Merge master into staging-nixos

Fix #557687, and also make Profile model pure instead of having
side-effects.

doc/interoperability/cyclonedx.md

@@ -39,7 +39,7 @@ The `nix:narinfo` properties should be accompanied by a `nix:store_path` propert
 | `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
 | `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
 | `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace-separated array of store paths that this component references. |
+| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
 
 ### `nix:fod` {#sec-interop.cylonedx-fod}
 

doc/release-notes/rl-2611.section.md

@@ -89,8 +89,6 @@
 
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
-- `writeTextFile` now uses structured attributes and `passAsFile` is no longer used or supported.
-
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -108,8 +106,6 @@
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
 
-- `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
-
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
 - LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
@@ -126,9 +122,6 @@
     Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
   - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
 
-- `replaceVarsWith` now enables `strictDeps` and `__structuredAttrs` and passing these attributes to the function is no longer allowed.
-   By extension, `replaceVars` now also enables `strictDeps` and `__structuredAttrs`.
-
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
 - `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.

doc/stdenv/stdenv.chapter.md

@@ -493,7 +493,7 @@ When using native compilation, `stdenv` is lenient towards incorrect placement o
 
 While convenient for getting to a package quickly, this behavior can break cross-compilation. Adding `strictDeps = true` as a parameter to `mkDerivation` or any of its language specific wrappers disables this behavior.
 
-The specialized `build*` functions for dlang, emacs, go, nim, ocaml, python, rust, and `tcl.mkTclDerivation` enable this option by default.
+The specialized `build*` functions for dlang, emacs, go, nim, ocaml, python, and rust enable this option by default.
 
 ## Attributes {#ssec-stdenv-attributes}
 

nixos/doc/manual/administration/systemd-state.section.md

@@ -47,6 +47,6 @@ form to `/var/log/journal/{machine-id}`; if (locally) persisting the entire log
 is desired, it is recommended to make all of `/var/log/journal` persistent.
 
 If not, one can set `Storage=volatile` in {manpage}`journald.conf(5)`
-([`services.journald.storage = "volatile";`](#opt-services.journald.storage)),
+([`services.journald.settings.Journal.Storage = "volatile";`](#opt-services.journald.settings.Journal)),
 which disables journal persistence and causes it to be written to
 `/run/log/journal`.

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -371,7 +371,6 @@ let
           "gfxmenu"
           "gfxterm"
           "gfxterm_background"
-          "gfxterm_menu"
           "test"
           "loadenv"
           "all_video"

nixos/modules/profiles/bashless.nix

@@ -31,6 +31,8 @@
   # Relies on bash scripts
   powerManagement.enable = lib.mkDefault false;
   users.manageLingering = lib.mkDefault false;
+  # Relies on the gzip command which depends on bash
+  services.logrotate.enable = lib.mkDefault false;
   # The resize helper pulls in bash
   services.lvm.resizeHelper.enable = false;
 

nixos/modules/services/audio/mpd.nix

@@ -84,6 +84,7 @@ let
           }
         }
       '';
+      __structuredAttrs = true;
     };
     checkPhase = ''
       printf "%s" "$expectScript" | ${lib.getExe pkgs.buildPackages.expect} -f -

nixos/modules/services/cluster/hadoop/hbase.nix

@@ -167,7 +167,7 @@ in
       zookeeperQuorum = lib.mkOption {
         description = ''
           This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
-          Comma-separated list of servers in the ZooKeeper ensemble.
+          Comma separated list of servers in the ZooKeeper ensemble.
         '';
         type = with lib.types; nullOr commas;
         example = "zk1.internal,zk2.internal,zk3.internal";

nixos/modules/services/logging/rsyslogd.nix

@@ -84,6 +84,8 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
     environment.systemPackages = [ pkgs.rsyslog ];
 
     systemd.services.syslog = {

nixos/modules/services/logging/syslog-ng.nix

@@ -77,6 +77,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
     systemd.services.syslog-ng = {
       description = "syslog-ng daemon";
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/supplicant.nix

@@ -226,7 +226,7 @@ in
         The value of this option is an attribute set. Each attribute configures a
         {command}`wpa_supplicant` service, where the attribute name specifies
         the name of the interface that {command}`wpa_supplicant` operates on.
-        The attribute name can be a space-separated list of interfaces.
+        The attribute name can be a space separated list of interfaces.
         The attribute names `WLAN`, `LAN` and `DBUS`
         have a special meaning. `WLAN` and `LAN` are
         configurations for universal {command}`wpa_supplicant` service that is

nixos/modules/services/networking/vsftpd.nix

@@ -168,7 +168,7 @@ in
         default = pkgs.writeText "userlist" (concatMapStrings (x: "${x}\n") cfg.userlist);
         defaultText = literalExpression ''pkgs.writeText "userlist" (concatMapStrings (x: "''${x}\n") cfg.userlist)'';
         description = ''
-          Newline-separated list of names to be allowed/denied if {option}`userlistEnable`
+          Newline separated list of names to be allowed/denied if {option}`userlistEnable`
           is `true`. Meaning see {option}`userlistDeny`.
 
           The default is a file containing the users from {option}`userlist`.

nixos/modules/system/boot/loader/limine/limine.nix

@@ -360,7 +360,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A semicolon-separated array of 8 colors in the format RRGGBB:
+            A ; seperated array of 8 colors in the format RRGGBB:
             black, red, green, brown, blue, magenta, cyan, and gray.
           '';
         };
@@ -369,7 +369,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A semicolon-separated array of 8 colors in the format RRGGBB:
+            A ; seperated array of 8 colors in the format RRGGBB:
             dark gray, bright red, bright green, yellow, bright blue, bright magenta, bright cyan, and white.
           '';
         };

nixos/modules/system/boot/systemd/journald.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   utils,
   ...
 }:
@@ -10,111 +9,65 @@ let
 in
 {
   imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "storage" ]
+      [ "services" "journald" "settings" "Journal" "Storage" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitInterval" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitIntervalSec" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitBurst" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitBurst" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "forwardToSyslog" ]
+      [ "services" "journald" "settings" "Journal" "ForwardToSyslog" ]
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "journald"
+        "console"
+      ]
+      "Use services.journald.settings.Journal.ForwardToConsole and services.journald.settings.Journal.TTYPath instead."
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "audit" ]
+      [ "services" "journald" "settings" "Journal" "Audit" ]
+    )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "journald"
+      "extraConfig"
+    ] "Use services.journald.settings.Journal instead.")
   ];
 
   options = {
-    services.journald.console = lib.mkOption {
-      default = "";
-      type = lib.types.str;
-      description = "If non-empty, write log messages to the specified TTY device.";
-    };
-
-    services.journald.rateLimitInterval = lib.mkOption {
-      default = "30s";
-      type = lib.types.str;
+    services.journald.settings.Journal = lib.mkOption {
+      default = { };
+      example = {
+        Storage = "volatile";
+        ForwardToConsole = true;
+        TTYPath = "/dev/tty12";
+      };
       description = ''
-        Configures the rate limiting interval that is applied to all
-        messages generated on the system. This rate limiting is applied
-        per-service, so that two services which log do not interfere with
-        each other's limit. The value may be specified in the following
-        units: s, min, h, ms, us. To turn off any kind of rate limiting,
-        set either value to 0.
-
-        See {option}`services.journald.rateLimitBurst` for important
-        considerations when setting this value.
-      '';
-    };
-
-    services.journald.storage = lib.mkOption {
-      default = "persistent";
-      type = lib.types.enum [
-        "persistent"
-        "volatile"
-        "auto"
-        "none"
-      ];
-      description = ''
-        Controls where to store journal data. See
-        {manpage}`journald.conf(5)` for further information.
-      '';
-    };
-
-    services.journald.rateLimitBurst = lib.mkOption {
-      default = 10000;
-      type = lib.types.int;
-      description = ''
-        Configures the rate limiting burst limit (number of messages per
-        interval) that is applied to all messages generated on the system.
-        This rate limiting is applied per-service, so that two services
-        which log do not interfere with each other's limit.
-
-        Note that the effective rate limit is multiplied by a factor derived
-        from the available free disk space for the journal as described on
-        {manpage}`journald.conf(5)`.
-
-        Note that the total amount of logs stored is limited by journald settings
-        such as `SystemMaxUse`, which defaults to 10% the file system size
-        (capped at max 4GB), and `SystemKeepFree`, which defaults to 15% of the
-        file system size.
-
-        It is thus recommended to compute what period of time that you will be
-        able to store logs for when an application logs at full burst rate.
-        With default settings for log lines that are 100 Bytes long, this can
-        amount to just a few hours.
-      '';
-    };
-
-    services.journald.audit = lib.mkOption {
-      default = "keep";
-      type = lib.types.oneOf [
-        lib.types.bool
-        (lib.types.enum [ "keep" ])
-      ];
-      description = ''
-        If enabled systemd-journald will turn on auditing on start-up.
-        If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
-
-        NixOS defaults to leaving this unset as enabling audit without auditd running leads to spamming /dev/kmesg with random messages
-        and if you enable auditd then auditd is responsible for turning auditing on.
-
-        If you want to have audit logs in journald and do not mind audit logs also ending up in /dev/kmesg you can set this option to true.
-
-        If you want to for some ununderstandable reason disable auditing if auditd enabled it then you can set this option to false.
-        It is of NixOS' opinion that setting this to false is definitely the wrong thing to do - but it's an option.
-      '';
-    };
-
-    services.journald.extraConfig = lib.mkOption {
-      default = "";
-      type = lib.types.lines;
-      example = "Storage=volatile";
-      description = ''
-        Extra config options for systemd-journald. See {manpage}`journald.conf(5)`
-        for available options.
-      '';
-    };
-
-    services.journald.forwardToSyslog = lib.mkOption {
-      default = config.services.rsyslogd.enable || config.services.syslog-ng.enable;
-      defaultText = lib.literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
-      type = lib.types.bool;
-      description = ''
-        Whether to forward log messages to syslog.
+        Options for the systemd journal service. See {manpage}`journald.conf(5)`
+        man page for available options.
       '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
     };
   };
 
   config = {
+    services.journald.settings.Journal = {
+      # "keep" isn't systemd's default since v258, so set it explicitly.
+      Audit = lib.mkOptionDefault "keep";
+    };
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-journald.socket"
       "systemd-journald@.socket"
@@ -136,23 +89,8 @@ in
       "sockets.target"
     ];
 
-    environment.etc = {
-      "systemd/journald.conf".text = ''
-        [Journal]
-        Storage=${cfg.storage}
-        RateLimitInterval=${cfg.rateLimitInterval}
-        RateLimitBurst=${toString cfg.rateLimitBurst}
-        ${lib.optionalString (cfg.console != "") ''
-          ForwardToConsole=yes
-          TTYPath=${cfg.console}
-        ''}
-        ${lib.optionalString (cfg.forwardToSyslog) ''
-          ForwardToSyslog=yes
-        ''}
-        Audit=${utils.systemdUtils.lib.toOption cfg.audit}
-        ${cfg.extraConfig}
-      '';
-    };
+    environment.etc."systemd/journald.conf".text =
+      utils.systemdUtils.lib.settingsToSections cfg.settings;
 
     users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
 

nixos/modules/testing/test-instrumentation.nix

@@ -233,11 +233,11 @@ in
     environment.systemPackages = [ pkgs.xwininfo ];
 
     # Log everything to the serial console.
-    services.journald.extraConfig = ''
-      ForwardToConsole=yes
-      TTYPath=/dev/${qemu-common.qemuSerialDevice}
-      MaxLevelConsole=debug
-    '';
+    services.journald.settings.Journal = {
+      ForwardToConsole = true;
+      TTYPath = "/dev/${qemu-common.qemuSerialDevice}";
+      MaxLevelConsole = "debug";
+    };
 
     systemd.settings.Manager = managerSettings;
     systemd.user.settings.Manager = {

nixos/tests/grub/basic.nix

@@ -49,7 +49,7 @@
     grub_select_all_configurations()
     with subtest("Invalid credentials are rejected"):
         grub_login_as("wronguser", "wrongsecret")
-        machine.wait_for_console_text("error: access denied.")
+        machine.wait_for_console_text("access denied")
 
     grub_select_all_configurations()
     with subtest("Valid credentials are accepted"):

nixos/tests/rsyslogd.nix

@@ -13,10 +13,11 @@ with pkgs.lib;
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
     nodes.machine =
-      { config, pkgs, ... }:
+      { lib, ... }:
       {
         services.rsyslogd.enable = true;
-        services.journald.forwardToSyslog = false;
+        # Verify that the module's option default remains overridable by downstream defaults.
+        services.journald.settings.Journal.ForwardToSyslog = lib.mkDefault false;
       };
 
     # ensure rsyslogd isn't receiving messages from journald if explicitly disabled
@@ -31,7 +32,7 @@ with pkgs.lib;
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
     nodes.machine =
-      { config, pkgs, ... }:
+      { ... }:
       {
         services.rsyslogd.enable = true;
       };

nixos/tests/systemd-journal.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   name = "systemd-journal";
@@ -14,7 +14,8 @@
     security.audit.enable = true;
   };
   nodes.journaldAudit = {
-    services.journald.audit = true;
+    # Verify that the module's option default remains overridable by downstream defaults.
+    services.journald.settings.Journal.Audit = lib.mkDefault true;
     security.audit.enable = true;
   };
   nodes.containerCheck = {
@@ -45,6 +46,7 @@
 
     with subtest("journald audit"):
       journaldAudit.wait_for_unit("multi-user.target")
+      journaldAudit.succeed("grep -Fx 'Audit=true' /etc/systemd/journald.conf")
 
       # logs should end up in the journald
       journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")

nixos/tests/systemd.nix

@@ -35,7 +35,7 @@
         KExecWatchdogSec = "5min";
       };
       systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
-      services.journald.extraConfig = "Storage=volatile";
+      services.journald.settings.Journal.Storage = "volatile";
       test-support.displayManager.auto.user = "alice";
 
       systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/test".source =

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1001";
+  version = "9.2.0782";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-dV1rqGt10gNb2jBABfaLQ5Noqt8hb0WcCBBSChDfAFA=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/misc/inochi2d/default.nix

@@ -36,7 +36,7 @@ in
     patches = [
       # Upstream asks that we change the bug tracker URL to not point to the upstream bug tracker
       (replaceVars ./support-url.patch {
-        assignees = "TomaSajt"; # should be a comma-separated list of the github usernames of the maintainers
+        assignees = "TomaSajt"; # should be a comma separated list of the github usernames of the maintainers
       })
       # Change how duplicate locales differentiate themselves (the store paths were too long)
       ./translations.patch

pkgs/build-support/fetchbzr/default.nix

@@ -17,9 +17,6 @@ lib.fetchers.withNormalizedHash { } (
     builder = ./builder.sh;
     nativeBuildInputs = [ breezy ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 

pkgs/build-support/fetchcvs/default.nix

@@ -29,9 +29,6 @@ lib.makeOverridable (
         openssh
       ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchdarcs/default.nix

@@ -27,9 +27,6 @@ lib.makeOverridable (
         darcs
       ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchfirefoxaddon/default.nix

@@ -1,5 +1,5 @@
 {
-  stdenvNoCC,
+  stdenv,
   fetchurl,
   jq,
   strip-nondeterminism,
@@ -35,7 +35,7 @@ let
           ;
       };
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation {
   inherit name;
 
   passthru = {
@@ -62,7 +62,4 @@ stdenvNoCC.mkDerivation {
     unzip
     zip
   ];
-
-  strictDeps = true;
-  __structuredAttrs = true;
 }

pkgs/build-support/fetchfossil/default.nix

@@ -22,9 +22,6 @@ lib.fetchers.withNormalizedHash { } (
       cacert
     ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
     # Envvar docs are hard to find. A link for the future:
     # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
     impureEnvVars = [ "http_proxy" ];

pkgs/build-support/fetchgit/default.nix

@@ -155,8 +155,6 @@ lib.makeOverridable (
           ++ lib.optionals fetchLFS [ git-lfs ]
           ++ nativeBuildInputs;
 
-          strictDeps = true;
-
           hash =
             if outputHashAlgo == null || outputHash == "" || lib.hasPrefix outputHashAlgo outputHash then
               outputHash

pkgs/build-support/fetchhg/default.nix

@@ -24,9 +24,6 @@ lib.extendMkDerivation {
       builder = ./builder.sh;
       nativeBuildInputs = [ mercurial ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       subrepoClause = lib.optionalString fetchSubrepos "S";

pkgs/build-support/fetchitchio/default.nix

@@ -85,8 +85,6 @@ lib.extendMkDerivation {
         ]
         ++ nativeBuildInputs;
 
-        strictDeps = true;
-
         inherit preferLocalBuild;
 
         # ENV

pkgs/build-support/fetchmavenartifact/default.nix

@@ -84,10 +84,6 @@ in
 stdenv.mkDerivation {
   inherit pname version meta;
   dontUnpack = true;
-
-  strictDeps = true;
-  __structuredAttrs = true;
-
   # By moving the jar to $out/share/java we make it discoverable by java
   # packages packages that mention this derivation in their buildInputs.
   installPhase = ''

pkgs/build-support/fetchpijul/default.nix

@@ -33,8 +33,6 @@ lib.makeOverridable (
       ];
       strictDeps = true;
 
-      __structuredAttrs = true;
-
       dontUnpack = true;
       dontConfigure = true;
       dontBuild = true;
@@ -43,7 +41,7 @@ lib.makeOverridable (
         runHook preInstall
 
         success=
-        for remote in "''${remotes[@]}"; do
+        for remote in $remotes; do
           if
             pijul clone \
               ''${change:+--change "$change"} \

pkgs/build-support/fetchsvn/default.nix

@@ -66,12 +66,7 @@ else
     ]
     ++ lib.optional sshSupport openssh;
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
-    env = lib.optionalAttrs sshSupport {
-      SVN_SSH = lib.getExe buildPackages.openssh;
-    };
+    SVN_SSH = if sshSupport then "${buildPackages.openssh}/bin/ssh" else null;
 
     outputHashAlgo = if hash != "" then null else "sha256";
     outputHashMode = "recursive";

pkgs/build-support/fetchsvnrevision/default.nix

@@ -2,7 +2,7 @@ runCommand: subversion: repository:
 import (
   runCommand "head-revision"
     {
-      nativeBuildInputs = [ subversion ];
+      buildInputs = [ subversion ];
       dummy = builtins.currentTime;
     }
     ''

pkgs/build-support/fetchsvnssh/builder.sh

@@ -1,5 +1,9 @@
 echo "exporting $url (r$rev) into $out"
 
+if test "$sshSupport"; then
+    export SVN_SSH="$openssh/bin/ssh"
+fi
+
 # Pipe the "p" character into Subversion to force it to accept the
 # server's certificate.  This is perfectly safe: we don't care
 # whether the server is being spoofed --- only the cryptographic

pkgs/build-support/fetchsvnssh/default.nix

@@ -24,13 +24,6 @@ lib.fetchers.withNormalizedHash { } (
       expect
     ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
-    env = lib.optionalAttrs sshSupport {
-      SVN_SSH = lib.getExe openssh;
-    };
-
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 
@@ -41,6 +34,8 @@ lib.fetchers.withNormalizedHash { } (
       password
       url
       rev
+      sshSupport
+      openssh
       ;
   }
 )

pkgs/build-support/go/module.nix

@@ -322,7 +322,7 @@ lib.extendMkDerivation {
               getGoDirs() {
                 local -r type="$1"
 
-                # Support structuredAttrs, they are not space separated
+                # Support strucuredAttrs, they are not space seperated
                 local -a subPackagesArray
                 concatTo subPackagesArray subPackages
 

pkgs/build-support/pkg-config-wrapper/default.nix

@@ -180,8 +180,6 @@ stdenv.mkDerivation {
       ;
   };
 
-  __structuredAttrs = true;
-
   meta =
     let
       pkg-config_ = optionalAttrs (pkg-config != null) pkg-config;

pkgs/build-support/replace-vars/replace-vars-with.nix

@@ -81,8 +81,6 @@ let
     dontUnpack = true;
     preferLocalBuild = true;
     allowSubstitutes = false;
-    strictDeps = true;
-    __structuredAttrs = true;
 
     buildPhase = ''
       runHook preBuild

pkgs/build-support/trivial-builders/default.nix

@@ -108,7 +108,9 @@ rec {
 
     extendDrvArgs =
       let
+        defaultPassAsFile = [ "text" ];
         removedDerivationNames = [
+          "passAsFile"
           "meta"
           "passthru"
         ];
@@ -147,9 +149,7 @@ rec {
               Ensure that the path starts with a / and specifies at least the filename.
             '';
           destination;
-
-        __structuredAttrs = true;
-        strictDeps = true;
+        passAsFile = defaultPassAsFile ++ derivationArgs.passAsFile or [ ];
 
         buildCommand = ''
           target=$out$destination

pkgs/by-name/ab/abella/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   rsync,
   ocamlPackages,
   dune,
@@ -17,15 +16,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-80b/RUpE3KRY0Qu8eeTxAbk6mwGG6jVTPOP0qFjyj2M=";
   };
 
-  patches = [
-    # Compatibility with OCaml 5.5
-    (fetchpatch {
-      url = "https://github.com/abella-prover/abella/commit/85dd329c03bf8866975ca0ea7278553d64f8d17f.patch";
-      includes = [ "src/*.ml" ];
-      hash = "sha256-adS2QGwqhLjiZo/Q4KUbpJVp8D/eNy/Ux17/nY3XMh4=";
-    })
-  ];
-
   strictDeps = true;
   __structuredAttrs = true;
 

pkgs/by-name/ap/apache-orc/package.nix

@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
     (lib.cmakeBool "BUILD_JAVA" false)
     (lib.cmakeBool "STOP_BUILD_ON_WARNING" false)
     (lib.cmakeBool "INSTALL_VENDORED_LIBS" false)

pkgs/by-name/bl/bluez-headers/package.nix

@@ -24,8 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
   dontConfigure = true;
   dontBuild = true;
 
-  strictDeps = true;
-
   installPhase = ''
     mkdir -p $out/include/
     cp -rv lib/* "$out/include/"
@@ -35,8 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
     inherit bluez; # inherits bluez-headers.src
   };
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://bluez.github.io/";
     description = "Official Linux Bluetooth protocol stack";

pkgs/by-name/bl/bluez/package.nix

@@ -33,12 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./lreadline.patch
-    # https://github.com/bluez/bluez/issues/2282
-    (fetchpatch2 {
-      name = "fix-uuid-discovery-segfault";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=82af2beafc39510e2c4a439bf44faea711d6503f";
-      hash = "sha256-Zf5J4USdfwKe7DVfivyj2q15LPy2GkUqVUq2tE1bG6M=";
-    })
   ];
 
   buildInputs = [

pkgs/by-name/by/byacc/package.nix

@@ -16,8 +16,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
-  strictDeps = true;
-
   configureFlags = [
     # change yacc to byacc
     "--program-transform-name='s,^,b,'"
@@ -29,8 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/byacc $out/bin/yacc
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://invisible-island.net/byacc/byacc.html";
     description = "Berkeley YACC";

pkgs/by-name/cm/cmake/package.nix

@@ -4,7 +4,6 @@
   fetchurl,
   replaceVars,
   buildPackages,
-  bashNonInteractive,
   bzip2,
   curlMinimal,
   expat,
@@ -110,24 +109,20 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals buildDocs [ texinfo ]
     ++ lib.optionals qt5UI [ wrapQtAppsHook ];
 
-  buildInputs = [
-    bashNonInteractive
-  ]
-  ++ lib.optionals useSharedLibraries [
-    bzip2
-    curlMinimal
-    expat
-    libarchive
-    xz
-    zlib
-    libuv
-    rhash
-  ]
-  ++ lib.optional useOpenSSL openssl
-  ++ lib.optional cursesUI ncurses
-  ++ lib.optional qt5UI qtbase;
-
-  strictDeps = true;
+  buildInputs =
+    lib.optionals useSharedLibraries [
+      bzip2
+      curlMinimal
+      expat
+      libarchive
+      xz
+      zlib
+      libuv
+      rhash
+    ]
+    ++ lib.optional useOpenSSL openssl
+    ++ lib.optional cursesUI ncurses
+    ++ lib.optional qt5UI qtbase;
 
   # bootstrap is not autoconf and rejects --enable-static/--disable-shared
   # FIXME: rebuild avoidance, drop optionalDrvAttr in staging
@@ -139,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
     # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
-    configureFlags=("--parallel=''${NIX_BUILD_CORES:-1}" "CC=$CC_FOR_BUILD" "CXX=$CXX_FOR_BUILD" ''${configureFlags[@]} ''${cmakeFlags[@]})
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags $cmakeFlags"
   ''
   + lib.optionalString (stdenv.hostPlatform.isStatic && useSharedLibraries) ''
     # FindLibArchive ignores libarchive.pc's Libs.private
@@ -211,8 +206,6 @@ stdenv.mkDerivation (finalAttrs: {
     ignoredVersions = "-"; # -rc1 and friends
   };
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://cmake.org/";
     description = "Cross-platform, open-source build system generator";

pkgs/by-name/cu/curlMinimal/package.nix

@@ -113,17 +113,28 @@ stdenv.mkDerivation (finalAttrs: {
   #
   # Where the host has no shell at all, `patchShebangs --host` finds nothing
   # and leaves the shebang as shipped, which is the best available answer.
-  + ''
-    local f flag
-    for f in scripts/*; do
-      if [[ "$f" == scripts/wcurl ]]; then
-        flag=--host
-      else
-        flag=--build
-      fi
-      patchShebangs "$flag" "$f"
-    done
-  '';
+  #
+  # TODO: take the first branch unconditionally --- in the spirit of strictDeps,
+  # it is good to always be defensive rather than do something unnecessarily
+  # that we can only get away with when build == host.
+  + (
+    if isCross then
+      ''
+        local f flag
+        for f in scripts/*; do
+          if [[ "$f" == scripts/wcurl ]]; then
+            flag=--host
+          else
+            flag=--build
+          fi
+          patchShebangs "$flag" "$f"
+        done
+      ''
+    else
+      ''
+        patchShebangs scripts
+      ''
+  );
 
   outputs = [
     "bin"
@@ -278,7 +289,13 @@ stdenv.mkDerivation (finalAttrs: {
   # Some hosts have no shell for the scripts to point at: MinGW is the one in
   # tree, where `bash` is marked unsupported because it needs a POSIX layer. We
   # cannot patch shebangs in that case.
-  buildInputs = lib.optional (lib.meta.availableOn stdenv.hostPlatform runtimeShellPackage) runtimeShellPackage;
+  #
+  # TODO: drop the isCross part of the condition --- in the spirit of
+  # `strictDeps` it is good to have the dep (when it is available), even if it
+  # is gratuitous in the `build = host` case.
+  buildInputs = lib.optional (
+    isCross && lib.meta.availableOn stdenv.hostPlatform runtimeShellPackage
+  ) runtimeShellPackage;
 
   passthru =
     let

pkgs/by-name/de/dejagnu/package.nix

@@ -2,7 +2,6 @@
   fetchurl,
   lib,
   stdenv,
-  bashNonInteractive,
   expect,
   makeWrapper,
   updateAutotoolsGnuConfigScriptsHook,
@@ -14,19 +13,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/dejagnu/dejagnu-${finalAttrs.version}.tar.gz";
-    hash = "sha256-h9rvrNeVi0pp+IxoVtvRY0JhljxBQHnQw3H1ic1mouM=";
+    sha256 = "1qx2cv6qkxbiqg87jh217jb62hk3s7dmcs4cz1llm2wmsynfznl7";
   };
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     makeWrapper
   ];
-  buildInputs = [
-    bashNonInteractive
-    expect
-  ];
-
-  strictDeps = true;
+  buildInputs = [ expect ];
 
   # dejagnu-1.6.3 can't successfully run tests in source tree:
   #   https://wiki.linuxfromscratch.org/lfs/ticket/4871
@@ -59,8 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Framework for testing other programs";
 

pkgs/by-name/di/diffoscope/package.nix

@@ -50,7 +50,7 @@
   lz4,
   lzip,
   mono,
-  ocaml-ng,
+  ocaml,
   odt2txt,
   oggvideotools,
   openssh,
@@ -231,7 +231,7 @@ python.pkgs.buildPythonApplication rec {
         libcaca
         llvm
         mono
-        ocaml-ng.ocamlPackages_5_4.ocaml
+        ocaml
         odt2txt
         oggvideotools
         openssh

pkgs/by-name/dp/dpkg/package.nix

@@ -16,6 +16,7 @@
   diffutils,
   versionCheckHook,
   glibc,
+  bashNonInteractive,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -113,7 +114,9 @@ stdenv.mkDerivation (finalAttrs: {
     xz
     zstd
     libmd
+    bashNonInteractive
   ];
+
   nativeBuildInputs = [
     makeWrapper
     perl
@@ -121,6 +124,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   postInstall = ''
     for i in $out/bin/*; do
       if head -n 1 $i | grep -q perl; then
@@ -138,6 +143,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = ./setup-hook.sh;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Debian package manager";
     homepage = "https://wiki.debian.org/Teams/Dpkg";

pkgs/by-name/ed/ed/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ed";
-  version = "1.22.6";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "mirror://gnu/ed/ed-${finalAttrs.version}.tar.lz";
-    hash = "sha256-PzOyITUhnDnDxpX3txccJWfT4qF8eYwKkGBzIMuyaPI=";
+    hash = "sha256-VuEH3cLyna1mkDdsFb+XUVCeHuO4JBcQ5E7b5cOhWMw=";
   };
 
   nativeBuildInputs = [ lzip ];

pkgs/by-name/el/eltclsh/package.nix

@@ -9,13 +9,13 @@
   tk,
 }:
 
-tcl.mkTclDerivation (finalAttrs: {
+tcl.mkTclDerivation rec {
   pname = "eltclsh";
   version = "1.20";
 
   src = fetchgit {
     url = "https://git.openrobots.org/robots/eltclsh.git";
-    tag = "eltclsh-${finalAttrs.version}";
+    rev = "eltclsh-${version}";
     hash = "sha256-kNUT190DkY+NNUmBwHfSxgBLbSyc0MutVDLsRh7kFDE=";
   };
 
@@ -46,4 +46,4 @@ tcl.mkTclDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ iwanb ];
     platforms = lib.platforms.all;
   };
-})
+}

pkgs/by-name/ex/expand-response-params/package.nix

@@ -26,8 +26,6 @@ stdenv.mkDerivation {
     mv expand-response-params${stdenv.hostPlatform.extensions.executable} $prefix/bin/
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
     longDescription = ''

pkgs/by-name/fo/fortify-headers/package.nix

@@ -21,8 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./restore-macros.patch
   ];
 
-  strictDeps = true;
-
   dontBuild = true;
 
   installPhase = ''
@@ -38,8 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     url = "git://git.2f30.org/fortify-headers";
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Standalone header-based fortify-source implementation";
     homepage = "https://git.2f30.org/fortify-headers";

pkgs/by-name/gl/glib/package.nix

@@ -9,6 +9,7 @@
   pkg-config,
   perl,
   python3,
+  python3Packages,
   libiconv,
   zlib,
   libffi,
@@ -77,8 +78,6 @@ let
     &&
       # dtrace support requires sys/sdt.h header
       lib.meta.availableOn stdenv.hostPlatform libsystemtap;
-
-  withSysprofCapture = !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isFreeBSD;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -162,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     finalAttrs.setupHook
   ]
-  ++ lib.optionals withSysprofCapture [
+  ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
     libsysprof-capture
   ]
   ++ [
@@ -194,6 +193,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     perl
     python3
+    python3Packages.packaging # mostly used to make meson happy
+    python3Packages.wrapPython # for patchPythonScript
     gettext
     libxslt
   ]
@@ -232,12 +233,13 @@ stdenv.mkDerivation (finalAttrs: {
     # FIXME: Fails when linking target glib/tests/libconstructor-helper.so
     # relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a shared object
     "-Dtests=${lib.boolToString (!stdenv.hostPlatform.isStatic)}"
-    (lib.mesonEnable "libelf" (lib.meta.availableOn stdenv.hostPlatform elfutils))
-    # sysprof-capture does not build on Windows
-    (lib.mesonEnable "sysprof" withSysprofCapture)
+  ]
+  ++ lib.optionals (!lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    "-Dlibelf=disabled"
   ]
   ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     "-Dxattr=false"
+    "-Dsysprof=disabled" # sysprof-capture does not build on FreeBSD
   ];
 
   env = {
@@ -293,6 +295,11 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
+  preFixup = lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+    buildPythonPath ${python3Packages.packaging}
+    patchPythonScript "$dev/share/glib-2.0/codegen/utils.py"
+  '';
+
   # Move man pages to the same output as their binaries (needs to be
   # done after preFixupHooks which moves man pages too - in
   # _multioutDocs)

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-07-23";
+      _version = "0-unstable-2026-05-27";
     in
     _version,
-  rev ? "641ace93dd9560e75e7add0d08f77b446fbb3b78",
-  hash ? "sha256-ovLx6KaORdXqnWgbsGEty10k2CHuCmTk3yEqy5//ovk=",
+  rev ? "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+  hash ? "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch

@@ -1,42 +1,86 @@
+From dc1b837925f7c2ee6663cf34bbd982e0b368d811 Mon Sep 17 00:00:00 2001
+From: hustlerone <nine-ball@tutanota.com>
+Date: Sun, 18 Jan 2026 11:57:36 +0100
+Subject: [PATCH] Add hidden menu entries
+
+Merge conflicts manually resolved.
+
+https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
+https://marc.info/?l=grub-devel&m=146193404929072&w=2
+
+Vendored in:
+https://build.opensuse.org/projects/openSUSE:Factory/packages/grub2/files/grub2-Add-hidden-menu-entries.patch?expand=1
+---
+ grub-core/commands/blsuki.c    |  4 ++--
+ grub-core/commands/legacycfg.c |  4 ++--
+ grub-core/commands/menuentry.c | 22 +++++++++++++++++-----
+ grub-core/normal/menu.c        | 30 ++++++++++++++++++++++++++----
+ grub-core/normal/menu_text.c   |  6 +++++-
+ include/grub/menu.h            |  2 ++
+ include/grub/normal.h          |  2 +-
+ 7 files changed, 55 insertions(+), 15 deletions(-)
+
+diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c
+index 4133d3111..26055f91f 100644
+--- a/grub-core/commands/blsuki.c
++++ b/grub-core/commands/blsuki.c
+@@ -1022,7 +1022,7 @@ bls_create_entry (grub_blsuki_entry_t *entry)
+ 			linux_cmd, initrd_cmd ? initrd_cmd : "",
+ 			dt_cmd ? dt_cmd : "");
+ 
+-  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry);
++  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (linux_cmd);
+@@ -1088,7 +1088,7 @@ uki_create_entry (grub_blsuki_entry_t *entry)
+ 			(options != NULL) ? " " : "",
+ 			(options != NULL) ? options : "");
+ 
+-  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry);
++  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (argv);
 diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
-index e9e9d94ef..54e08a1b4 100644
+index 7d9f9eb3c..bb5b7b3ad 100644
 --- a/grub-core/commands/legacycfg.c
 +++ b/grub-core/commands/legacycfg.c
 @@ -143,7 +143,7 @@ legacy_file (const char *filename)
  	    args[0] = oldname;
  	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
  					NULL, NULL,
--					entrysrc, 0);
-+					entrysrc, 0, 0);
+-					entrysrc, 0, NULL);
++					entrysrc, 0, NULL, 0);
  	    grub_free (args);
  	    entrysrc[0] = 0;
  	    grub_free (oldname);
-@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+@@ -204,7 +204,7 @@ legacy_file (const char *filename)
  	}
        args[0] = entryname;
        grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
--				  NULL, NULL, entrysrc, 0);
-+				  NULL, NULL, entrysrc, 0, 0);
+-				  NULL, NULL, entrysrc, 0, NULL);
++				  NULL, NULL, entrysrc, 0, NULL, 0);
        grub_free (args);
      }
  
 diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
-index 720e6d8ea..50632ccce 100644
+index 5e1318f17..288189b8d 100644
 --- a/grub-core/commands/menuentry.c
 +++ b/grub-core/commands/menuentry.c
 @@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
  			    char **classes, const char *id,
  			    const char *users, const char *hotkey,
  			    const char *prefix, const char *sourcecode,
--			    int submenu)
-+			    int submenu, int hidden)
+-			    int submenu, grub_blsuki_entry_t *blsuki)
++			    int submenu, grub_blsuki_entry_t *blsuki, int hidden)
  {
    int menu_hotkey = 0;
    char **menu_args = NULL;
-@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
-   (*last)->args = menu_args;
+@@ -189,8 +189,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
    (*last)->sourcecode = menu_sourcecode;
    (*last)->submenu = submenu;
+   (*last)->blsuki = blsuki;
 +  (*last)->hidden = hidden;
 +
 +  if (!hidden)
@@ -46,27 +90,28 @@ index 720e6d8ea..50632ccce 100644
    return GRUB_ERR_NONE;
  
   fail:
-@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
- 				       users,
+@@ -291,7 +294,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
  				       ctxt->state[2].arg, 0,
  				       ctxt->state[3].arg,
--				       ctxt->extcmd->cmd->name[0] == 's');
-+				       ctxt->extcmd->cmd->name[0] == 's',
+ 				       ctxt->extcmd->cmd->name[0] == 's',
+-				       NULL);
++				       NULL,
 +               ctxt->extcmd->cmd->name[0] == 'h');
  
    src = args[argc - 1];
    args[argc - 1] = NULL;
-@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -308,7 +312,9 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
  				  ctxt->state[0].args, ctxt->state[4].arg,
  				  users,
  				  ctxt->state[2].arg, prefix, src + 1,
--				  ctxt->extcmd->cmd->name[0] == 's');
+-				  ctxt->extcmd->cmd->name[0] == 's', NULL);
 +				  ctxt->extcmd->cmd->name[0] == 's',
++          NULL,
 +          ctxt->extcmd->cmd->name[0] == 'h');
  
    src[len - 1] = ch;
    args[argc - 1] = src;
-@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -316,7 +322,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
    return r;
  }
  
@@ -75,7 +120,7 @@ index 720e6d8ea..50632ccce 100644
  
  void
  grub_menu_init (void)
-@@ -327,6 +332,12 @@ grub_menu_init (void)
+@@ -332,6 +338,12 @@ grub_menu_init (void)
  				  | GRUB_COMMAND_FLAG_EXTRACTOR,
  				  N_("BLOCK"), N_("Define a submenu."),
  				  options);
@@ -89,10 +134,10 @@ index 720e6d8ea..50632ccce 100644
  
  void
 diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
-index 6a90e091f..4236f55bc 100644
+index b946c834d..483a3505c 100644
 --- a/grub-core/normal/menu.c
 +++ b/grub-core/normal/menu.c
-@@ -37,6 +37,8 @@
+@@ -38,6 +38,8 @@
     entry failing to boot.  */
  #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
  
@@ -101,7 +146,7 @@ index 6a90e091f..4236f55bc 100644
  grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
  				     int nested) = NULL;
  
-@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+@@ -81,8 +83,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
  {
    grub_menu_entry_t e;
  
@@ -124,7 +169,7 @@ index 6a90e091f..4236f55bc 100644
  
    return e;
  }
-@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+@@ -94,10 +108,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
    grub_menu_entry_t entry;
    int i;
  
@@ -137,7 +182,7 @@ index 6a90e091f..4236f55bc 100644
  
    return -1;
  }
-@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -510,6 +524,10 @@ get_entry_number (grub_menu_t menu, const char *name)
        grub_menu_entry_t e = menu->entry_list;
        int i;
  
@@ -148,7 +193,7 @@ index 6a90e091f..4236f55bc 100644
        grub_errno = GRUB_ERR_NONE;
  
        for (i = 0; e; i++)
-@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -521,6 +539,10 @@ get_entry_number (grub_menu_t menu, const char *name)
  	      break;
  	    }
  	  e = e->next;
@@ -160,10 +205,10 @@ index 6a90e091f..4236f55bc 100644
  
        if (! e)
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..d2e46cac8 100644
+index 9c383e64a..e55bafa6c 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
-@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+@@ -292,7 +292,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
        print_entry (data->geo.first_entry_y + i, data->offset == i,
  		   e, data);
        if (e)
@@ -177,10 +222,10 @@ index b1321eb26..d2e46cac8 100644
  
    grub_term_gotoxy (data->term,
 diff --git a/include/grub/menu.h b/include/grub/menu.h
-index ee2b5e910..eb8a86ba9 100644
+index 8d06e8400..f7a302081 100644
 --- a/include/grub/menu.h
 +++ b/include/grub/menu.h
-@@ -58,6 +58,8 @@ struct grub_menu_entry
+@@ -72,6 +72,8 @@ struct grub_menu_entry
  
    int submenu;
  
@@ -188,17 +233,20 @@ index ee2b5e910..eb8a86ba9 100644
 +
    /* The next element.  */
    struct grub_menu_entry *next;
- };
+ 
 diff --git a/include/grub/normal.h b/include/grub/normal.h
-index 218cbabcc..bcb412466 100644
+index d0150e3c2..4c1fe8ec1 100644
 --- a/include/grub/normal.h
 +++ b/include/grub/normal.h
 @@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
  			    const char *id,
  			    const char *users, const char *hotkey,
  			    const char *prefix, const char *sourcecode,
--			    int submenu);
-+			    int submenu, int hidden);
+-			    int submenu, grub_blsuki_entry_t *blsuki);
++			    int submenu, grub_blsuki_entry_t *blsuki, int hidden);
  
  grub_err_t
  grub_normal_set_password (const char *user, const char *password);
+-- 
+2.51.2
+

pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch

@@ -0,0 +1,13 @@
+diff --git a/bootstrap b/bootstrap
+index dc9fb4383..5d0e90a92 100755
+--- a/bootstrap
++++ b/bootstrap
+@@ -931,7 +931,7 @@ update_po_files() {
+   # Usually contains *.s1 checksum files.
+   ref_po_dir="$po_dir/.reference"
+ 
+-  test -d $ref_po_dir || mkdir $ref_po_dir || return
++  test -d $ref_po_dir && return || mkdir $ref_po_dir
+   download_po_files $ref_po_dir $domain \
+     && ls "$ref_po_dir"/*.po 2>/dev/null |
+       sed 's|.*/||; s|\.po$||' > "$po_dir/LINGUAS" || return

pkgs/by-name/gr/grub2/package.nix

@@ -1,12 +1,15 @@
 {
   lib,
   stdenv,
+  fetchurl,
   fetchgit,
   flex,
   bison,
   python3,
   autoconf,
+  autoconf-archive,
   automake,
+  autoreconfHook,
   libtool,
   bash,
   gettext,
@@ -23,6 +26,7 @@
   buildPackages,
   nixosTests,
   fuse3, # only needed for grub-mount
+  xz, # for xz compression support. Usually counterproductive, so don't try to force compression in your GRUB install.
   runtimeShell,
   zfs ? null,
   efiSupport ? false,
@@ -30,7 +34,8 @@
   zfsSupport ? false,
   xenSupport ? false,
   xenPvhSupport ? false,
-  kbdcompSupport ? false,
+  corebootSupport ? false,
+  kbdcompSupport ? corebootSupport,
   ckbcomp,
 }:
 
@@ -40,6 +45,11 @@ let
     x86_64-linux.target = "i386";
   };
 
+  corebootSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386";
+  };
+
   efiSystemsBuild = {
     i686-linux.target = "i386";
     x86_64-linux.target = "x86_64";
@@ -80,8 +90,8 @@ let
   inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);
 
   gnulib = fetchgit {
-    url = "https://git.savannah.gnu.org/git/gnulib.git";
-    # NOTE: keep in sync with bootstrap.conf!
+    url = "https://https.git.savannah.gnu.org/git/gnulib.git";
+    # NOTE: get $GNULIB_REVISION from bootstrap.conf!
     rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
     hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
   };
@@ -90,9 +100,12 @@ let
   # but those translations are not versioned/stable. For that reason
   # we take them from the nearest release tarball instead:
   locales = fetchzip {
-    url = "https://ftp.gnu.org/gnu/grub/grub-2.12.tar.gz";
-    hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w=";
+    url = "mirror://gnu/grub/grub-${version}.tar.gz";
+    hash = "sha256-NUlE6l8Ul3i1Si9mZgND6lnvFqc74EGptHV2iCtu+As=";
   };
+
+  # This is the variable that sets the GRUB release.
+  version = "2.14";
 in
 
 assert zfsSupport -> zfs != null;
@@ -103,505 +116,81 @@ assert lib.asserts.assertMsg (
       ieee1275Support
       xenSupport
       xenPvhSupport
+      corebootSupport
     ]
   ) <= 1 # (0 == pc)
 ) "Only <= 1 of grub2's platform-related *Support options may be enabled at the same time";
 
 stdenv.mkDerivation rec {
   pname = "grub";
-  version = "2.12";
+  inherit version;
 
   src = fetchgit {
-    url = "https://git.savannah.gnu.org/git/grub.git";
+    url = "https://gitlab.freedesktop.org/gnu-grub/grub.git";
     tag = "grub-${version}";
-    hash = "sha256-lathsBb2f7urh8R86ihpTdwo3h1hAHnRiHd5gCLVpBc=";
+    hash = "sha256-Gkpde5CeJOQ+0p5WGwXZ2P881jxrWkuFw3Fh4lul/so=";
   };
 
-  patches = [
-    ./fix-bash-completion.patch
-    ./add-hidden-menu-entries.patch
+  patches =
+    let
+      grubPatch = commit: "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/${commit}.patch";
+    in
+    [
+      ./fix-bash-completion.patch
+      ./add-hidden-menu-entries.patch
+      ./bootstrap-po-downloads.patch
 
-    # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
-    (fetchpatch {
-      name = "01_implement_grub_strlcpy.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f";
-      hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I=";
-    })
-    (fetchpatch {
-      name = "02_CVE-2024-45781.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba";
-      hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw=";
-    })
-    (fetchpatch {
-      name = "03_CVE-2024-45782_CVE-2024-56737.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3";
-      hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8=";
-    })
-    (fetchpatch {
-      name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d";
-      hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg=";
-    })
-    (fetchpatch {
-      name = "05_CVE-2024-45780.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3";
-      hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls=";
-    })
-    (fetchpatch {
-      name = "06_fs_f2fs_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3";
-      hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q=";
-    })
-    (fetchpatch {
-      name = "07_CVE-2024-45783.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898";
-      hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM=";
-    })
-    (fetchpatch {
-      name = "08_fs_iso9660_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97";
-      hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI=";
-    })
-    (fetchpatch {
-      name = "09_fs_iso9660_fix_invalid_free.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611";
-      hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI=";
-    })
-    (fetchpatch {
-      name = "10_fs_jfs_fix_oob_read_jfs_getent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb";
-      hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY=";
-    })
-    (fetchpatch {
-      name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7";
-      hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY=";
-    })
-    (fetchpatch {
-      name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef";
-      hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg=";
-    })
-    (fetchpatch {
-      name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28";
-      hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk=";
-    })
-    (fetchpatch {
-      name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c";
-      hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ=";
-    })
-    (fetchpatch {
-      name = "15_fs_ntfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732";
-      hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI=";
-    })
-    (fetchpatch {
-      name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a";
-      hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM=";
-    })
-    (fetchpatch {
-      name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71";
-      hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E=";
-    })
-    # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions
-    # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html
-    (fetchpatch {
-      name = "19_fs_xfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a";
-      hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE=";
-    })
-    (fetchpatch {
-      name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a";
-      hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg=";
-    })
-    (fetchpatch {
-      name = "21_kern_file_ensure_file_data_is_set.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17";
-      hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q=";
-    })
-    (fetchpatch {
-      name = "22_kern_file_implement_filesystem_reference_counting.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3";
-      hash = "sha256-5aFHzc5qXBNLEc6yzI17AH6J7EYogcXdLxk//1QgumY=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c";
-      hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173";
-      hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181";
-      hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95";
-      hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc";
-      hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8=";
-    })
-    (fetchpatch {
-      name = "23_CVE-2024-49504.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e";
-      hash = "sha256-GejDL9IKbmbSUmp8F1NuvBcFAp2/W04jxmOatI5dKn8=";
-    })
-    (fetchpatch {
-      name = "24_disk_loopback_reference_tracking_for_the_loopback.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae";
-      hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA=";
-    })
-    (fetchpatch {
-      name = "25_kern_disk_limit_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b";
-      hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw=";
-    })
-    (fetchpatch {
-      name = "26_kern_partition_limit_recursion_in_part_iterate.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a";
-      hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI=";
-    })
-    (fetchpatch {
-      name = "27_script_execute_limit_the_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1";
-      hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo=";
-    })
-    (fetchpatch {
-      name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d";
-      hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4=";
-    })
-    (fetchpatch {
-      name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401";
-      hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac=";
-    })
-    (fetchpatch {
-      name = "30_CVE-2025-0624.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1";
-      hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0=";
-    })
-    (fetchpatch {
-      name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367";
-      hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4=";
-    })
-    (fetchpatch {
-      name = "32_CVE-2024-45774.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f";
-      hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4=";
-    })
-    (fetchpatch {
-      name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d";
-      hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk=";
-    })
-    # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49)
-    # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12
-    (fetchpatch {
-      name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99";
-      hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg=";
-    })
-    (fetchpatch {
-      name = "36_CVE-2024-45775.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872";
-      hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY=";
-    })
-    (fetchpatch {
-      name = "37_commands_ls_fix_NULL_dereference.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56";
-      hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI=";
-    })
-    (fetchpatch {
-      name = "38_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726";
-      hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw=";
-    })
-    (fetchpatch {
-      name = "39_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67";
-      hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA=";
-    })
-    (fetchpatch {
-      name = "40_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637";
-      hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms=";
-    })
-    (fetchpatch {
-      name = "41_CVE-2024-45776.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91";
-      hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY=";
-    })
-    (fetchpatch {
-      name = "42_CVE-2024-45777.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515";
-      hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo=";
-    })
-    (fetchpatch {
-      name = "43_CVE-2025-0690.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc";
-      hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY=";
-    })
-    (fetchpatch {
-      name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af";
-      hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY=";
-    })
-    (fetchpatch {
-      name = "45_CVE-2025-1118.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f";
-      hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc=";
-    })
-    (fetchpatch {
-      name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c";
-      hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA=";
-    })
-    (fetchpatch {
-      name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99";
-      hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE=";
-    })
-    (fetchpatch {
-      name = "48_CVE-2024-45778_CVE-2024-45779.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630";
-      hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI=";
-    })
-    (fetchpatch {
-      name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74";
-      hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE=";
-    })
-    (fetchpatch {
-      name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa";
-      hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ=";
-    })
-    (fetchpatch {
-      name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f";
-      hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E=";
-    })
-    (fetchpatch {
-      name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464";
-      hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0=";
-    })
-    (fetchpatch {
-      name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753";
-      hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4=";
-    })
-    (fetchpatch {
-      name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek=";
-    })
-    (fetchpatch {
-      name = "55_CVE-2025-0678_CVE-2025-1125.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e";
-      hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4=";
-    })
-    (fetchpatch {
-      name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31";
-      hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys=";
-    })
-    (fetchpatch {
-      name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9";
-      hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA=";
-    })
-    (fetchpatch {
-      name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c";
-      hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk=";
-    })
-    (fetchpatch {
-      name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892";
-      hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0=";
-    })
-    (fetchpatch {
-      name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4";
-      hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o=";
-    })
-    (fetchpatch {
-      name = "61_net_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391";
-      hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg=";
-    })
-    (fetchpatch {
-      name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb";
-      hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk=";
-    })
-    (fetchpatch {
-      name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8";
-      hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388=";
-    })
-    (fetchpatch {
-      name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15";
-      hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU=";
-    })
-    (fetchpatch {
-      name = "65_script_execute_fix_potential_underflow_and_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e";
-      hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8=";
-    })
-    (fetchpatch {
-      name = "66_osdep_unix_getroot_fix_potential_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e";
-      hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc=";
-    })
-    (fetchpatch {
-      name = "67_misc_ensure_consistent_overflow_error_messages.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3";
-      hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI=";
-    })
-    (fetchpatch {
-      name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956";
-      hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I=";
-    })
-    (fetchpatch {
-      name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb";
-      hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM=";
-    })
-    (fetchpatch {
-      name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2";
-      hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI=";
-    })
-    (fetchpatch {
-      name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7";
-      hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg=";
-    })
-    (fetchpatch {
-      name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a";
-      hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8=";
-    })
-    (fetchpatch {
-      name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c";
-      hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4=";
-    })
-    (fetchpatch {
-      # Fixes 7e2f750f0a (security patch 14/73)
-      name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
-      hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
-    })
-    (fetchpatch {
-      name = "CVE-2025-4382.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d";
-      hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE=";
-    })
-    # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
-    (fetchpatch {
-      name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246";
-      hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk=";
-    })
-    (fetchpatch {
-      name = "2_CVE-2025-54771.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f";
-      hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY=";
-    })
-    (fetchpatch {
-      name = "3_CVE-2025-54770.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d";
-      hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ=";
-    })
-    (fetchpatch {
-      name = "4_CVE-2025-61662.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807";
-      hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM=";
-    })
-    (fetchpatch {
-      name = "5_CVE-2025-61663_CVE-2025-61664.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917";
-      hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8=";
-    })
-    (fetchpatch {
-      name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc";
-      hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI=";
-    })
-    (fetchpatch {
-      name = "7_CVE-2025-61661.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3";
-      hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY=";
-    })
-    (fetchpatch {
-      name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53";
-      hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw=";
-    })
-    # Required to apply the GCC-15 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bba7dd7363402157034e9c94ee3d9ea82e37861d";
-      hash = "sha256-KO9rE/9xRkIGi/Y6jv1gVPiAJZUejwaUW6kIWthPUhw=";
-    })
-    # Required to apply the GCC-11 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=db506b3b83640ab166a782e1ca47c47836afddcd";
-      hash = "sha256-4ucCu+9OZ8NoicLF9hCgUpX4xgJk4Gzu6F3P4zl9J3U=";
-    })
-    # Required to build grub 2.12 with GCC 15
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_1_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ac1512b872af8567b408518a7efa01607a0219ae";
-      hash = "sha256-deyp6Yatlgv86bYMt7WcWhKg8J6StDPUEy4UPHqJYIc=";
-    })
-    # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm'
-    # attribute ignored [-Werror=attributes]"
-    (fetchpatch {
-      name = "gcc16_make_regparm_attribute_more_conditional.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
-      hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
-    })
-  ];
+      /*
+        Fix parallel `msgmerge` race on de.po.
+        See https://gitlab.freedesktop.org/gnu-grub/grub/-/work_items/18
+        See https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
+      */
+      (fetchpatch {
+        name = "02_fix_msmerge.patch";
+        url = grubPatch "c2a215245e2e7d61da4f41945222bd761679ae11";
+        hash = "sha256-vBCDej/5DVX1NQMR05kNunxbmfyKywyYQtu4tg3Q2Cs=";
+      })
 
-  postPatch =
-    if kbdcompSupport then
-      ''
-        sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
-      ''
-    else
-      ''
-        echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
-        echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
-      '';
+      /*
+        The commit that we're reverting below breaks the `kernel.img` payload that's generated at runtime.
+
+        If we don't do this, we can't install GRUB.
+      */
+      (fetchpatch {
+        name = "01_fix_kernel-img_load_offset.patch";
+        url = grubPatch "1dc2986c7e8480d955f87d276d31400116a21fac";
+        hash = "sha256-T1V7Rklc7RNsKTwk2gLoWHxoXUlCM0/mxcnymqUcyRg=";
+      })
+
+      # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm' attribute ignored [-Werror=attributes]"
+      (fetchpatch {
+        name = "gcc16_make_regparm_attribute_more_conditional.patch";
+        url = grubPatch "9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
+        hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
+      })
+    ];
+
+  postPatch = ''
+    ${
+      if kbdcompSupport then
+        ''
+          sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
+        ''
+      else
+        ''
+          echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
+          echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
+        ''
+    }
+
+    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+      echo "This version of GRUB requires a different gnulib revision!"
+      echo "We have: ${gnulib.rev}"
+      echo "GRUB needs: $GNULIB_REVISION"
+      exit 1
+    fi
+  '';
 
   depsBuildBuild = [
     buildPackages.stdenv.cc
@@ -615,6 +204,7 @@ stdenv.mkDerivation rec {
     gettext
     freetype
     autoconf
+    autoconf-archive
     automake
     help2man
   ];
@@ -624,6 +214,7 @@ stdenv.mkDerivation rec {
     freetype
     lvm2
     fuse3
+    xz
     libtool
     bash
   ]
@@ -637,36 +228,31 @@ stdenv.mkDerivation rec {
   separateDebugInfo = !xenSupport;
 
   preConfigure = ''
-     for i in "tests/util/"*.in
-     do
-       sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
-     done
+    # Trust me, it's NEVER missing.
+    substituteInPlace configure.ac --replace-fail 'm4_ifndef([AX_CHECK_LINK_FLAG], [m4_fatal([autoconf-archive is missing. You must install it to generate the configure script.])])' ' '
 
-     # Apparently, the QEMU executable is no longer called
-     # `qemu-system-i386', even on i386.
-     #
-     # In addition, use `-nodefaults' to avoid errors like:
-     #
-     #  chardev: opening backend "stdio" failed
-     #  qemu: could not open serial device 'stdio': Invalid argument
-     #
-     # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
-     sed -i "tests/util/grub-shell.in" \
-         -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
+    for i in "tests/util/"*.in
+    do
+      sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
+    done
 
-    unset CPP # setting CPP intereferes with dependency calculation
+    # Apparently, the QEMU executable is no longer called
+    # `qemu-system-i386', even on i386.
+    #
+    # In addition, use `-nodefaults' to avoid errors like:
+    #
+    #  chardev: opening backend "stdio" failed
+    #  qemu: could not open serial device 'stdio': Invalid argument
+    #
+    # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
+    sed -i "tests/util/grub-shell.in" \
+        -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
 
     patchShebangs .
 
-    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
-    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
-      echo "This version of GRUB requires a different gnulib revision!"
-      echo "We have: ${gnulib.rev}"
-      echo "GRUB needs: $GNULIB_REVISION"
-      exit 1
-    fi
-
     cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po
+    mkdir po/.reference
+    cp -f --no-preserve=mode ${locales}/po/*.po po/.reference
 
     ./bootstrap --no-git --gnulib-srcdir=${gnulib}
 
@@ -679,13 +265,6 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  postConfigure = ''
-    # make sure .po files are up to date to workaround
-    # parallel `msgmerge --update` on autogenerated .po files:
-    #   https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
-    make dist
-  '';
-
   configureFlags = [
     "--enable-grub-mount" # dep of os-prober
   ]
@@ -718,6 +297,11 @@ stdenv.mkDerivation rec {
   ++ lib.optionals xenPvhSupport [
     "--with-platform=xen_pvh"
     "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals corebootSupport [
+    "--with-platform=coreboot"
+    "--target=${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}"
+    "--enable-boot-time" # Log boot times. Might be useful for debugging loading issues.
   ];
 
   # save target that grub is compiled for
@@ -726,6 +310,8 @@ stdenv.mkDerivation rec {
       "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi"
     else if ieee1275Support then
       "${ieee1275SystemsBuild.${stdenv.hostPlatform.system}.target}-ieee1275"
+    else if corebootSupport then
+      "${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}-coreboot"
     else
       lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";
 
@@ -733,11 +319,10 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    # Avoid a runtime reference to gcc
+    # We have to do this or else closure size balloons up
+
+    patchShebangs $out/lib/grub/*/modinfo.sh
     sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
-    # just adding bash to buildInputs wasn't enough to fix the shebang
-    substituteInPlace $out/lib/grub/*/modinfo.sh \
-      --replace ${buildPackages.bash} "/usr/bin/bash"
   '';
 
   passthru.tests = {
@@ -775,6 +360,8 @@ stdenv.mkDerivation rec {
         lib.attrNames xenSystemsBuild
       else if xenPvhSupport then
         lib.attrNames xenPvhSystemsBuild
+      else if corebootSupport then
+        lib.attrNames corebootSystemsBuild
       else
         lib.platforms.gnu ++ lib.platforms.linux;
 

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -26,13 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./no-avx2-i386.patch
   ];
 
+  buildInputs = [ zlib ];
   nativeBuildInputs = [
     cmake
     validatePkgConfig
   ];
-  buildInputs = [ zlib ];
-
-  strictDeps = true;
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [
     (lib.cmakeBool "HDR_HISTOGRAM_BUILD_SHARED" false)
@@ -59,8 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "C port or High Dynamic Range (HDR) Histogram";
     homepage = "https://github.com/HdrHistogram/HdrHistogram_c";

pkgs/by-name/ho/hol_light/package.nix

@@ -4,13 +4,13 @@
   fetchFromGitHub,
   makeBinaryWrapper,
   writeText,
-  ocaml-ng,
+  ocamlPackages,
   ledit,
   bash,
 }:
 
 let
-  inherit (ocaml-ng.ocamlPackages_5_4)
+  inherit (ocamlPackages)
     ocaml
     findlib
     zarith

pkgs/by-name/im/imagemagick/package.nix

@@ -69,13 +69,13 @@ assert libraqmSupport -> freetypeSupport;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-30";
+  version = "7.1.2-29";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-s2MC/14rNfbuOTI7xVNqr+YN2MobZ/EMnq0hxkJVAj8=";
+    hash = "sha256-gVp6eAXLl11KhtcpZ4hPeurCRHtRhhrAggJi7PatQ+M=";
   };
 
   outputs = [

pkgs/by-name/im/imath/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imath";
-  version = "3.2.3";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "imath";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kmWj9g6PnvgEOojjiWYpJ9+lXwT1svpezYDsCns4NP0=";
+    hash = "sha256-uLGH2kMo5S6iT2gS1091qKkCAxQ/iuQ8xx9507k6SzY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/jb/jbig2dec/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   python3,
   autoconf,
   automake,
@@ -18,15 +17,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qXBTaaZjOrpTJpNFDsgCxWI5fhuCRmLegJ7ekvZ6/yE=";
   };
 
-  # Remove with the first release containing cc37d0931aa71582f7128736a068c92cd8712d9b.
-  patches = [
-    (fetchpatch {
-      name = "CVE-2026-38076.patch";
-      url = "https://github.com/ArtifexSoftware/jbig2dec/commit/cc37d0931aa71582f7128736a068c92cd8712d9b.patch";
-      hash = "sha256-NdmE3xT5M6Ini6FJcKqCJmJkBTFnnq66/YV3Ky5PVNM=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';

pkgs/by-name/je/jemalloc/package.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   fetchpatch,
   autoreconfHook,
-  bashNonInteractive,
   # By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
   # then stops downstream builds (mariadb in particular) from detecting it. This
   # option should remove the prefix and give us a working jemalloc.
@@ -77,12 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ];
 
-  buildInputs = [
-    bashNonInteractive
-  ];
-
-  strictDeps = true;
-
   configureFlags = [
     "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
     "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
@@ -115,8 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Parallel builds break reproducibility.
   enableParallelBuilding = false;
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://jemalloc.net/";
     downloadPage = "https://github.com/jemalloc/jemalloc";

pkgs/by-name/js/json_c/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    tag = "json-c-0.18-20240915";
+    rev = "json-c-0.18-20240915";
     hash = "sha256-UyMXr8Vc6kDOx1/lD2YKPiHdaTotXAF9ak0yQuwrSUA=";
   };
 
@@ -23,14 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  strictDeps = true;
-
   cmakeFlags = [
     (lib.cmakeBool "BUILD_APPS" false)
   ];
 
-  __structuredAttrs = true;
-
   meta = {
     description = "JSON implementation in C";
     longDescription = ''

pkgs/by-name/ke/keyutils/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  bashNonInteractive,
   fetchurl,
 }:
 
@@ -16,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/snapshot/keyutils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ph1XBhNq5MBb1I+GGGvP29iN2L1RB+Phlckkz8Gzm7Q=";
+    sha256 = "sha256-ph1XBhNq5MBb1I+GGGvP29iN2L1RB+Phlckkz8Gzm7Q=";
   };
 
   patches = [
@@ -35,12 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  buildInputs = [
-    bashNonInteractive
-  ];
-
-  strictDeps = true;
-
   makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "NO_SOLIB=1" ];
 
   outputs = [
@@ -53,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # https://github.com/archlinux/svntogit-packages/blob/packages/keyutils/trunk/reproducible.patch
     substituteInPlace Makefile \
-      --replace-fail \
+      --replace \
         'VCPPFLAGS	:= -DPKGBUILD="\"$(shell date -u +%F)\""' \
         'VCPPFLAGS	:= -DPKGBUILD="\"$(date -ud "@$SOURCE_DATE_EPOCH" +%F)\""'
   '';
@@ -75,8 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     "USRLIBDIR=$(lib)/lib"
   ];
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://people.redhat.com/dhowells/keyutils/";
     description = "Tools used to control the Linux kernel key management system";

pkgs/by-name/li/libcap_ng/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcap-ng";
-  version = "0.9.5";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "stevegrubb";
     repo = "libcap-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HYVbPoFSlkmNuL5EsEQVAekE4fwidgL+biTBBS1BdPM=";
+    hash = "sha256-anuPOBWp4Hlpo+m6kYlSd2v7H3P7LQ9brZdq1lo7Po4=";
   };
 
   # NEWS needs to exist or else the build fails
@@ -58,20 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   configureFlags = [
-    # cap_audit is deliberately not enabled here.
-    # First, it'd create a cyclic dependency on audit, which we want to avoid.
-    # Second, it requires a vmlinux.h for utils/cap-audit/cap_audit.bpf.c
-    # The vmlinux.h header can either be generated from the running kernel of the build system
-    # (which does not work on cross with a non-linux build machine, and is never reproducible),
-    # or it can be supplied to configure by path (necessitating a dependency on a specific linux kernel).
-    # A compromise could be introducing a cap_audit package as part of linuxPackages set,
-    # but the cost on CI would not be insignificant due to that being built once per kernel.
-    # All current options are bad in their own way, so this stays disabled until we have a proper
-    # solution for vmlinux.h to not rebuild the world, or provably a user requiring this.
-    # "--enable-cap-audit"
-    # "--with-vmlinux-h=provided"
-    # "--with-vmlinux-h-path="
-
     (lib.withFeature withPython "python")
     "--with-capability_header='${linuxHeaders}/include/linux/capability.h'" # required to link bindings
   ];

pkgs/by-name/li/libconfuse/package.nix

@@ -2,21 +2,34 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   flex,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libconfuse";
-  version = "3.4";
+  version = "3.3";
 
   src = fetchFromGitHub {
-    owner = "libconfuse";
-    repo = "libconfuse";
+    sha256 = "1npfk5jv59kk4n8pkyx89fn9s6p8x3gbffs42jaw24frgxfgp8ca";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sC8O6vcMKvRdRCTXpKl6lgmzFUVG8/LBE7XsGX8F9e4=";
+    repo = "libconfuse";
+    owner = "libconfuse";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-40320.patch";
+      urls = [
+        "https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+        # files on sources.debian.org can disappear
+        "https://web.archive.org/web/20230107133212/https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+      ];
+      sha256 = "sha256-ftfE9JFz4nyRSOb2xHb9BAtgWn5Yv2WLm4RegDLtiBw=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tests/Makefile.am \
       --replace 'TESTS            += empty_string' "" \

pkgs/by-name/li/libdeflate/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
-    tag = "v${finalAttrs.version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-2TiV3kmFs9j4aYetoYeWg3+MoZ542/0zaD0hwn9b8ZA=";
   };
 
@@ -28,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ zlib ];
 
-  strictDeps = true;
-
   passthru.tests = {
     static = pkgsStatic.libdeflate;
     pkg-config = testers.hasPkgConfigModules {
@@ -39,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
     license = lib.licenses.mit;

pkgs/by-name/li/libei/package.nix

@@ -11,7 +11,6 @@
   pkg-config,
   protobuf,
   protobufc,
-  systemdSupport ? stdenv.hostPlatform.isLinux,
   systemdLibs,
   buildPackages,
   epoll-shim,
@@ -53,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     protobuf
     protobufc
   ]
-  ++ lib.optionals systemdSupport [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     systemdLibs
   ]
   ++ lib.optionals stdenv.hostPlatform.isFreeBSD [

pkgs/by-name/li/libgpg-error/package.nix

@@ -24,106 +24,99 @@ let
   };
 in
 stdenv.mkDerivation (
-  finalAttrs:
-  (
-    {
-      pname = "libgpg-error";
-      version = "1.61";
+  rec {
+    pname = "libgpg-error";
+    version = "1.61";
 
-      src = fetchurl {
-        url = "mirror://gnupg/libgpg-error/libgpg-error-${finalAttrs.version}.tar.bz2";
-        hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
-      };
+    src = fetchurl {
+      url = "mirror://gnupg/libgpg-error/libgpg-error-${version}.tar.bz2";
+      hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
+    };
 
-      patches = [
-        # Fixes t-printf test on platforms where LDBL_MAX == DBL_MAX (armhf, ppc64)
-        # Upstream's git forge doesn't seem to have a nice way to download it :/
-        ./libgpg-error-tests-skip-a-test-when-not-HAVE_LONG_DOUBLE_WIDER.patch
-      ];
+    patches = [
+      # Fixes t-printf test on platforms where LDBL_MAX == DBL_MAX (armhf, ppc64)
+      # Upstream's git forge doesn't seem to have a nice way to download it :/
+      ./libgpg-error-tests-skip-a-test-when-not-HAVE_LONG_DOUBLE_WIDER.patch
+    ];
 
-      postPatch = ''
-        sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
+    postPatch = ''
+      sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
+    ''
+    # libgpg-error insists on having these generated files. They should be fairly ABI stable,
+    # so add one for FreeBSD.
+    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-freebsd") ''
+      cp ${./lock-obj-pub.x86_64-unknown-freebsd.h} src/syscfg/lock-obj-pub.freebsd.h
+    ''
+    # Fails on powerpc64-linux
+    # https://lists.gnupg.org/pipermail/gnupg-users/2026-July/068440.html
+    + lib.optionalString (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) ''
+      substituteInPlace tests/t-printf.c \
+        --replace-fail \
+          '# ifdef HAVE_LONG_DOUBLE_WIDER' \
+          '# if 0' \
+        --replace-fail \
+          'show ("LDBL_MAX == DBL_MAX - skipping LDBL_MAX test\n")' \
+          'show ("LDBL_MAX is weird on this platform - skipping LDBL_MAX test\n")'
+    '';
+
+    hardeningDisable = [ "strictflexarrays3" ];
+
+    configureFlags = [
+      # See https://dev.gnupg.org/T6257#164567
+      "--enable-install-gpg-error-config"
+    ];
+
+    outputs = [
+      "out"
+      "dev"
+      "info"
+    ];
+    outputBin = "dev"; # deps want just the lib, most likely
+
+    # If architecture-dependent MO files aren't available, they're generated
+    # during build, so we need gettext for cross-builds.
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [
+      autoreconfHook # HAVE_LONG_DOUBLE_WIDER patch changes configure.ac
+      gettext
+    ];
+
+    postConfigure =
+      # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
+      # `config.status' run:
+      #   ./config.status[1401]: shift: (null): bad number
+      # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
+      # Thus, re-run it with Bash.
+      lib.optionalString stdenv.hostPlatform.isSunOS ''
+        ${stdenv.shell} config.status
       ''
-      # libgpg-error insists on having these generated files. They should be fairly ABI stable,
-      # so add one for FreeBSD.
-      + lib.optionalString (stdenv.hostPlatform.system == "x86_64-freebsd") ''
-        cp ${./lock-obj-pub.x86_64-unknown-freebsd.h} src/syscfg/lock-obj-pub.freebsd.h
-      ''
-      # Fails on powerpc64-linux
-      # https://lists.gnupg.org/pipermail/gnupg-users/2026-July/068440.html
-      + lib.optionalString (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) ''
-        substituteInPlace tests/t-printf.c \
-          --replace-fail \
-            '# ifdef HAVE_LONG_DOUBLE_WIDER' \
-            '# if 0' \
-          --replace-fail \
-            'show ("LDBL_MAX == DBL_MAX - skipping LDBL_MAX test\n")' \
-            'show ("LDBL_MAX is weird on this platform - skipping LDBL_MAX test\n")'
+      # ./configure erroneous decides to use weak symbols on pkgsStatic,
+      # which, together with other defines results in locking functions in
+      # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
+      + lib.optionalString stdenv.hostPlatform.isStatic ''
+        sed '/USE_POSIX_THREADS_WEAK/ d' config.h
+        echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
       '';
 
-      hardeningDisable = [ "strictflexarrays3" ];
+    doCheck = true; # not cross
 
-      configureFlags = [
-        # See https://dev.gnupg.org/T6257#164567
-        "--enable-install-gpg-error-config"
-      ];
+    meta = {
+      homepage = "https://www.gnupg.org/software/libgpg-error/index.html";
+      changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;hb=refs/tags/libgpg-error-${version}";
+      description = "Small library that defines common error values for all GnuPG components";
+      mainProgram = "gen-posix-lock-obj";
 
-      outputs = [
-        "out"
-        "dev"
-        "info"
-      ];
-      outputBin = "dev"; # deps want just the lib, most likely
+      longDescription = ''
+        Libgpg-error is a small library that defines common error values
+        for all GnuPG components.  Among these are GPG, GPGSM, GPGME,
+        GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard
+        Daemon and possibly more in the future.
+      '';
 
-      # If architecture-dependent MO files aren't available, they're generated
-      # during build, so we need gettext for cross-builds.
-      depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [
-        autoreconfHook # HAVE_LONG_DOUBLE_WIDER patch changes configure.ac
-        gettext
-      ];
-
-      strictDeps = true;
-
-      postConfigure =
-        # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
-        # `config.status' run:
-        #   ./config.status[1401]: shift: (null): bad number
-        # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
-        # Thus, re-run it with Bash.
-        lib.optionalString stdenv.hostPlatform.isSunOS ''
-          ${stdenv.shell} config.status
-        ''
-        # ./configure erroneous decides to use weak symbols on pkgsStatic,
-        # which, together with other defines results in locking functions in
-        # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
-        + lib.optionalString stdenv.hostPlatform.isStatic ''
-          sed '/USE_POSIX_THREADS_WEAK/ d' config.h
-          echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
-        '';
-
-      doCheck = true; # not cross
-
-      __structuredAttrs = true;
-
-      meta = {
-        homepage = "https://www.gnupg.org/software/libgpg-error/index.html";
-        changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;hb=refs/tags/libgpg-error-${finalAttrs.version}";
-        description = "Small library that defines common error values for all GnuPG components";
-        mainProgram = "gen-posix-lock-obj";
-
-        longDescription = ''
-          Libgpg-error is a small library that defines common error values
-          for all GnuPG components.  Among these are GPG, GPGSM, GPGME,
-          GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard
-          Daemon and possibly more in the future.
-        '';
-
-        license = lib.licenses.lgpl2Plus;
-        platforms = lib.platforms.all;
-        maintainers = [ ];
-      };
-    }
-    // genPosixLockObjOnlyAttrs
-  )
+      license = lib.licenses.lgpl2Plus;
+      platforms = lib.platforms.all;
+      maintainers = [ ];
+    };
+  }
+  // genPosixLockObjOnlyAttrs
 )

pkgs/by-name/li/libheif/package.nix

@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.23.2";
+  version = "1.23.1";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fqz2BfdcnnR5tylKcxM1xESoTRh5WgqvgdsBLJcnySU=";
+    hash = "sha256-o+gQCv/lpRx+IaqpjHACh8ysgl/N4Mo/9zbAI/cnWas=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libidn/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/libidn/libidn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
+    sha256 = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
   };
 
   outputs = [
@@ -27,12 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 
-  strictDeps = true;
-
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  __structuredAttrs = true;
-
   meta = {
     changelog = "https://codeberg.org/libidn/libidn/src/tag/v${finalAttrs.version}/NEWS";
     homepage = "https://www.gnu.org/software/libidn/";

pkgs/by-name/li/libopenmpt/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopenmpt";
-  version = "0.8.9";
+  version = "0.8.7";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${finalAttrs.version}+release.autotools.tar.gz";
-    hash = "sha256-186E/QXWhsS89mr0Dq6Fevo3FELbYO7aP4dL1s9vwxg=";
+    hash = "sha256-J1wp70e+mZL2KjX8yW98oFwG0v0FySmLje6fdD91sIk=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/li/libpsl/package.nix

@@ -56,8 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
   ];
 
-  strictDeps = true;
-
   propagatedBuildInputs = [
     publicsuffix-list
   ];
@@ -85,8 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  __structuredAttrs = true;
-
   meta = {
     description = "C library for the Publix Suffix List";
     longDescription = ''

pkgs/by-name/li/libqmi/package.nix

@@ -32,7 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
-    "doc"
   ];
 
   src = fetchFromGitLab {

pkgs/by-name/li/librsvg/librsvg-libpixbufloader-install-names.patch

@@ -1,25 +0,0 @@
---- a/gdk-pixbuf-loader/meson_install.py
-+++ b/gdk-pixbuf-loader/meson_install.py
-@@ -13,6 +13,22 @@ if __name__ == '__main__':
-     argparse.add_argument('--cache-file', type=Path, metavar="PATH", help="module cache file to write")
-     argparse.add_argument('--show-cross-message', action='store_true', help="tell the user to run query-loaders manually")
-     args = argparse.parse_args()
-+    if sys.platform in ['darwin', 'ios']:
-+        modulepath = Path(args.moduledir).resolve()
-+        prefix = modulepath.parent.parent.parent
-+        location = modulepath
-+        if 'DESTDIR' in os.environ:
-+            location = Path(os.environ['DESTDIR']) / modulepath.relative_to('/')
-+        oldfilepath = location / 'libpixbufloader_svg.dylib'
-+        newfilename = 'libpixbufloader-svg.so'
-+        newfilepath = location / newfilename
-+        installfilepath = modulepath / 'libpixbufloader-svg.so'
-+        librsvgpath = prefix / 'librsvg-2.2.dylib'
-+        os.rename(oldfilepath.as_posix(), newfilepath.as_posix())
-+        subprocess.run(
-+            ['install_name_tool', '-id', installfilepath.as_posix(), newfilepath.as_posix()])
-+        subprocess.run(
-+            ['install_name_tool', '-change', '@rpath/librsvg-2.2.dylib', librsvgpath.as_posix(), newfilepath.as_posix()])
- 
-     if not(args.show_cross_message or (args.queryloaders and args.moduledir and args.cache_file)):
-         argparse.print_help()

pkgs/by-name/li/librsvg/package.nix

@@ -65,14 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-frRJsnIqdoAhNW9m3+4yAsIptU7U5qcM5AwJDpf/FvI=";
   };
 
-  # FIXME: This patch should be made unconditional the next time librsvg is
-  # updated.
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Rebased copy of https://gitlab.gnome.org/GNOME/gtk-osx/-/blob/2c1492036ff92d1c87d7b7a4c3c5a7a3f042f825/patches/librsvg-libpixbufloader-install-names.patch.
-    # Fixes https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1161.
-    ./librsvg-libpixbufloader-install-names.patch
-  ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";

pkgs/by-name/li/libsodium/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-08-13";
+  version = "1.0.22-unstable-2026-07-31";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "2c61b499e7cea2d873a9afee220c946601f78beb";
-    hash = "sha256-BvGMNKDzpWkD7oCheoWr9jJXngEHw1KsF2CqniT2X78=";
+    rev = "701aa826b97dc84a353d70a551d49dc26da539c5";
+    hash = "sha256-vJK7nuvy22EWCdau9cn4HOvO8XDiVQXwf/zwhq9R9Jg=";
   };
 
   outputs = [

pkgs/by-name/li/libstemmer/package.nix

@@ -8,25 +8,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libstemmer";
-  version = "3.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "snowballstem";
     repo = "snowball";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-FpvV2brpjl0/l/EmrHN9tWFrXUUz9BDUH548MAjiTa8=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-qXrypwv/I+5npvGHGsHveijoui0ZnoGYhskCfLkewVE=";
   };
 
   nativeBuildInputs = [ perl ];
 
-  strictDeps = true;
-
   prePatch = ''
     patchShebangs .
   ''
   + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     substituteInPlace GNUmakefile \
-      --replace-fail './snowball ' '${lib.getExe' buildPackages.libstemmer "snowball"} '
+      --replace './snowball' '${lib.getBin buildPackages.libstemmer}/bin/snowball'
   '';
 
   makeTarget = "libstemmer.a";
@@ -39,12 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Snowball Stemming Algorithms";
     homepage = "https://snowballstem.org/";
-    changelog = "https://github.com/snowballstem/snowball/blob/v${finalAttrs.version}/NEWS";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fpletz ];
     platforms = lib.platforms.all;

pkgs/by-name/lz/lzip/package.nix

@@ -40,8 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
   strictDeps = true;
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://www.nongnu.org/lzip/lzip.html";
     description = "Lossless data compressor based on the LZMA algorithm";

pkgs/by-name/ma/mailcap/package.nix

@@ -22,12 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mkAyIC/A0rCFj0GxZzianP5SrCTsKC5kebkHZTGd4RM=";
   };
 
-  strictDeps = true;
-
   installPhase = ''
     runHook preInstall
 
-    substituteInPlace mailcap --replace-fail "/usr/bin/" ""
+    substituteInPlace mailcap --replace "/usr/bin/" ""
     sh generate-nginx-mimetypes.sh < mime.types > nginx-mime.types
 
     install -D -m0644 nginx-mime.types $out/etc/nginx/mime.types
@@ -58,8 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.nginx-mime = nixosTests.nginx-mime;
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Helper application and MIME type associations for file types";
     homepage = "https://pagure.io/mailcap";

pkgs/by-name/ma/maturin/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.15.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-elK82eg/m33GYNWeZUSfKxFVJS6fMRatHl66NgvxcxE=";
+    hash = "sha256-sqcNRN8oAZ2AK5gHr3ipb035VOiB+zDA10wTtiaeUBM=";
   };
 
-  cargoHash = "sha256-WRVXmhwhbOf2Isjvyqw3d4scA5Vs8Vkyy1m7WC3xb0s=";
+  cargoHash = "sha256-pD8/S7GsFFeAjc8U4fQ9ZTu+o3mKyPagMPKKRI40n4w=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

pkgs/by-name/me/media-player-info/package.nix

@@ -7,6 +7,7 @@
   python3,
   udev,
   udevCheckHook,
+  systemd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,14 +22,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VoMr5Lxy6u/BA/9t65/S8AW41YU0FLp6eftYUVdoMjY=";
   };
 
+  buildInputs = [
+    udev
+    systemd
+  ];
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    udevCheckHook
-
-    # used at *build* time only
     python3
-    udev
+    udevCheckHook
   ];
 
   doInstallCheck = true;

pkgs/by-name/mu/musl/package.nix

@@ -185,9 +185,6 @@ stdenv.mkDerivation (finalAttrs: {
     threadModel = "posix";
   };
 
-  strictDeps = true;
-  __structuredAttrs = true;
-
   meta = {
     description = "Efficient, small, quality libc implementation";
     homepage = "https://musl.libc.org/";

pkgs/by-name/na/nagelfar/package.nix

@@ -1,25 +1,23 @@
 {
   lib,
   fetchurl,
-  bashNonInteractive,
   tcl,
   tclPackages,
   tk,
 }:
 
-tcl.mkTclDerivation (finalAttrs: {
+tcl.mkTclDerivation rec {
   pname = "nagelfar";
   version = "1.3.5";
 
   src = fetchurl {
     url = "https://sourceforge.net/projects/nagelfar/files/Rel_${
-      lib.replaceString "." "" finalAttrs.version
-    }/nagelfar${lib.replaceString "." "" finalAttrs.version}.tar.gz";
+      lib.replaceString "." "" version
+    }/nagelfar${lib.replaceString "." "" version}.tar.gz";
     hash = "sha256-O6+SD7NLc+MgZxGDZdB02FkpjivON0itlFhiS+zoWyM=";
   };
 
   buildInputs = [
-    bashNonInteractive
     tcl
     tclPackages.tcllib
     tk
@@ -45,4 +43,4 @@ tcl.mkTclDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.nat-418 ];
   };
-})
+}

pkgs/by-name/ne/networkmanager/package.nix

@@ -112,9 +112,6 @@ stdenv.mkDerivation (finalAttrs: {
     (mesonOption "systemdsystemunitdir" (
       if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no"
     ))
-    (mesonOption "systemdsystemgeneratordir" (
-      if withSystemd then "${placeholder "out"}/lib/systemd/system-generators" else "no"
-    ))
     # to enable link-local connections
     (mesonOption "udev_dir" "${placeholder "out"}/lib/udev")
     (mesonOption "dbus_conf_dir" "${placeholder "out"}/share/dbus-1/system.d")

pkgs/by-name/nf/nfs-utils/package.nix

@@ -15,7 +15,7 @@
   libuuid,
   keyutils,
   lvm2,
-  systemdMinimal,
+  systemd,
   coreutils,
   python3,
   buildPackages,
@@ -28,19 +28,14 @@
   udevCheckHook,
   enablePython ? true,
   enableLdap ? true,
-  enableSystemd ? true,
 }:
 
 let
-  statdPath = lib.makeBinPath (
-    [
-      util-linux
-      coreutils
-    ]
-    ++ lib.optionals enableSystemd [
-      systemdMinimal
-    ]
-  );
+  statdPath = lib.makeBinPath [
+    systemd
+    util-linux
+    coreutils
+  ];
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -101,16 +96,11 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-svcgss"
     "--with-statedir=/var/lib/nfs"
     "--with-krb5=${lib.getLib libkrb5}"
+    "--with-systemd=${placeholder "out"}/etc/systemd/system"
     "--enable-libmount-mount"
     "--with-pluginpath=${placeholder "lib"}/lib/libnfsidmap" # this installs libnfsidmap
     "--with-rpcgen=${buildPackages.rpcsvc-proto}/bin/rpcgen"
     "--with-modprobedir=${placeholder "out"}/etc/modprobe.d"
-    (
-      if enableSystemd then
-        "--with-systemd=${placeholder "out"}/etc/systemd/system"
-      else
-        "--without-systemd"
-    )
   ]
   ++ lib.optional enableLdap "--enable-ldap";
 
@@ -149,8 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [
     "sbindir=$(out)/bin"
-  ]
-  ++ lib.optionals enableSystemd [
     "generator_dir=$(out)/etc/systemd/system-generators"
   ];
 
@@ -165,23 +153,20 @@ stdenv.mkDerivation (finalAttrs: {
     "lib"
     "libexec"
     "bin"
-  ]
-  ++ lib.optionals enableSystemd [
     "etc/systemd/system-generators"
   ];
 
-  postInstall =
-    lib.optionalString enableSystemd ''
-      # Not used on NixOS
-      sed -i \
-        -e "s,/sbin/modprobe,${kmod}/bin/modprobe,g" \
-        -e "s,/usr/sbin,$out/bin,g" \
-        $out/etc/systemd/system/*
-    ''
-    + lib.optionalString (!enablePython) ''
-      # Remove all scripts that require python (currently mountstats and nfsiostat)
-      grep -l /usr/bin/python $out/bin/* | xargs -I {} rm -v {}
-    '';
+  postInstall = ''
+    # Not used on NixOS
+    sed -i \
+      -e "s,/sbin/modprobe,${kmod}/bin/modprobe,g" \
+      -e "s,/usr/sbin,$out/bin,g" \
+      $out/etc/systemd/system/*
+  ''
+  + lib.optionalString (!enablePython) ''
+    # Remove all scripts that require python (currently mountstats and nfsiostat)
+    grep -l /usr/bin/python $out/bin/* | xargs -I {} rm -v {}
+  '';
 
   # One test fails on mips.
   # doCheck = !stdenv.hostPlatform.isMips;

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py

@@ -205,12 +205,17 @@ class Profile:
     name: str
     path: Path
 
+    @classmethod
+    def _is_custom_name(cls, name: str) -> bool:
+        return name != "system"
+
     @classmethod
     def from_arg(cls, name: str) -> Self:
-        match name:
-            case "system":
-                return cls(name, Path("/nix/var/nix/profiles/system"))
-            case _:
-                path = Path("/nix/var/nix/profiles/system-profiles") / name
-                path.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
-                return cls(name, path)
+        if cls._is_custom_name(name):
+            path = Path("/nix/var/nix/profiles/system-profiles") / name
+            return cls(name, path)
+        else:
+            return cls(name, Path("/nix/var/nix/profiles/system"))
+
+    def is_custom(self) -> bool:
+        return self._is_custom_name(self.name)

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

@@ -690,6 +690,15 @@ def set_profile(
             ).strip()
             raise NixOSRebuildError(msg)
 
+    if profile.is_custom():
+        # Using custom profile, the target profile directory may not exist yet,
+        # so we need to create it first
+        run_wrapper(
+            ["mkdir", "-p", profile.path.parent],
+            remote=target_host,
+            elevate=elevate,
+        )
+
     run_wrapper(
         ["nix-env", "-p", profile.path, "--set", path_to_config],
         remote=target_host,

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py

@@ -610,7 +610,7 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
 @patch("subprocess.run", autospec=True)
 @patch("uuid.uuid4", autospec=True)
 @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True)
-def test_execute_nix_switch_build_target_host(
+def test_execute_nix_switch_build_target_host_custom_profile(
     mock_cleanup_ssh: Mock,
     mock_uuid4: Mock,
     mock_run: Mock,
@@ -654,10 +654,12 @@ def test_execute_nix_switch_build_target_host(
             "nixos-config=./configuration.nix",
             "-I",
             "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            "--profile-name",
+            "custom-profile",
         ]
     )
 
-    assert mock_run.call_count == 12
+    assert mock_run.call_count == 13
     mock_run.assert_has_calls(
         [
             call(
@@ -791,6 +793,24 @@ def test_execute_nix_switch_build_target_host(
                 check=True,
                 **DEFAULT_RUN_KWARGS,
             ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@target-host",
+                    "--",
+                    "sudo",
+                    "/bin/sh",
+                    "-c",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                    "sh",
+                    "mkdir",
+                    "-p",
+                    "/nix/var/nix/profiles/system-profiles",
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "ssh",
@@ -804,7 +824,7 @@ def test_execute_nix_switch_build_target_host(
                     "sh",
                     "nix-env",
                     "-p",
-                    "/nix/var/nix/profiles/system",
+                    "/nix/var/nix/profiles/system-profiles/custom-profile",
                     "--set",
                     str(config_path),
                 ],

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py

@@ -205,19 +205,21 @@ def test_flake_from_arg(
         ) == m.Flake("/path/to", 'nixosConfigurations."remote-hostname"')
 
 
-@patch("pathlib.Path.mkdir", autospec=True)
-def test_profile_from_arg(mock_mkdir: Mock) -> None:
+def test_profile_from_arg() -> None:
     assert m.Profile.from_arg("system") == m.Profile(
         "system",
         Path("/nix/var/nix/profiles/system"),
     )
-    mock_mkdir.assert_not_called()
 
     assert m.Profile.from_arg("something") == m.Profile(
         "something",
         Path("/nix/var/nix/profiles/system-profiles/something"),
     )
-    mock_mkdir.assert_called_once()
+
+
+def test_profile_is_custom() -> None:
+    assert not m.Profile("system", Path()).is_custom()
+    assert m.Profile("something", Path()).is_custom()
 
 
 def test_grouped_nix_args_flake_build_flags() -> None:

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

@@ -749,6 +749,32 @@ def test_set_profile(mock_run: Mock) -> None:
         elevate=e.NO_ELEVATOR,
     )
 
+    mock_run.reset_mock()
+    target_host = m.Remote("user@localhost", [], "ssh")
+
+    n.set_profile(
+        m.Profile("something", profile_path),
+        config_path,
+        target_host=target_host,
+        elevate=e.NO_ELEVATOR,
+    )
+
+    mock_run.assert_has_calls(
+        [
+            call(
+                ["mkdir", "-p", profile_path.parent],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+            call(
+                ["nix-env", "-p", profile_path, "--set", config_path],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+        ]
+    )
+
+    mock_run.reset_mock()
     mock_run.return_value = CompletedProcess([], 1)
 
     with pytest.raises(m.NixOSRebuildError) as exc:

pkgs/by-name/nu/nuspell/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nuspell";
-  version = "5.1.8";
+  version = "5.1.7";
 
   src = fetchFromGitHub {
     owner = "nuspell";
     repo = "nuspell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-foMq1Gx30/EmYIHMPXTeraV3XcwBBVGnjMRjGE9+Xbw=";
+    hash = "sha256-CAyM3bzIP0aYNEu94I7I1qlglPx9HJSnEkgEfjNGfvc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/on/oniguruma/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/kkos/oniguruma/releases/download/v${finalAttrs.version}/onig-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Klz8WuJZ5Ol/hraN//wVLNr/6U4gYLdwy4JyONdp/AU=";
+    sha256 = "sha256-Klz8WuJZ5Ol/hraN//wVLNr/6U4gYLdwy4JyONdp/AU=";
   };
 
   outputs = [
@@ -23,13 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
   outputBin = "dev"; # onig-config
 
   nativeBuildInputs = [ autoreconfHook ];
-
-  strictDeps = true;
-
   configureFlags = [ "--enable-posix-api=yes" ];
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://github.com/kkos/oniguruma";
     description = "Regular expressions library";

pkgs/by-name/p1/p11-kit/package.nix

@@ -14,14 +14,14 @@
   libintl,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "p11-kit";
   version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
-    tag = finalAttrs.version;
+    tag = version;
     hash = "sha256-qFanbp0KPc6+CN4s5mMQNduzcxt/SrMcYWvIMZ0XnGY=";
     fetchSubmodules = true;
   };
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # Install sample config files to $out/etc even though they will be loaded from /etc.
     substituteInPlace p11-kit/meson.build \
-      --replace-fail 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
+      --replace 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
   '';
 
   preCheck = ''
@@ -82,8 +82,6 @@ stdenv.mkDerivation (finalAttrs: {
     fi
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Library for loading and sharing PKCS#11 modules";
     longDescription = ''
@@ -93,8 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://p11-glue.github.io/p11-glue/p11-kit.html";
     changelog = [
-      "https://github.com/p11-glue/p11-kit/raw/${finalAttrs.version}/NEWS"
-      "https://github.com/p11-glue/p11-kit/releases/tag/${finalAttrs.version}"
+      "https://github.com/p11-glue/p11-kit/raw/${version}/NEWS"
+      "https://github.com/p11-glue/p11-kit/releases/tag/${version}"
     ];
     platforms = lib.platforms.all;
     badPlatforms = [
@@ -103,6 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     license = lib.licenses.bsd3;
     mainProgram = "p11-kit";
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "p11-kit_project" finalAttrs.version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "p11-kit_project" version;
   };
-})
+}

pkgs/by-name/pa/pahole/package.nix

@@ -54,7 +54,5 @@ stdenv.mkDerivation (finalAttrs: {
       bosu
       martinetd
     ];
-
-    mainProgram = "pahole";
   };
 })

pkgs/by-name/pk/pkg-config-unwrapped/package.nix

@@ -77,8 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''rm -f "$out"/bin/*-pkg-config''; # clean the duplicate file
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Tool that allows packages to find out information about other packages";
     homepage = "http://pkg-config.freedesktop.org/wiki/";

pkgs/by-name/qr/qrencode/package.nix

@@ -37,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
   ];
 
-  strictDeps = true;
-
   doCheck = false;
 
   checkPhase = ''
@@ -59,8 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://fukuchi.org/works/qrencode/";
     description = "C library and command line tool for encoding data in a QR Code symbol";

pkgs/by-name/re/re2c/package.nix

@@ -28,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  strictDeps = true;
-
   doCheck = true;
   enableParallelBuilding = true;
 
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Tool for writing very fast and very flexible scanners";
     homepage = "https://re2c.org";