From 2450bb6f06161e5d2f1b3442da8c40a71ec9c4a6 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 2 May 2023 01:19:16 +0000
Subject: [PATCH 01/10] refactor package layout to conform better with NUR
 expectations

---
 integrations/nur/default.nix                  | 20 +++++
 modules/default.nix                           |  4 +-
 modules/lib/default.nix                       | 12 +--
 modules/lib/path.nix                          |  2 +-
 overlays/pkgs.nix                             | 74 +++++--------------
 .../bootpart-tow-boot-rpi-aarch64/config.txt  |  0
 .../bootpart-tow-boot-rpi-aarch64/default.nix |  0
 .../bootpart-u-boot-rpi-aarch64/config.txt    |  0
 .../bootpart-u-boot-rpi-aarch64/default.nix   |  0
 .../bootpart-uefi-x86_64/default.nix          |  0
 .../browserpass-extension/default.nix         |  0
 .../{ => additional}/cargo-docset/default.nix |  0
 pkgs/additional/default.nix                   | 35 +++++++++
 pkgs/{ => additional}/feeds/default.nix       |  0
 pkgs/{ => additional}/feeds/template.nix      |  0
 pkgs/{ => additional}/feeds/update.py         |  0
 .../fluffychat-moby/default.nix               |  0
 .../fractal-latest/default.nix                |  0
 .../com.justwatch.gopass.json                 |  0
 .../gopass-native-messaging-host/default.nix  |  0
 .../gopass-wrapper.sh                         |  0
 .../gpodder-configured/default.nix            |  0
 .../gpodder-configured/gpodder-remove-extra   |  0
 pkgs/{ => additional}/kaiteki/default.nix     |  0
 .../lightdm-mobile-greeter/default.nix        |  0
 .../{ => additional}/linux-megous/default.nix | 16 +++-
 pkgs/{ => additional}/mx-sanebot/Cargo.lock   |  0
 pkgs/{ => additional}/mx-sanebot/Cargo.toml   |  0
 pkgs/{ => additional}/mx-sanebot/default.nix  |  0
 pkgs/{ => additional}/mx-sanebot/flake.lock   |  0
 pkgs/{ => additional}/mx-sanebot/flake.nix    |  0
 pkgs/{ => additional}/mx-sanebot/shell.nix    |  0
 pkgs/{ => additional}/mx-sanebot/src/main.rs  |  0
 .../mx-sanebot/src/msg_handler.rs             |  0
 .../mx-sanebot/src/parsing.rs                 |  0
 .../rtl8723cs-firmware/default.nix            |  0
 .../{ => additional}/sane-scripts/default.nix |  0
 .../sane-scripts/resholve-prologue            |  0
 .../sane-scripts/src/sane-backup-ls           |  0
 .../sane-scripts/src/sane-backup-restore      |  0
 .../sane-scripts/src/sane-bt-add              |  0
 .../sane-scripts/src/sane-bt-search           |  0
 .../sane-scripts/src/sane-bt-show             |  0
 .../sane-scripts/src/sane-date-math           |  0
 .../sane-scripts/src/sane-deadlines           |  0
 .../sane-scripts/src/sane-dev-cargo-loop      |  0
 .../sane-scripts/src/sane-find-dotfiles       |  0
 .../sane-scripts/src/sane-git-init            |  0
 .../sane-scripts/src/sane-ip-check            |  0
 .../sane-scripts/src/sane-ip-check-router-wan |  0
 .../sane-scripts/src/sane-ip-reconnect        |  0
 .../sane-scripts/src/sane-mount-servo         |  0
 .../sane-scripts/src/sane-mount-servo-root    |  0
 .../src/sane-private-change-passwd            |  0
 .../sane-scripts/src/sane-private-do          |  0
 .../sane-scripts/src/sane-private-init        |  0
 .../sane-scripts/src/sane-private-lock        |  0
 .../sane-scripts/src/sane-private-unlock      |  0
 .../sane-scripts/src/sane-rcp                 |  0
 .../sane-scripts/src/sane-reboot              |  0
 .../sane-scripts/src/sane-reclaim-boot-space  |  0
 .../sane-scripts/src/sane-reclaim-disk-space  |  0
 .../sane-scripts/src/sane-secrets-dump        |  0
 .../sane-scripts/src/sane-secrets-unlock      |  0
 .../sane-scripts/src/sane-secrets-update-keys |  0
 .../sane-scripts/src/sane-shutdown            |  0
 .../sane-scripts/src/sane-ssl-dump            |  0
 .../sane-scripts/src/sane-stop-all-servo      |  0
 .../sane-scripts/src/sane-sudo-redirect       |  0
 .../sane-scripts/src/sane-sync-from-iphone    |  0
 .../sane-scripts/src/sane-sync-from-servo     |  0
 .../sane-scripts/src/sane-test                |  0
 .../sane-scripts/src/sane-vpn-down            |  0
 .../sane-scripts/src/sane-vpn-up              |  0
 .../sane-scripts/src/sane-which               |  0
 pkgs/{ => additional}/splatmoji/default.nix   |  0
 .../static-nix-shell/default.nix              | 11 +--
 .../sublime-music-mobile/default.nix          |  0
 pkgs/{ => additional}/tokodon/default.nix     |  0
 .../tow-boot-pinephone/default.nix            |  0
 .../tow-boot-rpi4/default.nix                 |  0
 .../01-skip-lba-check.patch                   |  0
 .../03-verbose-log.patch                      |  0
 .../ubootRaspberryPi4_64bit/default.nix       |  0
 pkgs/browserpass/default.nix                  | 48 ------------
 pkgs/patched/browserpass/default.nix          | 48 ++++++++++++
 .../browserpass/sops-gpg-adapter              |  0
 pkgs/patched/default.nix                      | 18 +++++
 .../allow-searchengines-non-esr.patch         |  0
 .../firefox-unwrapped/default.nix             |  0
 pkgs/{ => patched}/gocryptfs/default.nix      |  0
 .../jackett/01-fix-bind-host.patch            |  0
 pkgs/{ => patched}/jackett/default.nix        |  0
 pkgs/python-packages/default.nix              |  4 +
 .../0001-response-chunk-size.patch            |  0
 .../feedsearch-crawler/default.nix            |  0
 96 files changed, 170 insertions(+), 122 deletions(-)
 create mode 100644 integrations/nur/default.nix
 rename pkgs/{ => additional}/bootpart-tow-boot-rpi-aarch64/config.txt (100%)
 rename pkgs/{ => additional}/bootpart-tow-boot-rpi-aarch64/default.nix (100%)
 rename pkgs/{ => additional}/bootpart-u-boot-rpi-aarch64/config.txt (100%)
 rename pkgs/{ => additional}/bootpart-u-boot-rpi-aarch64/default.nix (100%)
 rename pkgs/{ => additional}/bootpart-uefi-x86_64/default.nix (100%)
 rename pkgs/{ => additional}/browserpass-extension/default.nix (100%)
 rename pkgs/{ => additional}/cargo-docset/default.nix (100%)
 create mode 100644 pkgs/additional/default.nix
 rename pkgs/{ => additional}/feeds/default.nix (100%)
 rename pkgs/{ => additional}/feeds/template.nix (100%)
 rename pkgs/{ => additional}/feeds/update.py (100%)
 rename pkgs/{ => additional}/fluffychat-moby/default.nix (100%)
 rename pkgs/{ => additional}/fractal-latest/default.nix (100%)
 rename pkgs/{ => additional}/gopass-native-messaging-host/com.justwatch.gopass.json (100%)
 rename pkgs/{ => additional}/gopass-native-messaging-host/default.nix (100%)
 rename pkgs/{ => additional}/gopass-native-messaging-host/gopass-wrapper.sh (100%)
 rename pkgs/{ => additional}/gpodder-configured/default.nix (100%)
 rename pkgs/{ => additional}/gpodder-configured/gpodder-remove-extra (100%)
 rename pkgs/{ => additional}/kaiteki/default.nix (100%)
 rename pkgs/{ => additional}/lightdm-mobile-greeter/default.nix (100%)
 rename pkgs/{ => additional}/linux-megous/default.nix (82%)
 rename pkgs/{ => additional}/mx-sanebot/Cargo.lock (100%)
 rename pkgs/{ => additional}/mx-sanebot/Cargo.toml (100%)
 rename pkgs/{ => additional}/mx-sanebot/default.nix (100%)
 rename pkgs/{ => additional}/mx-sanebot/flake.lock (100%)
 rename pkgs/{ => additional}/mx-sanebot/flake.nix (100%)
 rename pkgs/{ => additional}/mx-sanebot/shell.nix (100%)
 rename pkgs/{ => additional}/mx-sanebot/src/main.rs (100%)
 rename pkgs/{ => additional}/mx-sanebot/src/msg_handler.rs (100%)
 rename pkgs/{ => additional}/mx-sanebot/src/parsing.rs (100%)
 rename pkgs/{ => additional}/rtl8723cs-firmware/default.nix (100%)
 rename pkgs/{ => additional}/sane-scripts/default.nix (100%)
 rename pkgs/{ => additional}/sane-scripts/resholve-prologue (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-backup-ls (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-backup-restore (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-bt-add (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-bt-search (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-bt-show (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-date-math (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-deadlines (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-dev-cargo-loop (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-find-dotfiles (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-git-init (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-ip-check (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-ip-check-router-wan (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-ip-reconnect (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-mount-servo (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-mount-servo-root (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-private-change-passwd (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-private-do (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-private-init (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-private-lock (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-private-unlock (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-rcp (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-reboot (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-reclaim-boot-space (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-reclaim-disk-space (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-secrets-dump (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-secrets-unlock (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-secrets-update-keys (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-shutdown (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-ssl-dump (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-stop-all-servo (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-sudo-redirect (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-sync-from-iphone (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-sync-from-servo (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-test (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-vpn-down (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-vpn-up (100%)
 rename pkgs/{ => additional}/sane-scripts/src/sane-which (100%)
 rename pkgs/{ => additional}/splatmoji/default.nix (100%)
 rename pkgs/{ => additional}/static-nix-shell/default.nix (89%)
 rename pkgs/{ => additional}/sublime-music-mobile/default.nix (100%)
 rename pkgs/{ => additional}/tokodon/default.nix (100%)
 rename pkgs/{ => additional}/tow-boot-pinephone/default.nix (100%)
 rename pkgs/{ => additional}/tow-boot-rpi4/default.nix (100%)
 rename pkgs/{ => additional}/ubootRaspberryPi4_64bit/01-skip-lba-check.patch (100%)
 rename pkgs/{ => additional}/ubootRaspberryPi4_64bit/03-verbose-log.patch (100%)
 rename pkgs/{ => additional}/ubootRaspberryPi4_64bit/default.nix (100%)
 delete mode 100644 pkgs/browserpass/default.nix
 create mode 100644 pkgs/patched/browserpass/default.nix
 rename pkgs/{ => patched}/browserpass/sops-gpg-adapter (100%)
 create mode 100644 pkgs/patched/default.nix
 rename pkgs/{ => patched}/firefox-unwrapped/allow-searchengines-non-esr.patch (100%)
 rename pkgs/{ => patched}/firefox-unwrapped/default.nix (100%)
 rename pkgs/{ => patched}/gocryptfs/default.nix (100%)
 rename pkgs/{ => patched}/jackett/01-fix-bind-host.patch (100%)
 rename pkgs/{ => patched}/jackett/default.nix (100%)
 create mode 100644 pkgs/python-packages/default.nix
 rename pkgs/{ => python-packages}/feedsearch-crawler/0001-response-chunk-size.patch (100%)
 rename pkgs/{ => python-packages}/feedsearch-crawler/default.nix (100%)

diff --git a/integrations/nur/default.nix b/integrations/nur/default.nix
new file mode 100644
index 00000000..6732585a
--- /dev/null
+++ b/integrations/nur/default.nix
@@ -0,0 +1,20 @@
+# Nix User Repository (NUR)
+# - <https://github.com/nix-community/NUR>
+#
+# this file is not reachable from the top-level of my nixos configs (i.e. toplevel flake.nix)
+# nor is it intended for anyone who wants to reference my config directly
+#   (consider the toplevel flake.nix outputs instead).
+#
+# rather, this is the entrypoint through which NUR finds my packages, modules, overlays.
+# it's reachable only from those using this repo via NUR.
+
+{ pkgs }:
+let
+  sanePkgs = import ../../pkgs/additional pkgs;
+in
+({
+  overlays.pkgs = import ../../overlays/pkgs.nix;
+  pkgs = sanePkgs;
+  modules = import ../../modules { inherit (pkgs) lib; };
+  lib = import ../../modules/lib { inherit (pkgs) lib; };
+} // sanePkgs)
diff --git a/modules/default.nix b/modules/default.nix
index 892d6540..f984a038 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 {
   imports = [
@@ -15,7 +15,7 @@
   ];
 
   _module.args =  {
-    sane-lib = import ./lib { inherit lib utils; };
+    sane-lib = import ./lib { inherit lib; };
     sane-data = import ./data { inherit lib; };
   };
 }
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
index c7da9363..6d98524c 100644
--- a/modules/lib/default.nix
+++ b/modules/lib/default.nix
@@ -1,12 +1,12 @@
-{ lib, ... }@moduleArgs:
+{ lib, ... }:
 
 let
 sane-lib = rec {
-  feeds = import ./feeds.nix moduleArgs;
-  fs = import ./fs.nix moduleArgs;
-  merge = import ./merge.nix ({ inherit sane-lib; } // moduleArgs);
-  path = import ./path.nix moduleArgs;
-  types = import ./types.nix moduleArgs;
+  feeds = import ./feeds.nix { inherit lib; };
+  fs = import ./fs.nix { inherit lib; };
+  merge = import ./merge.nix { inherit lib sane-lib; };
+  path = import ./path.nix { inherit lib; };
+  types = import ./types.nix { inherit lib; };
 
   # re-exports
   inherit (merge) mkTypedMerge;
diff --git a/modules/lib/path.nix b/modules/lib/path.nix
index 6866b663..6bdef6a2 100644
--- a/modules/lib/path.nix
+++ b/modules/lib/path.nix
@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 let path = rec {
 
diff --git a/overlays/pkgs.nix b/overlays/pkgs.nix
index d8d44d2d..61005ab5 100644
--- a/overlays/pkgs.nix
+++ b/overlays/pkgs.nix
@@ -1,64 +1,24 @@
 (next: prev:
-  with next;
   let
-    sane = rec {
-      sane-lib = import ../modules/lib next;
-      #### my own, non-upstreamable packages:
-      static-nix-shell = callPackages ../pkgs/static-nix-shell { };
-      sane-scripts = callPackage ../pkgs/sane-scripts { };
-      mx-sanebot = callPackage ../pkgs/mx-sanebot { };
-      feeds = recurseIntoAttrs (callPackage ../pkgs/feeds { });
-      tow-boot-pinephone = callPackage ../pkgs/tow-boot-pinephone { };
-      tow-boot-rpi4 = callPackage ../pkgs/tow-boot-rpi4 { };
-      bootpart-uefi-x86_64 = callPackage ../pkgs/bootpart-uefi-x86_64 { };
-      bootpart-tow-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-tow-boot-rpi-aarch64 { };
-      bootpart-u-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-u-boot-rpi-aarch64 { };
-      rtl8723cs-firmware = callPackage ../pkgs/rtl8723cs-firmware { };
-      linux-megous = callPackage ../pkgs/linux-megous {
-        kernelPatches = [
-          prev.kernelPatches.bridge_stp_helper
-          prev.kernelPatches.request_key_helper
-        ];
-      };
-
-      sublime-music-mobile = callPackage ../pkgs/sublime-music-mobile { };
-
-      #### customized packages
-      fluffychat-moby = callPackage ../pkgs/fluffychat-moby { };
-      gpodder-configured = callPackage ../pkgs/gpodder-configured { };
-      # jackett doesn't allow customization of the bind address: this will probably always be here.
-      jackett = callPackage ../pkgs/jackett { inherit (prev) jackett; };
-      # mozilla keeps nerfing itself and removing configuration options
-      firefox-unwrapped = callPackage ../pkgs/firefox-unwrapped { inherit (prev) firefox-unwrapped; };
-
-      # patch rpi uboot with something that fixes USB HDD boot
-      ubootRaspberryPi4_64bit = callPackage ../pkgs/ubootRaspberryPi4_64bit { };
-
-      gocryptfs = callPackage ../pkgs/gocryptfs { inherit (prev) gocryptfs; };
-
-      browserpass = callPackage ../pkgs/browserpass { inherit (prev) browserpass; };
-
-      fractal-latest = callPackage ../pkgs/fractal-latest { };
-
-      #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
-
-      cargo-docset = callPackage ../pkgs/cargo-docset { };
-
+    additional = import ../pkgs/additional next;
+    python-packages = {
       pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        (py-final: py-prev: {
-          feedsearch-crawler = py-final.callPackage ../pkgs/feedsearch-crawler { };
-        })
+        (py-final: py-prev: import ../pkgs/python-packages { inherit (py-prev) callPackage; })
       ];
-
-      kaiteki = callPackage ../pkgs/kaiteki { };
-      lightdm-mobile-greeter = callPackage ../pkgs/lightdm-mobile-greeter { };
-      browserpass-extension = callPackage ../pkgs/browserpass-extension { };
-      gopass-native-messaging-host = callPackage ../pkgs/gopass-native-messaging-host { };
-      tokodon = prev.libsForQt5.callPackage ../pkgs/tokodon { };
-
-      # provided by nixpkgs patch or upstream preview
-      # splatmoji = callPackage ../pkgs/splatmoji { };
     };
+
+    # to avoid infinite recursion, the patched packages require *unpatched* inputs,
+    # but we don't want to just send `prev` naively, else patched packages might
+    # take dependencies on unpatched versions of other packages we patch; or they
+    # won't be able to use inputs from `additional`, etc.
+    #
+    # so, call the patched packages using the `next` package set, except with
+    # they packages we're "about to" patch replaced with their versions from `prev`.
+    #
+    # we could alternatively pass `pkgs = prev // { inherit (next) callPackage; }`,
+    patched = import ../pkgs/patched (next // patchedInputs);
+    patchedInputs = builtins.mapAttrs (name: _patched: prev."${name}") patched;
+
+    sane = additional // python-packages // patched;
   in sane // { inherit sane; }
 )
-
diff --git a/pkgs/bootpart-tow-boot-rpi-aarch64/config.txt b/pkgs/additional/bootpart-tow-boot-rpi-aarch64/config.txt
similarity index 100%
rename from pkgs/bootpart-tow-boot-rpi-aarch64/config.txt
rename to pkgs/additional/bootpart-tow-boot-rpi-aarch64/config.txt
diff --git a/pkgs/bootpart-tow-boot-rpi-aarch64/default.nix b/pkgs/additional/bootpart-tow-boot-rpi-aarch64/default.nix
similarity index 100%
rename from pkgs/bootpart-tow-boot-rpi-aarch64/default.nix
rename to pkgs/additional/bootpart-tow-boot-rpi-aarch64/default.nix
diff --git a/pkgs/bootpart-u-boot-rpi-aarch64/config.txt b/pkgs/additional/bootpart-u-boot-rpi-aarch64/config.txt
similarity index 100%
rename from pkgs/bootpart-u-boot-rpi-aarch64/config.txt
rename to pkgs/additional/bootpart-u-boot-rpi-aarch64/config.txt
diff --git a/pkgs/bootpart-u-boot-rpi-aarch64/default.nix b/pkgs/additional/bootpart-u-boot-rpi-aarch64/default.nix
similarity index 100%
rename from pkgs/bootpart-u-boot-rpi-aarch64/default.nix
rename to pkgs/additional/bootpart-u-boot-rpi-aarch64/default.nix
diff --git a/pkgs/bootpart-uefi-x86_64/default.nix b/pkgs/additional/bootpart-uefi-x86_64/default.nix
similarity index 100%
rename from pkgs/bootpart-uefi-x86_64/default.nix
rename to pkgs/additional/bootpart-uefi-x86_64/default.nix
diff --git a/pkgs/browserpass-extension/default.nix b/pkgs/additional/browserpass-extension/default.nix
similarity index 100%
rename from pkgs/browserpass-extension/default.nix
rename to pkgs/additional/browserpass-extension/default.nix
diff --git a/pkgs/cargo-docset/default.nix b/pkgs/additional/cargo-docset/default.nix
similarity index 100%
rename from pkgs/cargo-docset/default.nix
rename to pkgs/additional/cargo-docset/default.nix
diff --git a/pkgs/additional/default.nix b/pkgs/additional/default.nix
new file mode 100644
index 00000000..eeb61d30
--- /dev/null
+++ b/pkgs/additional/default.nix
@@ -0,0 +1,35 @@
+# { callPackage, callPackages, libsForQt5, pkgs, recurseIntoAttrs }:
+pkgs:
+let
+  inherit (pkgs) callPackage callPackages libsForQt5 recurseIntoAttrs;
+in {
+  sane-lib = import ../../modules/lib pkgs;
+
+  bootpart-tow-boot-rpi-aarch64 = callPackage ./bootpart-tow-boot-rpi-aarch64 { };
+  bootpart-u-boot-rpi-aarch64 = callPackage ./bootpart-u-boot-rpi-aarch64 { };
+  bootpart-uefi-x86_64 = callPackage ./bootpart-uefi-x86_64 { };
+  browserpass-extension = callPackage ./browserpass-extension { };
+  cargo-docset = callPackage ./cargo-docset { };
+  feeds = recurseIntoAttrs (callPackage ./feeds { });
+  fluffychat-moby = callPackage ./fluffychat-moby { };
+  fractal-latest = callPackage ./fractal-latest { };
+  gopass-native-messaging-host = callPackage ./gopass-native-messaging-host { };
+  gpodder-configured = callPackage ./gpodder-configured { };
+  kaiteki = callPackage ./kaiteki { };
+  lightdm-mobile-greeter = callPackage ./lightdm-mobile-greeter { };
+  linux-megous = callPackage ./linux-megous { };
+  mx-sanebot = callPackage ./mx-sanebot { };
+  rtl8723cs-firmware = callPackage ./rtl8723cs-firmware { };
+  sane-scripts = callPackage ./sane-scripts { };
+  static-nix-shell = callPackages ./static-nix-shell { };
+  sublime-music-mobile = callPackage ./sublime-music-mobile { };
+  tokodon = libsForQt5.callPackage ./tokodon { };
+  tow-boot-pinephone = callPackage ./tow-boot-pinephone { };
+  tow-boot-rpi4 = callPackage ./tow-boot-rpi4 { };
+
+  # patch rpi uboot with something that fixes USB HDD boot
+  ubootRaspberryPi4_64bit = callPackage ./ubootRaspberryPi4_64bit { };
+
+  # provided by nixpkgs patch or upstream PR
+  # splatmoji = callPackage ./splatmoji { };
+}
diff --git a/pkgs/feeds/default.nix b/pkgs/additional/feeds/default.nix
similarity index 100%
rename from pkgs/feeds/default.nix
rename to pkgs/additional/feeds/default.nix
diff --git a/pkgs/feeds/template.nix b/pkgs/additional/feeds/template.nix
similarity index 100%
rename from pkgs/feeds/template.nix
rename to pkgs/additional/feeds/template.nix
diff --git a/pkgs/feeds/update.py b/pkgs/additional/feeds/update.py
similarity index 100%
rename from pkgs/feeds/update.py
rename to pkgs/additional/feeds/update.py
diff --git a/pkgs/fluffychat-moby/default.nix b/pkgs/additional/fluffychat-moby/default.nix
similarity index 100%
rename from pkgs/fluffychat-moby/default.nix
rename to pkgs/additional/fluffychat-moby/default.nix
diff --git a/pkgs/fractal-latest/default.nix b/pkgs/additional/fractal-latest/default.nix
similarity index 100%
rename from pkgs/fractal-latest/default.nix
rename to pkgs/additional/fractal-latest/default.nix
diff --git a/pkgs/gopass-native-messaging-host/com.justwatch.gopass.json b/pkgs/additional/gopass-native-messaging-host/com.justwatch.gopass.json
similarity index 100%
rename from pkgs/gopass-native-messaging-host/com.justwatch.gopass.json
rename to pkgs/additional/gopass-native-messaging-host/com.justwatch.gopass.json
diff --git a/pkgs/gopass-native-messaging-host/default.nix b/pkgs/additional/gopass-native-messaging-host/default.nix
similarity index 100%
rename from pkgs/gopass-native-messaging-host/default.nix
rename to pkgs/additional/gopass-native-messaging-host/default.nix
diff --git a/pkgs/gopass-native-messaging-host/gopass-wrapper.sh b/pkgs/additional/gopass-native-messaging-host/gopass-wrapper.sh
similarity index 100%
rename from pkgs/gopass-native-messaging-host/gopass-wrapper.sh
rename to pkgs/additional/gopass-native-messaging-host/gopass-wrapper.sh
diff --git a/pkgs/gpodder-configured/default.nix b/pkgs/additional/gpodder-configured/default.nix
similarity index 100%
rename from pkgs/gpodder-configured/default.nix
rename to pkgs/additional/gpodder-configured/default.nix
diff --git a/pkgs/gpodder-configured/gpodder-remove-extra b/pkgs/additional/gpodder-configured/gpodder-remove-extra
similarity index 100%
rename from pkgs/gpodder-configured/gpodder-remove-extra
rename to pkgs/additional/gpodder-configured/gpodder-remove-extra
diff --git a/pkgs/kaiteki/default.nix b/pkgs/additional/kaiteki/default.nix
similarity index 100%
rename from pkgs/kaiteki/default.nix
rename to pkgs/additional/kaiteki/default.nix
diff --git a/pkgs/lightdm-mobile-greeter/default.nix b/pkgs/additional/lightdm-mobile-greeter/default.nix
similarity index 100%
rename from pkgs/lightdm-mobile-greeter/default.nix
rename to pkgs/additional/lightdm-mobile-greeter/default.nix
diff --git a/pkgs/linux-megous/default.nix b/pkgs/additional/linux-megous/default.nix
similarity index 82%
rename from pkgs/linux-megous/default.nix
rename to pkgs/additional/linux-megous/default.nix
index 5c1ca67c..5c233d8c 100644
--- a/pkgs/linux-megous/default.nix
+++ b/pkgs/additional/linux-megous/default.nix
@@ -1,4 +1,13 @@
-{ lib, buildPackages, fetchFromGitHub, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib
+, buildLinux
+, buildPackages
+, fetchFromGitHub
+, kernelPatches
+, modDirVersionArg ? null
+, nixosTests
+, perl
+, ...
+} @ args:
 
 with lib;
 
@@ -15,6 +24,11 @@ in buildLinux (args // rec {
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
+  kernelPatches = [
+    kernelPatches.bridge_stp_helper
+    kernelPatches.request_key_helper
+  ];
+
   src = fetchFromGitHub {
     # HOW TO UPDATE:
     # - `git fetch` from megous' github.
diff --git a/pkgs/mx-sanebot/Cargo.lock b/pkgs/additional/mx-sanebot/Cargo.lock
similarity index 100%
rename from pkgs/mx-sanebot/Cargo.lock
rename to pkgs/additional/mx-sanebot/Cargo.lock
diff --git a/pkgs/mx-sanebot/Cargo.toml b/pkgs/additional/mx-sanebot/Cargo.toml
similarity index 100%
rename from pkgs/mx-sanebot/Cargo.toml
rename to pkgs/additional/mx-sanebot/Cargo.toml
diff --git a/pkgs/mx-sanebot/default.nix b/pkgs/additional/mx-sanebot/default.nix
similarity index 100%
rename from pkgs/mx-sanebot/default.nix
rename to pkgs/additional/mx-sanebot/default.nix
diff --git a/pkgs/mx-sanebot/flake.lock b/pkgs/additional/mx-sanebot/flake.lock
similarity index 100%
rename from pkgs/mx-sanebot/flake.lock
rename to pkgs/additional/mx-sanebot/flake.lock
diff --git a/pkgs/mx-sanebot/flake.nix b/pkgs/additional/mx-sanebot/flake.nix
similarity index 100%
rename from pkgs/mx-sanebot/flake.nix
rename to pkgs/additional/mx-sanebot/flake.nix
diff --git a/pkgs/mx-sanebot/shell.nix b/pkgs/additional/mx-sanebot/shell.nix
similarity index 100%
rename from pkgs/mx-sanebot/shell.nix
rename to pkgs/additional/mx-sanebot/shell.nix
diff --git a/pkgs/mx-sanebot/src/main.rs b/pkgs/additional/mx-sanebot/src/main.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/main.rs
rename to pkgs/additional/mx-sanebot/src/main.rs
diff --git a/pkgs/mx-sanebot/src/msg_handler.rs b/pkgs/additional/mx-sanebot/src/msg_handler.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/msg_handler.rs
rename to pkgs/additional/mx-sanebot/src/msg_handler.rs
diff --git a/pkgs/mx-sanebot/src/parsing.rs b/pkgs/additional/mx-sanebot/src/parsing.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/parsing.rs
rename to pkgs/additional/mx-sanebot/src/parsing.rs
diff --git a/pkgs/rtl8723cs-firmware/default.nix b/pkgs/additional/rtl8723cs-firmware/default.nix
similarity index 100%
rename from pkgs/rtl8723cs-firmware/default.nix
rename to pkgs/additional/rtl8723cs-firmware/default.nix
diff --git a/pkgs/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
similarity index 100%
rename from pkgs/sane-scripts/default.nix
rename to pkgs/additional/sane-scripts/default.nix
diff --git a/pkgs/sane-scripts/resholve-prologue b/pkgs/additional/sane-scripts/resholve-prologue
similarity index 100%
rename from pkgs/sane-scripts/resholve-prologue
rename to pkgs/additional/sane-scripts/resholve-prologue
diff --git a/pkgs/sane-scripts/src/sane-backup-ls b/pkgs/additional/sane-scripts/src/sane-backup-ls
similarity index 100%
rename from pkgs/sane-scripts/src/sane-backup-ls
rename to pkgs/additional/sane-scripts/src/sane-backup-ls
diff --git a/pkgs/sane-scripts/src/sane-backup-restore b/pkgs/additional/sane-scripts/src/sane-backup-restore
similarity index 100%
rename from pkgs/sane-scripts/src/sane-backup-restore
rename to pkgs/additional/sane-scripts/src/sane-backup-restore
diff --git a/pkgs/sane-scripts/src/sane-bt-add b/pkgs/additional/sane-scripts/src/sane-bt-add
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-add
rename to pkgs/additional/sane-scripts/src/sane-bt-add
diff --git a/pkgs/sane-scripts/src/sane-bt-search b/pkgs/additional/sane-scripts/src/sane-bt-search
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-search
rename to pkgs/additional/sane-scripts/src/sane-bt-search
diff --git a/pkgs/sane-scripts/src/sane-bt-show b/pkgs/additional/sane-scripts/src/sane-bt-show
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-show
rename to pkgs/additional/sane-scripts/src/sane-bt-show
diff --git a/pkgs/sane-scripts/src/sane-date-math b/pkgs/additional/sane-scripts/src/sane-date-math
similarity index 100%
rename from pkgs/sane-scripts/src/sane-date-math
rename to pkgs/additional/sane-scripts/src/sane-date-math
diff --git a/pkgs/sane-scripts/src/sane-deadlines b/pkgs/additional/sane-scripts/src/sane-deadlines
similarity index 100%
rename from pkgs/sane-scripts/src/sane-deadlines
rename to pkgs/additional/sane-scripts/src/sane-deadlines
diff --git a/pkgs/sane-scripts/src/sane-dev-cargo-loop b/pkgs/additional/sane-scripts/src/sane-dev-cargo-loop
similarity index 100%
rename from pkgs/sane-scripts/src/sane-dev-cargo-loop
rename to pkgs/additional/sane-scripts/src/sane-dev-cargo-loop
diff --git a/pkgs/sane-scripts/src/sane-find-dotfiles b/pkgs/additional/sane-scripts/src/sane-find-dotfiles
similarity index 100%
rename from pkgs/sane-scripts/src/sane-find-dotfiles
rename to pkgs/additional/sane-scripts/src/sane-find-dotfiles
diff --git a/pkgs/sane-scripts/src/sane-git-init b/pkgs/additional/sane-scripts/src/sane-git-init
similarity index 100%
rename from pkgs/sane-scripts/src/sane-git-init
rename to pkgs/additional/sane-scripts/src/sane-git-init
diff --git a/pkgs/sane-scripts/src/sane-ip-check b/pkgs/additional/sane-scripts/src/sane-ip-check
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-check
rename to pkgs/additional/sane-scripts/src/sane-ip-check
diff --git a/pkgs/sane-scripts/src/sane-ip-check-router-wan b/pkgs/additional/sane-scripts/src/sane-ip-check-router-wan
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-check-router-wan
rename to pkgs/additional/sane-scripts/src/sane-ip-check-router-wan
diff --git a/pkgs/sane-scripts/src/sane-ip-reconnect b/pkgs/additional/sane-scripts/src/sane-ip-reconnect
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-reconnect
rename to pkgs/additional/sane-scripts/src/sane-ip-reconnect
diff --git a/pkgs/sane-scripts/src/sane-mount-servo b/pkgs/additional/sane-scripts/src/sane-mount-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-mount-servo
rename to pkgs/additional/sane-scripts/src/sane-mount-servo
diff --git a/pkgs/sane-scripts/src/sane-mount-servo-root b/pkgs/additional/sane-scripts/src/sane-mount-servo-root
similarity index 100%
rename from pkgs/sane-scripts/src/sane-mount-servo-root
rename to pkgs/additional/sane-scripts/src/sane-mount-servo-root
diff --git a/pkgs/sane-scripts/src/sane-private-change-passwd b/pkgs/additional/sane-scripts/src/sane-private-change-passwd
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-change-passwd
rename to pkgs/additional/sane-scripts/src/sane-private-change-passwd
diff --git a/pkgs/sane-scripts/src/sane-private-do b/pkgs/additional/sane-scripts/src/sane-private-do
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-do
rename to pkgs/additional/sane-scripts/src/sane-private-do
diff --git a/pkgs/sane-scripts/src/sane-private-init b/pkgs/additional/sane-scripts/src/sane-private-init
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-init
rename to pkgs/additional/sane-scripts/src/sane-private-init
diff --git a/pkgs/sane-scripts/src/sane-private-lock b/pkgs/additional/sane-scripts/src/sane-private-lock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-lock
rename to pkgs/additional/sane-scripts/src/sane-private-lock
diff --git a/pkgs/sane-scripts/src/sane-private-unlock b/pkgs/additional/sane-scripts/src/sane-private-unlock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-unlock
rename to pkgs/additional/sane-scripts/src/sane-private-unlock
diff --git a/pkgs/sane-scripts/src/sane-rcp b/pkgs/additional/sane-scripts/src/sane-rcp
similarity index 100%
rename from pkgs/sane-scripts/src/sane-rcp
rename to pkgs/additional/sane-scripts/src/sane-rcp
diff --git a/pkgs/sane-scripts/src/sane-reboot b/pkgs/additional/sane-scripts/src/sane-reboot
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reboot
rename to pkgs/additional/sane-scripts/src/sane-reboot
diff --git a/pkgs/sane-scripts/src/sane-reclaim-boot-space b/pkgs/additional/sane-scripts/src/sane-reclaim-boot-space
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reclaim-boot-space
rename to pkgs/additional/sane-scripts/src/sane-reclaim-boot-space
diff --git a/pkgs/sane-scripts/src/sane-reclaim-disk-space b/pkgs/additional/sane-scripts/src/sane-reclaim-disk-space
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reclaim-disk-space
rename to pkgs/additional/sane-scripts/src/sane-reclaim-disk-space
diff --git a/pkgs/sane-scripts/src/sane-secrets-dump b/pkgs/additional/sane-scripts/src/sane-secrets-dump
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-dump
rename to pkgs/additional/sane-scripts/src/sane-secrets-dump
diff --git a/pkgs/sane-scripts/src/sane-secrets-unlock b/pkgs/additional/sane-scripts/src/sane-secrets-unlock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-unlock
rename to pkgs/additional/sane-scripts/src/sane-secrets-unlock
diff --git a/pkgs/sane-scripts/src/sane-secrets-update-keys b/pkgs/additional/sane-scripts/src/sane-secrets-update-keys
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-update-keys
rename to pkgs/additional/sane-scripts/src/sane-secrets-update-keys
diff --git a/pkgs/sane-scripts/src/sane-shutdown b/pkgs/additional/sane-scripts/src/sane-shutdown
similarity index 100%
rename from pkgs/sane-scripts/src/sane-shutdown
rename to pkgs/additional/sane-scripts/src/sane-shutdown
diff --git a/pkgs/sane-scripts/src/sane-ssl-dump b/pkgs/additional/sane-scripts/src/sane-ssl-dump
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ssl-dump
rename to pkgs/additional/sane-scripts/src/sane-ssl-dump
diff --git a/pkgs/sane-scripts/src/sane-stop-all-servo b/pkgs/additional/sane-scripts/src/sane-stop-all-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-stop-all-servo
rename to pkgs/additional/sane-scripts/src/sane-stop-all-servo
diff --git a/pkgs/sane-scripts/src/sane-sudo-redirect b/pkgs/additional/sane-scripts/src/sane-sudo-redirect
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sudo-redirect
rename to pkgs/additional/sane-scripts/src/sane-sudo-redirect
diff --git a/pkgs/sane-scripts/src/sane-sync-from-iphone b/pkgs/additional/sane-scripts/src/sane-sync-from-iphone
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sync-from-iphone
rename to pkgs/additional/sane-scripts/src/sane-sync-from-iphone
diff --git a/pkgs/sane-scripts/src/sane-sync-from-servo b/pkgs/additional/sane-scripts/src/sane-sync-from-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sync-from-servo
rename to pkgs/additional/sane-scripts/src/sane-sync-from-servo
diff --git a/pkgs/sane-scripts/src/sane-test b/pkgs/additional/sane-scripts/src/sane-test
similarity index 100%
rename from pkgs/sane-scripts/src/sane-test
rename to pkgs/additional/sane-scripts/src/sane-test
diff --git a/pkgs/sane-scripts/src/sane-vpn-down b/pkgs/additional/sane-scripts/src/sane-vpn-down
similarity index 100%
rename from pkgs/sane-scripts/src/sane-vpn-down
rename to pkgs/additional/sane-scripts/src/sane-vpn-down
diff --git a/pkgs/sane-scripts/src/sane-vpn-up b/pkgs/additional/sane-scripts/src/sane-vpn-up
similarity index 100%
rename from pkgs/sane-scripts/src/sane-vpn-up
rename to pkgs/additional/sane-scripts/src/sane-vpn-up
diff --git a/pkgs/sane-scripts/src/sane-which b/pkgs/additional/sane-scripts/src/sane-which
similarity index 100%
rename from pkgs/sane-scripts/src/sane-which
rename to pkgs/additional/sane-scripts/src/sane-which
diff --git a/pkgs/splatmoji/default.nix b/pkgs/additional/splatmoji/default.nix
similarity index 100%
rename from pkgs/splatmoji/default.nix
rename to pkgs/additional/splatmoji/default.nix
diff --git a/pkgs/static-nix-shell/default.nix b/pkgs/additional/static-nix-shell/default.nix
similarity index 89%
rename from pkgs/static-nix-shell/default.nix
rename to pkgs/additional/static-nix-shell/default.nix
index 24e2ac99..c0f5e061 100644
--- a/pkgs/static-nix-shell/default.nix
+++ b/pkgs/additional/static-nix-shell/default.nix
@@ -2,14 +2,12 @@
 , lib
 , makeWrapper
 , python3
-, sane-lib
 , stdenv
 }:
 
 let
-  inherit (builtins) attrNames attrValues concatStringsSep map typeOf;
+  inherit (builtins) attrNames attrValues concatStringsSep foldl' map typeOf;
   inherit (lib) concatMapAttrs;
-  inherit (sane-lib) mapToAttrs;
   pkgs' = pkgs;
 in {
   # transform a file which uses `#!/usr/bin/env nix-shell` shebang with a `python3` interpreter
@@ -28,10 +26,9 @@ in {
       #   <value> = package to provide
       pkgsToAttrs = prefix: pkgSet: expr: ({
         "lambda" = expr: pkgsToAttrs prefix pkgSet (expr pkgSet);
-        "list" = expr: mapToAttrs (pname: {
-          name = prefix + pname;
-          value = pkgSet."${pname}";
-        }) expr;
+        "list" = expr: foldl' (acc: pname: acc // {
+          "${prefix + pname}" = pkgSet."${pname}";
+        }) {} expr;
         "set" = expr: expr;
       })."${typeOf expr}" expr;
       pyEnv = python3.withPackages (ps: attrValues (
diff --git a/pkgs/sublime-music-mobile/default.nix b/pkgs/additional/sublime-music-mobile/default.nix
similarity index 100%
rename from pkgs/sublime-music-mobile/default.nix
rename to pkgs/additional/sublime-music-mobile/default.nix
diff --git a/pkgs/tokodon/default.nix b/pkgs/additional/tokodon/default.nix
similarity index 100%
rename from pkgs/tokodon/default.nix
rename to pkgs/additional/tokodon/default.nix
diff --git a/pkgs/tow-boot-pinephone/default.nix b/pkgs/additional/tow-boot-pinephone/default.nix
similarity index 100%
rename from pkgs/tow-boot-pinephone/default.nix
rename to pkgs/additional/tow-boot-pinephone/default.nix
diff --git a/pkgs/tow-boot-rpi4/default.nix b/pkgs/additional/tow-boot-rpi4/default.nix
similarity index 100%
rename from pkgs/tow-boot-rpi4/default.nix
rename to pkgs/additional/tow-boot-rpi4/default.nix
diff --git a/pkgs/ubootRaspberryPi4_64bit/01-skip-lba-check.patch b/pkgs/additional/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
rename to pkgs/additional/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
diff --git a/pkgs/ubootRaspberryPi4_64bit/03-verbose-log.patch b/pkgs/additional/ubootRaspberryPi4_64bit/03-verbose-log.patch
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/03-verbose-log.patch
rename to pkgs/additional/ubootRaspberryPi4_64bit/03-verbose-log.patch
diff --git a/pkgs/ubootRaspberryPi4_64bit/default.nix b/pkgs/additional/ubootRaspberryPi4_64bit/default.nix
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/default.nix
rename to pkgs/additional/ubootRaspberryPi4_64bit/default.nix
diff --git a/pkgs/browserpass/default.nix b/pkgs/browserpass/default.nix
deleted file mode 100644
index a8708858..00000000
--- a/pkgs/browserpass/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib
-, browserpass
-, bash
-, fetchFromGitea
-, gnused
-, sane-scripts
-, sops
-, stdenv
-, substituteAll
-}:
-
-let
-  sane-browserpass-gpg = stdenv.mkDerivation {
-    pname = "sane-browserpass-gpg";
-    version = "0.1.0";
-    src = ./.;
-
-    inherit bash gnused sops;
-    sane_scripts = sane-scripts;
-    installPhase = ''
-      mkdir -p $out/bin
-      substituteAll ${./sops-gpg-adapter} $out/bin/gpg
-      chmod +x $out/bin/gpg
-      ln -s $out/bin/gpg $out/bin/gpg2
-    '';
-
-  };
-in
-(browserpass.overrideAttrs (upstream: {
-  src = fetchFromGitea {
-    domain = "git.uninsane.org";
-    owner = "colin";
-    repo = "browserpass-native";
-    # don't forcibly append '.gpg'
-    rev = "d3ef88e12cb127914fb0ead762b7baee6913592f";
-    hash = "sha256-FRnFmCJI/1f92DOI1VXSPivSBzIR372gmgLUfLLiuPc=";
-  };
-  installPhase = ''
-    make install
-
-    wrapProgram $out/bin/browserpass \
-      --prefix PATH : ${lib.makeBinPath [ sane-browserpass-gpg ]}
-
-    # This path is used by our firefox wrapper for finding native messaging hosts
-    mkdir -p $out/lib/mozilla/native-messaging-hosts
-    ln -s $out/lib/browserpass/hosts/firefox/*.json $out/lib/mozilla/native-messaging-hosts
-  '';
-}))
diff --git a/pkgs/patched/browserpass/default.nix b/pkgs/patched/browserpass/default.nix
new file mode 100644
index 00000000..ab3dd277
--- /dev/null
+++ b/pkgs/patched/browserpass/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, browserpass
+, bash
+, fetchFromGitea
+, gnused
+, sane-scripts
+, sops
+, stdenv
+, substituteAll
+}:
+
+let
+  sane-browserpass-gpg = stdenv.mkDerivation {
+    pname = "sane-browserpass-gpg";
+    version = "0.1.0";
+    src = ./.;
+
+    inherit bash gnused sops;
+    sane_scripts = sane-scripts;
+    installPhase = ''
+      mkdir -p $out/bin
+      substituteAll ${./sops-gpg-adapter} $out/bin/gpg
+      chmod +x $out/bin/gpg
+      ln -s $out/bin/gpg $out/bin/gpg2
+    '';
+
+  };
+in
+  browserpass.overrideAttrs (upstream: {
+    src = fetchFromGitea {
+      domain = "git.uninsane.org";
+      owner = "colin";
+      repo = "browserpass-native";
+      # don't forcibly append '.gpg'
+      rev = "d3ef88e12cb127914fb0ead762b7baee6913592f";
+      hash = "sha256-FRnFmCJI/1f92DOI1VXSPivSBzIR372gmgLUfLLiuPc=";
+    };
+    installPhase = ''
+      make install
+
+      wrapProgram $out/bin/browserpass \
+        --prefix PATH : ${lib.makeBinPath [ sane-browserpass-gpg ]}
+
+      # This path is used by our firefox wrapper for finding native messaging hosts
+      mkdir -p $out/lib/mozilla/native-messaging-hosts
+      ln -s $out/lib/browserpass/hosts/firefox/*.json $out/lib/mozilla/native-messaging-hosts
+    '';
+  })
diff --git a/pkgs/browserpass/sops-gpg-adapter b/pkgs/patched/browserpass/sops-gpg-adapter
similarity index 100%
rename from pkgs/browserpass/sops-gpg-adapter
rename to pkgs/patched/browserpass/sops-gpg-adapter
diff --git a/pkgs/patched/default.nix b/pkgs/patched/default.nix
new file mode 100644
index 00000000..e0606005
--- /dev/null
+++ b/pkgs/patched/default.nix
@@ -0,0 +1,18 @@
+pkgs:
+let
+  inherit (pkgs) callPackage;
+in {
+  # XXX: the `inherit`s here are because:
+  # - pkgs.callPackage draws from the _final_ package set.
+  # - pkgs.XYZ draws (selectively) from the _previous_ package set.
+  # see <overlays/pkgs.nix>
+  browserpass = callPackage ./browserpass { inherit (pkgs) browserpass; };
+
+  # mozilla keeps nerfing itself and removing configuration options
+  firefox-unwrapped = callPackage ./firefox-unwrapped { inherit (pkgs) firefox-unwrapped; };
+
+  gocryptfs = callPackage ./gocryptfs { inherit (pkgs) gocryptfs; };
+
+  # jackett doesn't allow customization of the bind address: this will probably always be here.
+  jackett = callPackage ./jackett { inherit (pkgs) jackett; };
+}
diff --git a/pkgs/firefox-unwrapped/allow-searchengines-non-esr.patch b/pkgs/patched/firefox-unwrapped/allow-searchengines-non-esr.patch
similarity index 100%
rename from pkgs/firefox-unwrapped/allow-searchengines-non-esr.patch
rename to pkgs/patched/firefox-unwrapped/allow-searchengines-non-esr.patch
diff --git a/pkgs/firefox-unwrapped/default.nix b/pkgs/patched/firefox-unwrapped/default.nix
similarity index 100%
rename from pkgs/firefox-unwrapped/default.nix
rename to pkgs/patched/firefox-unwrapped/default.nix
diff --git a/pkgs/gocryptfs/default.nix b/pkgs/patched/gocryptfs/default.nix
similarity index 100%
rename from pkgs/gocryptfs/default.nix
rename to pkgs/patched/gocryptfs/default.nix
diff --git a/pkgs/jackett/01-fix-bind-host.patch b/pkgs/patched/jackett/01-fix-bind-host.patch
similarity index 100%
rename from pkgs/jackett/01-fix-bind-host.patch
rename to pkgs/patched/jackett/01-fix-bind-host.patch
diff --git a/pkgs/jackett/default.nix b/pkgs/patched/jackett/default.nix
similarity index 100%
rename from pkgs/jackett/default.nix
rename to pkgs/patched/jackett/default.nix
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
new file mode 100644
index 00000000..50c34775
--- /dev/null
+++ b/pkgs/python-packages/default.nix
@@ -0,0 +1,4 @@
+{ callPackage }:
+{
+  feedsearch-crawler = callPackage ./feedsearch-crawler { };
+}
diff --git a/pkgs/feedsearch-crawler/0001-response-chunk-size.patch b/pkgs/python-packages/feedsearch-crawler/0001-response-chunk-size.patch
similarity index 100%
rename from pkgs/feedsearch-crawler/0001-response-chunk-size.patch
rename to pkgs/python-packages/feedsearch-crawler/0001-response-chunk-size.patch
diff --git a/pkgs/feedsearch-crawler/default.nix b/pkgs/python-packages/feedsearch-crawler/default.nix
similarity index 100%
rename from pkgs/feedsearch-crawler/default.nix
rename to pkgs/python-packages/feedsearch-crawler/default.nix

From 9f21fbcedacdb909c7bceea6e6d83c20d39d6cb3 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 00:56:23 +0000
Subject: [PATCH 02/10] nur: better docs for my entrypoint

---
 integrations/nur/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/integrations/nur/default.nix b/integrations/nur/default.nix
index 6732585a..ce1d8be1 100644
--- a/integrations/nur/default.nix
+++ b/integrations/nur/default.nix
@@ -7,14 +7,20 @@
 #
 # rather, this is the entrypoint through which NUR finds my packages, modules, overlays.
 # it's reachable only from those using this repo via NUR.
+#
+# to manually query available packages, modules, etc, true:
+# - nix eval --impure --expr 'builtins.attrNames (import ./. {})'
 
-{ pkgs }:
+{ pkgs ? import <nixpkgs> {} }:
 let
   sanePkgs = import ../../pkgs/additional pkgs;
 in
 ({
+  # contains both packages not in nixpkgs, and patched versions of those in nixpkgs
   overlays.pkgs = import ../../overlays/pkgs.nix;
+  # contains only my packages which aren't in nixpkgs
   pkgs = sanePkgs;
+
   modules = import ../../modules { inherit (pkgs) lib; };
   lib = import ../../modules/lib { inherit (pkgs) lib; };
 } // sanePkgs)

From 1b76f1d6430f4902fb5c5cca5e839e10827c7616 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 03:19:39 +0000
Subject: [PATCH 03/10] cleanup: place packages into scopes

this helps for my own packages which depend on eachother: they should now evaluate without an overlay
---
 overlays/pkgs.nix           | 20 +++++-------
 pkgs/additional/default.nix | 63 +++++++++++++++++++------------------
 pkgs/patched/default.nix    | 28 ++++++++---------
 3 files changed, 54 insertions(+), 57 deletions(-)

diff --git a/overlays/pkgs.nix b/overlays/pkgs.nix
index 61005ab5..ca61e4f4 100644
--- a/overlays/pkgs.nix
+++ b/overlays/pkgs.nix
@@ -1,24 +1,18 @@
 (next: prev:
   let
-    additional = import ../pkgs/additional next;
+    additional = import ../pkgs/additional
+      { pkgs = next; lib = prev.lib; };
     python-packages = {
       pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
         (py-final: py-prev: import ../pkgs/python-packages { inherit (py-prev) callPackage; })
       ];
     };
 
-    # to avoid infinite recursion, the patched packages require *unpatched* inputs,
-    # but we don't want to just send `prev` naively, else patched packages might
-    # take dependencies on unpatched versions of other packages we patch; or they
-    # won't be able to use inputs from `additional`, etc.
-    #
-    # so, call the patched packages using the `next` package set, except with
-    # they packages we're "about to" patch replaced with their versions from `prev`.
-    #
-    # we could alternatively pass `pkgs = prev // { inherit (next) callPackage; }`,
-    patched = import ../pkgs/patched (next // patchedInputs);
-    patchedInputs = builtins.mapAttrs (name: _patched: prev."${name}") patched;
+    patched = import ../pkgs/patched
+      { pkgs = next; lib = prev.lib; unpatched = prev; };
 
     sane = additional // python-packages // patched;
-  in sane // { inherit sane; }
+  in sane // {
+    sane = next.recurseIntoAttrs sane;
+  }
 )
diff --git a/pkgs/additional/default.nix b/pkgs/additional/default.nix
index eeb61d30..1bd766e3 100644
--- a/pkgs/additional/default.nix
+++ b/pkgs/additional/default.nix
@@ -1,35 +1,38 @@
 # { callPackage, callPackages, libsForQt5, pkgs, recurseIntoAttrs }:
-pkgs:
+{ pkgs ? import <nixpkgs> {}, lib ? pkgs.lib }:
 let
-  inherit (pkgs) callPackage callPackages libsForQt5 recurseIntoAttrs;
-in {
-  sane-lib = import ../../modules/lib pkgs;
+  me = lib.makeScope pkgs.newScope (self: with self; {
+    sane-lib = import ../../modules/lib pkgs;
 
-  bootpart-tow-boot-rpi-aarch64 = callPackage ./bootpart-tow-boot-rpi-aarch64 { };
-  bootpart-u-boot-rpi-aarch64 = callPackage ./bootpart-u-boot-rpi-aarch64 { };
-  bootpart-uefi-x86_64 = callPackage ./bootpart-uefi-x86_64 { };
-  browserpass-extension = callPackage ./browserpass-extension { };
-  cargo-docset = callPackage ./cargo-docset { };
-  feeds = recurseIntoAttrs (callPackage ./feeds { });
-  fluffychat-moby = callPackage ./fluffychat-moby { };
-  fractal-latest = callPackage ./fractal-latest { };
-  gopass-native-messaging-host = callPackage ./gopass-native-messaging-host { };
-  gpodder-configured = callPackage ./gpodder-configured { };
-  kaiteki = callPackage ./kaiteki { };
-  lightdm-mobile-greeter = callPackage ./lightdm-mobile-greeter { };
-  linux-megous = callPackage ./linux-megous { };
-  mx-sanebot = callPackage ./mx-sanebot { };
-  rtl8723cs-firmware = callPackage ./rtl8723cs-firmware { };
-  sane-scripts = callPackage ./sane-scripts { };
-  static-nix-shell = callPackages ./static-nix-shell { };
-  sublime-music-mobile = callPackage ./sublime-music-mobile { };
-  tokodon = libsForQt5.callPackage ./tokodon { };
-  tow-boot-pinephone = callPackage ./tow-boot-pinephone { };
-  tow-boot-rpi4 = callPackage ./tow-boot-rpi4 { };
+    bootpart-uefi-x86_64 = callPackage ./bootpart-uefi-x86_64 { };
+    browserpass-extension = callPackage ./browserpass-extension { };
+    cargo-docset = callPackage ./cargo-docset { };
+    feeds = recurseIntoAttrs (callPackage ./feeds { });
+    gopass-native-messaging-host = callPackage ./gopass-native-messaging-host { };
+    gpodder-configured = callPackage ./gpodder-configured { };
+    lightdm-mobile-greeter = callPackage ./lightdm-mobile-greeter { };
+    linux-megous = callPackage ./linux-megous { };
+    mx-sanebot = callPackage ./mx-sanebot { };
+    rtl8723cs-firmware = callPackage ./rtl8723cs-firmware { };
+    sane-scripts = callPackage ./sane-scripts { };
+    static-nix-shell = callPackage ./static-nix-shell { };
+    sublime-music-mobile = callPackage ./sublime-music-mobile { };
+    tow-boot-pinephone = callPackage ./tow-boot-pinephone { };
 
-  # patch rpi uboot with something that fixes USB HDD boot
-  ubootRaspberryPi4_64bit = callPackage ./ubootRaspberryPi4_64bit { };
+    # packages i haven't used for a while, may or may not still work
+    # fluffychat-moby = callPackage ./fluffychat-moby { };
+    # fractal-latest = callPackage ./fractal-latest { };
+    # kaiteki = callPackage ./kaiteki { };
+    # tokodon = libsForQt5.callPackage ./tokodon { };
 
-  # provided by nixpkgs patch or upstream PR
-  # splatmoji = callPackage ./splatmoji { };
-}
+    # old rpi packages that may or may not still work
+    # bootpart-tow-boot-rpi-aarch64 = callPackage ./bootpart-tow-boot-rpi-aarch64 { };
+    # bootpart-u-boot-rpi-aarch64 = callPackage ./bootpart-u-boot-rpi-aarch64 { };
+    # tow-boot-rpi4 = callPackage ./tow-boot-rpi4 { };
+    # patch rpi uboot with something that fixes USB HDD boot
+    # ubootRaspberryPi4_64bit = callPackage ./ubootRaspberryPi4_64bit { };
+
+    # provided by nixpkgs patch or upstream PR
+    # splatmoji = callPackage ./splatmoji { };
+  });
+in me.packages me
diff --git a/pkgs/patched/default.nix b/pkgs/patched/default.nix
index e0606005..3181b493 100644
--- a/pkgs/patched/default.nix
+++ b/pkgs/patched/default.nix
@@ -1,18 +1,18 @@
-pkgs:
+{ pkgs, lib ? pkgs.lib, unpatched ? pkgs }:
 let
-  inherit (pkgs) callPackage;
-in {
-  # XXX: the `inherit`s here are because:
-  # - pkgs.callPackage draws from the _final_ package set.
-  # - pkgs.XYZ draws (selectively) from the _previous_ package set.
-  # see <overlays/pkgs.nix>
-  browserpass = callPackage ./browserpass { inherit (pkgs) browserpass; };
+  me = lib.makeScope pkgs.newScope (self: with self; {
+    # XXX: the `inherit`s here are because:
+    # - pkgs.callPackage draws from the _final_ package set.
+    # - unpatched.XYZ draws (selectively) from the _unpatched_ package set.
+    # see <overlays/pkgs.nix>
+    browserpass = callPackage ./browserpass { inherit (unpatched) browserpass; };
 
-  # mozilla keeps nerfing itself and removing configuration options
-  firefox-unwrapped = callPackage ./firefox-unwrapped { inherit (pkgs) firefox-unwrapped; };
+    # mozilla keeps nerfing itself and removing configuration options
+    firefox-unwrapped = callPackage ./firefox-unwrapped { inherit (unpatched) firefox-unwrapped; };
 
-  gocryptfs = callPackage ./gocryptfs { inherit (pkgs) gocryptfs; };
+    gocryptfs = callPackage ./gocryptfs { inherit (unpatched) gocryptfs; };
 
-  # jackett doesn't allow customization of the bind address: this will probably always be here.
-  jackett = callPackage ./jackett { inherit (pkgs) jackett; };
-}
+    # jackett doesn't allow customization of the bind address: this will probably always be here.
+    jackett = callPackage ./jackett { inherit (unpatched) jackett; };
+  });
+in me.packages me

From 89f81da134a202ec7a47f2b6c6a5ef88eee721f5 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 05:59:48 +0000
Subject: [PATCH 04/10] cleanup: move my packages to just one toplevel scope

having multiple scopes -- particularly near the toplevel -- was actually just a complication
---
 flake.nix                         |  9 +++--
 integrations/nur/default.nix      |  6 +--
 overlays/pkgs.nix                 | 18 ++++-----
 pkgs/additional/default.nix       | 38 ------------------
 pkgs/additional/feeds/default.nix | 19 +++++----
 pkgs/default.nix                  | 66 +++++++++++++++++++++++++++++++
 pkgs/patched/default.nix          | 18 ---------
 7 files changed, 91 insertions(+), 83 deletions(-)
 delete mode 100644 pkgs/additional/default.nix
 create mode 100644 pkgs/default.nix
 delete mode 100644 pkgs/patched/default.nix

diff --git a/flake.nix b/flake.nix
index 4e0648b1..ecd70434 100644
--- a/flake.nix
+++ b/flake.nix
@@ -241,9 +241,12 @@
             (! elem name [ "feeds" "pythonPackagesExtensions" ])
             && (allPkgs.lib.meta.availableOn allPkgs.stdenv.hostPlatform pkg)
           )
-          (allPkgs.sane // {
-            inherit (allPkgs) uninsane-dot-org;
-          })
+          (
+            # expose sane packages and chosen inputs (uninsane.org)
+            (import ./pkgs { pkgs = allPkgs; }) // {
+              inherit (allPkgs) uninsane-dot-org;
+            }
+          )
         )
         # self.legacyPackages;
         { inherit (self.legacyPackages) x86_64-linux; }
diff --git a/integrations/nur/default.nix b/integrations/nur/default.nix
index ce1d8be1..737f6a0e 100644
--- a/integrations/nur/default.nix
+++ b/integrations/nur/default.nix
@@ -8,17 +8,15 @@
 # rather, this is the entrypoint through which NUR finds my packages, modules, overlays.
 # it's reachable only from those using this repo via NUR.
 #
-# to manually query available packages, modules, etc, true:
+# to manually query available packages, modules, etc, try:
 # - nix eval --impure --expr 'builtins.attrNames (import ./. {})'
 
 { pkgs ? import <nixpkgs> {} }:
 let
-  sanePkgs = import ../../pkgs/additional pkgs;
+  sanePkgs = import ../../pkgs { inherit pkgs; };
 in
 ({
-  # contains both packages not in nixpkgs, and patched versions of those in nixpkgs
   overlays.pkgs = import ../../overlays/pkgs.nix;
-  # contains only my packages which aren't in nixpkgs
   pkgs = sanePkgs;
 
   modules = import ../../modules { inherit (pkgs) lib; };
diff --git a/overlays/pkgs.nix b/overlays/pkgs.nix
index ca61e4f4..e09eba00 100644
--- a/overlays/pkgs.nix
+++ b/overlays/pkgs.nix
@@ -1,18 +1,16 @@
 (next: prev:
   let
-    additional = import ../pkgs/additional
-      { pkgs = next; lib = prev.lib; };
+    toplevel-pkgs = import ../pkgs
+      { pkgs = next; lib = prev.lib; unpatched = prev; };
     python-packages = {
       pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
         (py-final: py-prev: import ../pkgs/python-packages { inherit (py-prev) callPackage; })
       ];
     };
-
-    patched = import ../pkgs/patched
-      { pkgs = next; lib = prev.lib; unpatched = prev; };
-
-    sane = additional // python-packages // patched;
-  in sane // {
-    sane = next.recurseIntoAttrs sane;
-  }
+  in
+    # expose all my packages into the root scope:
+    # - `additional` packages
+    # - `patched` versions of nixpkgs (which necessarily shadow their nixpkgs version)
+    # - `pythonPackagesExtensions`
+    toplevel-pkgs
 )
diff --git a/pkgs/additional/default.nix b/pkgs/additional/default.nix
deleted file mode 100644
index 1bd766e3..00000000
--- a/pkgs/additional/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-# { callPackage, callPackages, libsForQt5, pkgs, recurseIntoAttrs }:
-{ pkgs ? import <nixpkgs> {}, lib ? pkgs.lib }:
-let
-  me = lib.makeScope pkgs.newScope (self: with self; {
-    sane-lib = import ../../modules/lib pkgs;
-
-    bootpart-uefi-x86_64 = callPackage ./bootpart-uefi-x86_64 { };
-    browserpass-extension = callPackage ./browserpass-extension { };
-    cargo-docset = callPackage ./cargo-docset { };
-    feeds = recurseIntoAttrs (callPackage ./feeds { });
-    gopass-native-messaging-host = callPackage ./gopass-native-messaging-host { };
-    gpodder-configured = callPackage ./gpodder-configured { };
-    lightdm-mobile-greeter = callPackage ./lightdm-mobile-greeter { };
-    linux-megous = callPackage ./linux-megous { };
-    mx-sanebot = callPackage ./mx-sanebot { };
-    rtl8723cs-firmware = callPackage ./rtl8723cs-firmware { };
-    sane-scripts = callPackage ./sane-scripts { };
-    static-nix-shell = callPackage ./static-nix-shell { };
-    sublime-music-mobile = callPackage ./sublime-music-mobile { };
-    tow-boot-pinephone = callPackage ./tow-boot-pinephone { };
-
-    # packages i haven't used for a while, may or may not still work
-    # fluffychat-moby = callPackage ./fluffychat-moby { };
-    # fractal-latest = callPackage ./fractal-latest { };
-    # kaiteki = callPackage ./kaiteki { };
-    # tokodon = libsForQt5.callPackage ./tokodon { };
-
-    # old rpi packages that may or may not still work
-    # bootpart-tow-boot-rpi-aarch64 = callPackage ./bootpart-tow-boot-rpi-aarch64 { };
-    # bootpart-u-boot-rpi-aarch64 = callPackage ./bootpart-u-boot-rpi-aarch64 { };
-    # tow-boot-rpi4 = callPackage ./tow-boot-rpi4 { };
-    # patch rpi uboot with something that fixes USB HDD boot
-    # ubootRaspberryPi4_64bit = callPackage ./ubootRaspberryPi4_64bit { };
-
-    # provided by nixpkgs patch or upstream PR
-    # splatmoji = callPackage ./splatmoji { };
-  });
-in me.packages me
diff --git a/pkgs/additional/feeds/default.nix b/pkgs/additional/feeds/default.nix
index d3393453..ac9551c5 100644
--- a/pkgs/additional/feeds/default.nix
+++ b/pkgs/additional/feeds/default.nix
@@ -1,15 +1,15 @@
 { lib
 , callPackage
 , python3
+, sane-data
 , static-nix-shell
 , writeShellScript
 }:
 
 let
   # TODO: dependency-inject this.
-  sane-data = import ../../modules/data { inherit lib; };
   template = callPackage ./template.nix;
-  feed-pkgs = lib.mapAttrs
+  feed-pkgs' = lib.mapAttrs
     (name: feed-details: template {
       feedName = name;
       jsonPath = "modules/data/feeds/sources/${name}/default.json";
@@ -18,9 +18,9 @@ let
     sane-data.feeds;
   update-scripts = lib.mapAttrsToList
     (name: feed: builtins.concatStringsSep " " feed.passthru.updateScript)
-    feed-pkgs;
+    feed-pkgs';
 in rec {  # TODO: make this a scope
-  inherit feed-pkgs;
+  feed-pkgs = lib.recurseIntoAttrs feed-pkgs';
   update = static-nix-shell.mkPython3Bin {
     pname = "update";
     src = ./.;
@@ -49,10 +49,9 @@ in rec {  # TODO: make this a scope
       ${update}/bin/update.py "$name" "$json_path"
       cat "$json_path"
     '';
-  passthru = {
-    updateScript = writeShellScript
-      "feeds-update"
-      (builtins.concatStringsSep "\n" update-scripts);
-    initFeedScript = init-feed;
-  };
+
+  updateScript = writeShellScript
+    "feeds-update"
+    (builtins.concatStringsSep "\n" update-scripts);
+  initFeedScript = init-feed;
 }
diff --git a/pkgs/default.nix b/pkgs/default.nix
new file mode 100644
index 00000000..cdddb591
--- /dev/null
+++ b/pkgs/default.nix
@@ -0,0 +1,66 @@
+{ pkgs ? import <nixpkgs> {}, lib ? pkgs.lib, unpatched ? pkgs }:
+let
+  # this scope ensures that my packages can all take each other as inputs,
+  # even when evaluated bare (i.e. outside of an overlay)
+  sane = lib.makeScope pkgs.newScope (self: with self; {
+    sane-data = import ../modules/data { inherit lib; };
+    sane-lib = import ../modules/lib pkgs;
+
+    ### ADDITIONAL PACKAGES
+    bootpart-uefi-x86_64 = callPackage ./additional/bootpart-uefi-x86_64 { };
+    browserpass-extension = callPackage ./additional/browserpass-extension { };
+    cargo-docset = callPackage ./additional/cargo-docset { };
+    feeds = lib.recurseIntoAttrs (callPackage ./additional/feeds { });
+    gopass-native-messaging-host = callPackage ./additional/gopass-native-messaging-host { };
+    gpodder-configured = callPackage ./additional/gpodder-configured { };
+    lightdm-mobile-greeter = callPackage ./additional/lightdm-mobile-greeter { };
+    linux-megous = callPackage ./additional/linux-megous { };
+    mx-sanebot = callPackage ./additional/mx-sanebot { };
+    rtl8723cs-firmware = callPackage ./additional/rtl8723cs-firmware { };
+    sane-scripts = callPackage ./additional/sane-scripts { };
+    static-nix-shell = callPackage ./additional/static-nix-shell { };
+    sublime-music-mobile = callPackage ./additional/sublime-music-mobile { };
+    tow-boot-pinephone = callPackage ./additional/tow-boot-pinephone { };
+
+    # packages i haven't used for a while, may or may not still work
+    # fluffychat-moby = callPackage ./additional/fluffychat-moby { };
+    # fractal-latest = callPackage ./additional/fractal-latest { };
+    # kaiteki = callPackage ./additional/kaiteki { };
+    # tokodon = libsForQt5.callPackage ./additional/tokodon { };
+
+    # old rpi packages that may or may not still work
+    # bootpart-tow-boot-rpi-aarch64 = callPackage ./additional/bootpart-tow-boot-rpi-aarch64 { };
+    # bootpart-u-boot-rpi-aarch64 = callPackage ./additional/bootpart-u-boot-rpi-aarch64 { };
+    # tow-boot-rpi4 = callPackage ./additional/tow-boot-rpi4 { };
+    # patch rpi uboot with something that fixes USB HDD boot
+    # ubootRaspberryPi4_64bit = callPackage ./additional/ubootRaspberryPi4_64bit { };
+
+    # provided by nixpkgs patch or upstream PR
+    # splatmoji = callPackage ./additional/splatmoji { };
+
+
+    ### PATCHED PACKAGES
+
+    # XXX: the `inherit`s here are because:
+    # - pkgs.callPackage draws from the _final_ package set.
+    # - unpatched.XYZ draws (selectively) from the _unpatched_ package set.
+    # see <overlays/pkgs.nix>
+    browserpass = callPackage ./patched/browserpass { inherit (unpatched) browserpass; };
+
+    # mozilla keeps nerfing itself and removing configuration options
+    firefox-unwrapped = callPackage ./patched/firefox-unwrapped { inherit (unpatched) firefox-unwrapped; };
+
+    gocryptfs = callPackage ./patched/gocryptfs { inherit (unpatched) gocryptfs; };
+
+    # jackett doesn't allow customization of the bind address: this will probably always be here.
+    jackett = callPackage ./patched/jackett { inherit (unpatched) jackett; };
+
+
+    ### PYTHON PACKAGES
+    python-packages = {
+      pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+        (py-final: py-prev: import ./python-packages { inherit (py-prev) callPackage; })
+      ];
+    };
+  });
+in sane.packages sane
diff --git a/pkgs/patched/default.nix b/pkgs/patched/default.nix
deleted file mode 100644
index 3181b493..00000000
--- a/pkgs/patched/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ pkgs, lib ? pkgs.lib, unpatched ? pkgs }:
-let
-  me = lib.makeScope pkgs.newScope (self: with self; {
-    # XXX: the `inherit`s here are because:
-    # - pkgs.callPackage draws from the _final_ package set.
-    # - unpatched.XYZ draws (selectively) from the _unpatched_ package set.
-    # see <overlays/pkgs.nix>
-    browserpass = callPackage ./browserpass { inherit (unpatched) browserpass; };
-
-    # mozilla keeps nerfing itself and removing configuration options
-    firefox-unwrapped = callPackage ./firefox-unwrapped { inherit (unpatched) firefox-unwrapped; };
-
-    gocryptfs = callPackage ./gocryptfs { inherit (unpatched) gocryptfs; };
-
-    # jackett doesn't allow customization of the bind address: this will probably always be here.
-    jackett = callPackage ./jackett { inherit (unpatched) jackett; };
-  });
-in me.packages me

From 897ba300b27952b1bfc60d4dd2501c1a273514a4 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 06:13:18 +0000
Subject: [PATCH 05/10] move pythonPackagesExtensions up to toplevel where it
 belongs

---
 pkgs/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/default.nix b/pkgs/default.nix
index cdddb591..a1ada4b9 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -57,10 +57,8 @@ let
 
 
     ### PYTHON PACKAGES
-    python-packages = {
-      pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        (py-final: py-prev: import ./python-packages { inherit (py-prev) callPackage; })
-      ];
-    };
+    pythonPackagesExtensions = (unpatched.pythonPackagesExtensions or []) ++ [
+      (py-final: py-prev: import ./python-packages { inherit (py-prev) callPackage; })
+    ];
   });
 in sane.packages sane

From 915f792b74ea9ed2cfd119d05447afe26f25dc0f Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 06:22:33 +0000
Subject: [PATCH 06/10] overlay: fix pythonPackagesExtension directive

---
 overlays/pkgs.nix | 20 ++++++--------------
 pkgs/default.nix  |  2 +-
 2 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/overlays/pkgs.nix b/overlays/pkgs.nix
index e09eba00..124f14bd 100644
--- a/overlays/pkgs.nix
+++ b/overlays/pkgs.nix
@@ -1,16 +1,8 @@
 (next: prev:
-  let
-    toplevel-pkgs = import ../pkgs
-      { pkgs = next; lib = prev.lib; unpatched = prev; };
-    python-packages = {
-      pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        (py-final: py-prev: import ../pkgs/python-packages { inherit (py-prev) callPackage; })
-      ];
-    };
-  in
-    # expose all my packages into the root scope:
-    # - `additional` packages
-    # - `patched` versions of nixpkgs (which necessarily shadow their nixpkgs version)
-    # - `pythonPackagesExtensions`
-    toplevel-pkgs
+  # expose all my packages into the root scope:
+  # - `additional` packages
+  # - `patched` versions of nixpkgs (which necessarily shadow their nixpkgs version)
+  # - `pythonPackagesExtensions`
+  import ../pkgs
+    { pkgs = next; lib = prev.lib; unpatched = prev; }
 )
diff --git a/pkgs/default.nix b/pkgs/default.nix
index a1ada4b9..9fc8b60d 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -58,7 +58,7 @@ let
 
     ### PYTHON PACKAGES
     pythonPackagesExtensions = (unpatched.pythonPackagesExtensions or []) ++ [
-      (py-final: py-prev: import ./python-packages { inherit (py-prev) callPackage; })
+      (py-final: py-prev: import ./python-packages { inherit (py-final) callPackage; })
     ];
   });
 in sane.packages sane

From 569a9904887616b038acae49520c3f09f5b96f93 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 06:47:41 +0000
Subject: [PATCH 07/10] fix so pythonPackagesExtensions takes effect when
 importing my packages w/o overlay

---
 pkgs/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/default.nix b/pkgs/default.nix
index 9fc8b60d..cc5efdb7 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -60,5 +60,8 @@ let
     pythonPackagesExtensions = (unpatched.pythonPackagesExtensions or []) ++ [
       (py-final: py-prev: import ./python-packages { inherit (py-final) callPackage; })
     ];
+    # when this scope's applied as an overlay pythonPackagesExtensions is propagated as desired.
+    # but when freestanding (e.g. NUR), it never gets plumbed into the outer pkgs, so we have to do that explicitly.
+    pythonInterpreters = unpatched.pythonInterpreters.override { inherit pythonPackagesExtensions; };
   });
 in sane.packages sane

From 57fcd33392d110c009906e1f37926bfb688f3504 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 06:48:38 +0000
Subject: [PATCH 08/10] fix dangling reference to `feeds.[passthru.]update`

---
 flake.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index ecd70434..a3073a2f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -263,13 +263,13 @@
         in {
           update-feeds = {
             type = "app";
-            program = "${pkgs.feeds.passthru.updateScript}";
+            program = "${pkgs.feeds.updateScript}";
           };
 
           init-feed = {
             # use like `nix run '.#init-feed' uninsane.org`
             type = "app";
-            program = "${pkgs.feeds.passthru.initFeedScript}";
+            program = "${pkgs.feeds.initFeedScript}";
           };
 
           deploy-moby-test = {

From a8584cf8dced32247fd5f064f7cc3185fd283e74 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 07:25:21 +0000
Subject: [PATCH 09/10] linux-megous: fix eval error from aliased
 `kernelPatches`

---
 pkgs/additional/linux-megous/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/additional/linux-megous/default.nix b/pkgs/additional/linux-megous/default.nix
index 5c233d8c..583c4303 100644
--- a/pkgs/additional/linux-megous/default.nix
+++ b/pkgs/additional/linux-megous/default.nix
@@ -12,6 +12,7 @@
 with lib;
 
 let
+  kernelPatches' = kernelPatches;
   base = "6.2.0";
   # set to empty if not a release candidate
   rc = "-rc5";
@@ -25,8 +26,8 @@ in buildLinux (args // rec {
   extraMeta.branch = versions.majorMinor version;
 
   kernelPatches = [
-    kernelPatches.bridge_stp_helper
-    kernelPatches.request_key_helper
+    kernelPatches'.bridge_stp_helper
+    kernelPatches'.request_key_helper
   ];
 
   src = fetchFromGitHub {

From 18ebfb9d9fae737b1a6ce8c5673720767854c407 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 3 May 2023 08:16:46 +0000
Subject: [PATCH 10/10] fix feedsearch-crawler to build outside of overlay

---
 integrations/nur/default.nix | 12 ++++++++++++
 pkgs/default.nix             | 10 ++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/integrations/nur/default.nix b/integrations/nur/default.nix
index 737f6a0e..d969af89 100644
--- a/integrations/nur/default.nix
+++ b/integrations/nur/default.nix
@@ -10,6 +10,18 @@
 #
 # to manually query available packages, modules, etc, try:
 # - nix eval --impure --expr 'builtins.attrNames (import ./. {})'
+#
+# to validate this before a push that would propagate to NUR:
+#   NIX_PATH= NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 nix-env -f . -qa \* --meta --xml \
+#     --allowed-uris https://static.rust-lang.org \
+#     --option restrict-eval true \
+#     --option allow-import-from-derivation true \
+#     --drv-path --show-trace \
+#     -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \
+#     -I ../../
+# ^ source: <https://github.com/nix-community/nur-packages-template/blob/master/.github/workflows/build.yml#L63>
+#   N.B.: nur eval allows only PATH (inherited) and NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM="1" (forced),
+#   hence the erasing of NIX_PATH above (to remove external overlays)
 
 { pkgs ? import <nixpkgs> {} }:
 let
diff --git a/pkgs/default.nix b/pkgs/default.nix
index cc5efdb7..18e8a939 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,5 +1,9 @@
 { pkgs ? import <nixpkgs> {}, lib ? pkgs.lib, unpatched ? pkgs }:
 let
+
+  pythonPackagesOverlay = py-final: py-prev: import ./python-packages {
+    inherit (py-final) callPackage;
+  };
   # this scope ensures that my packages can all take each other as inputs,
   # even when evaluated bare (i.e. outside of an overlay)
   sane = lib.makeScope pkgs.newScope (self: with self; {
@@ -58,10 +62,12 @@ let
 
     ### PYTHON PACKAGES
     pythonPackagesExtensions = (unpatched.pythonPackagesExtensions or []) ++ [
-      (py-final: py-prev: import ./python-packages { inherit (py-final) callPackage; })
+      pythonPackagesOverlay
     ];
     # when this scope's applied as an overlay pythonPackagesExtensions is propagated as desired.
     # but when freestanding (e.g. NUR), it never gets plumbed into the outer pkgs, so we have to do that explicitly.
-    pythonInterpreters = unpatched.pythonInterpreters.override { inherit pythonPackagesExtensions; };
+    python3 = unpatched.python3.override {
+      packageOverrides = pythonPackagesOverlay;
+    };
   });
 in sane.packages sane