update to nixpkgs/staging-next

```
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/1e2590679d0ed2cee2736e8b80373178d085d263' (2023-03-09)
  → 'github:nixos/nixpkgs/140a35879a1bec9907a15a66b6350e0efbef5239' (2023-03-11)
• Updated input 'uninsane-dot-org':
    'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=9b549e42da18218e46d1bf217b5eb81c0c4caf11' (2023-03-10)
  → 'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=a8aa5ac6e6b5a5fb76c116caf8a1dd94d078bac2' (2023-03-11)
```

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "flake-utils": {
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1676283394,
+        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
         "type": "github"
       },
       "original": {
@@ -18,11 +18,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1677431790,
-        "narHash": "sha256-diCr0inBOSQYehHSxYQ2Wb5dYSrLfJYqbH2gJYmSL/c=",
+        "lastModified": 1677879564,
+        "narHash": "sha256-luJTRYY1zEoN5fSGwbZxq66IE1kdrqOq0/iBWzw7gOI=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "c252e7bd9122704f0e0303c638f8b8412c2521c2",
+        "rev": "9a0c317a027d1c085c641fe6df1f51b71880b720",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1675958846,
-        "narHash": "sha256-/nf09eM2vey9GrAXoqagccJrBo/fGyVKP7oNSxPqwdo=",
+        "lastModified": 1678202930,
+        "narHash": "sha256-SF82/tTnagdazlETJLzXD9kjZ6lyk38agdLbmMx1UZE=",
         "owner": "edolstra",
         "repo": "nix-serve",
-        "rev": "7089565e260267c9c234a81292c841958737cef6",
+        "rev": "3b6d30016d910a43e0e16f94170440a3e0b8fa8d",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1677367679,
-        "narHash": "sha256-pOMXi7F9tcHls06Qv+7XCPASTJeXu47Jhd0Pk9du8T4=",
+        "lastModified": 1677948530,
+        "narHash": "sha256-BkQjq8AGHD55RJe4PUnrWRZZ8jS64p/k0bGDck5wKwY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ea736343e4d4a052e023d54b23334cf685de479c",
+        "rev": "d51554151a91cd4543a7620843cc378e3cbc767e",
         "type": "github"
       },
       "original": {
@@ -82,16 +82,16 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1676569297,
-        "narHash": "sha256-2n4C4H3/U+3YbDrQB6xIw7AaLdFISCCFwOkcETAigqU=",
+        "lastModified": 1678536071,
+        "narHash": "sha256-bj38dJO1KfHGbC8F0C3UKBPhAstqMcQed0GiFZnaNKA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ac1f5b72a9e95873d1de0233fddcb56f99884b37",
+        "rev": "140a35879a1bec9907a15a66b6350e0efbef5239",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "staging-next",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -113,11 +113,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1677381477,
-        "narHash": "sha256-NLzWgll+Q0Af8gI1ha34OHt7Y1GtOMYhCWQWV9LXE9Y=",
+        "lastModified": 1678440572,
+        "narHash": "sha256-zfL09Yy6H7QQwfacCPL0gOfWpVkTbE5jXJh5oZmGf8g=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "83fe25c8019db8216f5c6ffc65b394707784b4f3",
+        "rev": "1568702de0d2488c1e77011a9044de7fadec80c4",
         "type": "github"
       },
       "original": {
@@ -134,11 +134,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1675131883,
-        "narHash": "sha256-yBgJDG72YqIr1bltasqHD1E/kHc9uRFgDjxDmy6kI8M=",
+        "lastModified": 1678521821,
+        "narHash": "sha256-BlFdD28AeizJRa4DtnwxqZqvBTvsXIrf3kiI26Q3J1A=",
         "ref": "refs/heads/master",
-        "rev": "b099c24091cc192abf3997b94342d4b31cc5757b",
-        "revCount": 170,
+        "rev": "a8aa5ac6e6b5a5fb76c116caf8a1dd94d078bac2",
+        "revCount": 175,
         "type": "git",
         "url": "https://git.uninsane.org/colin/uninsane"
       },

flake.nix

@@ -22,7 +22,8 @@
     # nixpkgs-stable.url = "github:nixos/nixpkgs?ref=nixos-22.11";
 
     # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
-    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
 
     # nixpkgs = {
     #   url = "./nixpatches";
@@ -61,7 +62,7 @@
     ...
   }@inputs:
     let
-      inherit (builtins) attrNames listToAttrs map mapAttrs;
+      inherit (builtins) attrNames elem listToAttrs map mapAttrs;
       mapAttrs' = f: set:
         listToAttrs (map (attr: f attr set.${attr}) (attrNames set));
       # mapAttrs but without the `name` argument
@@ -92,9 +93,9 @@
               self.nixosModules.passthru
               {
                 nixpkgs.overlays = [
-                  self.overlays.default
                   self.overlays.passthru
                   self.overlays.pins
+                  self.overlays.pkgs
                   # self.overlays.optimizations
                 ];
                 nixpkgs.hostPlatform = target;
@@ -157,19 +158,21 @@
       # unofficial output
       host-pkgs = mapAttrValues (host: host.config.system.build.pkgs) self.nixosConfigurations;
 
-      overlays = rec {
-        default = pkgs;
-        pkgs = import ./overlays/pkgs.nix;
-        pins = import ./overlays/pins.nix;  # TODO: move to `nixpatches/` input
-        optimizations = import ./overlays/optimizations.nix;
-        passthru =
+      overlays = {
+        # N.B.: `nix flake check` requires every overlay to take `final: prev:` at defn site,
+        #   hence the weird redundancy.
+        default = final: prev: self.overlays.pkgs final prev;
+        pkgs = final: prev: import ./overlays/pkgs.nix final prev;
+        pins = final: prev: import ./overlays/pins.nix final prev;
+        optimizations = final: prev: import ./overlays/optimizations.nix final prev;
+        passthru = final: prev:
           let
             stable =
               if inputs ? "nixpkgs-stable" then (
-                next: prev: {
-                  stable = inputs.nixpkgs-stable.legacyPackages."${prev.stdenv.hostPlatform.system}";
+                final': prev': {
+                  stable = inputs.nixpkgs-stable.legacyPackages."${prev'.stdenv.hostPlatform.system}";
                 }
-              ) else (next: prev: {});
+              ) else (final': prev': {});
             mobile = (import "${mobile-nixos}/overlay/overlay.nix");
             uninsane = uninsane-dot-org.overlay;
             # nix-serve' = nix-serve.overlay;
@@ -180,11 +183,10 @@
               inherit (nix-serve.packages."${next.system}") nix-serve;
             };
           in
-            next: prev:
-              (stable next prev)
-              // (mobile next prev)
-              // (uninsane next prev)
-              // (nix-serve' next prev)
+              (stable final prev)
+              // (mobile final prev)
+              // (uninsane final prev)
+              // (nix-serve' final prev)
             ;
       };
 
@@ -209,10 +211,24 @@
           aarch64-linux = allPkgsFor "aarch64-linux";
         };
 
-      # extract only our own packages from the full set
-      packages = mapAttrValues
-        (full: full.sane // { inherit (full) sane uninsane-dot-org; })
-        self.legacyPackages;
+      # extract only our own packages from the full set.
+      # because of `nix flake check`, we flatten the package set and only surface x86_64-linux packages.
+      packages = mapAttrs
+        (system: allPkgs:
+          allPkgs.lib.filterAttrs (name: pkg:
+            # keep only packages which will pass `nix flake check`, i.e. keep only:
+            # - derivations (not package sets)
+            # - packages that build for the given platform
+            (! elem name [ "feeds" "pythonPackagesExtensions" ])
+            && (allPkgs.lib.meta.availableOn allPkgs.stdenv.hostPlatform pkg)
+          )
+          (allPkgs.sane // {
+            inherit (allPkgs) uninsane-dot-org;
+          })
+        )
+        # self.legacyPackages;
+        { inherit (self.legacyPackages) x86_64-linux; }
+      ;
 
       apps."x86_64-linux" =
         let

hosts/by-name/desko/default.nix

@@ -10,7 +10,6 @@
   sane.services.wg-home.ip = config.sane.hosts.by-name."desko".wg-home.ip;
   sane.services.duplicity.enable = true;
   sane.services.nixserve.sopsFile = ../../../secrets/desko.yaml;
-  sane.persist.enable = true;
 
   sane.gui.sway.enable = true;
   sane.programs.iphoneUtils.enableFor.user.colin = true;

hosts/by-name/lappy/default.nix

@@ -10,7 +10,6 @@
 
   # sane.guest.enable = true;
   sane.gui.sway.enable = true;
-  sane.persist.enable = true;
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 

hosts/by-name/moby/default.nix

@@ -34,7 +34,6 @@
     ".config/pulse"  # persist pulseaudio volume
   ];
 
-  sane.persist.enable = true;
   sane.gui.phosh.enable = true;
   # sane.programs.consoleUtils.enableFor.user.colin = false;
   # sane.programs.guiApps.enableFor.user.colin = false;

hosts/by-name/rescue/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 {
   imports = [
     ./fs.nix
@@ -7,6 +7,7 @@
   boot.loader.generic-extlinux-compatible.enable = true;
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
+  # sane.persist.enable = false;  # TODO: disable (but run `nix flake check` to ensure it works!)
   sane.nixcache.enable = false;  # don't want to be calling out to dead machines that we're *trying* to rescue
 
   # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion

hosts/by-name/servo/default.nix

@@ -16,7 +16,7 @@
   };
 
   sane.roles.build-machine = true;
-  sane.persist.enable = true;
+  sane.zsh.showDeadlines = false;  # ~/knowledge doesn't always exist
   sane.services.dyn-dns.enable = true;
   sane.services.wg-home.enable = true;
   sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;

hosts/by-name/servo/secrets.nix

@@ -25,6 +25,7 @@
   };
   sops.secrets."mautrix_signal_env" = {
     sopsFile = ../../../secrets/servo/mautrix_signal_env.bin;
+    format = "binary";
   };
 
   sops.secrets."mediawiki_pw" = {

hosts/by-name/servo/services/matrix/default.nix

@@ -6,12 +6,10 @@
   imports = [
     ./discord-puppet.nix
     # ./irc.nix
-    ./signal.nix
+    # TODO(2023/03/10): disabled because it's not bridging and mautrix_signal is hogging CPU
+    # ./signal.nix
   ];
 
-  # allow synapse to read the registration files of its appservices
-  users.users.matrix-synapse.extraGroups = [ "mautrix-signal" ];
-
   sane.persist.sys.plaintext = [
     { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
   ];

hosts/by-name/servo/services/matrix/signal.nix

@@ -7,6 +7,9 @@
     { user = "signald"; group = "signald"; directory = "/var/lib/signald"; }
   ];
 
+  # allow synapse to read the registration file
+  users.users.matrix-synapse.extraGroups = [ "mautrix-signal" ];
+
   services.signald.enable = true;
   services.mautrix-signal.enable = true;
   services.mautrix-signal.environmentFile =
@@ -27,7 +30,6 @@
   };
 
   sops.secrets."mautrix_signal_env" = {
-    format = "binary";
     mode = "0440";
     owner = config.users.users.mautrix-signal.name;
     group = config.users.users.matrix-synapse.name;

hosts/common/cross/default.nix

@@ -57,35 +57,16 @@
 #     """
 
 # TODO:
+# - fix(journalctl) "gnome-terminal-server[126562]: Installed schemas failed verification: Schema "org.gtk.Settings.Debug" is missing"
 # - fix firefox build so that it doesn't invoke clang w/o the ccache
 # - qt6.qtbase. cross compiling documented in upstream <qt6:qtbase/cmake/README.md>
 #   - `nix build '.#host-pkgs.moby.qgnomeplatform-qt6'` FAILS
 #   - `nix build '.#host-pkgs.moby.qt6Packages.qtwayland'` FAILS
 #     - it uses qmake in nativeBuildInputs  (but `.#host-pkgs.moby.buildPackages.qt6.qmake` builds, same with native qtbase...)
 #     - failed version build log truly doesn't have the `QT_HOST_PATH` flag.
-# - `host-pkgs.desko.stdenv` fails build:
+#
+# - `host-pkgs.cross-desko.stdenv` fails build:
 #   - #cross-compiling:nixos.org says pkgsCross.gnu64 IS KNOWN TO NOT COMPILE. let this go for now:
-#     - make a `<machine>` (don't specifiy local/targetSystem) and `<machine>-cross` target.
-#     - `desko-cross` will be broken but `desko` can work
-#   - see <nixpkgs:pkgs/stdenv/linux/default.nix>
-#   - disallowedRequisites = [ bootstrapTools.out ];
-#   """
-#   error: output '/nix/store/w2vgzyvs2jzf7yr6qqqrjbvrqxxmhwy0-stdenv-linux' is not allowed to refer to the following paths:
-#            /nix/store/2qbgchkjj1hqi1c8raznwml94pkm3k7q-libunistring-1.0
-#            /nix/store/4j425ybkjxcdj89352l5gpdl3nmxq4zn-libidn2-2.3.2
-#            /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224
-#            /nix/store/qbgfsaviwqi2p6jr7an1g2754sv3xqhn-gcc-11.3.0-lib
-#   """
-#   - rg doesn't reveal any such references in the output though...
-#     - nor references to bootstrapTools
-#     - HOWEVER, IT DOES CONTAIN A REFERENCE TO THE PREVIOUS STAGE'S BASH:
-#       - /nix/store/w2vgzyvs2jzf7yr6qqqrjbvrqxxmhwy0-stdenv-linux/setup
-#       - export SHELL=/nix/store/qqa28hmysc23yy081d178jfd9a1yk8aw-bash-5.2-p15/bin/bash
-#       - not clear if that matters? but maybe it reaches bootstrapTools transitively?
-#         - yeah: that bash specifies the above `glibc` as its loader
-#         - so we probably can't `inherit` the emulated bash like that.
-#   - try building `.#host-pkgs.desko.stdenv.shellPackage` or `.#host-pkgs.desko.stdenv.bootstrapTools`
-#   - `file result/bin/bash` does show that it uses the interpreter for the glibc, above
 
 
 { config, lib, options, pkgs, ... }:
@@ -118,6 +99,29 @@ let
       # config = builtins.removeAttrs config.nixpkgs.config [ "replaceStdenv" ];
       overlays = universalOverlays;
     };
+
+  ## package override helpers
+  addInputs = { buildInputs ? [], nativeBuildInputs ? [], depsBuildBuild ? [] }: pkg: pkg.overrideAttrs (upstream: {
+    buildInputs = upstream.buildInputs or [] ++ buildInputs;
+    nativeBuildInputs = upstream.nativeBuildInputs or [] ++ nativeBuildInputs;
+    depsBuildBuild = upstream.depsBuildBuild or [] ++ depsBuildBuild;
+  });
+  addNativeInputs = nativeBuildInputs: addInputs { inherit nativeBuildInputs; };
+  addBuildInputs = buildInputs: addInputs { inherit buildInputs; };
+  mvToNativeInputs = nativeBuildInputs: mvInputs { inherit nativeBuildInputs; };
+  mvToBuildInputs = buildInputs: mvInputs { inherit buildInputs; };
+  rmInputs = { buildInputs ? [], nativeBuildInputs ? [] }: pkg: pkg.overrideAttrs (upstream: {
+    buildInputs = lib.subtractLists buildInputs (upstream.buildInputs or []);
+    nativeBuildInputs = lib.subtractLists nativeBuildInputs (upstream.nativeBuildInputs or []);
+  });
+  # move items from buildInputs into nativeBuildInputs, or vice-versa.
+  # arguments represent the final location of specific inputs.
+  mvInputs = { buildInputs ? [], nativeBuildInputs ? [] }: pkg:
+    addInputs { buildInputs = buildInputs; nativeBuildInputs = nativeBuildInputs; }
+    (
+      rmInputs { buildInputs = nativeBuildInputs; nativeBuildInputs = buildInputs; }
+      pkg
+    );
 in
 {
   options = {
@@ -208,21 +212,6 @@ in
         prev.stdenv.hostPlatform == prev.stdenv.targetPlatform &&
         prev.stdenv.hostPlatform == config.nixpkgs.hostPlatform
       ) {
-        # stdenv = prev.stdenv.override {
-        #   cc = next.buildPackages.ccacheWrapper.overrideAttrs (orig: {
-        #     passthru = orig.passthru // {
-        #       # cc = orig.passthru.unwrappedCC;
-        #       cc = prev.stdenv.cc.cc;
-        #     };
-        #     # passthru = next.buildPackages.stdenv.cc.passthru // orig.passthru;
-        #   });
-        #   # cc = prev.stdenv.__bootPackages.ccacheWrapper;
-        # };
-        # stdenv = prev.stdenv.__bootPackages.ccacheStdenv;
-        # stdenv = prev.stdenv.override {
-        #   cc = prev.buildPackages.ccacheWrapper;
-        # };
-
         # XXX: stdenv.cc is the cc-wrapper, from <nixpkgs:pkgs/build-support/cc-wrapper/default.nix>.
         #      always the same.
         # stdenv.cc.cc is either the real gcc (for buildPackages.stdenv), or the ccache (for normal stdenv).
@@ -241,44 +230,6 @@ in
         # stdenv = prev.ccacheStdenv.override { inherit (prev) stdenv; };
       })
 
-      # (next: prev:
-      #   let
-      #     emulated = prev.emulated;
-      #   in {
-      #     # packages which don't "cross compile" from x86_64 -> x86_64
-      #     inherit (emulated)
-      #       # aws-crt-cpp  # "/build/source/include/aws/crt/Optional.h:6:10: fatal error: utility: No such file or directory"
-      #       # # bash  # "configure: error: C compiler cannot create executables"
-      #       # boehmgc  # "gc_badalc.cc:29:10: fatal error: new: No such file or directory <new>"
-      #       # c-ares  # dns-proto.h:11:10: fatal error: memory: No such file or directory
-      #       # db48  # "./db_cxx.h:59:10: fatal error: iostream.h: No such file or directory"
-      #       # # kexec-tools  # "configure: error: C compiler cannot create executables"
-      #       # gmp6  # "configure: error: could not find a working compiler"
-      #       # gtest  # "/build/source/googletest/src/gtest_main.cc:30:10: fatal error: cstdio: No such file or directory"
-      #       # icu72  # "../common/unicode/localpointer.h:45:10: fatal error: memory: No such file or directory"
-      #       # # libidn2  # "configure: error: C compiler cannot create executables"
-      #       # ncurses  # "configure: error: C compiler cannot create executables"
-      #     ;
-
-      #     bash = prev.bash.overrideAttrs (orig: {
-      #       # configure doesn't know how to build because it doesn't know where to find crt1.o.
-      #       # some parts of nixpkgs specify the path to it explicitly:
-      #       # - <nixpkgs:pkgs/development/libraries/gcc/libstdc++/5.nix>
-      #       # - <nixpkgs:pkgs/build-support/cc-wrapper/add-flags.sh>
-      #       # alternatively, the wrapper gcc (first item on PATH if we look at a failed bash's env-vars)
-      #       # adds these flags automatically. so we can probably just tell `configure` to *not* use any special gcc other than the wrapper.
-      #       # TESTING IN PROGRESS:
-      #       # - N.B.: BUILDCC is a vlc-ism!
-      #       # BUILDCC = "${prev.stdenv.cc}/bin/${prev.stdenv.cc.targetPrefix}cc";  # has illegal requisites
-      #       CC = "${prev.stdenv.cc}/bin/${prev.stdenv.cc.targetPrefix}cc";  # XXX: tested in nixpkgs: FAILS WITH SAME SIGNATURE. env-vars doesn't show our CC though :-(
-      #       # ^ env vars set here are making their way through, but something else (build script?) is overwriting it
-      #       SANE_CC = "${prev.stdenv.cc}/bin/${prev.stdenv.cc.targetPrefix}cc";
-      #       # CC = "gcc"  # bash configure.ac
-      #       # CC_FOR_BUILD = "gcc"  # bash configure.ac
-      #       # BUILDCC = "gcc";  # VLC
-      #     });
-      #   }
-      # )
       (nativeSelf: nativeSuper: {
         pkgsi686Linux = nativeSuper.pkgsi686Linux.extend (i686Self: i686Super: {
           # fixes eval-time error: "Unsupported cross architecture"
@@ -309,11 +260,12 @@ in
           # packages which don't cross compile
           inherit (emulated)
             # adwaita-qt6  # although qtbase cross-compiles with minor change, qtModule's qtbase can't
-            apacheHttpd_2_4  # `configure: error: Size of "void *" is less than size of "long"`
             # duplicity  # python3.10-s3transfer
             # gdk-pixbuf  # cross-compiled version doesn't output bin/gdk-pixbuf-thumbnailer  (used by webp-pixbuf-loader
             # gnome-tour
             # XXX: gnustep members aren't individually overridable, because the "scope" uses `rec` such that members don't see overrides
+            # gnustep is going to need a *lot* of work/domain-specific knowledge to truly cross-compile,
+            # though if we make the members overridable maybe we can get away with emulating only stdenv.
             gnustep  # gnustep.base: "configure: error: Your compiler does not appear to implement the -fconstant-string-class option needed for support of strings."
             # grpc
             # nixpkgs hdf5 is at commit 3e847e003632bdd5fdc189ccbffe25ad2661e16f
@@ -348,6 +300,28 @@ in
           # same story as qdwaita-qt6
           # qgnomeplatform-qt6 = next.emptyDirectory;
 
+          apacheHttpd_2_4 = prev.apacheHttpd_2_4.overrideAttrs (upstream: {
+            configureFlags = upstream.configureFlags or [] ++ [
+              "ap_cv_void_ptr_lt_long=no"  # configure can't AC_TRY_RUN, and can't validate that sizeof (void*) == sizeof long
+            ];
+            # let nix figure out the perl shebangs.
+            # some of these perl scripts are shipped on the host, others in the .dev output for the build machine.
+            # postPatch methods create cycles
+            # postPatch = ''
+            #   substituteInPlace configure --replace \
+            #     '/replace/with/path/to/perl/interpreter' \
+            #     '/usr/bin/perl'
+            # '';
+            # postPatch = ''
+            #   substituteInPlace support/apxs.in --replace \
+            #     '@perlbin@' \
+            #     '/usr/bin/perl'
+            # '';
+            postFixup = upstream.postFixup or "" + ''
+              sed -i 's:/replace/with/path/to/perl/interpreter:${next.buildPackages.perl}/bin/perl:' $dev/bin/apxs
+            '';
+          });
+
           # apacheHttpd_2_4 = (prev.apacheHttpd_2_4.override {
           #   # fixes `configure: error: Size of "void *" is less than size of "long"`
           #   inherit (emulated) stdenv;
@@ -371,9 +345,16 @@ in
               prevHttpdPkgs = prev.apacheHttpdPackagesFor apacheHttpd self;
             in prevHttpdPkgs // {
               # fixes "configure: error: *** Sorry, could not find apxs ***"
-              mod_dnssd = prevHttpdPkgs.mod_dnssd.override {
-                inherit (emulated) stdenv;
-              };
+              # mod_dnssd = prevHttpdPkgs.mod_dnssd.override {
+              #   inherit (emulated) stdenv;
+              # };
+              # TODO: the below apxs doesn't have a valid shebang (#!/replace/with/...).
+              #   we can't replace it at the origin?
+              mod_dnssd = prevHttpdPkgs.mod_dnssd.overrideAttrs (upstream: {
+                configureFlags = upstream.configureFlags ++ [
+                  "--with-apxs=${self.apacheHttpd.dev}/bin"
+                ];
+              });
             };
 
           # apacheHttpdPackagesFor = apacheHttpd: self:
@@ -426,10 +407,21 @@ in
             # configure: error: no acceptable C compiler found in $PATH
             inherit (emulated) stdenv;
           };
-          browserpass = prev.browserpass.override {
+          # browserpass = prev.browserpass.override {
+          #   # fixes "qemu-aarch64: Could not open '/lib/ld-linux-aarch64.so.1': No such file or directory"
+          #   inherit (emulated) buildGoModule;  # buildGoModule holds the stdenv
+          # };
+          browserpass = prev.browserpass.overrideAttrs (upstream: {
             # fixes "qemu-aarch64: Could not open '/lib/ld-linux-aarch64.so.1': No such file or directory"
-            inherit (emulated) buildGoModule;  # buildGoModule holds the stdenv
-          };
+            # default browserpass `make` both builds AND tests
+            buildPhase = ''
+              make browserpass
+            '';
+            checkPhase = ''
+              make test
+            '';
+            doCheck = next.stdenv.hostPlatform == next.stdenv.buildPlatform;
+          });
           cantarell-fonts = prev.cantarell-fonts.override {
             # fixes error where python3.10-skia-pathops dependency isn't available for the build platform
             inherit (emulated) stdenv;
@@ -496,10 +488,8 @@ in
             ];
           });
 
-          fuzzel = prev.fuzzel.overrideAttrs (upstream: {
-            # fixes: "meson.build:100:0: ERROR: Dependency lookup for wayland-scanner with method 'pkgconfig' failed: Pkg-config binary for machine 0 not found. Giving up."
-            depsBuildBuild = upstream.depsBuildBuild or [] ++ [ next.pkg-config ];
-          });
+          # fixes: "meson.build:100:0: ERROR: Dependency lookup for wayland-scanner with method 'pkgconfig' failed: Pkg-config binary for machine 0 not found. Giving up."
+          fuzzel = addInputs { depsBuildBuild = [ next.pkg-config ]; } prev.fuzzel;
 
           fwupd-efi = prev.fwupd-efi.override {
             # fwupd-efi queries meson host_machine to decide what arch to build for.
@@ -519,11 +509,16 @@ in
           #   #   next.mesonEmulatorHook
           #   # ];
           # });
-          fwupd = prev.fwupd.overrideAttrs (orig: {
-            # solves (meson) "Run-time dependency libgcab-1.0 found: NO (tried pkgconfig and cmake)", and others.
-            buildInputs = orig.buildInputs ++ [ next.gcab next.gnutls ];
-            mesonFlags = (lib.remove "-Ddocs=enabled" orig.mesonFlags) ++ [ "-Ddocs=disabled" ];
-            outputs = lib.remove "devdoc" orig.outputs;
+          # solves (meson) "Run-time dependency libgcab-1.0 found: NO (tried pkgconfig and cmake)", and others.
+          fwupd = (addBuildInputs
+            [ next.gcab ]
+            (mvToBuildInputs [ next.gnutls ] prev.fwupd)
+          ).overrideAttrs (upstream: {
+            # XXX: gcab is apparently needed as both build and native input
+            # can't build docs w/o adding `gi-docgen` to ldpath, but that adds a new glibc to the ldpath
+            # which causes host binaries to be linked against the build libc & fail
+            mesonFlags = (lib.remove "-Ddocs=enabled" upstream.mesonFlags) ++ [ "-Ddocs=disabled" ];
+            outputs = lib.remove "devdoc" upstream.outputs;
           });
           # fwupd = prev.fwupd.override {
           #   # solves missing libgcab-1.0;
@@ -531,14 +526,9 @@ in
           #   inherit (emulated) stdenv;
           # };
 
-          gcr_4 = prev.gcr_4.overrideAttrs (orig: {
-            # fixes (meson): "ERROR: Program 'gpg2 gpg' not found or not executable"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gnupg next.openssh ];
-          });
-          gthumb = prev.gthumb.overrideAttrs (orig: {
-            # fixes (meson) "Program 'glib-mkenums mkenums' not found or not executable"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
+          # fixes (meson): "ERROR: Program 'gpg2 gpg' not found or not executable"
+          gcr_4 = mvInputs { nativeBuildInputs = [ next.gnupg next.openssh ]; } prev.gcr_4;
+          gthumb = mvInputs { nativeBuildInputs = [ next.glib ]; } prev.gthumb;
 
           gmime = prev.gmime.overrideAttrs (upstream: {
             configureFlags = upstream.configureFlags ++ [
@@ -592,15 +582,13 @@ in
             #   # fails to fix original error
             #   inherit (emulated) stdenv;
             # };
-            dconf-editor = super.dconf-editor.overrideAttrs (orig: {
-              # fixes "error: Package `dconf' not found in specified Vala API directories or GObject-Introspection GIR directories"
-              # - but ONLY if `dconf` was built with the vala feature.
-              # - dconf is NOT built with vala when cross-compiled
-              #   - that's an explicit choice/limitation in nixpkgs upstream
-              # - TODO: vapi stuff is contained in <dconf.dev:/share/vala/vapi/dconf.vapi>
-              #   it's cross-platform; should be possible to ship dconf only in buildInputs & point dconf-editor to the right place
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.dconf ];
-            });
+            # fixes "error: Package `dconf' not found in specified Vala API directories or GObject-Introspection GIR directories"
+            # - but ONLY if `dconf` was built with the vala feature.
+            # - dconf is NOT built with vala when cross-compiled
+            #   - that's an explicit choice/limitation in nixpkgs upstream
+            # - TODO: vapi stuff is contained in <dconf.dev:/share/vala/vapi/dconf.vapi>
+            #   it's cross-platform; should be possible to ship dconf only in buildInputs & point dconf-editor to the right place
+            dconf-editor = addNativeInputs [ next.dconf ] super.dconf-editor;
             evince = super.evince.overrideAttrs (orig: {
               # fixes (meson) "Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)"
               # inspired by gupnp
@@ -633,18 +621,12 @@ in
             #   # fixes "src/meson.build:106:0: ERROR: Program 'glib-compile-resources' not found or not executable"
             #   inherit (emulated) stdenv;
             # };
-            file-roller = super.file-roller.overrideAttrs (orig: {
-              # fixes: "src/meson.build:106:0: ERROR: Program 'glib-compile-resources' not found or not executable"
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
-            gnome-color-manager = super.gnome-color-manager.overrideAttrs (orig: {
-              # fixes: "src/meson.build:3:0: ERROR: Program 'glib-compile-resources' not found or not executable"
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
-            gnome-control-center = super.gnome-control-center.overrideAttrs (orig: {
-              # fixes "subprojects/gvc/meson.build:30:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
+            # fixes: "src/meson.build:106:0: ERROR: Program 'glib-compile-resources' not found or not executable"
+            file-roller = mvToNativeInputs [ next.glib ] super.file-roller;
+            # fixes: "src/meson.build:3:0: ERROR: Program 'glib-compile-resources' not found or not executable"
+            gnome-color-manager = mvToNativeInputs [ next.glib ] super.gnome-color-manager;
+            # fixes "subprojects/gvc/meson.build:30:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
+            gnome-control-center = mvToNativeInputs [ next.glib ] super.gnome-control-center;
             # gnome-control-center = super.gnome-control-center.override {
             #   inherit (next) stdenv;
             # };
@@ -656,11 +638,8 @@ in
               # fixes "configure.ac:374: error: possibly undefined macro: AM_PATH_LIBGCRYPT"
               nativeBuildInputs = orig.nativeBuildInputs ++ [ next.libgcrypt next.openssh next.glib ];
             });
-            gnome-remote-desktop = super.gnome-remote-desktop.overrideAttrs (orig: {
-              # TODO: remove gnome-remote-desktop (wanted by gnome-control-center)
-              # fixes: "Program gdbus-codegen found: NO"
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
+            # fixes: "Program gdbus-codegen found: NO"
+            gnome-remote-desktop = mvToNativeInputs [ next.glib ] super.gnome-remote-desktop;
             # gnome-shell = super.gnome-shell.overrideAttrs (orig: {
             #   # fixes "meson.build:128:0: ERROR: Program 'gjs' not found or not executable"
             #   # does not fix "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"  (python import failure)
@@ -717,10 +696,8 @@ in
                 sed -i "s/disabled_plugins = \[\]/disabled_plugins = ['power']/" plugins/meson.build
               '';
             });
-            gnome-session = super.gnome-session.overrideAttrs (orig: {
-              # fixes: "gdbus-codegen not found or executable"
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
+            # fixes: "gdbus-codegen not found or executable"
+            gnome-session = mvToNativeInputs [ next.glib ] super.gnome-session;
             # gnome-terminal = super.gnome-terminal.override {
             #   # fixes: "meson.build:343:0: ERROR: Dependency "libpcre2-8" not found, tried pkgconfig"
             #   # new failure mode: "/nix/store/grqh2wygy9f9wp5bgvqn4im76v82zmcx-binutils-2.39/bin/ld: /nix/store/f7yr5z123d162p5457jh3wzkqm7x8yah-glib-2.74.3/lib/libglib-2.0.so: error adding symbols: file in wrong format"
@@ -730,10 +707,8 @@ in
               # fixes "meson.build:343:0: ERROR: Dependency "libpcre2-8" not found, tried pkgconfig"
               buildInputs = orig.buildInputs ++ [ next.pcre2 ];
             });
-            gnome-user-share = super.gnome-user-share.overrideAttrs (orig: {
-              # fixes: meson.build:111:6: ERROR: Program 'glib-compile-schemas' not found or not executable
-              nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-            });
+            # fixes: meson.build:111:6: ERROR: Program 'glib-compile-schemas' not found or not executable
+            gnome-user-share = addNativeInputs [ next.glib ] super.gnome-user-share;
             mutter = super.mutter.overrideAttrs (orig: {
               nativeBuildInputs = orig.nativeBuildInputs ++ [
                 next.glib  # fixes "clutter/clutter/meson.build:281:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
@@ -800,14 +775,20 @@ in
             # };
             # XXX this feels risky; it propagates a (conflicting) gst-plugins to all consumers
             # gst-editing-services = emulated.gst_all_1.gst-editing-services;
-            gst-editing-services = prev.gst_all_1.gst-editing-services.overrideAttrs (orig: {
-              # fixes "Run-time dependency gst-validate-1.0 found: NO"
-              buildInputs = orig.buildInputs ++ [ next.gst_all_1.gst-devtools ];
-              mesonFlags = orig.mesonFlags ++ [
-                # disable "python formatters" to avoid undefined references to Py_Initialize, etc.
-                "-Dpython=disabled"
-              ];
-            });
+            # fixes "Run-time dependency gst-validate-1.0 found: NO"
+            # fixes undefined references to Py_Initialize, etc.
+            # - alternative is `mesonFlags = [ "-Dpython=disabled" ]`
+            gst-editing-services = addBuildInputs
+              [ next.python3 ]
+              (mvToBuildInputs [ next.gst_all_1.gst-devtools ] prev.gst_all_1.gst-editing-services);
+            # gst-editing-services =
+            #   (mvToBuildInputs [ next.gst_all_1.gst-devtools ] prev.gst_all_1.gst-editing-services);
+            #   .overrideAttrs (upstream: {
+            #     mesonFlags = upstream.mesonFlags ++ [
+            #       # disable "python formatters" to avoid undefined references to Py_Initialize, etc.
+            #       "-Dpython=disabled"
+            #     ];
+            #   });
             # inherit (emulated.gst_all_1) gst-plugins-good;
             # gst-plugins-good = prev.gst_all_1.gst-plugins-good.override {
             #   # when invoked with `qt5Support = true`, qtbase shows up in both buildInputs and nativeBuildInputs
@@ -836,28 +817,21 @@ in
           #   inherit (emulated) stdenv;
           # };
 
-          ibus = (prev.ibus.override {
-            # fixes: "configure.ac:152: error: possibly undefined macro: AM_PATH_GLIB_2_0"
-            inherit (emulated) stdenv;
-          }).overrideAttrs (upstream: {
+          # ibus = (prev.ibus.override {
+          #   # fixes: "configure.ac:152: error: possibly undefined macro: AM_PATH_GLIB_2_0"
+          #   inherit (emulated) stdenv;
+          ibus = prev.ibus.overrideAttrs (upstream: {
             nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
-              # fixes "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
-              next.buildPackages.gobject-introspection
+              next.glib  # fixes: ImportError: /nix/store/fi1rsalr11xg00dqwgzbf91jpl3zwygi-gobject-introspection-aarch64-unknown-linux-gnu-1.74.0/lib/gobject-introspection/giscanner/_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory
+              next.buildPackages.gobject-introspection  # fixes "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
+            ];
+            buildInputs = lib.remove next.gobject-introspection upstream.buildInputs ++ [
+              next.vala  # fixes: "Package `ibus-1.0' not found in specified Vala API directories or GObject-Introspection GIR directories"
             ];
-            buildInputs = lib.remove next.gobject-introspection upstream.buildInputs;
           });
-          # ibus = prev.ibus.overrideAttrs (upstream: {
-          #   # FIXES: configure.ac:152: error: possibly undefined macro: AM_PATH_GLIB_2_0
-          #   # technique copied from <nixpkgs:pkgs/development/libraries/gts/default.nix>
-          #   # new error: ImportError: /nix/store/fi1rsalr11xg00dqwgzbf91jpl3zwygi-gobject-introspection-aarch64-unknown-linux-gnu-1.74.0/lib/gobject-introspection/giscanner/_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory
-          #   nativeBuildInputs = upstream.nativeBuildInputs ++ [ next.glib next.gobject-introspection ];
-          #   buildInputs = lib.remove next.gobject-introspection upstream.buildInputs;
-          # });
 
-          iio-sensor-proxy = prev.iio-sensor-proxy.overrideAttrs (orig: {
-            # fixes "./autogen.sh: line 26: gtkdocize: not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib next.gtk-doc ];
-          });
+          # fixes "./autogen.sh: line 26: gtkdocize: not found"
+          iio-sensor-proxy = mvToNativeInputs [ next.glib next.gtk-doc ] prev.iio-sensor-proxy;
 
           kitty = prev.kitty.overrideAttrs (upstream: {
             # fixes: "FileNotFoundError: [Errno 2] No such file or directory: 'pkg-config'"
@@ -893,17 +867,18 @@ in
           #   # fixes "Run-time dependency vapigen found: NO (tried pkgconfig)"
           #   buildInputs = upstream.buildInputs ++ [ next.vala ];
           # });
-          libHX = prev.libHX.overrideAttrs (orig: {
-            # "Can't exec "libtoolize": No such file or directory at /nix/store/r4fvx9hazsm0rdm7s393zd5v665dsh1c-autoconf-2.71/share/autoconf/Autom4te/FileUtils.pm line 294."
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.libtool ];
-          });
-          libjcat = prev.libjcat.overrideAttrs (upstream: {
-            # fixes: "ERROR: Program 'gnutls-certtool certtool' not found or not executable"
-            # N.B.: gnutls library is used by the compiled program (i.e. the host);
-            #   gnutls binaries are used by the build machine.
-            #   therefore gnutls can be specified in both buildInputs and nativeBuildInputs
-            nativeBuildInputs = upstream.nativeBuildInputs ++ [ next.gnutls ];
-            # buildInputs = lib.remove next.gnutls upstream.buildInputs;
+          # "Can't exec "libtoolize": No such file or directory at /nix/store/r4fvx9hazsm0rdm7s393zd5v665dsh1c-autoconf-2.71/share/autoconf/Autom4te/FileUtils.pm line 294."
+          libHX = mvToNativeInputs [ next.libtool ] prev.libHX;
+          # fixes: "ERROR: Program 'gnutls-certtool certtool' not found or not executable"
+          # N.B.: gnutls library is used by the compiled program (i.e. the host);
+          #   gnutls binaries are used by the build machine.
+          #   therefore gnutls can be specified in both buildInputs and nativeBuildInputs
+          libjcat = addNativeInputs [ next.gnutls ] prev.libjcat;
+          libqmi = prev.libqmi.overrideAttrs (upstream: {
+            # fixes "failed to produce output devdoc"; nixpkgs only builds that output conditionally
+            outputs = [ "out" "dev" ] ++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [
+              "devdoc"
+            ];
           });
 
           librest = prev.librest.overrideAttrs (orig: {
@@ -946,23 +921,12 @@ in
             HAVE_PKG_CONFIG = "yes";
           });
 
-          libvisual = prev.libvisual.overrideAttrs (upstream: {
-            # fixes: "configure: error: *** sdl-config not found."
-            # 2023/02/21: TODO: update nixpkgs to remove this override.
-            # - it's fixed by 11b095e8805aa123a4d77a5e706bebaf86622879
-            buildInputs = [ next.glib ];
-            configureFlags = [ "--disable-examples" ];
-          });
 
-          ncftp = prev.ncftp.overrideAttrs (upstream: {
-            # fixes: "ar: command not found"
-            # `ar` is provided by bintools
-            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [ next.bintools ];
-          });
-          networkmanager-fortisslvpn = prev.networkmanager-fortisslvpn.overrideAttrs (orig: {
-            # fixes "gdbus-codegen: command not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
+          # fixes: "ar: command not found"
+          # `ar` is provided by bintools
+          ncftp = addNativeInputs [ next.bintools ] prev.ncftp;
+          # fixes "gdbus-codegen: command not found"
+          networkmanager-fortisslvpn = mvToNativeInputs [ next.glib ] prev.networkmanager-fortisslvpn;
           # networkmanager-iodine = prev.networkmanager-iodine.overrideAttrs (orig: {
           #   # fails to fix "configure.ac:58: error: possibly undefined macro: AM_GLIB_GNU_GETTEXT"
           #   nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gettext ];
@@ -980,30 +944,21 @@ in
           #   '';
           # });
 
-          networkmanager-l2tp = prev.networkmanager-l2tp.overrideAttrs (orig: {
-            # fixes "gdbus-codegen: command not found"
-            # fixes "gtk4-builder-tool: command not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib next.gtk4 ];
-          });
-          networkmanager-openconnect = prev.networkmanager-openconnect.overrideAttrs (orig: {
-            # fixes "properties/gresource.xml: Permission denied"
-            #   - by providing glib-compile-resources
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
-          networkmanager-openvpn = prev.networkmanager-openvpn.overrideAttrs (orig: {
-            # fixes "properties/gresource.xml: Permission denied"
-            #   - by providing glib-compile-resources
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
-          networkmanager-sstp = prev.networkmanager-sstp.overrideAttrs (orig: {
-            # fixes "gdbus-codegen: command not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
-          networkmanager-vpnc = prev.networkmanager-vpnc.overrideAttrs (orig: {
-            # fixes "properties/gresource.xml: Permission denied"
-            #   - by providing glib-compile-resources
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
+          # fixes "gdbus-codegen: command not found"
+          # fixes "gtk4-builder-tool: command not found"
+          networkmanager-l2tp = addNativeInputs [ next.gtk4 ]
+            (mvToNativeInputs [ next.glib ] prev.networkmanager-l2tp);
+          # fixes "properties/gresource.xml: Permission denied"
+          #   - by providing glib-compile-resources
+          networkmanager-openconnect = mvToNativeInputs [ next.glib ] prev.networkmanager-openconnect;
+          # fixes "properties/gresource.xml: Permission denied"
+          #   - by providing glib-compile-resources
+          networkmanager-openvpn = mvToNativeInputs [ next.glib ] prev.networkmanager-openvpn;
+          # fixes "gdbus-codegen: command not found"
+          networkmanager-sstp = mvToNativeInputs [ next.glib ] prev.networkmanager-sstp;
+          networkmanager-vpnc = mvToNativeInputs [ next.glib ] prev.networkmanager-vpnc;
+          # fixes "properties/gresource.xml: Permission denied"
+          #   - by providing glib-compile-resources
           nheko = prev.nheko.overrideAttrs (orig: {
             # fixes "fatal error: lmdb++.h: No such file or directory
             buildInputs = orig.buildInputs ++ [ next.lmdbxx ];
@@ -1076,10 +1031,10 @@ in
           #   ];
           #   # buildInputs = lib.remove next.gnupg upstream.buildInputs;
           # });
-          obex_data_server = prev.obex_data_server.override {
-            # fixes "/nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 2: --prefix=ods_manager: command not found"
-            inherit (emulated) stdenv;
-          };
+
+          # fixes "/nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 2: --prefix=ods_manager: command not found"
+          # - dbus-glib should maybe be removed from buildInputs, too? but doing so breaks upstream configure
+          obex_data_server = addNativeInputs [ next.dbus-glib ] prev.obex_data_server;
           openfortivpn = prev.openfortivpn.override {
             # fixes "checking for /proc/net/route... configure: error: cannot check for file existence when cross compiling"
             inherit (emulated) stdenv;
@@ -1094,22 +1049,16 @@ in
           #   # buildInputs = lib.remove next.gpgme upstream.buildInputs;
           #   nativeBuildInputs = upstream.nativeBuildInputs ++ [ next.gpgme ];
           # });
-          pam_mount = prev.pam_mount.overrideAttrs (orig: {
-            # fixes: "perl: command not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.perl ];
-          });
+
+          # fixes: "perl: command not found"
+          pam_mount = mvToNativeInputs [ next.perl ] prev.pam_mount;
 
           # phoc = prev.phoc.override {
           #   # fixes "Program wayland-scanner found: NO"
           #   inherit (emulated) stdenv;
           # };
-          phoc = prev.phoc.overrideAttrs (upstream: {
-            # buildInputs = upstream.buildInputs or [] ++ [ next.wayland-scanner ];
-            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
-              next.wayland-scanner
-              next.glib  # fixes (meson) "Program 'glib-mkenums mkenums' not found or not executable"
-            ];
-          });
+          # fixes (meson) "Program 'glib-mkenums mkenums' not found or not executable"
+          phoc = mvToNativeInputs [ next.wayland-scanner next.glib ] prev.phoc;
           phosh = prev.phosh.overrideAttrs (upstream: {
             buildInputs = upstream.buildInputs ++ [
               next.libadwaita  # "plugins/meson.build:41:2: ERROR: Dependency "libadwaita-1" not found, tried pkgconfig"
@@ -1117,31 +1066,28 @@ in
             mesonFlags = upstream.mesonFlags ++ [
               "-Dphoc_tests=disabled"  # "tests/meson.build:20:0: ERROR: Program 'phoc' not found or not executable"
             ];
-            postPatch = upstream.postPatch or "" + ''
-              sed -i 's:gio_querymodules = :gio_querymodules = "${next.buildPackages.glib.dev}/bin/gio-querymodules" if True else :' build-aux/post_install.py
-            '';
+            # postPatch = upstream.postPatch or "" + ''
+            #   sed -i 's:gio_querymodules = :gio_querymodules = "${next.buildPackages.glib.dev}/bin/gio-querymodules" if True else :' build-aux/post_install.py
+            # '';
           });
           # phosh-mobile-settings = prev.phosh-mobile-settings.override {
           #   # fixes "meson.build:26:0: ERROR: Dependency "phosh-plugins" not found, tried pkgconfig"
           #   inherit (emulated) stdenv;
           # };
-          phosh-mobile-settings = prev.phosh-mobile-settings.overrideAttrs (upstream: {
+          phosh-mobile-settings = mvInputs {
             # fixes "meson.build:26:0: ERROR: Dependency "phosh-plugins" not found, tried pkgconfig"
             # phosh is used only for its plugins; these are specified as a runtime dep in src.
             # it's correct for them to be runtime dep: src/ms-lockscreen-panel.c loads stuff from
-            # MOBILE_SETTINGS_PHOSH_PLUGINS_DIR at runtime
-            buildInputs = upstream.buildInputs ++ [ next.phosh ];
-            nativeBuildInputs = (lib.remove next.phosh upstream.nativeBuildInputs) ++ [
+            buildInputs = [ next.phosh ];
+            nativeBuildInputs = [
               next.gettext  # fixes "data/meson.build:1:0: ERROR: Program 'msgfmt' not found or not executable"
               next.wayland-scanner  # fixes "protocols/meson.build:7:0: ERROR: Program 'wayland-scanner' not found or not executable"
               next.glib  # fixes "src/meson.build:1:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
               next.desktop-file-utils  # fixes "meson.build:116:8: ERROR: Program 'update-desktop-database' not found or not executable"
             ];
-          });
-          pipewire = prev.pipewire.overrideAttrs (orig: {
-            # fixes `spa/plugins/bluez5/meson.build:41:0: ERROR: Program 'gdbus-codegen' not found or not executable`
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
+          } prev.phosh-mobile-settings;
+          # fixes `spa/plugins/bluez5/meson.build:41:0: ERROR: Program 'gdbus-codegen' not found or not executable`
+          pipewire = mvToNativeInputs [ next.glib ] prev.pipewire;
           # psqlodbc = prev.psqlodbc.override {
           #   # fixes "configure: error: odbc_config not found (required for unixODBC build)"
           #   inherit (emulated) stdenv;
@@ -1247,16 +1193,9 @@ in
             # fixes "error: could not find git for clone of catch2-populate"
             buildInputs = orig.buildInputs or [] ++ [ next.catch2_3 ];
           });
-          re2 = (prev.re2.override {
-            # fixes: "FAILED: CMakeFiles/test.util"
-            inherit (emulated) stdenv;
-          }).overrideAttrs (orig: {
-            # exhaustive{,1,2}_test times out after 1500s.
-            # this is after exhaustive3_test takes 600s to pass.
-            doCheck = false;
-          });
           rmlint = prev.rmlint.override {
             # fixes "Checking whether the C compiler works... no"
+            # rmlint is scons; it reads the CC environment variable, though, so *may* be cross compilable
             inherit (emulated) stdenv;
           };
           samba = prev.samba.overrideAttrs (_upstream: {
@@ -1272,15 +1211,23 @@ in
           #   # fails to fix original error
           #   inherit (emulated) stdenv;
           # };
-          serf = prev.serf.overrideAttrs (upstream: {
-            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
-              next.bintools  # fixes "sh: line 1: ar: command not found"
+
+          # fixes "sh: line 1: ar: command not found"
+          serf = addNativeInputs [ next.bintools ] prev.serf;
+
+          spandsp = prev.spandsp.overrideAttrs (upstream: {
+            configureFlags = upstream.configureFlags or [] ++ [
+              # fixes runtime error: "undefined symbol: rpl_realloc"
+              # source is <https://github.com/NixOS/nixpkgs/pull/57825>
+              "ac_cv_func_malloc_0_nonnull=yes"
+              "ac_cv_func_realloc_0_nonnull=yes"
             ];
           });
 
-          # squeekboard = prev.squeekboard.overrideAttrs (orig: {
+          # squeekboard = prev.squeekboard.overrideAttrs (upstream: {
           #   # fixes: "meson.build:1:0: ERROR: 'rust' compiler binary not defined in cross or native file"
           #   # new error: "meson.build:1:0: ERROR: Rust compiler rustc --target aarch64-unknown-linux-gnu -C linker=aarch64-unknown-linux-gnu-gcc can not compile programs."
+          #   # NB(2023/03/04): upstream nixpkgs has a new squeekboard that's closer to cross-compiling; use that
           #   mesonFlags =
           #     let
           #       # ERROR: 'rust' compiler binary not defined in cross or native file
@@ -1289,14 +1236,44 @@ in
           #         rust = [ 'rustc', '--target', '${next.rust.toRustTargetSpec next.stdenv.hostPlatform}' ]
           #       '';
           #     in
-          #       orig.mesonFlags or [] ++ lib.optionals (next.stdenv.hostPlatform != next.stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
+          #       # upstream.mesonFlags or [] ++
+          #       [
+          #         "-Dtests=false"
+          #         "-Dnewer=false"
+          #         "-Donline=false"
+          #       ]
+          #       ++ lib.optional
+          #         (next.stdenv.hostPlatform != next.stdenv.buildPlatform)
+          #         "--cross-file=${crossFile}"
+          #       ;
+
+          #   cargoDeps = null;
+          #   cargoVendorDir = "vendor";
+
+          #   depsBuildBuild = upstream.depsBuildBuild or [] ++ [
+          #     next.pkg-config
+          #   ];
+          #   nativeBuildInputs = with next; [
+          #     meson
+          #     ninja
+          #     pkg-config
+          #     glib
+          #     wayland
+          #     wrapGAppsHook
+          #     rustPlatform.cargoSetupHook
+          #     cargo
+          #     rustc
+          #   ];
           # });
+
           squeekboard = prev.squeekboard.override {
             inherit (emulated)
               rustPlatform  # fixes original "'rust' compiler binary not defined in cross or native file"
-              stdenv  # fixes error when linking src/squeekboard: "/nix/store/3c0dqm093ylw8ks7myzxdaif0m16rgcl-binutils-2.40/bin/ld: /nix/store/jzh15bi6zablx3d9s928w3lgqy6and91-glib-2.74.3/lib/libgio-2.0.so"
-              glib  # fixes "gcc: error: unrecognized command line option '-m64'"
+              stdenv  # fixes "gcc: error: unrecognized command line option '-m64'"
+              glib  # fixes error when linking src/squeekboard: "/nix/store/3c0dqm093ylw8ks7myzxdaif0m16rgcl-binutils-2.40/bin/ld: /nix/store/jzh15bi6zablx3d9s928w3lgqy6and91-glib-2.74.3/lib/libgio-2.0.so"
               wayland  # fixes error when linking src/squeekboard: "/nix/store/3c0dqm093ylw8ks7myzxdaif0m16rgcl-binutils-2.40/bin/ld: /nix/store/ni0vb1pnaznx85378i3h9xhw9cay68g5-wayland-1.21.0/lib/libwayland-client.so: error adding symbols: file in wrong format"
+              # gtk3  # fails to fix: "/nix/store/acl3fg3z4i96d6lha2cbr16k7bl1zjs5-binutils-2.40/bin/ld: /nix/store/k2jd14yl5qcl3kwifhhs271607fjafbx-gtk+3-3.24.36/lib/libgtk-3.so: error adding symbols: file in wrong format"
+              wrapGAppsHook  # introduces a competing gtk3 at link-time, unless emulated
             ;
           };
           subversion = prev.subversion.overrideAttrs (upstream: {
@@ -1307,14 +1284,10 @@ in
             ];
           });
 
-          sysprof = prev.sysprof.overrideAttrs (orig: {
-            # fixes: "src/meson.build:12:2: ERROR: Program 'gdbus-codegen' not found or not executable"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
-          tpm2-abrmd = prev.tpm2-abrmd.overrideAttrs (orig: {
-            # fixes "configure: error: *** gdbus-codegen is required to build tpm2-abrmd; No package 'gio-unix-2.0' found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
-          });
+          # fixes: "src/meson.build:12:2: ERROR: Program 'gdbus-codegen' not found or not executable"
+          sysprof = mvToNativeInputs [ next.glib ] prev.sysprof;
+          # fixes "configure: error: *** gdbus-codegen is required to build tpm2-abrmd; No package 'gio-unix-2.0' found"
+          tpm2-abrmd = addNativeInputs [ next.glib ] prev.tpm2-abrmd;
           tracker-miners = prev.tracker-miners.override {
             # fixes "meson.build:183:0: ERROR: Can not run test applications in this cross environment."
             inherit (emulated) stdenv;
@@ -1324,11 +1297,9 @@ in
           #   inherit (emulated) stdenv;
           # };
 
-          unar = prev.unar.overrideAttrs (upstream: {
-            # fixes: "ar: command not found"
-            # `ar` is provided by bintools
-            nativeBuildInputs = upstream.nativeBuildInputs ++ [ next.bintools ];
-          });
+          # fixes: "ar: command not found"
+          # `ar` is provided by bintools
+          unar = addNativeInputs [ next.bintools ] prev.unar;
           unixODBCDrivers = prev.unixODBCDrivers // {
             # TODO: should this package be deduped with toplevel psqlodbc in upstream nixpkgs?
             psql = prev.unixODBCDrivers.psql.overrideAttrs (_upstream: {
@@ -1355,24 +1326,18 @@ in
             # makeFlags = orig.makeFlags or [] ++ [ "CC=${prev.stdenv.cc.targetPrefix}cc" ];
             BUILDCC = "${prev.stdenv.cc}/bin/${prev.stdenv.cc.targetPrefix}cc";
           });
-          vpnc = prev.vpnc.overrideAttrs (orig: {
-            # fixes "perl: command not found"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.perl ];
-          });
+          # fixes "perl: command not found"
+          vpnc = mvToNativeInputs [ next.perl ] prev.vpnc;
           xapian = prev.xapian.overrideAttrs (upstream: {
             # the output has #!/bin/sh scripts.
             # - shebangs get re-written on native build, but not cross build
             buildInputs = upstream.buildInputs ++ [ next.bash ];
           });
-          xdg-desktop-portal-gtk = prev.xdg-desktop-portal-gtk.overrideAttrs (orig: {
-            # fixes "No package 'xdg-desktop-portal' found"
-            buildInputs = orig.buildInputs ++ [ next.xdg-desktop-portal ];
-          });
-          xdg-desktop-portal-gnome = prev.xdg-desktop-portal-gnome.overrideAttrs (orig: {
-            # fixes: "data/meson.build:33:5: ERROR: Program 'msgfmt' not found or not executable"
-            # fixes: "src/meson.build:25:0: ERROR: Program 'gdbus-codegen' not found or not executable"
-            nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gettext next.glib ];
-          });
+          # fixes "No package 'xdg-desktop-portal' found"
+          xdg-desktop-portal-gtk = mvToBuildInputs [ next.xdg-desktop-portal ] prev.xdg-desktop-portal-gtk;
+          # fixes: "data/meson.build:33:5: ERROR: Program 'msgfmt' not found or not executable"
+          # fixes: "src/meson.build:25:0: ERROR: Program 'gdbus-codegen' not found or not executable"
+          xdg-desktop-portal-gnome = mvToNativeInputs [ next.gettext next.glib ] prev.xdg-desktop-portal-gnome;
           # webkitgtk = prev.webkitgtk.override { stdenv = next.ccacheStdenv; };
           # webp-pixbuf-loader = prev.webp-pixbuf-loader.override {
           #   # fixes "Builder called die: Cannot wrap '/nix/store/kpp8qhzdjqgvw73llka5gpnsj0l4jlg8-gdk-pixbuf-aarch64-unknown-linux-gnu-2.42.10/bin/gdk-pixbuf-thumbnailer' because it is not an executable file"

hosts/common/default.nix

@@ -20,6 +20,7 @@
 
   sane.nixcache.enable-trusted-keys = true;
   sane.nixcache.enable = lib.mkDefault true;
+  sane.persist.enable = lib.mkDefault true;
   sane.programs.sysadminUtils.enableFor.system = lib.mkDefault true;
   sane.programs.consoleUtils.enableFor.user.colin = lib.mkDefault true;
 

hosts/common/feeds.nix

@@ -1,3 +1,9 @@
+# candidates:
+# - The Nonlinear Library (podcast): <https://forum.effectivealtruism.org/posts/JTZTBienqWEAjGDRv/listen-to-more-ea-content-with-the-nonlinear-library>
+#   - has ~10 posts per day, text-to-speech; i would need better tagging before adding this
+# - <https://www.metaculus.com/questions/11102/introducing-the-metaculus-journal-podcast/>
+#   - dead since 2022/10 - 2023/03
+
 { lib, sane-data, ... }:
 let
   hourly = { freq = "hourly"; };
@@ -50,16 +56,23 @@ let
     (fromDb "lexfridman.com/podcast" // rat)
     ## Astral Codex Ten
     (fromDb "sscpodcast.libsyn.com" // rat)
+    ## Less Wrong Curated
+    (fromDb "feeds.libsyn.com/421877" // rat)
     ## Econ Talk
     (fromDb "feeds.simplecast.com/wgl4xEgL" // rat)
     ## Cory Doctorow -- both podcast & text entries
     (fromDb "craphound.com" // pol)
     (fromDb "congressionaldish.libsyn.com" // pol)
+    (mkPod "https://podcasts.la.utexas.edu/this-is-democracy/feed/podcast/" // pol // weekly)
     ## Civboot -- https://anchor.fm/civboot
     (fromDb "anchor.fm/s/34c7232c/podcast/rss" // tech)
     ## Emerge: making sense of what's next -- <https://www.whatisemerging.com/emergepodcast>
     (mkPod "https://anchor.fm/s/21bc734/podcast/rss" // pol // infrequent)
     (fromDb "feeds.feedburner.com/80000HoursPodcast" // rat)
+    ## Daniel Huberman on sleep
+    (fromDb "feeds.megaphone.fm/hubermanlab" // uncat)
+    ## Multidisciplinary Association for Psychedelic Studies
+    (fromDb "mapspodcast.libsyn.com" // uncat)
     (fromDb "allinchamathjason.libsyn.com" // pol)
     (fromDb "acquired.libsyn.com" // tech)
     # The Intercept - Deconstructed; also available: <rss.acast.com/deconstructed>
@@ -104,6 +117,10 @@ let
     (fromDb "semiaccurate.com" // tech)
     (mkText "https://linuxphoneapps.org/blog/atom.xml" // tech // infrequent)
     (fromDb "spectrum.ieee.org" // tech)
+    (fromDb "thisweek.gnome.org" // tech)
+    # more nixos stuff here, but unclear how to subscribe: <https://nixos.org/blog/categories.html>
+    (mkText "https://nixos.org/blog/announcements-rss.xml" // tech // infrequent)
+    (mkText "https://nixos.org/blog/stories-rss.xml" // tech // weekly)
     ## n.b.: quality RSS list here: <https://forum.merveilles.town/thread/57/share-your-rss-feeds%21-6/>
     (mkText "https://forum.merveilles.town/rss.xml" // pol // infrequent)
 
@@ -112,6 +129,7 @@ let
 
     # DEVELOPERS
     (fromDb "uninsane.org" // tech)
+    (fromDb "ascii.textfiles.com" // tech)  # Jason Scott
     (fromDb "mg.lol" // tech)
     (fromDb "drewdevault.com" // tech)
     ## Ken Shirriff

hosts/common/home/splatmoji.nix

@@ -6,7 +6,8 @@
 {
   sane.user.persist.plaintext = [ ".local/state/splatmoji" ];
   sane.user.fs.".config/splatmoji/splatmoji.config" = sane-lib.fs.wantedText ''
-    history_file=~/.local/state/splatmoji/history
+    # XXX doesn't seem to understand ~ as shorthand for `$HOME`
+    history_file=/home/colin/.local/state/splatmoji/history
     history_length=5
     # TODO: wayland equiv
     paste_command=xdotool key ctrl+v

hosts/common/home/ssh.nix

@@ -3,7 +3,8 @@
 with lib;
 let
   host = config.networking.hostName;
-  user-pubkey = config.sane.ssh.pubkeys."colin@${host}".asUserKey;
+  user-pubkey-full = config.sane.ssh.pubkeys."colin@${host}" or {};
+  user-pubkey = user-pubkey-full.asUserKey or null;
   host-keys = filter (k: k.user == "root") (attrValues config.sane.ssh.pubkeys);
   known-hosts-text = concatStringsSep
     "\n"
@@ -13,7 +14,8 @@ in
 {
   # ssh key is stored in private storage
   sane.user.persist.private = [ ".ssh/id_ed25519" ];
-  sane.user.fs.".ssh/id_ed25519.pub" = sane-lib.fs.wantedText user-pubkey;
+  sane.user.fs.".ssh/id_ed25519.pub" =
+    mkIf (user-pubkey != null) (sane-lib.fs.wantedText user-pubkey);
   sane.user.fs.".ssh/known_hosts" = sane-lib.fs.wantedText known-hosts-text;
 
   users.users.colin.openssh.authorizedKeys.keys =

hosts/common/home/zsh/default.nix

@@ -1,6 +1,8 @@
-{ pkgs, sane-lib, ... }:
+{ config, lib, pkgs, sane-lib, ... }:
 
 let
+  inherit (lib) mkOption types;
+  cfg = config.sane.zsh;
   # powerlevel10k prompt config
   # p10k.zsh is the auto-generated config, and i overwrite those defaults here, below.
   p10k-overrides = ''
@@ -26,123 +28,134 @@ let
   '';
 in
 {
-  sane.user.persist.plaintext = [
-    # we don't need to full zsh dir -- just the history file --
-    # but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
-    # TODO: should be private?
-    ".local/share/zsh"
-    # cache gitstatus otherwise p10k fetched it from the net EVERY BOOT
-    ".cache/gitstatus"
-  ];
-
-  # zsh/prezto complains if zshrc doesn't exist; but it does allow an "empty" file.
-  sane.user.fs.".config/zsh/.zshrc" = sane-lib.fs.wantedText "# ";
-
-  # enable zsh completions
-  environment.pathsToLink = [ "/share/zsh" ];
-
-  programs.zsh = {
-    enable = true;
-    histFile = "$HOME/.local/share/zsh/history";
-    shellAliases = {
-      ":q" = "exit";
-      # common typos
-      "cd.." = "cd ..";
-      "cd../" = "cd ../";
+  options = {
+    sane.zsh = {
+      showDeadlines = mkOption {
+        type = types.bool;
+        default = true;
+        description = "show upcoming deadlines (frommy PKM) upon shell init";
+      };
     };
-    setOptions = [
-      # defaults:
-      "HIST_IGNORE_DUPS"
-      "SHARE_HISTORY"
-      "HIST_FCNTL_LOCK"
-      # disable `rm *` confirmations
-      "rmstarsilent"
-    ];
-
-    # .zshenv config:
-    shellInit = ''
-      ZDOTDIR=$HOME/.config/zsh
-    '';
-
-    # .zshrc config:
-    interactiveShellInit =
-      (builtins.readFile ./p10k.zsh)
-    + p10k-overrides
-    + prezto-init
-    + ''
-      # zmv is a way to do rich moves/renames, with pattern matching/substitution.
-      # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
-      autoload -Uz zmv
-
-      HISTORY_IGNORE='(sane-shutdown *|sane-reboot *|rm *)'
-
-      # extra aliases
-      # TODO: move to `shellAliases` config?
-      function nd() {
-        mkdir -p "$1";
-        pushd "$1";
-      }
-
-      expiration=$(date -d "6 Mar" +%s)
-      today=$(date +%s)
-      days_until=$(( ($expiration - $today) / (24*60*60) ))
-      echo "You have $days_until days to renew your driver's license"
-
-      # auto-cd into any of these dirs by typing them and pressing 'enter':
-      hash -d 3rd="/home/colin/dev/3rd"
-      hash -d dev="/home/colin/dev"
-      hash -d knowledge="/home/colin/knowledge"
-      hash -d nixos="/home/colin/nixos"
-      hash -d nixpkgs="/home/colin/dev/3rd/nixpkgs"
-      hash -d ref="/home/colin/ref"
-      hash -d secrets="/home/colin/knowledge/secrets"
-      hash -d tmp="/home/colin/tmp"
-      hash -d uninsane="/home/colin/dev/uninsane"
-      hash -d Videos="/home/colin/Videos"
-    '';
-
-    syntaxHighlighting.enable = true;
-    vteIntegration = true;
   };
 
-  # enable a command-not-found hook to show nix packages that might provide the binary typed.
-  programs.nix-index.enable = true;
-  programs.command-not-found.enable = false;  #< mutually exclusive with nix-index
+  config = {
+    sane.user.persist.plaintext = [
+      # we don't need to full zsh dir -- just the history file --
+      # but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
+      # TODO: should be private?
+      ".local/share/zsh"
+      # cache gitstatus otherwise p10k fetched it from the net EVERY BOOT
+      ".cache/gitstatus"
+    ];
 
-  # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
-  # see: https://github.com/sorin-ionescu/prezto
-  # i believe this file is auto-sourced by the prezto init.zsh script.
-  sane.user.fs.".config/zsh/.zpreztorc" = sane-lib.fs.wantedText ''
-    zstyle ':prezto:*:*' color 'yes'
+    # zsh/prezto complains if zshrc doesn't exist; but it does allow an "empty" file.
+    sane.user.fs.".config/zsh/.zshrc" = sane-lib.fs.wantedText "# ";
 
-    # modules (they ship with prezto):
-    # ENVIRONMENT: configures jobs to persist after shell exit; other basic niceties
-    # TERMINAL: auto-titles terminal (e.g. based on cwd)
-    # EDITOR: configures shortcuts like Ctrl+U=undo, Ctrl+L=clear
-    # HISTORY: `history-stat` alias, setopts for good history defaults
-    # DIRECTORY: sets AUTO_CD, adds `d` alias to list directory stack, and `1`-`9` to cd that far back the stack
-    # SPECTRUM: helpers for term colors and styling. used by prompts? might be unnecessary
-    # UTILITY: configures aliases like `ll`, `la`, disables globbing for things like rsync
-    #   adds aliases like `get` to fetch a file. also adds `http-serve` alias??
-    # COMPLETION: tab completion. requires `utility` module prior to loading
-    # TODO: enable AUTO_PARAM_SLASH
-    zstyle ':prezto:load' pmodule \
-      'environment' \
-      'terminal' \
-      'editor' \
-      'history' \
-      'directory' \
-      'spectrum' \
-      'utility' \
-      'completion' \
-      'prompt'
+    # enable zsh completions
+    environment.pathsToLink = [ "/share/zsh" ];
 
-    # default keymap. try also `vicmd` (vim normal mode, AKA "cmd mode") or `vi`.
-    zstyle ':prezto:module:editor' key-bindings 'emacs'
+    programs.zsh = {
+      enable = true;
+      histFile = "$HOME/.local/share/zsh/history";
+      shellAliases = {
+        ":q" = "exit";
+        # common typos
+        "cd.." = "cd ..";
+        "cd../" = "cd ../";
+      };
+      setOptions = [
+        # defaults:
+        "HIST_IGNORE_DUPS"
+        "SHARE_HISTORY"
+        "HIST_FCNTL_LOCK"
+        # disable `rm *` confirmations
+        "rmstarsilent"
+      ];
 
-    zstyle ':prezto:module:prompt' theme 'powerlevel10k'
+      # .zshenv config:
+      shellInit = ''
+        ZDOTDIR=$HOME/.config/zsh
+      '';
 
-    # disable `mv` confirmation (and `rm`, too, unfortunately)
-    zstyle ':prezto:module:utility' safe-ops 'no'
-  '';
+      # .zshrc config:
+      interactiveShellInit =
+        (builtins.readFile ./p10k.zsh)
+      + p10k-overrides
+      + prezto-init
+      + ''
+        # zmv is a way to do rich moves/renames, with pattern matching/substitution.
+        # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
+        autoload -Uz zmv
+
+        HISTORY_IGNORE='(sane-shutdown *|sane-reboot *|rm *|nixos-rebuild.* switch)'
+
+        # extra aliases
+        # TODO: move to `shellAliases` config?
+        function nd() {
+          mkdir -p "$1";
+          pushd "$1";
+        }
+      ''
+      + lib.optionalString cfg.showDeadlines ''
+        ${pkgs.sane-scripts}/bin/sane-deadlines
+      ''
+      + ''
+        # auto-cd into any of these dirs by typing them and pressing 'enter':
+        hash -d 3rd="/home/colin/dev/3rd"
+        hash -d dev="/home/colin/dev"
+        hash -d knowledge="/home/colin/knowledge"
+        hash -d nixos="/home/colin/nixos"
+        hash -d nixpkgs="/home/colin/dev/3rd/nixpkgs"
+        hash -d ref="/home/colin/ref"
+        hash -d secrets="/home/colin/knowledge/secrets"
+        hash -d tmp="/home/colin/tmp"
+        hash -d uninsane="/home/colin/dev/uninsane"
+        hash -d Videos="/home/colin/Videos"
+      '';
+
+      syntaxHighlighting.enable = true;
+      vteIntegration = true;
+    };
+
+    # enable a command-not-found hook to show nix packages that might provide the binary typed.
+    programs.nix-index.enable = true;
+    programs.command-not-found.enable = false;  #< mutually exclusive with nix-index
+
+    # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
+    # see: https://github.com/sorin-ionescu/prezto
+    # i believe this file is auto-sourced by the prezto init.zsh script.
+    sane.user.fs.".config/zsh/.zpreztorc" = sane-lib.fs.wantedText ''
+      zstyle ':prezto:*:*' color 'yes'
+
+      # modules (they ship with prezto):
+      # ENVIRONMENT: configures jobs to persist after shell exit; other basic niceties
+      # TERMINAL: auto-titles terminal (e.g. based on cwd)
+      # EDITOR: configures shortcuts like Ctrl+U=undo, Ctrl+L=clear
+      # HISTORY: `history-stat` alias, setopts for good history defaults
+      # DIRECTORY: sets AUTO_CD, adds `d` alias to list directory stack, and `1`-`9` to cd that far back the stack
+      # SPECTRUM: helpers for term colors and styling. used by prompts? might be unnecessary
+      # UTILITY: configures aliases like `ll`, `la`, disables globbing for things like rsync
+      #   adds aliases like `get` to fetch a file. also adds `http-serve` alias??
+      # COMPLETION: tab completion. requires `utility` module prior to loading
+      # TODO: enable AUTO_PARAM_SLASH
+      zstyle ':prezto:load' pmodule \
+        'environment' \
+        'terminal' \
+        'editor' \
+        'history' \
+        'directory' \
+        'spectrum' \
+        'utility' \
+        'completion' \
+        'prompt'
+
+      # default keymap. try also `vicmd` (vim normal mode, AKA "cmd mode") or `vi`.
+      zstyle ':prezto:module:editor' key-bindings 'emacs'
+
+      zstyle ':prezto:module:prompt' theme 'powerlevel10k'
+
+      # disable `mv` confirmation (and `rm`, too, unfortunately)
+      zstyle ':prezto:module:utility' safe-ops 'no'
+    '';
+  };
 }

hosts/common/ids.nix

@@ -38,7 +38,7 @@
   sane.ids.sshd.uid = 2001;  # 997
   sane.ids.sshd.gid = 2001;  # 997
   sane.ids.polkituser.gid = 2002;  # 998
-  # sane.ids.systemd-coredump.gid = 2003;  # 996  # 2023/02/12: upstream now specifies this as 151
+  sane.ids.systemd-coredump.gid = 2003;  # 996  # 2023/02/12-2023/02/28: upstream temporarily specified this as 151
   sane.ids.nscd.uid = 2004;
   sane.ids.nscd.gid = 2004;
   sane.ids.systemd-oom.uid = 2005;

hosts/common/programs.nix

@@ -162,7 +162,7 @@ let
       "gnome.nautilus"
       # gnome-podcasts
       "gnome.gnome-system-monitor"
-      "gnome.gnome-terminal"  # works on phosh
+      # "gnome.gnome-terminal"  # works on phosh
       "gnome.gnome-weather"
       gpodder-configured
       gthumb
@@ -193,6 +193,7 @@ let
   desktopGuiPkgs = {
     inherit (flattenedPkgs)
       audacity
+      brave  # for the integrated wallet -- as a backup
       chromium
       dino
       electrum
@@ -202,6 +203,7 @@ let
       gimp  # broken on phosh
       "gnome.gnome-disk-utility"
       handbrake
+      hase
       inkscape
       kdenlive
       kid3  # audio tagging

hosts/modules/gui/phosh.nix

@@ -28,6 +28,7 @@ in
           "guiApps"
           # TODO: see about removing gnome-bluetooth if the in-built gnome-settings bluetooth manager can work
           "gnome.gnome-bluetooth"
+          "gnome.gnome-terminal"
           "phosh-mobile-settings"
           # "plasma5Packages.konsole"  # more reliable terminal
         ];
@@ -37,11 +38,13 @@ in
       sane.programs = {
         inherit (pkgs // {
           "gnome.gnome-bluetooth" = pkgs.gnome.gnome-bluetooth;
+          "gnome.gnome-terminal" = pkgs.gnome.gnome-terminal;
           "plasma5Packages.konsole" = pkgs.plasma5Packages.konsole;
         })
           phosh-mobile-settings
           "plasma5Packages.konsole"
           # "gnome.gnome-bluetooth"
+          "gnome.gnome-terminal"
         ;
       };
     }

modules/data/feeds/sources/feeds.libsyn.com/421877/default.json

@@ -0,0 +1,23 @@
+{
+  "bozo": 0,
+  "content_length": 272569,
+  "content_type": "text/xml; charset=utf-8",
+  "description": "Audio version of the posts shared in the LessWrong Curated newsletter.",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [
+    "https://pubsubhubbub.appspot.com/"
+  ],
+  "is_podcast": true,
+  "is_push": true,
+  "item_count": 56,
+  "last_updated": "2023-03-08T08:00:00+00:00",
+  "score": 32,
+  "self_url": "https://feeds.buzzsprout.com/2037297.rss",
+  "site_name": "",
+  "site_url": "",
+  "title": "LessWrong Curated Podcast",
+  "url": "https://feeds.buzzsprout.com/2037297.rss",
+  "velocity": 0.192,
+  "version": "rss20"
+}

modules/data/feeds/sources/feeds.megaphone.fm/hubermanlab/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 1377252,
+  "content_type": "application/xml; charset=utf-8",
+  "description": "Andrew Huberman, Ph.D.",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [],
+  "is_podcast": true,
+  "is_push": false,
+  "item_count": 129,
+  "last_updated": "2023-03-06T09:00:00+00:00",
+  "score": 14,
+  "self_url": "https://feeds.megaphone.fm/hubermanlab",
+  "site_name": "",
+  "site_url": "",
+  "title": "Huberman Lab",
+  "url": "https://feeds.megaphone.fm/hubermanlab",
+  "velocity": 0.159,
+  "version": "rss20"
+}

modules/data/feeds/sources/mapspodcast.libsyn.com/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 256360,
+  "content_type": "application/rss+xml; charset=utf-8",
+  "description": "Hosted by Zach Leary, the intent of the podcast is to bring you the listener an easily accessible resource for a variety of topics all related to psychedelic research. There is a lot to learn about new research into the therapeutic potential of psychedelics and marijuana. Over the years, the Multidisciplinary Association for Psychedelic Studies (MAPS) has amassed an incredible treasure trove of audio archives sourced from the amazing talks, presentations and panels that have taken place at past Psychedelic Science conferences and other unique events. By selecting some of that content and then bringing it to you in a podcast we hope to create a centralized location for the greater MAPS community. If you're a researcher, scientist, medical professional or just a curiosity seeker we hope that you'll find this content a valuable resource tool.\n\nPlease visit the MAPS website at https://maps.org",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [],
+  "is_podcast": true,
+  "is_push": false,
+  "item_count": 62,
+  "last_updated": "2023-03-06T20:20:00+00:00",
+  "score": 0,
+  "self_url": "https://feeds.libsyn.com/95610/rss",
+  "site_name": "",
+  "site_url": "",
+  "title": "MAPS Podcast",
+  "url": "https://feeds.libsyn.com/95610/rss",
+  "velocity": 0.028,
+  "version": "rss20"
+}

modules/data/feeds/sources/thisweek.gnome.org/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 1250267,
+  "content_type": "text/xml; charset=utf-8",
+  "description": "Recent content on This Week in GNOME",
+  "favicon": "https://thisweek.gnome.org/images/favicon-32x32.png",
+  "favicon_data_uri": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAABYAAAAWABINkT2gAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAI5SURBVFiFvdZPiE1RHAfwz/xBxhSTISxYaJSiJAklioWNjYWVhYWUtYRMslEWSv7WkPybsbHSGMmGDUmhyEKihMgsjMQsnjEW597emdt7z7vvvplvnTr3d3/n9/3ec8/vd35MHVqnkAu0YR+eoYQxPMWyZhEswH0M43DmXTuGMF5hXGyWgMEo6A8Tt/h0FfJxnGmEbA160ZU8twvbGgeenrxbgj81BKzNS746IhtIbB2ZoJ8j/6M1yIfyksORKMB3tCT2T5H9cuR/qwr5NyzMBq8nNYaj+Zxonu5GSfjnKdoqxBjBdnypg08XruFA8jwfv5W/IkUH+rAzs77XxC9/g1X1EKc4Fy3enNj2Cnl8qY71nejHk0TMzDzkcCUScCGy92BG3mD/Q3sF2w3sTuZLI/vbaN6NbVgnpN28xFYSDudjYRfiNblwTNiBqxn7VtxRO8/TUcL+RgXACsxN5otxtw7S7PiLlUVEwAbh9OclT8euIuTLheLTKPm4cE4aQgseFSR/qFw5c2NjQfJ3WNQoOZwoQH5PSMtCGGiAeBSHNKn96stJ/kAT2y3YUyfxLxw0CU1nj1BIapG/EErxpCHu+7Ljo3KlTNGNs/iQ+PzE8SIC1qu+C6cq+Fcq1yNFBMDJKgKeY1rG93UFv9tFBUwXrtdKIgaV832T0LRkfbYUFQCzVS/Lo3il8hXd3wzyFJ24WUVEtXtgVjMFpNiB9zWIx4RWLncvmAetQkt2XTh4X/ES5zWhAZlS/AMHdE5EpHwlOQAAAABJRU5ErkJggg==",
+  "hubs": [],
+  "is_podcast": false,
+  "is_push": false,
+  "item_count": 86,
+  "last_updated": "2023-03-10T00:00:00+00:00",
+  "score": 46,
+  "self_url": "https://thisweek.gnome.org/index.xml",
+  "site_name": "This Week in GNOME",
+  "site_url": "https://thisweek.gnome.org",
+  "title": "This Week in GNOME",
+  "url": "https://thisweek.gnome.org/index.xml",
+  "velocity": 0.141,
+  "version": "rss20"
+}

modules/persist/default.nix

@@ -124,6 +124,9 @@ let
   #   <option>.private.".cache/vim" = { mode = "0700"; };
   # to place ".cache/vim" into the private store and create with the appropriate mode
   dirsSubModule = types.submodule ({ config, ... }: {
+    # TODO: this should be a plain-old `attrsOf (convertInlineAcl entryInStoreOrShorthand)` with downstream checks,
+    #   rather than being filled in based on *other* settings.
+    #   otherwise, it behaves poorly when `sane.persist.enable = false`
     options = lib.attrsets.unionOfDisjoint
       (mapAttrs (store: store-cfg: mkOption {
         default = [];

nixpatches/2023-02-28-mesa-22.3.6.patch

@@ -0,0 +1,23 @@
+diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
+index 52633a6d21649..20d839b74c2ea 100644
+--- a/pkgs/development/libraries/mesa/default.nix
++++ b/pkgs/development/libraries/mesa/default.nix
+@@ -88,7 +88,7 @@
+ let
+   # Release calendar: https://www.mesa3d.org/release-calendar.html
+   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
+-  version = "22.3.5";
++  version = "22.3.6";
+   branch  = lib.versions.major version;
+ 
+   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
+@@ -120,7 +120,7 @@ self = stdenv.mkDerivation {
+       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
+       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
+     ];
+-    sha256 = "3eed2ecae2bc674494566faab9fcc9beb21cd804c7ba2b59a1694f3d7236e6a9";
++    hash = "sha256-TsjsZdvbHulETbpylwiQEooZVDpYzwWTG9b1TxJOEX8=";
+   };
+ 
+   # TODO:
+

nixpatches/2023-03-10-hase.patch

@@ -0,0 +1,178 @@
+diff --git a/pkgs/development/libraries/sparrow3d/default.nix b/pkgs/development/libraries/sparrow3d/default.nix
+new file mode 100644
+index 00000000000..331a02efc5f
+--- /dev/null
++++ b/pkgs/development/libraries/sparrow3d/default.nix
+@@ -0,0 +1,53 @@
++{ lib
++, fetchFromGitHub
++, pkg-config
++, SDL
++, SDL_image
++, SDL_mixer
++, SDL_net
++, SDL_ttf
++, stdenv
++}:
++
++stdenv.mkDerivation (finalAttrs: {
++  pname = "sparrow3d";
++  version = "2020-10-06";
++
++  src = fetchFromGitHub {
++    owner = "theZiz";
++    repo = "sparrow3d";
++    rev = "2033349d7adeba34bda2c442e1fec22377471134";
++    hash = "sha256-28j5nbTYBrMN8BQ6XrTlO1D8Viw+RiT3MAl99BAbhR4=";
++  };
++
++  nativeBuildInputs = [
++    pkg-config
++  ];
++
++  propagatedBuildInputs = [
++    SDL.dev
++    SDL_image
++    SDL_ttf
++    SDL_mixer
++    SDL_net
++  ];
++
++  postConfigure = ''
++    NIX_CFLAGS_COMPILE=$(pkg-config --cflags SDL_image SDL_ttf SDL_mixer SDL_net)
++  '';
++
++  installPhase = ''
++    mkdir -p $out/{include,lib/pkgconfig}
++    cp sparrow*.h $out/include
++    cp libsparrow{3d,Net,Sound}.so $out/lib
++    substituteAll ${./sparrow3d.pc.in} $out/lib/pkgconfig/sparrow3d.pc
++  '';
++
++  meta = with lib; {
++    description = "a software renderer for different open handhelds like the gp2x, wiz, caanoo and pandora";
++    homepage = "https://github.com/theZiz/sparrow3d";
++    license = licenses.lgpl21;
++    maintainers = with maintainers; [ colinsane ];
++    platforms = [ "x86_64-linux" ];
++  };
++})
+diff --git a/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in b/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in
+new file mode 100644
+index 00000000000..046e174ea97
+--- /dev/null
++++ b/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in
+@@ -0,0 +1,17 @@
++prefix=@out@
++includedir=${prefix}/include
++libdir=${prefix}/lib
++
++Name: sparrow3d
++Description: a software renderer for different open handhelds like the gp2x, wiz, caanoo and pandora
++URL: https://github.com/theZiz/sparrow3d
++Version: @version@
++Requires: \
++  sdl \
++  SDL_image \
++  SDL_ttf \
++  SDL_mixer \
++  SDL_net
++Cflags: -isystem${includedir}
++Libs: -L${libdir} -lsparrow3d -lsparrowNet -lsparrowSound
++
+diff --git a/pkgs/games/hase/default.nix b/pkgs/games/hase/default.nix
+new file mode 100644
+index 00000000000..794b6d017ae
+--- /dev/null
++++ b/pkgs/games/hase/default.nix
+@@ -0,0 +1,49 @@
++{ lib
++, fetchFromGitHub
++, pkg-config
++, stdenv
++, sparrow3d
++, zlib
++}:
++
++stdenv.mkDerivation {
++  pname = "hase";
++  version = "2020-10-06";
++
++  src = fetchFromGitHub {
++    owner = "theZiz";
++    repo = "hase";
++    rev = "31d6840cdf0c72fc459f10402dae7726096b2974";
++    hash = "sha256-d9So3E8nCQJ1/BdlwMkGbaFPT9mkX1VzlDGKp71ptEE=";
++  };
++  patches = [ ./prefer-dynamic.patch ];
++
++  nativeBuildInputs = [
++    pkg-config
++  ];
++
++  buildInputs = [
++    sparrow3d
++    zlib
++  ];
++
++  buildPhase = ''
++    NIX_CFLAGS_COMPILE=$(pkg-config --cflags sparrow3d zlib)
++    mkdir -p $out/{bin,share/applications,share/pixmaps}
++    # build and install are one step, and inseparable without patching
++    ./install.sh $out
++  '';
++
++  postFixup = ''
++    substituteInPlace "$out/share/applications/hase.desktop" \
++      --replace "Exec=hase" "Exec=$out/bin/hase"
++  '';
++
++  meta = with lib; {
++    description = "Hase is an open source gravity based artillery shooter. It is similar to Worms, Hedgewars or artillery, but the gravity force and direction depends on the mass nearby. It is optimized for mobile game consoles like the GP2X, Open Pandora or GCW Zero";
++    homepage = "http://ziz.gp2x.de/hase/";
++    license = licenses.gpl3;
++    maintainers = with maintainers; [ colinsane ];
++    platforms = [ "x86_64-linux" ];
++  };
++}
+diff --git a/pkgs/games/hase/prefer-dynamic.patch b/pkgs/games/hase/prefer-dynamic.patch
+new file mode 100644
+index 00000000000..ab36e6b2b3d
+--- /dev/null
++++ b/pkgs/games/hase/prefer-dynamic.patch
+@@ -0,0 +1,13 @@
++diff --git a/Makefile b/Makefile
++index 95d894e..3c561c1 100644
++--- a/Makefile
+++++ b/Makefile
++@@ -35,7 +35,7 @@ endif
++ LIB += -L$(SPARROW_LIB)
++ INCLUDE += -I$(SPARROW_FOLDER)
++ 
++-HASE_STATIC = $(SPARROW_LIB)/$(SPARROW3D_STATIC_LIB) $(SPARROW_LIB)/$(SPARROWSOUND_STATIC_LIB) $(SPARROW_LIB)/$(SPARROWNET_STATIC_LIB) $(STATIC)
+++DYNAMIC += -lsparrow3d -lsparrowSound -lsparrowNet
++ 
++ ifneq ($(TARGET),win32)
++ DYNAMIC += -lz
+diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
+index 521b00eb5f5..31052251314 100644
+--- a/pkgs/top-level/all-packages.nix
++++ b/pkgs/top-level/all-packages.nix
+@@ -23550,6 +23550,8 @@ with pkgs;
+ 
+   spaceship-prompt = callPackage ../shells/zsh/spaceship-prompt {};
+ 
++  sparrow3d = callPackage ../development/libraries/sparrow3d {};
++
+   spdk = callPackage ../development/libraries/spdk { };
+ 
+   speechd = callPackage ../development/libraries/speechd { };
+@@ -35570,6 +35572,8 @@ with pkgs;
+ 
+   harmonist = callPackage ../games/harmonist { };
+ 
++  hase = callPackage ../games/hase { };
++
+   hedgewars = libsForQt5.callPackage ../games/hedgewars {
+     inherit (haskellPackages) ghcWithPackages;
+   };

nixpatches/list.nix

@@ -26,7 +26,9 @@
   # fixed in mesa 22.3.6: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/21330/diffs>
   # only necessary on aarch64.
   # it's a revert of nixpkgs commit dcf630c172df2a9ecaa47c77f868211e61ae8e52
-  ./2023-01-30-mesa-cma-leak.patch
+  # ./2023-01-30-mesa-cma-leak.patch
+  # upgrade to 22.3.6 instead
+  # ./2023-02-28-mesa-22.3.6.patch
 
   # fix qt6.qtbase and qt6.qtModule to cross-compile.
   # unfortunately there's some tangle that makes that difficult to do via the normal `override` facilities
@@ -35,6 +37,14 @@
   # let ccache cross-compile
   ./2023-03-04-ccache-cross-fix.patch
 
+  # 2023-03-09: phosh: 0.23 -> 0.25.1
+  # (fetchpatch {
+  #   url = "https://github.com/NixOS/nixpkgs/pull/219355.diff";
+  #   hash = "sha256-hx2keVWuokla2Oi92zoXsnjVuwakxL2cB55ctzlO8OQ=";
+  # })
+
+  ./2023-03-10-hase.patch
+
   # # kaiteki: init at 2022-09-03
   # vendorHash changes too frequently (might not be reproducible).
   # using local package defn until stabilized

overlays/pins.nix

@@ -15,4 +15,7 @@
   # so just forward the unstable packages.
   inherit (next.stable or prev)
   ;
+  # chromium can take 4 hours to build from source, with no signs of progress.
+  # disable it if you're in a rush.
+  # chromium = next.emptyDirectory;
 })

overlays/pkgs.nix

@@ -1,46 +1,41 @@
 (next: prev:
+  with next;
   let
     sane = rec {
       #### my own, non-upstreamable packages:
-      sane-scripts = prev.callPackage ../pkgs/sane-scripts { };
-      feeds = prev.callPackage ../pkgs/feeds { };
-      tow-boot-pinephone = prev.callPackage ../pkgs/tow-boot-pinephone { };
-      tow-boot-rpi4 = prev.callPackage ../pkgs/tow-boot-rpi4 { };
-      bootpart-uefi-x86_64 = prev.callPackage ../pkgs/bootpart-uefi-x86_64 { };
-      bootpart-tow-boot-rpi-aarch64 = prev.callPackage ../pkgs/bootpart-tow-boot-rpi-aarch64 {
-        # not sure why i can't just do `next.callPackage` instead
-        inherit tow-boot-rpi4;
-      };
-      bootpart-u-boot-rpi-aarch64 = prev.callPackage ../pkgs/bootpart-u-boot-rpi-aarch64 {
-        # not sure why i can't just do `next.callPackage` instead
-        inherit ubootRaspberryPi4_64bit;
-      };
-      rtl8723cs-firmware = prev.callPackage ../pkgs/rtl8723cs-firmware { };
-      linux-megous = prev.callPackage ../pkgs/linux-megous {
+      sane-scripts = callPackage ../pkgs/sane-scripts { };
+      feeds = recurseIntoAttrs (callPackage ../pkgs/feeds { });
+      tow-boot-pinephone = callPackage ../pkgs/tow-boot-pinephone { };
+      tow-boot-rpi4 = callPackage ../pkgs/tow-boot-rpi4 { };
+      bootpart-uefi-x86_64 = callPackage ../pkgs/bootpart-uefi-x86_64 { };
+      bootpart-tow-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-tow-boot-rpi-aarch64 { };
+      bootpart-u-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-u-boot-rpi-aarch64 { };
+      rtl8723cs-firmware = callPackage ../pkgs/rtl8723cs-firmware { };
+      linux-megous = callPackage ../pkgs/linux-megous {
         kernelPatches = [
           prev.kernelPatches.bridge_stp_helper
           prev.kernelPatches.request_key_helper
         ];
       };
 
-      sublime-music-mobile = prev.callPackage ../pkgs/sublime-music-mobile { };
+      sublime-music-mobile = callPackage ../pkgs/sublime-music-mobile { };
 
       #### customized packages
-      fluffychat-moby = prev.callPackage ../pkgs/fluffychat-moby { };
-      gpodder-configured = prev.callPackage ../pkgs/gpodder-configured { };
+      fluffychat-moby = callPackage ../pkgs/fluffychat-moby { };
+      gpodder-configured = callPackage ../pkgs/gpodder-configured { };
       # jackett doesn't allow customization of the bind address: this will probably always be here.
-      jackett = prev.callPackage ../pkgs/jackett { inherit (prev) jackett; };
+      jackett = callPackage ../pkgs/jackett { inherit (prev) jackett; };
       # mozilla keeps nerfing itself and removing configuration options
-      firefox-unwrapped = next.callPackage ../pkgs/firefox-unwrapped { inherit (prev) firefox-unwrapped; };
+      firefox-unwrapped = callPackage ../pkgs/firefox-unwrapped { inherit (prev) firefox-unwrapped; };
 
       # patch rpi uboot with something that fixes USB HDD boot
-      ubootRaspberryPi4_64bit = prev.callPackage ../pkgs/ubootRaspberryPi4_64bit { };
+      ubootRaspberryPi4_64bit = callPackage ../pkgs/ubootRaspberryPi4_64bit { };
 
-      gocryptfs = prev.callPackage ../pkgs/gocryptfs { inherit (prev) gocryptfs; };
+      gocryptfs = callPackage ../pkgs/gocryptfs { inherit (prev) gocryptfs; };
 
-      browserpass = prev.callPackage ../pkgs/browserpass { inherit (prev) browserpass; inherit sane-scripts; };
+      browserpass = callPackage ../pkgs/browserpass { inherit (prev) browserpass; };
 
-      fractal-latest = prev.callPackage ../pkgs/fractal-latest { };
+      fractal-latest = callPackage ../pkgs/fractal-latest { };
 
       #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
 
@@ -50,14 +45,14 @@
         })
       ];
 
-      kaiteki = prev.callPackage ../pkgs/kaiteki { };
-      lightdm-mobile-greeter = prev.callPackage ../pkgs/lightdm-mobile-greeter { };
-      browserpass-extension = prev.callPackage ../pkgs/browserpass-extension { };
-      gopass-native-messaging-host = prev.callPackage ../pkgs/gopass-native-messaging-host { };
+      kaiteki = callPackage ../pkgs/kaiteki { };
+      lightdm-mobile-greeter = callPackage ../pkgs/lightdm-mobile-greeter { };
+      browserpass-extension = callPackage ../pkgs/browserpass-extension { };
+      gopass-native-messaging-host = callPackage ../pkgs/gopass-native-messaging-host { };
       tokodon = prev.libsForQt5.callPackage ../pkgs/tokodon { };
 
       # provided by nixpkgs patch or upstream preview
-      # splatmoji = prev.callPackage ../pkgs/splatmoji { };
+      # splatmoji = callPackage ../pkgs/splatmoji { };
     };
   in sane // { inherit sane; }
 )

pkgs/feeds/default.nix

@@ -1,42 +1,68 @@
 { lib
-, pkgs
+, callPackage
+, python3
+, stdenv
+, writeShellScript
 }:
 
-(lib.makeScope pkgs.newScope (self:
-  let
-    # TODO: dependency-inject this.
-    sane-data = import ../../modules/data { inherit lib; };
-    template = self.callPackage ./template.nix;
-    feed-pkgs = lib.mapAttrs
-      (name: feed-details: template {
-        feedName = name;
-        jsonPath = "modules/data/feeds/sources/${name}/default.json";
-        inherit (feed-details) url;
-      })
-      sane-data.feeds;
-    update-scripts = lib.mapAttrsToList
-      (name: feed: builtins.concatStringsSep " " feed.passthru.updateScript)
-      feed-pkgs;
-  in
-    feed-pkgs // {
-      passthru.updateScript = pkgs.writeShellScript
-        "feeds-update"
-        (builtins.concatStringsSep "\n" update-scripts);
+let
+  # TODO: dependency-inject this.
+  sane-data = import ../../modules/data { inherit lib; };
+  template = callPackage ./template.nix;
+  feed-pkgs = lib.mapAttrs
+    (name: feed-details: template {
+      feedName = name;
+      jsonPath = "modules/data/feeds/sources/${name}/default.json";
+      inherit (feed-details) url;
+    })
+    sane-data.feeds;
+  update-scripts = lib.mapAttrsToList
+    (name: feed: builtins.concatStringsSep " " feed.passthru.updateScript)
+    feed-pkgs;
+in rec {  # TODO: make this a scope
+  inherit feed-pkgs;
+  update = stdenv.mkDerivation {
+    pname = "update";
+    version = "0.1.0";
+    src = ./.;
+    patchPhase =
+      let
+        pyEnv = python3.withPackages (ps: [ ps.feedsearch-crawler ]);
+      in ''
+      substituteInPlace ./update.py \
+        --replace "#!/usr/bin/env nix-shell" "#!${pyEnv.interpreter}"
+    '';
+    installPhase = ''
+      mkdir -p $out/bin
+      mv update.py $out/bin/update.py
+    '';
+  };
+  init-feed = writeShellScript
+    "init-feed"
+    ''
+      # this is the `nix run '.#init-feed' <url>` script`
+      sources_dir=modules/data/feeds/sources
+      # prettify the URL, by default
+      name=$( \
+        echo "$1" \
+        | sed 's|^https://||' \
+        | sed 's|^http://||' \
+        | sed 's|^www\.||' \
+        | sed 's|/+$||' \
+      )
+      json_path="$sources_dir/$name/default.json"
 
-      passthru.initFeedScript = pkgs.writeShellScript
-        "init-feed"
-        ''
-          sources_dir=modules/data/feeds/sources
-          name="$1"
-          url="https://$name"
-          json_path="$sources_dir/$name/default.json"
+      # the name could have slashes in it, so we want to mkdir -p that
+      # but in a way where the least could go wrong.
+      pushd "$sources_dir"; mkdir -p "$name"; popd
 
-          # the name could have slashes in it, so we want to mkdir -p that
-          # but in a way where the least could go wrong.
-          pushd "$sources_dir"; mkdir -p "$name"; popd
-
-          ${./update.py} "$url" "$json_path"
-          cat "$json_path"
-        '';
-    }
-))
+      ${update}/bin/update.py "$name" "$json_path"
+      cat "$json_path"
+    '';
+  passthru = {
+    updateScript = writeShellScript
+      "feeds-update"
+      (builtins.concatStringsSep "\n" update-scripts);
+    initFeedScript = init-feed;
+  };
+}

pkgs/feeds/update.py

@@ -13,9 +13,13 @@ logging.getLogger().setLevel(logging.DEBUG)
 logging.getLogger().addHandler(logging.StreamHandler(sys.stdout))
 logging.getLogger(__name__).debug("logging enabled")
 
-url = coerce_url(url, default_scheme="https")
-items = search(url, total_timeout=180, request_timeout=90, max_content_length=100*1024*1024)
-items = sort_urls(items)
+def try_scheme(url: str, scheme: str):
+    url = coerce_url(url, default_scheme=scheme)
+    print(f"trying {url}")
+    items = search(url, total_timeout=180, request_timeout=90, max_content_length=100*1024*1024)
+    return sort_urls(items)
+
+items = try_scheme(url, "https") or try_scheme(url, "http")
 
 # print all results
 serialized = [item.serialize() for item in items]

pkgs/sane-scripts/src/sane-deadlines

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# processes a tab-separated "deadlines" file and alerts for any upcoming events.
+#
+# deadlines.tsv file format:
+# - <date>\t<reminder-interval>\t<event>
+# - no header
+# - one line per entry
+# - <event> may contain any non-newline and non-tab characters
+# - <notice-interval> is the number of days before the event to start alerting, followed by 'd', e.g. `14d`
+# - <date> should be lexicographically orderable and machine-parsable, e.g. `2023-03-14`
+#
+# example `deadlines.tsv`
+# 2023-03-14	1d	celebrate pi day!
+# 2023-04-18	14d	taxes due
+# 2023-04-01	7d	the other pie day :o
+
+# configurables:
+deadlines=~/knowledge/planner/deadlines.tsv
+
+if ! test -f "$deadlines"; then
+        echo "WARNING: $deadlines sane-deadlines file not found"
+        exit 1
+fi
+
+now=$(date +%s)
+sort "$deadlines" | while read line; do
+        # parse line
+        deadline_field=$(echo "$line" | cut -f 1)
+        threshold_field=$(echo "$line" | cut -f 2)
+        description_field=$(echo "$line" | cut -f 3)
+
+        # normalize dates into seconds since unix epoch
+        deadline=$(date -d "$deadline_field" +%s)
+        threshold=$(echo "$threshold_field" | sed 's/d/day /g')
+        birthtime=$(date -d "$deadline_field - ($threshold)" +%s)
+
+        # show the event iff it's near
+        if test "$now" -ge "$birthtime"; then
+                days_until=$(( ($deadline - $now) / (24*60*60) ))
+                echo "in $days_until day(s): $description_field"
+        fi
+done