cross compilation: build webp-pixbuf-loader without emulation

```
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/28319deb5ab05458d9cd5c7d99e1a24ec2e8fc4b' (2023-02-15)
  → 'github:nixos/nixpkgs/ac1f5b72a9e95873d1de0233fddcb56f99884b37' (2023-02-16)
```

flake.lock

@@ -18,11 +18,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1674880620,
-        "narHash": "sha256-JMALuC7xcoH/T66sKTVLuItHfOJBCWsNKpE49Qrvs80=",
+        "lastModified": 1676240485,
+        "narHash": "sha256-bef1Zrfpo9cxaf19QhqfTwaagpeoNc08sc8OjYDjSnQ=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "7478a9ffad737486951186b66f6c5535dc5802e2",
+        "rev": "8701fcb1448f1eb67c0d47631ec2bdb613bd6a38",
         "type": "github"
       },
       "original": {
@@ -39,22 +39,22 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-FTUAvxSeQToawyfVP9/S2143D5EgCbk88qI2PePLQQ8=",
-        "path": "/nix/store/s9v0l913m4drrddglbjqa384nxxwhxca-source/nixpatches",
+        "narHash": "sha256-AJlQHunLsnhZ8LdYirwIcqD1iojYJEQAdxGfJn9siPs=",
+        "path": "/nix/store/7s2pgwqd5ch6n53mh2v8hw7d1zp1r654-source/nixpatches",
         "type": "path"
       },
       "original": {
-        "path": "/nix/store/s9v0l913m4drrddglbjqa384nxxwhxca-source/nixpatches",
+        "path": "/nix/store/7s2pgwqd5ch6n53mh2v8hw7d1zp1r654-source/nixpatches",
         "type": "path"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1675556398,
-        "narHash": "sha256-5Gf5KlmFXfIGVQb2hmiiE7FQHoLd4UtEhIolLQvNB/A=",
+        "lastModified": 1676162277,
+        "narHash": "sha256-GK3cnvKNo1l0skGYXXiLJ/TLqdKyIYXd7jOlo0gN+Qw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e32c33811815ca4a535a16faf1c83eeb4493145b",
+        "rev": "d863ca850a06d91365c01620dcac342574ecf46f",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1675942811,
-        "narHash": "sha256-/v4Z9mJmADTpXrdIlAjFa1e+gkpIIROR670UVDQFwIw=",
+        "lastModified": 1676569297,
+        "narHash": "sha256-2n4C4H3/U+3YbDrQB6xIw7AaLdFISCCFwOkcETAigqU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "724bfc0892363087709bd3a5a1666296759154b1",
+        "rev": "ac1f5b72a9e95873d1de0233fddcb56f99884b37",
         "type": "github"
       },
       "original": {
@@ -97,11 +97,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1675872570,
-        "narHash": "sha256-RPH3CeTv7ixC2WcYiKyhmIgoH/9tur4Kr+3Vg/pleQk=",
+        "lastModified": 1676171095,
+        "narHash": "sha256-2laeSjBAAJ9e/C3uTIPb287iX8qeVLtWiilw1uxqG+A=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8fec29b009c19538e68d5d814ec74e04f662fbd1",
+        "rev": "c5dab21d8706afc7ceb05c23d4244dcb48d6aade",
         "type": "github"
       },
       "original": {

flake.nix

@@ -67,7 +67,9 @@
           (nixosSystem {
             # we use pkgs built for and *by* the target, i.e. emulation, by default.
             # cross compilation only happens on explicit access to `pkgs.cross`
-            system = target;
+            # system = target;
+            # localSystem = local;
+            # crossSystem = target;
             modules = [
               (import ./hosts/instantiate.nix { localSystem = local; hostName = name; })
               self.nixosModules.default
@@ -78,6 +80,9 @@
                   self.overlays.passthru
                   self.overlays.pins
                 ];
+                # nixpkgs.crossSystem = target;
+                nixpkgs.hostPlatform = target;
+                nixpkgs.buildPlatform = local;
               }
             ];
           });

hosts/by-name/desko/default.nix

@@ -14,6 +14,8 @@
 
   sane.gui.sway.enable = true;
 
+  sane.programs.guiApps.suggestedPrograms = [ "desktopGuiApps" ];
+
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
@@ -47,7 +49,7 @@
   };
 
   programs.steam = {
-    enable = true;
+    # enable = true;
     # not sure if needed: stole this whole snippet from the wiki
     remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
     dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server

hosts/by-name/lappy/default.nix

@@ -15,6 +15,8 @@
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
+  sane.programs.guiApps.suggestedPrograms = [ "desktopGuiApps" ];
+
   sops.secrets.colin-passwd = {
     sopsFile = ../../../secrets/lappy.yaml;
     neededForUsers = true;

hosts/by-name/moby/kernel.nix

@@ -114,7 +114,7 @@ in
   # - phone rotation sensor is off by 90 degrees
   # - ambient light sensor causes screen brightness to be shakey
   # - phosh greeter may not appear after wake from sleep
-  boot.kernelPackages = pkgs.cross.linuxPackagesFor pkgs.cross.linux-megous;
+  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-megous;
 
   boot.kernelPatches = [
     (patchDefconfig (kernelConfig //

hosts/common/home/firefox.nix

@@ -132,7 +132,7 @@ in
         sidebery.package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
         sponsorblock.package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
         ublacklist.package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
-        ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-a/ivUmY1P6teq9x0dt4CbgHt+3kBsEMMXlOfZ5Hx7cg=";
+        ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-52lYqMjrS3GVTaybDrH1p6VF90YVkifguCGxobI/fNQ=";
 
         browserpass-extension.enable = lib.mkDefault true;
         # bypass-paywalls-clean.enable = lib.mkDefault true;

hosts/common/home/zsh/default.nix

@@ -83,6 +83,11 @@ in
         pushd "$1";
       }
 
+      expiration=$(date -d "6 Mar" +%s)
+      today=$(date +%s)
+      days_until=$(( ($expiration - $today) / (24*60*60) ))
+      echo "You have $days_until days to renew your driver's license"
+
       # auto-cd into any of these dirs by typing them and pressing 'enter':
       hash -d 3rd="/home/colin/dev/3rd"
       hash -d dev="/home/colin/dev"

hosts/common/programs.nix

@@ -4,11 +4,23 @@ let
   inherit (builtins) attrNames concatLists;
   inherit (lib) mapAttrs mapAttrsToList mkDefault mkMerge optional;
 
+  flattenedPkgs = pkgs // (with pkgs; {
+    # XXX can't `inherit` a nested attr, so we move them to the toplevel
+    "cacert.unbundled" = pkgs.cacert.unbundled;
+    "gnome.cheese" = gnome.cheese;
+    "gnome.dconf-editor" = gnome.dconf-editor;
+    "gnome.file-roller" = gnome.file-roller;
+    "gnome.gnome-disk-utility" = gnome.gnome-disk-utility;
+    "gnome.gnome-maps" = gnome.gnome-maps;
+    "gnome.nautilus" = gnome.nautilus;
+    "gnome.gnome-system-monitor" = gnome.gnome-system-monitor;
+    "gnome.gnome-terminal" = gnome.gnome-terminal;
+    "gnome.gnome-weather" = gnome.gnome-weather;
+    "libsForQt5.plasmatube" = libsForQt5.plasmatube;
+  });
+
   sysadminPkgs = {
-    inherit (pkgs // {
-      # XXX can't `inherit` a nested attr, so we move them to the toplevel
-      "cacert.unbundled" = pkgs.cacert.unbundled;
-    })
+    inherit (flattenedPkgs)
       btrfs-progs
       "cacert.unbundled"  # some services require unbundled /etc/ssl/certs
       cryptsetup
@@ -50,12 +62,16 @@ let
     ;
   };
 
+  # TODO: split these into smaller groups.
+  # - iphone utils (libimobiledevice, ifuse) only wanted on desko, maybe lappy
+  # - transcoders (ffmpeg, imagemagick) only wanted on desko/lappy
   consolePkgs = {
     inherit (pkgs)
-      backblaze-b2
+      aerc  # email client
+      # backblaze-b2  # TODO: put into the same package set as duplicity
       cdrtools
       dmidecode
-      duplicity
+      # duplicity  # TODO: enable as part of some smaller package set
       efivar
       flashrom
       fwupd
@@ -99,41 +115,22 @@ let
       visidata
       w3m
       wireguard-tools
+      xdg-utils  # for xdg-open
       # youtube-dl
       yt-dlp
     ;
   };
 
   guiPkgs = {
-    inherit (pkgs // (with pkgs; {
-      # XXX can't `inherit` a nested attr, so we move them to the toplevel
-      # TODO: could use some "flatten attrs" helper instead
-      "gnome.cheese" = gnome.cheese;
-      "gnome.dconf-editor" = gnome.dconf-editor;
-      "gnome.file-roller" = gnome.file-roller;
-      "gnome.gnome-disk-utility" = gnome.gnome-disk-utility;
-      "gnome.gnome-maps" = gnome.gnome-maps;
-      "gnome.nautilus" = gnome.nautilus;
-      "gnome.gnome-system-monitor" = gnome.gnome-system-monitor;
-      "gnome.gnome-terminal" = gnome.gnome-terminal;
-      "gnome.gnome-weather" = gnome.gnome-weather;
-      "libsForQt5.plasmatube" = libsForQt5.plasmatube;
-    }))
-      aerc  # email client
-      audacity
+    inherit (flattenedPkgs)
       celluloid  # mpv frontend
-      chromium
       clinfo
-      dino
-      electrum
-      element-desktop
       emote
       evince  # works on phosh
 
       # { pkg = fluffychat-moby; dir = [ ".local/share/chat.fluffy.fluffychat" ]; }  # TODO: ship normal fluffychat on non-moby?
 
-      foliate  # e-book reader
-      font-manager
+      # foliate  # e-book reader
 
       # XXX by default fractal stores its state in ~/.local/share/<UUID>.
       # after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
@@ -141,14 +138,11 @@ let
       # { pkg = fractal-latest; private = [ ".local/share/fractal" ]; }
       # { pkg = fractal-next; private = [ ".local/share/fractal" ]; }
 
-      gajim  # XMPP client
-      gimp  # broken on phosh
-      "gnome.cheese"
+      # "gnome.cheese"
       "gnome.dconf-editor"
       gnome-feeds  # RSS reader (with claimed mobile support)
       "gnome.file-roller"
-      "gnome.gnome-disk-utility"
-      "gnome.gnome-maps"  # works on phosh
+      # "gnome.gnome-maps"  # works on phosh
       "gnome.nautilus"
       # gnome-podcasts
       "gnome.gnome-system-monitor"
@@ -156,21 +150,15 @@ let
       "gnome.gnome-weather"
       gpodder-configured
       gthumb
-      inkscape
-      kdenlive
-      kid3  # audio tagging
-      krita
-      libreoffice-fresh  # XXX colin: maybe don't want this on mobile
-      lollypop
+      # lollypop
       mpv
       networkmanagerapplet
-      newsflash
+      # newsflash
       nheko
-      obsidian
       pavucontrol
       # picard  # music tagging
       playerctl
-      "libsForQt5.plasmatube"  # Youtube player
+      # "libsForQt5.plasmatube"  # Youtube player
       soundconverter
       # sublime music persists any downloaded albums here.
       # it doesn't obey a conventional ~/Music/{Artist}/{Album}/{Track} notation, so no symlinking
@@ -178,15 +166,33 @@ let
       #   possible to pass config as a CLI arg (sublime-music -c config.json)
       # { pkg = sublime-music; dir = [ ".local/share/sublime-music" ]; }
       sublime-music-mobile
-      tdesktop  # broken on phosh
-      tokodon
+      # tdesktop  # broken on phosh
+      # tokodon
       vlc
       # pleroma client (Electron). input is broken on phosh. TODO(2023/02/02): fix electron19 input (insecure)
       # whalebird
-      xdg-utils  # for xdg-open
       xterm  # broken on phosh
     ;
   };
+  desktopGuiPkgs = {
+    inherit (flattenedPkgs)
+      audacity
+      chromium
+      dino
+      electrum
+      element-desktop
+      font-manager
+      gajim  # XMPP client
+      gimp  # broken on phosh
+      "gnome.gnome-disk-utility"
+      inkscape
+      kdenlive
+      kid3  # audio tagging
+      krita
+      libreoffice-fresh  # XXX colin: maybe don't want this on mobile
+      obsidian
+    ;
+  };
   x86GuiPkgs = {
     inherit (pkgs)
       discord
@@ -221,6 +227,7 @@ in
       (declarePkgs sysadminPkgs)
       (declarePkgs consolePkgs)
       (declarePkgs guiPkgs)
+      (declarePkgs desktopGuiPkgs)
       (declarePkgs x86GuiPkgs)
       {
         # link the various package sets into their own meta packages
@@ -237,6 +244,10 @@ in
           suggestedPrograms = (attrNames guiPkgs)
             ++ optional (pkgs.system == "x86_64-linux") "x86GuiApps";
         };
+        desktopGuiApps = {
+          package = null;
+          suggestedPrograms = attrNames desktopGuiPkgs;
+        };
         x86GuiApps = {
           package = null;
           suggestedPrograms = attrNames x86GuiPkgs;

hosts/common/secrets.nix

@@ -99,18 +99,22 @@
     sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.psk.bin;
     format = "binary";
   };
-  sops.secrets."iwd/home-bedroom.psk" = {
-    sopsFile = ../../secrets/universal/net/home-bedroom.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/home-shared-24G.psk" = {
-    sopsFile = ../../secrets/universal/net/home-shared-24G.psk.bin;
-    format = "binary";
-  };
   sops.secrets."iwd/home-shared.psk" = {
     sopsFile = ../../secrets/universal/net/home-shared.psk.bin;
     format = "binary";
   };
+  sops.secrets."iwd/archive-2023-02-home-bedroom.psk" = {
+    sopsFile = ../../secrets/universal/net/archive/2023-02-home-bedroom.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/archive-2023-02-home-shared-24G.psk" = {
+    sopsFile = ../../secrets/universal/net/archive/2023-02-home-shared-24G.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/archive-2023-02-home-shared.psk" = {
+    sopsFile = ../../secrets/universal/net/archive/2023-02-home-shared.psk.bin;
+    format = "binary";
+  };
   sops.secrets."iwd/iphone" = {
     sopsFile = ../../secrets/universal/net/iphone.psk.bin;
     format = "binary";

hosts/instantiate.nix

@@ -15,13 +15,13 @@
 
   networking.hostName = hostName;
 
-  nixpkgs.overlays = [
-    (next: prev: {
-      # for local != target we by default just emulate the target while building.
-      # provide a `pkgs.cross.<pkg>` alias that consumers can use instead of `pkgs.<foo>`
-      # to explicitly opt into non-emulated cross compilation for any specific package.
-      # this is most beneficial for large packages with few pre-requisites -- like Linux.
-      cross = prev.crossFrom."${localSystem}";
-    })
-  ];
+  # nixpkgs.overlays = [
+  #   (next: prev: {
+  #     # for local != target we by default just emulate the target while building.
+  #     # provide a `pkgs.cross.<pkg>` alias that consumers can use instead of `pkgs.<foo>`
+  #     # to explicitly opt into non-emulated cross compilation for any specific package.
+  #     # this is most beneficial for large packages with few pre-requisites -- like Linux.
+  #     cross = prev.crossFrom."${localSystem}";
+  #   })
+  # ];
 }

hosts/modules/gui/phosh.nix

@@ -29,7 +29,7 @@ in
           # TODO: see about removing gnome-bluetooth if the in-built gnome-settings bluetooth manager can work
           "gnome.gnome-bluetooth"
           "phosh-mobile-settings"
-          "plasma5Packages.konsole"  # more reliable terminal
+          # "plasma5Packages.konsole"  # more reliable terminal
         ];
       };
     }
@@ -63,6 +63,28 @@ in
         };
       };
 
+      # phosh enables `services.gnome.{core-os-services, core-shell}`
+      # and this in turn enables some default apps we don't really care about.
+      # see <nixos/modules/services/x11/desktop-managers/gnome.nix>
+      environment.gnome.excludePackages = with pkgs; [
+        # gnome.gnome-menus  # unused outside gnome classic, but probably harmless
+        gnome-tour
+      ];
+      services.dleyna-renderer.enable = false;
+      services.dleyna-server.enable = false;
+      services.gnome.gnome-browser-connector.enable = false;
+      services.gnome.gnome-initial-setup.enable = false;
+      services.gnome.gnome-online-accounts.enable = false;
+      services.gnome.gnome-remote-desktop.enable = false;
+      services.gnome.gnome-user-share.enable = false;
+      services.gnome.rygel.enable = false;
+
+      # gnome doesn't use mkDefault for these -- unclear why not
+      services.gnome.evolution-data-server.enable = mkForce false;
+      services.gnome.gnome-online-miners.enable = mkForce false;
+      # TODO: re-enable this once we can cross-compile gvfs
+      services.gvfs.enable = mkForce false;
+
       # XXX: phosh enables networkmanager by default; can probably disable these lines
       networking.useDHCP = false;
       networking.networkmanager.enable = true;
@@ -85,6 +107,7 @@ in
       };
 
       programs.dconf.packages = [
+        # org.kde.konsole.desktop
         (pkgs.writeTextFile {
           name = "dconf-phosh-settings";
           destination = "/etc/dconf/db/site.d/00_phosh_settings";
@@ -97,7 +120,7 @@ in
             sleep-inactive-battery-timeout=5400
 
             [sm/puri/phosh]
-            favorites=['gpodder.desktop', 'nheko.desktop', 'sublime-music.desktop', 'firefox.desktop', 'org.kde.konsole.desktop']
+            favorites=['gpodder.desktop', 'nheko.desktop', 'sublime-music.desktop', 'firefox.desktop', 'org.gnome.Terminal.desktop']
           '';
         })
       ];

nixpatches/2023-01-25-signald-update.patch

@@ -1,78 +0,0 @@
-diff --git a/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch b/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
-index 1d9ca8d838d..d2cf9dd4315 100644
---- a/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
-+++ b/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
-@@ -11,25 +11,15 @@ diff --git a/build.gradle b/build.gradle
- index 799e782..caceaac 100644
- --- a/build.gradle
- +++ b/build.gradle
--@@ -83,6 +83,9 @@ static String getVersion() {
-- 
-- repositories {
--     maven {url "https://gitlab.com/api/v4/groups/6853927/-/packages/maven"} // https://gitlab.com/groups/signald/-/packages
--+    maven {
--+      url "https://plugins.gradle.org/m2/"
--+    }
--     mavenCentral()
-- }
-- 
--@@ -104,6 +107,8 @@ dependencies {
--     implementation 'io.prometheus:simpleclient_httpserver:0.16.0'
--     implementation 'com.squareup.okhttp3:logging-interceptor:4.9.3'
--     implementation 'io.sentry:sentry:6.4.0'
--+    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.1.0'
--+    implementation 'org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10'
--     testImplementation 'org.junit.jupiter:junit-jupiter:5.8.2'
-+@@ -87,7 +86,7 @@ repositories {
-  }
-  
-+ dependencies {
-+-    implementation 'org.signald:signal-service-java-' + getTarget() + ':2.15.3_unofficial_50_signald_1'
-++    implementation 'org.signald:signal-service-java-' + getTarget() + ':2.15.3_unofficial_50_signald_2'
-+     implementation 'org.bouncycastle:bcprov-jdk15on:1.70'
-+     implementation 'com.kohlschutter.junixsocket:junixsocket-common:2.6.1'
-+     implementation 'com.kohlschutter.junixsocket:junixsocket-native-common:2.6.1'
- @@ -171,4 +176,4 @@ allprojects {
-  runtime {
-      options = ['--strip-java-debug-attributes', '--compress', '2', '--no-header-files', '--no-man-pages']
-diff --git a/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch b/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
-index 96a7d6d2ef3..2f0f6e73159 100644
---- a/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
-+++ b/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
-@@ -47,15 +47,15 @@ index 799e782..6ecef3e 100644
-  }
-  
-  dependencies {
--@@ -104,6 +117,8 @@ dependencies {
--     implementation 'io.prometheus:simpleclient_httpserver:0.16.0'
--     implementation 'com.squareup.okhttp3:logging-interceptor:4.9.3'
--     implementation 'io.sentry:sentry:6.4.0'
--+    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.1.0'
--+    implementation 'org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10'
--     testImplementation 'org.junit.jupiter:junit-jupiter:5.8.2'
-+@@ -87,7 +86,7 @@ repositories {
-  }
-  
-+ dependencies {
-+-    implementation 'org.signald:signal-service-java-' + getTarget() + ':2.15.3_unofficial_50_signald_1'
-++    implementation 'org.signald:signal-service-java-' + getTarget() + ':2.15.3_unofficial_50_signald_2'
-+     implementation 'org.bouncycastle:bcprov-jdk15on:1.70'
-+     implementation 'com.kohlschutter.junixsocket:junixsocket-common:2.6.1'
-+     implementation 'com.kohlschutter.junixsocket:junixsocket-native-common:2.6.1'
- @@ -167,8 +182,3 @@ allprojects {
-          }
-      }
-diff --git a/pkgs/applications/networking/instant-messengers/signald/default.nix b/pkgs/applications/networking/instant-messengers/signald/default.nix
-index a9e023cdf63..8847707e137 100644
---- a/pkgs/applications/networking/instant-messengers/signald/default.nix
-+++ b/pkgs/applications/networking/instant-messengers/signald/default.nix
-@@ -54,8 +54,8 @@ let
-     outputHashMode = "recursive";
-     # Downloaded jars differ by platform
-     outputHash = {
--      x86_64-linux = "sha256-ANiNDdTuCuDEH5zUPsrVF6Uegdq3zVsMv+uMtYRX0jE=";
--      aarch64-linux = "sha256-V9zn4v/ZeLELAwFJ5y7OVAeJwZp4DmHm4KWxE6KpwGs=";
-+      x86_64-linux = "sha256-B2T8bM8xdob5507oS1CVO+sszEg9VWL8QKUEanIlXvk=";
-+      aarch64-linux = "sha256-I314eLUQP8HPbwc+10ZDKzcn9WsqLGuBtfoiCEYZRck=";
-     }.${stdenv.system} or (throw "Unsupported platform");
-   };

nixpatches/2023-01-30-mesa-cma-leak.patch

@@ -0,0 +1,22 @@
+diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
+index 56fa74e5c0c..3573bb0af49 100644
+--- a/pkgs/development/libraries/mesa/default.nix
++++ b/pkgs/development/libraries/mesa/default.nix
+@@ -88,7 +88,7 @@
+ let
+   # Release calendar: https://www.mesa3d.org/release-calendar.html
+   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
+-  version = "22.3.4";
++  version = "22.3.2";
+   branch  = lib.versions.major version;
+ 
+   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
+@@ -120,7 +120,7 @@ self = stdenv.mkDerivation {
+       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
+       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
+     ];
+-    sha256 = "37a1ddaf03f41919ee3c89c97cff41e87de96e00e9d3247959cc8279d8294593";
++    sha256 = "c15df758a8795f53e57f2a228eb4593c22b16dffd9b38f83901f76cd9533140b";
+   };
+ 
+   # TODO:

nixpatches/flake.lock

@@ -2,16 +2,15 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1673163619,
-        "narHash": "sha256-B33PFBL64ZgTWgMnhFL3jgheAN/DjHPsZ1Ih3z0VE5I=",
+        "lastModified": 1675123384,
+        "narHash": "sha256-RpU+kboEWlIYwbRMGIPBIcztH63CvmqWN1B8GpJogd4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c54d842d9544361aac5f5b212ba04e4089e8efe",
+        "rev": "e0fa1ece2f3929726c9b98c539ad14b63ae8e4fd",
         "type": "github"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-22.11",
         "type": "indirect"
       }
     },

nixpatches/list.nix

@@ -21,11 +21,19 @@
   #   hash = "sha256-PnPzvJymafa+zjkauQW0LzFsJC7S+7D9JRszTE3in+w=";
   # })
 
+  # (fetchpatch {
+  #   # stdenv: fix cc for pseudo-crosscompilation
+  #   # closed because it breaks pkgsStatic (as of 2023/02/12)
+  #   url = "https://github.com/NixOS/nixpkgs/pull/196497.diff";
+  #   hash = "sha256-eTwEbVULYjmOW7zUFcTUqvBZqUFjHTKFhvmU2m3XQeo=";
+  # })
+
   ./2022-12-19-i2p-aarch64.patch
 
-  # fix for <https://gitlab.com/signald/signald/-/issues/345>
-  # allows to actually run signald
-  ./2023-01-25-signald-update.patch
+  # fix for CMA memory leak in mesa: <https://gitlab.freedesktop.org/mesa/mesa/-/issues/8198>
+  # only necessary on aarch64.
+  # it's a revert of nixpkgs commit dcf630c172df2a9ecaa47c77f868211e61ae8e52
+  ./2023-01-30-mesa-cma-leak.patch
 
   # # kaiteki: init at 2022-09-03
   # vendorHash changes too frequently (might not be reproducible).

overlays/pins.nix

@@ -4,9 +4,97 @@
 # - if it's broken by that upstream builder, then pin it: somebody will come along and fix the package.
 # - otherwise, search github issues/PRs for knowledge of it before pinning.
 # - if nobody's said anything about it yet, probably want to root cause it or hold off on updating.
+#
+# note that these pins apply to *all* platforms:
+# - natively compiled packages
+# - cross compiled packages
+# - qemu-emulated packages
+
 (next: prev: {
   # XXX: when invoked outside our flake (e.g. via NIX_PATH) there is no `next.stable`,
   # so just forward the unstable packages.
   inherit (next.stable or prev)
   ;
+
+  ell = prev.ell.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # fixes "TEST FAILED in get_random_return_callback at unit/test-dbus-message-fds.c:278: !l_dbus_message_get_error(message, ((void *)0), ((void *)0))"
+    # unclear *why* this test fails.
+    doCheck = false;
+  });
+  gjs = prev.gjs.overrideAttrs (_upstream: {
+    # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
+    doCheck = false;
+  });
+  gssdp = prev.gssdp.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # fixes "ERROR:../tests/test-regression.c:429:test_ggo_7: assertion failed (error == NULL): Failed to set multicast interfaceProtocol not available (gssdp-error, 1)"
+    doCheck = false;
+  });
+  json-glib = prev.json-glib.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # fixes: "15/15 json-glib:docs / doc-check    TIMEOUT        30.52s   killed by signal 15 SIGTERM"
+    doCheck = false;
+  });
+  lapack-reference = prev.lapack-reference.overrideAttrs (_upstream: {
+    # 2023/02/11: test timeouts
+    # > The following tests FAILED:
+    # >       93 - LAPACK-xlintstz_ztest_in (Timeout)
+    # >        98 - LAPACK-xeigtstz_svd_in (Timeout)
+    # >          99 - LAPACK-xeigtstz_zec_in (Timeout)
+    doCheck = false;
+  });
+  libadwaita = prev.libadwaita.overrideAttrs (_upstream: {
+    # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
+    doCheck = false;
+  });
+  libsecret = prev.libsecret.overrideAttrs (_upstream: {
+    # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
+    doCheck = false;
+  });
+  libuv = prev.libuv.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # 2 tests fail:
+    # - not ok 261 - tcp_bind6_error_addrinuse
+    # - not ok 267 - tcp_bind_error_addrinuse_listen
+    doCheck = false;
+  });
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (py-next: py-prev: {
+      ipython = py-prev.ipython.overridePythonAttrs (upstream: {
+        # > FAILED IPython/core/tests/test_debugger.py::test_xmode_skip - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip_disabled - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip_with_breakpoint - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/core/tests/test_debugger.py::test_where_erase_value - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/terminal/tests/test_debug_magic.py::test_debug_magic_passes_through_generators - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        # > FAILED IPython/terminal/tests/test_embed.py::test_nest_embed - pexpect.exceptions.TIMEOUT: Timeout exceeded.
+        disabledTestPaths = upstream.disabledTestPaths or [] ++ [
+          "IPython/core/tests/test_debugger.py"
+          "IPython/terminal/tests/test_debug_magic.py"
+          "IPython/terminal/tests/test_embed.py"
+        ];
+      });
+      pytest-xdist = py-prev.pytest-xdist.overridePythonAttrs (upstream: {
+        # 2023/02/19
+        # 4 tests fail:
+        # - FAILED: testing/test_remote.py::TestWorkInteractor::* - execnet.gateway_base.TimeoutError: no item after 10.0 seconds
+        # doCheck = false;
+        disabledTestPaths = upstream.disabledTestPaths or [] ++ [
+          "testing/test_remote.py"
+        ];
+        # disabledTests = upstream.disabledTests or [] ++ [
+        #   "test_basic_collect_and_runtests"
+        #   "test_remote_collect_fail"
+        #   "test_remote_collect_skip"
+        #   "test_runtests_all"
+        # ];
+      });
+    })
+  ];
+  strp = prev.srtp.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # roc_driver test times out after 30s
+    doCheck = false;
+  });
 })

pkgs/gpodder-configured/default.nix

@@ -13,7 +13,7 @@ in
 (symlinkJoin {
   name = "gpodder-configured";
   paths = [ gpodder remove-extra ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # gpodder keeps all its feeds in a sqlite3 database.
   # we can configure the feeds externally by wrapping gpodder and just instructing it to import

secrets/universal/net/README.md

@@ -0,0 +1,5 @@
+## to add a new network
+- connect to it (via GUI or `iwctl` TUI)
+- find it under `/var/lib/iwd`
+- `sops ./<NETWORK_NICKNAME>.psk.bin` and paste the contents from `/var/lib/iwd/SSID.psk`
+        - in same file: add `# SSID=UNQUOTED_NETWORK_NAME` to the top

secrets/universal/net/archive/2023-02-home-shared.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:OaFr+OOaBxi0PaApOYLUjJ0NgD5ABBQOaf6KpR9rheE2d1pQNa0jqnD4/ttqJrq8JjZT2Y6GDSwM5gPM,iv:TuyQPPDXM8cJU/GhJpdvxwB8+v6JavHcA+vmLHA3/74=,tag:V6RTKw6Cot4B4sK1JcRGmA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNzNHZWcvTmVVaGFabUU3\ndnZwVFdVcFBXZkoxTFA5WEZMMnRvUDBsS1NrCnRKUTNDZExFL1drSjBTakw1VmZW\nYWJzTUtVN0lrWXdiRk9QaVNmZmRqSjAKLS0tIGtHTzNUUnlnU2duNDF6UUlzUUJa\nSXhxQmRXZEZKK2htenF6N1kzV1VvancKP8jZotJe9188kId6cwVzITNwtELegpzi\nOKrWPWuIveSdMGmMsRDAcQbL0xVN0qd+Y4qsZ9l6e+cVAT3cHb1vDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLemhLZUwzSVJLNUhYQXQ3\nY3ExU1BJUzY4a24vUjRmazhtc1RIcVpyem1jCmFEVzlIZkxjSUc0RTdqQWRLTGNS\nL3FaRFhjdnZqNFk0WDFSY0xOTENxMkEKLS0tIDVzK1lPM1FlWmZLZFA0ZDlPKzla\naXRqTk90aVNTRHlNZ2FmcVY3b1JKbEkKTu8tiEKyab1bOsgdsRlEWeG9wzdg/d/s\nPfh7rnvf7Ex8Jl6qSq6xMPkv+19EbSpfSq0FRtCue/Wcce3cUmGToA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyZUY4OW5UNXFjOXQrUklu\nK3poU3RNVnBtc251TmRtMGJ6Z0ordDFhUGhjCms2a1o1Z1plNlpwSlYrUEEzRDZm\naHdEVVIzRnExNVhzci8vN0ZIODh3QzgKLS0tIGUxZ2gvbGM3YnMwVXU1RnNOSlBO\nVE94UFdKaDkwbmV5YjlBWm9ZZkk4Q0UK6CaPAtRrXKUzR29ZfXV8MvqszTu8LkT2\nQPlNJ4ckgTyivyseukR8X5fPKrrXIVtE+C6Xk5mJ6nGKD+oLprhpag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUk1yL3dLUnBpNWNxMzQw\ncDdVa0szNjBVNnNXdmZwNVNEK1RwUzJTMlhZCm9oV3NaZ3k0SERKMEZCQTRtRUI2\nVmdzWndQT1c4UUh2MzQyMEErdm96NG8KLS0tIG1aUElzK2VjUTNYOGRpbkpZTDVz\ncG9jR0VzNi9jYmdCTU1qMmJtNFNUaU0KkrIx2BKjj7l+52Kk/L8rNZYAsa87z9UH\nDtxhLTnQu8DPtm5o2sbGdEZgt9qKPJiylLNKVne3EyscMaehdB17RA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSUtONWlzZ0JQbDB0L1FU\nWlhCL0p4d3lpamg3YWdIUVhDc1hVRWR1MVhFCkdZbEhnUG0vYTJVZnphdTZNSXBW\nVGdpemc5Q3hSenN4V09ZbTFOK3kzK0UKLS0tIG9ZWkdSMHhzTGJleFF5L2RsdUxK\nSEdtSlB0L2d4TTVWcDJWaE13NjFiTkkKWgfem58/ZKqVaXiL0UGVTjA7AhSkD8Fq\ne/i5HKN1Pvgv8TVPnZ9mtGP2gwwkoFYgxM8/0jBjJUm4QDbTkocVJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNR05jQnJZZDNndmZnOVNO\nRFhVU3pLUzBxeC9rQlRoVWFCN1Y0bjhBM25VCmJKSzhkMjF1L3pGRjZmOURNeUZE\nTU8vN2pYVmZzdWdpaVdqcXloNGhTSlUKLS0tIGovSG84amhyTFZHZ2FNdTl3SzJj\nN1dObkd6K2J0Y2Q5bG5DR0VaUk1uSlUKxShDW7BD6sENlFjqp7/wFbV4g4gD7u5d\npidF9F+vXhpoBIwLlhruzvwyNXG4hQcKfWCnliXhVvNYbgaooDDhRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MkJ1RkVBeHJnR1FGeDVi\nN0htdHZ3cVNCcTJabnlkSUQ4aHUxRndvbVhZClk2d2ZRTlJIVTg1T3dkKzdMRXJt\nNXh5OWtud3gvNWNkRWI1UE1kSytYOUUKLS0tIHhhQVpmRWtTYVFjSUN5aEVYWDJx\nS3hDMlFkVGQyM2U5QjlJMko4OGRWdkEKG98s0QVSs1o4MQ9937okXDS4WH41S1Aq\nUSL8idmlPUJzgdHshuLv2Ic2RXVjJu8V508trO8bTymrqkNAQ0miMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraXJQOHR6ZzE5TjNQYmpB\nSStEQS9mcUpMSXlFQ05DcllFSjNOT1pWdVJZCmtSL3FkZ2Q1cU1Fc1dZbG13eXJC\nTXJkN0NzWTlDOEFMRGNQUG5HQUNUVDgKLS0tIGRwcmVxS0lNQ09GdmxKY2pkQ2Yz\nSkpZam1ZQUN1L1FZZ010ZlhUV1N4VlkKqsFAE+xZ24IMzIFjbsgANdjiGwVZk5rq\n66y00bjw+uj6WOwQuE1I9WcYDhCXEUQB9u4Q+hzejaFzCJ90N/WF4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2023-01-07T03:06:02Z",
+		"mac": "ENC[AES256_GCM,data:L3wY2ZdR1ASbLbKXiipWfBiQ5cumItuiL1+TwTJhU5ZtxLe6SMUyhckvuX8hczlFPUlJQJDCwpgVBs9C6GRAU45jzHYmpcfF30auiRT2dF/2doH9yiYZoF7JtbTas0Kvt1yxlPfuTi5mFuJGAKDOw6+a5ayQHYlK3/RxAUn0yPc=,iv:U/vlmvI1l4u92eUDXRphS0tscLOlWorOdmT7wDwGbAM=,tag:bQayboRgsMKT6akDq+rzQw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-shared.psk.bin

@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:OaFr+OOaBxi0PaApOYLUjJ0NgD5ABBQOaf6KpR9rheE2d1pQNa0jqnD4/ttqJrq8JjZT2Y6GDSwM5gPM,iv:TuyQPPDXM8cJU/GhJpdvxwB8+v6JavHcA+vmLHA3/74=,tag:V6RTKw6Cot4B4sK1JcRGmA==,type:str]",
+	"data": "ENC[AES256_GCM,data:HB8H4esi1JeRDvcvcAm9WAqr5L3Tre0aWQ/erwKro6q960NYJMNO0xbUSbp/QBd/u5zjuR56a+Jjhw+SWtxdjtMW2Iu2yFScQBoVTggeL4i1p7q4/HO2F4EMW8Q3pSu9AAa5RbXzCkHHvpB+eceQQIAYjVUC+9lFuUvCpBTfcqomNsonqfPmyGCu2iiK4VYV5uH56kwJMhRQCY+KpWXpdCE2pr3u1ikWHmBY/5Gr8r5srPVbpsb0JJG8+puPPiQ98Fplev9+kfw4KJHbgZ7CoQbL8Lg5eFqEJag7cTO2AlBWcA/oMfn1mOAffMhLXSDHxoOei2Ty5NXKe5oooeRCBd2PNxWMCRz+uprdkIlW9CBxppaP4S4c5g0bcotLjm7P9ms9DNEgHi89Qgjlu7yIQVEP7mp15g/srgvodURrjEQSnNvLZhlLNuncO4TzWM/9HgC2M+wzSt2ypJRp8nAkWfw1IuZ9Oz9BO6zOvPhNUJy361EGdOXwC435zUAydZakBTrlNd/Rw5+WFiFfJdTFeOzeQvqyQy+WrNS0jg91tMw8oNDf1p1iJ0j6D0Br3DYSNK0TxfdUXGyDLUpVpQpbVvMBbvwozTinuLkQzmXuqqb74nd0aBon8g4BJJSeVHFl13/eFdNKfbLLvD/ubIdKtg==,iv:OtYRb1AfJLVyZ9rmnUoCkzXHtO6yk7RZFcmnZYvHLek=,tag:I2wMiheAxY/j1jG0Rhying==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -8,39 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNzNHZWcvTmVVaGFabUU3\ndnZwVFdVcFBXZkoxTFA5WEZMMnRvUDBsS1NrCnRKUTNDZExFL1drSjBTakw1VmZW\nYWJzTUtVN0lrWXdiRk9QaVNmZmRqSjAKLS0tIGtHTzNUUnlnU2duNDF6UUlzUUJa\nSXhxQmRXZEZKK2htenF6N1kzV1VvancKP8jZotJe9188kId6cwVzITNwtELegpzi\nOKrWPWuIveSdMGmMsRDAcQbL0xVN0qd+Y4qsZ9l6e+cVAT3cHb1vDg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRGdDWXc2eW5VYVkxbXJp\nSWE1VE8wdEZVK2x3MHdmeEk1dWZyU1Q1QUVvCjJCV05ZV3FZdjl5VkNvMGkreWt0\nZTVWY1FwV21mQlIrVFFIWVFjOWw0TkUKLS0tIGRNRWlEaTdMM1l5M3MramVtZ0dh\nelh6RVM5TTh0MENOamsxRng5SnVpU3MKRwrQBe1PSYidsYakba+53yy1DoJb3Ppq\nDBhsYOBrkdQrS/0yG1ojm+VonVdZfBo53lUb+eGhroibhbOLZytdaQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLemhLZUwzSVJLNUhYQXQ3\nY3ExU1BJUzY4a24vUjRmazhtc1RIcVpyem1jCmFEVzlIZkxjSUc0RTdqQWRLTGNS\nL3FaRFhjdnZqNFk0WDFSY0xOTENxMkEKLS0tIDVzK1lPM1FlWmZLZFA0ZDlPKzla\naXRqTk90aVNTRHlNZ2FmcVY3b1JKbEkKTu8tiEKyab1bOsgdsRlEWeG9wzdg/d/s\nPfh7rnvf7Ex8Jl6qSq6xMPkv+19EbSpfSq0FRtCue/Wcce3cUmGToA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZSXU2TnQyT2JtUDRKMVhZ\nclNtNHNEWTlXY2JNN2ZVcXY5OVlNcWhHNFNrCjJnTUlpaDVmcHo1NUJpUk5GMldz\nSzQ2QWhHN2VSeGlPSmtMSSt2TG1CN00KLS0tIGY0U3UzN0NwWE96b3kwUU9tbW5U\ncjhETWV0R3lJSHcydXQ1bTVOYnVHN2cKs35cc525DpaAnsNzDa/ooq53QSaquMxW\nvjI/+9I+q4MP+XrRTPNSl0YRyy7ZZyDQaGgj6ljOFEb66irMEotKGw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyZUY4OW5UNXFjOXQrUklu\nK3poU3RNVnBtc251TmRtMGJ6Z0ordDFhUGhjCms2a1o1Z1plNlpwSlYrUEEzRDZm\naHdEVVIzRnExNVhzci8vN0ZIODh3QzgKLS0tIGUxZ2gvbGM3YnMwVXU1RnNOSlBO\nVE94UFdKaDkwbmV5YjlBWm9ZZkk4Q0UK6CaPAtRrXKUzR29ZfXV8MvqszTu8LkT2\nQPlNJ4ckgTyivyseukR8X5fPKrrXIVtE+C6Xk5mJ6nGKD+oLprhpag==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVWZMU3RoTDNqc0ZtcDBQ\nUllueVdFRjJhRGQ0MG5oMjNVUmt3SDgxMHhRCk10cCtGMUdEMW8zVFMvckJ5aXF5\nRjB5eHE3K1lIeGNOWFVRQVA1SkRRbVkKLS0tIDZJRDNCOW9iZFBISDg1OWtWcWto\nV3VUSmtzUXdtQ2Zsa2F5eWVXUXFZUG8KsqIQV7vKqbC1LKbDHJzQCbKmBqKLWZrI\nyt/mK0jfpQGS4vucmitMoEMsACrV1vG8hLC1yrt+gHudZX9zvtVLSw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUk1yL3dLUnBpNWNxMzQw\ncDdVa0szNjBVNnNXdmZwNVNEK1RwUzJTMlhZCm9oV3NaZ3k0SERKMEZCQTRtRUI2\nVmdzWndQT1c4UUh2MzQyMEErdm96NG8KLS0tIG1aUElzK2VjUTNYOGRpbkpZTDVz\ncG9jR0VzNi9jYmdCTU1qMmJtNFNUaU0KkrIx2BKjj7l+52Kk/L8rNZYAsa87z9UH\nDtxhLTnQu8DPtm5o2sbGdEZgt9qKPJiylLNKVne3EyscMaehdB17RA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbi9kSnUvdDdlWVBBQXY5\ncy9DYjNBNlMxd2tXMHRDUjl2WFZTd3NySVRZClZJendtditxZVluQUNXM1VlS0tz\nSFBMQ1FHbks1VFgvM0ExQmw5SkYwZE0KLS0tIHUvVGkrV3VmZ2RodDhFMktYcTYv\nRGhxL1hQMDlPZHhXRTdRcnVnZjdxQ1EKFcSljMApXgz3sKoiBTstm9BErhlLL5HR\n7LTocTL1s2s0yLFHedNmbad4kRA3mTAywwNtfAEZ3vWx+WB4NOhS7A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSUtONWlzZ0JQbDB0L1FU\nWlhCL0p4d3lpamg3YWdIUVhDc1hVRWR1MVhFCkdZbEhnUG0vYTJVZnphdTZNSXBW\nVGdpemc5Q3hSenN4V09ZbTFOK3kzK0UKLS0tIG9ZWkdSMHhzTGJleFF5L2RsdUxK\nSEdtSlB0L2d4TTVWcDJWaE13NjFiTkkKWgfem58/ZKqVaXiL0UGVTjA7AhSkD8Fq\ne/i5HKN1Pvgv8TVPnZ9mtGP2gwwkoFYgxM8/0jBjJUm4QDbTkocVJw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUU5VenRYVTBQT0o0dFdz\nRHFjNGpRQ3VkaWF4a3p5ZitrY1JWTnVuckUwClFjZG96VVVDaWZPNnJaK0Q5VG83\nUkpGME5KQk1IL0tQendPSEwwZGptMVEKLS0tIHJDZTg2UFBJNytPL285cy8wcVFL\ncjRYZXVoamUwRVZwK3JnQUxhM3lEOVkK6obmbqk+5PNp1dflUb1l12hfat33JOFD\nFfr7iCU16nGeNYKqQ6VWXkPeRmr7xLi4FKHSgG0q/KFjlpEikBwD/g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNR05jQnJZZDNndmZnOVNO\nRFhVU3pLUzBxeC9rQlRoVWFCN1Y0bjhBM25VCmJKSzhkMjF1L3pGRjZmOURNeUZE\nTU8vN2pYVmZzdWdpaVdqcXloNGhTSlUKLS0tIGovSG84amhyTFZHZ2FNdTl3SzJj\nN1dObkd6K2J0Y2Q5bG5DR0VaUk1uSlUKxShDW7BD6sENlFjqp7/wFbV4g4gD7u5d\npidF9F+vXhpoBIwLlhruzvwyNXG4hQcKfWCnliXhVvNYbgaooDDhRw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaTZOdWtsWFRoVktXSjJF\nRHBQTVd3OXFBbkRJZzZiQXFIRlRrdFh0M2lFCnpmS1pxYzFvSmlZSTIrMTgvangy\nWDhySUdpUXExRnphazNBcjg0cktSN1EKLS0tIG03dTlqQ25EV0dRWHJvUy96TzRU\nRVFOL2ZZMmVLc1g5SGgrc2VHTlNMeGcKqy+ulNsanMLch1oMq/gSlPO0gy/NO6Gn\ndX1hAe4UPo05nxf58rEDd3ejXliU4ZEvk9p999nFcg85vTvyw9/K/A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MkJ1RkVBeHJnR1FGeDVi\nN0htdHZ3cVNCcTJabnlkSUQ4aHUxRndvbVhZClk2d2ZRTlJIVTg1T3dkKzdMRXJt\nNXh5OWtud3gvNWNkRWI1UE1kSytYOUUKLS0tIHhhQVpmRWtTYVFjSUN5aEVYWDJx\nS3hDMlFkVGQyM2U5QjlJMko4OGRWdkEKG98s0QVSs1o4MQ9937okXDS4WH41S1Aq\nUSL8idmlPUJzgdHshuLv2Ic2RXVjJu8V508trO8bTymrqkNAQ0miMA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYXYzVEJyYUs2a0s2aW84\neHZwbWhUSmpTbFg5c3RiV2N0OE05R21IeGhvClRzTDk1M1VPMFZpWlNPcEp3Q0tJ\nUjlWMHVBbUtiRmlwZUpKZWlPdHYxaWMKLS0tIDBVOUNxbW8yM1JJRk81QmdBOWp5\nL0xsL2U2VDdMR1YrWHpEQVNWU3YySG8KceuhQOvfHl3EDlxXbUT9PR0CAxP5+iDs\ngEBnRKpCfhq+Fr84fmlZmIBF9R5fmAn1Aq290U0ak3eHz+GWLlTgjA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraXJQOHR6ZzE5TjNQYmpB\nSStEQS9mcUpMSXlFQ05DcllFSjNOT1pWdVJZCmtSL3FkZ2Q1cU1Fc1dZbG13eXJC\nTXJkN0NzWTlDOEFMRGNQUG5HQUNUVDgKLS0tIGRwcmVxS0lNQ09GdmxKY2pkQ2Yz\nSkpZam1ZQUN1L1FZZ010ZlhUV1N4VlkKqsFAE+xZ24IMzIFjbsgANdjiGwVZk5rq\n66y00bjw+uj6WOwQuE1I9WcYDhCXEUQB9u4Q+hzejaFzCJ90N/WF4w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTU1tT2cvUEpQWnpOWE1x\nNXlENUgvckd1dzZHU21PbVprOUpnVVA1OHpnCjZjOFJBR3hRbHBlbkMrbUFNa0Fl\nNDVKZ0IxWkgyWUhvckQxaW5wbEIxWmsKLS0tIGxTdUVWcEh2K3g2NFFIb2FmZG5a\nOWkwRUtlMVpRMWFOb25QVWF1bU9QZzgKcjkcHLqSSncBsmaricXdAzSWeaKlgbmb\nMbU1lXSZymzmNiu7J1O4MsgWgZv8N/E1HTFqcRv2+wPz8FVDLPL0Fg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-01-07T03:06:02Z",
-		"mac": "ENC[AES256_GCM,data:L3wY2ZdR1ASbLbKXiipWfBiQ5cumItuiL1+TwTJhU5ZtxLe6SMUyhckvuX8hczlFPUlJQJDCwpgVBs9C6GRAU45jzHYmpcfF30auiRT2dF/2doH9yiYZoF7JtbTas0Kvt1yxlPfuTi5mFuJGAKDOw6+a5ayQHYlK3/RxAUn0yPc=,iv:U/vlmvI1l4u92eUDXRphS0tscLOlWorOdmT7wDwGbAM=,tag:bQayboRgsMKT6akDq+rzQw==,type:str]",
+		"lastmodified": "2023-02-15T01:53:52Z",
+		"mac": "ENC[AES256_GCM,data:C0zS4XzJ4HHaOZiZrZnd3fbdoEoMcWTQmJnyu0irYo9UGbXzs58EoHC1PJjoxdauD7zIby5DqW88Y9tzG0j5Wc8AveAHZ97XQs/9vHMBI2PeBrduUDVPZL7UwBxKSimaXcJLBylUvpO5/j1Ceg+/nf4lzD0OJksJP5B2MFWIH0A=,iv:DEiGZyvc0ugiJ9DHDNqkA6+D2r7PvTi5qsCzpvzxXdM=,tag:wFzeFvrrK8FqQ3LapHCB9Q==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"