cross compilation: simplify emulateBuilderQemu & use linux-megous as kernel when available

but it doesn't seem to be emulating child processes...

flake.lock

@@ -85,11 +85,11 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1691006197,
+        "lastModified": 1691654369,
-        "narHash": "sha256-DbtxVWPt+ZP5W0Usg7jAyTomIM//c3Jtfa59Ht7AV8s=",
+        "narHash": "sha256-gSILTEx1jRaJjwZxRlnu3ZwMn1FVNk80qlwiCX8kmpo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "66aedfd010204949cb225cf749be08cb13ce1813",
+        "rev": "ce5e4a6ef2e59d89a971bc434ca8ca222b9c7f5e",
         "type": "github"
       },
       "original": {

hosts/by-name/moby/default.nix

@@ -37,6 +37,7 @@
   ];
 
   sane.gui.sxmo.enable = true;
+  sane.services.eg25-manager.enable = true;
   sane.programs.guiApps.suggestedPrograms = [ "handheldGuiApps" ];
   # sane.programs.consoleUtils.enableFor.user.colin = false;
   # sane.programs.guiApps.enableFor.user.colin = false;
@@ -151,6 +152,13 @@
     #
     # NB: the above log is default level. though less specific, there's a `err` level message that also signals this:
     # sun4i-drm display-engine: failed to bind 1ee0000.hdmi (ops sun8i_dw_hdmi_ops [sun8i_drm_hdmi]): -17
+    # NB: this is the most common, but not the only, failure mode for `display-manager`.
+    # another error seems characterized by these dmesg logs, in which reprobing sun8i_drm_hdmi does not fix:
+    # ```syslog
+    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't get the MIPI D-PHY
+    # sun4i-drm display-engine: Couldn't bind all pipelines components
+    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't register our component
+    # ```
 
     if (${dmesg} --kernel --level err --color=never --notime | ${grep} -q 'sun4i-drm display-engine: failed to bind 1ee0000.hdmi')
     then

hosts/by-name/servo/fs.nix

@@ -2,6 +2,9 @@
 
 {
   sane.persist.root-on-tmpfs = true;
+  # increase /tmp space (defaults to 50% of RAM) for building large nix things.
+  # even the stock `nixpkgs.linux` consumes > 16 GB of tmp
+  fileSystems."/tmp".options = [ "size=32G" ];
 
   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/cc81cca0-3cc7-4d82-a00c-6243af3e7776";

hosts/modules/gui/default.nix

@@ -39,9 +39,9 @@
       "koreader"
       "lemoa"  # lemmy app
       # "lollypop"
+      "mate.engrampa"  # archive manager
       "mepo"  # maps viewer
       "mpv"
-      "nheko"
       # "networkmanagerapplet"
       # "newsflash"
       "pavucontrol"
@@ -72,7 +72,7 @@
       # "gajim"  # XMPP client
       "gimp"  # broken on phosh
       "gnome.dconf-editor"
-      "gnome.file-roller"
+      # "gnome.file-roller"
       "gnome.gnome-disk-utility"
       "gnome.nautilus"  # file browser
       # "gnome.totem"  # video player, supposedly supports UPnP
@@ -85,6 +85,7 @@
       "krita"
       "libreoffice"  # TODO: replace with an office suite that uses saner packaging?
       "mumble"
+      "nheko"
       "obsidian"
       "slic3r"
       "steam"

modules/programs.nix

@@ -231,6 +231,7 @@ in
           (lib.mapAttrs' (pkgName: _pkg: { name = "cacert.${pkgName}"; value = {}; }) pkgs.cacert)
           (lib.mapAttrs' (pkgName: _pkg: { name = "gnome.${pkgName}"; value = {}; }) pkgs.gnome)
           (lib.mapAttrs' (pkgName: _pkg: { name = "libsForQt5.${pkgName}"; value = {}; }) pkgs.libsForQt5)
+          (lib.mapAttrs' (pkgName: _pkg: { name = "mate.${pkgName}"; value = {}; }) pkgs.mate)
           (lib.mapAttrs' (pkgName: _pkg: { name = "plasma5Packages.${pkgName}"; value = {}; }) pkgs.plasma5Packages)
           (lib.mapAttrs' (pkgName: _pkg: { name = "python3Packages.${pkgName}"; value = {}; }) pkgs.python3Packages)
           (lib.mapAttrs' (pkgName: _pkg: { name = "sane-scripts.${pkgName}"; value = {}; }) pkgs.sane-scripts)

modules/services/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./dyn-dns.nix
+    ./eg25-manager.nix
     ./kiwix-serve.nix
     ./mautrix-signal.nix
     ./nixserve.nix

modules/services/eg25-manager.nix

@@ -0,0 +1,19 @@
+# eg25-manager: <https://gitlab.com/mobian1/eg25-manager>
+# - used by sxmo, in <configs/default_hooks/sxmo_hook_restart_modem_daemons.sh>
+# - requires modemmanager (ModemManager.service)
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.services.eg25-manager;
+in
+{
+  options.sane.services.eg25-manager = {
+    enable = lib.mkEnableOption "Quectel EG25 modem manager service";
+  };
+  config = lib.mkIf cfg.enable {
+    # eg25-manager package ships udev rules *and* a systemd service.
+    # for that reason, i think it needs to be on the system path for the systemd service to be enabled.
+    systemd.packages = [ pkgs.eg25-manager ];
+    services.udev.packages = [ pkgs.eg25-manager ];
+    systemd.services.eg25-manager.wantedBy = [ "multi-user.target" ];
+  };
+}

nixpatches/list.nix

@@ -144,12 +144,52 @@ in [
   #   hash = "sha256-MNG8C0OgdPnFQ8SF2loiEhXJuP2z4n9pkXr8Zh4X7QU=";
   # })
 
+  # 2023-08-06: conky wayland + cross compilation patches.
+  # nix path-info shows clean
+  # branch is wip-conky-cross2 on servo
+  # factoring out those feature abstractions was possibly overkill.
+  # the manual wayland-scanner patching is unfortunate, but within
+  #   acceptable norms of the existing package.
   (fetchpatch' {
-    title = "conky: support wayland";
+    title = "conky: factor out an abstraction for feature flags";
-    # saneCommit = "82978099c3a0d5fb4925351da1b0e2598503dc6c";
+    saneCommit = "3ddf13038d6df90ad0db36a41d55e4077818a3e9";
-    # hash = "sha256-lnDGEDhmeOIXfFnizEIVUiUzI7nMvpoCERbdjhR+Bto=";
+    hash = "sha256-CjLzndFEH1Ng9CqKX8gxCJ6n/wFv5U/sHnQE0FMYILc=";
-    saneCommit = "3ad928e20b498444e3a106b182e09317cea9a11f";
+  })
-    hash = "sha256-lvIASvQWVFbjHsQwO2EhEBUTSq1UkHvriaZZ2iS0ulU=";
+  (fetchpatch' {
+    title = "conky: simplify the features even more";
+    saneCommit = "1c4aa404743f1ae7d5b95f18a96c4057ca251a96";
+    hash = "sha256-0zhiw9siIkFgFW4sow+X88NBEa3ggCe1t1HJ5xFH4ac=";
+  })
+  (fetchpatch' {
+    title = "conky: support cross compilation";
+    saneCommit = "01e607e11c7e5bbbfe6ad132fb72394ec29dab0a";
+    hash = "sha256-Bm/XFLvE7gEyLPlBWNSAcU3qwwqKLIRdpoe0/1aHUho=";
+  })
+  (fetchpatch' {
+    title = "conky: add wayland support";
+    saneCommit = "84c51f67e02ebc7f118fd3171bd10f1978d4f1e6";
+    hash = "sha256-gRYbkzCe3q1R7X/FeOcz/haURQkeAfmED1/ZQlCCdWE=";
+  })
+  (fetchpatch' {
+    title = "conky: remove no-op sed patch";
+    saneCommit = "e8b19984a2858ca24b7e8f5acd20be8b7dfe1af0";
+    hash = "sha256-K3mG1kcyB7sQZ7ZRCdlinNsV6mCcl3eIUI2ldSmcbJE=";
+  })
+
+  # (fetchpatch' {
+  #   title = "gtk3: compile schemas even when cross compiling";
+  #   saneCommit = "5ee69670071f583bdffe2718dc46763fa1698f92";
+  #   hash = "sha256-ZX3lY63qUW2XuwCoxffbLYoFxckDImKy+S8mqlYJcvk=";
+  # })
+  # (fetchpatch' {
+  #   title = "gtk4: compile schemas even when cross compiling";
+  #   saneCommit = "7a1c5e3a5d1ff82c8afa659c7f903d5309d5de6a";
+  #   hash = "sha256-Tz8NBcIqGE9rCqbOrixgbvApYDEAHWCg4lZbklL/xXc=";
+  # })
+  (fetchpatch' {
+    title = "gtk{3,4}: compile schemas even when cross compiling";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/247844";
+    hash = "sha256-1CsjLgMvX0Lx500UDzal5HZi78hb7zBcb+AlNPF6NvA=";
   })
 
   # (fetchpatch' {
@@ -171,7 +211,7 @@ in [
     # includes hare-json and hare-ev as pre-reqs
     title = "bonsai: init at 1.0.0";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/233892";
-    hash = "sha256-f7tdHz0lFsSJO8C0saMuG8e7VzSx8XDy/UXjbqWHP9M=";
+    hash = "sha256-HaTr7GBCfK1I2e7K4k2dUGZ6hZf4PwtEFobLaSz262M=";
   })
 
   # make alsa-project members overridable
@@ -200,13 +240,12 @@ in [
     hash = "sha256-38sND/UNRj5WAYYKpzdrRBIOK4UAT14RzbIv49KmNNw=";
   })
 
-  (fetchpatch' {
+  # (fetchpatch' {
-    # TODO: send this upstream!
+  #   title = "mepo: 1.1 -> 1.1.2";
-    title = "mepo: 1.1 -> 1.1.2";
+  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/247866";
-    saneCommit = "eee68d7146a6cd985481cdd8bca52ffb204de423";
+  #   saneCommit = "eee68d7146a6cd985481cdd8bca52ffb204de423";
-    hash = "sha256-uNerTwyFzivTU+o9bEKmNMFceOmy2AKONfKJWI5qkzo=";
+  #   hash = "sha256-uNerTwyFzivTU+o9bEKmNMFceOmy2AKONfKJWI5qkzo=";
-  })
+  # })
-
 
   (fetchpatch' {
     title = "gthumb: make the webservices feature be optional";
@@ -221,23 +260,6 @@ in [
     hash = "sha256-rD0es4uUbaLMrI9ZB2HzPmRLyu/ixNBLAFyDJtFHNko=";
   })
 
-  (fetchpatch' {
-    title = "p11-kit: build with meson";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/244633";
-    hash = "sha256-+z6hosSyt6ynLpUKS0TsHRoLOS8ck/SK9Y7W2zVUnCQ=";
-  })
-  (fetchpatch' {
-    title = "p11-kit: use mesonEmulatorHook for cross compilation";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/245124";
-    hash = "sha256-8NqqLBbjt1fLj4ZYhat7wPqQSv/aez9IwgSK2b4CfW8=";
-  })
-
-  (fetchpatch' {
-    title = "python310Packages.gssapi: support cross compilation";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/247048";
-    saneCommit = "4766ae46f863734fbe96dc4e537870b6b3894cf4";
-    hash = "sha256-7JZqAlcNFP6orJZCEqe5eodVxTUHeSLGyniRvw/+PuQ=";
-  })
   # (fetchpatch' {
   #   title = "perlPackages.FileBaseDir: 0.08 -> 0.09";
   #   saneCommit = "acc990b04bbe8c99587eadccc65f100c326ec204";
@@ -252,7 +274,7 @@ in [
     title = "xdg-utils: enable cross compilation";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/246954";
     saneCommit = "b7aa5e0c1ec06723cf1594de192703a65be21497";
-    hash = "sha256-jA84RKt4nOEZsBlACaqa0GeBiDdFOBYARgAq4NgTqtY=";
+    hash = "sha256-5iYzyjVlye7mhwhlZOHucVod/aPT3OrXolC9jAnB544=";
   })
   # (fetchpatch' {
   #   # N.B.: duplicates outstanding, merged PR: <https://github.com/NixOS/nixpkgs/pull/246362>
@@ -265,8 +287,7 @@ in [
     title = "gupnp: fix cross compilation";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/246931";
     saneCommit = "3af24c9e517689d048bb62511c6e8acf9bc55684";
-    # hash = "sha256-6yl6I/zOcUe0TDKEi/vjEzyU4OWoGi0PMht3VOKWmQo=";
+    hash = "sha256-I/+ArctOngrxacaMk82GODaodwSzmy+rh6q0J6KjMwA=";
-    hash = "sha256-NYA72+liKZXnUoAGor3MR62YmZNsNPJ3SEfWGhpeiY4=";
   })
   (fetchpatch' {
     title = "blueman: support cross compilation";
@@ -284,25 +305,6 @@ in [
     saneCommit = "24b062309ea8baa2d8303c0610c9ec7b8c399e8b";
     hash = "sha256-Jj+1z2DeCEY+DqI1J4vYjYJwDDMRcA93CqpZSXzG0wE=";
   })
-  (fetchpatch' {
-    # alternate fix for upower; Arturrin
-    title = "upower: Fix cross";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/247031";
-    hash = "sha256-Skn1dO+SDXbrWYWn8QpSBzYaTis/KUXLEY+pJxO9pWM=";
-  })
-  # (fetchpatch' {
-  #   # PR also includes the nativeBuildInputs fix
-  #   title = "upower: fix cross compilation";
-  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/246945";
-  #   saneCommit = "3ab262456acc016c8dc834df1d1f7e61a00e01e3";
-  #   # hash = "sha256-kTFZVu9oDiYH4W4SoQQj0pNuo9hTJk6jUy+hy34HUtA=";
-  #   hash = "sha256-PpC9YRMqg/wPfFgAPNV80mwbZWCKxNi4agxNf0yQutI=";
-  # })
-  # (fetchpatch' {
-  #   title = "upower: don't pass unnecessary nativeBuildInputs";
-  #   saneCommit = "e2cbfb1bc81afadc5d31c18d43e774fa9a985f98";
-  #   hash = "sha256-7Q9Fjp7xrw3e887inc5cc01OvuOhThnVYduSLNtv2d0=";
-  # })
   (fetchpatch' {
     title = "iio-sensor-proxy: support cross compilation";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/246947";
@@ -317,13 +319,6 @@ in [
     # hash = "sha256-MB3qloOW4pXZmbCIVsUKP2DnPoePmBf+qRc2x/o+nDw=";
     hash = "sha256-uMbnfO0WY2/AFpvvnHQGKVSTE2rPrm3SCef4f04Bt78=";
   })
-  (fetchpatch' {
-    title = "wvkbd: support cross compilation";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/247083";
-    saneCommit = "34379f5770662b483ab0cbe252cf23dd663d84dc";
-    # hash = "sha256-Duim5hPBtfGePBte29ZUtojyRAts9lQlbleUsTJNkwI=";
-    hash = "sha256-aC7zEM4pV4YXh5X0m2nYAkH0vLgVTNq8bgIP8CLZy4I=";
-  })
   (fetchpatch' {
     title = "clapper: support cross compilation";
     saneCommit = "8a171b49aca406f8220f016e56964b3fae53a3df";
@@ -367,6 +362,13 @@ in [
     hash = "sha256-PDCp4GOm6hWcRob4kz7qXZfxAF6YbYrESx9idoS3e/s=";
   })
 
+  (fetchpatch' {
+    title = "mate.engrampa: support cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/247841";
+    saneCommit = "3c76cdaf837f48861e4c3347b480c9a18b5b4a72";
+    hash = "sha256-rT0CBTOFxHQAvxqjWeNRJ2jenDuNRSo+gVDoPFKzHSM=";
+  })
+
   (fetchpatch' {
     title = "dtrx: 8.5.1 -> 8.5.3";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/246282";

overlays/cross.nix

@@ -67,43 +67,194 @@ let
   };
   emulated = mkEmulated final prev;
 
-  emulateBuilder = pkg: let
+  # linuxMinimal = final.linux.override {
-    # create a derivation would could be realized by the host system -- only.
+  #   # customize stock linux to compile using less RAM
-    binfmtDeriv = pkg.override {
+  #   # default config is in:
-      inherit (emulated) stdenv;
+  #   # - <pkgs/os-specific/linux/kernel/common-config.nix>
+  #   structuredExtraConfig = with lib.kernel; {
+  #     # recommended by: <https://nixos.wiki/wiki/Linux_kernel#Too_high_ram_usage>
+  #     DEBUG_INFO_BTF = lib.mkForce no;
+
+  #     # other debug-related things i can probably disable
+  #     CC_OPTIMIZE_FOR_SIZE = lib.mkForce yes;
+  #     DEBUG_INFO = lib.mkForce no;
+  #     DEBUG_KERNEL = lib.mkForce no;
+  #     GDB_SCRIPTS = lib.mkForce no;
+  #     SCHED_DEBUG = lib.mkForce no;
+  #     SUNRPC_DEBUG = lib.mkForce no;
+
+  #     # disable un-needed features
+  #     BT = no;
+  #     CAN = no;
+  #     DRM = no;  # uses a lot of space when compiling
+  #     FPGA = no;
+  #     GNSS = no;
+  #     IIO = no;  # 500 MB
+  #     INPUT_TOUCHSCREEN = no;
+  #     MEDIA_SDR_SUPPORT = no;
+  #     NFC = no;
+  #     SND = no;  # also uses a lot of disk space when compiling
+  #     SOUND = no;
+  #     # WWAN = no;  # 1.4 GB (drivers/net/wireless)  (but WWAN=no doesn't actually disable that?)
+
+  #     # we could try disabling these, but i wonder if anything relies on them (e.g. autoconf)
+  #     # FONTS = lib.mkForce no;
+  #     # FB = lib.mkForce no;
+  #     # WAN = lib.mkForce no;
+  #     # INET = no;
+  #     # MEMTEST = lib.mkForce no;
+  #     # # NET = lib.mkForce no;  # we need net (9pnet_virtio; unix) for sharing fs with the build machine
+  #     MEDIA_ANALOG_TV_SUPPORT = lib.mkForce no;
+  #     MEDIA_CAMERA_SUPPORT = lib.mkForce no;
+  #     MEDIA_DIGITAL_TV_SUPPORT = lib.mkForce no;  # 150 MB disk space when compiling
+  #     MICROCODE = lib.mkForce no;
+  #     STAGING = lib.mkForce no;  # 450 MB disk space when compiling
+
+  #     RTC_DRV_CMOS = yes;  # something in the above config changes disabled this...
+  #   };
+  # };
+  # given a package that's defined for build == host,
+  # build it from the native build machine by emulating the builder.
+  emulateBuilderQemu = pkg: let
+    vmTools = final.vmTools.override {
+      kernel = final.linux-megous or final.linux;  #< HACK: guess at whatever deployed linux we're using, to avoid building two kernels
     };
     # fix up the nixpkgs command that runs a Linux OS inside QEMU:
     # qemu_kvm doesn't support x86_64 -> aarch64; but full qemu package does.
     qemuCommandLinux = lib.replaceStrings
       [ "${final.buildPackages.qemu_kvm}" ]
       [ "${final.buildPackages.qemu}" ]
-      final.vmTools.qemuCommandLinux;
+      vmTools.qemuCommandLinux;
+    vmRunCommand = final.buildPackages.vmTools.vmRunCommand qemuCommandLinux;
   in
-    # to use binfmt emulation, just return the derivation with emulated stdenv as usual:
-    # binfmtDeriv
-    #
     # without binfmt emulation, leverage the `vmTools.runInLinuxVM` infrastructure:
-    # final.vmTools.runInLinuxVM pkg
+    # final.buildPackages.vmTools.runInLinuxVM pkg
     #
-    # except `runInLinuxVM` doesn't seem to support cross compilation (what's its purpose, then?)
+    # except `runInLinuxVM` doesn't quite work OOTB (see above),
-    # so hack its components into something which *does* handle cross compilation
+    # so hack its components into something which *does* work.
-    lib.overrideDerivation binfmtDeriv ({ builder, args, ... }: {
+    lib.overrideDerivation pkg ({ builder, args, ... }: {
       builder = "${final.buildPackages.bash}/bin/sh";
-      args = ["-e" (final.buildPackages.vmTools.vmRunCommand qemuCommandLinux)];
+      args = [ "-e" vmRunCommand ];
       # orig{Builder,Args} gets used by the vmRunCommand script:
       origBuilder = builder;
       origArgs = args;
 
-      QEMU_OPTS = "-m 4096";  # MiB of RAM
+      QEMU_OPTS = "-m 16384";  # MiB of RAM
       enableParallelBuilding = true;
 
       # finally, let nix know that this package should be built by the build system
       system = final.stdenv.buildPlatform.system;
-    })
+    }) // {
-    # alternatively, `proot` could let us get per-package binfmt:
+      override = attrs: emulateBuilderQemu (pkg.override attrs);
-    # - <https://proot-me.github.io/>
+      overrideAttrs = mergeFn: emulateBuilderQemu (pkg.overrideAttrs mergeFn);
-    # - i.e., execute host programs *and* build programs, mixed
+    }
   ;
+
+  # given a package that's defined for build == host,
+  # build it from a "proot": a chroot-like environment where `exec` is hooked to invoke qemu instead.
+  # this is like binfmt, but configured to run *only* the emulated host and not the build machine
+  # see: <https://proot-me.github.io/>
+  # hinted at by: <https://www.tweag.io/blog/2022-03-31-running-wasm-native-hybrid-code/>
+  emulateBuilderProot = pkg:
+    lib.overrideDerivation pkg ({ builder, args, ... }: {
+      builder = "${final.buildPackages.bash}/bin/sh";
+      args = [ "-e" prootBuilder ];
+      origBuilder = builder;
+      origArgs = args;
+
+      enableParallelBuilding = true;  # TODO: inherit from `pkg`?
+      NIX_DEBUG = "6";
+
+      # finally, let nix know that this package should be built by the build system
+      system = final.stdenv.buildPlatform.system;
+    }) // {
+      override = attrs: emulateBuilderProot (pkg.override attrs);
+      overrideAttrs = mergeFn: emulateBuilderProot (pkg.overrideAttrs mergeFn);
+    };
+
+  prootBuilder = let
+    proot = "${final.buildPackages.proot}/bin/proot";
+    # prootFlags = "-r / -b /:/";
+    prootFlags = "-b /nix:/nix -b /tmp:/tmp";
+    # prootFlags = "-b /:/ -b ${final.bash}/bin/sh:/bin/sh";  # --mixed-mode false
+    qemu = "${final.buildPackages.qemu}/bin/qemu-aarch64";
+  in
+    final.pkgs.writeText "proot-run" ''
+      echo "proot: ${proot} -q ${qemu} ${prootFlags} $origBuilder $origArgs"
+      ${proot} -q ${qemu} ${prootFlags} $origBuilder $origArgs
+      echo "exited proot"
+    '';
+
+  emulateBuilderBinfmt = pkg:
+    lib.overrideDerivation pkg ({ builder, args, ...}: {
+      builder = "${final.buildPackages.bash}/bin/sh";
+      args = [ "-e" binfmtBuilder ];
+      origBuilder = builder;
+      origArgs = args;
+
+      # finally, let nix know that this package should be built by the build system
+      system = final.stdenv.buildPlatform.system;
+    }) // {
+      override = attrs: emulateBuilderBinfmt (pkg.override attrs);
+      overrideAttrs = mergeFn: emulateBuilderBinfmt (pkg.overrideAttrs mergeFn);
+    };
+
+  binfmtBuilder = let
+    sudo = "${final.buildPackages.sudo}/bin/sudo";
+    mount = "${final.buildPackages.util-linux.mount}/bin/mount";
+  in
+    final.pkgs.writeText "binfmt-run" ''
+      echo "binfmtBuilder: mounting binfmt_misc"
+      ${sudo} ${mount} binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc
+      echo "binfmtBuilder: running $origBuilder $origArgs"
+      $origBuilder $origArgs
+    '';
+
+  # given a package defined for build != host, transform it to build on the host.
+  # i.e. build using the host's stdenv.
+  buildOnHost =
+    let
+      # patch packages which can't ordinarily exist in buildPackages
+      preFixPkg = p:
+        if p.name or null == "make-shell-wrapper-hook" then
+          p.overrideAttrs (_: {
+            # unconditionally use the outermost targetPackages shell
+            shell = final.runtimeShell;
+          })
+          # p.__spliced.buildBuild.overrideAttrs (_: {
+          #   shell = "TODO"; # final.targetPackages.runtimeShell;
+          # })
+          # final.makeBinaryWrapper
+        else
+          p
+        ;
+      unsplicePkg = p: p.__spliced.hostTarget or p;
+      unsplicePkgs = ps: map (p: unsplicePkg (preFixPkg p)) ps;
+    in
+      pkg: (pkg.override {
+        inherit (emulated) stdenv;
+      }).overrideAttrs (upstream: {
+        # for this purpose, the naming in `depsAB` is "inputs build for A, used to create packages in B" (i think).
+        # when cross compiling x86_64 -> aarch64, most packages are
+        # - build: x86_64
+        # - target: aarch64
+        # - host: aarch64
+        # so, we only need to replace the build packages with alternates.
+        depsBuildBuild = unsplicePkgs (upstream.depsBuildBuild or []);
+        nativeBuildInputs = unsplicePkgs (upstream.nativeBuildInputs or []);
+        depsBuildTarget = unsplicePkgs (upstream.depsBuildTarget or []);
+
+        depsBuildBuildPropagated = unsplicePkgs (upstream.depsBuildBuildPropagated or []);
+        propagatedNativeBuildInputs = unsplicePkgs (upstream.propagatedNativeBuildInputs or []);
+        depsBuildTargetPropagated = unsplicePkgs (upstream.depsBuildTargetPropagated or []);
+
+        nativeCheckInputs = unsplicePkgs (upstream.nativeCheckInputs or []);
+        nativeInstallCheckInputs = unsplicePkgs (upstream.nativeInstallCheckInputs or []);
+      });
+
+  buildInQemu = pkg: emulateBuilderQemu (buildOnHost pkg);
+  buildInProot = pkg: emulateBuilderProot (buildOnHost pkg);
+  buildInBinfmt = pkg: emulateBuilderBinfmt (buildOnHost pkg);
 in {
   inherit emulated;
 
@@ -202,14 +353,14 @@ in {
   #   # configure: error: ifconfig or ip not found, install net-tools or iproute2
   #   nativeBuildInputs = orig.nativeBuildInputs ++ [ final.iproute2 ];
   # });
-  bonsai = emulateBuilder (prev.bonsai.override {
+  # bonsai = emulateBuildMachine (prev.bonsai.override {
-    hare = emulateBuilder (final.hare.override {
+  #   hare = emulateBuildMachine (final.hare.override {
-      qbe = emulateBuilder final.qbe;
+  #     qbe = emulateBuildMachine final.qbe;
-      harePackages.harec = emulateBuilder (final.harePackages.harec.override {
+  #     harePackages.harec = emulateBuildMachine (final.harePackages.harec.override {
-        qbe = emulateBuilder final.qbe;
+  #       qbe = emulateBuildMachine final.qbe;
-      });
+  #     });
-    });
+  #   });
-  });
+  # });
   # bonsai = prev.bonsai.override {
   #   inherit (emulated) stdenv hare;
   # };
@@ -254,12 +405,23 @@ in {
     ];
   });
 
-  conky = ((useEmulatedStdenv prev.conky).override {
+  # conky = ((useEmulatedStdenv prev.conky).override {
-    # docbook2x dependency doesn't cross compile
+  #   # docbook2x dependency doesn't cross compile
-    docsSupport = prev.stdenv.buildPlatform.canExecute prev.stdenv.hostPlatform;
+  #   docsSupport = prev.stdenv.buildPlatform.canExecute prev.stdenv.hostPlatform;
-  }).overrideAttrs (upstream: {
+  # }).overrideAttrs (upstream: {
-    nativeBuildInputs = upstream.nativeBuildInputs ++ [ final.git ];
+  #   nativeBuildInputs = upstream.nativeBuildInputs ++ [ final.git ];
-  });
+  # });
+  # conky = (prev.conky.override {
+  #   # docbook2x dependency doesn't cross compile
+  #   docsSupport = prev.stdenv.buildPlatform.canExecute prev.stdenv.hostPlatform;
+  # }).overrideAttrs (upstream: {
+  #   nativeBuildInputs = upstream.nativeBuildInputs ++ [
+  #     # "Unable to find program 'git'"
+  #     final.git
+  #     # "bash: line 1: toluapp: command not found"
+  #     final.toluapp
+  #   ];
+  # });
 
   # cozy = prev.cozy.override {
   #   cozy = prev.cozy.upstream.cozy.override {
@@ -302,8 +464,31 @@ in {
   firefox-extensions = prev.firefox-extensions.overrideScope' (self: super: {
     unwrapped = super.unwrapped // {
       browserpass-extension = super.unwrapped.browserpass-extension.override {
-        # bash: line 1: node_modules/.bin/prettier: cannot execute: required file not found
+        # this overlay is optional for binfmt machines, but non-binfmt can't cross-compile the modules (for use at runtime)
-        inherit (emulated) mkYarnModules;
+        mkYarnModules = args: buildInQemu {
+          override = { stdenv }: (
+            (final.yarn2nix-moretea.override {
+              pkgs = final.pkgs.__splicedPackages // { inherit stdenv; };
+            }).mkYarnModules args
+          ).overrideAttrs (upstream: {
+            # i guess the VM creates the output directory for the derivation? not sure.
+            # and `mv` across the VM boundary breaks, too?
+            # original errors:
+            # - "mv: cannot create directory <$out>: File exists"
+            # - "mv: failed to preserve ownership for"
+            buildPhase = lib.replaceStrings
+              [
+                "mkdir $out"
+                "mv "
+              ]
+              [
+                "mkdir $out || true ; chmod +w deps/browserpass-extension-modules/package.json"
+                "cp -Rv "
+              ]
+              upstream.buildPhase
+            ;
+          });
+        };
       };
     };
   });
@@ -719,10 +904,9 @@ in {
   koreader = (prev.koreader.override {
     # fixes runtime error: luajit: ./ffi/util.lua:757: attempt to call field 'pack' (a nil value)
     # inherit (emulated) luajit;
-    luajit = final.luajit.override {
+    luajit = buildInQemu (final.luajit.override {
-      inherit (emulated) stdenv;
       buildPackages.stdenv = emulated.stdenv;  # it uses buildPackages.stdenv for HOST_CC
-    };
+    });
   }).overrideAttrs (upstream: {
     nativeBuildInputs = upstream.nativeBuildInputs ++ [
       final.autoPatchelfHook
@@ -731,10 +915,9 @@ in {
   koreader-from-src = prev.koreader-from-src.override {
     # fixes runtime error: luajit: ./ffi/util.lua:757: attempt to call field 'pack' (a nil value)
     # inherit (emulated) luajit;
-    luajit = final.luajit.override {
+    luajit = buildInQemu (final.luajit.override {
-      inherit (emulated) stdenv;
       buildPackages.stdenv = emulated.stdenv;  # it uses buildPackages.stdenv for HOST_CC
-    };
+    });
   };
   # libgweather = rmNativeInputs [ final.glib ] (prev.libgweather.override {
   #   # alternative to emulating python3 is to specify it in `buildInputs` instead of `nativeBuildInputs` (upstream),
@@ -781,76 +964,146 @@ in {
     # depsBuildBuild = (upstream.depsBuildBuild or []) ++ [ final.pkg-config ];
   });
 
-  mepo =
+  mepo = (prev.mepo.override {
-    # let
+    # nixpkgs mepo correctly puts `zig_0_10.hook` in nativeBuildInputs,
-    #   zig = final.zig.override {
+    # but for some reason that tries to use the host zig instead of the build zig.
-    #     inherit (emulated) stdenv;
+    zig_0_10 = final.buildPackages.zig_0_10;
-    #   };
+  }).overrideAttrs (upstream: {
-    #   # makeWrapper = final.makeWrapper.override {
+    dontUseZigCheck = true;
+    nativeBuildInputs = upstream.nativeBuildInputs ++ [
+      # zig hardcodes the /lib/ld-linux.so interpreter which breaks nix dynamic linking & dep tracking
+      final.autoPatchelfHook
+      # zig hard-codes `pkg-config` inside lib/std/build.zig
+      (final.buildPackages.writeShellScriptBin "pkg-config" ''
+        exec $PKG_CONFIG $@
+      '')
+    ];
+    postPatch = (upstream.postPatch or "") + ''
+      substituteInPlace src/sdlshim.zig \
+        --replace 'cInclude("SDL2/SDL_image.h")' 'cInclude("SDL_image.h")' \
+        --replace 'cInclude("SDL2/SDL_ttf.h")' 'cInclude("SDL_ttf.h")'
+      substituteInPlace build.zig \
+        --replace 'step.linkSystemLibrary("curl")' 'step.linkSystemLibrary("libcurl")' \
+        --replace 'exe.install();' 'exe.install(); if (true) { return; } // skip tests when cross compiling'
+    '';
+    # skip the mepo -docman self-documenting invocation
+    postInstall = ''
+      install -d $out/share/man/man1
+    '';
+    # optional `zig build` debugging flags:
+    # - --verbose
+    # - --verbose-cimport
+    # - --help
+    zigBuildFlags = [ "-Dtarget=aarch64-linux-gnu" ];
+  });
+
+  # mepo = emulateBuildMachine (prev.mepo.override {
+  #   zig = (final.buildPackages.zig.overrideAttrs (upstream: {
+  #     cmakeFlags = (upstream.cmakeFlags or []) ++ [
+  #       "-DZIG_EXECUTABLE=${final.buildPackages.zig}/bin/zig"
+  #       "-DZIG_TARGET_TRIPLE=aarch64-linux-gnu"
+  #       # "-DZIG_MCPU=${final.targetPlatform.gcc.cpu}"
+  #     ];
+  #     # makeFlags = (upstream.makeFlags or []) ++ [
+  #     #   # stop at the second stage.
+  #     #   # the third stage would be a self-hosted compiler (i.e. build the compiler using what you just built),
+  #     #   # but that only works on native builds
+  #     #   "zig2"
+  #     # ];
+  #   }));
+  # });
+  # mepo = prev.mepo.overrideAttrs (upstream: {
+  #   installPhase = lib.replaceStrings [ "zig " ] [ "zig -Dtarget=aarch64-linux "] upstream.installPhase;
+  #   doCheck = false;
+  # });
+
+  # mepo =
+  #   # let
+  #   #   zig = final.zig.override {
   #   #     inherit (emulated) stdenv;
   #   #   };
-    #   # makeWrapper = emulated.stdenv.mkDerivation final.makeWrapper;
+  #   #   # makeWrapper = final.makeWrapper.override {
-    # in
+  #   #   #   inherit (emulated) stdenv;
-    # (prev.mepo.overrideAttrs (upstream: {
+  #   #   # };
-    #   checkPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.checkPhase;
+  #   #   # makeWrapper = emulated.stdenv.mkDerivation final.makeWrapper;
-    #   installPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.installPhase;
+  #   # in
-    # })).override {
+  #   # (prev.mepo.overrideAttrs (upstream: {
-    #   inherit (emulated) stdenv;
-    #   inherit zig;
-    # };
-    final.callPackage ({
-      stdenv
-      , upstreamMepo
-      , makeWrapper
-      , pkg-config
-      , zig
-      # buildInputs
-      , curl
-      , SDL2
-      , SDL2_gfx
-      , SDL2_image
-      , SDL2_ttf
-      , jq
-      , ncurses
-    }: stdenv.mkDerivation {
-      inherit (upstreamMepo)
-        pname
-        version
-        src
-        # buildInputs
-        preBuild
-        doCheck
-        postInstall
-        meta
-      ;
-      # moves pkg-config to buildInputs where zig can see it, and uses the host build of zig.
-      nativeBuildInputs = [ makeWrapper ];
-      buildInputs = [
-        curl SDL2 SDL2_gfx SDL2_image SDL2_ttf jq ncurses pkg-config
-      ];
-      checkPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstreamMepo.checkPhase;
-      installPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstreamMepo.installPhase;
-    }) {
-      upstreamMepo = prev.mepo;
-      inherit (emulated) stdenv;
-      zig = useEmulatedStdenv final.zig;
-    };
-    # (prev.mepo.override {
-    #   # emulate zig and stdenv to fix:
-    #   # - "/build/source/src/sdlshim.zig:1:20: error: C import failed"
-    #   # emulate makeWrapper to fix:
-    #   # - "error: makeWrapper/makeShellWrapper must be in nativeBuildInputs"
-    #   # inherit (emulated) makeWrapper stdenv;
-    #   inherit (emulated) stdenv;
-    #   inherit zig;
-    #   # inherit makeWrapper;
-    # }).overrideAttrs (upstream: {
-    #   # nativeBuildInputs = [ final.pkg-config makeWrapper ];
-    #   # nativeBuildInputs = [ final.pkg-config emulated.makeWrapper ];
-    #   # ref to zig by full path because otherwise it doesn't end up on the path...
   #   #   checkPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.checkPhase;
   #   #   installPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.installPhase;
+  #   # })).override {
+  #   #   inherit (emulated) stdenv;
+  #   #   inherit zig;
+  #   # };
+  # let
+  #   mepoDefn = {
+  #     stdenv
+  #     , upstreamMepo
+  #     , makeWrapper
+  #     , pkg-config
+  #     , zig
+  #     # buildInputs
+  #     , curl
+  #     , SDL2
+  #     , SDL2_gfx
+  #     , SDL2_image
+  #     , SDL2_ttf
+  #     , jq
+  #     , ncurses
+  #   }: stdenv.mkDerivation {
+  #     inherit (upstreamMepo)
+  #       pname
+  #       version
+  #       src
+  #       # buildInputs
+  #       preBuild
+  #       doCheck
+  #       postInstall
+  #       meta
+  #     ;
+  #     # moves pkg-config to buildInputs where zig can see it, and uses the host build of zig.
+  #     nativeBuildInputs = [ makeWrapper ];
+  #     buildInputs = [
+  #       curl SDL2 SDL2_gfx SDL2_image SDL2_ttf jq ncurses pkg-config
+  #     ];
+  #     checkPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstreamMepo.checkPhase;
+  #     installPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstreamMepo.installPhase;
+  #   };
+  # in
+  #   emulateBuildMachine (final.callPackage mepoDefn {
+  #     upstreamMepo = prev.mepo;
+  #     zig = final.zig.overrideAttrs (upstream: {
+  #       # TODO: for zig1 we can actually set ZIG_EXECUTABLE and use the build zig.
+  #       # zig2 doesn't support that.
+  #       postPatch = (upstream.postPatch or "") + ''
+  #         substituteInPlace CMakeLists.txt \
+  #           --replace "COMMAND zig1 " "COMMAND ${final.stdenv.hostPlatform.emulator final.buildPackages} $PWD/build/zig1 " \
+  #           --replace "COMMAND zig2 " "COMMAND ${final.stdenv.hostPlatform.emulator final.buildPackages} $PWD/build/zig2 "
+  #       '';
   #     });
+  #     # zig = emulateBuildMachine (final.zig.overrideAttrs (upstream: {
+  #     #   # speed up the emulated build by skipping docs and tests
+  #     #   outputs = [ "out" ];
+  #     #   postBuild = "";  # don't build docs
+  #     #   doInstallCheck = false;
+  #     #   doCheck = false;
+  #     # }));
+  #   });
+  #   # (prev.mepo.override {
+  #   #   # emulate zig and stdenv to fix:
+  #   #   # - "/build/source/src/sdlshim.zig:1:20: error: C import failed"
+  #   #   # emulate makeWrapper to fix:
+  #   #   # - "error: makeWrapper/makeShellWrapper must be in nativeBuildInputs"
+  #   #   # inherit (emulated) makeWrapper stdenv;
+  #   #   inherit (emulated) stdenv;
+  #   #   inherit zig;
+  #   #   # inherit makeWrapper;
+  #   # }).overrideAttrs (upstream: {
+  #   #   # nativeBuildInputs = [ final.pkg-config makeWrapper ];
+  #   #   # nativeBuildInputs = [ final.pkg-config emulated.makeWrapper ];
+  #   #   # ref to zig by full path because otherwise it doesn't end up on the path...
+  #   #   #checkPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.checkPhase;
+  #   #   #installPhase = lib.replaceStrings [ "zig" ] [ "${zig}/bin/zig" ] upstream.installPhase;
+  #   # });
   # mepo = (prev.mepo.override {
   #   # emulate zig and stdenv to fix:
   #   # - "/build/source/src/sdlshim.zig:1:20: error: C import failed"
@@ -1164,21 +1417,117 @@ in {
   #   })
   # ];
 
-  qt5 = (prev.qt5.override {
+  # qt5 = prev.qt5.overrideScope (self: super: {
-    # build all qt5 modules using emulation...
+  #   # emulate all qt5 modules
-    inherit (emulated) stdenv;
+  #   # this is a good idea, because qt is touchy about mixing "versions",
-  }).overrideScope (self: super: {
+  #   # but idk if it's necessary -- i haven't tried selective emulation.
-    # but for anything using `libsForQt5.callPackage`, don't emulate.
+  #   #
-    # note: alternative approach is to only `libsForQt5` (it's a separate scope),.
+  #   # qt5's `callPackage` doesn't use the final `qtModule`, but the non-overriden one.
-    # it inherits so much from the `qt5` scope, so not a clear improvement.
+  #   # so to modify `qtModule` we have to go through callPackage.
-    mkDerivation = self.mkDerivationWith final.stdenv.mkDerivation;
+  #   callPackage = self.newScope {
-    callPackage = self.newScope { inherit (self) qtCompatVersion qtModule srcs; inherit (final) stdenv; };
+  #     inherit (self) qtCompatVersion srcs stdenv;
-    qtbase = super.qtbase.override {
+  #     qtModule = args: emulateBuildMachine {
-      # qtbase is the only thing in `qt5` scope that references `[stdenv.]mkDerivation`.
+  #       # clunky emulateBuildMachine API, when not used via `callPackage`
-      # to emulate it, we emulate stdenv; all the other qt5 members are emulated via `qt5.qtModule`
+  #       override = _attrs: super.qtModule args;
-      inherit (emulated) stdenv;
+  #     };
-    };
+  #   };
-  });
+  #   # emulate qtbase (which doesn't go through qtModule)
+  #   qtbase = emulateBuildMachine super.qtbase;
+  # });
+
+  # qt5 = prev.qt5.overrideScope (self: super:
+  #   let
+  #     emulateQtModule = pkg: emulateBuildMachine {
+  #       # qtModule never gets `stdenv`
+  #       override = _stdenv: pkg;
+  #     };
+  #   in {
+  #   qtbase = emulateBuildMachine super.qtbase;
+  #   qtdeclarative = emulateQtModule super.qtdeclarative;
+  #   qtgraphicaleffects = emulateQtModule super.qtgraphicaleffects;
+  #   qtimageformats = emulateQtModule super.qtimageformats;
+  #   qtkeychain = emulateQtModule super.qtkeychain;  #< doesn't exist?
+  #   qtmultimedia = emulateQtModule super.qtmultimedia;
+  #   qtquickcontrols = emulateQtModule super.qtquickcontrols;
+  #   qtquickcontrols2 = emulateQtModule super.qtquickcontrols2;
+  #   qtsvg = emulateQtModule super.qtsvg;
+  #   qttools = emulateQtModule super.qttools;
+  #   qtwayland = emulateQtModule super.qtwayland;
+  # });
+
+  # qt5 = let
+  #   emulatedQt5 = prev.qt5.override {
+  #     # emulate qt5base and all qtModules.
+  #     # because qt5 doesn't place this `stdenv` argument into its scope, `libsForQt5` doesn't inherit
+  #     # this stdenv. so anything using `libsForQt5.callPackage` builds w/o emulation.
+  #     stdenv = final.stdenv // {
+  #       mkDerivation = args: emulateBuildMachine {
+  #         override = { stdenv }: stdenv.mkDerivation args;
+  #       };
+  #     };
+  #   };
+  # in prev.qt5.overrideScope (self: super: {
+  #   inherit (emulatedQt5)
+  #     qtbase
+  #     # without emulation these all fail with "Project ERROR: Cannot run compiler 'g++'."
+  #     qtdeclarative
+  #     qtgraphicaleffects
+  #     qtimageformats
+  #     qtmultimedia
+  #     qtquickcontrols
+  #     qtquickcontrols2
+  #     qtsvg
+  #     qttools
+  #     qtwayland
+  #   ;
+  # });
+
+  # qt5 = prev.qt5.overrideScope (self: super: {
+  #   # stdenv.mkDerivation is used by qtModule, so this emulates all the qt modules
+  #   stdenv = final.stdenv // {
+  #     mkDerivation = args: emulateBuildMachine {
+  #       override = { stdenv }: stdenv.mkDerivation args;
+  #     };
+  #   };
+  #   # callPackage/mkDerivation is used by libsForQt5, so we avoid emulating qt consumers.
+  #   # mkDerivation = final.stdenv.mkDerivation;
+  #   # callPackage = self.newScope {
+  #   #   inherit (self) qtCompatVersion qtModule srcs;
+  #   #   inherit (final) stdenv;
+  #   # };
+
+  #   # qtbase = emulateBuildMachine super.qtbase;
+  # });
+  # libsForQt5 = prev.libsForQt5.overrideScope (self: super: {
+  #   stdenv = final.stdenv;
+  #   inherit (self.stdenv) mkderivation;
+  # });
+
+  # qt5 = (prev.qt5.override {
+  #   # qt5 modules see this stdenv; they don't pick up the scope's qtModule or stdenv
+  #   stdenv = emulated.stdenv // {
+  #     # mkDerivation = args: emulateBuildMachine (final.stdenv.mkDerivation args);
+  #     mkDerivation = args: emulateBuildMachine {
+  #       # clunky emulateBuildMachine API, when not used via `callPackage`
+  #       override = _attrs: final.stdenv.mkDerivation args;
+  #     };
+  #   };
+  # }).overrideScope (self: super: {
+  #   # but for anything using `libsForQt5.callPackage`, don't emulate.
+  #   # note: alternative approach is to only `libsForQt5` (it's a separate scope),.
+  #   # it inherits so much from the `qt5` scope, so not a clear improvement.
+  #   mkDerivation = self.mkDerivationWith final.stdenv.mkDerivation;
+  #   callPackage = self.newScope { inherit (self) qtCompatVersion qtModule srcs; inherit (final) stdenv; };
+  #   # except, still emulate qtbase.
+  #   # all other modules build with qtModule (which emulates), except for qtbase which is behind a `callPackage` and uses `stdenv.mkDerivation`.
+  #   # therefore we need to re-emulate it when make callPackage not emulate here.
+  #   qtbase = emulateBuildMachine super.qtbase;
+  #   # qtbase = super.qtbase.override {
+  #   #   # qtbase is the only thing in `qt5` scope that references `[stdenv.]mkDerivation`.
+  #   #   # to emulate it, we emulate stdenv; all the other qt5 members are emulated via `qt5.qtModule`
+  #   #   inherit (emulated) stdenv;
+  #   # };
+  # });
   # qt5 = emulated.qt5.overrideScope (self: super: {
   #   # emulate all the qt5 packages, but rework `libsForQt5.callPackage` and `mkDerivation`
   #   # to use non-emulated stdenv by default.
@@ -1415,12 +1764,12 @@ in {
   tangram = (prev.tangram.override {
     # N.B. blueprint-compiler is in nativeBuildInputs.
     # the trick here is to force the aarch64 versions to be used during build (via emulation),
-    blueprint-compiler = (useEmulatedStdenv final.blueprint-compiler).overrideAttrs (upstream: {
+    blueprint-compiler = buildInQemu (final.blueprint-compiler.overrideAttrs (upstream: {
       # default is to propagate gobject-introspection *as a buildInput*, when it's supposed to be native.
       propagatedBuildInputs = [];
       # "Namespace Gtk not available"
       doCheck = false;
-    });
+    }));
     # blueprint-compiler = dontCheck emulated.blueprint-compiler;
     # gjs = dontCheck emulated.gjs;
     # gjs = dontCheck (mvToBuildInputs [ final.gobject-introspection ] (useEmulatedStdenv final.gjs));

overlays/disable-flakey-tests.nix

@@ -63,6 +63,19 @@ in {
           "pyarrow/tests/test_flight.py"
         ];
       });
+
+      # 2023/08/09: unclear why it fails; probably can remove after next nixpkgs update
+      pillow = py-prev.pillow.overridePythonAttrs (_upstream: {
+        format = "setuptools";
+      });
+
+      seaborn = py-prev.seaborn.overridePythonAttrs (upstream: {
+        # 2023/08/09
+        disabledTestPaths = (upstream.disabledTestPaths or []) ++ [
+          "tests/test_categorical.py"
+          "tests/test_core.py"
+        ];
+      });
     })
   ];
 

pkgs/additional/bonsai/default.nix

@@ -18,6 +18,21 @@ stdenv.mkDerivation rec {
     hash = "sha256-jOtFUpl2/Aa7f8JMZf6g63ayFOi+Ci+i7Ac63k63znc=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace 'hare build' 'hare build $(HARE_TARGET_FLAGS)'
+  '';
+
+  env.HARE_TARGET_FLAGS =
+    if stdenv.hostPlatform.isAarch64 then
+      "-t aarch64"
+    else if stdenv.hostPlatform.isRiscV64 then
+      "-t riscv64"
+    else if stdenv.hostPlatform.isx86_64 then
+      "-t x86_64"
+    else
+      "";
+
   nativeBuildInputs = [
     hare
     hare-ev
@@ -31,7 +46,7 @@ stdenv.mkDerivation rec {
     # export ARFLAGS="-csr"
   '';
 
-  installFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";

pkgs/additional/eg25-manager/default.nix

@@ -0,0 +1,75 @@
+# package based on:
+# - <https://github.com/NixOS/mobile-nixos/pull/573>
+
+{ lib
+, stdenv
+, callPackage
+, fetchFromGitLab
+, gnugrep
+, meson
+, ninja
+, pkg-config
+, scdoc
+, curl
+, glib
+, libgudev
+, libusb1
+, modemmanager
+}:
+
+let
+  # eg25-manager needs to be made compatible with libgpiod 2.0 API. see:
+  # - <https://github.com/NixOS/mobile-nixos/pull/573#issuecomment-1666739462>
+  # - <https://gitlab.com/mobian1/eg25-manager/-/issues/45>
+  # nixpkgs libgpiod was bumped 2023-07-29:
+  # - <https://github.com/NixOS/nixpkgs/pull/246018>
+  libgpiod1 = callPackage ./libgpiod1.nix { };
+in
+stdenv.mkDerivation rec {
+  pname = "eg25-manager";
+  version = "0.4.6";
+
+  src = fetchFromGitLab {
+    owner = "mobian1";
+    repo = "eg25-manager";
+    rev = version;
+    hash = "sha256-2JsdwK1ZOr7ljNHyuUMzVCpl+HV0C5sA5LAOkmELqag=";
+  };
+
+  postPatch = ''
+    substituteInPlace 'udev/80-modem-eg25.rules' \
+      --replace '/bin/grep' '${gnugrep}/bin/grep'
+  '';
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    glib # Contains gdbus-codegen program
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    curl
+    glib
+    libgpiod1
+    libgudev
+    libusb1
+    modemmanager
+  ];
+
+  passthru = {
+    inherit libgpiod1;
+  };
+
+  meta = with lib; {
+    description = "Manager daemon for the Quectel EG25 mobile broadband modem";
+    homepage = "https://gitlab.com/mobian1/eg25-manager";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}

pkgs/additional/eg25-manager/libgpiod1.nix

@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchurl, autoreconfHook, autoconf-archive, pkg-config, kmod
+, enable-tools ? true
+, enablePython ? false, python3, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "libgpiod";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
+    hash = "sha256-gp1KwmjfB4U2CdZ8/H9HbpqnNssqaKYwvpno+tGXvgo=";
+  };
+
+  buildInputs = [ kmod ] ++ lib.optionals enablePython [ python3 ncurses ];
+  nativeBuildInputs = [
+    autoconf-archive
+    pkg-config
+    autoreconfHook
+  ];
+
+  configureFlags = [
+    "--enable-tools=${if enable-tools then "yes" else "no"}"
+    "--enable-bindings-cxx"
+    "--prefix=${placeholder "out"}"
+  ] ++ lib.optional enablePython "--enable-bindings-python";
+
+  meta = with lib; {
+    description = "C library and tools for interacting with the linux GPIO character device";
+    longDescription = ''
+      Since linux 4.8 the GPIO sysfs interface is deprecated. User space should use
+      the character device instead. This library encapsulates the ioctl calls and
+      data structures behind a straightforward API.
+    '';
+    homepage = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/about/";
+    license = licenses.lgpl2;
+    maintainers = [ maintainers.expipiplus1 ];
+    platforms = platforms.linux;
+  };
+}

pkgs/additional/firefox-extensions/browserpass-extension/default.nix

@@ -1,8 +1,8 @@
 { stdenv
 , fetchFromGitHub
 , fetchFromGitea
-, gnused
 , mkYarnModules
+, nodejs
 , zip
 }:
 
@@ -25,7 +25,8 @@ let
   #   sha256 = "sha256-dSRZ2ToEOPhzHNvlG8qdewa7689gT8cNB7nXkN3/Avo=";
   # };
   browserpass-extension-yarn-modules = mkYarnModules {
-    inherit pname version;
+    inherit version;
+    pname = "${pname}-modules";
     packageJSON = ./package.json;
     yarnLock = ./yarn.lock;
     # yarnNix is auto-generated. to update: leave unset, then query the package deps and copy it out of the store.
@@ -37,9 +38,20 @@ let
 in stdenv.mkDerivation {
   inherit pname version src;
 
+  nativeBuildInputs = [ nodejs zip ];
+
   postPatch = ''
     # dependencies are built separately: skip the yarn install
-    ${gnused}/bin/sed -i /yarn\ install/d src/Makefile
+    # prettier, lessc, browserify are made available here via the modules,
+    # which are for the host (even the devDependencies are compiled for the host).
+    # but we can just run those via the build node.
+    #
+    # alternative would be to patchShebangs in the node_modules dir.
+    substituteInPlace src/Makefile \
+      --replace "yarn install" "true" \
+      --replace '	$(PRETTIER)' '	node $(PRETTIER)' \
+      --replace '	$(LESSC)' '	node $(LESSC)' \
+      --replace '	$(BROWSERIFY)' '	node $(BROWSERIFY)'
   '';
 
   preBuild = ''
@@ -48,11 +60,12 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     pushd firefox
-    ${zip}/bin/zip -r $out ./*
+    zip -r $out ./*
     popd
   '';
 
   passthru = {
+    yarn-modules = browserpass-extension-yarn-modules;
     extid = "browserpass@maximbaz.com";
   };
 }

pkgs/additional/firefox-extensions/bypass-paywalls-clean/default.nix

@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
     ./0003-disable-metrics.patch
   ];
 
+  nativeBuildInputs = [ zip ];
+
   installPhase = ''
-    ${zip}/bin/zip -r $out ./*
+    zip -r $out ./*
   '';
 
   passthru = {

pkgs/additional/firefox-extensions/default.nix

@@ -29,7 +29,7 @@ let
     };
   in (stdenv.mkDerivation ({
     # heavily borrows from <repo:nixos/nixpkgs:pkgs/build-support/fetchfirefoxaddon/default.nix>
-    inherit (addon) name;
+    name = "${addon.name}-wrapped";
     unpackPhase = ''
       echo "patching firefox addon $name into $out/${extid}.xpi"
 
@@ -64,7 +64,7 @@ let
     '';
   } // args')).overrideAttrs (final: upstream: {
     passthru = (upstream.passthru or {}) // {
-      withAttrs = attrs: wrapAddon final.finalPackage attrs;
+      withAttrs = attrs: wrapAddon addon (args // attrs);
       withPostPatch = postPatch: final.passthru.withAttrs { inherit postPatch; };
       # given an addon, repackage it without some `perm`ission
       withoutPermission = perm: final.passthru.withPostPatch ''
@@ -92,9 +92,9 @@ in lib.makeScope newScope (self: with self; {
     ether-metamask = fetchAddon "ether-metamask" "webextension@metamask.io" "sha256-UI83wUUc33OlQYX+olgujeppoo2D2PAUJ+Wma5mH2O0=";
     i2p-in-private-browsing = fetchAddon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
     sidebery = fetchAddon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
-    sponsorblock = fetchAddon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-b/OTFmhSEUZ/CYrYCE4rHVMQmY+Y78k8jSGMoR8vsZA=";
+    sponsorblock = fetchAddon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-kIVx/Yl2IZ0/0RqLMf4+HJojoDA7oOUYwZfFvMt/2XE=";
     ublacklist = fetchAddon "ublacklist" "@ublacklist" "sha256-NZ2FmgJiYnH7j2Lkn0wOembxaEphmUuUk0Ytmb0rNWo=";
-    ublock-origin = fetchAddon "ublock-origin" "uBlock0@raymondhill.net" "sha256-EGGAA+cLUow/F5luNzFG055rFfd3rEyh8hTaL/23pbM=";
+    ublock-origin = fetchAddon "ublock-origin" "uBlock0@raymondhill.net" "sha256-i3NGi8IzoR3SiVIZRmOBeD0ZEjhX3Qtv0WoBgg/KSDQ=";
 
     # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
     # bypass-paywalls-clean = fetchAddon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
@@ -113,7 +113,8 @@ in lib.makeScope newScope (self: with self; {
       # XXX: i tried to build sponsorblock from source and patch this *before* it gets webpack'd,
       # but web shit is absolutely cursed and building from source requires a fucking PhD
       # (if you have one, feel free to share your nix package)
-      ${gnused}/bin/sed -i 's/default\.config\.userID)/default.config.userID && false)/' js/background.js
+      substituteInPlace js/background.js \
+        --replace 'default.config.userId)' 'default.config.userID && false)'
     '';
 
   ublacklist = wrapAddon unwrapped.ublacklist {};

pkgs/additional/linux-megous/default.nix

@@ -1,11 +1,8 @@
 { lib
 , buildLinux
-, buildPackages
 , fetchFromGitHub
-, modDirVersionArg ? null
-, nixosTests
-, perl
 , pkgs
+# something inside nixpkgs calls `override` on the kernel and passes in extra arguments
 , ...
 }@args:
 
@@ -34,6 +31,16 @@ let
   kernelConfig = with lib.kernel; {
     # NB: nix adds the CONFIG_ prefix to each of these.
     # if you add the prefix yourself nix will IGNORE YOUR CONFIG.
+
+    # optimize for faster builds.
+    # see <repo:kernel.org/linux:Documentation/admin-guide/quickly-build-trimmed-linux.rst>
+    DEBUG_KERNEL = lib.mkForce no;  # option group which seems to just gate the other DEBUG_ opts?
+    DEBUG_INFO = lib.mkForce no;  # for gdb debugging
+    DEBUG_INFO_BTF = lib.mkForce no;  # BPF debug symbols. rec by <https://nixos.wiki/wiki/Linux_kernel#Too_high_ram_usage>
+    SCHED_DEBUG = lib.mkForce no;  # determines /sys/kernel/debug/sched
+    # SUNRPC_DEBUG = lib.mkForce no;  # i use NFS though
+
+    # taken from mobile-nixos config?? or upstream megous config??
     RTL8723CS = module;
     BT_HCIUART_3WIRE = yes;
     BT_HCIUART_RTL = yes;
@@ -99,35 +106,36 @@ let
   extraKernelPatches = [
     pkgs.kernelPatches.bridge_stp_helper
     pkgs.kernelPatches.request_key_helper
-    (patchDefconfig kernelConfig)
+    # (patchDefconfig kernelConfig)
   ];
 
 
   # create a kernelPatch which overrides nixos' defconfig with extra options
-  patchDefconfig = config: {
+  # patchDefconfig = config: {
-    # defconfig options. this method comes from here:
+  #   # defconfig options. this method comes from here:
-    # - https://discourse.nixos.org/t/the-correct-way-to-override-the-latest-kernel-config/533/9
+  #   # - https://discourse.nixos.org/t/the-correct-way-to-override-the-latest-kernel-config/533/9
-    name = "linux-megous-defconfig";
+  #   name = "linux-megous-defconfig";
-    patch = null;
+  #   patch = null;
-    extraStructuredConfig = config;
+  #   extraStructuredConfig = config;
-  };
+  # };
 
-  overridenArgs = args // rec {
+in buildLinux (args // {
   version = base + rc;
 
-    # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  # modDirVersion needs to be x.y.z, where `z` could be `Z-rcN`
-    modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) + rc else modDirVersionArg;
+  # nix kernel build will sanity check us if we get the modDirVersion wrong
+  modDirVersion = base + rc;
 
   # branchVersion needs to be x.y
-    extraMeta.branch = versions.majorMinor version;
+  extraMeta.branch = versions.majorMinor base;
 
   src = fetchFromGitHub {
     owner = "megous";
     repo = "linux";
     inherit rev hash;
   };
-  } // (args.argsOverride or { });
+
-  finalArgs = overridenArgs // {
+  kernelPatches = (args.kernelPatches or []) ++ extraKernelPatches;
-    kernelPatches = overridenArgs.kernelPatches or [] ++ extraKernelPatches;
+
-  };
+  structuredExtraConfig = (args.structuredExtraConfig or {}) // kernelConfig;
-in buildLinux finalArgs
+})

pkgs/additional/sxmo-utils/0004-no-busybox.patch

@@ -1,24 +0,0 @@
-diff --git a/setup_config_version.sh b/setup_config_version.sh
-index fde40c1..6386014 100755
---- a/setup_config_version.sh
-+++ b/setup_config_version.sh
-@@ -8,7 +8,7 @@ case "$1" in
-                exit
- esac
- 
--case "$(busybox head -n1 "$1")" in
-+case "$(head -n1 "$1")" in
- 	"#"*)
- 		comment="#"
- 		;;
-@@ -23,7 +23,7 @@ case "$(busybox head -n1 "$1")" in
- 		;;
- esac
- 
--busybox md5sum "$1" | \
--	busybox cut -d" " -f1 | \
--	busybox xargs -I{} busybox sed -i "2i$comment configversion: {}" \
-+md5sum "$1" | \
-+	cut -d" " -f1 | \
-+	xargs -I{} sed -i "2i$comment configversion: {}" \
- 	"$1"

pkgs/additional/sxmo-utils/default.nix

@@ -1,7 +1,10 @@
 { stdenv
+, bash
 , bc
 , bemenu
 , bonsai
+, buildPackages
+, busybox
 , conky
 , coreutils
 , dbus
@@ -40,13 +43,13 @@
 let
   # anything which any sxmo script or default hook in this package might invoke
   runtimeDeps = [
-    bc
+    bc  # also in busybox
     bemenu
     bonsai
     conky
     dbus
     # dmenu  # or dmenu-wayland? only used on x11?
-    gnugrep
+    gnugrep  # also in busybox
     gojq
     grim
     inotify-tools
@@ -106,7 +109,6 @@ stdenv.mkDerivation rec {
       url = "https://lists.sr.ht/~mil/sxmo-devel/patches/42880/mbox";
       hash = "sha256-tAMPBb6vwzj1dFMTEaqrcCJU6FbQirwZgB0+tqW3rQA=";
     })
-    ./0004-no-busybox.patch
     # wanted to fix/silence some non-fatal errors
     ./0005-system-audio.patch
     ./0007-workspace-wrapping.patch
@@ -160,11 +162,16 @@ stdenv.mkDerivation rec {
     scdoc
   ];
 
-  installFlags = [
+  buildInputs = [ bash ];  # needed here so stdenv's `patchShebangsAuto` hook sets the right interpreter
-    "OPENRC=0"
+
-    "DESTDIR=$(out)"
+  installPhase = ''
-    "PREFIX="
+    runHook preInstall
-  ];
+
+    # busybox is used by setup_config_version.sh, but placing it in nativeBuildInputs breaks the nix builder
+    PATH="$PATH:${buildPackages.busybox}/bin" make OPENRC=0 DESTDIR=$out PREFIX= install
+
+    runHook postInstall
+  '';
 
   # we don't wrap sxmo_common.sh or sxmo_init.sh
   # which is unfortunate, for non-sxmo-utils files that might source though.

pkgs/default.nix

@@ -21,10 +21,13 @@ let
 
     ### ADDITIONAL PACKAGES
     alsa-ucm-conf-sane = callPackage ./additional/alsa-ucm-conf-sane { };
-    bonsai = unpatched.bonsai or (callPackage ./additional/bonsai { });
+    # TODO: move target flags to upstream PR and re-enable this bonsai
+    # bonsai = unpatched.bonsai or (callPackage ./additional/bonsai { });
+    bonsai = callPackage ./additional/bonsai { };
     bootpart-uefi-x86_64 = callPackage ./additional/bootpart-uefi-x86_64 { };
     cargoDocsetHook = callPackage ./additional/cargo-docset/hook.nix { };
     chatty-latest = callPackage ./additional/chatty-latest { };
+    eg25-manager = callPackage ./additional/eg25-manager { };
     feeds = lib.recurseIntoAttrs (callPackage ./additional/feeds { });
     lemoa = callPackage ./additional/lemoa { };
     jellyfin-media-player-qt6 = callPackage ./additional/jellyfin-media-player-qt6 { };