cross compilation: simplify emulateBuilderQemu & use linux-megous as kernel when available

but it doesn't seem to be emulating child processes...

flake.lock

@@ -21,11 +21,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1683422260,
-        "narHash": "sha256-79zaClbubRkBNlJ04OSADILuLQHH48N5fu296hEWYlw=",
+        "lastModified": 1690059310,
+        "narHash": "sha256-4zcoDp8wwZVfGSzXltC5x+eH4kDWC/eJpyQNgr7shAA=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "ba4638836e94a8f16d1d1f9e8c0530b86078029c",
+        "rev": "56fc9f9619f305f0865354975a98d22410eed127",
         "type": "github"
       },
       "original": {
@@ -69,11 +69,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1689473667,
-        "narHash": "sha256-41ePf1ylHMTogSPAiufqvBbBos+gtB6zjQlYFSEKFMM=",
+        "lastModified": 1690066826,
+        "narHash": "sha256-6L2qb+Zc0BFkh72OS9uuX637gniOjzU6qCDBpjB2LGY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "13231eccfa1da771afa5c0807fdd73e05a1ec4e6",
+        "rev": "ce45b591975d070044ca24e3003c830d26fea1c8",
         "type": "github"
       },
       "original": {
@@ -85,11 +85,11 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1689534811,
-        "narHash": "sha256-jnSUdzD/414d94plCyNlvTJJtiTogTep6t7ZgIKIHiE=",
+        "lastModified": 1691654369,
+        "narHash": "sha256-gSILTEx1jRaJjwZxRlnu3ZwMn1FVNk80qlwiCX8kmpo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6cee3b5893090b0f5f0a06b4cf42ca4e60e5d222",
+        "rev": "ce5e4a6ef2e59d89a971bc434ca8ca222b9c7f5e",
         "type": "github"
       },
       "original": {
@@ -116,11 +116,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1689534977,
-        "narHash": "sha256-EB4hasmjKgetTR0My2bS5AwELZFIQ4zANLqHKi7aVXg=",
+        "lastModified": 1690199016,
+        "narHash": "sha256-yTLL72q6aqGmzHq+C3rDp3rIjno7EJZkFLof6Ika7cE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bd695cc4d0a5e1bead703cc1bec5fa3094820a81",
+        "rev": "c36df4fe4bf4bb87759b1891cab21e7a05219500",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1688265812,
-        "narHash": "sha256-Wkx56Pw7V5+5Gn6B3olDGP+o1qIp8BPFL0MWC2wbKVg=",
+        "lastModified": 1691106178,
+        "narHash": "sha256-3mZ9gTvMpbZA9ea9ovoQpn2wKuQY0QZ7MDdEjArYdAQ=",
         "ref": "refs/heads/master",
-        "rev": "1542323cfb46a8950c17a3afa5f7cd2e62dd9672",
-        "revCount": 202,
+        "rev": "f4d91aa201b6e49af690f250d4786bd1d8b4dcfd",
+        "revCount": 205,
         "type": "git",
         "url": "https://git.uninsane.org/colin/uninsane"
       },

flake.nix

@@ -94,7 +94,17 @@
       evalHost = { name, local, target }: nixpkgs.lib.nixosSystem {
         system = target;
         modules = [
-          (import ./hosts/instantiate.nix { localSystem = local; hostName = name; })
+          {
+            nixpkgs = (if (local != null) then {
+              buildPlatform = local;
+            } else {}) // {
+              # TODO: does the earlier `system` arg to nixosSystem make its way here?
+              hostPlatform.system = target;
+            };
+            # nixpkgs.buildPlatform = local;  # set by instantiate.nix instead
+            # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
+          }
+          (import ./hosts/instantiate.nix { hostName = name; })
           self.nixosModules.default
           self.nixosModules.passthru
           {
@@ -103,12 +113,6 @@
               self.overlays.sane-all
             ];
           }
-          ({ lib, ... }: {
-            # TODO: does the earlier `system` arg to nixosSystem make its way here?
-            nixpkgs.hostPlatform.system = target;
-            # nixpkgs.buildPlatform = local;  # set by instantiate.nix instead
-            # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
-          })
         ];
       };
     in {
@@ -174,6 +178,7 @@
         disable-flakey-tests = final: prev: import ./overlays/disable-flakey-tests.nix final prev;
         pkgs = final: prev: import ./overlays/pkgs.nix final prev;
         pins = final: prev: import ./overlays/pins.nix final prev;
+        preferences = final: prev: import ./overlays/preferences.nix final prev;
         optimizations = final: prev: import ./overlays/optimizations.nix final prev;
         passthru = final: prev:
           let
@@ -239,46 +244,58 @@
       apps."x86_64-linux" =
         let
           pkgs = self.legacyPackages."x86_64-linux";
-          deployScript = host: action: pkgs.writeShellScript "deploy-${host}" ''
+          deployScript = host: addr: action: pkgs.writeShellScript "deploy-${host}" ''
             nix build '.#nixosConfigurations.${host}.config.system.build.toplevel' --out-link ./result-${host} $@
             sudo nix sign-paths -r -k /run/secrets/nix_serve_privkey $(readlink ./result-${host})
 
             # XXX: this triggers another config eval & (potentially) build.
             # if the config changed between these invocations, the above signatures might not apply to the deployed config.
             # let the user handle that edge case by re-running this whole command
-            nixos-rebuild --flake '.#${host}' ${action} --target-host colin@${host} --use-remote-sudo $@
+            nixos-rebuild --flake '.#${host}' ${action} --target-host colin@${addr} --use-remote-sudo $@
           '';
         in {
+          help = {
+            type = "app";
+            program = let
+              helpMsg = builtins.toFile "nixos-config-help-message" ''
+                commands:
+                - `nix run '.#help'`
+                  - show this message
+                - `nix run '.#update-feeds'`
+                  - updates metadata for all feeds
+                - `nix run '.#init-feed' <url>`
+                - `nix run '.#deploy-{lappy,moby,moby-test,servo}' [nixos-rebuild args ...]`
+                - `nix run '.#check-nur'`
+              '';
+            in builtins.toString (pkgs.writeShellScript "nixos-config-help" ''
+              cat ${helpMsg}
+            '');
+          };
           update-feeds = {
             type = "app";
             program = "${pkgs.feeds.updateScript}";
           };
 
           init-feed = {
-            # use like `nix run '.#init-feed' uninsane.org`
             type = "app";
             program = "${pkgs.feeds.initFeedScript}";
           };
 
           deploy-lappy = {
-            # `nix run '.#deploy-lappy'`
             type = "app";
-            program = ''${deployScript "lappy" "switch"}'';
+            program = ''${deployScript "lappy" "lappy" "switch"}'';
           };
           deploy-moby-test = {
-            # `nix run '.#deploy-moby-test'`
             type = "app";
-            program = ''${deployScript "moby" "test"}'';
+            program = ''${deployScript "moby" "moby-hn" "test"}'';
           };
           deploy-moby = {
-            # `nix run '.#deploy-moby'`
             type = "app";
-            program = ''${deployScript "moby" "switch"}'';
+            program = ''${deployScript "moby" "moby-hn" "switch"}'';
           };
           deploy-servo = {
-            # `nix run '.#deploy-servo'`
             type = "app";
-            program = ''${deployScript "servo" "switch"}'';
+            program = ''${deployScript "servo" "servo" "switch"}'';
           };
 
           check-nur = {

hosts/by-name/desko/default.nix

@@ -25,7 +25,7 @@
   sane.programs.steam.enableFor.user.colin = true;
 
   sane.programs.guiApps.suggestedPrograms = [ "desktopGuiApps" ];
-  sane.programs.consoleUtils.suggestedPrograms = [ "consoleMediaUtils" ];
+  sane.programs.consoleUtils.suggestedPrograms = [ "consoleMediaUtils" "desktopConsoleUtils" ];
   # sane.programs.devPkgs.enableFor.user.colin = true;
 
   boot.loader.efi.canTouchEfiVariables = false;

hosts/by-name/lappy/default.nix

@@ -19,7 +19,7 @@
     "desktopGuiApps"
     "stepmania"
   ];
-  sane.programs.consoleUtils.suggestedPrograms = [ "consoleMediaUtils" ];
+  sane.programs.consoleUtils.suggestedPrograms = [ "consoleMediaUtils" "desktopConsoleUtils" ];
 
   sops.secrets.colin-passwd.neededForUsers = true;
 

hosts/by-name/moby/default.nix

@@ -12,8 +12,9 @@
 { config, pkgs, lib, ... }:
 {
   imports = [
-    ./firmware.nix
+    ./bootloader.nix
     ./fs.nix
+    ./gps.nix
     ./kernel.nix
     ./polyfill.nix
   ];
@@ -36,6 +37,7 @@
   ];
 
   sane.gui.sxmo.enable = true;
+  sane.services.eg25-manager.enable = true;
   sane.programs.guiApps.suggestedPrograms = [ "handheldGuiApps" ];
   # sane.programs.consoleUtils.enableFor.user.colin = false;
   # sane.programs.guiApps.enableFor.user.colin = false;
@@ -150,6 +152,13 @@
     #
     # NB: the above log is default level. though less specific, there's a `err` level message that also signals this:
     # sun4i-drm display-engine: failed to bind 1ee0000.hdmi (ops sun8i_dw_hdmi_ops [sun8i_drm_hdmi]): -17
+    # NB: this is the most common, but not the only, failure mode for `display-manager`.
+    # another error seems characterized by these dmesg logs, in which reprobing sun8i_drm_hdmi does not fix:
+    # ```syslog
+    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't get the MIPI D-PHY
+    # sun4i-drm display-engine: Couldn't bind all pipelines components
+    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't register our component
+    # ```
 
     if (${dmesg} --kernel --level err --color=never --notime | ${grep} -q 'sun4i-drm display-engine: failed to bind 1ee0000.hdmi')
     then

hosts/by-name/moby/gps.nix

@@ -0,0 +1,24 @@
+# pinephone GPS happens in EG25 modem
+# serial control interface to modem is /dev/ttyUSB2
+# after enabling GPS, readout is /dev/ttyUSB1
+#
+# minimal process to enable modem and GPS:
+# - `echo 1 > /sys/class/modem-power/modem-power/device/powered`
+# - `screen /dev/ttyUSB2 115200`
+#   - `AT+QGPSCFG="nmeasrc",1`
+#   - `AT+QGPS=1`
+#
+# now, something like `gpsd` can directly read from /dev/ttyUSB1.
+#
+# initial GPS fix can take 15+ minutes.
+# meanwhile, services like eg25-manager can speed this up by uploading assisted GPS data to the modem.
+#
+# geoclue somehow fits in here as a geospatial provider that leverages GPS and also other sources like radio towers
+
+{ ... }:
+{
+  services.gpsd.enable = true;
+  services.gpsd.devices = [ "/dev/ttyUSB1" ];
+
+  # TODO: enable eg25-manager, and bring online both the modem and GPS on boot
+}

hosts/by-name/moby/polyfill.nix

@@ -4,11 +4,17 @@
 #
 # NixOS backgrounds:
 # - <https://github.com/NixOS/nixos-artwork>
+#   - <https://github.com/NixOS/nixos-artwork/issues/50>  (colorful; unmerged)
+#   - <https://github.com/NixOS/nixos-artwork/pull/60/files>  (desktop-oriented; clean; unmerged)
 # - <https://itsfoss.com/content/images/2023/04/nixos-tutorials.png>
 
-{ pkgs, sane-lib, ... }:
+{ lib, pkgs, sane-lib, ... }:
 let
-  bg-01 = ./nixos-bg-01.png;
+  # TODO: generate this from the .svg
+  # bg = ./nixos-bg-02.png;
+  bg = pkgs.runCommand "nixos-bg.png" { nativeBuildInputs = [ pkgs.inkscape ]; } ''
+    inkscape ${./nixos-bg-02.svg} -o $out
+  '';
 in
 {
   sane.programs.firefox.config = {
@@ -23,6 +29,7 @@ in
   };
 
   sane.gui.sxmo = {
+    nogesture = true;
     settings = {
       ### hardware: touch screen
       SXMO_LISGD_INPUT_DEVICE = "/dev/input/by-path/platform-1c2ac00.i2c-event";
@@ -30,6 +37,90 @@ in
 
 
       ### preferences
+      # notable bemenu options:
+      #   - see `bemenu --help` for all
+      #   -P, --prefix          text to show before highlighted item.
+      #   --scrollbar           display scrollbar. (none (default), always, autohide)
+      #   -H, --line-height     defines the height to make each menu line (0 = default height). (wx)
+      #   -M, --margin          defines the empty space on either side of the menu. (wx)
+      #   -W, --width-factor    defines the relative width factor of the menu (from 0 to 1). (wx)
+      #   -B, --border          defines the width of the border in pixels around the menu. (wx)
+      #   -R  --border-radius   defines the radius of the border around the menu (0 = no curved borders).
+      #   --ch                  defines the height of the cursor (0 = scales with line height). (wx)
+      #   --cw                  defines the width of the cursor. (wx)
+      #   --hp                  defines the horizontal padding for the entries in single line mode. (wx)
+      #   --fn                  defines the font to be used ('name [size]'). (wx)
+      #   --tb                  defines the title background color. (wx)
+      #   --tf                  defines the title foreground color. (wx)
+      #   --fb                  defines the filter background color. (wx)
+      #   --ff                  defines the filter foreground color. (wx)
+      #   --nb                  defines the normal background color. (wx)
+      #   --nf                  defines the normal foreground color. (wx)
+      #   --hb                  defines the highlighted background color. (wx)
+      #   --hf                  defines the highlighted foreground color. (wx)
+      #   --fbb                 defines the feedback background color. (wx)
+      #   --fbf                 defines the feedback foreground color. (wx)
+      #   --sb                  defines the selected background color. (wx)
+      #   --sf                  defines the selected foreground color. (wx)
+      #   --ab                  defines the alternating background color. (wx)
+      #   --af                  defines the alternating foreground color. (wx)
+      #   --scb                 defines the scrollbar background color. (wx)
+      #   --scf                 defines the scrollbar foreground color. (wx)
+      #   --bdr                 defines the border color. (wx)
+      #
+      # colors are specified as `#RRGGBB`
+      # defaults:
+      # --ab "#222222"
+      # --af "#bbbbbb"
+      # --bdr "#005577"
+      # --border 3
+      # --cb "#222222"
+      # --center
+      # --cf "#bbbbbb"
+      # --fb "#222222"
+      # --fbb "#eeeeee"
+      # --fbf "#222222"
+      # --ff "#bbbbbb"
+      # --fixed-height
+      # --fn 'Sxmo 14'
+      # --hb "#005577"
+      # --hf "#eeeeee"
+      # --line-height 20
+      # --list 16
+      # --margin 40
+      # --nb "#222222"
+      # --nf "#bbbbbb"
+      # --no-overlap
+      # --no-spacing
+      # --sb "#323232"
+      # --scb "#005577"
+      # --scf "#eeeeee"
+      # --scrollbar autohide
+      # --tb "#005577"
+      # --tf "#eeeeee"
+      # --wrap
+      BEMENU_OPTS = let
+        bg = "#1d1721";       # slight purple
+        fg0 = "#d8d8d8";      # inactive text (light grey)
+        fg1 = "#ffffff";      # active text   (white)
+        accent0 = "#1f5e54";  # darker but saturated teal
+        accent1 = "#418379";  # teal (matches nixos-bg)
+        accent2 = "#5b938a";  # brighter but muted teal
+      in lib.concatStringsSep " " [
+        "--wrap --scrollbar autohide --fixed-height"
+        "--center --margin 45"
+        "--no-spacing"
+        # XXX: font size doesn't seem to take effect (would prefer larger)
+        "--fn 'Sxmo 14' --line-height 22 --border 3"
+        "--bdr '${accent0}'"                     # border
+        "--scf '${accent2}' --scb '${accent0}'"  # scrollbar
+        "--tb '${accent0}' --tf '${fg0}'"        # title
+        "--fb '${accent0}' --ff '${fg1}'"        # filter (i.e. text that's been entered)
+        "--hb '${accent1}' --hf '${fg1}'"        # selected item
+        "--nb '${bg}' --nf '${fg0}'"             # normal lines (even)
+        "--ab '${bg}' --af '${fg0}'"             # alternated lines (odd)
+        "--cf '${accent0}' --cb '${accent0}'"    # cursor (not very useful)
+      ];
       DEFAULT_COUNTRY = "US";
 
       # BEMENU lines (wayland DMENU):
@@ -43,7 +134,7 @@ in
       # - close is 16th entry
       SXMO_BEMENU_LANDSCAPE_LINES = "11";  # default 8
       SXMO_BEMENU_PORTRAIT_LINES = "16";  # default 16
-      SXMO_BG_IMG = "${bg-01}";
+      SXMO_BG_IMG = "${bg}";
       SXMO_LOCK_IDLE_TIME = "15";  # how long between screenoff -> lock -> back to screenoff (default: 8)
       # gravity: how far to tilt the device before the screen rotates
       # for a given setting, normal <-> invert requires more movement then left <-> right
@@ -78,9 +169,6 @@ in
     };
     package = pkgs.sxmo-utils.overrideAttrs (base: {
       postPatch = (base.postPatch or "") + ''
-        # don't enable gestures at launch
-        # sed -i '/superctl start sxmo_hook_lisgd/d' ./configs/default_hooks/sxmo_hook_start.sh
-
         cat <<EOF >> ./configs/default_hooks/sxmo_hook_start.sh
         # rotate UI based on physical display angle by default
         sxmo_daemons.sh start autorotate sxmo_autorotate.sh

hosts/by-name/servo/default.nix

@@ -18,6 +18,10 @@
   sane.roles.build-machine.enable = true;
   sane.roles.build-machine.emulation = false;
   sane.zsh.showDeadlines = false;  # ~/knowledge doesn't always exist
+  sane.programs.consoleUtils.suggestedPrograms = [
+    "desktopConsoleUtils"
+    "sane-scripts.stop-all-servo"
+  ];
   sane.services.dyn-dns.enable = true;
   sane.services.wg-home.enable = true;
   sane.services.wg-home.enableWan = true;

hosts/by-name/servo/fs.nix

@@ -2,6 +2,9 @@
 
 {
   sane.persist.root-on-tmpfs = true;
+  # increase /tmp space (defaults to 50% of RAM) for building large nix things.
+  # even the stock `nixpkgs.linux` consumes > 16 GB of tmp
+  fileSystems."/tmp".options = [ "size=32G" ];
 
   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/cc81cca0-3cc7-4d82-a00c-6243af3e7776";

hosts/common/feeds.nix

@@ -119,6 +119,12 @@ let
     ## The Witch Trials of J.K. Rowling
     ## - <https://www.thefp.com/witchtrials>
     (mkPod "https://feeds.megaphone.fm/RUNMED9919162779" // pol // infrequent)
+    ## Atlas Obscura
+    (fromDb "feeds.simplecast.com/xKJ93w_w" // uncat)
+    ## Ezra Klein Show
+    (fromDb "feeds.simplecast.com/82FI35Px" // pol)
+    ## Wireshark Podcast o_0
+    (fromDb "sharkbytes.transistor.fm" // tech)
   ];
 
   texts = [
@@ -220,6 +226,7 @@ let
     (fromDb "preposterousuniverse.com" // rat)
     (mkSubstack "eliqian" // rat // weekly)
     (mkText "https://acoup.blog/feed" // rat // weekly)
+    (fromDb "mindingourway.com" // rat)
 
     ## mostly dating topics. not advice, or humor, but looking through a social lens
     (fromDb "putanumonit.com" // rat)

hosts/common/hardware.nix

@@ -23,7 +23,6 @@
 
   # non-free firmware
   hardware.enableRedistributableFirmware = true;
-  services.fwupd.enable = true;
 
   # powertop will default to putting USB devices -- including HID -- to sleep after TWO SECONDS
   powerManagement.powertop.enable = false;

hosts/common/programs/assorted.nix

@@ -1,163 +1,201 @@
 { pkgs, ... }:
 
+let
+  declPackageSet = pkgs: {
+    package = null;
+    suggestedPrograms = pkgs;
+  };
+in
 {
   sane.programs = {
     # PACKAGE SETS
-    sysadminUtils = {
-      package = null;
-      suggestedPrograms = [
-        "btrfs-progs"
-        "cacert.unbundled"  # some services require unbundled /etc/ssl/certs
-        "cryptsetup"
-        "dig"
-        "efibootmgr"
-        "fatresize"
-        "fd"
-        "file"
-        "gawk"
-        "git"
-        "gptfdisk"
-        "hdparm"
-        "htop"
-        "iftop"
-        "inetutils"  # for telnet
-        "iotop"
-        "iptables"
-        "jq"
-        "killall"
-        "lsof"
-        "miniupnpc"
-        "nano"
-        #  "ncdu"  # ncurses disk usage. doesn't cross compile (zig)
-        "neovim"
-        "netcat"
-        "nethogs"
-        "nmap"
-        "openssl"
-        "parted"
-        "pciutils"
-        "powertop"
-        "pstree"
-        "ripgrep"
-        "screen"
-        "smartmontools"
-        "socat"
-        "strace"
-        "subversion"
-        "tcpdump"
-        "tree"
-        "usbutils"
-        "wget"
-        "wirelesstools"  # iwlist
-      ];
-    };
-    sysadminExtraUtils = {
-      package = null;
-      suggestedPrograms = [
-        "backblaze-b2"
-        "duplicity"
-        "sqlite"  # to debug sqlite3 databases
-      ];
-    };
+    "sane-scripts.backup" = declPackageSet [
+      "sane-scripts.backup-ls"
+      "sane-scripts.backup-restore"
+    ];
+    "sane-scripts.bittorrent" = declPackageSet [
+      "sane-scripts.bt-add"
+      "sane-scripts.bt-rm"
+      "sane-scripts.bt-search"
+      "sane-scripts.bt-show"
+    ];
+    "sane-scripts.dev" = declPackageSet [
+      "sane-scripts.dev-cargo-loop"
+      "sane-scripts.git-init"
+    ];
+    "sane-scripts.cli" = declPackageSet [
+      "sane-scripts.deadlines"
+      "sane-scripts.find-dotfiles"
+      "sane-scripts.ip-check"
+      "sane-scripts.ip-reconnect"
+      "sane-scripts.private-change-passwd"
+      "sane-scripts.private-do"
+      "sane-scripts.private-init"
+      "sane-scripts.private-lock"
+      "sane-scripts.private-unlock"
+      "sane-scripts.rcp"
+      "sane-scripts.reboot"
+      "sane-scripts.reclaim-boot-space"
+      "sane-scripts.reclaim-disk-space"
+      "sane-scripts.secrets-dump"
+      "sane-scripts.secrets-unlock"
+      "sane-scripts.secrets-update-keys"
+      "sane-scripts.shutdown"
+      "sane-scripts.ssl-dump"
+      "sane-scripts.sudo-redirect"
+      "sane-scripts.sync-from-servo"
+      "sane-scripts.vpn-down"
+      "sane-scripts.vpn-up"
+      "sane-scripts.which"
+      "sane-scripts.wipe-browser"
+    ];
+    "sane-scripts.sys-utils" = declPackageSet [
+      "sane-scripts.ip-port-forward"
+    ];
+
+
+    sysadminUtils = declPackageSet [
+      "btrfs-progs"
+      "cacert.unbundled"  # some services require unbundled /etc/ssl/certs
+      "cryptsetup"
+      "dig"
+      "efibootmgr"
+      "fatresize"
+      "fd"
+      "file"
+      # "fwupd"
+      "gawk"
+      "git"
+      "gptfdisk"
+      "hdparm"
+      "htop"
+      "iftop"
+      "inetutils"  # for telnet
+      "iotop"
+      "iptables"
+      "jq"
+      "killall"
+      "lsof"
+      "miniupnpc"
+      "nano"
+      #  "ncdu"  # ncurses disk usage. doesn't cross compile (zig)
+      "neovim"
+      "netcat"
+      "nethogs"
+      "nmap"
+      "openssl"
+      "parted"
+      "pciutils"
+      "powertop"
+      "pstree"
+      "ripgrep"
+      "screen"
+      "smartmontools"
+      "socat"
+      "strace"
+      "subversion"
+      "tcpdump"
+      "tree"
+      "usbutils"
+      "wget"
+      "wirelesstools"  # iwlist
+    ];
+    sysadminExtraUtils = declPackageSet [
+      "backblaze-b2"
+      "duplicity"
+      "sane-scripts.backup"
+      "sqlite"  # to debug sqlite3 databases
+    ];
 
     # TODO: split these into smaller groups.
     # - moby doesn't want a lot of these.
     # - categories like
     #   - dev?
     #   - debugging?
-    consoleUtils = {
-      package = null;
-      suggestedPrograms = [
-        "alsaUtils"  # for aplay, speaker-test
-        # "cdrtools"
-        "clinfo"
-        "dmidecode"
-        "efivar"
-        # "flashrom"
-        "fwupd"
-        "gh"  # MS GitHub cli
-        "git"  # needed as a user package, for config.
-        # "gnupg"
-        # "gocryptfs"
-        # "gopass"
-        # "gopass-jsonapi"
-        "helix"  # text editor
-        "kitty"  # TODO: move to GUI, but `ssh servo` from kitty sets `TERM=xterm-kitty` in the remove and breaks things
-        "libsecret"  # for managing user keyrings. TODO: what needs this? lift into the consumer
-        "lm_sensors"  # for sensors-detect. TODO: what needs this? lift into the consumer
-        "lshw"
-        # "memtester"
-        "neovim"  # needed as a user package, for swap persistence
-        # "nettools"
-        # "networkmanager"
-        "nix-index"
-        "nixpkgs-review"
-        # "nixos-generators"
-        "nmon"
-        # "node2nix"
-        # "oathToolkit"  # for oathtool
-        # "ponymix"
-        "pulsemixer"
-        "python3"
-        # "python3Packages.eyeD3"  # music tagging
-        "ripgrep"  # needed as a user package so that its user-level config file can be installed
-        "rsync"
-        "sane-scripts"
-        "sequoia"
-        "snapper"
-        "sops"
-        "speedtest-cli"
-        # "ssh-to-age"
-        "sudo"
-        # "tageditor"  # music tagging
-        "unar"
-        "wireguard-tools"
-        "xdg-terminal-exec"
-        "xdg-utils"  # for xdg-open
-        # "yarn"
-        "zsh"
-      ];
-    };
+    consoleUtils = declPackageSet [
+      "alsaUtils"  # for aplay, speaker-test
+      # "cdrtools"
+      "clinfo"
+      "dmidecode"
+      "dtrx"  # `unar` alternative, "Do The Right eXtraction"
+      "efivar"
+      # "flashrom"
+      "git"  # needed as a user package, for config.
+      # "gnupg"
+      # "gocryptfs"
+      # "gopass"
+      # "gopass-jsonapi"
+      "helix"  # text editor
+      "kitty"  # TODO: move to GUI, but `ssh servo` from kitty sets `TERM=xterm-kitty` in the remove and breaks things
+      "libsecret"  # for managing user keyrings. TODO: what needs this? lift into the consumer
+      "lm_sensors"  # for sensors-detect. TODO: what needs this? lift into the consumer
+      "lshw"
+      # "memtester"
+      "neovim"  # needed as a user package, for swap persistence
+      # "nettools"
+      # "networkmanager"
+      # "nixos-generators"
+      "nmon"
+      # "node2nix"
+      # "oathToolkit"  # for oathtool
+      # "ponymix"
+      "pulsemixer"
+      "python3"
+      # "python3Packages.eyeD3"  # music tagging
+      "ripgrep"  # needed as a user package so that its user-level config file can be installed
+      "rsync"
+      "sane-scripts.bittorrent"
+      "sane-scripts.cli"
+      "snapper"
+      "sops"
+      "speedtest-cli"
+      # "ssh-to-age"
+      "sudo"
+      # "tageditor"  # music tagging
+      # "unar"
+      "wireguard-tools"
+      "xdg-terminal-exec"
+      "xdg-utils"  # for xdg-open
+      # "yarn"
+      "zsh"
+    ];
 
-    consoleMediaUtils = {
-      package = null;
-      suggestedPrograms = [
-        "ffmpeg"
-        "imagemagick"
-        "sox"
-        "yt-dlp"
-      ];
-    };
+    desktopConsoleUtils = declPackageSet [
+      "gh"  # MS GitHub cli
+      "nix-index"
+      "nixpkgs-review"
+      "sane-scripts.dev"
+      "sequoia"
+    ];
 
-    tuiApps = {
-      package = null;
-      suggestedPrograms = [
-        "aerc"  # email client
-        "msmtp"  # sendmail
-        "offlineimap"  # email mailox sync
-        "sfeed"  # RSS fetcher
-        "visidata"  # TUI spreadsheet viewer/editor
-        "w3m"  # web browser
-      ];
-    };
+    consoleMediaUtils = declPackageSet [
+      "ffmpeg"
+      "imagemagick"
+      "sox"
+      "yt-dlp"
+    ];
 
-    iphoneUtils = {
-      package = null;
-      suggestedPrograms = [
-        "ifuse"
-        "ipfs"
-        "libimobiledevice"
-      ];
-    };
+    tuiApps = declPackageSet [
+      "aerc"  # email client
+      "msmtp"  # sendmail
+      "offlineimap"  # email mailbox sync
+      "sfeed"  # RSS fetcher
+      "visidata"  # TUI spreadsheet viewer/editor
+      "w3m"  # web browser
+    ];
 
-    devPkgs = {
-      package = null;
-      suggestedPrograms = [
-        "clang"
-        "nodejs"
-        "tree-sitter"
-      ];
-    };
+    iphoneUtils = declPackageSet [
+      "ifuse"
+      "ipfs"
+      "libimobiledevice"
+      "sane-scripts.sync-from-iphone"
+    ];
+
+    devPkgs = declPackageSet [
+      "clang"
+      "nodejs"
+      "tree-sitter"
+    ];
 
 
     # INDIVIDUAL PACKAGE DEFINITIONS
@@ -167,9 +205,6 @@
     # creds, but also 200 MB of node modules, etc
     discord.persist.private = [ ".config/discord" ];
 
-    # creds/session keys, etc
-    element-desktop.persist.private = [ ".config/Element" ];
-
     # `emote` will show a first-run dialog based on what's in this directory.
     # mostly, it just keeps a LRU of previously-used emotes to optimize display order.
     # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
@@ -177,12 +212,6 @@
 
     fluffychat-moby.persist.plaintext = [ ".local/share/chat.fluffy.fluffychat" ];
 
-    # XXX by default fractal stores its state in ~/.local/share/<UUID>.
-    # after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
-    # then reboot (so that libsecret daemon re-loads the keyring...?)
-    fractal-latest.persist.private = [ ".local/share/fractal" ];
-    fractal-next.persist.private = [ ".local/share/fractal" ];
-
     # MS GitHub stores auth token in .config
     # TODO: we can populate gh's stuff statically; it even lets us use the same oauth across machines
     gh.persist.private = [ ".config/gh" ];
@@ -193,13 +222,6 @@
 
     mumble.persist.private = [ ".local/share/Mumble" ];
 
-    # not strictly necessary, but allows caching articles; offline use, etc.
-    nheko.persist.private = [
-      ".config/nheko"  # config file (including client token)
-      ".cache/nheko"  # media cache
-      ".local/share/nheko"  # per-account state database
-    ];
-
     # settings (electron app)
     obsidian.persist.plaintext = [ ".config/obsidian" ];
 

hosts/common/programs/chatty.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+let
+  chattyNoOauth = pkgs.chatty.override {
+    # the OAuth feature (presumably used for web-based logins) pulls a full webkitgtk.
+    # especially when using the gtk3 version of evolution-data-server, it's an ancient webkitgtk_4_1.
+    # disable OAuth for a faster build & smaller closure
+    evolution-data-server = pkgs.evolution-data-server.override {
+      enableOAuth2 = false;
+      gnome-online-accounts = pkgs.gnome-online-accounts.override {
+        # disables the upstream "goabackend" feature -- presumably "Gnome Online Accounts Backend"
+        # frees us from webkit_4_1, in turn.
+        enableBackend = false;
+        gvfs = pkgs.gvfs.override {
+          # saves 20 minutes of build time, for unused feature
+          samba = null;
+        };
+      };
+    };
+  };
+  chatty-latest = pkgs.chatty-latest.override {
+    evolution-data-server-gtk4 = pkgs.evolution-data-server-gtk4.override {
+      gnome-online-accounts = pkgs.gnome-online-accounts.override {
+        # disables the upstream "goabackend" feature -- presumably "Gnome Online Accounts Backend"
+        # frees us from webkit_4_1, in turn.
+        enableBackend = false;
+        gvfs = pkgs.gvfs.override {
+          # saves 20 minutes of build time, for unused feature
+          samba = null;
+        };
+      };
+    };
+  };
+in
+{
+  sane.programs.chatty = {
+    # package = chattyNoOauth;
+    package = chatty-latest;
+    suggestedPrograms = [ "gnome-keyring" ];
+    persist.private = [
+      ".local/share/chatty"  # matrix avatars and files
+      # ".purple"  # XMPP stuff
+    ];
+  };
+}

hosts/common/programs/default.nix

@@ -4,13 +4,18 @@
   imports = [
     ./aerc.nix
     ./assorted.nix
+    ./chatty.nix
     ./cozy.nix
+    ./element-desktop.nix
     ./epiphany.nix
     ./evince.nix
     ./firefox.nix
     ./fontconfig.nix
+    ./fractal.nix
+    ./fwupd.nix
     ./git.nix
     ./gnome-feeds.nix
+    ./gnome-keyring.nix
     ./gpodder.nix
     ./gthumb.nix
     ./helix.nix
@@ -21,11 +26,13 @@
     ./koreader
     ./libreoffice.nix
     ./lemoa.nix
+    ./megapixels.nix
     ./mepo.nix
     ./mpv.nix
     ./msmtp.nix
     ./neovim.nix
     ./newsflash.nix
+    ./nheko.nix
     ./nix-index.nix
     ./obsidian.nix
     ./offlineimap.nix
@@ -35,8 +42,10 @@
     ./steam.nix
     ./sublime-music.nix
     ./tangram.nix
+    ./tuba.nix
     ./vlc.nix
     ./wireshark.nix
+    ./xarchiver.nix
     ./zeal.nix
     ./zsh
   ];

hosts/common/programs/element-desktop.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  sane.programs.element-desktop = {
+    # creds/session keys, etc
+    persist.private = [ ".config/Element" ];
+
+    suggestedPrograms = [ "gnome-keyring" ];
+  };
+}

hosts/common/programs/fontconfig.nix

@@ -8,7 +8,8 @@
       serif = [ "DejaVu Serif" ];
       sansSerif = [ "DejaVu Sans" ];
     };
-    enableDefaultFonts = true;
-    fonts = with pkgs; [ font-awesome noto-fonts-emoji hack-font ];
+    #vvv enables dejavu_fonts, freefont_ttf, gyre-fonts, liberation_ttf, unifont, noto-fonts-emoji
+    enableDefaultPackages = true;
+    packages = with pkgs; [ font-awesome noto-fonts-emoji hack-font ];
   };
 }

hosts/common/programs/fractal.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  sane.programs.fractal = {
+    # package = pkgs.fractal-latest;
+    package = pkgs.fractal-next;
+
+    # XXX by default fractal stores its state in ~/.local/share/stable/<UUID>.
+    persist.private = [ ".local/share/stable" ];
+
+    suggestedPrograms = [ "gnome-keyring" ];
+  };
+}

hosts/common/programs/fwupd.nix

@@ -0,0 +1,7 @@
+{ config, lib, ... }:
+{
+  services.fwupd = lib.mkIf config.sane.programs.fwupd.enabled {
+    # enables the dbus service, which i think the frontend speaks to.
+    enable = true;
+  };
+}

hosts/common/programs/gnome-keyring.nix

@@ -0,0 +1,10 @@
+{ config, lib, pkgs, ... }:
+{
+  sane.programs.gnome-keyring = {
+    package = pkgs.gnome.gnome-keyring;
+  };
+  # adds gnome-keyring as a xdg-data-portal (xdg.portal)
+  services.gnome.gnome-keyring = lib.mkIf config.sane.programs.gnome-keyring.enabled {
+    enable = true;
+  };
+}

hosts/common/programs/jellyfin-media-player.nix

@@ -3,7 +3,9 @@
 {
   sane.programs.jellyfin-media-player = {
     # package = pkgs.jellyfin-media-player;
-    package = pkgs.jellyfin-media-player-qt6;
+    # qt6 version is slightly buggy, but also most qtwebengine apps (e.g. zeal) are on qt5
+    #   so using qt6 would force yet *another* qtwebengine compile.
+    # package = pkgs.jellyfin-media-player-qt6;
 
     # jellyfin stores things in a bunch of directories: this one persists auth info.
     # it *might* be possible to populate this externally (it's Qt stuff), but likely to

hosts/common/programs/koreader/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, sane-lib, ... }:
+{ config, lib, pkgs, sane-lib, ... }:
 
 let
   feeds = sane-lib.feeds;
@@ -10,11 +10,12 @@ let
     # limit = 0                    => download and keep *all* articles
     # download_full_article = true => populate feed by downloading the webpage -- not just what's encoded in the RSS <article> tags
     # - use this for articles where the RSS only encodes content previews
+    # - in practice, most articles don't work with download_full_article = false
     # enable_filter         = true => only render content that matches the filter_element css selector.
     let fields = [
       (lib.escapeShellArg feed.url)
       "limit = 5"
-      "download_full_article = false"
+      "download_full_article = true"
       "include_images = true"
       "enable_filter = false"
       "filter_element = \"\""
@@ -22,6 +23,7 @@ let
   ) wantedFeeds;
 in {
   sane.programs.koreader = {
+    package = pkgs.koreader-from-src;
     # koreader applies these lua "patches" at boot:
     # - <https://github.com/koreader/koreader/wiki/User-patches>
     # - TODO: upstream this patch to koreader

hosts/common/programs/libreoffice.nix

@@ -1,14 +1,20 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
-  # libreoffice: disable first-run stuff
-  sane.programs.libreoffice-fresh.fs.".config/libreoffice/4/user/registrymodifications.xcu".symlink.text = ''
-    <?xml version="1.0" encoding="UTF-8"?>
-    <oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
-      <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="FirstRun" oor:op="fuse"><value>false</value></prop></item>
-      <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="ShowTipOfTheDay" oor:op="fuse"><value>false</value></prop></item>
-    </oor:items>
-  '';
-  # <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeDonateShown" oor:op="fuse"><value>1667693880</value></prop></item>
-  # <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeGetInvolvedShown" oor:op="fuse"><value>1667693880</value></prop></item>
+  sane.programs.libreoffice = {
+    # package = pkgs.libreoffice-bin;
+    # package = pkgs.libreoffice-still;
+    package = pkgs.libreoffice-fresh;
+
+    # disable first-run stuff
+    fs.".config/libreoffice/4/user/registrymodifications.xcu".symlink.text = ''
+      <?xml version="1.0" encoding="UTF-8"?>
+      <oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+        <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="FirstRun" oor:op="fuse"><value>false</value></prop></item>
+        <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="ShowTipOfTheDay" oor:op="fuse"><value>false</value></prop></item>
+      </oor:items>
+    '';
+    # <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeDonateShown" oor:op="fuse"><value>1667693880</value></prop></item>
+    # <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeGetInvolvedShown" oor:op="fuse"><value>1667693880</value></prop></item>
+  };
 }

hosts/common/programs/megapixels.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  sane.programs.megapixels.package = pkgs.megapixels.override {
+    # megapixels uses zbar to read barcodes.
+    # zbar by default ships zbarcam-gtk and zbarcam-qt, neither of which megapixels needs.
+    # but the latter takes a dep on qt, which bloats the closure and the build, so disable this feature.
+    zbar = pkgs.zbar.override {
+      enableVideo = false;
+    };
+  };
+}

hosts/common/programs/mepo.nix

@@ -9,12 +9,18 @@
     persist.private = [
       { type = "file"; path = ".cache/mepo/savestate"; }
     ];
+
+    # give mepo access to gpsd for location data, if that's enabled.
+    # same with geoclue2.
+    suggestedPrograms = lib.optional config.services.gpsd.enable "gpsd"
+      ++ lib.optional config.services.geoclue2.enable "geoclue2-with-demo-agent"
+    ;
   };
 
-  programs.mepo = lib.mkIf config.sane.programs.mepo.enabled {
-    # enable location services (via geoclue)
-    enable = true;
-    # more precise, via gpsd ("may require additional config")
-    # programs.mepo.gpsd.enable = true
-  };
+  # programs.mepo = lib.mkIf config.sane.programs.mepo.enabled {
+  #   # enable location services (via geoclue)
+  #   enable = true;
+  #   # more precise, via gpsd ("may require additional config")
+  #   # programs.mepo.gpsd.enable = true
+  # };
 }

hosts/common/programs/mpv.nix

@@ -1,13 +1,82 @@
-{ ... }:
+# mpv docs:
+# - <https://mpv.io/manual/master>
+# - <https://github.com/mpv-player/mpv/wiki>
+# curated mpv mods/scripts/users:
+# - <https://github.com/stax76/awesome-mpv>
+{ pkgs, ... }:
 
 {
   sane.programs.mpv = {
+    package = pkgs.wrapMpv pkgs.mpv-unwrapped {
+      youtubeSupport = false;  #< XXX(2023/08/03): doesn't cross compile until next staging -> master merge
+      scripts = with pkgs.mpvScripts; [
+        mpris
+        # uosc
+        pkgs.mpv-uosc-latest
+      ];
+    };
     persist.plaintext = [ ".config/mpv/watch_later" ];
-    # format is <key>=%<length>%<value>
-    fs.".config/mpv/mpv.conf".symlink.text = ''
-      save-position-on-quit=%3%yes
-      keep-open=%3%yes
+    fs.".config/mpv/input.conf".symlink.text = ''
+      # let volume keys be interpreted by the system.
+      # this is important for sxmo.
+      VOLUME_UP ignore
+      VOLUME_DOWN ignore
     '';
+    fs.".config/mpv/mpv.conf".symlink.text = ''
+      save-position-on-quit=yes
+      keep-open=yes
+
+      # use uosc instead (for On Screen Controls)
+      osc=no
+      # uosc provides its own seeking/volume indicators, so you also don't need this
+      osd-bar=no
+      # uosc will draw its own window controls if you disable window border
+      border=no
+    '';
+    fs.".config/mpv/script-opts/osc.conf".symlink.text = ''
+      # make the on-screen controls *always* visible
+      # unfortunately, this applies to full-screen as well
+      # - docs: <https://mpv.io/manual/master/#on-screen-controller-visibility>
+      # if uosc is installed, this file is unused
+      visibility=always
+    '';
+    fs.".config/mpv/script-opts/uosc.conf".symlink.text = let
+      play_pause_btn = "cycle:play_arrow:pause:no=pause/yes=play_arrow";
+      rev_btn = "command:replay_10:seek -10";
+      fwd_btn = "command:forward_30:seek 30";
+    in ''
+      # docs:
+      # - <https://github.com/tomasklaen/uosc>
+      # - <https://superuser.com/questions/1775550/add-new-buttons-to-mpv-uosc-ui>
+      timeline_style=bar
+      timeline_persistency=paused,audio
+      controls_persistency=paused,audio
+      volume_persistency=audio
+      volume_opacity=0.75
+
+      # speed_persistency=paused,audio
+      # vvv  want a close button?
+      top_bar=always
+      top_bar_persistency=paused
+
+      controls=menu,<video>subtitles,<has_many_audio>audio,<has_many_video>video,<has_many_edition>editions,<stream>stream-quality,space,${rev_btn},${play_pause_btn},${fwd_btn},space,speed:1.0,gap,<video>fullscreen
+
+      text_border=6.0
+      font_bold=yes
+      background_text=ff8080
+      foreground=ff8080
+
+      ui_scale=1.0
+    '';
+
+    mime.priority = 200;  # default = 100; 200 means to yield to other apps
+    mime.associations."audio/flac" = "mpv.desktop";
+    mime.associations."audio/mpeg" = "mpv.desktop";
+    mime.associations."audio/x-vorbis+ogg" = "mpv.desktop";
+    mime.associations."video/mp4" = "mpv.desktop";
+    mime.associations."video/quicktime" = "mpv.desktop";
+    mime.associations."video/webm" = "mpv.desktop";
+    mime.associations."video/x-matroska" = "mpv.desktop";
   };
 }
 

hosts/common/programs/nheko.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  # not strictly necessary, but allows caching articles; offline use, etc.
+  sane.programs.nheko.persist.private = [
+    ".config/nheko"  # config file (including client token)
+    ".cache/nheko"  # media cache
+    ".local/share/nheko"  # per-account state database
+  ];
+}

hosts/common/programs/tuba.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  sane.programs.tuba.suggestedPrograms = [ "gnome-keyring" ];
+}

hosts/common/programs/xarchiver.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  sane.programs.xarchiver.package = pkgs.xarchiver.override {
+    # unar doesn't cross compile well, so disable support for it
+    unar = null;
+  };
+}

hosts/common/programs/zeal.nix

@@ -13,6 +13,7 @@ let
   };
 in {
   sane.programs.zeal = {
+    # package = pkgs.zeal-qt6;  #< TODO: upgrade system to qt6 versions of everything (i.e. jellyfin-media-player, nheko)
     package = pkgs.zeal-qt5;
     persist.plaintext = [
       ".cache/Zeal"

hosts/instantiate.nix

@@ -1,10 +1,10 @@
 # trampoline from flake.nix into the specific host definition, while doing a tiny bit of common setup
 
 # args from flake-level `import`
-{ hostName, localSystem }:
+{ hostName }:
 
 # module args
-{ lib, ... }:
+{ ... }:
 
 {
   imports = [
@@ -14,5 +14,4 @@
   ];
 
   networking.hostName = hostName;
-  nixpkgs.buildPlatform = lib.mkIf (localSystem != null) localSystem;
 }

hosts/modules/gui/default.nix

@@ -10,22 +10,25 @@
 
   sane.programs.guiApps = {
     package = null;
-    suggestedPrograms = [
-      "firefox"
+    suggestedPrograms = lib.optionals (pkgs.system == "x86_64-linux") [
+      "x86GuiApps"
+    ] ++ [
+      # package sets
       "tuiApps"
-    ] ++ lib.optional (pkgs.system == "x86_64-linux") "x86GuiApps"
-    ++ [
+    ] ++ [
       # "celluloid"  # mpv frontend
+      "chatty"  # matrix/xmpp/irc client
       "cozy"  # audiobook player
       # "emote"
       "epiphany"  # gnome's web browser
       "evince"  # works on phosh
+      "firefox"
       # "foliate"  # e-book reader
+      # "fractal"  # matrix client
       # "gnome.cheese"
       # "gnome-feeds"  # RSS reader (with claimed mobile support)
-      "gnome.file-roller"
+      # "gnome.file-roller"
       # "gnome.gnome-maps"  # works on phosh
-      "gnome.nautilus"
       # "gnome-podcasts"
       # "gnome.gnome-system-monitor"
       # "gnome.gnome-terminal"  # works on phosh
@@ -36,11 +39,11 @@
       "koreader"
       "lemoa"  # lemmy app
       # "lollypop"
+      "mate.engrampa"  # archive manager
       "mepo"  # maps viewer
-      # "mpv"
+      "mpv"
       # "networkmanagerapplet"
       # "newsflash"
-      "nheko"
       "pavucontrol"
       # "picard"  # music tagging
       # "libsForQt5.plasmatube"  # Youtube player
@@ -50,7 +53,6 @@
       # "tdesktop"  # broken on phosh
       # "tokodon"
       "tuba"  # mastodon/pleroma client (stores pw in keyring)
-      "vlc"
       # "whalebird"  # pleroma client (Electron). input is broken on phosh.
       "xterm"  # broken on phosh
     ];
@@ -62,15 +64,17 @@
       "audacity"
       "blanket"  # ambient noise generator
       "brave"  # for the integrated wallet -- as a backup
-      "chromium"
-      "dino"
+      # "chromium"  # chromium takes hours to build. brave is chromium-based, distributed in binary form, so prefer it.
+      # "dino"  # XMPP client
       "electrum"
       "element-desktop"
       # "font-manager"  #< depends on webkitgtk4_0 (expensive to build)
-      "gajim"  # XMPP client
+      # "gajim"  # XMPP client
       "gimp"  # broken on phosh
       "gnome.dconf-editor"
+      # "gnome.file-roller"
       "gnome.gnome-disk-utility"
+      "gnome.nautilus"  # file browser
       # "gnome.totem"  # video player, supposedly supports UPnP
       "handbrake"
       "hase"
@@ -79,11 +83,13 @@
       "kdenlive"
       "kid3"  # audio tagging
       "krita"
-      "libreoffice-fresh"
+      "libreoffice"  # TODO: replace with an office suite that uses saner packaging?
       "mumble"
+      "nheko"
       "obsidian"
       "slic3r"
       "steam"
+      "vlc"
       "wireshark"  # could maybe ship the cli as sysadmin pkg
     ];
   };
@@ -92,6 +98,8 @@
     package = null;
     suggestedPrograms = [
       "megapixels"  # camera app
+      "portfolio-filemanager"
+      "xarchiver"
     ];
   };
 

hosts/modules/gui/sway/default.nix

@@ -97,9 +97,6 @@ in
         };
       };
 
-      # some programs (e.g. fractal) **require** a "Secret Service Provider"
-      services.gnome.gnome-keyring.enable = true;
-
       # unlike other DEs, sway configures no audio stack
       # administer with pw-cli, pw-mon, pw-top commands
       services.pipewire = {
@@ -133,9 +130,38 @@ in
       };
 
       programs.sway = {
+        # provides xdg-desktop-portal-wlr, which exposes on dbus:
+        # - org.freedesktop.impl.portal.ScreenCast
+        # - org.freedesktop.impl.portal.Screenshot
         enable = true;
+        extraPackages = [];  # nixos adds swaylock, swayidle, foot, dmenu by default
+        # "wrapGAppsHook wrapper to execute sway with required environment variables for GTK applications."
         wrapperFeatures.gtk = true;
       };
+      # provide portals for:
+      # - org.freedesktop.impl.portal.Access
+      # - org.freedesktop.impl.portal.Account
+      # - org.freedesktop.impl.portal.DynamicLauncher
+      # - org.freedesktop.impl.portal.Email
+      # - org.freedesktop.impl.portal.FileChooser
+      # - org.freedesktop.impl.portal.Inhibit
+      # - org.freedesktop.impl.portal.Notification
+      # - org.freedesktop.impl.portal.Print
+      # and conditionally (i.e. unless buildPortalsInGnome = false) for:
+      # - org.freedesktop.impl.portal.AppChooser (@appchooser_iface@)
+      # - org.freedesktop.impl.portal.Background (@background_iface@)
+      # - org.freedesktop.impl.portal.Lockdown (@lockdown_iface@)
+      # - org.freedesktop.impl.portal.RemoteDesktop (@remotedesktop_iface@)
+      # - org.freedesktop.impl.portal.ScreenCast (@screencast_iface@)
+      # - org.freedesktop.impl.portal.Screenshot (@screenshot_iface@)
+      # - org.freedesktop.impl.portal.Settings (@settings_iface@)
+      # - org.freedesktop.impl.portal.Wallpaper (@wallpaper_iface@)
+      xdg.portal.extraPortals = [
+        (pkgs.xdg-desktop-portal-gtk.override {
+          buildPortalsInGnome = false;
+        })
+      ];
+
       sane.user.fs.".config/sway/config".symlink.text =
         import ./sway-config.nix { inherit pkgs; };
 

hosts/modules/gui/sway/sway-config.nix

@@ -170,4 +170,13 @@ in ''
     pos 1920,0
     res 1920x1080
   }
+
+  # XXX: needed for xdg-desktop-portal-* to work.
+  # this is how we expose these env vars to user dbus services:
+  # - DISPLAY
+  # - WAYLAND_DISPLAY
+  # - SWAYSOCK
+  # - XDG_CURRENT_DESKTOP
+  # for more, see: <repo:nixos/nixpkgs:nixos/modules/programs/wayland/sway.nix>
+  include /etc/sway/config.d/*
 ''

hosts/modules/gui/sxmo/conky-config

@@ -13,11 +13,12 @@ conky.config = {
     alignment = 'middle_middle',
     own_window_type = 'desktop',
     -- own_window_argb_value: opacity of the background (0-255)
-    own_window_argb_value = 92,
-    own_window_colour = '#beebe5',  -- beebe5 matches nixos flake bg color
+    own_window_argb_value = 0,
+    -- own_window_argb_value = 92,
+    -- own_window_colour = '#beebe5',  -- beebe5 matches nixos flake bg color
 
     -- "border" pads the entire conky window
-    -- this can be used to control the extend of the own_window background
+    -- this can be used to control the extent of the own_window background
     border_inner_margin = 8,
     -- optionally, actually draw borders
     -- draw_borders = true,

hosts/modules/gui/sxmo/default.nix

@@ -126,6 +126,11 @@ in
       default = false;
       description = "inhibit lock-on-idle and screenoff-on-idle";
     };
+    sane.gui.sxmo.nogesture = mkOption {
+      type = types.bool;
+      default = false;
+      description = "don't start lisgd gesture daemon by default";
+    };
   };
 
   config = lib.mkMerge [
@@ -171,10 +176,7 @@ in
         services.blueman.enable = true;
 
         # TODO: nerdfonts is 4GB. it accepts an option to ship only some fonts: probably want to use that.
-        fonts.fonts = [ pkgs.nerdfonts ];
-
-        # some programs (e.g. fractal/nheko) **require** a "Secret Service Provider"
-        services.gnome.gnome-keyring.enable = true;
+        fonts.packages = [ pkgs.nerdfonts ];
 
         # lightdm-mobile-greeter: "The name org.a11y.Bus was not provided by any .service files"
         services.gnome.at-spi2-core.enable = true;
@@ -213,9 +215,37 @@ in
           wantedBy = [ "display-manager.service" ];
         };
 
+        # if superd fails to start a service within 100ms, it'll try to start again
+        # the fallout of this is that during intense lag (e.g. OOM or swapping) it can
+        # start the service many times.
+        # see <repo:craftyguy/superd:internal/cmd/cmd.go>
+        # TODO: better fix may be to patch `sxmo_hook_lisgdstart.sh` and force it to behave as a singleton
+        systemd.services."dedupe-sxmo-lisgd" = {
+          description = "kill duplicate lisgd processes started by superd";
+          serviceConfig = {
+            Type = "oneshot";
+          };
+          script = ''
+            if [ "$(${pkgs.procps}/bin/pgrep -c lisgd)" -gt 1 ]; then
+              echo 'killing duplicated lisgd daemons'
+              ${pkgs.psmisc}/bin/killall lisgd  # let superd restart it
+            fi
+          '';
+          wantedBy = [ "multi-user.target" ];
+        };
+        systemd.timers."dedupe-sxmo-lisgd" = {
+          wantedBy = [ "dedupe-sxmo-lisgd.service" ];
+          timerConfig = {
+            OnUnitActiveSec = "2min";
+          };
+        };
+
         sane.user.fs.".cache/sxmo/sxmo.noidle" = lib.mkIf cfg.noidle {
           symlink.text = "";
         };
+        sane.user.fs.".cache/sxmo/sxmo.nogesture" = lib.mkIf cfg.nogesture {
+          symlink.text = "";
+        };
         sane.user.fs.".config/sxmo/profile".symlink.text = let
           mkKeyValue = key: value: ''export ${key}="${value}"'';
           userConfig = lib.generators.toKeyValue { inherit mkKeyValue; } cfg.settings;
@@ -238,8 +268,8 @@ in
           in
             (pkgs.formats.json {}).generate "waybar-config.json" waybar-config;
 
-        # sane.user.fs.".config/waybar/style.css".symlink.text =
-        #   builtins.readFile ./waybar-style.css;
+        sane.user.fs.".config/waybar/style.css".symlink.text =
+          builtins.readFile ./waybar-style.css;
 
         sane.user.fs.".config/sxmo/conky.conf".symlink.target = let
           battery_estimate = pkgs.static-nix-shell.mkBash {

hosts/modules/gui/sxmo/sway-config

@@ -39,6 +39,21 @@ mode "menu" {
     bindsym --input-device=1:1:1c21800.lradc XF86AudioMute exec nothing # just a placeholder for "menu" mode
 }
 
+hide_edge_borders smart
+default_border pixel 1
+titlebar_border_thickness 1
+# XX YY distance from edge of window title to edge of text
+# the YY distance here determines the heigh of the overall title
+titlebar_padding 12 1
+title_align center
+
+### tab colors (#border #background #text [#indicator #childBorder])
+# fucused & unfocused are the main interest
+client.focused          #1f5e54 #418379 #ffffff
+client.focused_inactive #1f5e54 #5f676a #ffffff
+client.unfocused        #1f5e54 #1f554c #b4b4b4
+client.urgent           #e64291 #e64291 #ffffff
+
 ### Key bindings
 #
 # Basics:
@@ -214,10 +229,6 @@ bar {
 for_window [app_id="foot" title=".*sxmo/modem/.*/draft.txt.*"] resize set height 25
 for_window [title="megapixels"] inhibit_idle open
 
-default_border pixel 3
-titlebar_border_thickness 3
-hide_edge_borders smart
-
 include /etc/sway/config.d/*
 
 exec 'printf %s "$SWAYSOCK" > "$XDG_RUNTIME_DIR"/sxmo.swaysock'

hosts/modules/gui/sxmo/waybar-config.nix

@@ -4,7 +4,7 @@
 [
   { # TOP BAR
     layer = "top";
-    height = 32;
+    height = 26;
 
     modules-left = [ "sway/workspaces" ];
     modules-center = [ ];

hosts/modules/gui/sxmo/waybar-style.css

@@ -0,0 +1,64 @@
+/* style docs: https://github.com/Alexays/Waybar/wiki/Styling */
+/* defaults: https://github.com/Alexays/Waybar/blob/master/resources/style.css */
+
+window#waybar {
+  background-color: #418379;
+  border-bottom: 0px solid #1f5e54;
+  color: #ffffff;
+  transition-property: background-color;
+  transition-duration: .2s;
+}
+
+.modules-right {
+  /* workspace buttons (LHS) get padding between it and the screen edge */
+  /* replicate that same padding for whatever's on the RHS (i.e. the clock) */
+  margin-right: 5px;
+}
+
+#workspaces button {
+  padding: 0 5px;
+  background-color: #418379;
+  color: #ffffff;
+  /* Use box-shadow instead of border so the text isn't offset */
+  box-shadow: inset 0 0px #1f5e54;
+  /* Avoid rounded borders under each workspace name */
+  border: none;
+  border-radius: 0;
+}
+
+#workspaces button:hover {
+  /* i don't want hover effects, so reset this styling to be the same as default button */
+  /* https://github.com/Alexays/Waybar/wiki/FAQ#the-workspace-buttons-have-a-strange-hover-effect */
+  background: inherit;
+  box-shadow: inherit;
+  text-shadow: inherit;
+}
+
+#workspaces button.focused {
+  background-color: #63a89c;
+  box-shadow: inset 0 0px #2c8274;
+}
+
+#workspaces button.urgent {
+  background-color: #e64291;
+}
+
+@keyframes blink {
+  to {
+    background-color: #ffffff;
+    color: #000000;
+  }
+}
+
+#tray {
+  background-color: #418379;
+}
+
+#tray > .passive {
+  -gtk-icon-effect: dim;
+}
+ 
+#tray > .needs-attention {
+  -gtk-icon-effect: highlight;
+  background-color: #e64291;
+}

modules/data/feeds/sources/feeds.simplecast.com/82FI35Px/default.json

@@ -0,0 +1,23 @@
+{
+  "bozo": 0,
+  "content_length": 3673943,
+  "content_type": "application/xml; charset=utf-8",
+  "description": "*** Named a best podcast of 2021 by Time, Vulture, Esquire and The Atlantic. ***\nEach Tuesday and Friday, Ezra Klein invites you into a conversation on something that matters. How do we address climate change if the political system fails to act? Has the logic of markets infiltrated too many aspects of our lives? What is the future of the Republican Party? What do psychedelics teach us about consciousness? What does sci-fi understand about our present that we miss? Can our food system be just to humans and animals alike?\n\nListen to this podcast in New York Times Audio, our new iOS app for news subscribers. Download now at nytimes.com/audioapp",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [
+    "https://simplecast.superfeedr.com/"
+  ],
+  "is_podcast": true,
+  "is_push": true,
+  "item_count": 255,
+  "last_updated": "2023-07-25T09:00:00+00:00",
+  "score": 24,
+  "self_url": "https://feeds.simplecast.com/82FI35Px",
+  "site_name": "",
+  "site_url": "",
+  "title": "The Ezra Klein Show",
+  "url": "https://feeds.simplecast.com/82FI35Px",
+  "velocity": 0.275,
+  "version": "rss20"
+}

modules/data/feeds/sources/feeds.simplecast.com/xKJ93w_w/default.json

@@ -0,0 +1,23 @@
+{
+  "bozo": 0,
+  "content_length": 1410917,
+  "content_type": "application/xml; charset=utf-8",
+  "description": "An audio guide to the world\u2019s strange, incredible, and wondrous places. Co-founder Dylan Thuras and a neighborhood of Atlas Obscura reporters explore a new wonder every day, Monday through Thursday. In under 15 minutes, they\u2019ll take you to an incredible place, and along the way, you\u2019ll meet some fascinating people and hear their stories. Our theme and end credit music is composed by Sam Tyndall.",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [
+    "https://simplecast.superfeedr.com/"
+  ],
+  "is_podcast": true,
+  "is_push": true,
+  "item_count": 571,
+  "last_updated": "2023-07-27T04:05:00+00:00",
+  "score": 24,
+  "self_url": "https://feeds.simplecast.com/xKJ93w_w",
+  "site_name": "",
+  "site_url": "",
+  "title": "The Atlas Obscura Podcast",
+  "url": "https://feeds.simplecast.com/xKJ93w_w",
+  "velocity": 0.647,
+  "version": "rss20"
+}

modules/data/feeds/sources/mindingourway.com/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 133561,
+  "content_type": "text/xml; charset=utf-8",
+  "description": "to the heavens",
+  "favicon": "https://mindingourway.com/favicon.png",
+  "favicon_data_uri": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAACXBIWXMAAAAnAAAAJwEqCZFPAAAE2klEQVR42u2dSasUVxxHW4zGiFmbrxHliU8NKMaF+AWcn34IcQIFA4pK4rAJZKcrNyKIOOCnUBwS5wnUlaIicbaXVYfC/7td1dXV3nPh7N6rvsNp+NH3f2/1et95m5iYmAJfAjYW6dkUwKYANgWwjcuCzwS3QCTAv6D0PGdYAWwKYFMAW2cF2AS4wDfBf4B/v6GIM6wANgWwKYCtMwv+A2CI++YPPdMQxlCoAAqgAAqgAArQTQE2Ay4gQ97MAEOhAiiAAiiAAijAeIS+aLMnqcDDUKgACqAACqAACtBZAaIiz9ugJMw0nm8oVAAFUAAFUAAF6MaCpxZ5lkJcA5+fWmBiKFQABVAABVAABWhGABZwtLoAAwhoKFQABVAABVCAsRCg38lFRTrQn1kgqcizhf5FBSidDoX9PkwWUQAFUAAFUICsBfgADoGfirTQwS2AE8wQ1uoEdz0Ucr36HAYfiyiAAiiAAihA1gJ8BFGBxW9FhjChUQFGo5s9DfR/pEWk/WcsBgyh7E/pC68ACqAACqAAWQvAdgXwAZ/AUTC3SAObPd883NkBAVIFTj2oMgcwpEdf4Gug1BRAARRAARQgXwEqPpCHL7eD/wE/8AH4HfD5dwCft65Ir+ON/a0YD8fL+VgB7gE+7x3geiUdjFEABVAABVCAfAWYxgB/Bamh8TIYq9A3hFB4AUSh7jpot6BHARRAARRAAbIVoGLAs8E+8B5EL23aW6Q35q0/hl0gGj8FOAhKPwx1YYAKoAAKoAAKkKcAQ5gAhsYjIGmzqYXx/QgOABbdRuPfXaSX4TdAARRAARRAAcZTgIofQqLNnnMgCo08iLGsSAvjY2PBRRTqLoLv6zJqBVAABVAABchZgFpFnn0WgNTNplqhsSLU7QdRqOPBDB7cGGoRqQIogAIogAIoQIsLnlrkubbIAM9vukh1ObgLUoswS5dcTWN8tYpIFUABFEABFEABRihAdEHCE9DoACpC41UQhcYo1PGHmfJFi/X7z4sxn4Juh0IFUAAFUAAFyEaAAX7IIPfBHjC/yAD9mwRvQdQ/bkatKjJAf34BewFDatS/0W4WKYACKIACKEDOAkQvTHgEUgVhKDsLVoM/QBTq2J/U0PgXWAPY39SiUC7wYzDaUKgACqAACqAA2QhQsRkTvSBhPZgBVoIzIHXCIk4BvlCBh1v/AXU/n+PheDkfnK+RXkatAAqgAAqgAFkLMAXYgc+AFxqwAGMe4AL8DeouAEPceUBBUi+0iDgJKODPgPPFy6E538MNhQqgAAqgAAqQjQAVoY8vjWo6FD0D0f+fACyqfAXq9vc1WAtShX0BKGjd/tYLhQqgAAqgAAqQswDRy5tvAG7OHAPR5cepMASlhjZurjwEqQUjUSirG1qPA853s4dLFUABFEABFCAbAeoe7qwowoxeXhwN+EvLNL2AqZdBR3/PBV4K6m0WKYACKIACKEDOAmwFfAB/CPoTNB3yJO0LwyLV6KBJORQqgAIogAIoQM4CRJcijTqkRbwBl8BOsAQsArz0iS925ObQuAlUCoUKoAAKoAAKkLUAo+7QS8AXSOwAXMCkixmHcFCGP4SxvxwPxzvS+VcABVAABVAABajBc3AabAO82HG8XorU/CVbCwHni/PJ+VYABVAABVAABRiEr4mwVmPpPyoAAAAAAElFTkSuQmCC",
+  "hubs": [],
+  "is_podcast": false,
+  "is_push": false,
+  "item_count": 15,
+  "last_updated": "2019-12-21T19:28:00+00:00",
+  "score": 16,
+  "self_url": "https://mindingourway.com/rss/",
+  "site_name": "Minding our way",
+  "site_url": "https://mindingourway.com",
+  "title": "Minding our way",
+  "url": "https://mindingourway.com/rss/",
+  "velocity": 0.01,
+  "version": "rss20"
+}

modules/data/feeds/sources/sharkbytes.transistor.fm/default.json

@@ -0,0 +1,23 @@
+{
+  "bozo": 0,
+  "content_length": 26554,
+  "content_type": "application/rss+xml; charset=utf-8",
+  "description": "Welcome to the SharkBytes Podcast. We will discuss all things Wireshark, as well as topics from the world of Packet Analysis and SharkFest, our packet analysis and developer conference. We'll be hanging out with interesting people from diverse backgrounds in the industry and we'll also learn why the truth is always in the packets. Support this podcast: <a href=\"https://podcasters.spotify.com/pod/show/sharkbytes/support\" rel=\"payment\">https://podcasters.spotify.com/pod/show/sharkbytes/support</a>",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [
+    "https://pubsubhubbub.appspot.com/"
+  ],
+  "is_podcast": true,
+  "is_push": true,
+  "item_count": 8,
+  "last_updated": "2023-06-29T15:00:00+00:00",
+  "score": 2,
+  "self_url": "https://anchor.fm/s/d4b7d750/podcast/rss",
+  "site_name": "",
+  "site_url": "",
+  "title": "SharkBytes Podcast",
+  "url": "https://anchor.fm/s/d4b7d750/podcast/rss",
+  "velocity": 0.025,
+  "version": "rss20"
+}

modules/ports.nix

@@ -47,9 +47,11 @@ let
     lib.mkIf portCfg.visibleTo.wan {
       "upnp-forward-${port}" = {
         description = "forward port ${port} from upstream gateway to this host";
-        serviceConfig.Type = "oneshot";
         restartTriggers = [(builtins.toJSON portCfg)];
 
+        serviceConfig.Type = "oneshot";
+        serviceConfig.TimeoutSec = "6min";
+
         after = [ "network.target" ];
         wantedBy = [ "upnp-forwards.target" ];
         script =
@@ -120,9 +122,9 @@ in
       systemd.timers.upnp-forwards = {
         wantedBy = [ "network.target" ];
         timerConfig = {
-          OnStartupSec = "1min";
+          OnStartupSec = "75s";
           OnCalendar = cfg.upnpRenewInterval;
-          RandomizeDelaySec = "2min";
+          RandomizeDelaySec = "30s";
           Unit = "upnp-forwards.target";
         };
       };

modules/programs.nix

@@ -231,8 +231,10 @@ in
           (lib.mapAttrs' (pkgName: _pkg: { name = "cacert.${pkgName}"; value = {}; }) pkgs.cacert)
           (lib.mapAttrs' (pkgName: _pkg: { name = "gnome.${pkgName}"; value = {}; }) pkgs.gnome)
           (lib.mapAttrs' (pkgName: _pkg: { name = "libsForQt5.${pkgName}"; value = {}; }) pkgs.libsForQt5)
+          (lib.mapAttrs' (pkgName: _pkg: { name = "mate.${pkgName}"; value = {}; }) pkgs.mate)
           (lib.mapAttrs' (pkgName: _pkg: { name = "plasma5Packages.${pkgName}"; value = {}; }) pkgs.plasma5Packages)
           (lib.mapAttrs' (pkgName: _pkg: { name = "python3Packages.${pkgName}"; value = {}; }) pkgs.python3Packages)
+          (lib.mapAttrs' (pkgName: _pkg: { name = "sane-scripts.${pkgName}"; value = {}; }) pkgs.sane-scripts)
           (lib.mapAttrs' (pkgName: _pkg: { name = "sway-contrib.${pkgName}"; value = {}; }) pkgs.sway-contrib)
         ];
       }

modules/services/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./dyn-dns.nix
+    ./eg25-manager.nix
     ./kiwix-serve.nix
     ./mautrix-signal.nix
     ./nixserve.nix

modules/services/eg25-manager.nix

@@ -0,0 +1,19 @@
+# eg25-manager: <https://gitlab.com/mobian1/eg25-manager>
+# - used by sxmo, in <configs/default_hooks/sxmo_hook_restart_modem_daemons.sh>
+# - requires modemmanager (ModemManager.service)
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.services.eg25-manager;
+in
+{
+  options.sane.services.eg25-manager = {
+    enable = lib.mkEnableOption "Quectel EG25 modem manager service";
+  };
+  config = lib.mkIf cfg.enable {
+    # eg25-manager package ships udev rules *and* a systemd service.
+    # for that reason, i think it needs to be on the system path for the systemd service to be enabled.
+    systemd.packages = [ pkgs.eg25-manager ];
+    services.udev.packages = [ pkgs.eg25-manager ];
+    systemd.services.eg25-manager.wantedBy = [ "multi-user.target" ];
+  };
+}

nixpatches/2023-05-31-toplevel-alsa.patch

@@ -1,14 +0,0 @@
-diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
-index d188ecdda55..69174ba7dc7 100644
---- a/pkgs/top-level/all-packages.nix
-+++ b/pkgs/top-level/all-packages.nix
-@@ -26607,7 +26607,8 @@ with pkgs;
- 
-   tinyalsa = callPackage ../os-specific/linux/tinyalsa { };
- 
--  inherit (callPackage ../os-specific/linux/alsa-project { })
-+  alsa-project = callPackage ../os-specific/linux/alsa-project { };
-+  inherit (alsa-project)
-     alsa-firmware
-     alsa-lib
-     alsa-oss

nixpatches/flake.nix

@@ -15,9 +15,15 @@
       patchedFlakeFor = system: import "${patchedPkgsFor system}/flake.nix";
       patchedFlakeOutputsFor = system:
         (patchedFlakeFor system).outputs { inherit self; };
+
+      extractBuildPlatform = nixosSystemArgs:
+        let
+          firstMod = builtins.head nixosSystemArgs.modules;
+        in
+          firstMod.nixpkgs.buildPlatform or nixosSystemArgs.system;
     in
     {
-      lib.nixosSystem = args: (patchedFlakeOutputsFor args.system).lib.nixosSystem args;
+      lib.nixosSystem = args: (patchedFlakeOutputsFor (extractBuildPlatform args)).lib.nixosSystem args;
 
       legacyPackages = builtins.mapAttrs
         (system: _:

nixpatches/list.nix

@@ -20,6 +20,13 @@ let
     );
 in [
 
+  # (fetchpatch' {
+  #   # TODO: check back in on this around 2023-10-01
+  #   title = "libkiwix: 12.0.0 -> 12.1.0";
+  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/246700";
+  #   hash = "sha256-LyTkWNgG1mynCdckKm3Hj9ifzLemyrhJ9BFVaPppwgw=";
+  # })
+
   # (fetchpatch' {
   #   # XXX: doesn't cleanly apply; fetch `firefox-pmos-mobile` branch from my git instead
   #   title = "firefox-pmos-mobile: init at -pmos-2.2.0";
@@ -58,15 +65,15 @@ in [
   #   hash = "sha256-oQEM3EZfAOmfZzDu9faCqyOFZsdHYGn1mVBgkxt68Zg=";
   # })
   (fetchpatch' {
-    saneCommit = "c3becd7cdf144d85d12e2e76663e9549a0536efd";
     title = "firefox-pmos-mobile: init at 4.0.2";
+    saneCommit = "c3becd7cdf144d85d12e2e76663e9549a0536efd";
     hash = "sha256-NRh2INUMA2K7q8zioqKA7xwoqg7v6sxpuJRpTG5IP1Q=";
   })
 
-  # splatmoji: init at 1.2.0
   (fetchpatch' {
-    saneCommit = "75149039b6eaf57d8a92164e90aab20eb5d89196";
+    title = "splatmoji: init at 1.2.0";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/211874";
+    saneCommit = "75149039b6eaf57d8a92164e90aab20eb5d89196";
     hash = "sha256-jDXYLlXaEBKMrZ2dgxc6ucrcX/5dtqoIIKw+Ay19vlc=";
   })
 
@@ -77,7 +84,7 @@ in [
   #   hash = "sha256-eTwEbVULYjmOW7zUFcTUqvBZqUFjHTKFhvmU2m3XQeo=";
   # })
 
-  ./2022-12-19-i2p-aarch64.patch
+  # ./2022-12-19-i2p-aarch64.patch
 
   # fix for CMA memory leak in mesa: <https://gitlab.freedesktop.org/mesa/mesa/-/issues/8198>
   # fixed in mesa 22.3.6: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/21330/diffs>
@@ -87,18 +94,15 @@ in [
   # upgrade to 22.3.6 instead
   # ./2023-02-28-mesa-22.3.6.patch
 
-  # fix qt6.qtbase and qt6.qtModule to cross-compile.
-  # unfortunately there's some tangle that makes that difficult to do via the normal `override` facilities
-  ./2023-03-03-qtbase-cross-compile.patch
 
   # let ccache cross-compile
   # TODO: why doesn't this apply?
   # ./2023-03-04-ccache-cross-fix.patch
 
-  # 2023-04-11: bambu-studio: init at 01.06.02.04
   (fetchpatch' {
+    title = "bambu-studio: init at 01.06.02.04";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/206495";
-    hash = "sha256-XG4hvHXmP/wgiKuNRCAfttaGLrg/6mAOr+YvAVmycKQ=";
+    hash = "sha256-Z+IOzd+bnxjg6neF1YcrRDTzz9GhJfbbj0Wa8yTXsa4=";
   })
 
   # (fetchpatch' {
@@ -140,43 +144,84 @@ in [
   #   hash = "sha256-MNG8C0OgdPnFQ8SF2loiEhXJuP2z4n9pkXr8Zh4X7QU=";
   # })
 
+  # 2023-08-06: conky wayland + cross compilation patches.
+  # nix path-info shows clean
+  # branch is wip-conky-cross2 on servo
+  # factoring out those feature abstractions was possibly overkill.
+  # the manual wayland-scanner patching is unfortunate, but within
+  #   acceptable norms of the existing package.
   (fetchpatch' {
-    title = "conky: support wayland";
-    # saneCommit = "82978099c3a0d5fb4925351da1b0e2598503dc6c";
-    # hash = "sha256-lnDGEDhmeOIXfFnizEIVUiUzI7nMvpoCERbdjhR+Bto=";
-    saneCommit = "3ad928e20b498444e3a106b182e09317cea9a11f";
-    hash = "sha256-lvIASvQWVFbjHsQwO2EhEBUTSq1UkHvriaZZ2iS0ulU=";
+    title = "conky: factor out an abstraction for feature flags";
+    saneCommit = "3ddf13038d6df90ad0db36a41d55e4077818a3e9";
+    hash = "sha256-CjLzndFEH1Ng9CqKX8gxCJ6n/wFv5U/sHnQE0FMYILc=";
+  })
+  (fetchpatch' {
+    title = "conky: simplify the features even more";
+    saneCommit = "1c4aa404743f1ae7d5b95f18a96c4057ca251a96";
+    hash = "sha256-0zhiw9siIkFgFW4sow+X88NBEa3ggCe1t1HJ5xFH4ac=";
+  })
+  (fetchpatch' {
+    title = "conky: support cross compilation";
+    saneCommit = "01e607e11c7e5bbbfe6ad132fb72394ec29dab0a";
+    hash = "sha256-Bm/XFLvE7gEyLPlBWNSAcU3qwwqKLIRdpoe0/1aHUho=";
+  })
+  (fetchpatch' {
+    title = "conky: add wayland support";
+    saneCommit = "84c51f67e02ebc7f118fd3171bd10f1978d4f1e6";
+    hash = "sha256-gRYbkzCe3q1R7X/FeOcz/haURQkeAfmED1/ZQlCCdWE=";
+  })
+  (fetchpatch' {
+    title = "conky: remove no-op sed patch";
+    saneCommit = "e8b19984a2858ca24b7e8f5acd20be8b7dfe1af0";
+    hash = "sha256-K3mG1kcyB7sQZ7ZRCdlinNsV6mCcl3eIUI2ldSmcbJE=";
   })
 
   # (fetchpatch' {
-  #   title = "hare-json: init at unstable-2023-01-31";
-  #   saneCommit = "260f9c6ac4e3564acbceb46aa4b65fbb652f8e23";
-  #   hash = "sha256-bjLKANo0+zaxugJlEk1ObPqRHWOKptD7dXB+/xzsYqA=";
+  #   title = "gtk3: compile schemas even when cross compiling";
+  #   saneCommit = "5ee69670071f583bdffe2718dc46763fa1698f92";
+  #   hash = "sha256-ZX3lY63qUW2XuwCoxffbLYoFxckDImKy+S8mqlYJcvk=";
+  # })
+  # (fetchpatch' {
+  #   title = "gtk4: compile schemas even when cross compiling";
+  #   saneCommit = "7a1c5e3a5d1ff82c8afa659c7f903d5309d5de6a";
+  #   hash = "sha256-Tz8NBcIqGE9rCqbOrixgbvApYDEAHWCg4lZbklL/xXc=";
+  # })
+  (fetchpatch' {
+    title = "gtk{3,4}: compile schemas even when cross compiling";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/247844";
+    hash = "sha256-1CsjLgMvX0Lx500UDzal5HZi78hb7zBcb+AlNPF6NvA=";
+  })
+
+  # (fetchpatch' {
+  #   title = "hare-json: init at unstable-2023-02-25";
+  #   saneCommit = "6c88c2b087755e8f60c9f61c6361dec2f7a38155";
+  #   hash = "sha256-9TTlhwLDZESaFC02k4+YER+NvoNVPz9wFYV79+Dmuxs=";
   # })
   # (fetchpatch' {
   #   title = "hare-ev: init at unstable-2022-12-29";
-  #   saneCommit = "4058200a407c86c5d963bc49b608aa1a881cbbf2";
-  #   hash = "sha256-wm1aavbCfxBhcOXh4EhFO4u0LrA9tNr0mSczHUK8mQU=";
+  #   saneCommit = "1761049e9b8620091f29bf864ecbbf204b0c56b4";
+  #   hash = "sha256-H2ekBJx/iRX8E4uVmdEyaAZVhqeM25QbwvQ9Ki7fMQ0=";
   # })
   # (fetchpatch' {
   #   title = "bonsai: init at 1.0.0";
-  #   saneCommit = "65d37294d939384e8db400ea82d25ce8b4ad6897";
-  #   hash = "sha256-2easgOtJfzvVcz/3nt3lo1GKLLotrM4CkBRyTgIAhHU=";
+  #   saneCommit = "507252828934c73c7cffe255dae237c041676c27";
+  #   hash = "sha256-HwycOd3v4IifdQqQmMP6w14g0E/T9RAjAw41AsUZQoc=";
   # })
   (fetchpatch' {
+    # includes hare-json and hare-ev as pre-reqs
     title = "bonsai: init at 1.0.0";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/233892";
-    hash = "sha256-HqtDgisbR0xOUY4AxhzEv+2JJMPyQMawKo6nbd9pxhE=";
+    hash = "sha256-HaTr7GBCfK1I2e7K4k2dUGZ6hZf4PwtEFobLaSz262M=";
   })
 
   # make alsa-project members overridable
-  ./2023-05-31-toplevel-alsa.patch
-
-  # qt6 qtwebengine: specify `python` as buildPackages
-  ./2023-06-02-qt6-qtwebengine-cross.patch
-
-  # Jellyfin: don't build via `libsForQt5.callPackage`
-  ./2023-06-06-jellyfin-no-libsForQt5-callPackage.patch
+  (fetchpatch' {
+    title = "alsa-project: expose the scope as a top-level package to support overrides";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246656";
+    saneCommit = "28f76deae50cc53f5f6a5e846e04426357b8ce2e";
+    # hash = "sha256-dBWStotLBa4LN7JmriTzoFX3/SQr/qxGO8glv3MNyZQ=";
+    hash = "sha256-QvurEnupAdPVVnHYl4DC1OqJronGt31REkTJO/alr60=";
+  })
 
   # pin to a pre-0.17.3 release
   # removing this and using stock 0.17.3 (also 0.17.4) causes:
@@ -189,24 +234,18 @@ in [
   # related: <https://github.com/NixOS/nixpkgs/issues/236890#issuecomment-1585030861>
   # ./2023-06-10-lemmy-downgrade.patch
 
-  # (fetchpatch' {
-  #   title = "gpodder: wrap with missing `xdg-utils` path";
-  #   saneCommit = "10d0ac11bc083cbcf0d6340950079b3888095abf";
-  #   hash = "sha256-cu8L30ZiUJnWFGRR/SK917TC7TalzpGkurGkUAAxl54=";
-  # })
-
   (fetchpatch' {
     title = "koreader: 2023.04 -> 2023.05.1";
     saneCommit = "a5c471bd263abe93e291239e0078ac4255a94262";
     hash = "sha256-38sND/UNRj5WAYYKpzdrRBIOK4UAT14RzbIv49KmNNw=";
   })
 
-  (fetchpatch' {
-    # TODO: send this upstream!
-    title = "mepo: 1.1 -> 1.1.2";
-    saneCommit = "eee68d7146a6cd985481cdd8bca52ffb204de423";
-    hash = "sha256-uNerTwyFzivTU+o9bEKmNMFceOmy2AKONfKJWI5qkzo=";
-  })
+  # (fetchpatch' {
+  #   title = "mepo: 1.1 -> 1.1.2";
+  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/247866";
+  #   saneCommit = "eee68d7146a6cd985481cdd8bca52ffb204de423";
+  #   hash = "sha256-uNerTwyFzivTU+o9bEKmNMFceOmy2AKONfKJWI5qkzo=";
+  # })
 
   (fetchpatch' {
     title = "gthumb: make the webservices feature be optional";
@@ -221,6 +260,128 @@ in [
     hash = "sha256-rD0es4uUbaLMrI9ZB2HzPmRLyu/ixNBLAFyDJtFHNko=";
   })
 
+  # (fetchpatch' {
+  #   title = "perlPackages.FileBaseDir: 0.08 -> 0.09";
+  #   saneCommit = "acc990b04bbe8c99587eadccc65f100c326ec204";
+  #   hash = "sha256-8s789GGARJH1i088OGBjGGnL2l5m8Q+iBPS213QsS6A=";
+  # })
+  # (fetchpatch' {
+  #   title = "perlPackages.TestFile: 1.443 -> 1.993";
+  #   saneCommit = "6cf080fb51d034f9c2ddd60cef7dee7d041afd3e";
+  #   hash = "sha256-fAZpduh3JZeFixJ4yX0wkh/GRp0gYKsTT+XkNdpK7CU=";
+  # })
+  (fetchpatch' {
+    title = "xdg-utils: enable cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246954";
+    saneCommit = "b7aa5e0c1ec06723cf1594de192703a65be21497";
+    hash = "sha256-5iYzyjVlye7mhwhlZOHucVod/aPT3OrXolC9jAnB544=";
+  })
+  # (fetchpatch' {
+  #   # N.B.: duplicates outstanding, merged PR: <https://github.com/NixOS/nixpkgs/pull/246362>
+  #   # - also a stale, approved PR: <https://github.com/NixOS/nixpkgs/pull/245761>
+  #   title = "libgudev: support cross compilation";
+  #   saneCommit = "4dc30718fe01e9dbed4ffc2ff375148da218e86b";
+  #   hash = "sha256-Nb2LphSyv8Dayqfwqfua0eKtNzsnaf7PC/KYUhIvnT8=";
+  # })
+  (fetchpatch' {
+    title = "gupnp: fix cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246931";
+    saneCommit = "3af24c9e517689d048bb62511c6e8acf9bc55684";
+    hash = "sha256-I/+ArctOngrxacaMk82GODaodwSzmy+rh6q0J6KjMwA=";
+  })
+  (fetchpatch' {
+    title = "blueman: support cross compilation";
+    saneCommit = "e070195bdf213dffb0164574397b6a7417f81c9e";
+    hash = "sha256-6JnIJCVBbV4tmFinX7Qv2wO2AThrgxrnyb9T4Ov6p5w=";
+  })
+  # (fetchpatch' {
+  #   # N.B.: duplicates merged PR: <https://github.com/NixOS/nixpkgs/pull/246369>
+  #   title = "tracker: support cross compilation";
+  #   saneCommit = "bea390fd0c4fda96db5b1fad06ee071a10561305";
+  #   hash = "sha256-Y2tVoTvSIIT9ufghqqsXgmqWq9daH+WKj4JHZgWbWwE=";
+  # })
+  (fetchpatch' {
+    title = "tracker-miners: support cross compilation";
+    saneCommit = "24b062309ea8baa2d8303c0610c9ec7b8c399e8b";
+    hash = "sha256-Jj+1z2DeCEY+DqI1J4vYjYJwDDMRcA93CqpZSXzG0wE=";
+  })
+  (fetchpatch' {
+    title = "iio-sensor-proxy: support cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246947";
+    saneCommit = "dc1c3341fef6c64d5fbc983670819cf7932f5be1";
+    # hash = "sha256-lSVGjNepRLMfLgaAG3zv/BfoEhJg8yX7EqaCgu8/b8I=";
+    hash = "sha256-0rO+qkWgdrZsuHnoRdQ0SqEEW+PYcJaLixrOgJSOssk=";
+  })
+  (fetchpatch' {
+    title = "mpvScripts.mpris: support cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/247087";
+    saneCommit = "f7cd92e2afa26852ccf53f8ca59c13d82bf7bf64";
+    # hash = "sha256-MB3qloOW4pXZmbCIVsUKP2DnPoePmBf+qRc2x/o+nDw=";
+    hash = "sha256-uMbnfO0WY2/AFpvvnHQGKVSTE2rPrm3SCef4f04Bt78=";
+  })
+  (fetchpatch' {
+    title = "clapper: support cross compilation";
+    saneCommit = "8a171b49aca406f8220f016e56964b3fae53a3df";
+    hash = "sha256-R11IYatGhSXxZnJxJid519Oc9Kh56D9NT2/cxf2CLuM=";
+  })
+  (fetchpatch' {
+    title = "gcr_4: support cross compilation";
+    saneCommit = "a8c3d69236fa67382a8c18cc1ef0f34610fd3275";
+    hash = "sha256-UnLqkkpXxBKaqlsoD1jUIigZkxgLtNpjmMHOx10HpfE=";
+  })
+  (fetchpatch' {
+    title = "networkmanager-openvpn: support cross compilation";
+    saneCommit = "6f53c267fbeb2ff543f075032a7e73af2d4bcb9e";
+    hash = "sha256-gq9AyKH7/k2ZVSZ3jpPJPt3uAM+CllXQnaiC1tE1r/8=";
+  })
+  (fetchpatch' {
+    title = "WIP: networkmanager-sstp: support cross compilation";
+    saneCommit = "6de63fe320406ec9a509db721c52b3894a93bda2";
+    hash = "sha256-EY3bQuv/80JbpquUJhc89CcYAgN9A9KkpsSitw/684I=";
+  })
+  (fetchpatch' {
+    title = "WIP: networkmanager-l2tp: support cross compilation";
+    saneCommit = "7a4191c570b0e5a1ab257222c26a4a2ecb945037";
+    hash = "sha256-FiPJhHGqZ8MFwLY+1t6HgbK6ndomFSYUKvApvrikRHE=";
+  })
+  (fetchpatch' {
+    title = "gtkspell2: support cross compilation";
+    saneCommit = "56348833b4411e9fe2016c24c7fc4af1e3c1d28a";
+    hash = "sha256-0RMxouOBw7SUmQDLB2qGey714DaM0AOvZlZ5nB+Lkc4=";
+  })
+  (fetchpatch' {
+    title = "libgnt: 2.14.1 -> 2.14.3";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246937";
+    saneCommit = "ecd423195d72036a209912868ad02742cb4b6fcd";
+    # hash = "sha256-u4V/UHNtd2c3+FppuJ5LeLNSV8ZaLe8cqj8HmcW2a/0=";
+    hash = "sha256-cGhJSby0K+e1hKPdPZjLFRKvwjGaTbq/kb6Fxj2v8g8=";
+  })
+  (fetchpatch' {
+    title = "pidgin: support cross compilation";
+    saneCommit = "caacbcc54e217f5ee9281422777a7f712765f71a";
+    hash = "sha256-PDCp4GOm6hWcRob4kz7qXZfxAF6YbYrESx9idoS3e/s=";
+  })
+
+  (fetchpatch' {
+    title = "mate.engrampa: support cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/247841";
+    saneCommit = "3c76cdaf837f48861e4c3347b480c9a18b5b4a72";
+    hash = "sha256-rT0CBTOFxHQAvxqjWeNRJ2jenDuNRSo+gVDoPFKzHSM=";
+  })
+
+  (fetchpatch' {
+    title = "dtrx: 8.5.1 -> 8.5.3";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/246282";
+    saneCommit = "eba9bbc251db942ae27f87824cae643b5f3198c2";
+    # hash = "sha256-wgpjUXQ/ZnRY5AJ9xOL2BToA7hDaokDiMmPkMt0Y5go=";
+    hash = "sha256-awUDlibmxcJcdMZeBXcWR1U+P/GCxCH/lalhwZ5Er90=";
+  })
+  # (fetchpatch' {
+  #   title = "dtrx: don't double-wrap the binary";
+  #   saneCommit = "97a9d12b6c31a58e9067eae7cdcd3f53055c124c";
+  #   hash = "sha256-g+p96OrBOQAwwH7nwHBuM/KGeIrnBzh9u9lL0M0sYWo=";
+  # })
+
   # (fetchpatch' {
   #   # N.B.: compiles, but runtime error on launch suggestive of some module not being shipped
   #   title = "matrix-appservice-irc: 0.38.0 -> 1.0.0";
@@ -234,4 +395,14 @@ in [
   ./02-rpi4-uboot.patch
 
   # ./07-duplicity-rich-url.patch
+
+  # fix qt6.qtbase and qt6.qtModule to cross-compile.
+  # unfortunately there's some tangle that makes that difficult to do via the normal `override` facilities
+  # ./2023-03-03-qtbase-cross-compile.patch
+
+  # qt6 qtwebengine: specify `python` as buildPackages
+  # ./2023-06-02-qt6-qtwebengine-cross.patch
+
+  # Jellyfin: don't build via `libsForQt5.callPackage`
+  # ./2023-06-06-jellyfin-no-libsForQt5-callPackage.patch
 ]

overlays/all.nix

@@ -5,6 +5,7 @@
 final: prev:
 let
   pkgs = import ./pkgs.nix;
+  preferences = import ./preferences.nix;
   disable-flakey-tests = import ./disable-flakey-tests.nix;
   optimizations = import ./optimizations.nix;
   cross = import ./cross.nix;
@@ -18,6 +19,7 @@ let
 in
   renderOverlays [
     pkgs
+    preferences
     disable-flakey-tests
     (ifCross optimizations)
     (ifCross cross)

overlays/disable-flakey-tests.nix

@@ -4,200 +4,87 @@
 # - they assume a particular architecture (e.g. x86) whereas i compile on multiple archs.
 # - they assume too much about their environment and fail under qemu.
 #
-(next: prev: {
-  ell = prev.ell.overrideAttrs (_upstream: {
-    # 2023/02/11
-    # fixes "TEST FAILED in get_random_return_callback at unit/test-dbus-message-fds.c:278: !l_dbus_message_get_error(message, ((void *)0), ((void *)0))"
-    # 2023/04/06
-    # fixes "test-cipher: unit/test-cipher.c:102: test_aes_ctr: Assertion `!r' failed."
-    # unclear *why* this test fails.
+(next: prev:
+let
+  dontCheck = p: p.overrideAttrs (_: {
+    doCheck = false;
+    doInstallCheck = false;
+  });
+  aarch64Only = f: p: p.overrideAttrs (upstream:
+    next.lib.optionalAttrs
+      (p.stdenv.targetPlatform.system == "aarch64-linux")
+      (f upstream)
+  );
+  emulatedOnly = f: p: p.overrideAttrs (upstream:
+    next.lib.optionalAttrs
+      (p.stdenv.targetPlatform.system == "aarch64-linux" && p.stdenv.buildPlatform.system == "aarch64-linux")
+      (f upstream)
+  );
+  dontCheckAarch64 = aarch64Only (_: {
+    # only `dontCheck` if the package is being built for aarch64
+    doCheck = false;
+    doInstallCheck = false;
+  });
+  dontCheckEmulated = emulatedOnly (_: {
     doCheck = false;
   });
-  # fish = prev.fish.overrideAttrs (_upstream: {
-  #   # 2023/02/28
-  #   # The following tests FAILED:
-  #   #     177 - sigint.fish (Failed)
-  #   #     241 - torn_escapes.py (Failed)
-  #   doCheck = false;
-  # });
-  # gjs = prev.gjs.overrideAttrs (_upstream: {
-  #   # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
-  #   doCheck = false;
-  # });
-  # gssdp = prev.gssdp.overrideAttrs (_upstream: {
-  #   # 2023/02/11
-  #   # fixes "ERROR:../tests/test-regression.c:429:test_ggo_7: assertion failed (error == NULL): Failed to set multicast interfaceProtocol not available (gssdp-error, 1)"
-  #   doCheck = false;
-  # });
-  # gupnp = prev.gupnp.overrideAttrs (_upstream: {
-  #   # 2023/02/22
-  #   # fixes "Bail out! ERROR:../tests/test-bugs.c:205:test_bgo_696762: assertion failed (error == NULL): Failed to set multicast interfaceProtocol not available (gssdp-erro>"
-  #   doCheck = false;
-  # });
-  # json-glib = prev.json-glib.overrideAttrs (_upstream: {
-  #   # 2023/02/11
-  #   # fixes: "15/15 json-glib:docs / doc-check    TIMEOUT        30.52s   killed by signal 15 SIGTERM"
-  #   doCheck = false;
-  # });
-  # lapack-reference = prev.lapack-reference.overrideAttrs (_upstream: {
-  #   # 2023/02/11: test timeouts
-  #   # > The following tests FAILED:
-  #   # >       93 - LAPACK-xlintstz_ztest_in (Timeout)
-  #   # >        98 - LAPACK-xeigtstz_svd_in (Timeout)
-  #   # >          99 - LAPACK-xeigtstz_zec_in (Timeout)
-  #   doCheck = false;
-  # });
-  # libadwaita = prev.libadwaita.overrideAttrs (_upstream: {
-  #   # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
-  #   doCheck = false;
-  # });
-  # libsecret = prev.libsecret.overrideAttrs (_upstream: {
-  #   # 2023/01/30: one test times out. probably flakey test that only got built because i patched mesa.
-  #   doCheck = false;
-  # });
-  # libuv = prev.libuv.overrideAttrs (_upstream: {
-  #   # 2023/02/11
-  #   # 2 tests fail:
-  #   # - not ok 261 - tcp_bind6_error_addrinuse
-  #   # - not ok 267 - tcp_bind_error_addrinuse_listen
-  #   doCheck = false;
-  # });
-  libwacom = prev.libwacom.overrideAttrs (_upstream: {
-    # 2023/03/30
-    # "libwacom:all / pytest TIMEOUT"
+in {
+  # 2023/07/27
+  # 4 tests fail when building `host-pkgs.moby.emulated.elfutils`
+  # it might be enough to only disable checks when targeting aarch64, which could reduce rebuilds?
+  elfutils = dontCheckAarch64 prev.elfutils;
+
+  # 2023/07/31
+  # tests just hang after mini-record-2
+  # only for binfmt-emulated aarch64 -> aarch64 build
+  gnutls = dontCheckEmulated prev.gnutls;
+
+  # 2023/07/31
+  # tests fail (not timeout), but only when cross compiling, and not on servo (so, due to binfmt?)
+  gupnp = dontCheck prev.gupnp;
+
+  # hangs during checkPhase (or maybe it just takes 20-30 minutes)
+  # libqmi = dontCheckEmulated prev.libqmi;
+
+  # 2023/07/28
+  # "7/7 libwacom:all / pytest                               TIMEOUT        30.36s   killed by signal 15 SIGTERM"
+  # N.B.: it passes on x86_64, but only if it's not CPU starved (i.e. nix build with -j1 if it fails)
+  libwacom = aarch64Only (_: {
     doCheck = false;
     mesonFlags = [ "-Dtests=disabled" ];
-  });
-
-  # llvmPackages_12 =
-  #   let
-  #     tools = prev.llvmPackages_12.tools.extend (self: super: {
-  #       libllvm = super.libllvm.overrideAttrs (upstream: {
-  #         # 2023/02/21: fix: "FAIL: LLVM-Unit :: ExecutionEngine/MCJIT/./MCJITTests/MCJITTest.return_global (2857 of 42084)"
-  #         # - nix log /nix/store/6vydavlxh1gvs0vmrkcx9qp67g3h7kcz-llvm-12.0.1.drv
-  #         # - wanted by sequoia, rav1e, rustc-1.66.1  (is this right?)
-  #         doCheck = false;
-  #         # upstream sets this with `rec`; TODO: have upstream refer to the final overrideAttrs version of the derivation instead of using rec.
-  #         cmakeFlags = next.lib.remove "-DLLVM_BUILD_TESTS=ON" upstream.cmakeFlags;
-  #       });
-  #     });
-  #   in
-  #     # see <nixpkgs:pkgs/development/compilers/llvm/12/default.nix>
-  #     # - we copy their strategy / attrset mutilation
-  #     prev.llvmPackages_12 // { inherit tools; } // tools;
-
-  # llvmPackages_14 =
-  #   let
-  #     tools = prev.llvmPackages_14.tools.extend (self: super: {
-  #       libllvm = super.libllvm.overrideAttrs (upstream: {
-  #         # 2023/02/21: fix: "FAIL: LLVM-Unit :: ExecutionEngine/MCJIT/./MCJITTests/MCJITMultipleModuleTest.two_module_global_variables_case (43769 of 46988)"
-  #         # - nix log /nix/store/ib2yw6sajnhlmibxkrn7lj7chllbr85h-llvm-14.0.6.drv
-  #         # - wanted by clang-11-12-LLVMgold-path, compiler-rt-libc-12.0.1, clang-wrapper-12.0.1  (is this right?)
-  #         doCheck = false;
-  #         # upstream sets this with `rec`; TODO: have upstream refer to the final overrideAttrs version of the derivation instead of using rec.
-  #         cmakeFlags = next.lib.remove "-DLLVM_BUILD_TESTS=ON" upstream.cmakeFlags;
-  #       });
-  #     });
-  #   in
-  #     # see <nixpkgs:pkgs/development/compilers/llvm/14/default.nix>
-  #     # - we copy their strategy / attrset mutilation
-  #     prev.llvmPackages_14 // { inherit tools; } // tools;
-
-  # llvmPackages_15 =
-  #   let
-  #     tools = prev.llvmPackages_15.tools.extend (self: super: {
-  #       libllvm = super.libllvm.override {
-  #         # 2023/02/21: fix: "FAIL: LLVM-Unit :: ExecutionEngine/MCJIT/./MCJITTests/..."
-  #         # llvm15 passes doCheck as a call arg, so we don't need to set cmakeFlags explicitly as in previous versions
-  #         doCheck = false;
-  #       };
-  #     });
-  #   in
-  #     prev.llvmPackages_15 // { inherit tools; } // tools;
-
-  # modemmanager = prev.modemmanager.overrideAttrs (_upstream: {
-  #   # 2023/02/25
-  #   # "ERROR:test-modem-helpers.c:257:test_cmgl_response: assertion failed: (list != NULL)"
-  #   doCheck = false;
-  #   doInstallCheck = false;  # tests are run during install check??
-  # });
+  }) prev.libwacom;
 
   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
     (py-next: py-prev: {
-      # ipython = py-prev.ipython.overridePythonAttrs (upstream: {
-      #   # > FAILED IPython/core/tests/test_debugger.py::test_xmode_skip - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip_disabled - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/core/tests/test_debugger.py::test_decorator_skip_with_breakpoint - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/core/tests/test_debugger.py::test_where_erase_value - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/terminal/tests/test_debug_magic.py::test_debug_magic_passes_through_generators - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   # > FAILED IPython/terminal/tests/test_embed.py::test_nest_embed - pexpect.exceptions.TIMEOUT: Timeout exceeded.
-      #   disabledTestPaths = upstream.disabledTestPaths or [] ++ [
-      #     "IPython/core/tests/test_debugger.py"
-      #     "IPython/terminal/tests/test_debug_magic.py"
-      #     "IPython/terminal/tests/test_embed.py"
-      #   ];
-      # });
       pyarrow = py-prev.pyarrow.overridePythonAttrs (upstream: {
         # 2023/04/02
         # disabledTests = upstream.disabledTests ++ [ "test_generic_options" ];
-        disabledTestPaths = upstream.disabledTestPaths or [] ++ [
+        disabledTestPaths = (upstream.disabledTestPaths or []) ++ [
           "pyarrow/tests/test_flight.py"
         ];
       });
-      # pytest-xdist = py-prev.pytest-xdist.overridePythonAttrs (upstream: {
-      #   # 2023/02/19
-      #   # 4 tests fail:
-      #   # - FAILED: testing/test_remote.py::TestWorkInteractor::* - execnet.gateway_base.TimeoutError: no item after 10.0 seconds
-      #   # doCheck = false;
-      #   disabledTestPaths = upstream.disabledTestPaths or [] ++ [
-      #     "testing/test_remote.py"
-      #   ];
-      #   # disabledTests = upstream.disabledTests or [] ++ [
-      #   #   "test_basic_collect_and_runtests"
-      #   #   "test_remote_collect_fail"
-      #   #   "test_remote_collect_skip"
-      #   #   "test_runtests_all"
-      #   # ];
-      # });
-      # twisted = py-prev.twisted.overridePythonAttrs (upstream: {
-      #   # 2023/02/25
-      #   # ```
-      #   # [ERROR]
-      #   # Traceback (most recent call last):
-      #   #   File "/nix/store/dcnsxrn8rsfk1dghah7md5glbbnfysq3-python3.10-twisted-22.10.0/lib/python3.10/site-packages/twisted/test/test_udp.py", line 645, in test_interface
-      #   #     self.assertEqual(self.client.transport.getOutgoingInterface(), "0.0.0.0")
-      #   #   File "/nix/store/dcnsxrn8rsfk1dghah7md5glbbnfysq3-python3.10-twisted-22.10.0/lib/python3.10/site-packages/twisted/internet/udp.py", line 449, in getOutgoingInterface
-      #   #     i = self.socket.getsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_IF)
-      #   # builtins.OSError: [Errno 92] Protocol not available
-      #   #
-      #   # twisted.test.test_udp.MulticastTests.test_interface
-      #   # ```
-      #   postPatch = upstream.postPatch + ''
-      #     echo 'MulticastTests.test_interface.skip = "Protocol not available"'>> src/twisted/test/test_udp.py
-      #   '';
-      # });
+
+      # 2023/08/09: unclear why it fails; probably can remove after next nixpkgs update
+      pillow = py-prev.pillow.overridePythonAttrs (_upstream: {
+        format = "setuptools";
+      });
+
+      seaborn = py-prev.seaborn.overridePythonAttrs (upstream: {
+        # 2023/08/09
+        disabledTestPaths = (upstream.disabledTestPaths or []) ++ [
+          "tests/test_categorical.py"
+          "tests/test_core.py"
+        ];
+      });
     })
   ];
 
-  # strp = prev.srtp.overrideAttrs (_upstream: {
-  #   # 2023/02/11
-  #   # roc_driver test times out after 30s
-  #   doCheck = false;
-  # });
-  tracker = prev.tracker.overrideAttrs (_upstream: {
-    # 2023/02/22
-    # "27/37 tracker:core / service                          TIMEOUT         60.37s   killed by signal 15 SIGTERM"
-    doCheck = false;
-  });
-  # udisks2 = prev.udisks2.overrideAttrs (_upstream: {
-  #   # 2023/02/25
-  #   # "udisks-test:ERROR:test.c:61:on_completed_expect_failure: assertion failed (message == expected_message): ("Command-line `./udisks-test-helper 4' was signaled with signal SIGSEGV (11):\nstdout: `OK, deliberately causing a segfault\n'\nstderr: `qemu: uncaught target signal 11 (Segmentation fault) - core dumped\n'" == "Command-line `./udisks-test-helper 4' was signaled with signal SIGSEGV (11): OK, deliberately causing a segfault\n")"
-  #   doCheck = false;
-  # });
-  # upower = prev.upower.overrideAttrs (_upstream: {
-  #   # 2023/02/25
-  #   # "Tests.test_battery_state_guessing                          TIMEOUT        60.80s   killed by signal 15 SIGTERM"
-  #   doCheck = false;
-  # });
+  # 2023/02/22
+  # "27/37 tracker:core / service                          TIMEOUT         60.37s   killed by signal 15 SIGTERM"
+  tracker = dontCheck prev.tracker;
+
+  # 2023/07/31
+  # fails a test (didn't see which one)
+  # only for binfmt-emulated aarch64 -> aarch64 build
+  umockdev = dontCheckEmulated prev.umockdev;
 })

overlays/preferences.nix

@@ -0,0 +1,29 @@
+# personal preferences
+# prefer to encode these in `sane.programs`
+# resort to this method for e.g. system dependencies, or things which are referenced from too many places.
+(next: prev: {
+  pipewire = prev.pipewire.override {
+    # avoid a dep on python3.10-PyQt5, which has mixed qt5 versions.
+    # this means we lose firewire support (oh well..?)
+    ffadoSupport = false;
+  };
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (pySelf: pySuper: {
+      # TODO(2023/08/02): cryptography (a dependency of komikku -> keyring -> secretstorage -> cryptography) doesn't cross compile
+      # so disable it. can be re-enabled in next staging -> master merge.
+      # see:
+      # - <https://github.com/NixOS/nixpkgs/pull/245287/files>
+      # - <https://github.com/NixOS/nixpkgs/pull/244135>
+      keyring = (pySuper.keyring.override {
+        secretstorage = null;
+        jeepney = null;
+      }).overrideAttrs (upstream: {
+        postPatch = (upstream.postPatch or "") + ''
+          sed -i /SecretStorage/d setup.cfg
+          sed -i /jeepney/d setup.cfg
+        '';
+      });
+    })
+  ];
+})

pkgs/additional/bonsai/default.nix

@@ -18,6 +18,21 @@ stdenv.mkDerivation rec {
     hash = "sha256-jOtFUpl2/Aa7f8JMZf6g63ayFOi+Ci+i7Ac63k63znc=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace 'hare build' 'hare build $(HARE_TARGET_FLAGS)'
+  '';
+
+  env.HARE_TARGET_FLAGS =
+    if stdenv.hostPlatform.isAarch64 then
+      "-t aarch64"
+    else if stdenv.hostPlatform.isRiscV64 then
+      "-t riscv64"
+    else if stdenv.hostPlatform.isx86_64 then
+      "-t x86_64"
+    else
+      "";
+
   nativeBuildInputs = [
     hare
     hare-ev
@@ -31,7 +46,7 @@ stdenv.mkDerivation rec {
     # export ARFLAGS="-csr"
   '';
 
-  installFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";

pkgs/additional/chatty-latest/default.nix

@@ -0,0 +1,87 @@
+{ chatty
+, fetchFromGitLab
+, appstream-glib
+, desktop-file-utils
+, itstool
+, meson
+, ninja
+, pkg-config
+, python3
+# , wrapGAppsHook
+# , evolution-data-server
+, feedbackd
+, glibmm
+, gnome-desktop
+, gspell
+# , gtk3
+, json-glib
+, libgcrypt
+, libhandy
+, libphonenumber
+, modemmanager
+, olm
+, pidgin
+, protobuf
+, sqlite
+# NEW
+, evolution-data-server-gtk4
+, glib-networking
+, gtk4
+, libadwaita
+, wrapGAppsHook4
+}:
+chatty.overrideAttrs (upstream: {
+  pname = "chatty-latest";
+  version = "unstable-2023-08-01";
+  src = fetchFromGitLab {
+    domain = "source.puri.sm";
+    owner = "Librem5";
+    repo = "chatty";
+    rev = "ca556b7df539b37e08ed2c73e2beb2b6cc7b91f3";
+    hash = "sha256-Tzdai2VU9wh/HW52uB+9uzpQymZmTqwiGqB6N20IvxE=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = (upstream.postPatch or "") + ''
+    substituteInPlace build-aux/meson/postinstall.py \
+      --replace 'gtk-update-icon-cache' 'gtk4-update-icon-cache'
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    itstool
+    meson
+    ninja
+    pkg-config
+    python3
+    #wrapGAppsHook
+
+    # NEW
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    # evolution-data-server
+    feedbackd
+    glib-networking  # for TLS
+    glibmm
+    gnome-desktop
+    gspell
+    # gtk3
+    json-glib
+    libgcrypt
+    libhandy
+    libphonenumber
+    modemmanager
+    olm
+    pidgin
+    protobuf
+    sqlite
+
+    # NEW
+    libadwaita
+    gtk4
+    evolution-data-server-gtk4
+  ];
+})

pkgs/additional/eg25-manager/default.nix

@@ -0,0 +1,75 @@
+# package based on:
+# - <https://github.com/NixOS/mobile-nixos/pull/573>
+
+{ lib
+, stdenv
+, callPackage
+, fetchFromGitLab
+, gnugrep
+, meson
+, ninja
+, pkg-config
+, scdoc
+, curl
+, glib
+, libgudev
+, libusb1
+, modemmanager
+}:
+
+let
+  # eg25-manager needs to be made compatible with libgpiod 2.0 API. see:
+  # - <https://github.com/NixOS/mobile-nixos/pull/573#issuecomment-1666739462>
+  # - <https://gitlab.com/mobian1/eg25-manager/-/issues/45>
+  # nixpkgs libgpiod was bumped 2023-07-29:
+  # - <https://github.com/NixOS/nixpkgs/pull/246018>
+  libgpiod1 = callPackage ./libgpiod1.nix { };
+in
+stdenv.mkDerivation rec {
+  pname = "eg25-manager";
+  version = "0.4.6";
+
+  src = fetchFromGitLab {
+    owner = "mobian1";
+    repo = "eg25-manager";
+    rev = version;
+    hash = "sha256-2JsdwK1ZOr7ljNHyuUMzVCpl+HV0C5sA5LAOkmELqag=";
+  };
+
+  postPatch = ''
+    substituteInPlace 'udev/80-modem-eg25.rules' \
+      --replace '/bin/grep' '${gnugrep}/bin/grep'
+  '';
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    glib # Contains gdbus-codegen program
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    curl
+    glib
+    libgpiod1
+    libgudev
+    libusb1
+    modemmanager
+  ];
+
+  passthru = {
+    inherit libgpiod1;
+  };
+
+  meta = with lib; {
+    description = "Manager daemon for the Quectel EG25 mobile broadband modem";
+    homepage = "https://gitlab.com/mobian1/eg25-manager";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}

pkgs/additional/eg25-manager/libgpiod1.nix

@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchurl, autoreconfHook, autoconf-archive, pkg-config, kmod
+, enable-tools ? true
+, enablePython ? false, python3, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "libgpiod";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
+    hash = "sha256-gp1KwmjfB4U2CdZ8/H9HbpqnNssqaKYwvpno+tGXvgo=";
+  };
+
+  buildInputs = [ kmod ] ++ lib.optionals enablePython [ python3 ncurses ];
+  nativeBuildInputs = [
+    autoconf-archive
+    pkg-config
+    autoreconfHook
+  ];
+
+  configureFlags = [
+    "--enable-tools=${if enable-tools then "yes" else "no"}"
+    "--enable-bindings-cxx"
+    "--prefix=${placeholder "out"}"
+  ] ++ lib.optional enablePython "--enable-bindings-python";
+
+  meta = with lib; {
+    description = "C library and tools for interacting with the linux GPIO character device";
+    longDescription = ''
+      Since linux 4.8 the GPIO sysfs interface is deprecated. User space should use
+      the character device instead. This library encapsulates the ioctl calls and
+      data structures behind a straightforward API.
+    '';
+    homepage = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/about/";
+    license = licenses.lgpl2;
+    maintainers = [ maintainers.expipiplus1 ];
+    platforms = platforms.linux;
+  };
+}

pkgs/additional/firefox-extensions/browserpass-extension/default.nix

@@ -1,8 +1,8 @@
 { stdenv
 , fetchFromGitHub
 , fetchFromGitea
-, gnused
 , mkYarnModules
+, nodejs
 , zip
 }:
 
@@ -25,7 +25,8 @@ let
   #   sha256 = "sha256-dSRZ2ToEOPhzHNvlG8qdewa7689gT8cNB7nXkN3/Avo=";
   # };
   browserpass-extension-yarn-modules = mkYarnModules {
-    inherit pname version;
+    inherit version;
+    pname = "${pname}-modules";
     packageJSON = ./package.json;
     yarnLock = ./yarn.lock;
     # yarnNix is auto-generated. to update: leave unset, then query the package deps and copy it out of the store.
@@ -37,9 +38,20 @@ let
 in stdenv.mkDerivation {
   inherit pname version src;
 
+  nativeBuildInputs = [ nodejs zip ];
+
   postPatch = ''
     # dependencies are built separately: skip the yarn install
-    ${gnused}/bin/sed -i /yarn\ install/d src/Makefile
+    # prettier, lessc, browserify are made available here via the modules,
+    # which are for the host (even the devDependencies are compiled for the host).
+    # but we can just run those via the build node.
+    #
+    # alternative would be to patchShebangs in the node_modules dir.
+    substituteInPlace src/Makefile \
+      --replace "yarn install" "true" \
+      --replace '	$(PRETTIER)' '	node $(PRETTIER)' \
+      --replace '	$(LESSC)' '	node $(LESSC)' \
+      --replace '	$(BROWSERIFY)' '	node $(BROWSERIFY)'
   '';
 
   preBuild = ''
@@ -48,11 +60,12 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     pushd firefox
-    ${zip}/bin/zip -r $out ./*
+    zip -r $out ./*
     popd
   '';
 
   passthru = {
+    yarn-modules = browserpass-extension-yarn-modules;
     extid = "browserpass@maximbaz.com";
   };
 }

pkgs/additional/firefox-extensions/bypass-paywalls-clean/default.nix

@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
     ./0003-disable-metrics.patch
   ];
 
+  nativeBuildInputs = [ zip ];
+
   installPhase = ''
-    ${zip}/bin/zip -r $out ./*
+    zip -r $out ./*
   '';
 
   passthru = {

pkgs/additional/firefox-extensions/default.nix

@@ -29,7 +29,7 @@ let
     };
   in (stdenv.mkDerivation ({
     # heavily borrows from <repo:nixos/nixpkgs:pkgs/build-support/fetchfirefoxaddon/default.nix>
-    inherit (addon) name;
+    name = "${addon.name}-wrapped";
     unpackPhase = ''
       echo "patching firefox addon $name into $out/${extid}.xpi"
 
@@ -64,7 +64,7 @@ let
     '';
   } // args')).overrideAttrs (final: upstream: {
     passthru = (upstream.passthru or {}) // {
-      withAttrs = attrs: wrapAddon final.finalPackage attrs;
+      withAttrs = attrs: wrapAddon addon (args // attrs);
       withPostPatch = postPatch: final.passthru.withAttrs { inherit postPatch; };
       # given an addon, repackage it without some `perm`ission
       withoutPermission = perm: final.passthru.withPostPatch ''
@@ -92,9 +92,9 @@ in lib.makeScope newScope (self: with self; {
     ether-metamask = fetchAddon "ether-metamask" "webextension@metamask.io" "sha256-UI83wUUc33OlQYX+olgujeppoo2D2PAUJ+Wma5mH2O0=";
     i2p-in-private-browsing = fetchAddon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
     sidebery = fetchAddon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
-    sponsorblock = fetchAddon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-b/OTFmhSEUZ/CYrYCE4rHVMQmY+Y78k8jSGMoR8vsZA=";
+    sponsorblock = fetchAddon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-kIVx/Yl2IZ0/0RqLMf4+HJojoDA7oOUYwZfFvMt/2XE=";
     ublacklist = fetchAddon "ublacklist" "@ublacklist" "sha256-NZ2FmgJiYnH7j2Lkn0wOembxaEphmUuUk0Ytmb0rNWo=";
-    ublock-origin = fetchAddon "ublock-origin" "uBlock0@raymondhill.net" "sha256-EGGAA+cLUow/F5luNzFG055rFfd3rEyh8hTaL/23pbM=";
+    ublock-origin = fetchAddon "ublock-origin" "uBlock0@raymondhill.net" "sha256-i3NGi8IzoR3SiVIZRmOBeD0ZEjhX3Qtv0WoBgg/KSDQ=";
 
     # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
     # bypass-paywalls-clean = fetchAddon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
@@ -113,7 +113,8 @@ in lib.makeScope newScope (self: with self; {
       # XXX: i tried to build sponsorblock from source and patch this *before* it gets webpack'd,
       # but web shit is absolutely cursed and building from source requires a fucking PhD
       # (if you have one, feel free to share your nix package)
-      ${gnused}/bin/sed -i 's/default\.config\.userID)/default.config.userID && false)/' js/background.js
+      substituteInPlace js/background.js \
+        --replace 'default.config.userId)' 'default.config.userID && false)'
     '';
 
   ublacklist = wrapAddon unwrapped.ublacklist {};

pkgs/additional/fractal-latest/default.nix

@@ -1,18 +1,23 @@
 { fractal-next, fetchFromGitLab, rustPlatform }:
 
 (fractal-next.overrideAttrs (prev: rec {
-  version = "20221220";
+  pname = "fractal-latest";
+  version = "unstable-2023-07-28";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "fractal";
-    rev = "d394badd0bf36c43026e01dbeb1cd7f881cf3440";
-    hash = "sha256-JgLrDrMLEh7302tZ3NOJ12dCMiSxGgecaUjcuDPcGSg=";
+    rev = "dc66180a44e4e996db0e840dab0be08d826a5319";
+    hash = "sha256-SYkeHkNlxHbsd+kubGZO5PEA9mg9Id0pHDi/2MMGy90=";
   };
-  patches = [];
-  postPatch = "";
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    hash = "sha256-hHsMcU6s42yKn2+LkWraLDhnmWNY72dL2cJoy6uoOKI=";
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "matrix-sdk-0.6.2" = "sha256-ofaXdhkbDa7/tp/RdBQ1/JBaSims8znJ66NeRUhof20=";
+      "ruma-0.8.2" = "sha256-ZlevGTGL/DQVAYeR078I0cT/V1kaubhORgt1cZUhBqM=";
+      # "vodozemac-0.3.0" = "sha256-tAimsVD8SZmlVybb7HvRffwlNsfb7gLWGCplmwbLIVE=";
+      "x25519-dalek-1.2.0" = "sha256-AHjhccCqacu0WMTFyxIret7ghJ2V+8wEAwR5L6Hy1KY=";
+    };
   };
 }))

pkgs/additional/koreader-from-src/default.nix

@@ -11,34 +11,20 @@
 , fetchgit
 , fetchurl
 , dpkg
-, glib
-, gnutar
-, gtk3-x11
+, gettext
 , luajit
-# , lua51Packages
 , perl
 , pkg-config
 , python3
 , ragel
-, sdcv
 , SDL2
 , substituteAll
 , which
 }:
 let
   sources = import ./sources.nix;
-  # luajson = luajit_lua52.pkgs.buildLuarocksPackage {
-  #   pname = "luajson";
-  #   version = "1.3.4-1";
-  #   source = fetchgit {
-  #     url = "https://github.com/harningt/luajson.git";
-  #     rev = "1.3.4";
-  #     hash = "sha256-JaJsjN5Gp+8qswfzl5XbHRQMfaCAJpWDWj9DYWJ0gEI=";
-  #   };
-  # };
   luajit52 = luajit.override { enable52Compat = true; self = luajit52; };
   luaEnv = luajit52.withPackages (ps: with ps; [
-    luarocks  # TODO: needed?
     (buildLuarocksPackage {
       pname = "luajson";
       version = "1.3.4-1";
@@ -54,6 +40,15 @@ let
       propagatedBuildInputs = [ lpeg ];
     })
   ]);
+  crossTargets = {
+    # koreader-base Makefile targets to use when compiling for the given host platform
+    # only used when cross compiling
+    aarch64 = "debian-arm64";
+  };
+  target = if stdenv.buildPlatform == stdenv.hostPlatform then
+    "debian"
+  else
+    crossTargets."${stdenv.hostPlatform.parsed.cpu.name}";
 in
 stdenv.mkDerivation rec {
   pname = "koreader-from-src";
@@ -83,8 +78,7 @@ stdenv.mkDerivation rec {
   );
 
   patches = [
-    ./debug.patch
-    # ./mupdf_dir.patch  #< TODO: needed?
+    ./debug.patch  #< not needed to build, just helps debug packaging issues
     ./no_rm_build_dirs.patch
     ./lua-Spore-no-luajson.patch  #< TODO: test this at runtime! we ship luajson, but just don't expose it via luarocks...
     (substituteAll (
@@ -100,14 +94,15 @@ stdenv.mkDerivation rec {
   sourceRoot = "koreader";
 
   nativeBuildInputs = [
+    buildPackages.stdenv.cc  # TODO: move to depsBuildBuild?
     autoconf  # autotools is used by some thirdparty libraries
     automake
     autoPatchelfHook  # TODO: needed?
     cmake  # for koreader/base submodule
     dpkg
+    gettext
     git
     libtool
-    # lua51Packages.luarocks
     makeWrapper
     perl  # TODO: openssl might try to take a runtime dep on this; see nixpkg
     pkg-config
@@ -118,23 +113,16 @@ stdenv.mkDerivation rec {
     luaEnv.pkgs.luarocks
   ];
   buildInputs = [
-    glib  #< TODO: needed?
-    gnutar
-    gtk3-x11  #< TODO: needed?
-    # luajit_lua52
     # luajson
     luaEnv
-    sdcv  # TODO: remove this? KOreader builds (and ships) it itself
-    SDL2  # TODO: remove this? KOreader builds (but doesn't ship) it itself
   ];
 
   postPatch =
   let
     env = "${buildPackages.coreutils}/bin/env";
   in ''
-    # patchShebangs platform/debian/do_debian_package.sh
-
     substituteInPlace ../openssl/config --replace '/usr/bin/env' '${env}'
+    substituteInPlace ../openssl/Configure --replace '/usr/bin/env' '${env}'
 
     chmod +x ../glib/gio/gio-querymodules-wrapper.py
     chmod +x ../glib/gio/tests/gengiotypefuncs.py
@@ -154,6 +142,9 @@ stdenv.mkDerivation rec {
     substituteInPlace ../glib/glib/gtester-report.in --replace '/usr/bin/env @PYTHON@' '@PYTHON@'
     substituteInPlace ../glib/gobject/glib-genmarshal.in --replace '/usr/bin/env @PYTHON@' '@PYTHON@'
     substituteInPlace ../glib/gobject/glib-mkenums.in --replace '/usr/bin/env @PYTHON@' '@PYTHON@'
+
+    substituteInPlace ../harfbuzz/autogen.sh --replace 'which pkg-config' 'which $PKG_CONFIG'
+    substituteInPlace ../fribidi/autogen.sh --replace 'which pkg-config' 'which $PKG_CONFIG'
   '';
 
   dontConfigure = true;
@@ -207,26 +198,29 @@ stdenv.mkDerivation rec {
     (name: src:
       let
         # for machine-agnostic libraries (e.g. pure lua), koreader doesn't build them in a flavored directory
-        machine = if src.machineAgnostic or false then "" else "x86_64-unknown-linux-gnu";
+        machine = if src.machineAgnostic or false then "" else stdenv.hostPlatform.config;
       in
         ''install_lib "${name}" "${src.source.rev}" "${machine}"''
     )
     sources.thirdparty
   ) + ''
 
-    make TARGET=debian DEBIAN=1 SHELL=sh VERBOSE=1
+    make TARGET=${target} DEBIAN=1 SHELL=sh VERBOSE=1
   '';
-  # XXX: ^ don't specify INSTALL_DIR="$out" as make arg because that conflicts with vars used by third-party libs
-  # might be safe to specify that as an env var, though?
+  env = lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+    CHOST = stdenv.hostPlatform.config;
+  };
 
   installPhase = ''
-    make TARGET=debian DEBIAN=1 debianupdate
-    mv koreader-debian-x86_64-unknown-linux-gnu/debian/usr $out
+    make TARGET=${target} DEBIAN=1 debianupdate
+    mv koreader-${target}-${stdenv.hostPlatform.config}/debian/usr $out
 
     wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
       lib.makeLibraryPath [ SDL2 ]
     }
   '';
+  # XXX: ^ don't specify INSTALL_DIR="$out" as make arg because that conflicts with vars used by third-party libs
+  # might be safe to specify that as an env var, though?
   # XXX: nixpkgs adds glib and gtk3-x11 to LD_LIBRARY_PATH as well
 
   passthru = {

pkgs/additional/koreader-from-src/mupdf_dir.patch

@@ -1,15 +0,0 @@
-diff --git a/base/Makefile.defs b/base/Makefile.defs
-index dbb95daa..1293e5d5 100644
---- a/base/Makefile.defs
-+++ b/base/Makefile.defs
-@@ -732,8 +732,8 @@ MINIZIP_DIR=$(CURDIR)/$(MINIZIP_BUILD_DIR)/minizip-prefix/src/minizip
- AES_LIB_DIR=$(MINIZIP_DIR)/aes
- AES_LIB=$(MINIZIP_DIR)/libaes.a
- 
--MUPDF_BUILD_DIR=$(CURDIR)/$(THIRDPARTY_DIR)/mupdf/build/$(MACHINE)
--MUPDF_DIR=$(MUPDF_BUILD_DIR)/mupdf-prefix/src/mupdf
-+MUPDF_BUILD_DIR=$(THIRDPARTY_DIR)/mupdf/build/$(MACHINE)
-+MUPDF_DIR=$(CURDIR)/$(MUPDF_BUILD_DIR)/mupdf-prefix/src/mupdf
- MUPDF_LIB_DIR=$(MUPDF_DIR)/build/$(if $(KODEBUG),debug,release)
- MUPDF_LIB_STATIC=$(MUPDF_LIB_DIR)/libmupdf.a
- MUPDF_THIRDPARTY_LIBS=$(MUPDF_LIB_DIR)/libmupdfthird.a \

pkgs/additional/koreader-from-src/sources.nix

@@ -6,13 +6,11 @@
       source.hash = "sha256-kzozc0Io+1f4UMivSV2IhzJDQXmad4wNhXN/Y2Lsg3Q=";
     };
     czmq = {
-      # Completed
       source.url = "https://github.com/zeromq/czmq.git";
       source.rev = "2a0ddbc4b2dde623220d7f4980ddd60e910cfa78";
       source.hash = "sha256-p4Cl2PLVgRQ0S4qr3VClJXjvAd2LUBU9oRUvOCfVnyw=";
     };
     djvulibre = {
-      # Completed
       source.url = "https://gitlab.com/koreader/djvulibre.git";
       source.rev = "6a1e5ba1c9ef81c205a4b270c3f121a1e106f4fc";
       source.hash = "sha256-OWSbxdr93FH3ed0D+NSFWIah7VDTcL3LIGOciY+f4dk=";
@@ -23,31 +21,26 @@
       source.hash = "sha256-JlanCl4XQBFnrpRIEsowSeUI7wSa9RoQc5h3pkMHXA8=";
     };
     freetype2 = {
-      # Completed
       source.url = "https://gitlab.com/koreader/freetype2.git";
       source.rev = "VER-2-13-1";
       source.hash = "sha256-rQN+hRzrs+KGgp8+n1VJzOOwtKUcRuSE/s/r8/xOUdI=";
     };
     fribidi = {
-      # Completed
       source.url = "https://github.com/fribidi/fribidi.git";
       source.rev = "tags/v1.0.12";
       source.hash = "sha256-L4m/F9rs8fiv9rSf8oy7P6cthhupc6R/lCv30PLiQ4M=";
     };
     giflib = {
-      # Completed
       source.url = "https://gitlab.com/koreader/giflib.git";
       source.rev = "5.1.4";
       source.hash = "sha256-znbY4tliXHXVLBd8sTKrbglOdCUb7xhcCQsDDWcQfhw=";
     };
     glib = {
-      # Completed
       source.url = "https://github.com/GNOME/glib.git";
       source.rev = "2.58.3";
       source.hash = "sha256-KmJXCJ6h2QhPyK1axk+Y9+yJzO0wnCczcogopxGShJc=";
     };
     harfbuzz = {
-      # Completed
       source.url = "https://github.com/harfbuzz/harfbuzz.git";
       source.rev = "8.0.1";
       source.hash = "sha256-qh04AsZlymNcUtZ3fytA9+Jk5PjPYm8UH75kBqZNsw4=";
@@ -63,37 +56,31 @@
       source.hash = "sha256-SDXKam768xvZZvTbXe3sssvZyeLEEiY97Vrzx8hoc6g=";
     };
     libjpeg-turbo = {
-      # Completed
       source.url = "https://github.com/libjpeg-turbo/libjpeg-turbo.git";
       source.rev = "3.0.0";
       source.hash = "sha256-mIeSBP65+rWOCRS/33MPqGUpemBee2qR45CZ6H00Hak=";
     };
     libk2pdfopt = {
-      # Completed
       source.url = "https://github.com/koreader/libk2pdfopt.git";
       source.rev = "60b82eeecf71d1776951da970fe8cd2cc5735ded";
       source.hash = "sha256-9UcDr9e4GZCZ78moRs1ADAt4Xl7z3vR93KDexXEHvhw=";
     };
     libpng = {
-      # Completed
       source.url = "https://github.com/glennrp/libpng.git";
       source.rev = "v1.6.40";
       source.hash = "sha256-Rad7Y5Z9PUCipBTQcB7LEP8fIVTG3JsnMeknUkZ/rRg=";
     };
     libunibreak = {
-      # Completed
       source.url = "https://github.com/adah1972/libunibreak.git";
       source.rev = "tags/libunibreak_5_1";
       source.hash = "sha256-hjgT5DCQ6KFXKlxk9LLzxGHz6B71X/3Ot7ipK3KY85A=";
     };
     libwebp = {
-      # Completed
       source.url = "https://github.com/webmproject/libwebp.git";
       source.rev = "v1.3.1";
       source.hash = "sha256-ddDL/nnBikbm6YznlyCcBgmq2Qzo0MjIwMzN4/kzWqk=";
     };
     libzmq = {
-      # Completed
       source.url = "https://github.com/zeromq/libzmq";
       source.rev = "883e95b22e0bffffa72312ea1fec76199afbe458";
       source.hash = "sha256-R76EREtHsqcoKxKrgT8gfEf9pIWdLTBXvF9cDvjEf3E=";
@@ -105,37 +92,31 @@
       machineAgnostic = true;
     };
     lodepng = {
-      # Completed
       source.url = "https://github.com/lvandeve/lodepng.git";
       source.rev = "c18b949b71f45e78b1f9a28c5d458bce0da505d6";
       source.hash = "sha256-AAw6I+MxDaxmGpjC5efxuBNw7Lx8FXwg2TEfl6LfPfQ=";
     };
     lua-htmlparser = {
-      # Completed
       source.url = "https://github.com/msva/lua-htmlparser";
       source.rev = "5ce9a775a345cf458c0388d7288e246bb1b82bff";
       source.hash = "sha256-aSTLSfqz/MIDFVRwtBlDNBUhPb7KqOl32/Y62Hdec1s=";
     };
     luajit = {
-      # Completed
       source.url = "https://github.com/LuaJIT/LuaJIT";
       source.rev = "8635cbabf3094c4d8bd00578c7d812bea87bb2d3";
       source.hash = "sha256-pfMNQFulW6AEwAVPxn9wUdbRg3ViHbGVCCke5NSIgTo=";
     };
     lua-rapidjson = {
-      # Completed
       source.url = "https://github.com/xpol/lua-rapidjson";
       source.rev = "242b40c8eaceb0cc43bcab88309736461cac1234";
       source.hash = "sha256-y/czEVPtCt4uN1n49Qi7BrgZmkG+SDXlM5D2GvvO2qg=";
     };
     luasec = {
-      # Completed
       source.url = "https://github.com/brunoos/luasec";
       source.rev = "tags/v1.3.1";
       source.hash = "sha256-3iYRNQoVk5HFjDSqRRmg1taSqeT2cHFil36vxjrEofo=";
     };
     luasocket = {
-      # Completed
       source.url = "https://github.com/lunarmodules/luasocket";
       source.rev = "8c2ff7217e2a205eb107a6f48b04ff1b2b3090a1";
       source.hash = "sha256-Y35QYNLznQmErr6rIjxLzw0/6Y7y8TbzD4yaEdgEljA=";
@@ -151,25 +132,21 @@
       source.hash = "sha256-wb7ykJsndoq0DazHpfXieUcBBptowYqD/eTTN/EK/6g=";
     };
     lunasvg = {
-      # Completed
       source.url = "https://github.com/sammycage/lunasvg.git";
       source.rev = "59d6f6ba835c1b7c7a0f9d4ea540ec3981777885";
       source.hash = "sha256-gW2ikakS6Omz5upmy26nAo/jkGHYO2kjlB3UmKJBh1k=";
     };
     minizip = {
-      # Completed
       source.url = "https://github.com/nmoinvaz/minizip";
       source.rev = "0b46a2b4ca317b80bc53594688883f7188ac4d08";
       source.hash = "sha256-P/3MMMGYDqD9NmkYvw/thKpUNa3wNOSlBBjANHSonAg=";
     };
     mupdf = {
-      # Completed
       source.url = "https://github.com/ArtifexSoftware/mupdf.git";
       source.rev = "tags/1.13.0";
       source.hash = "sha256-pQejRon9fO9A1mhz3oLjBr1j4HveDLcQIWjR1/Rpy5Q=";
     };
     nanosvg = {
-      # Completed
       source.url = "https://github.com/memononen/nanosvg.git";
       source.rev = "9da543e8329fdd81b64eb48742d8ccb09377aed1";
       source.hash = "sha256-VOiN6583DtzGYPRkl19VG2QvSzl4T9HaynBuNcvZf94=";
@@ -181,7 +158,6 @@
       source.hash = "sha256-yjIpSbe5pt9sEV2MZYGztxejg/aBFfKO8ieRvoLN2KA=";
     };
     openssl = {
-      # Completed
       source.url = "https://github.com/openssl/openssl.git";
       source.rev = "OpenSSL_1_1_1u";
       source.hash = "sha256-JOcUj4ovA6621+1k2HUsvhGX1B9BjvaMbCaSx680nSs=";
@@ -203,19 +179,16 @@
       source.hash = "sha256-FQvlrJ+Uy7+wtUxBuS5NdoToUwNRhYw2ju8Ya8MLyQw=";
     };
     turbo = {
-      # Completed
       source.url = "https://github.com/kernelsauce/turbo";
       source.rev = "tags/v2.1.3";
       source.hash = "sha256-vBRkFdc5a0FIt15HBz3TnqMZ+GGsqjEefnfJEpuVTBs=";
     };
     utf8proc = {
-      # Completed
       source.url = "https://github.com/JuliaStrings/utf8proc.git";
       source.rev = "v2.8.0";
       source.hash = "sha256-/lSD78kj133rpcSAOh8T8XFW/Z0c3JKkGQM5Z6DcMtU=";
     };
     zstd = {
-      # Completed
       source.url = "https://github.com/facebook/zstd.git";
       source.rev = "tags/v1.5.5";
       source.hash = "sha256-tHHHIsQU7vJySrVhJuMKUSq11MzkmC+Pcsj00uFJdnQ=";
@@ -237,7 +210,6 @@
       hash = "sha256-x30NoxAq7JwH9DZx5gYR6/+JqZbvFZSXzo5Z0HV4axI=";
     };
     libffi = {
-      # Completed
       url = "https://github.com/libffi/libffi/releases/download/v3.4.4/libffi-3.4.4.tar.gz";
       hash = "sha256-1mxWrSWags8qnfxAizK/XaUjcVALhHRff7i2RXEt9nY=";
     };
@@ -246,7 +218,6 @@
       hash = "sha256-zPU2YgpFRY0muoOIepg7loJwAekqE4R7ReSSXMiRMXg=";
     };
     lpeg = {
-      # Completed
       url = "http://distcache.FreeBSD.org/ports-distfiles/lpeg-1.0.2.tar.gz";
       hash = "sha256-SNZldgUbbHg4j6rQm3BJMJMmRYj80PJY3aqxzdShX/4=";
     };
@@ -269,7 +240,6 @@
       hash = "sha256-A9kIz1doz+a3rViMkhxu0hrKv7K3m3iNEzBFNQdkeu0=";
     };
     zlib = {
-      # Completed
       url = "http://gentoo.osuosl.org/distfiles/zlib-1.2.13.tar.xz";
       hash = "sha256-0Uw44xOvw1qah2Da3yYEL1HqD10VSwYwox2gVAEH+5g=";
     };

pkgs/additional/linux-megous/default.nix

@@ -1,13 +1,10 @@
 { lib
 , buildLinux
-, buildPackages
 , fetchFromGitHub
-, modDirVersionArg ? null
-, nixosTests
-, perl
 , pkgs
+# something inside nixpkgs calls `override` on the kernel and passes in extra arguments
 , ...
-} @ args:
+}@args:
 
 with lib;
 
@@ -34,6 +31,16 @@ let
   kernelConfig = with lib.kernel; {
     # NB: nix adds the CONFIG_ prefix to each of these.
     # if you add the prefix yourself nix will IGNORE YOUR CONFIG.
+
+    # optimize for faster builds.
+    # see <repo:kernel.org/linux:Documentation/admin-guide/quickly-build-trimmed-linux.rst>
+    DEBUG_KERNEL = lib.mkForce no;  # option group which seems to just gate the other DEBUG_ opts?
+    DEBUG_INFO = lib.mkForce no;  # for gdb debugging
+    DEBUG_INFO_BTF = lib.mkForce no;  # BPF debug symbols. rec by <https://nixos.wiki/wiki/Linux_kernel#Too_high_ram_usage>
+    SCHED_DEBUG = lib.mkForce no;  # determines /sys/kernel/debug/sched
+    # SUNRPC_DEBUG = lib.mkForce no;  # i use NFS though
+
+    # taken from mobile-nixos config?? or upstream megous config??
     RTL8723CS = module;
     BT_HCIUART_3WIRE = yes;
     BT_HCIUART_RTL = yes;
@@ -99,35 +106,36 @@ let
   extraKernelPatches = [
     pkgs.kernelPatches.bridge_stp_helper
     pkgs.kernelPatches.request_key_helper
-    (patchDefconfig kernelConfig)
+    # (patchDefconfig kernelConfig)
   ];
 
 
   # create a kernelPatch which overrides nixos' defconfig with extra options
-  patchDefconfig = config: {
-    # defconfig options. this method comes from here:
-    # - https://discourse.nixos.org/t/the-correct-way-to-override-the-latest-kernel-config/533/9
-    name = "linux-megous-defconfig";
-    patch = null;
-    extraStructuredConfig = config;
+  # patchDefconfig = config: {
+  #   # defconfig options. this method comes from here:
+  #   # - https://discourse.nixos.org/t/the-correct-way-to-override-the-latest-kernel-config/533/9
+  #   name = "linux-megous-defconfig";
+  #   patch = null;
+  #   extraStructuredConfig = config;
+  # };
+
+in buildLinux (args // {
+  version = base + rc;
+
+  # modDirVersion needs to be x.y.z, where `z` could be `Z-rcN`
+  # nix kernel build will sanity check us if we get the modDirVersion wrong
+  modDirVersion = base + rc;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor base;
+
+  src = fetchFromGitHub {
+    owner = "megous";
+    repo = "linux";
+    inherit rev hash;
   };
 
-  overridenArgs = args // rec {
-    version = base + rc;
+  kernelPatches = (args.kernelPatches or []) ++ extraKernelPatches;
 
-    # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-    modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) + rc else modDirVersionArg;
-
-    # branchVersion needs to be x.y
-    extraMeta.branch = versions.majorMinor version;
-
-    src = fetchFromGitHub {
-      owner = "megous";
-      repo = "linux";
-      inherit rev hash;
-    };
-  } // (args.argsOverride or { });
-  finalArgs = overridenArgs // {
-    kernelPatches = overridenArgs.kernelPatches or [] ++ extraKernelPatches;
-  };
-in buildLinux finalArgs
+  structuredExtraConfig = (args.structuredExtraConfig or {}) // kernelConfig;
+})

pkgs/additional/mpv-uosc-latest/default.nix

@@ -0,0 +1,26 @@
+{ lib
+, fetchFromGitHub
+, fetchFromGitea
+, mpvScripts
+}:
+mpvScripts.uosc.overrideAttrs (upstream: {
+  version = "unstable-2023-07-26";
+  # src = fetchFromGitHub {
+  #   owner = "tomasklaen";
+  #   repo = "uosc";
+  #   rev = "e783ad1f133e06a50d424291143d25497fbecfdd";
+  #   hash = "sha256-FFl51Kv5eMNyB4LM4JmjJXDnd/XvvtXZbHsRpSkSGqE=";
+  # };
+  src = lib.warnIf (upstream.version != "4.7.0") "mpv-uosc-latest is behind nixpkgs mpvScripts.uosc ${upstream.version}" fetchFromGitea {
+    domain = "git.uninsane.org";
+    owner = "colin";
+    repo = "uosc";
+    rev = "dev/sane";
+    hash = "sha256-XOhryppod3zozYrPQlGBw298u+0/eS1MaDepV4p88cM=";
+    # for version > 4.7.0, we can use nixpkgs src and set `patches` to a fetch of my one custom commit
+  };
+  passthru = upstream.passthru // {
+    scriptName = "uosc";
+  };
+  postPatch = "";  # delete the outdated `path` fix
+})

pkgs/additional/sane-scripts/default.nix

@@ -144,7 +144,7 @@ let
     reclaim-disk-space = static-nix-shell.mkBash {
       pname = "sane-reclaim-disk-space";
       src = ./src;
-      pkgs = [ "nix" "rmlint" "util-linux" ];
+      pkgs = [ "nix" ];
     };
     secrets-dump = static-nix-shell.mkBash {
       pname = "sane-secrets-dump";
@@ -211,16 +211,10 @@ let
       src = ./src;
     };
   };
-in
-symlinkJoin {
-  name = "sane-scripts";
-  paths = lib.attrValues sane-bin;
-  passthru = sane-bin // {
-    lib = sane-lib;
-  };
-  meta = {
-    description = "collection of scripts associated with sane systems";
-    homepage = "https://git.uninsane.org";
-    platforms = lib.platforms.all;
+in sane-bin // {
+  lib = sane-lib;
+  all = symlinkJoin {
+    name = "sane-scripts";
+    paths = lib.attrValues sane-bin;
   };
 }

pkgs/additional/sane-scripts/src/sane-bt-search

@@ -11,6 +11,7 @@ options:
   --full     display all results
   --help     show this help message and exit
   --manga    show only manga results
+  --h265     show only H.265 video (HEVC)
   --json     output one json document instead of a human-readable table
   --top=<n>  show the <n> top rated torrents (default: 5)
   --verbose  show more information, useful for debugging/development
@@ -153,6 +154,12 @@ class Torrent:
     def is_manga(self, default: bool = False) -> bool:
         return is_cat(self.categories, MANGA_CATS, default)
 
+    def is_h265(self) -> bool:
+        meta = self.title.lower()
+        return "h265" in meta \
+            or "x265" in meta \
+            or "HEVC" in meta
+
 class Client:
     def __init__(self):
         self.apikey = open("/run/secrets/jackett_apikey").read().strip()
@@ -176,12 +183,14 @@ class Client:
         return sorted(torrents, reverse=True)
 
 
-def filter_results(results: list[Torrent], full: bool, top: int, manga: bool) -> list[Torrent]:
+def filter_results(results: list[Torrent], full: bool, top: int, manga: bool, h265: bool) -> list[Torrent]:
     """
     take the complete query and filter further based on CLI options
     """
     if manga:
         results = [t for t in results if t.is_manga(default=True)]
+    if h265:
+        results = [t for t in results if t.is_h265()]
     if not full:
         results = results[:top]
     return results
@@ -195,6 +204,7 @@ def parse_args(args: list[str]) -> dict:
         top="5",
         verbose=False,
         manga=False,
+        h265=False,
     )
     while args:
         arg = args[0]
@@ -218,9 +228,11 @@ def main(args: list[str]):
     help = options.pop("help")
     json = options.pop("json")
     query = options.pop("query")
+    assert options.get("top") is not True, "use `--top=N`, not `--top N`"
     top = int(options.pop("top"))
     verbose = options.pop("verbose")
     manga = options.pop("manga")
+    h265 = options.pop("h265")
 
     if options != {}:
         raise BadCliArgs(f"unexpected options: {options}")
@@ -235,7 +247,7 @@ def main(args: list[str]):
     results = client.query(query)
     num_results = len(results)
 
-    results = filter_results(results, full, top, manga)
+    results = filter_results(results, full, top, manga, h265)
 
     if json:
         dumpable = [t.to_dict() for t in results]

pkgs/additional/sane-scripts/src/sane-reclaim-disk-space

@@ -1,74 +1,20 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix -p rmlint -p util-linux
+#!nix-shell -i bash -p nix
 # script to reclaim some hard drive space
 # some of this is documented here:
 # - <https://nixos.wiki/wiki/Storage_optimization>
-set -e
 
-options=$(getopt -l "gc,rmlint,all" -- "" "$@")
-eval "set -- ${options}"
-do_rmlint=false
-do_gc=false
-while true; do
-  case "$1" in
-    (--all)
-      shift
-      do_gc=true
-      do_rmlint=true
-    ;;
-    (--gc)
-      shift
-      do_gc=true
-    ;;
-    (--rmlint)
-      shift
-      do_rmlint=true
-    ;;
-    (--)
-      shift
-      if [ $# -eq 0 ]; then
-        break
-      fi
-    ;;
-    (*)
-      echo "invalid arguments"
-      exit 1
-    ;;
-  esac
-done
-
-set -x
+set -xeu
 
 # scan the store and hard-link identical files
 # nix-store --optimise
 
-if [ $do_gc = true ]
-then
-  # TODO: do we need `sudo` here?
-  # TODO: `nix-store --gc`?
-  sudo nix-collect-garbage --delete-older-than 30d
-fi
+# TODO: do we need `sudo` here?
+# TODO: `nix-store --gc`?
+sudo nix-collect-garbage --delete-older-than 30d
 
-if [ $do_rmlint = true ]
-then
-  # identify duplicate files in the nix store
-  rmlint --types="duplicates" --config=sh:handler=clone --output=sh:/tmp/rmlint.sh --output=json:/dev/null --progress /nix/store
-  # link the dupes together (uses ioctl_fideduperange)
-  #   see: https://btrfs.wiki.kernel.org/index.php/Deduplication
-  #   see: https://rmlint.readthedocs.io/en/latest/tutorial.html
-fi
-
-if [ $do_rmlint = true ]
-then
-  sudo mount -o remount,rw /nix/store
-  # XXX: does rmlint really need to be invoked as root?
-  sudo /tmp/rmlint.sh -d || true  # on failure, we still want to remount ro
-  # XXX this doesn't work: 'mount point is busy.'
-  sudo mount -o remount,ro /nix/store
-fi
-
-# TODO: instead of using rmlint, could use dduper: https://github.com/Lakshmipathi/dduper
-#   better perf for btrfs (checksum tests)
+# TODO: could use dduper: https://github.com/Lakshmipathi/dduper
+#   like rmlint, but better perf for btrfs (checksum tests)
 #   likely also better compression, on account of being block-based instead of whole-file based.
 #   however, not clearly actively maintained; uses custom btrfs-progs patch; riskier
 #     might not currently build on nix: https://github.com/NixOS/nixpkgs/issues/175730

pkgs/additional/sxmo-utils/0003-fix-xkb-paths.patch

@@ -1,19 +0,0 @@
-diff --git a/scripts/core/sxmo_swayinitconf.sh b/scripts/core/sxmo_swayinitconf.sh
-index c4afcd6..80f593c 100755
---- a/scripts/core/sxmo_swayinitconf.sh
-+++ b/scripts/core/sxmo_swayinitconf.sh
-@@ -60,13 +60,13 @@ focused_name="$(
- swaymsg -- input type:touch map_to_output "$focused_name"
- swaymsg -- input type:tablet_tool map_to_output "$focused_name"
- 
--swaymsg -- input "$pwr" xkb_file "$(xdg_data_path sxmo/sway/xkb_mobile_normal_buttons)"
-+swaymsg -- input "$pwr" xkb_file "$(xdg_data_path sxmo/xkb/xkb_mobile_normal_buttons)"
- 
- if ! [ "$vols" = "none" ]; then
- 	for vol in $vols; do
- 		swaymsg -- input "$vol" repeat_delay 200
- 		swaymsg -- input "$vol" repeat_rate 15
--		swaymsg -- input "$vol" xkb_file "$(xdg_data_path sxmo/sway/xkb_mobile_normal_buttons)"
-+		swaymsg -- input "$vol" xkb_file "$(xdg_data_path sxmo/xkb/xkb_mobile_normal_buttons)"
- 	done
- fi

pkgs/additional/sxmo-utils/0004-no-busybox.patch

@@ -1,24 +0,0 @@
-diff --git a/setup_config_version.sh b/setup_config_version.sh
-index fde40c1..6386014 100755
---- a/setup_config_version.sh
-+++ b/setup_config_version.sh
-@@ -8,7 +8,7 @@ case "$1" in
-                exit
- esac
- 
--case "$(busybox head -n1 "$1")" in
-+case "$(head -n1 "$1")" in
- 	"#"*)
- 		comment="#"
- 		;;
-@@ -23,7 +23,7 @@ case "$(busybox head -n1 "$1")" in
- 		;;
- esac
- 
--busybox md5sum "$1" | \
--	busybox cut -d" " -f1 | \
--	busybox xargs -I{} busybox sed -i "2i$comment configversion: {}" \
-+md5sum "$1" | \
-+	cut -d" " -f1 | \
-+	xargs -I{} sed -i "2i$comment configversion: {}" \
- 	"$1"

pkgs/additional/sxmo-utils/default.nix

@@ -1,8 +1,12 @@
 { stdenv
+, bash
 , bc
 , bemenu
 , bonsai
+, buildPackages
+, busybox
 , conky
+, coreutils
 , dbus
 , fetchgit
 , fetchpatch
@@ -39,13 +43,13 @@
 let
   # anything which any sxmo script or default hook in this package might invoke
   runtimeDeps = [
-    bc
+    bc  # also in busybox
     bemenu
     bonsai
     conky
     dbus
     # dmenu  # or dmenu-wayland? only used on x11?
-    gnugrep
+    gnugrep  # also in busybox
     gojq
     grim
     inotify-tools
@@ -97,8 +101,14 @@ stdenv.mkDerivation rec {
       url = "https://lists.sr.ht/~mil/sxmo-devel/patches/42441/mbox";
       hash = "sha256-YmkJ4JLIG/mHosRlVQqvWzujFMBsuDf5nVT3iOi40zU=";
     })
-    ./0003-fix-xkb-paths.patch
-    ./0004-no-busybox.patch
+    (fetchpatch {
+      # merged post 1.14.2
+      # i only care about patch no. 2
+      # [1/2] suspend toggle: silence rm failure noise
+      # [2/2] config: fix keyboard files location
+      url = "https://lists.sr.ht/~mil/sxmo-devel/patches/42880/mbox";
+      hash = "sha256-tAMPBb6vwzj1dFMTEaqrcCJU6FbQirwZgB0+tqW3rQA=";
+    })
     # wanted to fix/silence some non-fatal errors
     ./0005-system-audio.patch
     ./0007-workspace-wrapping.patch
@@ -110,6 +120,13 @@ stdenv.mkDerivation rec {
       url = "https://lists.sr.ht/~mil/sxmo-devel/patches/42443/mbox";
       hash = "sha256-c4VySbVJgsbh2h+CnCgwWWe5WkAregpYFqL8n3WRXwY=";
     })
+    # (fetchpatch {
+    #   XXX: doesn't apply cleanly to 1.14.2 release
+    #   # Don't wait for led or status bar in state change hooks
+    #   # - significantly decreases the time between power-button state transitions
+    #   url = "https://lists.sr.ht/~mil/sxmo-devel/patches/43109/mbox";
+    #   hash = "sha256-4uR2u6pa62y6SaRHYRn15YGDPILAs7py0mPbAjsgwM4=";
+    # })
     (fetchpatch {
       # Make config gesture toggle persistent
       url = "https://lists.sr.ht/~mil/sxmo-devel/patches/42876/mbox";
@@ -121,10 +138,23 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    sed -i 's@/usr/lib/udev/rules\.d@/etc/udev/rules.d@' Makefile
+    # allow sxmo to source its init file
     sed -i "s@/etc/profile\.d/sxmo_init.sh@$out/etc/profile.d/sxmo_init.sh@" scripts/core/*.sh
-    sed -i "s@/usr/bin/@@g" scripts/core/sxmo_version.sh
+    # remove absolute paths
+    substituteInPlace scripts/core/sxmo_version.sh \
+      --replace "/usr/bin/" ""
+
+    # let superd find sxmo service binaries at runtime via PATH
+    # TODO: replace with fully-qualified paths
     sed -i 's:ExecStart=/usr/bin/:ExecStart=/usr/bin/env :' configs/superd/services/*.service
+
+    # install udev rules to where nix expects
+    substituteInPlace Makefile \
+      --replace "/usr/lib/udev/rules.d" "/etc/udev/rules.d"
+    # avoid relative paths in udev rules
+    substituteInPlace configs/udev/90-sxmo.rules \
+      --replace "/bin/chgrp" "${coreutils}/bin/chgrp" \
+      --replace "/bin/chmod" "${coreutils}/bin/chmod"
   '';
 
   nativeBuildInputs = [
@@ -132,11 +162,16 @@ stdenv.mkDerivation rec {
     scdoc
   ];
 
-  installFlags = [
-    "OPENRC=0"
-    "DESTDIR=$(out)"
-    "PREFIX="
-  ];
+  buildInputs = [ bash ];  # needed here so stdenv's `patchShebangsAuto` hook sets the right interpreter
+
+  installPhase = ''
+    runHook preInstall
+
+    # busybox is used by setup_config_version.sh, but placing it in nativeBuildInputs breaks the nix builder
+    PATH="$PATH:${buildPackages.busybox}/bin" make OPENRC=0 DESTDIR=$out PREFIX= install
+
+    runHook postInstall
+  '';
 
   # we don't wrap sxmo_common.sh or sxmo_init.sh
   # which is unfortunate, for non-sxmo-utils files that might source though.

pkgs/default.nix

@@ -21,9 +21,13 @@ let
 
     ### ADDITIONAL PACKAGES
     alsa-ucm-conf-sane = callPackage ./additional/alsa-ucm-conf-sane { };
-    bonsai = unpatched.bonsai or (callPackage ./additional/bonsai { });
+    # TODO: move target flags to upstream PR and re-enable this bonsai
+    # bonsai = unpatched.bonsai or (callPackage ./additional/bonsai { });
+    bonsai = callPackage ./additional/bonsai { };
     bootpart-uefi-x86_64 = callPackage ./additional/bootpart-uefi-x86_64 { };
     cargoDocsetHook = callPackage ./additional/cargo-docset/hook.nix { };
+    chatty-latest = callPackage ./additional/chatty-latest { };
+    eg25-manager = callPackage ./additional/eg25-manager { };
     feeds = lib.recurseIntoAttrs (callPackage ./additional/feeds { });
     lemoa = callPackage ./additional/lemoa { };
     jellyfin-media-player-qt6 = callPackage ./additional/jellyfin-media-player-qt6 { };
@@ -40,10 +44,10 @@ let
     ldd-aarch64 = callPackage ./additional/ldd-aarch64 { };
     lightdm-mobile-greeter = callPackage ./additional/lightdm-mobile-greeter { };
     linux-megous = callPackage ./additional/linux-megous { };
+    mpv-uosc-latest = callPackage ./additional/mpv-uosc-latest { };
     mx-sanebot = callPackage ./additional/mx-sanebot { };
     rtl8723cs-firmware = callPackage ./additional/rtl8723cs-firmware { };
-    # TODO: use `recurseIntoAttrs` ?
-    sane-scripts = callPackage ./additional/sane-scripts { };
+    sane-scripts = lib.recurseIntoAttrs (callPackage ./additional/sane-scripts { });
     static-nix-shell = callPackage ./additional/static-nix-shell { };
     sublime-music-mobile = callPackage ./additional/sublime-music-mobile { };
     sxmo-utils = callPackage ./additional/sxmo-utils { };
@@ -55,7 +59,7 @@ let
 
     # packages i haven't used for a while, may or may not still work
     # fluffychat-moby = callPackage ./additional/fluffychat-moby { };
-    # fractal-latest = callPackage ./additional/fractal-latest { };
+    fractal-latest = callPackage ./additional/fractal-latest { };
     # kaiteki = callPackage ./additional/kaiteki { };
     # tokodon = libsForQt5.callPackage ./additional/tokodon { };
 
@@ -88,6 +92,8 @@ let
 
     cozy = callPackage ./patched/cozy { inherit (unpatched) cozy; };
 
+    engrampa = callPackage ./patched/engrampa { inherit (unpatched) mate; };
+
     # mozilla keeps nerfing itself and removing configuration options
     firefox-unwrapped = callPackage ./patched/firefox-unwrapped { inherit (unpatched) firefox-unwrapped; };
 
@@ -106,8 +112,6 @@ let
 
     komikku = callPackage ./patched/komikku { inherit (unpatched) komikku; };
 
-    lemmy-server = callPackage ./patched/lemmy-server { inherit (unpatched) lemmy-server; };
-
     phoc = callPackage ./patched/phoc { inherit (unpatched) phoc; };
 
 

pkgs/patched/engrampa/default.nix

@@ -0,0 +1,14 @@
+{ mate
+, fetchFromGitHub
+}:
+mate.engrampa.overrideAttrs (super: {
+  pname = "engrampa-sane";
+  src = fetchFromGitHub {
+    owner = "mate-desktop";
+    repo = "engrampa";
+    # point to a version > 1.27.0, for working cross compilation.
+    # remove this override once engrampa > 1.27.0 is released.
+    rev = "45f52c13baa93857d912effb4f1f9a58c41a0da3";
+    hash = "sha256-j7tASMjBSA+d1a9Fu3G/328aRDqNJjXoITxogRH0YI4=";
+  };
+})

pkgs/patched/komikku/default.nix

@@ -3,13 +3,13 @@
 , fetchpatch2
 }:
 komikku.overrideAttrs (upstream: {
-  src = fetchFromGitLab {
-    owner = "valos";
-    repo = "Komikku";
-    rev = "7dcf2b3d0ba685396872780b1ce75d01cbe02ebe";
-    hash = "sha256-LzgHPuIpxy0ropiNycdxZP6onjK2JpMRqkkdmJGA4nE=";
-  };
-  patches = [
+  # src = fetchFromGitLab {
+  #   owner = "valos";
+  #   repo = "Komikku";
+  #   rev = "7dcf2b3d0ba685396872780b1ce75d01cbe02ebe";
+  #   hash = "sha256-LzgHPuIpxy0ropiNycdxZP6onjK2JpMRqkkdmJGA4nE=";
+  # };
+  patches = (upstream.patches or []) ++ [
     (fetchpatch2 {
       url = "https://git.uninsane.org/colin/mirror-komikku/commit/318fc0c975ba84ca4dcff405bc1bb8f5895bc5a6.diff";
       hash = "sha256-mn81hCt5xrypJMOOiCOg8NthLjglXntTDsYpcdCg0E8=";

pkgs/patched/lemmy-server/debug-db-migrations.patch

@@ -1,24 +0,0 @@
-diff --git a/src/code_migrations.rs b/src/code_migrations.rs
-index c69ce591..b416a299 100644
---- a/src/code_migrations.rs
-+++ b/src/code_migrations.rs
-@@ -36,7 +36,7 @@ use lemmy_db_schema::{
-   utils::{get_conn, naive_now, DbPool},
- };
- use lemmy_utils::{error::LemmyError, settings::structs::Settings};
--use tracing::info;
-+use tracing::{debug, info};
- use url::Url;
- 
- pub async fn run_advanced_migrations(pool: &DbPool, settings: &Settings) -> Result<(), LemmyError> {
-@@ -419,7 +419,9 @@ async fn initialize_local_site_2022_10_10(
-   info!("Running initialize_local_site_2022_10_10");
- 
-   // Check to see if local_site exists
--  if LocalSite::read(pool).await.is_ok() {
-+  let local_site = LocalSite::read(pool).await;
-+  debug!("local_site: {local_site:?}");
-+  if local_site.is_ok() {
-     return Ok(());
-   }
-   info!("No Local Site found, creating it.");

pkgs/patched/lemmy-server/default.nix

@@ -1,12 +0,0 @@
-{ lemmy-server }:
-
-lemmy-server.overrideAttrs (upstream: {
-  patches = upstream.patches or [] ++ [
-    # "thread 'main' panicked at 'Couldn't run DB Migrations: Failed to run 2022-07-07-182650_comment_ltrees with: permission denied: "RI_ConstraintTrigger_a_647340" is a system trigger', crates/db_schema/src/utils.rs:165:25"
-    # ./fix-db-migrations.patch  #< upstreamed as of 2023/06/28
-    # log the database connection events, for debugging
-    # ./log-startup.patch
-    # print more debug info about specific problem paths i've encountered
-    # ./debug-db-migrations.patch
-  ];
-})

pkgs/patched/lemmy-server/fix-db-migrations.patch

@@ -1,19 +0,0 @@
-diff --git a/migrations/2022-07-07-182650_comment_ltrees/up.sql b/migrations/2022-07-07-182650_comment_ltrees/up.sql
-index fde9e1b3..55b96dac 100644
---- a/migrations/2022-07-07-182650_comment_ltrees/up.sql
-+++ b/migrations/2022-07-07-182650_comment_ltrees/up.sql
-@@ -60,7 +60,7 @@ ORDER BY
-        breadcrumb;
-
- -- Remove indexes and foreign key constraints, and disable triggers for faster updates
--alter table comment disable trigger all;
-+-- alter table comment disable trigger all;
-
- alter table comment drop constraint if exists comment_creator_id_fkey;
- alter table comment drop constraint if exists comment_parent_id_fkey;
-@@ -115,4 +115,4 @@ create index idx_path_gist on comment using gist (path);
- -- Drop the parent_id column
- alter table comment drop column parent_id cascade;
-
--alter table comment enable trigger all;
-+-- alter table comment enable trigger all;

pkgs/patched/lemmy-server/log-startup.patch

@@ -1,56 +0,0 @@
-diff --git a/crates/db_schema/src/utils.rs b/crates/db_schema/src/utils.rs
-index acedab97..4b62b5bb 100644
---- a/crates/db_schema/src/utils.rs
-+++ b/crates/db_schema/src/utils.rs
-@@ -134,9 +134,12 @@ pub fn diesel_option_overwrite_to_url_create(
- }
- 
- async fn build_db_pool_settings_opt(settings: Option<&Settings>) -> Result<DbPool, LemmyError> {
-+  println!("build_db_pool_settings_opt");
-   let db_url = get_database_url(settings);
-+  println!("  db_url: {db_url}");
-   let pool_size = settings.map(|s| s.database.pool_size).unwrap_or(5);
-   let manager = AsyncDieselConnectionManager::<AsyncPgConnection>::new(&db_url);
-+  println!("  built manager");
-   let pool = Pool::builder(manager)
-     .max_size(pool_size)
-     .wait_timeout(POOL_TIMEOUT)
-@@ -144,12 +147,15 @@ async fn build_db_pool_settings_opt(settings: Option<&Settings>) -> Result<DbPoo
-     .recycle_timeout(POOL_TIMEOUT)
-     .runtime(Runtime::Tokio1)
-     .build()?;
-+  println!("  built pool");
- 
-   // If there's no settings, that means its a unit test, and migrations need to be run
-   if settings.is_none() {
-+    println!("  running migrations");
-     run_migrations(&db_url);
-   }
- 
-+  println!("  complete");
-   Ok(pool)
- }
- 
-diff --git a/src/code_migrations.rs b/src/code_migrations.rs
-index c69ce591..0914677d 100644
---- a/src/code_migrations.rs
-+++ b/src/code_migrations.rs
-@@ -40,7 +40,9 @@ use tracing::info;
- use url::Url;
- 
- pub async fn run_advanced_migrations(pool: &DbPool, settings: &Settings) -> Result<(), LemmyError> {
-+  println!("run_advanced_migrations");
-   let protocol_and_hostname = &settings.get_protocol_and_hostname();
-+  println!("  conn: {protocol_and_hostname}");
-   user_updates_2020_04_02(pool, protocol_and_hostname).await?;
-   community_updates_2020_04_02(pool, protocol_and_hostname).await?;
-   post_updates_2020_04_03(pool, protocol_and_hostname).await?;
-@@ -52,6 +54,8 @@ pub async fn run_advanced_migrations(pool: &DbPool, settings: &Settings) -> Resu
-   regenerate_public_keys_2022_07_05(pool).await?;
-   initialize_local_site_2022_10_10(pool, settings).await?;
- 
-+  println!("  complete");
-+
-   Ok(())
- }
-