lightdm-mobile-greeter: fix to comply with newer cargo git deps/nixpkgs requirements

```
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/7d385961ebe582fed4e850a326d8d200be79f6b8' (2023-04-23)
  → 'github:nixos/nixpkgs/d0ea36ece469a71a909ebff90777c2f7a49478bb' (2023-04-25)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/8a95e6f8cd160a05c2b560e66f702432a53b59ac' (2023-04-23)
  → 'github:Mic92/sops-nix/7c8e9727a2ecf9994d4a63d577ad5327e933b6a4' (2023-04-24)
```

flake.lock

@@ -18,11 +18,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1679516998,
-        "narHash": "sha256-w4baQlS84X8Lf0E5RN0nGkx03luDuV1X0+jWMAXm6fs=",
+        "lastModified": 1680563603,
+        "narHash": "sha256-gxSci3NTlzgkAOhaC93Q4lReX/Pjd7++imD85JOAlps=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "7a6e97e3af73c4cca87e12c83abcb4913dac7dbc",
+        "rev": "4aa0afd84005b79be4d5361b56a60df9e9bd4ea3",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1680390120,
-        "narHash": "sha256-RyDJcG/7mfimadlo8vO0QjW22mvYH1+cCqMuigUntr8=",
+        "lastModified": 1682173319,
+        "narHash": "sha256-tPhOpJJ+wrWIusvGgIB2+x6ILfDkEgQMX0BTtM5vd/4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c1e2efaca8d8a3db6a36f652765d6c6ba7bb8fae",
+        "rev": "ee7ec1c71adc47d2e3c2d5eb0d6b8fbbd42a8d1c",
         "type": "github"
       },
       "original": {
@@ -82,11 +82,11 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1680415272,
-        "narHash": "sha256-S2J9n+sSeAAdXWHrz/s9pyS5fhbQilfNqYrs6RCUyN8=",
+        "lastModified": 1682404149,
+        "narHash": "sha256-vilYNldFXiu56HGD0lPcWsiED7EmjGMViCLZoQsv7Jk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "66f60deb8aa348ca81d60d0639ae420c667ff92a",
+        "rev": "d0ea36ece469a71a909ebff90777c2f7a49478bb",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1680404136,
-        "narHash": "sha256-06D8HJmRv4DdpEQGblMhx2Vm81SBWM61XBBIx7QQfo0=",
+        "lastModified": 1682338428,
+        "narHash": "sha256-T7AL/Us6ecxowjMAlO77GETTQO2SO+1XX2+Y/OSfHk8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "b93eb910f768f9788737bfed596a598557e5625d",
+        "rev": "7c8e9727a2ecf9994d4a63d577ad5327e933b6a4",
         "type": "github"
       },
       "original": {
@@ -134,11 +134,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1680086409,
-        "narHash": "sha256-Q2QcVgKvTj/LLuZX9dP8ImySWD5sTn8DDI5+EggRn2c=",
+        "lastModified": 1681952179,
+        "narHash": "sha256-GfI682y7LJXj6p0kcYIyzVKFNKtkEbxvMGu5VjSPeN4=",
         "ref": "refs/heads/master",
-        "rev": "068f176a64f0e26dc8c1f0eccf28cbd05be4909b",
-        "revCount": 182,
+        "rev": "3b9ce28b7a65d516eedddac67a224493399e5b1e",
+        "revCount": 190,
         "type": "git",
         "url": "https://git.uninsane.org/colin/uninsane"
       },

flake.nix

@@ -26,14 +26,26 @@
     # <https://github.com/nixos/nixpkgs/tree/nixos-22.11>
     # nixpkgs-stable.url = "github:nixos/nixpkgs?ref=nixos-22.11";
 
+    # branch workflow:
+    # - daily:
+    #   - nixos-unstable cut from master after enough packages have been built in caches.
+    # - every 6 hours:
+    #   - master auto-merged into staging.
+    #   - staging-next auto-merged into staging.
+    # - manually, approximately once per month:
+    #   - staging-next is cut from staging.
+    #   - staging-next merged into master.
+    #
+    # which branch to source from?
+    # - for everyday development, prefer `nixos-unstable` branch, as it provides good caching.
+    # - if need to test bleeding updates (e.g. if submitting code into staging):
+    #   - use `staging-next` if it's been cut (i.e. if there's an active staging-next -> master PR)
+    #   - use `staging` if no staging-next branch has been cut.
+    #
     # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
     # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
     nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
-
-    # nixpkgs = {
-    #   url = "./nixpatches";
-    #   inputs.nixpkgs.follows = "nixpkgs-unpatched";
-    # };
+    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging";
 
     mobile-nixos = {
       # <https://github.com/nixos/mobile-nixos>
@@ -241,9 +253,9 @@
         let
           pkgs = self.legacyPackages."x86_64-linux";
           deployScript = action: pkgs.writeShellScript "deploy-moby" ''
-            nixos-rebuild --flake '.#cross-moby' build
+            nixos-rebuild --flake '.#moby' build $@
             sudo nix sign-paths -r -k /run/secrets/nix_serve_privkey $(readlink ./result)
-            nixos-rebuild --flake '.#cross-moby' ${action} --target-host colin@moby --use-remote-sudo
+            nixos-rebuild --flake '.#moby' ${action} --target-host colin@moby-hn --use-remote-sudo $@
           '';
         in {
           update-feeds = {
@@ -262,7 +274,7 @@
             type = "app";
             program = ''${deployScript "test"}'';
           };
-          deploy-moby-switch = {
+          deploy-moby = {
             # `nix run '.#deploy-moby-switch'`
             type = "app";
             program = ''${deployScript "switch"}'';

hosts/by-name/servo/services/matrix/default.nix

@@ -5,9 +5,8 @@
 {
   imports = [
     ./discord-puppet.nix
-    # ./irc.nix
-    # TODO(2023/03/10): disabled because it's not bridging and mautrix_signal is hogging CPU
-    # ./signal.nix
+    ./irc.nix
+    ./signal.nix
   ];
 
   sane.persist.sys.plaintext = [

hosts/by-name/servo/services/matrix/irc-no-reveal-bridge.patch

@@ -0,0 +1,13 @@
+diff --git a/src/irc/ConnectionInstance.ts b/src/irc/ConnectionInstance.ts
+index 688036ca..3373fa27 100644
+--- a/src/irc/ConnectionInstance.ts
++++ b/src/irc/ConnectionInstance.ts
+@@ -149,7 +149,7 @@ export class ConnectionInstance {
+         if (this.dead) {
+             return Promise.resolve();
+         }
+-        ircReason = ircReason || reason;
++        ircReason = "bye"; // don't reveal through the IRC quit message that we're a bridge
+         log.info(
+             "disconnect()ing %s@%s - %s", this.nick, this.domain, reason
+         );

hosts/by-name/servo/services/matrix/irc-no-reveal-mxid.patch

@@ -0,0 +1,50 @@
+diff --git a/config.schema.yml b/config.schema.yml
+index 2e71c8d6..42ba8ba1 100644
+--- a/config.schema.yml
++++ b/config.schema.yml
+@@ -433,7 +433,7 @@ properties:
+                                     type: "boolean"
+                                 realnameFormat:
+                                     type: "string"
+-                                    enum: ["mxid","reverse-mxid"]
++                                    enum: ["mxid","reverse-mxid","localpart"]
+                                 ipv6:
+                                     type: "object"
+                                     properties:
+diff --git a/src/irc/IdentGenerator.ts b/src/irc/IdentGenerator.ts
+index 7a2b5cf1..50f7815a 100644
+--- a/src/irc/IdentGenerator.ts
++++ b/src/irc/IdentGenerator.ts
+@@ -74,6 +74,9 @@ export class IdentGenerator {
+         else if (server.getRealNameFormat() === "reverse-mxid") {
+             realname = IdentGenerator.sanitiseRealname(IdentGenerator.switchAroundMxid(matrixUser));
+         }
++        else if (server.getRealNameFormat() == "localpart") {
++            realname = IdentGenerator.sanitiseRealname(matrixUser.localpart);
++        }
+         else {
+             throw Error('Invalid value for realNameFormat');
+         }
+diff --git a/src/irc/IrcServer.ts b/src/irc/IrcServer.ts
+index 2af73ab4..895b9783 100644
+--- a/src/irc/IrcServer.ts
++++ b/src/irc/IrcServer.ts
+@@ -101,7 +101,7 @@ export interface IrcServerConfig {
+         };
+         lineLimit: number;
+         userModes?: string;
+-        realnameFormat?: "mxid"|"reverse-mxid";
++        realnameFormat?: "mxid"|"reverse-mxid"|"localpart";
+         pingTimeoutMs: number;
+         pingRateMs: number;
+         kickOn: {
+@@ -289,7 +289,7 @@ export class IrcServer {
+         return this.config.ircClients.userModes || "";
+     }
+ 
+-    public getRealNameFormat(): "mxid"|"reverse-mxid" {
++    public getRealNameFormat(): "mxid"|"reverse-mxid"|"localpart" {
+         return this.config.ircClients.realnameFormat || "mxid";
+     }
+ 
+

hosts/by-name/servo/services/matrix/irc.nix

@@ -1,21 +1,120 @@
+# config docs:
+# - <https://github.com/matrix-org/matrix-appservice-irc/blob/develop/config.sample.yaml>
+# TODO: /quit message for bridged users reveals to IRC users that i'm using a bridge;
+#       probably want to remove that.
 { config, lib, ... }:
 
+let
+  ircServer = { name, additionalAddresses ? [], sasl ? true }: let
+    lowerName = lib.toLower name;
+  in {
+    # XXX sasl: appservice doesn't support NickServ identification (only SASL, or PASS if sasl = false)
+    inherit name additionalAddresses sasl;
+    port = 6697;
+    ssl = true;
+    botConfig = {
+      # bot has no presence in IRC channel; only real Matrix users
+      enabled = false;
+      # this is the IRC username/nickname *of the bot* (not visible in channels): not of the end-user.
+      # the irc username/nick of a mapped Matrix user is determined further down in `ircClients` section.
+      # if `enabled` is false, then this name probably never shows up on the IRC side (?)
+      nick = "uninsane";
+      username = "uninsane";
+      joinChannelsIfNoUsers = false;
+    };
+    dynamicChannels = {
+      enabled = true;
+      aliasTemplate = "#irc_${lowerName}_$CHANNEL";
+      published = false;  # false => irc rooms aren't listed in homeserver public rooms list
+      federate = false;  # false => Matrix users from other homeservers can't join IRC channels
+    };
+    ircClients = {
+      nickTemplate = "$LOCALPARTsane";  # @colin:uninsane.org (Matrix) -> colinsane (IRC)
+      realnameFormat = "reverse-mxid";  # @colin:uninsane.org (Matrix) -> org.uninsane:colin (IRC)
+      # realnameFormat = "localpart";  # @colin:uninsane.org (Matrix) -> colin (IRC)  -- but requires the mxid patch below
+      # by default, Matrix will convert messages greater than (3) lines into a pastebin-like URL to send to IRC.
+      lineLimit = 20;
+      # Rizon in particular allows only 4 connections from one IP before a 30min ban.
+      # that's effectively reduced to 2 during a netsplit, or maybe during a restart.
+      #   - https://wiki.rizon.net/index.php?title=Connection/Session_Limit_Exemptions
+      # especially, misconfigurations elsewhere in this config may cause hundreds of connections
+      # so this is a safeguard.
+      maxClients = 2;
+      # don't have the bridge disconnect me from IRC when idle.
+      idleTimeout = 0;
+      concurrentReconnectLimit = 2;
+      reconnectIntervalMs = 60000;
+      kickOn = {
+        # remove Matrix user from room when...
+        channelJoinFailure = false;
+        ircConnectionFailure = false;
+        userQuit = true;
+      };
+    };
+    matrixClients = {
+      userTemplate = "@irc_${lowerName}_$NICK";  # the :uninsane.org part is appended automatically
+    };
+
+    # this will let this user message the appservice with `!join #<IRCChannel>` and the rest "Just Works"
+    "@colin:uninsane.org" = "admin";
+
+    membershipLists = {
+      enabled = true;
+      global = {
+        ircToMatrix = {
+          initial = true;
+          incremental = true;
+          requireMatrixJoined = false;
+        };
+        matrixToIrc = {
+          initial = true;
+          incremental = true;
+        };
+      };
+      ignoreIdleUsersOnStartup = {
+        enabled = false;  # false => always bridge users, even if idle
+      };
+    };
+    # sync room description?
+    bridgeInfoState = {
+      enabled = true;
+      initial = true;
+    };
+
+    # for per-user IRC password:
+    # - invite @irc_${lowerName}_NickServ:uninsane.org to a DM and type `help`  => register
+    # - invite the matrix-appservice-irc user to a DM and type `!help`   => add PW to database
+    # to validate that i'm authenticated on the IRC network, DM @irc_${lowerName}_NickServ:uninsane.org:
+    # - send: `STATUS colinsane`
+    # - response should be `3`: "user recognized as owner via password identification"
+    # passwordEncryptionKeyPath = "/path/to/privkey";  # appservice will generate its own if unspecified
+  };
+in
 {
+
+  nixpkgs.overlays = [
+    (next: prev: {
+      matrix-appservice-irc = prev.matrix-appservice-irc.overrideAttrs (super: {
+        patches = super.patches or [] ++ [
+          ./irc-no-reveal-bridge.patch
+          # ./irc-no-reveal-mxid.patch
+        ];
+      });
+    })
+  ];
+
   sane.persist.sys.plaintext = [
     # TODO: mode?
-    # user and group are both "matrix-appservice-irc"
-    { user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
+    { user = "matrix-appservice-irc"; group = "matrix-appservice-irc"; directory = "/var/lib/matrix-appservice-irc"; }
   ];
 
   services.matrix-synapse.settings.app_service_config_files = [
     "/var/lib/matrix-appservice-irc/registration.yml"  # auto-created by irc appservice
   ];
 
-  # note: Rizon allows only FOUR simultaneous IRC connections per IP: https://wiki.rizon.net/index.php?title=Connection/Session_Limit_Exemptions
   # Rizon supports CertFP for auth: https://wiki.rizon.net/index.php?title=CertFP
   services.matrix-appservice-irc.enable = true;
   services.matrix-appservice-irc.registrationUrl = "http://127.0.0.1:8009";
-  # settings documented here: https://github.com/matrix-org/matrix-appservice-irc/blob/develop/config.sample.yaml
   services.matrix-appservice-irc.settings = {
     homeserver = {
       url = "http://127.0.0.1:8008";
@@ -28,68 +127,11 @@
 
     ircService = {
       servers = {
-        "irc.rizon.net" = {
-          name = "Rizon";
-          port = 6697;  # SSL port
-          ssl = true;
-          sasl = true;  # appservice doesn't support NickServ identification
-          botConfig = {
-            # bot has no presence in IRC channel; only real Matrix users
-            enabled = false;
-            # nick = "UninsaneDotOrg";
-            nick = "uninsane";
-            username = "uninsane";
-          };
-          dynamicChannels = {
-            enabled = true;
-            aliasTemplate = "#irc_rizon_$CHANNEL";
-          };
-          ircClients = {
-            nickTemplate = "$LOCALPARTsane";
-            # by default, Matrix will convert messages greater than (3) lines into a pastebin-like URL to send to IRC.
-            lineLimit = 20;
-          };
-          matrixClients = {
-            userTemplate = "@irc_rizon_$NICK";  # the :uninsane.org part is appended automatically
-          };
-
-          # this will let this user message the appservice with `!join #<IRCChannel>` and the rest "Just Works"
-          "@colin:uninsane.org" = "admin";
-
-          membershipLists = {
-            enabled = true;
-            global = {
-              ircToMatrix = {
-                initial = true;
-                incremental = true;
-                requireMatrixJoined = false;
-              };
-              matrixToIrc = {
-                initial = true;
-                incremental = true;
-              };
-            };
-          };
-          # sync room description?
-          bridgeInfoState = {
-            enabled = true;
-            initial = true;
-          };
-
-          # hardcoded mappings, for when dynamicChannels fails us. TODO: probably safe to remove these.
-          # mappings = {
-          #   "#chat" = {
-          #     roomIds = [ "!GXJSOTdbtxRboGtDep:uninsane.org" ];
-          #   };
-          #   # BakaBT requires account registration, which i think means my user needs to be added before the appservice user
-          #   "#BakaBT" = {
-          #     roomIds = [ "!feZKttuYuHilqPFSkD:uninsane.org" ];
-          #   };
-          # };
-          # for per-user IRC password:
-          #   invite @irc_rizon_NickServ:uninsane.org to a DM and type `help`  => register
-          #   invite the matrix-appservice-irc user to a DM and type `!help`   => add PW to database
-          # passwordEncryptionKeyPath = "/path/to/privkey";  # appservice will generate its own if unspecified
+        "irc.rizon.net" = ircServer { name = "Rizon"; };
+        "irc.myanonamouse.net" = ircServer {
+          name = "MyAnonamouse";
+          additionalAddresses = [ "irc2.myanonamouse.net" ];
+          sasl = false;
         };
       };
     };

hosts/common/cross/default.nix

@@ -72,10 +72,8 @@
 #   - #cross-compiling:nixos.org says pkgsCross.gnu64 IS KNOWN TO NOT COMPILE. let this go for now:
 
 # Nixpkgs PR tracker:
-# - browserpass (2023/03/14): <https://github.com/NixOS/nixpkgs/pull/221310>
-# - gupnp_1_6 (2023/03/14): <https://github.com/NixOS/nixpkgs/pull/221308>
-# - libmbim (2023/02/22, not mine): <https://github.com/NixOS/nixpkgs/pull/217701>
-
+# - 2023/04/12 (gst_all_1): https://github.com/NixOS/nixpkgs/pull/225664
+# - 2023/04/12 (subversion,serf,apr-util,pam_mount): https://github.com/NixOS/nixpkgs/pull/225977
 
 { config, lib, options, pkgs, ... }:
 
@@ -269,65 +267,67 @@ in
     # the configuration of which specific package set `pkgs.cross` refers to happens elsewhere;
     # here we just define them all.
 
-    nixpkgs.config.perlPackageOverrides = pkgs: (with pkgs; with pkgs.perlPackages; {
-      # these are the upstream nixpkgs perl modules, but with `nativeBuildInputs = [ perl ]`
-      # to fix cross compilation errors
-      ModuleBuild = buildPerlPackage {
-        pname = "Module-Build";
-        version = "0.4231";
-        src = fetchurl {
-          url = "mirror://cpan/authors/id/L/LE/LEONT/Module-Build-0.4231.tar.gz";
-          hash = "sha256-fg9MaSwXQMGshOoU1+o9i8eYsvsmwJh3Ip4E9DCytxc=";
-        };
-        # support cross-compilation by removing unnecessary File::Temp version check
-        # postPatch = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-        #   sed -i '/File::Temp/d' Build.PL
-        # '';
-        nativeBuildInputs = [ perl ];
-        meta = {
-          description = "Build and install Perl modules";
-          license = with lib.licenses; [ artistic1 gpl1Plus ];
-          mainProgram = "config_data";
-        };
-      };
-      FileBaseDir = buildPerlModule {
-        version = "0.08";
-        pname = "File-BaseDir";
-        src = fetchurl {
-          url = "mirror://cpan/authors/id/K/KI/KIMRYAN/File-BaseDir-0.08.tar.gz";
-          hash = "sha256-wGX80+LyKudpk3vMlxuR+AKU1QCfrBQL+6g799NTBeM=";
-        };
-        configurePhase = ''
-          runHook preConfigure
-          perl Build.PL PREFIX="$out" prefix="$out"
-        '';
-        nativeBuildInputs = [ perl ];
-        propagatedBuildInputs = [ IPCSystemSimple ];
-        buildInputs = [ FileWhich ];
-        meta = {
-          description = "Use the Freedesktop.org base directory specification";
-          license = with lib.licenses; [ artistic1 gpl1Plus ];
-        };
-      };
-      # fixes: "FAILED IPython/terminal/tests/test_debug_magic.py::test_debug_magic_passes_through_generators - pexpect.exceptions.TIMEOUT: Timeout exceeded."
-      Testutf8 = buildPerlPackage {
-        pname = "Test-utf8";
-        version = "1.02";
-        src = fetchurl {
-          url = "mirror://cpan/authors/id/M/MA/MARKF/Test-utf8-1.02.tar.gz";
-          hash = "sha256-34LwnFlAgwslpJ8cgWL6JNNx5gKIDt742aTUv9Zri9c=";
-        };
-        nativeBuildInputs = [ perl ];
-        meta = {
-          description = "Handy utf8 tests";
-          homepage = "https://github.com/2shortplanks/Test-utf8/tree";
-          license = with lib.licenses; [ artistic1 gpl1Plus ];
-        };
-      };
-      # inherit (pkgs.emulated.perl.pkgs)
-      #   Testutf8
-      # ;
-    });
+    # nixpkgs.config.perlPackageOverrides = pkgs': (with pkgs'; with pkgs'.perlPackages; {
+    #   # these are the upstream nixpkgs perl modules, but with `nativeBuildInputs = [ perl ]`
+    #   # to fix cross compilation errors
+    #   # see <nixpkgs:pkgs/top-level/perl-packages.nix>
+    #   # TODO: try this PR: https://github.com/NixOS/nixpkgs/pull/225640
+    #   ModuleBuild = buildPerlPackage {
+    #     pname = "Module-Build";
+    #     version = "0.4231";
+    #     src = pkgs.fetchurl {
+    #       url = "mirror://cpan/authors/id/L/LE/LEONT/Module-Build-0.4231.tar.gz";
+    #       hash = "sha256-fg9MaSwXQMGshOoU1+o9i8eYsvsmwJh3Ip4E9DCytxc=";
+    #     };
+    #     # support cross-compilation by removing unnecessary File::Temp version check
+    #     # postPatch = lib.optionalString (pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform) ''
+    #     #   sed -i '/File::Temp/d' Build.PL
+    #     # '';
+    #     nativeBuildInputs = [ perl ];
+    #     meta = {
+    #       description = "Build and install Perl modules";
+    #       license = with lib.licenses; [ artistic1 gpl1Plus ];
+    #       mainProgram = "config_data";
+    #     };
+    #   };
+    #   FileBaseDir = buildPerlModule {
+    #     version = "0.08";
+    #     pname = "File-BaseDir";
+    #     src = pkgs.fetchurl {
+    #       url = "mirror://cpan/authors/id/K/KI/KIMRYAN/File-BaseDir-0.08.tar.gz";
+    #       hash = "sha256-wGX80+LyKudpk3vMlxuR+AKU1QCfrBQL+6g799NTBeM=";
+    #     };
+    #     configurePhase = ''
+    #       runHook preConfigure
+    #       perl Build.PL PREFIX="$out" prefix="$out"
+    #     '';
+    #     nativeBuildInputs = [ perl ];
+    #     propagatedBuildInputs = [ IPCSystemSimple ];
+    #     buildInputs = [ FileWhich ];
+    #     meta = {
+    #       description = "Use the Freedesktop.org base directory specification";
+    #       license = with lib.licenses; [ artistic1 gpl1Plus ];
+    #     };
+    #   };
+    #   # fixes: "FAILED IPython/terminal/tests/test_debug_magic.py::test_debug_magic_passes_through_generators - pexpect.exceptions.TIMEOUT: Timeout exceeded."
+    #   Testutf8 = buildPerlPackage {
+    #     pname = "Test-utf8";
+    #     version = "1.02";
+    #     src = pkgs.fetchurl {
+    #       url = "mirror://cpan/authors/id/M/MA/MARKF/Test-utf8-1.02.tar.gz";
+    #       hash = "sha256-34LwnFlAgwslpJ8cgWL6JNNx5gKIDt742aTUv9Zri9c=";
+    #     };
+    #     nativeBuildInputs = [ perl ];
+    #     meta = {
+    #       description = "Handy utf8 tests";
+    #       homepage = "https://github.com/2shortplanks/Test-utf8/tree";
+    #       license = with lib.licenses; [ artistic1 gpl1Plus ];
+    #     };
+    #   };
+    #   # inherit (pkgs.emulated.perl.pkgs)
+    #   #   Testutf8
+    #   # ;
+    # });
     # XXX: replaceStdenv only affects non-cross stages
     # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
     nixpkgs.overlays = crossOnlyUniversalOverlays ++ [
@@ -412,9 +412,11 @@ in
             # nixpkgs hdf5 is at commit 3e847e003632bdd5fdc189ccbffe25ad2661e16f
             # hdf5  # configure: error: cannot run test program while cross compiling
             # http2
+            ibus
+            jellyfin-web  # in node-dependencies-jellyfin-web: "node: command not found"  (nodePackages don't cross compile)
             # libgccjit  # "../../gcc-9.5.0/gcc/jit/jit-result.c:52:3: error: 'dlclose' was not declared in this scope"  (needed by emacs!)
             # libsForQt5  # qtbase  # make: g++: No such file or directory
-            # perlInterpreters  # perl5.36.0-Module-Build perl5.36.0-Test-utf8 (see tracking issues ^)
+            perlInterpreters  # perl5.36.0-Module-Build perl5.36.0-Test-utf8 (see tracking issues ^)
             # qgnomeplatform
             # qtbase
             qt5  # qt5.qtx11extras fails, but we can't selectively emulate it
@@ -508,30 +510,8 @@ in
           #         inherit (self) apacheHttpd;
           #       };
           #     };
-          # appstream = prev.appstream.override {
-          #   # doesn't fix: "ld: error adding symbols: file in wrong format"
-          #   inherit (emulated) stdenv;
-          # };
-          # appstream = prev.appstream.overrideAttrs (orig: {
-          #   # fixes "Program 'gperf' not found or not executable"
-          #   # does not fix "ERROR: An exe_wrapper is needed but was not found. Please define one in cross file and check the command and/or add it to PATH."
-          #   nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gperf ];
-          # });
-          # appstream = prev.appstream.overrideAttrs (upstream: {
-          #   # does not fix "Program 'gperf' not found or not executable"
-          #   nativeBuildInputs = upstream.nativeBuildInputs ++ lib.optionals (!prev.stdenv.buildPlatform.canExecute prev.stdenv.hostPlatform) [
-          #     next.mesonEmulatorHook
-          #   ];
-          # });
-          appstream = prev.appstream.overrideAttrs (upstream: {
-            # fixes "Program 'gperf' not found or not executable"
-            nativeBuildInputs = upstream.nativeBuildInputs ++ lib.optionals (!prev.stdenv.buildPlatform.canExecute prev.stdenv.hostPlatform) [
-              next.mesonEmulatorHook
-            ] ++ [
-              next.gperf
-            ];
-          });
 
+          # TODO(REMOVE AFTER MERGE): https://github.com/NixOS/nixpkgs/pull/225977
           aprutil = prev.aprutil.overrideAttrs (upstream: {
             # nixpkgs patches the ldb version only for the package itself, but derivative packages (serf -> subversion) inherit the wrong -ldb-6.9 flag.
             postConfigure = upstream.postConfigure + lib.optionalString (next.stdenv.buildPlatform != next.stdenv.hostPlatform) ''
@@ -548,21 +528,6 @@ in
             # configure: error: no acceptable C compiler found in $PATH
             inherit (emulated) stdenv;
           };
-          # browserpass = prev.browserpass.override {
-          #   # fixes "qemu-aarch64: Could not open '/lib/ld-linux-aarch64.so.1': No such file or directory"
-          #   inherit (emulated) buildGoModule;  # buildGoModule holds the stdenv
-          # };
-          browserpass = prev.browserpass.overrideAttrs (upstream: {
-            # fixes "qemu-aarch64: Could not open '/lib/ld-linux-aarch64.so.1': No such file or directory"
-            # default browserpass `make` both builds AND tests
-            buildPhase = ''
-              make browserpass
-            '';
-            checkPhase = ''
-              make test
-            '';
-            doCheck = next.stdenv.hostPlatform == next.stdenv.buildPlatform;
-          });
           cantarell-fonts = prev.cantarell-fonts.override {
             # fixes error where python3.10-skia-pathops dependency isn't available for the build platform
             inherit (emulated) stdenv;
@@ -632,9 +597,6 @@ in
             ];
           });
 
-          # fixes: "meson.build:100:0: ERROR: Dependency lookup for wayland-scanner with method 'pkgconfig' failed: Pkg-config binary for machine 0 not found. Giving up."
-          fuzzel = addInputs { depsBuildBuild = [ next.pkg-config ]; } prev.fuzzel;
-
           fwupd-efi = prev.fwupd-efi.override {
             # fwupd-efi queries meson host_machine to decide what arch to build for.
             #   for some reason, this gives x86_64 unless meson itself is emulated.
@@ -674,51 +636,6 @@ in
           gcr_4 = mvInputs { nativeBuildInputs = [ next.gnupg next.openssh ]; } prev.gcr_4;
           gthumb = mvInputs { nativeBuildInputs = [ next.glib ]; } prev.gthumb;
 
-          gmime = prev.gmime.overrideAttrs (upstream: {
-            configureFlags = upstream.configureFlags ++ [
-              "ac_cv_have_iconv_detect_h=yes"  # fixes: "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
-              "--enable-cryptography=yes"  # force GPGME  (TODO: might not be necessary?)
-            ];
-            postPatch = upstream.postPatch + ''
-              # mimick how upstream builds iconv-detect.h
-              # the resulting binary is for the host, but unlike configure we know how to invoke that.
-              "$CC" ./iconv-detect.c -o iconv-detect
-              ./iconv-detect
-              rm iconv-detect
-            '';
-          });
-          gmime3 = prev.gmime3.overrideAttrs (upstream: {
-            configureFlags = upstream.configureFlags ++ [
-              "ac_cv_have_iconv_detect_h=yes"  # fixes: "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
-              "--enable-crypto=yes"  # force GPGME  (TODO: might not be necessary?)
-            ];
-            postPatch = upstream.postPatch + ''
-              # mimick how upstream builds iconv-detect.h
-              # the resulting binary is for the host, but unlike configure we know how to invoke that.
-              "$CC" ./iconv-detect.c -o iconv-detect
-              ./iconv-detect
-              rm iconv-detect
-            '';
-            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
-              next.buildPackages.gobject-introspection
-            ];
-            # configure detects gpgme support by invoking `gpgme-config` which otherwise fails on cross-compiled builds and causes gmime3 to build without gpgme support.
-            # consumers of gmime3 expect gpgme support, so make sure we build it on all platforms with this.
-            GPGME_CONFIG = next.buildPackages.writeShellScript "gpgme-config" ''
-              exec ${lib.getBin next.gpgme.dev}/bin/gpgme-config $@
-            '';
-          });
-
-          # gmime3 = prev.gmime3.overrideAttrs (orig: {
-          #   # fixes: "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
-          #   # new error: something about python imports; doesn't happen on nixpkgs/tip.
-          #   configureFlags = orig.configureFlags ++ [ "ac_cv_have_iconv_detect_h=no" ];
-          #   nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gobject-introspection ];
-          #   # XXX lib.remove doesn't work on pkg sets (?)
-          #   buildInputs = with next; [ vala zlib gpgme libidn2 libunistring ];
-          #   # buildInputs = lib.remove next.gobject-introspection orig.buildInputs;
-          # });
-
           gnome = prev.gnome.overrideScope' (self: super: {
             inherit (emulated.gnome)
             ;
@@ -817,6 +734,8 @@ in
                 "-Dextensions_tool=false"
                 "-Dman=false"
                 "-Dgtk_doc=false"
+                # fixes "src/st/meson.build:198:2: ERROR: Dependency "libmutter-test-12" not found, tried pkgconfig"
+                "-Dtests=false"
               ];
               outputs = [ "out" "dev" ];
               postPatch = upstream.postPatch or "" + ''
@@ -938,39 +857,8 @@ in
             buildInputs = lib.remove next.gobject-introspection upstream.buildInputs;
             strictDeps = true;
           });
-          gupnp_1_6 = prev.gupnp_1_6.overrideAttrs (orig: {
-            # fixes "subprojects/gi-docgen/meson.build:10:0: ERROR: python3 not found"
-            # this patch is copied from the default gupnp.
-            outputs = [ "out" "dev" ]
-              ++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
-            mesonFlags = [
-              "-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
-              "-Dintrospection=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
-            ];
-          });
 
           gst_all_1 = prev.gst_all_1 // {
-            # gst-editing-services = prev.gst_all_1.gst-editing-services.override {
-            #   # fixes "Run-time dependency gst-validate-1.0 found: NO"
-            #   # new failure mode: "/nix/store/grqh2wygy9f9wp5bgvqn4im76v82zmcx-binutils-2.39/bin/ld: /nix/store/f7yr5z123d162p5457jh3wzkqm7x8yah-glib-2.74.3/lib/libgobject-2.0.so: error adding symbols: file in wrong format"
-            #   inherit (emulated) stdenv;
-            # };
-            # XXX this feels risky; it propagates a (conflicting) gst-plugins to all consumers
-            # gst-editing-services = emulated.gst_all_1.gst-editing-services;
-            # fixes "Run-time dependency gst-validate-1.0 found: NO"
-            # fixes undefined references to Py_Initialize, etc.
-            # - alternative is `mesonFlags = [ "-Dpython=disabled" ]`
-            gst-editing-services = addBuildInputs
-              [ next.python3 ]
-              (mvToBuildInputs [ next.gst_all_1.gst-devtools ] prev.gst_all_1.gst-editing-services);
-            # gst-editing-services =
-            #   (mvToBuildInputs [ next.gst_all_1.gst-devtools ] prev.gst_all_1.gst-editing-services);
-            #   .overrideAttrs (upstream: {
-            #     mesonFlags = upstream.mesonFlags ++ [
-            #       # disable "python formatters" to avoid undefined references to Py_Initialize, etc.
-            #       "-Dpython=disabled"
-            #     ];
-            #   });
             # inherit (emulated.gst_all_1) gst-plugins-good;
             # gst-plugins-good = prev.gst_all_1.gst-plugins-good.override {
             #   # when invoked with `qt5Support = true`, qtbase shows up in both buildInputs and nativeBuildInputs
@@ -1003,17 +891,20 @@ in
           i2p = mvToNativeInputs [ next.ant next.gettext ] prev.i2p;
 
           # ibus = (prev.ibus.override {
-          #   # fixes: "configure.ac:152: error: possibly undefined macro: AM_PATH_GLIB_2_0"
-          #   inherit (emulated) stdenv;
-          ibus = prev.ibus.overrideAttrs (upstream: {
-            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
-              next.glib  # fixes: ImportError: /nix/store/fi1rsalr11xg00dqwgzbf91jpl3zwygi-gobject-introspection-aarch64-unknown-linux-gnu-1.74.0/lib/gobject-introspection/giscanner/_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory
-              next.buildPackages.gobject-introspection  # fixes "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
-            ];
-            buildInputs = lib.remove next.gobject-introspection upstream.buildInputs ++ [
-              next.vala  # fixes: "Package `ibus-1.0' not found in specified Vala API directories or GObject-Introspection GIR directories"
-            ];
-          });
+          #   inherit (emulated)
+          #     stdenv # fixes: "configure: error: cannot run test program while cross compiling"
+          #     gobject-introspection # "cannot open shared object ..."
+          #   ;
+          # });
+          # .overrideAttrs (upstream: {
+          #   nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
+          #     next.glib  # fixes: ImportError: /nix/store/fi1rsalr11xg00dqwgzbf91jpl3zwygi-gobject-introspection-aarch64-unknown-linux-gnu-1.74.0/lib/gobject-introspection/giscanner/_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory
+          #     next.buildPackages.gobject-introspection  # fixes "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
+          #   ];
+          #   buildInputs = lib.remove next.gobject-introspection upstream.buildInputs ++ [
+          #     next.vala  # fixes: "Package `ibus-1.0' not found in specified Vala API directories or GObject-Introspection GIR directories"
+          #   ];
+          # });
 
           # fixes "./autogen.sh: line 26: gtkdocize: not found"
           iio-sensor-proxy = mvToNativeInputs [ next.glib next.gtk-doc ] prev.iio-sensor-proxy;
@@ -1030,22 +921,34 @@ in
               openjdk8-bootstrap = useEmulatedStdenv prev.javaPackages.compiler.openjdk8-bootstrap;
               # fixes "configure: error: Could not find required tool for WHICH"
               openjdk8 = useEmulatedStdenv prev.javaPackages.compiler.openjdk8;
-              openjdk19 = (
-                # fixes "configure: error: Could not find required tool for ZIPEXE"
-                # new failure: "checking for cc... [not found]"
-                (mvToNativeInputs
-                  [ next.zip ]
-                  (useEmulatedStdenv prev.javaPackages.compiler.openjdk19)
-                ).overrideAttrs (_upstream: {
-                  # avoid building `support/demos`, which segfaults
-                  buildFlags = [ "product-images" ];
-                  doCheck = false;  # pre-emptive
-                })
-              );
-              # openjdk19 = emulated.javaPackages.compiler.openjdk19;
+              # openjdk19 = (
+              #   # fixes "configure: error: Could not find required tool for ZIPEXE"
+              #   # new failure: "checking for cc... [not found]"
+              #   (mvToNativeInputs
+              #     [ next.zip ]
+              #     (useEmulatedStdenv prev.javaPackages.compiler.openjdk19)
+              #   ).overrideAttrs (_upstream: {
+              #     # avoid building `support/demos`, which segfaults
+              #     buildFlags = [ "product-images" ];
+              #     doCheck = false;  # pre-emptive
+              #   })
+              # );
+              openjdk19 = emulated.javaPackages.compiler.openjdk19;
             };
           };
 
+          jellyfin-media-player = prev.jellyfin-media-player.overrideAttrs (upstream: {
+            meta = upstream.meta // {
+              platforms = upstream.meta.platforms ++ [
+                "aarch64-linux"
+              ];
+            };
+          });
+          # jellyfin-web = prev.jellyfin-web.override {
+          #   # in node-dependencies-jellyfin-web: "node: command not found"
+          #   inherit (emulated) stdenv;
+          # };
+
           kitty = prev.kitty.overrideAttrs (upstream: {
             # fixes: "FileNotFoundError: [Errno 2] No such file or directory: 'pkg-config'"
             PKGCONFIG_EXE = "${next.buildPackages.pkg-config}/bin/${next.buildPackages.pkg-config.targetPrefix}pkg-config";
@@ -1057,11 +960,6 @@ in
               ./kitty-no-docs.patch
             ];
           });
-
-          libchamplain = prev.libchamplain.overrideAttrs (upstream: {
-            # fixes: "failed to produce output path for output 'devdoc'"
-            outputs = lib.remove "devdoc" upstream.outputs;
-          });
           libgweather = (prev.libgweather.override {
             # alternative to emulating python3 is to specify it in `buildInputs` instead of `nativeBuildInputs` (upstream),
             #   but presumably that's just a different way to emulate it.
@@ -1080,13 +978,8 @@ in
           #   # fixes "Run-time dependency vapigen found: NO (tried pkgconfig)"
           #   buildInputs = upstream.buildInputs ++ [ next.vala ];
           # });
-          # "Can't exec "libtoolize": No such file or directory at /nix/store/r4fvx9hazsm0rdm7s393zd5v665dsh1c-autoconf-2.71/share/autoconf/Autom4te/FileUtils.pm line 294."
-          libHX = mvToNativeInputs [ next.libtool ] prev.libHX;
-          # fixes: "ERROR: Program 'gnutls-certtool certtool' not found or not executable"
-          # N.B.: gnutls library is used by the compiled program (i.e. the host);
-          #   gnutls binaries are used by the build machine.
-          #   therefore gnutls can be specified in both buildInputs and nativeBuildInputs
-          libjcat = addNativeInputs [ next.gnutls ] prev.libjcat;
+
+          # TODO(REMOVE AFTER MERGE): https://github.com/NixOS/nixpkgs/pull/225977
           libqmi = prev.libqmi.overrideAttrs (upstream: {
             # fixes "failed to produce output devdoc"; nixpkgs only builds that output conditionally
             outputs = [ "out" "dev" ] ++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [
@@ -1094,20 +987,6 @@ in
             ];
           });
 
-          librest = prev.librest.overrideAttrs (orig: {
-            # fixes "You must have gtk-doc >= 1.13 installed to build documentation"
-            #   by removing the "--enable-gtk-doc" flag
-            configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
-          });
-          librest_1_0 = prev.librest_1_0.overrideAttrs (orig: {
-            # fixes (meson) "Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)"
-            # inspired by gupnp
-            outputs = [ "out" "dev" ]
-              ++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
-            mesonFlags = orig.mesonFlags ++ [
-              "-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
-            ];
-          });
           libsForQt5 = prev.libsForQt5.overrideScope' (self: super: {
             qgpgme = super.qgpgme.overrideAttrs (orig: {
               # fix so it can find the MOC compiler
@@ -1121,20 +1000,6 @@ in
             });
           });
 
-          # libtiger = prev.libtiger.override {
-          #   # fails to fix: "src/tiger_internal.h:24:10: fatal error: pango/pango.h: No such file or directory"
-          #   inherit (emulated) stdenv;
-          # };
-          # libtiger = prev.libtiger.overrideAttrs (orig: {
-          #   # fails to fix: "src/tiger_internal.h:24:10: fatal error: pango/pango.h: No such file or directory"
-          #   nativeBuildInputs = orig.nativeBuildInputs ++ [ next.libkate next.cairo next.pango ];
-          # });
-          libtiger = prev.libtiger.overrideAttrs (_upstream: {
-            # libtiger seems to expect PKG_CONFIG to be an absolute path? not sure, but without this it claims it can't find pkg-config.
-            HAVE_PKG_CONFIG = "yes";
-          });
-
-
           # fixes: "ar: command not found"
           # `ar` is provided by bintools
           ncftp = addNativeInputs [ next.bintools ] prev.ncftp;
@@ -1263,6 +1128,7 @@ in
           #   nativeBuildInputs = upstream.nativeBuildInputs ++ [ next.gpgme ];
           # });
 
+          # TODO(REMOVE AFTER MERGE): https://github.com/NixOS/nixpkgs/pull/225977
           # fixes: "perl: command not found"
           pam_mount = mvToNativeInputs [ next.perl ] prev.pam_mount;
 
@@ -1299,8 +1165,6 @@ in
               next.desktop-file-utils  # fixes "meson.build:116:8: ERROR: Program 'update-desktop-database' not found or not executable"
             ];
           } prev.phosh-mobile-settings;
-          # fixes `spa/plugins/bluez5/meson.build:41:0: ERROR: Program 'gdbus-codegen' not found or not executable`
-          pipewire = mvToNativeInputs [ next.glib ] prev.pipewire;
           # psqlodbc = prev.psqlodbc.override {
           #   # fixes "configure: error: odbc_config not found (required for unixODBC build)"
           #   inherit (emulated) stdenv;
@@ -1316,6 +1180,10 @@ in
                 ];
               });
 
+              cryptography = py-prev.cryptography.override {
+                inherit (emulated) rustPlatform;  # "cargo:warning=aarch64-unknown-linux-gnu-gcc: error: unrecognized command-line option ‘-m64’"
+              };
+
               defcon = py-prev.defcon.overridePythonAttrs (orig: {
                 nativeBuildInputs = orig.nativeBuildInputs ++ orig.nativeCheckInputs;
               });
@@ -1429,17 +1297,6 @@ in
           #   # };
           # });
 
-          rapidfuzz-cpp = prev.rapidfuzz-cpp.overrideAttrs (orig: {
-            # fixes "error: could not find git for clone of catch2-populate"
-            buildInputs = orig.buildInputs or [] ++ [ next.catch2_3 ];
-          });
-          rav1e = prev.rav1e.override {
-            # fix "aarch64-unknown-linux-gnu-gcc: error: unrecognized command-line option '-m64'"
-            inherit (emulated)
-              rustPlatform
-              stdenv
-            ;
-          };
           rmlint = prev.rmlint.override {
             # fixes "Checking whether the C compiler works... no"
             # rmlint is scons; it reads the CC environment variable, though, so *may* be cross compilable
@@ -1459,6 +1316,7 @@ in
           #   inherit (emulated) stdenv;
           # };
 
+          # TODO(REMOVE AFTER MERGE): https://github.com/NixOS/nixpkgs/pull/225977
           # fixes "sh: line 1: ar: command not found"
           serf = addNativeInputs [ next.bintools ] prev.serf;
 
@@ -1523,6 +1381,7 @@ in
               wrapGAppsHook  # introduces a competing gtk3 at link-time, unless emulated
             ;
           };
+          # TODO(REMOVE AFTER MERGE): https://github.com/NixOS/nixpkgs/pull/225977
           subversion = prev.subversion.overrideAttrs (upstream: {
             configureFlags = upstream.configureFlags ++ [
               # configure can't find APR and APR-util, unclear why (are they not placed on PATH?)
@@ -1538,8 +1397,6 @@ in
               rmInputs { nativeBuildInputs = [ next.wrapGAppsHook4 ]; } prev.sysprof
             )
           );
-          # fixes "configure: error: *** gdbus-codegen is required to build tpm2-abrmd; No package 'gio-unix-2.0' found"
-          tpm2-abrmd = addNativeInputs [ next.glib ] prev.tpm2-abrmd;
           tracker-miners = prev.tracker-miners.override {
             # fixes "meson.build:183:0: ERROR: Can not run test applications in this cross environment."
             inherit (emulated) stdenv;
@@ -1592,7 +1449,11 @@ in
           xdg-desktop-portal-gtk = mvToBuildInputs [ next.xdg-desktop-portal ] prev.xdg-desktop-portal-gtk;
           # fixes: "data/meson.build:33:5: ERROR: Program 'msgfmt' not found or not executable"
           # fixes: "src/meson.build:25:0: ERROR: Program 'gdbus-codegen' not found or not executable"
-          xdg-desktop-portal-gnome = mvToNativeInputs [ next.gettext next.glib ] prev.xdg-desktop-portal-gnome;
+          xdg-desktop-portal-gnome = (
+            addNativeInputs [ next.wayland-scanner ] (
+              mvToNativeInputs [ next.gettext next.glib ] prev.xdg-desktop-portal-gnome
+            )
+          );
           # webkitgtk = prev.webkitgtk.override { stdenv = next.ccacheStdenv; };
           # webp-pixbuf-loader = prev.webp-pixbuf-loader.override {
           #   # fixes "Builder called die: Cannot wrap '/nix/store/kpp8qhzdjqgvw73llka5gpnsj0l4jlg8-gdk-pixbuf-aarch64-unknown-linux-gnu-2.42.10/bin/gdk-pixbuf-thumbnailer' because it is not an executable file"
@@ -1602,9 +1463,11 @@ in
           webp-pixbuf-loader = prev.webp-pixbuf-loader.overrideAttrs (upstream: {
             # fixes: "Builder called die: Cannot wrap '/nix/store/kpp8qhzdjqgvw73llka5gpnsj0l4jlg8-gdk-pixbuf-aarch64-unknown-linux-gnu-2.42.10/bin/gdk-pixbuf-thumbnailer' because it is not an executable file"
             # gdk-pixbuf doesn't create a `bin/` directory when cross-compiling, breaks some thumbnailing stuff.
+            # - gnome's gdk-pixbuf *explicitly* doesn't build thumbnailer on cross builds
             # see `librsvg` for a more bullet-proof cross-compilation approach
             postInstall = "";
           });
+          # XXX: aarch64 webp-pixbuf-loader wanted by gdk-pixbuf-loaders.cache.drv, wanted by aarch64 gnome-control-center
       })
     ];
   };

hosts/common/feeds.nix

@@ -109,13 +109,16 @@ let
     (fromDb "talesfromthebridge.buzzsprout.com" // tech)
     ## UnNamed Reverse Engineering Podcast
     (fromDb "reverseengineering.libsyn.com/rss" // tech)
+    ## The Witch Trials of J.K. Rowling
+    ## - <https://www.thefp.com/witchtrials>
+    (mkPod "https://feeds.megaphone.fm/RUNMED9919162779" // pol // infrequent)
   ];
 
   texts = [
     # AGGREGATORS (> 1 post/day)
     (fromDb "lwn.net" // tech)
     (fromDb "lesswrong.com" // rat)
-    (fromDb "econlib.org" // pol)
+    # (fromDb "econlib.org" // pol)
 
     # AGGREGATORS (< 1 post/day)
     (fromDb "palladiummag.com" // uncat)
@@ -134,6 +137,7 @@ let
     (fromDb "rifters.com/crawl" // uncat)
 
     # DEVELOPERS
+    (fromDb "blog.jmp.chat" // tech)
     (fromDb "uninsane.org" // tech)
     (fromDb "ascii.textfiles.com" // tech)  # Jason Scott
     (fromDb "xn--gckvb8fzb.com" // tech)
@@ -207,6 +211,9 @@ let
     ## mostly dating topics. not advice, or humor, but looking through a social lens
     (fromDb "putanumonit.com" // rat)
 
+    # LOCAL
+    (fromDb "capitolhillseattle.com" // pol)
+
     # CODE
     # (mkText "https://github.com/Kaiteki-Fedi/Kaiteki/commits/master.atom" // tech // infrequent)
   ];

hosts/common/home/firefox.nix

@@ -29,8 +29,8 @@ let
     cacheDir = ".cache/mozilla";
     desktop = "firefox.desktop";
   };
-  defaultSettings = firefoxSettings;
-  # defaultSettings = librewolfSettings;
+  # defaultSettings = firefoxSettings;
+  defaultSettings = librewolfSettings;
 
   addon = name: extid: hash: pkgs.fetchFirefoxAddon {
     inherit name hash;

hosts/common/ids.nix

@@ -15,6 +15,8 @@
   sane.ids.acme.gid = 996;
   sane.ids.pleroma.uid = 997;
   sane.ids.acme.uid = 998;
+  sane.ids.matrix-appservice-irc.uid = 993;
+  sane.ids.matrix-appservice-irc.gid = 992;
 
   # greetd (used by sway)
   sane.ids.greeter.uid = 999;

hosts/common/programs.nix

@@ -98,6 +98,7 @@ let
       efivar
       flashrom
       fwupd
+      gh  # MS GitHub cli
       ghostscript  # TODO: imagemagick wrapper should add gs to PATH
       gnupg
       gocryptfs
@@ -110,11 +111,12 @@ let
       lshw
       ffmpeg
       memtester
+      # nettools
       # networkmanager
       nixpkgs-review
       # nixos-generators
-      # nettools
       nmon
+      # node2nix
       oathToolkit  # for oathtool
       # ponymix
       pulsemixer
@@ -133,6 +135,7 @@ let
       unar
       wireguard-tools
       xdg-utils  # for xdg-open
+      # yarn
       # youtube-dl
       yt-dlp
     ;
@@ -167,6 +170,7 @@ let
       "gnome.gnome-weather"
       gpodder-configured
       gthumb
+      jellyfin-media-player
       # lollypop
       mpv
       networkmanagerapplet
@@ -207,13 +211,13 @@ let
       handbrake
       hase
       inkscape
-      jellyfin-media-player  # TODO: try on moby!
       kdenlive
       kid3  # audio tagging
       krita
       libreoffice-fresh  # XXX colin: maybe don't want this on mobile
       mumble
       obsidian
+      slic3r
     ;
   };
   x86GuiPkgs = {
@@ -316,6 +320,10 @@ in
         # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
         emote.dir = [ ".local/share/Emote" ];
 
+        # MS GitHub stores auth token in .config
+        # TODO: we can populate gh's stuff statically; it even lets us use the same oauth across machines
+        gh.private = [ ".config/gh" ];
+
         # XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
         #   then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
         gpodder-configured.dir = [ "gPodder" ];
@@ -347,6 +355,8 @@ in
         # creds, media
         signal-desktop.private = [ ".config/Signal" ];
 
+        # printer/filament settings
+        slic3r.dir = [ ".Slic3r" ];
 
         # creds, widevine .so download. TODO: could easily manage these statically.
         spotify.dir = [ ".config/spotify" ];
@@ -373,6 +383,8 @@ in
 
         whalebird.private = [ ".config/Whalebird" ];
 
+        yarn.dir = [ ".cache/yarn" ];
+
         # zcash coins. safe to delete, just slow to regenerate (10-60 minutes)
         zecwallet-lite.private = [ ".zcash" ];
       }

hosts/common/users.nix

@@ -101,6 +101,7 @@ in
     sane.user.fs."Videos/servo" = fs.wantedSymlinkTo "/mnt/servo-media/Videos";
     sane.user.fs."Videos/servo-incomplete" = fs.wantedSymlinkTo "/mnt/servo-media/incomplete";
     sane.user.fs."Music/servo" = fs.wantedSymlinkTo "/mnt/servo-media/Music";
+    sane.user.fs."Pictures/servo-macros" = fs.wantedSymlinkTo "/mnt/servo-media/Pictures/macros";
 
     # used by password managers, e.g. unix `pass`
     sane.user.fs.".password-store" = fs.wantedSymlinkTo "knowledge/secrets/accounts";

modules/data/feeds/sources/capitolhillseattle.com/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 83424,
+  "content_type": "application/rss+xml; charset=utf-8",
+  "description": "Community News For All of Seattle's Capitol Hill",
+  "favicon": "https://www.capitolhillseattle.com/favicon.ico",
+  "favicon_data_uri": "data:image/png;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////39/f/h4eH/vb29/729vf/i4uL//f39/////////////////////////////////////////////f39/6+vr/81NTX/AgIC/wAAAP8AAAD/AgIC/zU1Nf+wsLD//f39////////////////////////////+vr6/2pqav8BAQH/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AQEB/2xsbP/6+vr//////////////////v7+/7u7u/9VVVX/VVVV/1VVVf9VVVX/VVVV/1VVVf9VVVX/VVVV/1VVVf9VVVX/vb29//7+/v/+/v7//////87Ozv8eHh7/HBwc/xwcHP8cHBz/t7e3/z8/P/+VlZX/WVlZ/xwcHP8cHBz/HBwc/x4eHv/Q0ND//v7+//7+/v9hYWH/AAAA/yUlJf/Dw8P/4ODg//n5+f/29vb//Pz8/+Li4v9MTEz/AAAA/wAAAP8AAAD/ZGRk///////7+/v/MTEx/xUVFf8WFhb/jY2N//7+/v/+/v7//v7+//7+/v/+/v7/+vr6/2FhYf8VFRX/FRUV/zMzM//8/Pz/7+/v/xgYGP8TExP/ExMT/xMTE/+2trb//v7+//7+/v/+/v7//v7+//7+/v/z8/P/JiYm/xMTE/8ZGRn/8PDw/+zs7P8EBAT/AAAA/wAAAP8AAAD/NjY2//39/f/+/v7//v7+//7+/v/+/v7//v7+/zk5Of8AAAD/BgYG/+3t7f/5+fn/FhYW/wAAAP8AAAD/AAAA/wICAv/T09P//v7+//7+/v/+/v7//v7+//7+/v9BQUH/AAAA/xcXF//5+fn//v7+/1FRUf8AAAD/AAAA/wAAAP8AAAD/RUVF//Pz8//+/v7//v7+//7+/v/+/v7/Li4u/wAAAP9UVFT///////////+7u7v/AQEB/wAAAP8AAAD/AAAA/wAAAP8fHx//vLy8//7+/v/+/v7/8/Pz/xEREf8BAQH/vb29/////////////f39/1hYWP8AAAD/AAAA/wAAAP8AAAD/GBgY/15eXv+Li4v/39/f/2tra/8AAAD/W1tb//7+/v/////////////////x8fH/Q0ND/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wMDA/8AAAD/RUVF//Ly8v////////////////////////////b29v+EhIT/EhIS/wAAAP8AAAD/AAAA/wAAAP8TExP/hYWF//f39/////////////////////////////////////////////Ly8v+2trb/kJCQ/5CQkP+3t7f/8/Pz////////////////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==",
+  "hubs": [],
+  "is_podcast": false,
+  "is_push": false,
+  "item_count": 5,
+  "last_updated": "2023-04-02T02:03:11+00:00",
+  "score": 13,
+  "self_url": "https://www.capitolhillseattle.com/feed/",
+  "site_name": "CHS Capitol Hill Seattle News",
+  "site_url": "https://www.capitolhillseattle.com",
+  "title": "CHS Capitol Hill Seattle News",
+  "url": "https://www.capitolhillseattle.com/feed/",
+  "velocity": 1.6,
+  "version": "rss20"
+}

modules/services/mautrix-signal.nix

@@ -2,6 +2,39 @@
 
 with lib;
 let
+  # TODO: upstream these "optional-dependencies"
+  # - search that phrase in <nixpkgs:doc/languages-frameworks/python.section.md>
+  pkg = pkgs.mautrix-signal.overridePythonAttrs (super: {
+    propagatedBuildInputs = super.propagatedBuildInputs ++ (with pkgs.python3.pkgs; [
+      # these optional deps come from mautrix-signal's "optional-requirements.txt"
+
+      # #/e2be
+      # python-olm>=3,<4
+      # pycryptodome>=3,<4
+      # unpaddedbase64>=1,<3
+      # XXX: ^above already included in nixpkgs package
+
+      # #/metrics
+      # prometheus_client>=0.6,<0.17
+      # XXX: ^above already included in nixpkgs package
+
+      # #/formattednumbers
+      # phonenumbers>=8,<9
+      # XXX: ^above already included in nixpkgs package
+
+      # #/qrlink
+      # qrcode>=6,<8
+      # Pillow>=4,<10
+      # XXX: ^above already included in nixpkgs package
+
+      # #/stickers
+      # signalstickers-client>=3,<4
+
+      # #/sqlite
+      # aiosqlite>=0.16,<0.19
+      aiosqlite
+    ]);
+  });
   dataDir = "/var/lib/mautrix-signal";
   registrationFile = "${dataDir}/signal-registration.yaml";
   cfg = config.services.mautrix-signal;
@@ -136,10 +169,10 @@ in
       preStart = ''
         # generate the appservice's registration file if absent
         if [ ! -f '${registrationFile}' ]; then
-          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+          ${pkg}/bin/mautrix-signal \
             --generate-registration \
             --no-update \
-            --base-config='${pkgs.mautrix-signal}/${pkgs.mautrix-signal.pythonModule.sitePackages}/mautrix_signal/example-config.yaml' \
+            --base-config='${pkg}/${pkg.pythonModule.sitePackages}/mautrix_signal/example-config.yaml' \
             --config='${settingsFile}' \
             --registration='${registrationFile}'
         fi
@@ -158,13 +191,13 @@ in
         ProtectControlGroups = true;
 
         PrivateTmp = true;
-        WorkingDirectory = pkgs.mautrix-signal;
+        WorkingDirectory = pkg;
         StateDirectory = baseNameOf dataDir;
         UMask = "0027";
         EnvironmentFile = cfg.environmentFile;
 
         ExecStart = ''
-          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+          ${pkg}/bin/mautrix-signal \
             --config='${settingsFile}' \
             --no-update
         '';

nixpatches/2023-03-03-qtbase-cross-compile.patch

@@ -19,16 +19,3 @@ index e71b0a7613d..72779ac57a5 100644
    ];
  
    NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
-diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
-index 28180d3b0ca..f14c73b10ee 100644
---- a/pkgs/development/libraries/qt-6/qtModule.nix
-+++ b/pkgs/development/libraries/qt-6/qtModule.nix
-@@ -61,7 +61,7 @@ stdenv.mkDerivation (args // {
-       if [[ -z "$dontSyncQt" && -f sync.profile ]]; then
-         # FIXME: this probably breaks crosscompiling as it's not from nativeBuildInputs
-         # I don't know how to get /libexec from nativeBuildInputs to work, it's not under /bin
--        ${lib.getDev self.qtbase}/libexec/syncqt.pl -version "''${version%%-*}"
-+        perl ${lib.getDev self.qtbase}/libexec/syncqt.pl -version "''${version%%-*}"
-       fi
-     '';
- 

nixpatches/2023-03-10-hase.patch

@@ -1,178 +0,0 @@
-diff --git a/pkgs/development/libraries/sparrow3d/default.nix b/pkgs/development/libraries/sparrow3d/default.nix
-new file mode 100644
-index 00000000000..331a02efc5f
---- /dev/null
-+++ b/pkgs/development/libraries/sparrow3d/default.nix
-@@ -0,0 +1,53 @@
-+{ lib
-+, fetchFromGitHub
-+, pkg-config
-+, SDL
-+, SDL_image
-+, SDL_mixer
-+, SDL_net
-+, SDL_ttf
-+, stdenv
-+}:
-+
-+stdenv.mkDerivation (finalAttrs: {
-+  pname = "sparrow3d";
-+  version = "2020-10-06";
-+
-+  src = fetchFromGitHub {
-+    owner = "theZiz";
-+    repo = "sparrow3d";
-+    rev = "2033349d7adeba34bda2c442e1fec22377471134";
-+    hash = "sha256-28j5nbTYBrMN8BQ6XrTlO1D8Viw+RiT3MAl99BAbhR4=";
-+  };
-+
-+  nativeBuildInputs = [
-+    pkg-config
-+  ];
-+
-+  propagatedBuildInputs = [
-+    SDL.dev
-+    SDL_image
-+    SDL_ttf
-+    SDL_mixer
-+    SDL_net
-+  ];
-+
-+  postConfigure = ''
-+    NIX_CFLAGS_COMPILE=$(pkg-config --cflags SDL_image SDL_ttf SDL_mixer SDL_net)
-+  '';
-+
-+  installPhase = ''
-+    mkdir -p $out/{include,lib/pkgconfig}
-+    cp sparrow*.h $out/include
-+    cp libsparrow{3d,Net,Sound}.so $out/lib
-+    substituteAll ${./sparrow3d.pc.in} $out/lib/pkgconfig/sparrow3d.pc
-+  '';
-+
-+  meta = with lib; {
-+    description = "a software renderer for different open handhelds like the gp2x, wiz, caanoo and pandora";
-+    homepage = "https://github.com/theZiz/sparrow3d";
-+    license = licenses.lgpl21;
-+    maintainers = with maintainers; [ colinsane ];
-+    platforms = [ "x86_64-linux" ];
-+  };
-+})
-diff --git a/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in b/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in
-new file mode 100644
-index 00000000000..046e174ea97
---- /dev/null
-+++ b/pkgs/development/libraries/sparrow3d/sparrow3d.pc.in
-@@ -0,0 +1,17 @@
-+prefix=@out@
-+includedir=${prefix}/include
-+libdir=${prefix}/lib
-+
-+Name: sparrow3d
-+Description: a software renderer for different open handhelds like the gp2x, wiz, caanoo and pandora
-+URL: https://github.com/theZiz/sparrow3d
-+Version: @version@
-+Requires: \
-+  sdl \
-+  SDL_image \
-+  SDL_ttf \
-+  SDL_mixer \
-+  SDL_net
-+Cflags: -isystem${includedir}
-+Libs: -L${libdir} -lsparrow3d -lsparrowNet -lsparrowSound
-+
-diff --git a/pkgs/games/hase/default.nix b/pkgs/games/hase/default.nix
-new file mode 100644
-index 00000000000..794b6d017ae
---- /dev/null
-+++ b/pkgs/games/hase/default.nix
-@@ -0,0 +1,49 @@
-+{ lib
-+, fetchFromGitHub
-+, pkg-config
-+, stdenv
-+, sparrow3d
-+, zlib
-+}:
-+
-+stdenv.mkDerivation {
-+  pname = "hase";
-+  version = "2020-10-06";
-+
-+  src = fetchFromGitHub {
-+    owner = "theZiz";
-+    repo = "hase";
-+    rev = "31d6840cdf0c72fc459f10402dae7726096b2974";
-+    hash = "sha256-d9So3E8nCQJ1/BdlwMkGbaFPT9mkX1VzlDGKp71ptEE=";
-+  };
-+  patches = [ ./prefer-dynamic.patch ];
-+
-+  nativeBuildInputs = [
-+    pkg-config
-+  ];
-+
-+  buildInputs = [
-+    sparrow3d
-+    zlib
-+  ];
-+
-+  buildPhase = ''
-+    NIX_CFLAGS_COMPILE=$(pkg-config --cflags sparrow3d zlib)
-+    mkdir -p $out/{bin,share/applications,share/pixmaps}
-+    # build and install are one step, and inseparable without patching
-+    ./install.sh $out
-+  '';
-+
-+  postFixup = ''
-+    substituteInPlace "$out/share/applications/hase.desktop" \
-+      --replace "Exec=hase" "Exec=$out/bin/hase"
-+  '';
-+
-+  meta = with lib; {
-+    description = "Hase is an open source gravity based artillery shooter. It is similar to Worms, Hedgewars or artillery, but the gravity force and direction depends on the mass nearby. It is optimized for mobile game consoles like the GP2X, Open Pandora or GCW Zero";
-+    homepage = "http://ziz.gp2x.de/hase/";
-+    license = licenses.gpl3;
-+    maintainers = with maintainers; [ colinsane ];
-+    platforms = [ "x86_64-linux" ];
-+  };
-+}
-diff --git a/pkgs/games/hase/prefer-dynamic.patch b/pkgs/games/hase/prefer-dynamic.patch
-new file mode 100644
-index 00000000000..ab36e6b2b3d
---- /dev/null
-+++ b/pkgs/games/hase/prefer-dynamic.patch
-@@ -0,0 +1,13 @@
-+diff --git a/Makefile b/Makefile
-+index 95d894e..3c561c1 100644
-+--- a/Makefile
-++++ b/Makefile
-+@@ -35,7 +35,7 @@ endif
-+ LIB += -L$(SPARROW_LIB)
-+ INCLUDE += -I$(SPARROW_FOLDER)
-+ 
-+-HASE_STATIC = $(SPARROW_LIB)/$(SPARROW3D_STATIC_LIB) $(SPARROW_LIB)/$(SPARROWSOUND_STATIC_LIB) $(SPARROW_LIB)/$(SPARROWNET_STATIC_LIB) $(STATIC)
-++DYNAMIC += -lsparrow3d -lsparrowSound -lsparrowNet
-+ 
-+ ifneq ($(TARGET),win32)
-+ DYNAMIC += -lz
-diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
-index 521b00eb5f5..31052251314 100644
---- a/pkgs/top-level/all-packages.nix
-+++ b/pkgs/top-level/all-packages.nix
-@@ -23550,6 +23550,8 @@ with pkgs;
- 
-   spaceship-prompt = callPackage ../shells/zsh/spaceship-prompt {};
- 
-+  sparrow3d = callPackage ../development/libraries/sparrow3d {};
-+
-   spdk = callPackage ../development/libraries/spdk { };
- 
-   speechd = callPackage ../development/libraries/speechd { };
-@@ -35570,6 +35572,8 @@ with pkgs;
- 
-   harmonist = callPackage ../games/harmonist { };
- 
-+  hase = callPackage ../games/hase { };
-+
-   hedgewars = libsForQt5.callPackage ../games/hedgewars {
-     inherit (haskellPackages) ghcWithPackages;
-   };

nixpatches/list.nix

@@ -1,10 +1,4 @@
 { fetchpatch, fetchurl }: [
-  # librewolf: build with `MOZ_REQUIRE_SIGNING=false`
-  (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/199134.diff";
-    # url = "https://git.uninsane.org/colin/nixpkgs/commit/99b82e07fee4d194520d6e8d51bc45c80a4d3c7e.diff";
-    sha256 = "sha256-Ne4hyHQDwBHUlWo8Z3QyRdmEv1rYGOjFGxSfOAcLUvQ=";
-  })
 
   # splatmoji: init at 1.2.0
   (fetchpatch {
@@ -38,16 +32,18 @@
   # TODO: why doesn't this apply?
   # ./2023-03-04-ccache-cross-fix.patch
 
-  # TODO: point to upstream PR
-  ./2023-03-10-hase.patch
-
-  # 2023-03-28: jellyfin-media-player: 1.8.1 -> 1.9.0
-  # TODO: i should review/approve this PR if it works
+  # 2023-04-11: bambu-studio: init at unstable-2023-01-11
   (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/220974.diff";
-    hash = "sha256-AK/l0vteCEg/ae4E0dS1oWnlLI4xyeyLFJcqMgCQ4RI=";
+    url = "https://github.com/NixOS/nixpkgs/pull/206495.diff";
+    hash = "sha256-RbQzAtFTr7Nrk2YBcHpKQMYoPlFMVSXNl96B/lkKluQ=";
   })
 
+  # 2023-04-20: perl: fix modules for compatibility with miniperl
+  # (fetchpatch {
+  #   url = "https://github.com/NixOS/nixpkgs/pull/225640.diff";
+  #   hash = "sha256-MNG8C0OgdPnFQ8SF2loiEhXJuP2z4n9pkXr8Zh4X7QU=";
+  # })
+
   # # kaiteki: init at 2022-09-03
   # vendorHash changes too frequently (might not be reproducible).
   # using local package defn until stabilized

overlays/disable-flakey-tests.nix

@@ -5,12 +5,14 @@
 # - they assume too much about their environment and fail under qemu.
 #
 (next: prev: {
-  # ell = prev.ell.overrideAttrs (_upstream: {
-  #   # 2023/02/11
-  #   # fixes "TEST FAILED in get_random_return_callback at unit/test-dbus-message-fds.c:278: !l_dbus_message_get_error(message, ((void *)0), ((void *)0))"
-  #   # unclear *why* this test fails.
-  #   doCheck = false;
-  # });
+  ell = prev.ell.overrideAttrs (_upstream: {
+    # 2023/02/11
+    # fixes "TEST FAILED in get_random_return_callback at unit/test-dbus-message-fds.c:278: !l_dbus_message_get_error(message, ((void *)0), ((void *)0))"
+    # 2023/04/06
+    # fixes "test-cipher: unit/test-cipher.c:102: test_aes_ctr: Assertion `!r' failed."
+    # unclear *why* this test fails.
+    doCheck = false;
+  });
   # fish = prev.fish.overrideAttrs (_upstream: {
   #   # 2023/02/28
   #   # The following tests FAILED:

pkgs/lightdm-mobile-greeter/default.nix

@@ -33,7 +33,13 @@ rustPlatform.buildRustPackage rec {
     rev = "f3511ec71a4a1f491d759711e0bcf031e335ea70";
     hash = "sha256-U5chzm3q3vycgX1HSLf6sk6M3YoJ4CHGLKRg4ViIhu8=";
   };
-  cargoHash = "sha256-2NMXR+D/CnDhUToQmMwK2Cb2l+4/N9BrCz/lt1NZ6Wk=";
+  # cargoHash = "sha256-2NMXR+D/CnDhUToQmMwK2Cb2l+4/N9BrCz/lt1NZ6Wk=";
+  cargoLock = {
+    lockFile = "${src}/Cargo.lock";
+    outputHashes = {
+      "light-dm-sys-0.0.1" = "sha256-91MZhbO/Or0QOt0yVAUhtorpMBBzElFg6U59mF7WB0k=";
+    };
+  };
 
   buildInputs = [
     gtk3

pkgs/sane-scripts/src/sane-deadlines

@@ -33,7 +33,7 @@ sort "$deadlines" | while read line; do
         # normalize dates into seconds since unix epoch
         deadline=$(date -d "$deadline_field" +%s)
         threshold=$(echo "$threshold_field" | sed 's/d/day /g')
-        birthtime=$(date -d "$deadline_field - ($threshold)" +%s)
+        birthtime=$(date -d "$deadline_field - $threshold" +%s)
 
         # show the event iff it's near
         if test "$now" -ge "$birthtime"; then