Merge master into haskell-updates

doc/build-helpers/images/dockertools.section.md

@@ -6,7 +6,7 @@ Docker itself is not used to perform any of the operations done by these functio
 ## buildImage {#ssec-pkgs-dockerTools-buildImage}
 
 This function builds a Docker-compatible repository tarball containing a single image.
-As such, the result is suitable for being loaded in Docker with `docker load` (see [](#ex-dockerTools-buildImage) for how to do this).
+As such, the result is suitable for being loaded in Docker with `docker image load` (see [](#ex-dockerTools-buildImage) for how to do this).
 
 This function will create a single layer for all files (and dependencies) that are specified in its argument.
 Only new dependencies that are not already in the existing layers will be copied.
@@ -43,7 +43,7 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
 `fromImage` (Path or Null; _optional_)
 
 : The repository tarball of an image to be used as the base for the generated image.
-  It must be a valid Docker image, such as one exported by `docker save`, or another image built with the `dockerTools` utility functions.
+  It must be a valid Docker image, such as one exported by `docker image save`, or another image built with the `dockerTools` utility functions.
   This can be seen as an equivalent of `FROM fromImage` in a `Dockerfile`.
   A value of `null` can be seen as an equivalent of `FROM scratch`.
 
@@ -123,7 +123,7 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
 
   _Default value:_ `""`.
 
-`config` (Attribute Set; _optional_)
+`config` (Attribute Set or Null; _optional_)
 
 : Used to specify the configuration of the containers that will be started off the generated image.
   Must be an attribute set, with each attribute as listed in the [Docker Image Specification v1.3.0](https://github.com/moby/moby/blob/46f7ab808b9504d735d600e259ca0723f76fb164/image/spec/spec.md#image-json-field-descriptions).
@@ -247,7 +247,7 @@ Cooking the image...
 Finished.
 /nix/store/p4dsg62inh9d2ksy3c7bv58xa851dasr-docker-image-redis.tar.gz
 
-$ docker load -i /nix/store/p4dsg62inh9d2ksy3c7bv58xa851dasr-docker-image-redis.tar.gz
+$ docker image load -i /nix/store/p4dsg62inh9d2ksy3c7bv58xa851dasr-docker-image-redis.tar.gz
 (some output removed for clarity)
 Loaded image: redis:latest
 ```
@@ -345,8 +345,8 @@ dockerTools.buildImage {
 
 After importing the generated repository tarball with Docker, its CLI will display a reasonable date and sort the images as expected:
 
-```ShellSession
-$ docker images
+```shell
+$ docker image ls
 REPOSITORY   TAG      IMAGE ID       CREATED              SIZE
 hello        latest   de2bf4786de6   About a minute ago   25.2MB
 ```
@@ -364,7 +364,7 @@ Despite the similar name, [`buildImage`](#ssec-pkgs-dockerTools-buildImage) work
 Even though some of the arguments may seem related, they cannot be interchanged.
 :::
 
-You can use this function to load an image in Docker with `docker load`.
+You can load the result of this function in Docker with `docker image load`.
 See [](#ex-dockerTools-buildLayeredImage-hello) to see how to do that.
 
 ### Examples {#ssec-pkgs-dockerTools-buildLayeredImage-examples}
@@ -404,7 +404,7 @@ Adding manifests...
 Done.
 /nix/store/hxcz7snvw7f8rzhbh6mv8jq39d992905-hello.tar.gz
 
-$ docker load -i /nix/store/hxcz7snvw7f8rzhbh6mv8jq39d992905-hello.tar.gz
+$ docker image load -i /nix/store/hxcz7snvw7f8rzhbh6mv8jq39d992905-hello.tar.gz
 (some output removed for clarity)
 Loaded image: hello:latest
 ```
@@ -415,7 +415,7 @@ Loaded image: hello:latest
 `streamLayeredImage` builds a **script** which, when run, will stream to stdout a Docker-compatible repository tarball containing a single image, using multiple layers to improve sharing between images.
 This means that `streamLayeredImage` does not output an image into the Nix store, but only a script that builds the image, saving on IO and disk/cache space, particularly with large images.
 
-You can use this function to load an image in Docker with `docker load`.
+You can load the result of this function in Docker with `docker image load`.
 See [](#ex-dockerTools-streamLayeredImage-hello) to see how to do that.
 
 For this function, you specify a [store path](https://nixos.org/manual/nix/stable/store/store-path) or a list of store paths to be added to the image, and the functions will automatically include any dependencies of those paths in the image.
@@ -440,7 +440,7 @@ This allows the function to produce reproducible images.
 
 : The name of the generated image.
 
-`tag` (String; _optional_)
+`tag` (String or Null; _optional_)
 
 : Tag of the generated image.
   If `null`, the hash of the nix derivation will be used as the tag.
@@ -450,7 +450,7 @@ This allows the function to produce reproducible images.
 `fromImage`(Path or Null; _optional_)
 
 : The repository tarball of an image to be used as the base for the generated image.
-  It must be a valid Docker image, such as one exported by `docker save`, or another image built with the `dockerTools` utility functions.
+  It must be a valid Docker image, such as one exported by `docker image save`, or another image built with the `dockerTools` utility functions.
   This can be seen as an equivalent of `FROM fromImage` in a `Dockerfile`.
   A value of `null` can be seen as an equivalent of `FROM scratch`.
 
@@ -470,7 +470,7 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `[]`
 
-`config` (Attribute Set; _optional_) []{#dockerTools-buildLayeredImage-arg-config}
+`config` (Attribute Set or Null; _optional_) []{#dockerTools-buildLayeredImage-arg-config}
 
 : Used to specify the configuration of the containers that will be started off the generated image.
   Must be an attribute set, with each attribute as listed in the [Docker Image Specification v1.3.0](https://github.com/moby/moby/blob/46f7ab808b9504d735d600e259ca0723f76fb164/image/spec/spec.md#image-json-field-descriptions).
@@ -594,7 +594,7 @@ dockerTools.streamLayeredImage {
 ```
 
 The result of building this package is a script.
-Running this script and piping it into `docker load` gives you the same image that was built in [](#ex-dockerTools-buildLayeredImage-hello).
+Running this script and piping it into `docker image load` gives you the same image that was built in [](#ex-dockerTools-buildLayeredImage-hello).
 Note that in this case, the image is never added to the Nix store, but instead streamed directly into Docker.
 
 ```shell
@@ -602,7 +602,7 @@ $ nix-build
 (output removed for clarity)
 /nix/store/wsz2xl8ckxnlb769irvq6jv1280dfvxd-stream-hello
 
-$ /nix/store/wsz2xl8ckxnlb769irvq6jv1280dfvxd-stream-hello | docker load
+$ /nix/store/wsz2xl8ckxnlb769irvq6jv1280dfvxd-stream-hello | docker image load
 No 'fromImage' provided
 Creating layer 1 from paths: ['/nix/store/i93s7xxblavsacpy82zdbn4kplsyq48l-libunistring-1.1']
 Creating layer 2 from paths: ['/nix/store/ji01n9vinnj22nbrb86nx8a1ssgpilx8-libidn2-2.3.4']
@@ -718,7 +718,7 @@ dockerTools.streamLayeredImage {
 []{#ssec-pkgs-dockerTools-fetchFromRegistry}
 ## pullImage {#ssec-pkgs-dockerTools-pullImage}
 
-This function is similar to the `docker pull` command, which means it can be used to pull a Docker image from a registry that implements the [Docker Registry HTTP API V2](https://distribution.github.io/distribution/spec/api/).
+This function is similar to the `docker image pull` command, which means it can be used to pull a Docker image from a registry that implements the [Docker Registry HTTP API V2](https://distribution.github.io/distribution/spec/api/).
 By default, the `docker.io` registry is used.
 
 The image will be downloaded as an uncompressed Docker-compatible repository tarball, which is suitable for use with other `dockerTools` functions such as [`buildImage`](#ssec-pkgs-dockerTools-buildImage), [`buildLayeredImage`](#ssec-pkgs-dockerTools-buildLayeredImage), and [`streamLayeredImage`](#ssec-pkgs-dockerTools-streamLayeredImage).
@@ -1105,7 +1105,7 @@ This is currently implemented by linking to the `env` binary from the `coreutils
 ### binSh {#sssec-pkgs-dockerTools-helpers-binSh}
 
 This provides a `/bin/sh` link to the `bash` binary from the `bashInteractive` package.
-Because of this, it supports cases such as running a command interactively in a container (for example by running `docker run -it <image_name>`).
+Because of this, it supports cases such as running a command interactively in a container (for example by running `docker container run -it <image_name>`).
 
 ### caCertificates {#sssec-pkgs-dockerTools-helpers-caCertificates}
 
@@ -1169,9 +1169,9 @@ This is made possible by `binSh`.
 $ nix-build
 (some output removed for clarity)
 /nix/store/2p0i3i04cgjlk71hsn7ll4kxaxxiv4qg-docker-image-env-helpers.tar.gz
-$ docker load -i /nix/store/2p0i3i04cgjlk71hsn7ll4kxaxxiv4qg-docker-image-env-helpers.tar.gz
+$ docker image load -i /nix/store/2p0i3i04cgjlk71hsn7ll4kxaxxiv4qg-docker-image-env-helpers.tar.gz
 (output removed for clarity)
-$ docker run --rm -it env-helpers:latest /bin/sh
+$ docker container run --rm -it env-helpers:latest /bin/sh
 sh-5.2# help
 GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu)
 (rest of output removed for clarity)
@@ -1209,9 +1209,9 @@ This is made possible by `binSh`.
 $ nix-build
 (some output removed for clarity)
 /nix/store/rpf47f4z5b9qr4db4ach9yr4b85hjhxq-env-helpers.tar.gz
-$ docker load -i /nix/store/rpf47f4z5b9qr4db4ach9yr4b85hjhxq-env-helpers.tar.gz
+$ docker image load -i /nix/store/rpf47f4z5b9qr4db4ach9yr4b85hjhxq-env-helpers.tar.gz
 (output removed for clarity)
-$ docker run --rm -it env-helpers:latest /bin/sh
+$ docker container run --rm -it env-helpers:latest /bin/sh
 sh-5.2# help
 GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu)
 (rest of output removed for clarity)
@@ -1315,7 +1315,7 @@ $ nix-build
 (some output removed for clarity)
 /nix/store/pkj1sgzaz31wl0pbvbg3yp5b3kxndqms-hello-2.12.1-env.tar.gz
 
-$ docker load -i /nix/store/pkj1sgzaz31wl0pbvbg3yp5b3kxndqms-hello-2.12.1-env.tar.gz
+$ docker image load -i /nix/store/pkj1sgzaz31wl0pbvbg3yp5b3kxndqms-hello-2.12.1-env.tar.gz
 (some output removed for clarity)
 Loaded image: hello-2.12.1-env:latest
 ```
@@ -1323,7 +1323,7 @@ Loaded image: hello-2.12.1-env:latest
 After starting an interactive container, the derivation can be built by running `buildDerivation`, and the output can be executed as expected:
 
 ```shell
-$ docker run -it hello-2.12.1-env:latest
+$ docker container run -it hello-2.12.1-env:latest
 [nix-shell:~]$ buildDerivation
 Running phase: unpackPhase
 unpacking source archive /nix/store/pa10z4ngm0g83kx9mssrqzz30s84vq7k-hello-2.12.1.tar.gz
@@ -1443,14 +1443,14 @@ dockerTools.streamNixShellImage {
 ```
 
 The result of building this package is a script.
-Running this script and piping it into `docker load` gives you the same image that was built in [](#ex-dockerTools-buildNixShellImage-hello).
+Running this script and piping it into `docker image load` gives you the same image that was built in [](#ex-dockerTools-buildNixShellImage-hello).
 
 ```shell
 $ nix-build
 (some output removed for clarity)
 /nix/store/8vhznpz2frqazxnd8pgdvf38jscdypax-stream-hello-2.12.1-env
 
-$ /nix/store/8vhznpz2frqazxnd8pgdvf38jscdypax-stream-hello-2.12.1-env | docker load
+$ /nix/store/8vhznpz2frqazxnd8pgdvf38jscdypax-stream-hello-2.12.1-env | docker image load
 (some output removed for clarity)
 Loaded image: hello-2.12.1-env:latest
 ```
@@ -1458,7 +1458,7 @@ Loaded image: hello-2.12.1-env:latest
 After starting an interactive container, the derivation can be built by running `buildDerivation`, and the output can be executed as expected:
 
 ```shell
-$ docker run -it hello-2.12.1-env:latest
+$ docker container run -it hello-2.12.1-env:latest
 [nix-shell:~]$ buildDerivation
 Running phase: unpackPhase
 unpacking source archive /nix/store/pa10z4ngm0g83kx9mssrqzz30s84vq7k-hello-2.12.1.tar.gz
@@ -1497,14 +1497,14 @@ dockerTools.streamNixShellImage {
 }
 ```
 
-The result of building this package is a script which can be run and piped into `docker load` to load the generated image.
+The result of building this package is a script which can be run and piped into `docker image load` to load the generated image.
 
 ```shell
 $ nix-build
 (some output removed for clarity)
 /nix/store/h5abh0vljgzg381lna922gqknx6yc0v7-stream-hello-2.12.1-env
 
-$ /nix/store/h5abh0vljgzg381lna922gqknx6yc0v7-stream-hello-2.12.1-env | docker load
+$ /nix/store/h5abh0vljgzg381lna922gqknx6yc0v7-stream-hello-2.12.1-env | docker image load
 (some output removed for clarity)
 Loaded image: hello-2.12.1-env:latest
 ```
@@ -1512,7 +1512,7 @@ Loaded image: hello-2.12.1-env:latest
 After starting an interactive container, we can verify the extra package is available by running `cowsay`:
 
 ```shell
-$ docker run -it hello-2.12.1-env:latest
+$ docker container run -it hello-2.12.1-env:latest
 [nix-shell:~]$ cowsay "Hello, world!"
  _______________
 < Hello, world! >
@@ -1546,14 +1546,14 @@ dockerTools.streamNixShellImage {
 }
 ```
 
-The result of building this package is a script which can be run and piped into `docker load` to load the generated image.
+The result of building this package is a script which can be run and piped into `docker image load` to load the generated image.
 
 ```shell
 $ nix-build
 (some output removed for clarity)
 /nix/store/iz4dhdvgzazl5vrgyz719iwjzjy6xlx1-stream-hello-2.12.1-env
 
-$ /nix/store/iz4dhdvgzazl5vrgyz719iwjzjy6xlx1-stream-hello-2.12.1-env | docker load
+$ /nix/store/iz4dhdvgzazl5vrgyz719iwjzjy6xlx1-stream-hello-2.12.1-env | docker image load
 (some output removed for clarity)
 Loaded image: hello-2.12.1-env:latest
 ```
@@ -1561,7 +1561,7 @@ Loaded image: hello-2.12.1-env:latest
 After starting an interactive container, we can see the result of the `shellHook`:
 
 ```shell
-$ docker run -it hello-2.12.1-env:latest
+$ docker container run -it hello-2.12.1-env:latest
 Hello, world!
 
 [nix-shell:~]$

doc/languages-frameworks/rust.section.md

@@ -44,11 +44,11 @@ rustPlatform.buildRustPackage rec {
 }
 ```
 
-`buildRustPackage` requires either the `cargoHash` or the `cargoSha256`
-attribute which is computed over all crate sources of this package.
-`cargoSha256` is used for traditional Nix SHA-256 hashes. `cargoHash` should
-instead be used for [SRI](https://www.w3.org/TR/SRI/) hashes and should be
-preferred. For example:
+`buildRustPackage` requires either a `cargoHash` (preferred) or a
+`cargoSha256` attribute, computed over all crate sources of this package.
+`cargoHash` supports [SRI](https://www.w3.org/TR/SRI/) hashes and should be
+preferred over `cargoSha256` which was used for traditional Nix SHA-256 hashes.
+For example:
 
 ```nix
   cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
@@ -64,18 +64,18 @@ Both types of hashes are permitted when contributing to nixpkgs. The
 Cargo hash is obtained by inserting a fake checksum into the
 expression and building the package once. The correct checksum can
 then be taken from the failed build. A fake hash can be used for
-`cargoSha256` as follows:
-
-```nix
-  cargoSha256 = lib.fakeSha256;
-```
-
-For `cargoHash` you can use:
+`cargoHash` as follows:
 
 ```nix
   cargoHash = lib.fakeHash;
 ```
 
+For `cargoSha256` you can use:
+
+```nix
+  cargoSha256 = lib.fakeSha256;
+```
+
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
 best practices guide, Rust applications should always commit the `Cargo.lock`
 file in git to ensure a reproducible build. However, a few packages do not, and
@@ -90,7 +90,7 @@ directory into a tar.gz archive.
 The tarball with vendored dependencies contains a directory with the
 package's `name`, which is normally composed of `pname` and
 `version`. This means that the vendored dependencies hash
-(`cargoSha256`/`cargoHash`) is dependent on the package name and
+(`cargoHash`/`cargoSha256`) is dependent on the package name and
 version. The `cargoDepsName` attribute can be used to use another name
 for the directory of vendored dependencies. For example, the hash can
 be made invariant to the version by setting `cargoDepsName` to
@@ -115,7 +115,7 @@ rustPlatform.buildRustPackage rec {
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
 
-Using `cargoSha256` or `cargoHash` is tedious when using
+Using a vendored hash (`cargoHash`/`cargoSha256`) is tedious when using
 `buildRustPackage` within a project, since it requires that the hash
 is updated after every change to `Cargo.lock`. Therefore,
 `buildRustPackage` also supports vendoring dependencies directly from

doc/packages/darwin-builder.section.md

@@ -98,7 +98,7 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
             host.pkgs = pkgs;
             darwin-builder.workingDirectory = "/var/lib/darwin-builder";
           };
-        };
+        }
       ];
     };
   in {

maintainers/maintainer-list.nix

@@ -2250,6 +2250,12 @@
     githubId = 24027;
     name = "Bruno Bigras";
   };
+  bbjubjub = {
+    name = "Julie B.";
+    email = "julie+nixpkgs@bbjubjub.fr";
+    github = "bbjubjub2494";
+    githubId = 15657735;
+  };
   bburdette = {
     email = "bburdette@protonmail.com";
     github = "bburdette";
@@ -3216,6 +3222,13 @@
     github = "cdmistman";
     githubId = 23486351;
   };
+  cdombroski = {
+    name = "Chris Dombroski";
+    email = "cdombroski@gmail.com";
+    matrix = "@cdombroski:kow.is";
+    github = "cdombroski";
+    githubId = 244909;
+  };
   ceedubs = {
     email = "ceedubs@gmail.com";
     github = "ceedubs";
@@ -4289,6 +4302,15 @@
     githubId = 34766150;
     name = "datafoo";
   };
+  DataHearth = {
+    email = "dev@antoine-langlois.net";
+    github = "DataHearth";
+    githubId = 28595242;
+    name = "DataHearth";
+    keys = [{
+      fingerprint = "A129 2547 0298 BFEE 7EE0  92B3 946E 2D0C 410C 7B3D";
+    }];
+  };
   davegallant = {
     name = "Dave Gallant";
     email = "davegallant@gmail.com";
@@ -4782,6 +4804,12 @@
     githubId = 8404455;
     name = "Diego Lelis";
   };
+  diegs = {
+    email = "dpontor@gmail.com";
+    github = "diegs";
+    githubId = 74719;
+    name = "Diego Pontoriero";
+  };
   DieracDelta = {
     email = "justin@restivo.me";
     github = "DieracDelta";
@@ -5304,6 +5332,12 @@
     githubId = 7875;
     name = "Rommel Martinez";
   };
+  ecklf = {
+    email = "ecklf@icloud.com";
+    github = "ecklf";
+    githubId = 8146736;
+    name = "Florentin Eckl";
+  };
   eclairevoyant = {
     github = "eclairevoyant";
     githubId = 848000;
@@ -11067,15 +11101,6 @@
     githubId = 4969294;
     name = "Louis Tim Larsen";
   };
-  lourkeur = {
-    name = "Louis Bettens";
-    email = "louis@bettens.info";
-    github = "lourkeur";
-    githubId = 15657735;
-    keys = [{
-      fingerprint = "5B93 9CFA E8FC 4D8F E07A  3AEA DFE1 D4A0 1733 7E2A";
-    }];
-  };
   loveisgrief = {
     name = "LoveIsGrief";
     email = "loveisgrief@tuta.io";
@@ -17450,6 +17475,12 @@
     github = "shymega";
     githubId = 1334592;
   };
+  siddarthkay = {
+    email = "siddarthkay@gmail.com";
+    github = "siddarthkay";
+    githubId = 64726664;
+    name = "Siddarth Kumar";
+  };
   siddharthdhakane = {
     email = "siddharthdhakane@gmail.com";
     github = "siddharthdhakane";
@@ -18320,6 +18351,13 @@
     githubId = 2666479;
     name = "Y Nguyen";
   };
+  superherointj = {
+    email = "sergiomarcelo@yandex.com";
+    github = "superherointj";
+    githubId = 5861043;
+    matrix = "@superherointj:matrix.org";
+    name = "Sérgio Marcelo";
+  };
   SuperSandro2000 = {
     email = "sandro.jaeckel@gmail.com";
     matrix = "@sandro:supersandro.de";

maintainers/team-list.nix

@@ -176,7 +176,7 @@ with lib.maintainers; {
 
   cosmopolitan = {
     members = [
-      lourkeur
+      bbjubjub
       tomberek
     ];
     scope = "Maintain the Cosmopolitan LibC and related programs.";
@@ -821,12 +821,18 @@ with lib.maintainers; {
 
   qt-kde = {
     members = [
+      ilya-fedin
+      k900
+      LunNova
+      mjm
+      nickcao
+      SuperSandro2000
       ttuegel
     ];
     githubTeams = [
       "qt-kde"
     ];
-    scope = "Maintain the KDE desktop environment and Qt.";
+    scope = "Maintain the Qt framework, KDE application suite, Plasma desktop environment and related projects.";
     shortName = "Qt / KDE";
     enableFeatureFreezePing = true;
   };

nixos/maintainers/scripts/lxd/lxd-container-image.nix

@@ -20,8 +20,7 @@
     };
   in ''
     if [ ! -e /etc/nixos/configuration.nix ]; then
-      mkdir -p /etc/nixos
-      cp ${config} /etc/nixos/configuration.nix
+      install -m 644 -D ${config} /etc/nixos/configuration.nix
     fi
   '';
 

nixos/modules/config/ldso.nix

@@ -6,9 +6,9 @@ let
   libDir = pkgs.stdenv.hostPlatform.libDir;
   ldsoBasename = builtins.unsafeDiscardStringContext (last (splitString "/" pkgs.stdenv.cc.bintools.dynamicLinker));
 
-  pkgs32 = pkgs.pkgsi686Linux;
-  libDir32 = pkgs32.stdenv.hostPlatform.libDir;
-  ldsoBasename32 = builtins.unsafeDiscardStringContext (last (splitString "/" pkgs32.stdenv.cc.bintools.dynamicLinker));
+  # Hard-code to avoid creating another instance of nixpkgs. Also avoids eval errors in some cases.
+  libDir32 = "lib"; # pkgs.pkgsi686Linux.stdenv.hostPlatform.libDir
+  ldsoBasename32 = "ld-linux.so.2"; # last (splitString "/" pkgs.pkgsi686Linux.stdenv.cc.bintools.dynamicLinker)
 in {
   options = {
     environment.ldso = mkOption {

nixos/modules/services/cluster/kubernetes/pki.nix

@@ -192,7 +192,8 @@ in
         mkdir -p "$(dirname "${certmgrAPITokenPath}")"
         if [ -f "${cfsslAPITokenPath}" ]; then
           ln -fs "${cfsslAPITokenPath}" "${certmgrAPITokenPath}"
-        else
+        elif [ ! -f "${certmgrAPITokenPath}" ]; then
+          # Don't remove the token if it already exists
           install -m 600 /dev/null "${certmgrAPITokenPath}"
         fi
       ''

nixos/modules/services/misc/tandoor-recipes.nix

@@ -17,14 +17,11 @@ let
     lib.mapAttrs (_: toString) cfg.extraConfig
   );
 
-  manage =
-    let
-      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
-    in
-    pkgs.writeShellScript "manage" ''
-      ${setupEnv}
-      exec ${pkg}/bin/tandoor-recipes "$@"
-    '';
+  manage = pkgs.writeShellScript "manage" ''
+    set -o allexport # Export the following env vars
+    ${lib.toShellVars env}
+    exec ${pkg}/bin/tandoor-recipes "$@"
+  '';
 in
 {
   meta.maintainers = with maintainers; [ ambroisie ];

nixos/modules/services/networking/knot.nix

@@ -1,8 +1,36 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 
-with lib;
 
 let
+  inherit (lib)
+    attrNames
+    concatMapStrings
+    concatMapStringsSep
+    concatStrings
+    concatStringsSep
+    elem
+    filter
+    flip
+    hasAttr
+    hasPrefix
+    isAttrs
+    isBool
+    isDerivation
+    isList
+    mapAttrsToList
+    mkChangedOptionModule
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionals
+    types
+  ;
+
+  inherit (utils)
+    escapeSystemdExecArgs
+  ;
+
   cfg = config.services.knot;
 
   yamlConfig = let
@@ -113,8 +141,7 @@ let
   mkConfigFile = configString: pkgs.writeTextFile {
     name = "knot.conf";
     text = (concatMapStringsSep "\n" (file: "include: ${file}") cfg.keyFiles) + "\n" + configString;
-    # TODO: maybe we could do some checks even when private keys complicate this?
-    checkPhase = lib.optionalString (cfg.keyFiles == []) ''
+    checkPhase = lib.optionalString cfg.checkConfig ''
       ${cfg.package}/bin/knotc --config=$out conf-check
     '';
   };
@@ -142,12 +169,45 @@ let
 in {
   options = {
     services.knot = {
-      enable = mkEnableOption (lib.mdDoc "Knot authoritative-only DNS server");
+      enable = mkEnableOption "Knot authoritative-only DNS server";
+
+      enableXDP = mkOption {
+        type = types.bool;
+        default = lib.hasAttrByPath [ "xdp" "listen" ] cfg.settings;
+        defaultText = ''
+          Enabled when the `xdp.listen` setting is configured through `settings`.
+        '';
+        example = true;
+        description = ''
+          Extends the systemd unit with permissions to allow for the use of
+          the eXpress Data Path (XDP).
+
+          ::: {.note}
+            Make sure to read up on functional [limitations](https://www.knot-dns.cz/docs/latest/singlehtml/index.html#mode-xdp-limitations)
+            when running in XDP mode.
+          :::
+        '';
+      };
+
+      checkConfig = mkOption {
+        type = types.bool;
+        # TODO: maybe we could do some checks even when private keys complicate this?
+        # conf-check fails hard on missing IPs/devices with XDP
+        default = cfg.keyFiles == [] && !cfg.enableXDP;
+        defaultText = ''
+          Disabled when the config uses `keyFiles` or `enableXDP`.
+        '';
+        example = false;
+        description = ''
+          Toggles the configuration test at build time. It runs in a
+          sandbox, and therefore cannot be used in all scenarios.
+        '';
+      };
 
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = lib.mdDoc ''
+        description = ''
           List of additional command line parameters for knotd
         '';
       };
@@ -155,7 +215,7 @@ in {
       keyFiles = mkOption {
         type = types.listOf types.path;
         default = [];
-        description = lib.mdDoc ''
+        description = ''
           A list of files containing additional configuration
           to be included using the include directive. This option
           allows to include configuration like TSIG keys without
@@ -168,7 +228,7 @@ in {
       settings = mkOption {
         type = types.attrs;
         default = {};
-        description = lib.mdDoc ''
+        description = ''
           Extra configuration as nix values.
         '';
       };
@@ -176,7 +236,7 @@ in {
       settingsFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = lib.mdDoc ''
+        description = ''
           As alternative to ``settings``, you can provide whole configuration
           directly in the almost-YAML format of Knot DNS.
           You might want to utilize ``pkgs.writeText "knot.conf" "longConfigString"`` for this.
@@ -210,19 +270,35 @@ in {
       wants = [ "network.target" ];
       after = ["network.target" ];
 
-      serviceConfig = {
+      serviceConfig = let
+        # https://www.knot-dns.cz/docs/3.3/singlehtml/index.html#pre-requisites
+        xdpCapabilities = lib.optionals (cfg.enableXDP) [
+          "CAP_NET_ADMIN"
+          "CAP_NET_RAW"
+          "CAP_SYS_ADMIN"
+          "CAP_IPC_LOCK"
+        ] ++ lib.optionals (lib.versionOlder config.boot.kernelPackages.kernel.version "5.11") [
+          "CAP_SYS_RESOURCE"
+        ];
+      in {
         Type = "notify";
-        ExecStart = "${cfg.package}/bin/knotd --config=${configFile} --socket=${socketFile} ${concatStringsSep " " cfg.extraArgs}";
-        ExecReload = "${knot-cli-wrappers}/bin/knotc reload";
+        ExecStart = escapeSystemdExecArgs ([
+          (lib.getExe cfg.package)
+          "--config=${configFile}"
+          "--socket=${socketFile}"
+        ] ++ cfg.extraArgs);
+        ExecReload = escapeSystemdExecArgs [
+          "${knot-cli-wrappers}/bin/knotc" "reload"
+        ];
         User = "knot";
         Group = "knot";
 
         AmbientCapabilities = [
           "CAP_NET_BIND_SERVICE"
-        ];
+        ] ++ xdpCapabilities;
         CapabilityBoundingSet = [
           "CAP_NET_BIND_SERVICE"
-        ];
+        ] ++ xdpCapabilities;
         DeviceAllow = "";
         DevicePolicy = "closed";
         LockPersonality = true;
@@ -247,6 +323,9 @@ in {
           "AF_INET"
           "AF_INET6"
           "AF_UNIX"
+        ] ++ optionals (cfg.enableXDP) [
+          "AF_NETLINK"
+          "AF_XDP"
         ];
         RestrictNamespaces = true;
         RestrictRealtime =true;
@@ -258,6 +337,8 @@ in {
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+        ] ++ optionals (cfg.enableXDP) [
+          "bpf"
         ];
         UMask = "0077";
       };

nixos/modules/services/web-apps/photoprism.nix

@@ -12,17 +12,14 @@ let
     lib.mapAttrs (_: toString) cfg.settings
   );
 
-  manage =
-    let
-      setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env);
-    in
-    pkgs.writeShellScript "manage" ''
-      ${setupEnv}
-      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
-      exec ${pkgs.util-linux}/bin/nsenter \
-        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
-        ${cfg.package}/bin/photoprism "$@"
-    '';
+  manage = pkgs.writeShellScript "manage" ''
+    set -o allexport # Export the following env vars
+    ${lib.toShellVars env}
+    eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+    exec ${pkgs.util-linux}/bin/nsenter \
+      -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
+      ${cfg.package}/bin/photoprism "$@"
+  '';
 in
 {
   meta.maintainers = with lib.maintainers; [ stunkymonkey ];

nixos/tests/knot.nix

@@ -114,13 +114,16 @@ in {
       services.knot.extraArgs = [ "-v" ];
       services.knot.settings = {
         server = {
-          listen = [
-            "0.0.0.0@53"
-            "::@53"
-          ];
           automatic-acl = true;
         };
 
+        xdp = {
+          listen = [
+            "eth1"
+          ];
+          tcp = true;
+        };
+
         remote.primary = {
           address = "192.168.0.1@53";
           key = "xfr_key";
@@ -140,7 +143,7 @@ in {
           "sub.example.com".file = "sub.example.com.zone";
         };
 
-        log.syslog.any = "info";
+        log.syslog.any = "debug";
       };
     };
     client = { lib, nodes, ... }: {

nixos/tests/slurm.nix

@@ -45,7 +45,7 @@ let
       '';
     in pkgs.runCommand "mpitest" {} ''
       mkdir -p $out/bin
-      ${pkgs.openmpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
+      ${lib.getDev pkgs.mpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
     '';
 in {
   name = "slurm";

pkgs/applications/audio/CHOWTapeModel/default.nix

@@ -127,5 +127,6 @@ stdenv.mkDerivation rec {
     # error: 'vvtanh' was not declared in this scope; did you mean 'tanh'?
     # error: no matching function for call to 'juce::dsp::SIMDRegister<double>::SIMDRegister(xsimd::simd_batch_traits<xsimd::batch<double, 2> >::batch_bool_type)'
     broken = stdenv.isAarch64; # since 2021-12-27 on hydra (update to 2.10): https://hydra.nixos.org/build/162558991
+    mainProgram = "CHOWTapeModel";
   };
 }

pkgs/applications/audio/ChowKick/default.nix

@@ -102,5 +102,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "ChowKick";
   };
 }

pkgs/applications/audio/aacgain/default.nix

@@ -34,5 +34,6 @@ stdenv.mkDerivation {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.robbinch ];
+    mainProgram = "aacgain";
   };
 }

pkgs/applications/audio/aeolus/default.nix

@@ -40,5 +40,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ nico202 orivej ];
+    mainProgram = "aeolus";
   };
 }

pkgs/applications/audio/aj-snapshot/default.nix

@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.mrVanDalo ];
     platforms = platforms.all;
+    mainProgram = "aj-snapshot";
   };
 }

pkgs/applications/audio/ashuffle/default.nix

@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.tcbravo ];
     platforms = platforms.unix;
     license = licenses.mit;
+    mainProgram = "ashuffle";
   };
 }

pkgs/applications/audio/aucatctl/default.nix

@@ -32,5 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.isc;
     maintainers = with maintainers; [ sna ];
     platforms = platforms.unix;
+    mainProgram = "aucatctl";
   };
 })

pkgs/applications/audio/bitmeter/default.nix

@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "bitmeter";
   };
 }

pkgs/applications/audio/brutefir/default.nix

@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ auchter ];
     platforms = [ "x86_64-linux" "i686-linux" ];
+    mainProgram = "brutefir";
   };
 }

pkgs/applications/audio/calf/default.nix

@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
+    mainProgram = "calfjackhost";
   };
 }

pkgs/applications/audio/cdparanoia/default.nix

@@ -58,5 +58,6 @@ stdenv.mkDerivation rec {
     description = "A tool and library for reading digital audio from CDs";
     license = with licenses; [ gpl2Plus lgpl21Plus ];
     platforms = platforms.unix;
+    mainProgram = "cdparanoia";
   };
 }

pkgs/applications/audio/chuck/default.nix

@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ ftrvxmtrx ];
+    mainProgram = "chuck";
   };
 }

pkgs/applications/audio/cider/default.nix

@@ -26,5 +26,6 @@ appimageTools.wrapType2 rec {
     license = licenses.agpl3;
     maintainers = [ maintainers.cigrainger ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "cider";
   };
 }

pkgs/applications/audio/cmusfm/default.nix

@@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ CharlesHD mudri ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;
+    mainProgram = "cmusfm";
   };
 }

pkgs/applications/audio/codecserver/default.nix

@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Only;
     platforms = platforms.unix;
     maintainers = teams.c3d2.members;
+    mainProgram = "codecserver";
   };
 }

pkgs/applications/audio/dirt/default.nix

@@ -35,5 +35,6 @@ stdenv.mkDerivation {
     license = licenses.gpl3;
     maintainers = with maintainers; [ anderspapitto ];
     platforms = with platforms; linux;
+    mainProgram = "dirt";
   };
 }

pkgs/applications/audio/dolbybcsoftwaredecode/default.nix

@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     # I asked upstream to assign a license, so maybe this can be free
     # in the future, but for now let's play it safe and make it unfree.
     license = lib.licenses.unfree;
+    mainProgram = "DolbyBi64";
   };
 }

pkgs/applications/audio/dsf2flac/default.nix

@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ artemist ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "dsf2flac";
   };
 }

pkgs/applications/audio/eflite/default.nix

@@ -47,5 +47,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ jhhuh ];
+    mainProgram = "eflite";
   };
 }

pkgs/applications/audio/famistudio/default.nix

@@ -66,5 +66,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "famistudio";
   };
 }

pkgs/applications/audio/flac123/default.nix

@@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
     description = "A command-line program for playing FLAC audio files";
     license = licenses.gpl2Plus;
     platforms = platforms.all;
+    mainProgram = "flac123";
   };
 }

pkgs/applications/audio/fluidsynth/default.nix

@@ -32,5 +32,6 @@ stdenv.mkDerivation rec {
     license     = licenses.lgpl21Plus;
     maintainers = with maintainers; [ goibhniu lovek323 ];
     platforms   = platforms.unix;
+    mainProgram = "fluidsynth";
   };
 }

pkgs/applications/audio/freewheeling/default.nix

@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.sepi ];
     platforms = lib.platforms.linux;
+    mainProgram = "fweelin";
   };
 }

pkgs/applications/audio/freqtweak/default.nix

@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
+    mainProgram = "freqtweak";
   };
 }

pkgs/applications/audio/ft2-clone/default.nix

@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     # From HOW-TO-COMPILE.txt:
     # > This code is NOT big-endian compatible
     platforms = platforms.littleEndian;
+    mainProgram = "ft2-clone";
   };
 }

pkgs/applications/audio/furnace/default.nix

@@ -116,5 +116,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
+    mainProgram = "furnace";
   };
 }

pkgs/applications/audio/geonkick/default.nix

@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.magnetophon ];
+    mainProgram = "geonkick";
   };
 }

pkgs/applications/audio/gigedit/default.nix

@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
+    mainProgram = "gigedit";
   };
 }

pkgs/applications/audio/gjay/default.nix

@@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ pSub ];
     platforms = with platforms; linux;
+    mainProgram = "gjay";
   };
 }

pkgs/applications/audio/gnaural/default.nix

@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     homepage = "https://gnaural.sourceforge.net/";
     maintainers = with maintainers; [ ehmry ];
     license = with licenses; [ gpl2Only ];
+    mainProgram = "gnaural";
   };
 }

pkgs/applications/audio/gtkcord4/default.nix

@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "gtkcord4";
-  version = "0.0.18";
+  version = "0.0.19";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-J76MkbXtlrRIyQEbNlHFNpAW9+mXcOcrx9ahMQ61NL4=";
+    hash = "sha256-TOrAUTYS4J4W1wZvP1TxZf5Nel29YCPoWPN7GYNomkc=";
   };
 
   nativeBuildInputs = [
@@ -56,7 +56,7 @@ buildGoModule rec {
     install -D -m 444 internal/icons/hicolor/scalable/apps/logo.svg $out/share/icons/hicolor/scalable/apps/gtkcord4.svg
   '';
 
-  vendorHash = "sha256-BDR67P4Gxveg2FpxijT0eWjUciGDO+l02QmBUxVb99c=";
+  vendorHash = "sha256-dJm+v7/2+TQWoU7G1uOpie6KN5W0JqfLU4mF8mghV4A=";
 
   meta = with lib; {
     description = "GTK4 Discord client in Go, attempt #4";

pkgs/applications/audio/headset/default.nix

@@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ muscaln ];
+    mainProgram = "headset";
   };
 }

pkgs/applications/audio/helm/default.nix

@@ -70,5 +70,6 @@
     license = lib.licenses.gpl3Plus;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "helm";
   };
 }

pkgs/applications/audio/hybridreverb2/default.nix

@@ -83,5 +83,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "HybridReverb2";
   };
 }

pkgs/applications/audio/id3v2/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://id3v2.sourceforge.net/";
     license = licenses.gpl2Plus;
     platforms = with platforms; unix;
+    mainProgram = "id3v2";
   };
 }

pkgs/applications/audio/industrializer/default.nix

@@ -46,5 +46,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.magnetophon ];
     platforms = lib.platforms.linux;
+    mainProgram = "psindustrializer";
   };
 }

pkgs/applications/audio/infamousPlugins/default.nix

@@ -47,5 +47,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "infamous-rule";
   };
 }

pkgs/applications/audio/ir.lv2/default.nix

@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "convert4chan";
   };
 }

pkgs/applications/audio/jaaa/default.nix

@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "jaaa";
   };
 }

pkgs/applications/audio/jack-passthrough/default.nix

@@ -35,5 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.unfree;
     maintainers = [ maintainers.PowerUser64 ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "jack-passthru";
   };
 })

pkgs/applications/audio/jackmeter/default.nix

@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.marcweber ];
     platforms = lib.platforms.linux;
+    mainProgram = "jack_meter";
   };
 }

pkgs/applications/audio/japa/default.nix

@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.magnetophon ];
     platforms = lib.platforms.linux;
+    mainProgram = "japa";
   };
 }

pkgs/applications/audio/jellycli/default.nix

@@ -30,5 +30,6 @@ buildGoModule rec {
     homepage = "https://github.com/tryffel/jellycli";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ oxzi ];
+    mainProgram = "jellycli";
   };
 }

pkgs/applications/audio/jmusicbot/default.nix

@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
     inherit (jre_headless.meta) platforms;
+    mainProgram = "JMusicBot";
   };
 }

pkgs/applications/audio/keyfinder-cli/default.nix

@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
+    mainProgram = "keyfinder-cli";
   };
 }

pkgs/applications/audio/klick/default.nix

@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     description = "Advanced command-line metronome for JACK";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
+    mainProgram = "klick";
   };
 }

pkgs/applications/audio/klystrack/default.nix

@@ -54,5 +54,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ suhr ];
     platforms = platforms.linux;
+    mainProgram = "klystrack";
   };
 }

pkgs/applications/audio/kmetronome/default.nix

@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ orivej ];
     platforms = platforms.linux;
+    mainProgram = "kmetronome";
   };
 }

pkgs/applications/audio/listenbrainz-mpd/default.nix

@@ -59,5 +59,6 @@ rustPlatform.buildRustPackage rec {
     description = "ListenBrainz submission client for MPD";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ DeeUnderscore ];
+    mainProgram = "listenbrainz-mpd";
   };
 }

pkgs/applications/audio/littlegptracker/default.nix

@@ -70,5 +70,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     # https://github.com/NixOS/nixpkgs/pull/91766#issuecomment-688751821
     broken = stdenv.isDarwin;
+    mainProgram = "lgpt";
   };
 }

pkgs/applications/audio/losslessaudiochecker/default.nix

@@ -26,5 +26,6 @@ stdenv.mkDerivation {
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ p-h ];
+    mainProgram = "LAC";
   };
 }

pkgs/applications/audio/luppp/default.nix

@@ -43,5 +43,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ prusnak ];
     platforms = platforms.linux;
+    mainProgram = "luppp";
   };
 }

pkgs/applications/audio/lv2bm/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "lv2bm";
   };
 }

pkgs/applications/audio/lv2lint/default.nix

@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     license = licenses.artistic2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.all;
+    mainProgram = "lv2lint";
   };
 }

pkgs/applications/audio/m4acut/default.nix

@@ -20,5 +20,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ bsdOriginal zlib ];
     maintainers = [ maintainers.chkno ];
     platforms = platforms.all;
+    mainProgram = "m4acut";
   };
 }

pkgs/applications/audio/master_me/default.nix

@@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     broken = stdenv.isDarwin; # error: no type or protocol named 'NSPasteboardType'
     license = licenses.gpl3Plus;
+    mainProgram = "master_me";
   };
 }

pkgs/applications/audio/meterbridge/default.nix

@@ -23,5 +23,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.nico202 ];
+    mainProgram = "meterbridge";
   };
 }

pkgs/applications/audio/mi2ly/default.nix

@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
     homepage = "https://www.nongnu.org/mi2ly/";
+    mainProgram = "mi2ly";
   };
 }

pkgs/applications/audio/mid2key/default.nix

@@ -23,5 +23,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
+    mainProgram = "mid2key";
   };
 }

pkgs/applications/audio/mikmod/default.nix

@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ ];
     platforms = with lib.platforms; linux;
+    mainProgram = "mikmod";
   };
 }

pkgs/applications/audio/milkytracker/default.nix

@@ -81,5 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     # ibtool -> real Xcode -> I can't get that, and Ofborg can't test that
     broken = stdenv.hostPlatform.isDarwin;
     maintainers = with maintainers; [ OPNA2608 ];
+    mainProgram = "milkytracker";
   };
 })

pkgs/applications/audio/mmlgui/default.nix

@@ -95,5 +95,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
+    mainProgram = "mmlgui";
   };
 }

pkgs/applications/audio/mmtc/default.nix

@@ -28,5 +28,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/figsoda/mmtc/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "mmtc";
   };
 }

pkgs/applications/audio/moc/default.nix

@@ -96,5 +96,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ aethelz pSub jagajaga ];
     platforms = platforms.unix;
+    mainProgram = "mocp";
   };
 }

pkgs/applications/audio/mp3gain/default.nix

@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
     platforms = platforms.unix;
     maintainers = with maintainers; [ devhell ];
+    mainProgram = "mp3gain";
   };
 }

pkgs/applications/audio/mp3val/default.nix

@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.devhell ];
+    mainProgram = "mp3val";
   };
 }

pkgs/applications/audio/museeks/default.nix

@@ -34,5 +34,6 @@ appimageTools.wrapType2 {
     license = licenses.mit;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ zendo ];
+    mainProgram = "museeks";
   };
 }

pkgs/applications/audio/music-player/default.nix

@@ -40,5 +40,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/tsirysndr/music-player/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
+    mainProgram = "music-player";
   };
 }

pkgs/applications/audio/musly/default.nix

@@ -29,5 +29,6 @@ stdenv.mkDerivation {
     license = licenses.mpl20;
     maintainers = with maintainers; [ ggpeti ];
     platforms = with platforms; darwin ++ linux;
+    mainProgram = "musly";
   };
 }

pkgs/applications/audio/ncmpc/default.nix

@@ -40,5 +40,6 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     platforms   = platforms.all;
     maintainers = with maintainers; [ fpletz ];
+    mainProgram = "ncmpc";
   };
 }

pkgs/applications/audio/ncpamixer/default.nix

@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = teams.c3d2.members;
+    mainProgram = "ncpamixer";
   };
 }

pkgs/applications/audio/ncspot/default.nix

@@ -59,5 +59,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/hrkfdn/ncspot/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = [ maintainers.marsam ];
+    mainProgram = "ncspot";
   };
 }

pkgs/applications/audio/ninjas2/default.nix

@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl3 ];
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    mainProgram = "ninjas2";
   };
 }

pkgs/applications/audio/odin2/default.nix

@@ -82,5 +82,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ magnetophon ];
+    mainProgram = "Odin2";
   };
 }

pkgs/applications/audio/open-stage-control/default.nix

@@ -90,5 +90,6 @@ buildNpmPackage rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ lilyinstarlight ];
     platforms = platforms.linux;
+    mainProgram = "open-stage-control";
   };
 }

pkgs/applications/audio/openutau/default.nix

@@ -85,5 +85,6 @@ buildDotnetModule rec {
     ];
     maintainers = with maintainers; [ lilyinstarlight ];
     platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    mainProgram = "OpenUtau";
   };
 }

pkgs/applications/audio/opustags/default.nix

@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     broken = stdenv.isDarwin;
     maintainers = with maintainers; [ kmein ];
     license = licenses.bsd3;
+    mainProgram = "opustags";
   };
 }

pkgs/applications/audio/pamix/default.nix

@@ -40,5 +40,6 @@ stdenv.mkDerivation rec {
     license     = licenses.mit;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ ericsagnes ];
+    mainProgram = "pamix";
   };
 }

pkgs/applications/audio/patchage/default.nix

@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl3;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.nico202 ];
+    mainProgram = "patchage";
   };
 }

pkgs/applications/audio/paulstretch/default.nix

@@ -56,5 +56,6 @@ stdenv.mkDerivation {
     homepage = "https://hypermammut.sourceforge.net/paulstretch/";
     platforms = platforms.linux;
     license = licenses.gpl2;
+    mainProgram = "paulstretch";
   };
 }

pkgs/applications/audio/pbpctrl/default.nix

@@ -28,5 +28,6 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ asl20 mit ];
     maintainers = [ maintainers.vanilla ];
     platforms = platforms.linux;
+    mainProgram = "pbpctrl";
   };
 }

pkgs/applications/audio/petrifoo/default.nix

@@ -33,5 +33,6 @@ stdenv.mkDerivation  rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.goibhniu ];
+    mainProgram = "petri-foo";
   };
 }

pkgs/applications/audio/pianobar/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://6xq.net/pianobar/";
     platforms = platforms.unix;
     license = licenses.mit; # expat version
+    mainProgram = "pianobar";
   };
 }

pkgs/applications/audio/picoloop/default.nix

@@ -46,5 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/yoyz/picoloop";
     platforms = platforms.linux;
     license = licenses.bsd3;
+    mainProgram = "picoloop";
   };
 }

pkgs/applications/audio/pmidi/default.nix

@@ -18,5 +18,6 @@ stdenv.mkDerivation {
     description = "A straightforward command line program to play midi files through the ALSA sequencer";
     maintainers = with maintainers; [ lheckemann ];
     license = licenses.gpl2;
+    mainProgram = "pmidi";
   };
 }

pkgs/applications/audio/pms/default.nix

@@ -18,5 +18,6 @@ buildGoModule {
     homepage = "https://ambientsound.github.io/pms/";
     license = licenses.mit;
     maintainers = with maintainers; [ deejayem ];
+    mainProgram = "pms";
   };
 }

pkgs/applications/audio/proteus/default.nix

@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ orivej ];
+    mainProgram = "Proteus";
   };
 }