Merge master into haskell-updates

2024-02-26 00:12:47 +00:00 · 2024-02-26 00:12:47 +00:00 · 70706e07ef
commit 70706e07ef
parent 257171f024 75f9d4f7cf
183 changed files with 1620 additions and 900 deletions
--- a/flake.nix
+++ b/flake.nix
@ -27,7 +27,19 @@
              # We set it to null, to remove the "legacy" entrypoint's
              # non-hermetic default.
              system = null;
-            } // args
+
+              modules = args.modules ++ [
+                # This module is injected here since it exposes the nixpkgs self-path in as
+                # constrained of contexts as possible to avoid more things depending on it and
+                # introducing unnecessary potential fragility to changes in flakes itself.
+                #
+                # See: failed attempt to make pkgs.path not copy when using flakes:
+                # https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1023287913
+                ({ config, pkgs, lib, ... }: {
+                  config.nixpkgs.flake.source = self.outPath;
+                })
+              ];
+            } // builtins.removeAttrs args [ "modules" ]
          );
      });

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1743,6 +1743,12 @@
    githubId = 113123021;
    name = "Ashvith Shetty";
  };
+  asininemonkey = {
+    email = "nixpkgs@asininemonkey.com";
+    github = "asininemonkey";
+    githubId = 65740649;
+    name = "Jose Cardoso";
+  };
  aske = {
    email = "aske@fmap.me";
    github = "aske";
@ -1755,6 +1761,15 @@
    githubId = 453170;
    name = "Alastair Pharo";
  };
+  aspulse = {
+    email = "contact@aspulse.dev";
+    github = "aspulse";
+    githubId = 84216737;
+    name = "AsPulse / あすぱる";
+    keys = [{
+      fingerprint = "C919 E69E A7C0 E147 9E0F  C26E 1EDA D0C6 70BD 062D";
+    }];
+  };
  astavie = {
    email = "astavie@pm.me";
    github = "astavie";
@ -15926,6 +15941,12 @@
    githubId = 11351304;
    name = "Ricardo Ardissone";
  };
+  raroh73 = {
+    email = "me@raroh73.com";
+    github = "Raroh73";
+    githubId = 96078496;
+    name = "Raroh73";
+  };
  rasendubi = {
    email = "rasen.dubi@gmail.com";
    github = "rasendubi";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -342,7 +342,6 @@ with lib.maintainers; {
      imincik
      nh2
      nialov
-      r-burns
      sikmir
      willcohen
    ];
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -20,6 +20,14 @@ In addition to numerous new and upgraded packages, this release has the followin
   - This can be disabled through the `environment.stub-ld.enable` option.
   - If you use `programs.nix-ld.enable`, no changes are needed. The stub will be disabled automatically.

+- On flake-based NixOS configurations using `nixpkgs.lib.nixosSystem`, NixOS will automatically set `NIX_PATH` and the system-wide flake registry (`/etc/nix/registry.json`) to point `<nixpkgs>` and the unqualified flake path `nixpkgs` to the version of nixpkgs used to build the system.
+
+  This makes `nix run nixpkgs#hello` and `nix-build '<nixpkgs>' -A hello` work out of the box with no added configuration, reusing dependencies already on the system.
+
+  This may be undesirable if nix commands are not going to be run on the built system since it adds nixpkgs to the system closure. For such closure-size-constrained non-interactive systems, this setting should be disabled.
+
+  To disable this, set [nixpkgs.flake.setNixPath](#opt-nixpkgs.flake.setNixPath) and [nixpkgs.flake.setFlakeRegistry](#opt-nixpkgs.flake.setFlakeRegistry) to false.
+
 - Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.

 - A new option `systemd.sysusers.enable` was added. If enabled, users and
@ -111,6 +119,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.

+- `boot.supportedFilesystems` and `boot.initrd.supportedFilesystems` are now attribute sets instead of lists. Assignment from lists as done previously is still supported, but checking whether a filesystem is enabled must now by done using `supportedFilesystems.fs or false` instead of using `lib.elem "fs" supportedFilesystems` as was done previously.
+
 - `services.aria2.rpcSecret` has been replaced with `services.aria2.rpcSecretFile`.
  This was done so that secrets aren't stored in the world-readable nix store.
  To migrate, you will have create a file with the same exact string, and change
@ -173,6 +183,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - The `cudaPackages` package scope has been updated to `cudaPackages_12`.

+- Ada packages (libraries and tools) have been moved into the `gnatPackages` scope. `gnatPackages` uses the default GNAT compiler, `gnat12Packages` and `gnat13Packages` use the respective matching compiler version.
+
+- `spark2014` has been renamed to `gnatprove`. A version of `gnatprove` matching different GNAT versions is available from the different `gnatPackages` sets.
+
 - `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.

 - `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@ -2,18 +2,23 @@
 with lib;
 let
  cfg = config.hardware.printers;
-  ppdOptionsString = options: optionalString (options != {})
-    (concatStringsSep " "
-      (mapAttrsToList (name: value: "-o '${name}'='${value}'") options)
-    );
-  ensurePrinter = p: ''
-    ${pkgs.cups}/bin/lpadmin -p '${p.name}' -E \
-      ${optionalString (p.location != null) "-L '${p.location}'"} \
-      ${optionalString (p.description != null) "-D '${p.description}'"} \
-      -v '${p.deviceUri}' \
-      -m '${p.model}' \
-      ${ppdOptionsString p.ppdOptions}
+
+  ensurePrinter = p: let
+    args = cli.toGNUCommandLineShell {} ({
+      p = p.name;
+      v = p.deviceUri;
+      m = p.model;
+    } // optionalAttrs (p.location != null) {
+      L = p.location;
+    } // optionalAttrs (p.description != null) {
+      D = p.description;
+    } // optionalAttrs (p.ppdOptions != {}) {
+      o = mapAttrsToList (name: value: "'${name}'='${value}'") p.ppdOptions;
+    });
+  in ''
+    ${pkgs.cups}/bin/lpadmin ${args} -E
  '';
+
  ensureDefaultPrinter = name: ''
    ${pkgs.cups}/bin/lpadmin -d '${name}'
  '';
--- a/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix
@ -1,15 +1,7 @@
-{ pkgs, ... }:
+{ lib, ... }:

 {
  imports = [ ./installation-cd-minimal-new-kernel.nix ];

-  # Makes `availableOn` fail for zfs, see <nixos/modules/profiles/base.nix>.
-  # This is a workaround since we cannot remove the `"zfs"` string from `supportedFilesystems`.
-  # The proper fix would be to make `supportedFilesystems` an attrset with true/false which we
-  # could then `lib.mkForce false`
-  nixpkgs.overlays = [(final: super: {
-    zfs = super.zfs.overrideAttrs(_: {
-      meta.platforms = [];
-    });
-  })];
+  boot.supportedFilesystems.zfs = lib.mkForce false;
 }
--- a/nixos/modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix
+++ b/nixos/modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix
@ -1,15 +1,7 @@
-{ pkgs, ... }:
+{ lib, ... }:

 {
  imports = [ ./sd-image-aarch64-new-kernel-installer.nix ];

-  # Makes `availableOn` fail for zfs, see <nixos/modules/profiles/base.nix>.
-  # This is a workaround since we cannot remove the `"zfs"` string from `supportedFilesystems`.
-  # The proper fix would be to make `supportedFilesystems` an attrset with true/false which we
-  # could then `lib.mkForce false`
-  nixpkgs.overlays = [(final: super: {
-    zfs = super.zfs.overrideAttrs(_: {
-      meta.platforms = [];
-    });
-  })];
+  boot.supportedFilesystems.zfs = lib.mkForce false;
 }
--- a/nixos/modules/misc/nixpkgs-flake.nix
+++ b/nixos/modules/misc/nixpkgs-flake.nix
@ -0,0 +1,105 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.nixpkgs.flake;
+in
+{
+  options.nixpkgs.flake = {
+    source = mkOption {
+      # In newer Nix versions, particularly with lazy trees, outPath of
+      # flakes becomes a Nix-language path object. We deliberately allow this
+      # to gracefully come through the interface in discussion with @roberth.
+      #
+      # See: https://github.com/NixOS/nixpkgs/pull/278522#discussion_r1460292639
+      type = types.nullOr (types.either types.str types.path);
+
+      default = null;
+      defaultText = "if (using nixpkgsFlake.lib.nixosSystem) then self.outPath else null";
+
+      example = ''builtins.fetchTarball { name = "source"; sha256 = "${lib.fakeHash}"; url = "https://github.com/nixos/nixpkgs/archive/somecommit.tar.gz"; }'';
+
+      description = mdDoc ''
+        The path to the nixpkgs sources used to build the system. This is automatically set up to be
+        the store path of the nixpkgs flake used to build the system if using
+        `nixpkgs.lib.nixosSystem`, and is otherwise null by default.
+
+        This can also be optionally set if the NixOS system is not built with a flake but still uses
+        pinned sources: set this to the store path for the nixpkgs sources used to build the system,
+        as may be obtained by `builtins.fetchTarball`, for example.
+
+        Note: the name of the store path must be "source" due to
+        <https://github.com/NixOS/nix/issues/7075>.
+      '';
+    };
+
+    setNixPath = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
+        lookups receive the version of nixpkgs that the system was built with, in concert with
+        {option}`nixpkgs.flake.setFlakeRegistry`.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This makes {command}`nix-build '<nixpkgs>' -A hello` work out of the box on flake systems.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+
+    setFlakeRegistry = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
+        store path of the sources of nixpkgs used to build the NixOS system.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This option makes {command}`nix run nixpkgs#hello` reuse dependencies from the system, avoid
+        refetching nixpkgs, and have a consistent result every time.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.source != null) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.setNixPath -> cfg.setFlakeRegistry;
+          message = ''
+            Setting `nixpkgs.flake.setNixPath` requires that `nixpkgs.flake.setFlakeRegistry` also
+            be set, since it is implemented in terms of indirection through the flake registry.
+          '';
+        }
+      ];
+    }
+    (mkIf cfg.setFlakeRegistry {
+      nix.registry.nixpkgs.to = mkDefault {
+        type = "path";
+        path = cfg.source;
+      };
+    })
+    (mkIf cfg.setNixPath {
+      # N.B. This does not include nixos-config in NIX_PATH unlike modules/config/nix-channel.nix
+      # because we would need some kind of evil shim taking the *calling* flake's self path,
+      # perhaps, to ever make that work (in order to know where the Nix expr for the system came
+      # from and how to call it).
+      nix.nixPath = mkDefault ([ "nixpkgs=flake:nixpkgs" ]
+        ++ optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels");
+    })
+  ]);
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -133,6 +133,7 @@
  ./misc/meta.nix
  ./misc/nixops-autoluks.nix
  ./misc/nixpkgs.nix
+  ./misc/nixpkgs-flake.nix
  ./misc/passthru.nix
  ./misc/version.nix
  ./misc/wordlist.nix
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -3,7 +3,7 @@
 # the modules necessary to mount the root file system, then calls the
 # init in the root file system to start the second boot stage.

-{ config, lib, utils, pkgs, ... }:
+{ config, options, lib, utils, pkgs, ... }:

 with lib;

@ -636,10 +636,8 @@ in
      };

    boot.initrd.supportedFilesystems = mkOption {
-      default = [ ];
-      example = [ "btrfs" ];
-      type = types.listOf types.str;
-      description = lib.mdDoc "Names of supported filesystem types in the initial ramdisk.";
+      default = { };
+      inherit (options.boot.supportedFilesystems) example type description;
    };

    boot.initrd.verbose = mkOption {
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -246,10 +246,23 @@ in
    };

    boot.supportedFilesystems = mkOption {
-      default = [ ];
-      example = [ "btrfs" ];
-      type = types.listOf types.str;
-      description = lib.mdDoc "Names of supported filesystem types.";
+      default = { };
+      example = lib.literalExpression ''
+        {
+          btrfs = true;
+          zfs = lib.mkForce false;
+        }
+      '';
+      type = types.coercedTo
+        (types.listOf types.str)
+        (enabled: lib.listToAttrs (map (fs: lib.nameValuePair fs true) enabled))
+        (types.attrsOf types.bool);
+      description = lib.mdDoc ''
+        Names of supported filesystem types, or an attribute set of file system types
+        and their state. The set form may be used together with `lib.mkForce` to
+        explicitly disable support for specific filesystems, e.g. to disable ZFS
+        with an unsupported kernel.
+      '';
    };

    boot.specialFileSystems = mkOption {
--- a/nixos/modules/tasks/filesystems/apfs.nix
+++ b/nixos/modules/tasks/filesystems/apfs.nix
@ -4,12 +4,12 @@ with lib;

 let

-  inInitrd = any (fs: fs == "apfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.apfs or false;

 in

 {
-  config = mkIf (any (fs: fs == "apfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.apfs or false) {

    system.fsPackages = [ pkgs.apfsprogs ];

--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@ -118,7 +118,7 @@ let
 in

 {
-  config = lib.mkIf (lib.elem "bcachefs" config.boot.supportedFilesystems) (lib.mkMerge [
+  config = lib.mkIf (config.boot.supportedFilesystems.bcachefs or false) (lib.mkMerge [
    {
      inherit assertions;
      # needed for systemd-remount-fs
@ -133,7 +133,7 @@ in
      };
    }

-    (lib.mkIf ((lib.elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) {
+    (lib.mkIf ((config.boot.initrd.supportedFilesystems.bcachefs or false) || (bootFs != {})) {
      inherit assertions;
      # chacha20 and poly1305 are required only for decryption attempts
      boot.initrd.availableKernelModules = [ "bcachefs" "sha256" "chacha20" "poly1305" ];
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@ -4,8 +4,8 @@ with lib;

 let

-  inInitrd = any (fs: fs == "btrfs") config.boot.initrd.supportedFilesystems;
-  inSystem = any (fs: fs == "btrfs") config.boot.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.btrfs or false;
+  inSystem = config.boot.supportedFilesystems.btrfs or false;

  cfgScrub = config.services.btrfs.autoScrub;

--- a/nixos/modules/tasks/filesystems/cifs.nix
+++ b/nixos/modules/tasks/filesystems/cifs.nix
@ -4,14 +4,14 @@ with lib;

 let

-  inInitrd = any (fs: fs == "cifs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.cifs or false;

 in

 {
  config = {

-    system.fsPackages = mkIf (any (fs: fs == "cifs") config.boot.supportedFilesystems) [ pkgs.cifs-utils ];
+    system.fsPackages = mkIf (config.boot.supportedFilesystems.cifs or false) [ pkgs.cifs-utils ];

    boot.initrd.availableKernelModules = mkIf inInitrd
      [ "cifs" "nls_utf8" "hmac" "md4" "ecb" "des_generic" "sha256" ];
--- a/nixos/modules/tasks/filesystems/ecryptfs.nix
+++ b/nixos/modules/tasks/filesystems/ecryptfs.nix
@ -4,7 +4,7 @@
 with lib;

 {
-  config = mkIf (any (fs: fs == "ecryptfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.ecryptfs or false) {
    system.fsPackages = [ pkgs.ecryptfs ];
    security.wrappers = {
      "mount.ecryptfs_private" =
--- a/nixos/modules/tasks/filesystems/erofs.nix
+++ b/nixos/modules/tasks/filesystems/erofs.nix
@ -2,8 +2,8 @@

 let

-  inInitrd = lib.any (fs: fs == "erofs") config.boot.initrd.supportedFilesystems;
-  inSystem = lib.any (fs: fs == "erofs") config.boot.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.erofs or false;
+  inSystem = config.boot.supportedFilesystems.erofs or false;

 in

--- a/nixos/modules/tasks/filesystems/exfat.nix
+++ b/nixos/modules/tasks/filesystems/exfat.nix
@ -3,7 +3,7 @@
 with lib;

 {
-  config = mkIf (any (fs: fs == "exfat") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.exfat or false) {
    system.fsPackages = if config.boot.kernelPackages.kernelOlder "5.7" then [
      pkgs.exfat # FUSE
    ] else [
--- a/nixos/modules/tasks/filesystems/ext.nix
+++ b/nixos/modules/tasks/filesystems/ext.nix
@ -2,8 +2,10 @@

 let

-  inInitrd = lib.any (fs: fs == "ext2" || fs == "ext3" || fs == "ext4") config.boot.initrd.supportedFilesystems;
-  inSystem = lib.any (fs: fs == "ext2" || fs == "ext3" || fs == "ext4") config.boot.supportedFilesystems;
+  hasExtX = s: s.ext2 or s.ext3 or s.ext4 or false;
+
+  inInitrd = hasExtX config.boot.initrd.supportedFilesystems;
+  inSystem = hasExtX config.boot.supportedFilesystems;

 in

--- a/nixos/modules/tasks/filesystems/f2fs.nix
+++ b/nixos/modules/tasks/filesystems/f2fs.nix
@ -3,11 +3,10 @@
 with lib;

 let
-  inInitrd = any (fs: fs == "f2fs") config.boot.initrd.supportedFilesystems;
-  fileSystems = filter (x: x.fsType == "f2fs") config.system.build.fileSystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.f2fs or false;
 in
 {
-  config = mkIf (any (fs: fs == "f2fs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.f2fs or false) {

    system.fsPackages = [ pkgs.f2fs-tools ];

--- a/nixos/modules/tasks/filesystems/glusterfs.nix
+++ b/nixos/modules/tasks/filesystems/glusterfs.nix
@ -3,7 +3,7 @@
 with lib;

 {
-  config = mkIf (any (fs: fs == "glusterfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.glusterfs or false) {

    system.fsPackages = [ pkgs.glusterfs ];

--- a/nixos/modules/tasks/filesystems/jfs.nix
+++ b/nixos/modules/tasks/filesystems/jfs.nix
@ -3,10 +3,10 @@
 with lib;

 let
-  inInitrd = any (fs: fs == "jfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.jfs or false;
 in
 {
-  config = mkIf (any (fs: fs == "jfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.jfs or false) {

    system.fsPackages = [ pkgs.jfsutils ];

--- a/nixos/modules/tasks/filesystems/nfs.nix
+++ b/nixos/modules/tasks/filesystems/nfs.nix
@ -4,7 +4,7 @@ with lib;

 let

-  inInitrd = any (fs: fs == "nfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.nfs or false;

  nfsStateDir = "/var/lib/nfs";

@ -58,7 +58,7 @@ in

  ###### implementation

-  config = mkIf (any (fs: fs == "nfs" || fs == "nfs4") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.nfs or config.boot.supportedFilesystems.nfs4 or false) {

    services.rpcbind.enable = true;

--- a/nixos/modules/tasks/filesystems/ntfs.nix
+++ b/nixos/modules/tasks/filesystems/ntfs.nix
@ -3,7 +3,7 @@
 with lib;

 {
-  config = mkIf (any (fs: fs == "ntfs" || fs == "ntfs-3g") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.ntfs or config.boot.supportedFilesystems.ntfs-3g or false) {

    system.fsPackages = [ pkgs.ntfs3g ];

--- a/nixos/modules/tasks/filesystems/reiserfs.nix
+++ b/nixos/modules/tasks/filesystems/reiserfs.nix
@ -4,12 +4,12 @@ with lib;

 let

-  inInitrd = any (fs: fs == "reiserfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.reiserfs or false;

 in

 {
-  config = mkIf (any (fs: fs == "reiserfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.reiserfs or false) {

    system.fsPackages = [ pkgs.reiserfsprogs ];

--- a/nixos/modules/tasks/filesystems/squashfs.nix
+++ b/nixos/modules/tasks/filesystems/squashfs.nix
@ -2,7 +2,7 @@

 let

-  inInitrd = lib.any (fs: fs == "squashfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.squashfs or false;

 in

--- a/nixos/modules/tasks/filesystems/sshfs.nix
+++ b/nixos/modules/tasks/filesystems/sshfs.nix
@ -1,7 +1,11 @@
 { config, lib, pkgs, ... }:

 {
-  config = lib.mkIf (lib.any (fs: fs == "sshfs" || fs == "fuse.sshfs") config.boot.supportedFilesystems) {
-    system.fsPackages = [ pkgs.sshfs ];
-  };
+  config = lib.mkIf
+    (config.boot.supportedFilesystems.sshfs
+      or config.boot.supportedFilesystems."fuse.sshfs"
+      or false)
+    {
+      system.fsPackages = [ pkgs.sshfs ];
+    };
 }
--- a/nixos/modules/tasks/filesystems/unionfs-fuse.nix
+++ b/nixos/modules/tasks/filesystems/unionfs-fuse.nix
@ -3,7 +3,7 @@
 {
  config = lib.mkMerge [

-    (lib.mkIf (lib.any (fs: fs == "unionfs-fuse") config.boot.initrd.supportedFilesystems) {
+    (lib.mkIf (config.boot.initrd.supportedFilesystems.unionfs-fuse or false) {
      boot.initrd.kernelModules = [ "fuse" ];

      boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
@ -35,7 +35,7 @@
      };
    })

-    (lib.mkIf (lib.any (fs: fs == "unionfs-fuse") config.boot.supportedFilesystems) {
+    (lib.mkIf (config.boot.supportedFilesystems.unionfs-fuse or false) {
      system.fsPackages = [ pkgs.unionfs-fuse ];
    })

--- a/nixos/modules/tasks/filesystems/vboxsf.nix
+++ b/nixos/modules/tasks/filesystems/vboxsf.nix
@ -4,7 +4,7 @@ with lib;

 let

-  inInitrd = any (fs: fs == "vboxsf") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.vboxsf or false;

  package = pkgs.runCommand "mount.vboxsf" { preferLocalBuild = true; } ''
    mkdir -p $out/bin
@ -13,7 +13,7 @@ let
 in

 {
-  config = mkIf (any (fs: fs == "vboxsf") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.vboxsf or false) {

    system.fsPackages = [ package ];

--- a/nixos/modules/tasks/filesystems/vfat.nix
+++ b/nixos/modules/tasks/filesystems/vfat.nix
@ -4,12 +4,12 @@ with lib;

 let

-  inInitrd = any (fs: fs == "vfat") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.vfat or false;

 in

 {
-  config = mkIf (any (fs: fs == "vfat") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.vfat or false) {

    system.fsPackages = [ pkgs.dosfstools pkgs.mtools ];

--- a/nixos/modules/tasks/filesystems/xfs.nix
+++ b/nixos/modules/tasks/filesystems/xfs.nix
@ -4,12 +4,12 @@ with lib;

 let

-  inInitrd = any (fs: fs == "xfs") config.boot.initrd.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.xfs or false;

 in

 {
-  config = mkIf (any (fs: fs == "xfs") config.boot.supportedFilesystems) {
+  config = mkIf (config.boot.supportedFilesystems.xfs or false) {

    system.fsPackages = [ pkgs.xfsprogs.bin ];

--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -20,8 +20,8 @@ let
  clevisDatasets = map (e: e.device) (filter (e: e.device != null && (hasAttr e.device config.boot.initrd.clevis.devices) && e.fsType == "zfs" && (fsNeededForBoot e)) config.system.build.fileSystems);


-  inInitrd = any (fs: fs == "zfs") config.boot.initrd.supportedFilesystems;
-  inSystem = any (fs: fs == "zfs") config.boot.supportedFilesystems;
+  inInitrd = config.boot.initrd.supportedFilesystems.zfs or false;
+  inSystem = config.boot.supportedFilesystems.zfs or false;

  autosnapPkg = pkgs.zfstools.override {
    zfs = cfgZfs.package;
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@ -6,7 +6,7 @@ let

  crioPackage = pkgs.cri-o.override {
    extraPackages = cfg.extraPackages
-      ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
+      ++ lib.optional (config.boot.supportedFilesystems.zfs or false) config.boot.zfs.package;
  };

  format = pkgs.formats.toml { };
--- a/nixos/modules/virtualisation/hyperv-image.nix
+++ b/nixos/modules/virtualisation/hyperv-image.nix
@ -60,7 +60,6 @@ in {
    boot.growPartition = true;

    boot.loader.grub = {
-      version = 2;
      device = "nodev";
      efiSupport = true;
      efiInstallAsRemovable = true;
--- a/nixos/modules/virtualisation/linode-config.nix
+++ b/nixos/modules/virtualisation/linode-config.nix
@ -59,7 +59,6 @@ with lib;

      grub = {
        enable = true;
-        version = 2;
        forceInstall = true;
        device = "nodev";

--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@ -252,10 +252,13 @@ let
      text = ''
        ${cfg.backend} rm -f ${name} || true
        ${optionalString (isValidLogin container.login) ''
+          # try logging in, if it fails, check if image exists locally
          ${cfg.backend} login \
          ${container.login.registry} \
          --username ${container.login.username} \
-          --password-stdin < ${container.login.passwordFile}
+          --password-stdin < ${container.login.passwordFile} \
+          || ${cfg.backend} image inspect ${container.image} >/dev/null \
+          || { echo "image doesn't exist locally and login failed" >&2 ; exit 1; }
        ''}
        ${optionalString (container.imageFile != null) ''
          ${cfg.backend} load -i ${container.imageFile}
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@ -9,7 +9,7 @@ let
    extraPackages = cfg.extraPackages
      # setuid shadow
      ++ [ "/run/wrappers" ]
-      ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
+      ++ lib.optional (config.boot.supportedFilesystems.zfs or false) config.boot.zfs.package;
  });

  # Provides a fake "docker" binary mapping to podman
--- a/nixos/modules/virtualisation/vmware-image.nix
+++ b/nixos/modules/virtualisation/vmware-image.nix
@ -80,7 +80,6 @@ in {
    boot.growPartition = true;

    boot.loader.grub = {
-      version = 2;
      device = "nodev";
      efiSupport = true;
      efiInstallAsRemovable = true;
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -526,8 +526,7 @@ let
            curl
          ]
          ++ optionals (bootLoader == "grub") (let
-            zfsSupport = lib.any (x: x == "zfs")
-              (extraInstallerConfig.boot.supportedFilesystems or []);
+            zfsSupport = extraInstallerConfig.boot.supportedFilesystems.zfs or false;
          in [
            (pkgs.grub2.override { inherit zfsSupport; })
            (pkgs.grub2_efi.override { inherit zfsSupport; })
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -9,18 +9,18 @@

 buildGoModule rec {
  pname = "go-musicfox";
-  version = "4.3.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "go-musicfox";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-JDR3D3tILT0q9jqcZmbfQC3yn7cmaSL/GEpCguqCFXI=";
+    hash = "sha256-QZHuQAOnthSm7Kb82i3NUWTnKk+9OMHV5vzOU72inX0=";
  };

  deleteVendor = true;

-  vendorHash = "sha256-ILO4v4ii1l9JokXG7R3vuN7i5hDi/hLHTFiClA2vdf0=";
+  vendorHash = "sha256-6DeoxpjVfykBI3fJAJpMZwJ4VTooIbxGpk5+SW198hU=";

  subPackages = [ "cmd/musicfox.go" ];

--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -28,11 +28,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kid3";
-  version = "3.9.4";
+  version = "3.9.5";

  src = fetchurl {
    url = "mirror://kde/stable/kid3/${finalAttrs.version}/kid3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-xBCWDpYiXeChxIiMPqHG3CyiRau2kUdDJtzcPtvWpSA=";
+    hash = "sha256-pCT+3eNcF247RDNEIqrUOEhBh3LaAgdR0A0IdOXOgUU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, soxr
+, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, libopus, soxr
 , IOKit, AudioToolbox
 , aixlog, popl
 , pulseaudioSupport ? false, libpulseaudio
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  # not needed
  buildInputs = [
    boost179
-    asio avahi flac libogg libvorbis
+    asio avahi flac libogg libvorbis libopus
    aixlog popl soxr
  ] ++ lib.optional pulseaudioSupport libpulseaudio
  ++ lib.optional stdenv.isLinux alsa-lib
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@ -6,21 +6,23 @@
 , pkg-config
 , gperf
 , libmicrohttpd
+, libsodium
 , openssl
 , readline
+, secp256k1
 , zlib
 , nix-update-script
 }:

 stdenv.mkDerivation rec {
  pname = "ton";
-  version = "2023.10";
+  version = "2024.01";

  src = fetchFromGitHub {
    owner = "ton-blockchain";
    repo = "ton";
    rev = "v${version}";
-    sha256 = "sha256-K1RhhW7EvwYV7/ng3NPjSGdHEQvJZ7K97YXd7s5wghc=";
+    hash = "sha256-nZ7yel+lTNO5zFzN711tLwAvqpf5qaYOxERwApnMVOs=";
    fetchSubmodules = true;
  };

@ -35,14 +37,19 @@ stdenv.mkDerivation rec {
  buildInputs = [
    gperf
    libmicrohttpd
+    libsodium
    openssl
    readline
+    secp256k1
    zlib
  ];

  passthru.updateScript = nix-update-script { };

  meta = with lib; {
+    # The build fails on darwin as:
+    #   error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
+    broken = stdenv.isDarwin;
    description = "A fully decentralized layer-1 blockchain designed by Telegram";
    homepage = "https://ton.org/";
    changelog = "https://github.com/ton-blockchain/ton/blob/v${version}/Changelog.md";
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
@ -88,7 +88,7 @@ self: let
        ];

        buildInputs = [
-          pkgs.gnatcoll-xref
+          pkgs.gnatPackages.gnatcoll-xref
        ];

        buildPhase = ''
--- a/pkgs/applications/editors/neovim/build-neovim-plugin.nix
+++ b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
@ -33,6 +33,7 @@ in
          nativeBuildInputs = oa.nativeBuildInputs or [] ++ [
            lua.pkgs.luarocksMoveDataFolder
          ];
+          version = "${originalLuaDrv.version}-unstable-${oa.version}";
        }));
    in
      finalDrv
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "notepad-next";
-  version = "0.6.4";
+  version = "0.7";

  src = fetchFromGitHub {
    owner = "dail8859";
    repo = "NotepadNext";
    rev = "v${version}";
-    sha256 = "sha256-m8+kM9uz3gJ3kvpgZdoonSvYlh/f1WiGZlB8JKMTXh4=";
+    sha256 = "sha256-I2bS8oT/TGf6fuXpTwOKo2MaUo0jLFIU/DfW9h1toOk=";
    # External dependencies - https://github.com/dail8859/NotepadNext/issues/135
    fetchSubmodules = true;
  };
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -955,6 +955,54 @@ let

      contextmapper.context-mapper-vscode-extension = callPackage ./contextmapper.context-mapper-vscode-extension { };

+      continue.continue = buildVscodeMarketplaceExtension {
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                sha256 = "05kh6sf3jv3510q33chf8s5n1kfp9wcm7650va7mcrdkfr9g8ysq";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                sha256 = "0242h9kq47qvs1xynr5x8dzxkc5pwgb6km0iqpyy9kydg8ng1vp3";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                sha256 = "1qm3f2lh8mi3hnyp2bmx7j2lir6fmbbxkzh6b8zf579khhbapnaz";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                sha256 = "18w22z1c5qgkpw2zlwmi9gs9dx1pcm51f0r8my7ynnvgl6mp12sg";
+              };
+            };
+          in
+          {
+            name = "continue";
+            publisher = "Continue";
+            version = "0.8.12";
+          } // sources.${stdenv.system};
+        nativeBuildInputs = [
+          autoPatchelfHook
+        ];
+        buildInputs = [
+          stdenv.cc.cc.lib
+        ];
+        postInstall = ''
+          cd "$out/$installPrefix"
+          substituteInPlace "out/extension.js" \
+            --replace-fail 'await showTutorial();' '//await showTutorial();'
+        '';
+        meta = {
+          description = "Open-source autopilot for software development - bring the power of ChatGPT to your IDE";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Continue.continue";
+          homepage = "https://github.com/continuedev/continue";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.raroh73 ];
+          platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+        };
+      };
+
      coolbear.systemd-unit-file = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "coolbear";
--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ares";
-  version = "135";
+  version = "136";

  src = fetchFromGitHub {
    owner = "ares-emulator";
    repo = "ares";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-SZhsMKjNxmT2eHsXAZcyMGoMhwWGgvXpDeZGGVn58Sc=";
+    hash = "sha256-Hks/MWusPiBVdb5L+53qtR6VmXG/P4rDzsvHxLeA8Do=";
  };

  patches = [
--- a/pkgs/applications/graphics/upscayl/default.nix
+++ b/pkgs/applications/graphics/upscayl/default.nix
@ -4,11 +4,11 @@
  lib,
 }: let
  pname = "upscayl";
-  version = "2.9.8";
+  version = "2.9.9";

  src = fetchurl {
    url = "https://github.com/upscayl/upscayl/releases/download/v${version}/upscayl-${version}-linux.AppImage";
-    hash = "sha256-hLK9AX87WbJdKTV/rzEzNeaUWeDz1+bvp/R2LkjHp+w=";
+    hash = "sha256-33jJRMvRQxL7rPJ6VigEKcDhge46CAA0jJUOhzEyWzA=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/kde/kcachegrind.nix
+++ b/pkgs/applications/kde/kcachegrind.nix
@ -2,7 +2,7 @@
  mkDerivation, lib,
  extra-cmake-modules, kdoctools,
  karchive, ki18n, kio, perl, python3, php, qttools,
-  kdbusaddons
+  kdbusaddons, makeBinaryWrapper, graphviz
 }:

 mkDerivation {
@ -13,6 +13,10 @@ mkDerivation {
    license = with lib.licenses; [ gpl2 ];
    maintainers = with lib.maintainers; [ orivej ];
  };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools makeBinaryWrapper ];
  buildInputs = [ karchive ki18n kio perl python3 php qttools kdbusaddons ];
+  postInstall = ''
+    wrapProgram $out/bin/kcachegrind \
+      --suffix PATH : "${lib.makeBinPath [ graphviz ]}"
+  '';
 }
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,4 +1,4 @@
-{ config, stdenv, lib, fetchurl, fetchzip, boost, cmake, ffmpeg, gettext, glew
+{ config, stdenv, lib, fetchurl, fetchzip, fetchpatch, boost, cmake, ffmpeg, gettext, glew
 , libepoxy, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
 , libtiff, libwebp, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio, openjpeg, python310Packages
@ -47,6 +47,10 @@ stdenv.mkDerivation (finalAttrs: rec {

  patches = [
    ./draco.patch
+    (fetchpatch {
+      url = "https://projects.blender.org/blender/blender/commit/cf4365e555a759d5b3225bce77858374cb07faad.diff";
+      hash = "sha256-Nypd04yFSHYa7RBa8kNmoApqJrU4qpaOle3tkj44d4g=";
+    })
  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;

  nativeBuildInputs =
--- a/pkgs/applications/misc/gimoji/default.nix
+++ b/pkgs/applications/misc/gimoji/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gimoji";
-  version = "0.7.3";
+  version = "0.7.6";

  src = fetchFromGitHub {
    owner = "zeenix";
    repo = "gimoji";
    rev = version;
-    hash = "sha256-xQ02jmPuu1IHkQCCJn2FVPcJRbwN+k8FhsZyDX0oHaw=";
+    hash = "sha256-ipsEFZGC3JYOeNVI4AUb2c/9tt+TTIbeXuJ15ShEH6U=";
  };

-  cargoHash = "sha256-DSLIH6swVQXHrqKBxlrhNTG5maRmUi6Ndmuuv0Vo3Ak=";
+  cargoHash = "sha256-786OPEaIHQtgUHlkjLprKfJ7VoeSW+IzHto3XXZ6Fu8=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@ -13,24 +13,27 @@

 flutter.buildFlutterApplication rec {
  pname = "yubioath-flutter";
-  version = "6.3.1";
+  version = "6.4.0";

  src = fetchFromGitHub {
    owner = "Yubico";
    repo = "yubioath-flutter";
    rev = version;
-    hash = "sha256-XgRIX2Iv5niJw2NSBPwM0K4uF5sPj9c+Xj4oHtAQSbU=";
+    hash = "sha256-aXUnmKEUCi0rsVr3HVhEk6xa1z9HMsH+0AIY531hqiU=";
  };

  passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = {
+    window_manager = "sha256-mLX51nbWFccsAfcqLQIYDjYz69y9wAz4U1RZ8TIYSj0=";
+  };

  postPatch = ''
    rm -f pubspec.lock

    substituteInPlace linux/CMakeLists.txt \
-      --replace "../build/linux/helper" "${passthru.helper}/libexec/helper"
+      --replace-fail "../build/linux/helper" "${passthru.helper}/libexec/helper"
  '';

  preInstall = ''
--- a/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
+++ b/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
@ -134,11 +134,11 @@
      "dependency": "transitive",
      "description": {
        "name": "build_runner_core",
-        "sha256": "c9e32d21dd6626b5c163d48b037ce906bbe428bc23ab77bcd77bb21e593b6185",
+        "sha256": "4ae8ffe5ac758da294ecf1802f2aff01558d8b1b00616aa7538ea9a8a5d50799",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.2.11"
+      "version": "7.3.0"
    },
    "built_collection": {
      "dependency": "transitive",
@ -154,11 +154,11 @@
      "dependency": "transitive",
      "description": {
        "name": "built_value",
-        "sha256": "c9aabae0718ec394e5bc3c7272e6bb0dc0b32201a08fe185ec1d8401d3e39309",
+        "sha256": "a3ec2e0f967bc47f69f95009bb93db936288d61d5343b9436e378b28a2f830c6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.8.1"
+      "version": "8.9.0"
    },
    "characters": {
      "dependency": "transitive",
@ -264,31 +264,31 @@
      "dependency": "direct dev",
      "description": {
        "name": "custom_lint",
-        "sha256": "dfb893ff17c83cf08676c6b64df11d3e53d80590978d7c1fb242afff3ba6dedb",
+        "sha256": "f89ff83efdba7c8996e86bb3bad0b759d58f9b19ae4d0e277a386ddd8b481217",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "custom_lint_builder": {
      "dependency": "direct dev",
      "description": {
        "name": "custom_lint_builder",
-        "sha256": "8df6634b38a36a6c6cb74a9c0eb02e9ba0b0ab89b29e38e6daa86e8ed2c6288d",
+        "sha256": "9cdd9987feaa6925ec5f98d64de4fbbb5d94248ff77bbf2489366efad6c4baef",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "custom_lint_core": {
      "dependency": "transitive",
      "description": {
        "name": "custom_lint_core",
-        "sha256": "2b235be098d157e244f18ea905a15a18c16a205e30553888fac6544bbf52f03f",
+        "sha256": "9003a91409c9f1db6e2e50b4870d1d5e802e5923b25f7261bf3cb3e11ea9d4fb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "dart_style": {
      "dependency": "transitive",
@ -402,11 +402,11 @@
      "dependency": "direct main",
      "description": {
        "name": "flutter_riverpod",
-        "sha256": "da9591d1f8d5881628ccd5c25c40e74fc3eef50ba45e40c3905a06e1712412d5",
+        "sha256": "4bce556b7ecbfea26109638d5237684538d4abc509d253e6c5c4c5733b360098",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.4.10"
    },
    "flutter_test": {
      "dependency": "direct dev",
@ -424,11 +424,11 @@
      "dependency": "direct dev",
      "description": {
        "name": "freezed",
-        "sha256": "6c5031daae12c7072b3a87eff98983076434b4889ef2a44384d0cae3f82372ba",
+        "sha256": "57247f692f35f068cae297549a46a9a097100685c6780fe67177503eea5ed4e5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.6"
+      "version": "2.4.7"
    },
    "freezed_annotation": {
      "dependency": "direct main",
@ -645,11 +645,11 @@
      "dependency": "transitive",
      "description": {
        "name": "mime",
-        "sha256": "e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e",
+        "sha256": "2e123074287cc9fd6c09de8336dae606d1ddb88d9ac47358826db698c176a1f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.0.4"
+      "version": "1.0.5"
    },
    "package_config": {
      "dependency": "transitive",
@ -834,11 +834,11 @@
      "dependency": "transitive",
      "description": {
        "name": "riverpod",
-        "sha256": "942999ee48b899f8a46a860f1e13cee36f2f77609eb54c5b7a669bb20d550b11",
+        "sha256": "548e2192eb7aeb826eb89387f814edb76594f3363e2c0bb99dd733d795ba3589",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.5.0"
    },
    "rxdart": {
      "dependency": "transitive",
@ -1119,11 +1119,11 @@
      "dependency": "direct main",
      "description": {
        "name": "url_launcher",
-        "sha256": "d25bb0ca00432a5e1ee40e69c36c85863addf7cc45e433769d61bed3fe81fd96",
+        "sha256": "c512655380d241a337521703af62d2c122bf7b77a46ff7dd750092aa9433499c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.2.3"
+      "version": "6.2.4"
    },
    "url_launcher_android": {
      "dependency": "transitive",
@ -1308,12 +1308,13 @@
    "window_manager": {
      "dependency": "direct main",
      "description": {
-        "name": "window_manager",
-        "sha256": "dcc865277f26a7dad263a47d0e405d77e21f12cb71f30333a52710a408690bd7",
-        "url": "https://pub.dev"
+        "path": ".",
+        "ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "resolved-ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "url": "https://github.com/fdennis/window_manager.git"
      },
-      "source": "hosted",
-      "version": "0.3.7"
+      "source": "git",
+      "version": "0.3.8"
    },
    "xdg_directories": {
      "dependency": "transitive",
--- a/pkgs/applications/networking/asn/default.nix
+++ b/pkgs/applications/networking/asn/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "asn";
-  version = "0.75.3";
+  version = "0.76.0";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KOwXOGw6gv8YFTrFFkD6BNKChTIbD2Soy3gvvSzNQgM=";
+    hash = "sha256-pdtRf9VKEdNg1UeYSaLNLm9O057dT+n5g3Dd0bcP4EI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2024.2.0";
+  version = "2024.2.1";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflared";
    rev = "refs/tags/${version}";
-    hash = "sha256-jcIHpRHcAgzzSKvZH9SLfu5Ake3zCgsSw1iv64yXW2E=";
+    hash = "sha256-aSAwDz7QSYbHfDA+/usGh7xCxSq+kBTB3eqMBf5XEa8=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-DsKc+AT+0vIaJftBFLqVXx/CJRNNgE/vzSxlHkCSJaI=";
+    hash = "sha256-G8zWPz5pTDjfZJ8DtY1DQRGYMOsGhNXWZEgFYKM/y6I=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/kubetail/default.nix
+++ b/pkgs/applications/networking/cluster/kubetail/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kubetail";
-  version = "1.6.18";
+  version = "1.6.19";

  src = fetchFromGitHub {
    owner = "johanhaleby";
    repo = "kubetail";
    rev = version;
-    sha256 = "sha256-Gde5thEpMX3h0e1eoC8SeDdkZfa02CmQf3ELLMeEWGU=";
+    sha256 = "sha256-s+rz30VWG4RijeJuRYEhCmgFDjaxJ+4twgXrGkNc5c8=";
  };

  nativeBuildInputs = [ installShellFiles makeWrapper ];
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "vcluster";
-  version = "0.18.1";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "loft-sh";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-TJjMB7x8MOlr3GexsnOZBFPJovVkf4ByRn1aGprvZFQ=";
+    hash = "sha256-W9BSLGUrW8Us+yYQLIz3oY8JKJSo43cL+oWQQf3xWJE=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -4,7 +4,7 @@ let
    if stdenv.isLinux then {
      stable = "0.0.43";
      ptb = "0.0.71";
-      canary = "0.0.278";
+      canary = "0.0.282";
      development = "0.0.13";
    } else {
      stable = "0.0.294";
@ -25,7 +25,7 @@ let
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-ypnw/CDY02jD8xLpJvS4Y7GjahgvUhcmV7zSDaVkNpk=";
+        hash = "sha256-+Ijl/yPa7DVzVKOWTxCu6FxIsschIqYa+tYBnnKdCBA=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@ -1,24 +1,24 @@
 { lib
 , stdenv
 , fetchurl
-, electron_26
+, electron_27
 , makeWrapper
 }:

 let

  pname = "mattermost-desktop";
-  version = "5.5.1";
+  version = "5.6.0";

  srcs = {
    "x86_64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-bRiO5gYM7nrnkbHBP3B9zAK2YV5POkc3stEsbZJ48VA=";
+      hash = "sha256-KUF/zH18X+RS8AICBv53JTBpcaokzo92psyoQNmLF/Q=";
    };

    "aarch64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-Z4U6Jbwasra69QPHJ9/7WwMSxh0O9r4QIe/xC3WRf4w=";
+      hash = "sha256-Zl5PalAles39qSMtt1cytfu4Mheud4+8TTkt7Ohdf/o=";
    };
  };

@ -52,7 +52,7 @@ stdenv.mkDerivation {
    substituteInPlace $out/share/applications/Mattermost.desktop \
      --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop

-    makeWrapper ${electron_26}/bin/electron $out/bin/${pname} \
+    makeWrapper '${lib.getExe electron_27}' $out/bin/${pname} \
      --add-flags $out/share/${pname}/app.asar

    runHook postInstall
--- a/pkgs/applications/networking/pyload-ng/default.nix
+++ b/pkgs/applications/networking/pyload-ng/default.nix
@ -21,8 +21,6 @@ python3.pkgs.buildPythonApplication rec {
  postPatch = ''
    # relax version bounds
    sed -i 's/\([A-z0-9]*\)~=.*$/\1/' setup.cfg
-    # not sure what Flask-Session2 is but flask-session works just fine
-    sed -i '/Flask-Session2/d' setup.cfg
  '';

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "storj-uplink";
-  version = "1.96.2";
+  version = "1.98.2";

  src = fetchFromGitHub {
    owner = "storj";
    repo = "storj";
    rev = "v${version}";
-    hash = "sha256-mQIrXDEfMMrubQyn90eu0k3isvnpaF237Tpd84HhUfU=";
+    hash = "sha256-XnTrQIDUHdW9HwnYRigGFMGmcSCBhdoTXT4xlMCMeCw=";
  };

  subPackages = [ "cmd/uplink" ];

-  vendorHash = "sha256-cUhdl0jqgkA89NeOdFSifR5LsTjeYifOXqBu3qCAovk=";
+  vendorHash = "sha256-n7exLjiDyvnoKAKnJXo1Ag+jh1Ccb2eA3Yv5fg7gkDk=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/sync/wdt/default.nix
+++ b/pkgs/applications/networking/sync/wdt/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation {
  pname = "wdt";
-  version = "unstable-2023-12-01";
+  version = "unstable-2024-02-05";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "wdt";
-    rev = "66f17af009ef6eaf2707bb8bb511ba6bcf3d9bbe";
-    sha256 = "sha256-ucnFcpH9Duru35kRT769zMX2BMqufZJopd2srKPJkrU=";
+    rev = "d94b2d5df6f1c803f9f3b8ed9247b752fa853865";
+    sha256 = "sha256-9TeJbZZq9uQ6KaEBFGDyIGcXgxi2y1aj55vxv5dAIzw=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -22,13 +22,13 @@
 }:

 let
-  version = "2.5.2";
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "paperless-ngx";
    repo = "paperless-ngx";
    rev = "refs/tags/v${version}";
-    hash = "sha256-v6k9clKNBNb2MQp0BTrUL9zfY6SUKfzaaOycmV8RKyk=";
+    hash = "sha256-fZ5grVZjCVkCH6doeqBLHPh9mPvHkiz+QXi/OyoJhR4=";
  };

  python = python3;
@ -99,30 +99,12 @@ python.pkgs.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with python.pkgs; [
-    amqp
-    anyio
-    asgiref
-    async-timeout
-    attrs
-    autobahn
-    automat
-    billiard
    bleach
-    celery
-    certifi
-    cffi
-    channels-redis
    channels
-    charset-normalizer
-    click
-    click-didyoumean
-    click-plugins
-    click-repl
-    coloredlogs
+    channels-redis
    concurrent-log-handler
-    constantly
-    cryptography
    dateparser
+    django
    django-allauth
    django-auditlog
    django-celery-results
@ -132,92 +114,41 @@ python.pkgs.buildPythonApplication rec {
    django-filter
    django-guardian
    django-multiselectfield
-    django
-    djangorestframework-guardian2
    djangorestframework
+    djangorestframework-guardian2
    drf-writable-nested
    filelock
    flower
    gotenberg-client
    gunicorn
-    h11
-    h2
-    hiredis
-    httptools
-    httpx
-    humanfriendly
-    humanize
-    hyperlink
-    idna
    imap-tools
-    img2pdf
-    incremental
-    inotify-simple
    inotifyrecursive
-    joblib
    langdetect
-    lxml
-    msgpack
    mysqlclient
    nltk
    ocrmypdf
-    packaging
    pathvalidate
    pdf2image
-    pikepdf
-    pillow
-    pluggy
-    portalocker
-    prompt-toolkit
    psycopg2
-    pyasn1-modules
-    pyasn1
-    pycparser
-    pyopenssl
    python-dateutil
    python-dotenv
+    python-gnupg
    python-ipware
    python-magic
-    python-gnupg
-    pytz
-    pyyaml
    pyzbar
    rapidfuzz
    redis
-    regex
-    reportlab
-    requests
    scikit-learn
-    scipy
    setproctitle
-    service-identity
-    sniffio
-    sqlparse
-    threadpoolctl
    tika-client
-    tornado
    tqdm
-    twisted
-    txaio
-    tzdata
-    tzlocal
-    urllib3
    uvicorn
-    uvloop
-    vine
    watchdog
-    watchfiles
-    wcwidth
-    webencodings
-    websockets
    whitenoise
    whoosh
-    zipp
-    zope-interface
    zxing-cpp
  ]
  ++ redis.optional-dependencies.hiredis
-  ++ twisted.optional-dependencies.tls
  ++ uvicorn.optional-dependencies.standard;

  postBuild = ''
@ -262,7 +193,6 @@ python.pkgs.buildPythonApplication rec {
    pytest-rerunfailures
    pytest-xdist
    pytestCheckHook
-    reportlab
  ];

  pytestFlagsArray = [
@ -280,7 +210,7 @@ python.pkgs.buildPythonApplication rec {

    # Disable unneeded code coverage test
    substituteInPlace src/setup.cfg \
-      --replace "--cov --cov-report=html --cov-report=xml" ""
+      --replace-fail "--cov --cov-report=html --cov-report=xml" ""
  '';

  disabledTests = [
--- a/pkgs/applications/radio/srsran/default.nix
+++ b/pkgs/applications/radio/srsran/default.nix
@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
    zeromq
  ];

+  cmakeFlags = [ "-DENABLE_WERROR=OFF" ];
+
  meta = with lib; {
    homepage = "https://www.srslte.com/";
    description = "Open-source 4G and 5G software radio suite.";
--- a/pkgs/applications/science/biology/sortmerna/default.nix
+++ b/pkgs/applications/science/biology/sortmerna/default.nix
@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
    substituteInPlace src/sortmerna/CMakeLists.txt \
      --replace "target_link_libraries(sortmerna" \
        "target_link_libraries(sortmerna Threads::Threads"
+
+    # Fix gcc-13 build by adding missing <cstdint> includes:
+    #   https://github.com/sortmerna/sortmerna/issues/412
+    sed -e '1i #include <cstdint>' -i include/kseq_load.hpp
  '';

  meta = with lib; {
--- a/pkgs/applications/science/machine-learning/starspace/default.nix
+++ b/pkgs/applications/science/machine-learning/starspace/default.nix
@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    # Does not build against gcc-13. No development activity upstream
+    # for past few years.
+    broken = true;
    description = "General-purpose neural model for efficient learning of entity embeddings";
    homepage = "https://ai.facebook.com/tools/starspace/";
    license = licenses.mit;
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@ -3,26 +3,27 @@
 , fetchFromGitHub
 , rustPlatform
 , Security
+, SystemConfiguration
 }:

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "1.4.0";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    hash = "sha256-OK2eoWlqlpf/X8EGMnWTv9Gs5FkYvW5rmQDB/Mkbp60=";
+    hash = "sha256-0ReMn37sYpS5uX9Nem7M9LthAvGNdJaAob+tEnjIrMw=";
  };

-  cargoHash = "sha256-gtkpZKOaG5p79uJ9cbbGdiOX57bDFTf2/Bd8+WToJrw=";
+  cargoHash = "sha256-xDIXXHoykEtRzWm5NDE1rcFgC4iFxhUPgwlvaoHmV6Y=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;

  buildInputs = lib.optionals stdenv.isDarwin [
-    Security
+    Security SystemConfiguration
  ];

  meta = with lib; {
--- a/pkgs/applications/version-management/git-credential-oauth/default.nix
+++ b/pkgs/applications/version-management/git-credential-oauth/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-credential-oauth";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "hickford";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Zxdd4JhSoaAFx8neZqdOZSZEOTtupZHnX+5ziYxbw6s=";
+    hash = "sha256-bqyoAAqli0L6Kf+W1sTh2vmmfaIj2OdpQyvQZnYOWWA=";
  };

  ldflags = [
--- a/pkgs/applications/version-management/git-ignore/default.nix
+++ b/pkgs/applications/version-management/git-ignore/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-ignore";
-  version = "1.3.1";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "sondr3";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-kfc4LIFjLMltCn3BPaEfxc/yOZxFjYioyobTQZN/RmY=";
+    hash = "sha256-OVKRNj3tRi/PGY1m4rdpmH87laYzTkCiwoBc3txVJ3U=";
  };

-  cargoHash = "sha256-HoW10XzWIjxsqoKVKQkMf5in7pOODGnUM0cRZP1OJpg=";
+  cargoHash = "sha256-dAQKL+sMThpTqBoN5MZvm8tQUJhaSH7lT8DwbjzFq40=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@ -3,13 +3,13 @@
 buildKodiAddon rec {
  pname = "youtube";
  namespace = "plugin.video.youtube";
-  version = "7.0.2.2";
+  version = "7.0.3";

  src = fetchFromGitHub {
    owner = "anxdpanic";
    repo = "plugin.video.youtube";
    rev = "v${version}";
-    hash = "sha256-BUeE/8oQYBiq4XgIp4nv0hjEQz3nnkDWCnAf4kpptwk=";
+    hash = "sha256-dD9jl/W8RDfYHv13TBniOeRyc4cocj8160BHWz3MKlE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/video/vokoscreen-ng/default.nix
+++ b/pkgs/applications/video/vokoscreen-ng/default.nix
@ -1,52 +1,46 @@
-{ lib
-, mkDerivation
-, fetchFromGitHub
-, pkg-config
-, qmake
-, qttools
-, gstreamer
-, libX11
-, pulseaudio
-, qtbase
-, qtmultimedia
-, qtx11extras
-
+{ fetchFromGitHub
+, gst_all_1
+, gst-plugins-bad
 , gst-plugins-base
 , gst-plugins-good
-, gst-plugins-bad
 , gst-plugins-ugly
-, wayland
+, gstreamer
+, lib
+, libX11
 , pipewire
-, wrapQtAppsHook
+, pkg-config
+, pulseaudio
+, qt6
+, stdenv
+, wayland
 }:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "vokoscreen-ng";
-  version = "3.8.0";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "vkohaupt";
    repo = "vokoscreenNG";
    rev = version;
-    sha256 = "sha256-4tQ/fLaAbjfc3mt2qJsW9scku/CGUs74SehDaZgLPj4=";
+    hash = "sha256-Y6+R18Gf3ShqhsmZ4Okx02fSOOyilS6iKU5FW9wpxvY=";
  };

  qmakeFlags = [ "src/vokoscreenNG.pro" ];

-  nativeBuildInputs = [ qttools pkg-config qmake wrapQtAppsHook ];
+  nativeBuildInputs = [ qt6.qttools pkg-config qt6.qmake qt6.wrapQtAppsHook ];
  buildInputs = [
-    gstreamer
+    gst_all_1.gstreamer
    libX11
    pulseaudio
-    qtbase
-    qtmultimedia
-    qtx11extras
+    qt6.qtbase
+    qt6.qtmultimedia
    wayland
    pipewire
-    gst-plugins-base
-    gst-plugins-good
-    gst-plugins-bad
-    gst-plugins-ugly
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
  ];

  postPatch = ''
@ -67,7 +61,7 @@ mkDerivation rec {
    description = "User friendly Open Source screencaster for Linux and Windows";
    license = licenses.gpl2Plus;
    homepage = "https://github.com/vkohaupt/vokoscreenNG";
-    maintainers = with maintainers; [ shamilton ];
+    maintainers = with maintainers; [ shamilton dietmarw ];
    platforms = platforms.linux;
    mainProgram = "vokoscreenNG";
  };
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -377,7 +377,7 @@ stdenv.mkDerivation {

      # this symlink points to the unwrapped gnat's output "out". It is used by
      # our custom gprconfig compiler description to find GNAT's ada runtime. See
-      # ../../development/tools/build-managers/gprbuild/{boot.nix, nixpkgs-gnat.xml}
+      # ../../development/ada-modules/gprbuild/{boot.nix, nixpkgs-gnat.xml}
      ln -sf ${cc} $out/nix-support/gprconfig-gnat-unwrapped
    ''

--- a/pkgs/by-name/ar/arcticons-sans/package.nix
+++ b/pkgs/by-name/ar/arcticons-sans/package.nix
@ -0,0 +1,29 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "arcticons-sans";
+  version = "0.580";
+
+  src = fetchzip {
+    hash = "sha256-BRyYHOuz7zxD1zD4L4DmI9dFhGePmGFDqYmS0DIbvi8=";
+    url = "https://github.com/arcticons-team/arcticons-font/archive/refs/tags/${finalAttrs.version}.zip";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Arcticons Sans";
+    homepage = "https://github.com/arcticons-team/arcticons-font";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ asininemonkey ];
+  };
+})
--- a/pkgs/by-name/bo/bonsai/package.nix
+++ b/pkgs/by-name/bo/bonsai/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bonsai";
-  version = "1.0.2";
+  version = "1.1.0";

  src = fetchFromSourcehut {
    owner = "~stacyharper";
    repo = "bonsai";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Yosf07KUOQv4O5111tLGgI270g0KVGwzdTPtPOsTcP8=";
+    hash = "sha256-Wsr76OQOIqRPCx/8GK9NovxxPZ3dEP8pSo8wgMK1Hfo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gh/gh-poi/package.nix
+++ b/pkgs/by-name/gh/gh-poi/package.nix
@ -0,0 +1,33 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "gh-poi";
+  version = "0.9.8";
+
+  src = fetchFromGitHub {
+    owner = "seachicken";
+    repo = "gh-poi";
+    rev = "v${version}";
+    hash = "sha256-QpUZxho9hzmgbCFgNxwwKi6hhfyqc4b/JYKH3rP4Eb8=";
+  };
+
+  ldflags = [ "-s" "-w" ];
+
+  vendorHash = "sha256-D/YZLwwGJWCekq9mpfCECzJyJ/xSlg7fC6leJh+e8i0=";
+
+  # Skip checks because some of test suites require fixture.
+  # See: https://github.com/seachicken/gh-poi/blob/v0.9.8/.github/workflows/contract-test.yml#L28-L29
+  doCheck = false;
+
+  meta = with lib; {
+    changelog = "https://github.com/seachicken/gh-poi/releases/tag/${src.rev}";
+    description = "GitHub CLI extension to safely clean up your local branches";
+    homepage = "https://github.com/seachicken/gh-poi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aspulse ];
+    mainProgram = "gh-poi";
+  };
+}
--- a/pkgs/by-name/he/helix-gpt/pin.json
+++ b/pkgs/by-name/he/helix-gpt/pin.json
@ -1,7 +1,7 @@
 {
-  "version": "0.27",
-  "srcHash": "sha256-sGkK3SaQmzprgTiABgKfRZ3pUNFZNrt/8aNANH1RES8=",
+  "version": "0.28",
+  "srcHash": "sha256-vOXY8B5CRCEQX/NnBVNwmyRKSeDSliurClRPiJIAD3Y=",
  "x86_64-linux": "sha256-h6wGkOfSbB8Rwm7eFvcowDdH1RdS6eFaxgf+SdYvYt8=",
-  "x86_64-darwin": "sha256-A8T1FNPS1CguSmRyGl+i0o/DGy+LyTnKYKdNc8kTKS8=",
-  "aarch64-darwin": "sha256-A8T1FNPS1CguSmRyGl+i0o/DGy+LyTnKYKdNc8kTKS8="
+  "x86_64-darwin": "sha256-lkURZs6nQpsZ7SGX+eLoBEXa9VdTQP795iHAGYyRaVs=",
+  "aarch64-darwin": "sha256-lkURZs6nQpsZ7SGX+eLoBEXa9VdTQP795iHAGYyRaVs="
 }
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-YxP8XmjYqxuTA2fIV1q7GBsrWPtLr02KkFl4UUNJ2p8=";
+    hash = "sha256-eH8BWTUTzmVTOnn5svSfk8hqf8CjIpQdxoknlkgjVDY=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@ -6,13 +6,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "oelint-adv";
-  version = "4.3.1";
+  version = "4.4.0";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "oelint_adv";
-    hash = "sha256-N8QNX6JuHVDKBLwGNwBROH8f+tcLrc1Mk21CiiOVHkI=";
+    hash = "sha256-Sg7qn/yZUJEJdMmaGm27kyL+fKkUsZo25eExZPOem40=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/ou/outfox/package.nix
+++ b/pkgs/by-name/ou/outfox/package.nix
@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, alsa-lib
+, freetype
+, libjack2
+, libglvnd
+, libpulseaudio
+, makeDesktopItem
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "outfox";
+  version = "0.5.0-pre042";
+
+  src = {
+    i686-linux = fetchurl {
+      url =  "https://github.com/TeamRizu/OutFox/releases/download/OF5.0.0-042/OutFox-alpha-0.5.0-pre042-Linux-14.04-32bit-i386-i386-legacy-date-20231227.tar.gz";
+      sha256 = "sha256-NFjNoqJ7Fq4A7Y0k6oQcWjykV+/b/MiRtJ1p6qlZdjs=";
+    };
+    x86_64-linux = fetchurl {
+      url = "https://github.com/TeamRizu/OutFox/releases/download/OF5.0.0-042/OutFox-alpha-0.5.0-pre042-Linux-22.04-amd64-current-date-20231224.tar.gz";
+      hash = "sha256-dW+g/JYav3rUuI+nHDi6rXu/O5KYiEdk/HH82jgOUnI=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/TeamRizu/OutFox/releases/download/OF5.0.0-042/OutFox-alpha-0.5.0-pre042-Raspberry-Pi-Linux-18.04-arm64-arm64v8-modern-date-20231225.tar.gz";
+      hash = "sha256-7Qrq6t8KmUSIK4Rskkxw5l4UZ2vsb9/orzPegHySaJ4=";
+    };
+    armv7l-linux = fetchurl {
+      url = "https://github.com/TeamRizu/OutFox/releases/download/OF5.0.0-042/OutFox-alpha-0.5.0-pre042-Raspberry-Pi-Linux-14.04-arm32-arm32v7-legacy-date-20231227.tar.gz";
+      hash = "sha256-PRp7kuqFBRy7nextTCB+/poc+A9AX2EiQphx6aUfT8E=";
+    };
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    alsa-lib
+    freetype
+    libjack2
+    libglvnd
+    libpulseaudio
+  ];
+
+  desktop = makeDesktopItem {
+    name = "project-outfox";
+    desktopName = "Project OutFox";
+    genericName = "Rhythm game engine";
+    exec = "OutFox";
+    tryExec = "OutFox";
+    categories = [ "Game" ];
+  };
+
+  patchPhase = ''
+    find ./Appearance -type f -executable -exec chmod -x {} \;
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/OutFox $out/share/applications
+    cp -r ./. $out/share/OutFox
+    ln -s ${desktop}/share/applications/project-outfox.desktop $out/share/applications/project-outfox.desktop
+    makeWrapper $out/share/OutFox/OutFox $out/bin/OutFox --argv0
+  '';
+
+  meta = with lib; {
+    description = "A rhythm game engine forked from StepMania";
+    homepage = "https://projectoutfox.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "armv7l-linux" ];
+    maintainers = with maintainers; [ maxwell-lt ];
+    mainProgram = "OutFox";
+  };
+}
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "unstable-2024-02-19";
+  version = "unstable-2024-02-23";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "d0bf509a04327bfe5a8542fdbcc71cf368bb9ac7";
-    hash = "sha256-era8iyKOk5JzemSWk20ojjtoRsjSA43uzQC1ZFXUkZc=";
+    rev = "ae616f4f6a70a2f497c2a9ce8c9c64b34238e553";
+    hash = "sha256-2Q7hfXf9nCrmHxJ0S8njF5zIgcGXaRPPVogtsPgLLsI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sr/srm-cuarzo/package.nix
+++ b/pkgs/by-name/sr/srm-cuarzo/package.nix
@ -14,9 +14,9 @@
 }:
 stdenv.mkDerivation (self: {
  pname = "srm-cuarzo";
-  version = "0.5.2-1";
+  version = "0.5.3-1";
  rev = "v${self.version}";
-  hash = "sha256-FMd1v0K+H7DlSD0osmWrnuSKqQZxw3RUZq8JwZFm/f4=";
+  hash = "sha256-KRp+rTpiUbOmUPE9vASwTF+c8TDveFnAEqptcGO5luc=";

  src = fetchFromGitHub {
    inherit (self) rev hash;
--- a/pkgs/by-name/ty/typos-lsp/package.nix
+++ b/pkgs/by-name/ty/typos-lsp/package.nix
@ -4,16 +4,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "typos-lsp";
-  version = "0.1.12";
+  version = "0.1.13";

  src = fetchFromGitHub {
    owner = "tekumara";
    repo = "typos-lsp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-LzemgHVCuLkLaJyyrJhIsOOn+OnYuiJsMSxITNz6R8g=";
+    hash = "sha256-2nNOUeuDDBi7Ak7ATKYyRqmGwebk0JqIdHN6GV+v+aA=";
  };

-  cargoHash = "sha256-LFRg/Y/nudrdPw/o3WUH6aM+ThE8N/HII5J0Ikid8GI=";
+  cargoHash = "sha256-hQoxaavR4cefmpr+znXOs1OFJJ83mGk4TidFf13l7Ho=";

  # fix for compilation on aarch64
  # see https://github.com/NixOS/nixpkgs/issues/145726
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@ -8,37 +8,42 @@
 , xorg
 , wayland
 , vulkan-headers
-, wineWowPackages
+, wine64Packages
 , fetchpatch
 }:
 let
  # wine-staging doesn't support overrideAttrs for now
-  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+  wine = wine64Packages.staging.overrideDerivation (oldAttrs: {
    patches =
-      (oldAttrs.patches or [ ])
+      (oldAttrs.patches or [])
      ++ [
        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
        # Here are the currently applied patches for Roblox to run under WINE:
        (fetchpatch {
-          name = "vinegar-wine-segrevert.patch";
-          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
-          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+          name = "vinegar-wine-segregrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/segregrevert.patch";
+          hash = "sha256-+3Nld81nG3GufI4jAF6yrWfkJmsSCOku39rx0Hov29c=";
+        })
+        (fetchpatch {
+          name = "vinegar-wine-mouselock.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/mouselock.patch";
+          hash = "sha256-0AGA4AQbxTL5BGVbm072moav7xVA3zpotYqM8pcEDa4=";
        })
      ];
  });
 in
 buildGoModule rec {
  pname = "vinegar";
-  version = "1.6.1";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "vinegarhq";
    repo = "vinegar";
    rev = "v${version}";
-    hash = "sha256-uRdWE5NwRVSuUZyU5B5u5DfJOxu/gUqwM682eORTDOs=";
+    hash = "sha256-aKL+4jw/uMbbvLRCBHstCTrcQ1PTYSCwMNgXTvSvMeY=";
  };

-  vendorHash = "sha256-Ex6PRd3rD2jbLXlY36koNvZF3P+gAZTE9hExIfOw9CE=";
+  vendorHash = "sha256-OaMfWecOPQh6quXjYkZLyBDHZ9TINSA7Ue/Y0sz5ZYY=";

  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wayland vulkan-headers wine ];
--- a/pkgs/development/libraries/ada/gnatcoll/bindings.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/bindings.nix
--- a/pkgs/development/libraries/ada/gnatcoll/core.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/core.nix
--- a/pkgs/development/libraries/ada/gnatcoll/db.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/db.nix
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@ -0,0 +1,96 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gnat
+, gnatcoll-core
+, gprbuild
+, python3
+, ocamlPackages
+, makeWrapper
+}:
+let
+  gnat_version = lib.versions.major gnat.version;
+
+  fetchSpark2014 = { rev, sha256 } : fetchFromGitHub {
+    owner = "AdaCore";
+    repo = "spark2014";
+    fetchSubmodules = true;
+    inherit rev sha256;
+  };
+
+  spark2014 = {
+    "12" = {
+      src = fetchSpark2014 {
+        rev = "ab34e07080a769b63beacc141707b5885c49d375"; # branch fsf-12
+        sha256 = "sha256-7pe3eWitpxmqzjW6qEIEuN0qr2IR+kJ7Ssc9pTBcCD8=";
+      };
+      commit_date = "2022-05-25";
+    };
+    "13" = {
+      src = fetchSpark2014 {
+        rev = "12db22e854defa9d1c993ef904af1e72330a68ca"; # branch fsf-13
+        sha256 = "sha256-mZWP9yF1O4knCiXx8CqolnS+93bM+hTQy40cd0HZmwI=";
+      };
+      commit_date = "2023-01-05";
+    };
+  };
+
+  thisSpark = spark2014.${gnat_version} or
+    (builtins.throw "GNATprove depend on a specific GNAT version and can't be built using GNAT ${gnat_version}.");
+
+in
+stdenv.mkDerivation rec {
+  pname = "gnatprove";
+  version = "fsf-${gnat_version}_${thisSpark.commit_date}";
+
+  src = thisSpark.src;
+
+  nativeBuildInputs = [
+    gnat
+    gprbuild
+    python3
+    ocamlPackages.ocaml
+    makeWrapper
+  ];
+
+  buildInputs = [
+    gnatcoll-core
+    ocamlPackages.camlzip
+    ocamlPackages.findlib
+    ocamlPackages.menhir
+    ocamlPackages.menhirLib
+    ocamlPackages.num
+    ocamlPackages.yojson
+    ocamlPackages.zarith
+  ];
+
+  propagatedBuildInputs = [
+    gprbuild
+  ];
+
+  postPatch = ''
+    # gnat2why/gnat_src points to the GNAT sources
+    tar xf ${gnat.cc.src} gcc-${gnat.cc.version}/gcc/ada
+    mv gcc-${gnat.cc.version}/gcc/ada gnat2why/gnat_src
+  '';
+
+  configurePhase = ''
+    make setup
+  '';
+
+  installPhase = ''
+    make install-all
+    cp -a ./install/. $out
+    mkdir $out/share/gpr
+    ln -s $out/lib/gnat/* $out/share/gpr/
+  '';
+
+  meta = with lib; {
+    description = "a software development technology specifically designed for engineering high-reliability applications";
+    homepage = "https://github.com/AdaCore/spark2014";
+    maintainers = [ maintainers.jiegec ];
+    license = licenses.gpl3;
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/development/tools/build-managers/gprbuild/boot.nix
+++ b/pkgs/development/tools/build-managers/gprbuild/boot.nix
--- a/pkgs/development/tools/build-managers/gprbuild/default.nix
+++ b/pkgs/development/tools/build-managers/gprbuild/default.nix
@ -54,7 +54,10 @@ stdenv.mkDerivation {
  # link gprconfig_kb db from gprbuild-boot into build dir,
  # the install process copies its contents to $out
  preInstall = ''
-    ln -sf ${gprbuild-boot}/share/gprconfig share/gprconfig
+    # Use PATH to discover spliced gprbuild-boot from buildPackages,
+    # since path interpolation would give us gprbuild-boot from pkgsHostTarget
+    gprbuild_boot="$(dirname "$(type -p gprbuild)")/.."
+    ln -sf "$gprbuild_boot/share/gprconfig" share/gprconfig
  '';

  # no need for the install script
--- a/pkgs/development/tools/build-managers/gprbuild/gpr-project-darwin-rpath-hook.sh
+++ b/pkgs/development/tools/build-managers/gprbuild/gpr-project-darwin-rpath-hook.sh
--- a/pkgs/development/tools/build-managers/gprbuild/gpr-project-path-hook.sh
+++ b/pkgs/development/tools/build-managers/gprbuild/gpr-project-path-hook.sh
--- a/pkgs/development/tools/build-managers/gprbuild/gprbuild-relocatable-build.patch
+++ b/pkgs/development/tools/build-managers/gprbuild/gprbuild-relocatable-build.patch
--- a/pkgs/development/tools/build-managers/gprbuild/nixpkgs-gnat.xml
+++ b/pkgs/development/tools/build-managers/gprbuild/nixpkgs-gnat.xml
--- a/pkgs/development/libraries/ada/xmlada/default.nix
+++ b/pkgs/development/libraries/ada/xmlada/default.nix
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl
 , coreutils, cctools
-, ncurses, libiconv, libX11, libuuid
+, ncurses, libiconv, libX11, libuuid, testers
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "chez-scheme";
-  version = "9.6.4";
+  version = "10.0.0";

  src = fetchurl {
    url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-9YJ2gvolnEeXX/4Hh4X7Vh5KXFT3ZDMe9mwyEyhDaF0=";
+    hash = "sha256-03GZASte0ZhcQGnWqH/xjl4fWi3yfkApkfr0XcTyIyw=";
  };

  nativeBuildInputs = lib.optional stdenv.isDarwin cctools;
@ -28,18 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
  ** NixOS or in any chroot build.
  */
  patchPhase = ''
-    substituteInPlace ./configure \
-      --replace "git submodule init && git submodule update || exit 1" "true"
-
-    substituteInPlace ./workarea \
-      --replace "/bin/ln" ln \
-      --replace "/bin/cp" cp
-
    substituteInPlace ./makefiles/installsh \
-      --replace "/usr/bin/true" "${coreutils}/bin/true"
+      --replace-warn "/usr/bin/true" "${coreutils}/bin/true"

    substituteInPlace zlib/configure \
-      --replace "/usr/bin/libtool" libtool
+      --replace-warn "/usr/bin/libtool" libtool
  '';

  /*
@ -52,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
  ** for.
  */
  configurePhase = ''
-    ./configure --threads --installprefix=$out --installman=$out/share/man
+    ./configure --as-is --threads --installprefix=$out --installman=$out/share/man
  '';

  /*
@ -64,12 +57,18 @@ stdenv.mkDerivation (finalAttrs: {

  setupHook = ./setup-hook.sh;

+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = {
    description  = "A powerful and incredibly fast R6RS Scheme compiler";
    homepage     = "https://cisco.github.io/ChezScheme/";
    license      = lib.licenses.asl20;
    maintainers  = with lib.maintainers; [ thoughtpolice ];
    platforms    = lib.platforms.unix;
-    badPlatforms = [ "aarch64-linux" "aarch64-darwin" ];
+    mainProgram  = "scheme";
  };
 })
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@ -65,6 +65,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

+  # ECL’s ‘make check’ only works after install, making it a de-facto
+  # installCheck.
+  doInstallCheck = true;
+  installCheckTarget = "check";
+
  postInstall = ''
    sed -e 's/@[-a-zA-Z_]*@//g' -i $out/bin/ecl-config
    wrapProgram "$out/bin/ecl" --prefix PATH ':' "${
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@ -26,4 +26,6 @@ stdenv.mkDerivation rec {
  postFixup = lib.optionalString (!stdenv.isAarch32 && stdenv.isLinux) ''
    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $out/share/sbcl/sbcl
  '';
+
+  meta.sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
 }
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, clisp, fetchurl, fetchpatch, writeText, zstd
+{ lib, stdenv, callPackage, clisp, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
 , threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
 , linkableRuntime ? stdenv.hostPlatform.isx86
 , disableImmobileSpace ? false
@ -8,8 +8,13 @@
 , purgeNixReferences ? false
 , coreCompression ? lib.versionAtLeast version "2.2.6"
 , markRegionGC ? lib.versionAtLeast version "2.4.0"
-, texinfo
 , version
+  # Set this to a lisp binary to use a custom bootstrap lisp compiler for
+  # SBCL. Leave as null to use the default. This is useful for local development
+  # of SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
+  # of course we can’t do that because SBCL hasn’t been built yet, so we use
+  # CLISP, but that’s much slower.
+, bootstrapLisp ? null
 }:

 let
@ -62,14 +67,16 @@ let
  sbclBootstrap = callPackage ./bootstrap.nix {
    cfg = bootstrapBinaries.${stdenv.hostPlatform.system};
  };
-  bootstrapLisp =
-    if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
+  bootstrapLisp' =
+    if bootstrapLisp != null
+    then bootstrapLisp
+    else if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
    then "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
    else "${clisp}/bin/clisp -E UTF-8 --silent -norc";

 in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: rec {
  pname = "sbcl";
  inherit version;

@ -78,48 +85,62 @@ stdenv.mkDerivation rec {
    inherit (versionMap.${version}) sha256;
  };

-  nativeBuildInputs = [ texinfo ];
+  nativeBuildInputs = [
+    texinfo
+  ] ++ lib.optionals self.doCheck (
+    [
+      which
+    ] ++ lib.optionals (builtins.elem stdenv.system strace.meta.platforms) [
+      strace
+    ]
+  );
  buildInputs = lib.optionals coreCompression [ zstd ];

-  patches = lib.optionals (version == "2.4.0") [
+  patches = [
+    ./search-for-binaries-in-PATH.patch
+  ] ++ lib.optionals (version == "2.4.0") [
    ./fix-2.4.0-aarch64-darwin.patch
  ];

-  postPatch = ''
-    echo '"${version}.nixos"' > version.lisp-expr
-
-    # SBCL checks whether files are up-to-date in many places..
-    # Unfortunately, same timestamp is not good enough
-    sed -e 's@> x y@>= x y@' -i contrib/sb-aclrepl/repl.lisp
-    #sed -e '/(date)/i((= date 2208988801) 2208988800)' -i contrib/asdf/asdf.lisp
-    sed -i src/cold/slam.lisp -e \
-      '/file-write-date input/a)'
-    sed -i src/cold/slam.lisp -e \
-      '/file-write-date output/i(or (and (= 2208988801 (file-write-date output)) (= 2208988801 (file-write-date input)))'
-    sed -i src/code/target-load.lisp -e \
-      '/date defaulted-fasl/a)'
-    sed -i src/code/target-load.lisp -e \
-      '/date defaulted-source/i(or (and (= 2208988801 (file-write-date defaulted-source-truename)) (= 2208988801 (file-write-date defaulted-fasl-truename)))'
-
-    # Fix the tests
-    sed -e '5,$d' -i contrib/sb-bsd-sockets/tests.lisp
-    sed -e '5,$d' -i contrib/sb-simple-streams/*test*.lisp
+  # I don’t know why these are failing (on ofBorg), and I’d rather just disable
+  # them and move forward with the succeeding tests than block testing
+  # altogether. One by one hopefully we can fix these (on ofBorg,
+  # upstream--somehow some way) in due time.
+  disabledTestFiles = lib.optionals (builtins.elem stdenv.hostPlatform.system [
+    "x86_64-linux"
+    "aarch64-linux"
+  ]) [
+    "foreign-stack-alignment.impure.lisp"
+    # Floating point tests are fragile
+    # https://sourceforge.net/p/sbcl/mailman/message/58728554/
+    "compiler.pure.lisp"
+    "float.pure.lisp"
+  ] ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+    # This is failing on aarch64-linux on ofBorg. Not on my local machine nor on
+    # a VM on my laptop. Not sure what’s wrong.
+    "traceroot.impure.lisp"
+  ];
+  postPatch = lib.optionalString (self.disabledTestFiles != [ ]) ''
+    (cd tests ; rm -f ${lib.concatStringsSep " " self.disabledTestFiles})
  ''
-  + (if purgeNixReferences
-    then
-      # This is the default location to look for the core; by default in $out/lib/sbcl
-      ''
-        sed 's@^\(#define SBCL_HOME\) .*$@\1 "/no-such-path"@' \
-          -i src/runtime/runtime.c
-      ''
-    else
-      # Fix software version retrieval
-      ''
-        sed -e "s@/bin/uname@$(command -v uname)@g" -i src/code/*-os.lisp \
-          src/code/run-program.lisp
-      ''
-    );
-
+  + lib.optionalString purgeNixReferences ''
+    # This is the default location to look for the core; by default in $out/lib/sbcl
+    sed 's@^\(#define SBCL_HOME\) .*$@\1 "/no-such-path"@' \
+        -i src/runtime/runtime.c
+  ''
+  + ''
+    (
+      shopt -s nullglob
+      # Tests need patching regardless of purging of paths from the final
+      # binary. There are some tricky files in nested directories which should
+      # definitely NOT be patched this way, hence just a single * (and no
+      # globstar).
+      substituteInPlace ${if purgeNixReferences then "tests" else "{tests,src/code}"}/*.{lisp,sh} \
+        --replace-quiet /usr/bin/env "${coreutils}/bin/env" \
+        --replace-quiet /bin/uname "${coreutils}/bin/uname" \
+        --replace-quiet /bin/sh "${stdenv.shell}"
+    )
+  '';

  preBuild = ''
    export INSTALL_ROOT=$out
@ -138,7 +159,16 @@ stdenv.mkDerivation rec {
    optional (!threadSupport) "sb-thread" ++
    optionals disableImmobileSpace [ "immobile-space" "immobile-code" "compact-instance-header" ];

-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (lib.versionOlder version "2.1.10") [
+  buildArgs = [
+    "--prefix=$out"
+    "--xc-host=${lib.escapeShellArg bootstrapLisp'}"
+  ] ++ builtins.map (x: "--with-${x}") self.enableFeatures
+  ++ builtins.map (x: "--without-${x}") self.disableFeatures
+  ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-darwin") [
+    "--arch=arm64"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (lib.versionOlder self.version "2.1.10") [
    # Workaround build failure on -fno-common toolchains like upstream
    # clang-13. Without the change build fails as:
    #   duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
@ -151,22 +181,32 @@ stdenv.mkDerivation rec {
  buildPhase = ''
    runHook preBuild

-    sh make.sh --prefix=$out --xc-host="${bootstrapLisp}" ${
-                  lib.concatStringsSep " "
-                    (builtins.map (x: "--with-${x}") enableFeatures ++
-                     builtins.map (x: "--without-${x}") disableFeatures)
-                } ${lib.optionalString (stdenv.hostPlatform.system == "aarch64-darwin") "--arch=arm64"}
+    sh make.sh ${lib.concatStringsSep " " self.buildArgs}
    (cd doc/manual ; make info)

    runHook postBuild
  '';

+  # Tests on ofBorg’s x86_64-darwin platforms are so unstable that a random one
+  # will fail every other run. There’s a deeper problem here; we might as well
+  # disable them entirely so at least the other platforms get to benefit from
+  # testing.
+  doCheck = stdenv.hostPlatform.system != "x86_64-darwin";
+
+  # From the INSTALL docs
+  checkPhase = ''
+    runHook preCheck
+
+    (cd tests && sh run-tests.sh)
+
+    runHook postCheck
+  '';
+
  installPhase = ''
    runHook preInstall

    INSTALL_ROOT=$out sh install.sh

-    runHook postInstall
  ''
  + lib.optionalString (!purgeNixReferences) ''
    cp -r src $out/lib/sbcl
@ -176,6 +216,8 @@ stdenv.mkDerivation rec {
       '(("SYS:SRC;**;*.*.*" #P"$out/lib/sbcl/src/**/*.*")
         ("SYS:CONTRIB;**;*.*.*" #P"$out/lib/sbcl/contrib/**/*.*")))
    EOF
+  '' + ''
+    runHook postInstall
  '';

  setupHook = lib.optional purgeNixReferences (writeText "setupHook.sh" ''
@ -186,7 +228,7 @@ stdenv.mkDerivation rec {
  '');

  meta = with lib; {
-    description = "Lisp compiler";
+    description = "Common Lisp compiler";
    homepage = "https://sbcl.org";
    license = licenses.publicDomain; # and FreeBSD
    maintainers = lib.teams.lisp.members;
@ -198,4 +240,4 @@ stdenv.mkDerivation rec {
      "aarch64-linux"
    ];
  };
-}
+})
--- a/Show More
+++ b/Show More