Merge master into staging-next

.git-blame-ignore-revs

@@ -102,3 +102,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 
 # systemd: break too long lines of Nix code
 67643f8ec84bef1482204709073e417c9f07eb87
+
+# {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
+802a1b4d3338f24cbc4efd704616654456d75a94

.github/workflows/check-nix-format.yml

@@ -0,0 +1,50 @@
+# This file was copied mostly from check-maintainers-sorted.yaml.
+# NOTE: Formatting with the RFC-style nixfmt command is not yet stable. See
+# https://github.com/NixOS/rfcs/pull/166.
+# Because of this, this action is not yet enabled for all files -- only for
+# those who have opted in.
+name: Check that Nix files are formatted
+
+on:
+  pull_request_target:
+permissions:
+  contents: read
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - name: Install nixfmt
+        run: nix-env -f default.nix -iAP nixfmt-rfc-style
+      - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
+        run: |
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
+            fi
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              echo "Error: nixfmt failed."
+              exit 1
+            fi
+          done

maintainers/maintainer-list.nix

@@ -256,6 +256,12 @@
     githubId = 381298;
     name = "9R";
   };
+  A1ca7raz = {
+    email = "aya@wtm.moe";
+    github = "A1ca7raz";
+    githubId = 7345998;
+    name = "A1ca7raz";
+  };
   a1russell = {
     email = "adamlr6+pub@gmail.com";
     github = "a1russell";
@@ -18858,6 +18864,15 @@
     githubId = 89950;
     name = "Stéphan Kochen";
   };
+  stephen-huan = {
+    name = "Stephen Huan";
+    email = "stephen.huan@cgdct.moe";
+    github = "stephen-huan";
+    githubId = 20411956;
+    keys = [{
+      fingerprint = "EA6E 2794 8C7D BF5D 0DF0  85A1 0FBC 2E3B A99D D60E";
+    }];
+  };
   stephenmw = {
     email = "stephen@q5comm.com";
     github = "stephenmw";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -72,6 +72,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [ownCloud Infinite Scale Stack](https://owncloud.com/infinite-scale-4-0/), a modern and scalable rewrite of ownCloud.
+
 - [Handheld Daemon](https://github.com/hhd-dev/hhd), support for gaming handhelds like the Legion Go, ROG Ally, and GPD Win. Available as [services.handheld-daemon](#opt-services.handheld-daemon.enable).
 
 - [Guix](https://guix.gnu.org), a functional package manager inspired by Nix. Available as [services.guix](#opt-services.guix.enable).

nixos/modules/module-list.nix

@@ -1362,6 +1362,7 @@
   ./services/web-apps/nexus.nix
   ./services/web-apps/nifi.nix
   ./services/web-apps/node-red.nix
+  ./services/web-apps/ocis.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/openvscode-server.nix
   ./services/web-apps/mobilizon.nix

nixos/modules/services/monitoring/prometheus/exporters.md

@@ -72,6 +72,7 @@ example:
       - `extraFlags`
       - `openFirewall`
       - `firewallFilter`
+      - `firewallRules`
       - `user`
       - `group`
   - As there is already a package available, the module can now be added. This

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -169,6 +169,17 @@ let
         is true. It is used as `ip46tables -I nixos-fw firewallFilter -j nixos-fw-accept`.
       '';
     };
+    firewallRules = mkOption {
+      type = types.nullOr types.lines;
+      default = null;
+      example = literalExpression ''
+        iifname "eth0" tcp dport ${toString port} counter accept
+      '';
+      description = lib.mdDoc ''
+        Specify rules for nftables to add to the input chain
+        when {option}`services.prometheus.exporters.${name}.openFirewall` is true.
+      '';
+    };
     user = mkOption {
       type = types.str;
       default = "${name}-exporter";
@@ -194,6 +205,7 @@ let
         } // extraOpts);
       } ({ config, ... }: mkIf config.openFirewall {
         firewallFilter = mkDefault "-p tcp -m tcp --dport ${toString config.port}";
+        firewallRules = mkDefault ''tcp dport ${toString config.port} accept comment "${name}-exporter"'';
       })];
       internal = true;
       default = {};
@@ -212,6 +224,7 @@ let
   mkExporterConf = { name, conf, serviceOpts }:
     let
       enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
+      nftables = config.networking.nftables.enable;
     in
     mkIf conf.enable {
       warnings = conf.warnings or [];
@@ -223,10 +236,11 @@ let
       users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
         "${name}-exporter" = {};
       });
-      networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
+      networking.firewall.extraCommands = mkIf (conf.openFirewall && !nftables) (concatStrings [
         "ip46tables -A nixos-fw ${conf.firewallFilter} "
         "-m comment --comment ${name}-exporter -j nixos-fw-accept"
       ]);
+      networking.firewall.extraInputRules = mkIf (conf.openFirewall && nftables) conf.firewallRules;
       systemd.services."prometheus-${name}-exporter" = mkMerge ([{
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];

nixos/modules/services/web-apps/ocis.md

@@ -0,0 +1,113 @@
+# ownCloud Infinite Scale {#module-services-ocis}
+
+[ownCloud Infinite Scale](https://owncloud.dev/ocis/) (oCIS) is an open-source,
+modern file-sync and sharing platform. It is a ground-up rewrite of the well-known PHP based ownCloud server.
+
+The server setup can be automated using
+[services.ocis](#opt-services.ocis.enable). The desktop client is packaged at
+`pkgs.owncloud-client`.
+
+## Basic usage {#module-services-ocis-basic-usage}
+
+oCIS is a golang application and does not require an HTTP server (such as nginx)
+in front of it, though you may optionally use one if you will.
+
+oCIS is configured using a combination of yaml and environment variables. It is
+recommended to familiarize yourself with upstream's available configuration
+options and deployment instructions:
+
+* [Getting Started](https://owncloud.dev/ocis/getting-started/)
+* [Configuration](https://owncloud.dev/ocis/config/)
+* [Basic Setup](https://owncloud.dev/ocis/deployment/basic-remote-setup/)
+
+A very basic configuration may look like this:
+```
+{ pkgs, ... }:
+{
+  services.ocis = {
+    enable = true;
+    configDir = "/etc/ocis/config";
+  };
+}
+```
+
+This will start the oCIS server and make it available at `https://localhost:9200`
+
+However to make this configuration work you will need generate a configuration.
+You can do this with:
+
+```console
+$ nix-shell -p ocis-bin
+$ mkdir scratch/
+$ cd scratch/
+$ ocis init --config-path . --admin-password "changeme"
+```
+
+You may need to pass `--insecure true` or provide the `OCIS_INSECURE = true;` to
+[`services.ocis.environment`][mod-envFile], if TLS certificates are generated
+and managed externally (e.g. if you are using oCIS behind reverse proxy).
+
+If you want to manage the config file in your nix configuration, then it is
+encouraged to use a secrets manager like sops-nix or agenix.
+
+Be careful not to write files containing secrets to the globally readable nix
+store.
+
+Please note that current NixOS module for oCIS is configured to run in `fullstack`
+mode, which starts all the services for owncloud on single instance. This will
+start multiple ocis services and listen on multiple other ports.
+
+Current known services and their ports are as below:
+
+| Service            | Group   |  Port |
+|--------------------|---------|-------|
+| gateway            | api     |  9142 |
+| sharing            | api     |  9150 |
+| app-registry       | api     |  9242 |
+| ocdav              | web     | 45023 |
+| auth-machine       | api     |  9166 |
+| storage-system     | api     |  9215 |
+| webdav             | web     |  9115 |
+| webfinger          | web     | 46871 |
+| storage-system     | web     |  9216 |
+| web                | web     |  9100 |
+| eventhistory       | api     | 33177 |
+| ocs                | web     |  9110 |
+| storage-publiclink | api     |  9178 |
+| settings           | web     |  9190 |
+| ocm                | api     |  9282 |
+| settings           | api     |  9191 |
+| ocm                | web     |  9280 |
+| app-provider       | api     |  9164 |
+| storage-users      | api     |  9157 |
+| auth-service       | api     |  9199 |
+| thumbnails         | web     |  9186 |
+| thumbnails         | api     |  9185 |
+| storage-shares     | api     |  9154 |
+| sse                | sse     | 46833 |
+| userlog            | userlog | 45363 |
+| search             | api     |  9220 |
+| proxy              | web     |  9200 |
+| idp                | web     |  9130 |
+| frontend           | web     |  9140 |
+| groups             | api     |  9160 |
+| graph              | graph   |  9120 |
+| users              | api     |  9144 |
+| auth-basic         | api     |  9146 |
+
+## Configuration via environment variables
+
+You can also eschew the config file entirely and pass everything to oCIS via
+environment variables. For this make use of
+[`services.ocis.environment`][mod-env] for non-sensitive
+values, and
+[`services.ocis.environmentFile`][mod-envFile] for
+sensitive values.
+
+Configuration in (`services.ocis.environment`)[mod-env] overrides those from
+[`services.ocis.environmentFile`][mod-envFile] and will have highest
+precedence
+
+
+[mod-env]: #opt-services.ocis.environment
+[mod-envFile]: #opt-services.ocis.environmentFile

nixos/modules/services/web-apps/ocis.nix

@@ -0,0 +1,201 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.services.ocis;
+  defaultUser = "ocis";
+  defaultGroup = defaultUser;
+in
+{
+  options = {
+    services.ocis = {
+      enable = lib.mkEnableOption "ownCloud Infinite Scale";
+
+      package = lib.mkPackageOption pkgs "ocis-bin" { };
+
+      configDir = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/var/lib/ocis/config";
+        description = lib.mdDoc ''
+          Path to directory containing oCIS config file.
+
+          Example config can be generated by `ocis init --config-path fileName --admin-password "adminPass"`.
+          Add `--insecure true` if SSL certificates are generated and managed externally (e.g. using oCIS behind reverse proxy).
+
+          Note: This directory must contain at least a `ocis.yaml`. Ensure
+          [user](#opt-services.ocis.user) has read/write access to it. In some
+          circumstances you may need to add additional oCIS configuration files (e.g.,
+          `proxy.yaml`) to this directory.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/ocis.env";
+        description = lib.mdDoc ''
+          An environment file as defined in {manpage}`systemd.exec(5)`.
+
+          Configuration provided in this file will override those from [configDir](#opt-services.ocis.configDir)/ocis.yaml.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = types.str;
+        default = defaultUser;
+        example = "yourUser";
+        description = lib.mdDoc ''
+          The user to run oCIS as.
+          By default, a user named `${defaultUser}` will be created whose home
+          directory is [stateDir](#opt-services.ocis.stateDir).
+        '';
+      };
+
+      group = lib.mkOption {
+        type = types.str;
+        default = defaultGroup;
+        example = "yourGroup";
+        description = lib.mdDoc ''
+          The group to run oCIS under.
+          By default, a group named `${defaultGroup}` will be created.
+        '';
+      };
+
+      address = lib.mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Web interface address.";
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = 9200;
+        description = "Web interface port.";
+      };
+
+      url = lib.mkOption {
+        type = types.str;
+        default = "https://localhost:9200";
+        example = "https://some-hostname-or-ip:9200";
+        description = "Web interface address.";
+      };
+
+      stateDir = lib.mkOption {
+        default = "/var/lib/ocis";
+        type = types.str;
+        description = "ownCloud data directory.";
+      };
+
+      environment = lib.mkOption {
+        type = types.attrsOf types.str;
+        default = { };
+        description = lib.mdDoc ''
+          Extra config options.
+
+          See [the documentation](https://doc.owncloud.com/ocis/next/deployment/services/services.html) for available options.
+          See [notes for environment variables](https://doc.owncloud.com/ocis/next/deployment/services/env-var-note.html) for more information.
+
+          Note that all the attributes here will be copied to /nix/store/ and will be world readable. Options like *_PASSWORD or *_SECRET should be part of     [environmentFile](#opt-services.ocis.environmentFile) instead, and are only provided here for illustrative purpose.
+
+          Configuration here will override those from [environmentFile](#opt-services.ocis.environmentFile) and will have highest precedence, at the cost of security. Do NOT put security sensitive stuff here.
+        '';
+        example = {
+          OCIS_INSECURE = "false";
+          OCIS_LOG_LEVEL = "error";
+          OCIS_JWT_SECRET = "super_secret";
+          OCIS_TRANSFER_SECRET = "foo";
+          OCIS_MACHINE_AUTH_API_KEY = "foo";
+          OCIS_SYSTEM_USER_ID = "123";
+          OCIS_MOUNT_ID = "123";
+          OCIS_STORAGE_USERS_MOUNT_ID = "123";
+          GATEWAY_STORAGE_USERS_MOUNT_ID = "123";
+          CS3_ALLOW_INSECURE = "true";
+          OCIS_INSECURE_BACKENDS = "true";
+          TLS_INSECURE = "true";
+          TLS_SKIP_VERIFY_CLIENT_CERT = "true";
+          WEBDAV_ALLOW_INSECURE = "true";
+          IDP_TLS = "false";
+          GRAPH_APPLICATION_ID = "1234";
+          IDM_IDPSVC_PASSWORD = "password";
+          IDM_REVASVC_PASSWORD = "password";
+          IDM_SVC_PASSWORD = "password";
+          IDP_ISS = "https://localhost:9200";
+          OCIS_LDAP_BIND_PASSWORD = "password";
+          OCIS_SERVICE_ACCOUNT_ID = "foo";
+          OCIS_SERVICE_ACCOUNT_SECRET = "foo";
+          OCIS_SYSTEM_USER_API_KEY = "foo";
+          STORAGE_USERS_MOUNT_ID = "123";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${defaultUser} = lib.mkIf (cfg.user == defaultUser) {
+      group = cfg.group;
+      home = cfg.stateDir;
+      isSystemUser = true;
+      createHome = true;
+      description = "ownCloud Infinite Scale daemon user";
+    };
+
+    users.groups = lib.mkIf (cfg.group == defaultGroup) { ${defaultGroup} = { }; };
+
+    systemd = {
+      services.ocis = {
+        description = "ownCloud Infinite Scale Stack";
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          PROXY_HTTP_ADDR = "${cfg.address}:${toString cfg.port}";
+          OCIS_URL = cfg.url;
+          OCIS_CONFIG_DIR = if (cfg.configDir == null) then "${cfg.stateDir}/config" else cfg.configDir;
+          OCIS_BASE_DATA_PATH = cfg.stateDir;
+        } // cfg.environment;
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${lib.getExe cfg.package} server";
+          WorkingDirectory = cfg.stateDir;
+          User = cfg.user;
+          Group = cfg.group;
+          Restart = "always";
+          EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+          ReadWritePaths = [ cfg.stateDir ];
+          ReadOnlyPaths = [ cfg.configDir ];
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectControlGroups = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectKernelLogs = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          LockPersonality = true;
+          SystemCallArchitectures = "native";
+        };
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    bhankas
+    danth
+    ramblurr
+  ];
+}

nixos/tests/all-tests.nix

@@ -648,6 +648,7 @@ in {
   nvmetcfg = handleTest ./nvmetcfg.nix {};
   nzbget = handleTest ./nzbget.nix {};
   nzbhydra2 = handleTest ./nzbhydra2.nix {};
+  ocis = handleTest ./ocis.nix {};
   oh-my-zsh = handleTest ./oh-my-zsh.nix {};
   ollama = handleTest ./ollama.nix {};
   ombi = handleTest ./ombi.nix {};

nixos/tests/ocis.nix

@@ -0,0 +1,217 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+
+  let
+    # this is a demo user created by IDM_CREATE_DEMO_USERS=true
+    demoUser = "einstein";
+    demoPassword = "relativity";
+
+    adminUser = "admin";
+    adminPassword = "hunter2";
+    testRunner =
+      pkgs.writers.writePython3Bin "test-runner"
+        {
+          libraries = [ pkgs.python3Packages.selenium ];
+          flakeIgnore = [ "E501" ];
+        }
+        ''
+          import sys
+          from selenium.webdriver.common.by import By
+          from selenium.webdriver import Firefox
+          from selenium.webdriver.firefox.options import Options
+          from selenium.webdriver.support.ui import WebDriverWait
+          from selenium.webdriver.support import expected_conditions as EC
+
+          options = Options()
+          options.add_argument('--headless')
+          driver = Firefox(options=options)
+
+          user = sys.argv[1]
+          password = sys.argv[2]
+          driver.implicitly_wait(20)
+          driver.get('https://localhost:9200/login')
+          wait = WebDriverWait(driver, 10)
+          wait.until(EC.title_contains("Sign in"))
+          driver.find_element(By.XPATH, '//*[@id="oc-login-username"]').send_keys(user)
+          driver.find_element(By.XPATH, '//*[@id="oc-login-password"]').send_keys(password)
+          driver.find_element(By.XPATH, '//*[@id="root"]//button').click()
+          wait.until(EC.title_contains("Personal"))
+        '';
+
+    # This was generated with `ocis init --config-path testconfig/ --admin-password "hunter2" --insecure true`.
+    testConfig = ''
+      token_manager:
+        jwt_secret: kaKYgfso*d9GA-yTM.&BTOUEuMz%Ai0H
+      machine_auth_api_key: sGWRG1JZ&qe&pe@N1HKK4#qH*B&@xLnO
+      system_user_api_key: h+m4aHPUtOtUJFKrc5B2=04C=7fDZaT-
+      transfer_secret: 4-R6AfUjQn0P&+h2+$skf0lJqmre$j=x
+      system_user_id: db180e0a-b38a-4edf-a4cd-a3d358248537
+      admin_user_id: ea623f50-742d-4fd0-95bb-c61767b070d4
+      graph:
+        application:
+          id: 11971eab-d560-4b95-a2d4-50726676bbd0
+        events:
+          tls_insecure: true
+        spaces:
+          insecure: true
+        identity:
+          ldap:
+            bind_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      idp:
+        ldap:
+          bind_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+      idm:
+        service_user_passwords:
+          admin_password: hunter2
+          idm_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+          reva_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+          idp_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+      proxy:
+        oidc:
+          insecure: true
+        insecure_backends: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      frontend:
+        app_handler:
+          insecure: true
+        archiver:
+          insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      auth_basic:
+        auth_providers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      auth_bearer:
+        auth_providers:
+          oidc:
+            insecure: true
+      users:
+        drivers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      groups:
+        drivers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      ocdav:
+        insecure: true
+      ocm:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      thumbnails:
+        thumbnail:
+          transfer_secret: 2%11!zAu*AYE&=d*8dfoZs8jK&5ZMm*%
+          webdav_allow_insecure: true
+          cs3_allow_insecure: true
+      search:
+        events:
+          tls_insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      audit:
+        events:
+          tls_insecure: true
+      settings:
+        service_account_ids:
+        - df39a290-3f3e-4e39-b67b-8b810ca2abac
+      sharing:
+        events:
+          tls_insecure: true
+      storage_users:
+        events:
+          tls_insecure: true
+        mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      notifications:
+        notifications:
+          events:
+            tls_insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      nats:
+        nats:
+          tls_skip_verify_client_cert: true
+      gateway:
+        storage_registry:
+          storage_users_mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+      userlog:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      auth_service:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      clientlog:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE'';
+  in
+
+  {
+    name = "ocis";
+
+    meta.maintainers = with lib.maintainers; [
+      bhankas
+      ramblurr
+    ];
+
+    nodes.machine =
+      { config, ... }:
+      {
+        virtualisation.memorySize = 2048;
+        environment.systemPackages = [
+          pkgs.firefox-unwrapped
+          pkgs.geckodriver
+          testRunner
+        ];
+
+        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+        environment.etc."ocis/ocis.env".text = ''
+          ADMIN_PASSWORD=${adminPassword}
+          IDM_CREATE_DEMO_USERS=true
+        '';
+
+        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+        environment.etc."ocis/config/ocis.yaml".text = testConfig;
+
+        services.ocis = {
+          enable = true;
+          configDir = "/etc/ocis/config";
+          environment = {
+            OCIS_INSECURE = "true";
+          };
+          environmentFile = "/etc/ocis/ocis.env";
+        };
+      };
+
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("ocis.service")
+      machine.wait_for_open_port(9200)
+      # wait for ocis to fully come up
+      machine.sleep(5)
+
+      with subtest("ocis bin works"):
+          machine.succeed("${lib.getExe pkgs.ocis-bin} version")
+
+      with subtest("use the web interface to log in with a demo user"):
+          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${demoUser} ${demoPassword}")
+
+      with subtest("use the web interface to log in with the provisioned admin user"):
+          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${adminUser} ${adminPassword}")
+    '';
+  }
+)

pkgs/applications/editors/nano/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, ncurses, texinfo, writeScript
-, common-updater-scripts, git, nix, nixfmt, coreutils, gnused, callPackage
+, common-updater-scripts, git, nix, nixfmt-classic, coreutils, gnused, callPackage
 , file ? null, gettext ? null, enableNls ? true, enableTiny ? false }:
 
 assert enableNls -> (gettext != null);
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
         lib.makeBinPath [
           common-updater-scripts
           git
-          nixfmt
+          nixfmt-classic
           nix
           coreutils
           gnused

pkgs/applications/networking/browsers/chromium/update.py

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p python3 nix nixfmt nix-prefetch-git
+#! nix-shell -i python -p python3 nix nixfmt-classic nix-prefetch-git
 
 """This script automatically updates chromium, google-chrome, chromedriver, and ungoogled-chromium
 via upstream-info.nix."""

pkgs/applications/networking/cluster/k3s/README.md

@@ -71,3 +71,44 @@ In order to resolve this issue, we propose backporting not just new patch releas
 
 In the above example, where NixOS 23.05 included k3s 1.26, and 23.11 included k3s 1.28, that means we would backport 1.27 to the NixOS 23.05 release, and backport all patches for 1.26 and 1.27.
 This would allow someone to upgrade between those NixOS releases in a supported configuration.
+
+
+## K3s upkeep for nixpkgs maintainers
+
+* A `nixos-stable` release triggers the need of re-setting K3s versions in `nixos-unstable` branch to a single K3s version. After every `nixos-stable` release, K3s maintainers should remove all K3s versions in `nixos-unstable` branch but the latest. While `nixos-stable` keeps the multiple K3s versions necessary for a smooth upgrade to `nixos-unstable`.
+
+* Whenever adding a new major/minor K3s version to nixpkgs:
+  - update `k3s` alias to the latest version.
+  - add a NixOS release note scheduling the removal of all K3s packages but the latest
+  - include migration information from both Kubernetes and K3s projects
+
+* For version patch upgrades, use the K3s update script.
+
+  To execute the update script, from nixpkgs git repository, run:
+
+  > ./pkgs/applications/networking/cluster/k3s/update-script.sh "29"
+
+  "29" being the target minor version to be updated.
+
+  On failure, the update script should be fixed. On failing to fix, open an issue reporting the update script breakage.
+
+  RyanTM bot can automatically do patch upgrades. Update logs are available at: https://r.ryantm.com/log/k3s_1_29/
+
+* When reviewing upgrades, check:
+
+  - At top-level, every K3s version should have the Go compiler pinned according to `go.mod` file.
+
+    Notice the update script does not automatically pin the Go version.
+
+  - K3s passthru.tests (Currently: single-node, multi-node, etcd) works for all architectures (linux-x86_64, aarch64-linux).
+
+    For GitHub CI, [OfBorg](https://github.com/NixOS/ofborg) can be used to test all platforms.
+
+    To test locally, at nixpkgs repository, run:
+    > nix build .#k3s_1_29.passthru.tests.{etcd,single-node,multi-node}
+
+    Replace "29" according to the version that you are testing.
+
+  - Read the nix build logs to check for anything unusual. (Obvious but underrated.)
+
+* Thank you for reading the documentation and your continued contribution.

pkgs/applications/networking/sync/backintime/common.nix

@@ -7,13 +7,13 @@ let
   apps = lib.makeBinPath [ openssh python' cron rsync sshfs-fuse encfs ];
 in stdenv.mkDerivation rec {
   pname = "backintime-common";
-  version = "1.3.3";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "bit-team";
     repo = "backintime";
     rev = "v${version}";
-    sha256 = "sha256-cKmzq155/dCl5wZA2SE3XjfCocHxTh4Wa2IdfzSfQHg=";
+    sha256 = "sha256-2q2Q4rnxXwVnfH1YEBwY35B2ctG9+qpOIAHqPOjjArg=";
   };
 
   nativeBuildInputs = [ makeWrapper gettext ];
@@ -21,6 +21,8 @@ in stdenv.mkDerivation rec {
 
   installFlags = [ "DEST=$(out)" ];
 
+  configureFlags = [ "--python=${lib.getExe python'}" ];
+
   preConfigure = ''
     cd common
     substituteInPlace configure \
@@ -41,7 +43,7 @@ in stdenv.mkDerivation rec {
     homepage = "https://github.com/bit-team/backintime";
     description = "Simple backup tool for Linux";
     license = lib.licenses.gpl2;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ stephen-huan ];
     platforms = lib.platforms.all;
     longDescription = ''
       Back In Time is a simple backup tool (on top of rsync) for Linux

pkgs/applications/networking/sync/backintime/qt.nix

@@ -11,11 +11,11 @@ mkDerivation {
 
   buildInputs = [ python' backintime-common ];
 
+  configureFlags = [ "--python=${lib.getExe python'}" ];
+
   preConfigure = ''
     cd qt
-    substituteInPlace configure \
+    substituteInPlace qttools_path.py \
-      --replace '"/../etc' '"/etc'
-    substituteInPlace qttools.py \
       --replace "__file__, os.pardir, os.pardir" '"${backintime-common}/${python'.sitePackages}/backintime"'
   '';
 
@@ -37,7 +37,6 @@ mkDerivation {
       --replace "/usr/bin/ionice" "${lib.getBin util-linux}/bin/ionice"
 
     substituteInPlace "$out/share/dbus-1/system-services/net.launchpad.backintime.serviceHelper.service" \
-      --replace "/usr/bin/python3" "${lib.getBin python'}/bin/python3" \
       --replace "/usr/share/backintime" "$out/share/backintime"
 
     substituteInPlace "$out/bin/backintime-qt_polkit" \

pkgs/applications/terminal-emulators/xterm/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, xorg, ncurses, freetype, fontconfig
 , pkg-config, makeWrapper, nixosTests, gitUpdater
-, nixfmt, nix, gnused, coreutils, enableDecLocator ? true }:
+, nix, gnused, coreutils, enableDecLocator ? true }:
 
 stdenv.mkDerivation rec {
   pname = "xterm";

pkgs/build-support/setup-hooks/audit-blas.sh

@@ -1,37 +0,0 @@
-# Ensure that we are always linking against “libblas.so.3” and
-# “liblapack.so.3”.
-
-auditBlas() {
-    local dir="$prefix"
-    [ -e "$dir" ] || return 0
-
-    local i
-    while IFS= read -r -d $'\0' i; do
-        if ! isELF "$i"; then continue; fi
-
-        if $OBJDUMP -p "$i" | grep 'NEEDED' | awk '{ print $2; }' | grep -q '\(libmkl_rt.so\|libopenblas.so.0\)'; then
-            echo "$i refers to a specific implementation of BLAS or LAPACK."
-            echo "This prevents users from switching BLAS/LAPACK implementations."
-            echo "Add \`blas' or \`lapack' to buildInputs instead of \`mkl' or \`openblas'."
-            exit 1
-        fi
-
-        (IFS=:
-         for dir in "$(patchelf --print-rpath "$i")"; do
-             if [ -f "$dir/libblas.so.3" ] || [ -f "$dir/libblas.so" ]; then
-                 if [ "$dir" != "@blas@/lib" ]; then
-                     echo "$dir is not allowed to contain a library named libblas.so.3"
-                     exit 1
-                 fi
-             fi
-             if [ -f "$dir/liblapack.so.3" ] || [ -f "$dir/liblapack.so" ]; then
-                 if [ "$dir" != "@lapack@/lib" ]; then
-                     echo "$dir is not allowed to contain a library named liblapack.so.3"
-                     exit 1
-                 fi
-             fi
-         done)
-    done < <(find "$dir" -type f -print0)
-}
-
-fixupOutputHooks+=(auditBlas)

pkgs/by-name/da/daytona-bin/package.nix

@@ -0,0 +1,55 @@
+{ stdenvNoCC
+, lib
+, fetchurl
+, makeWrapper
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "daytona-bin";
+  version = "0.9.0";
+
+  src =
+    let
+      urls = {
+        "x86_64-linux" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-linux-amd64";
+          hash = "sha256-vJVGFmaGP9oCCzdvhuAPsoTaxzGvdDKDupMYuepRUCA=";
+        };
+        "x86_64-darwin" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-darwin-amd64";
+          hash = "sha256-R63AQVt5DudzJub+TYcJiHkBGVeOhjvgJZgnqvJb8t0=";
+        };
+        "aarch64-linux" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-linux-arm64";
+          hash = "sha256-98OEhJ1gakPTVO73M9WW0QuSDgR42gNjoioEkkNbf6w=";
+        };
+        "aarch64-darwin" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-darwin-arm64";
+          hash = "sha256-YmLyioFueEfi/2Q+JwINDhkwo617/KUZrimz9CibdA8=";
+        };
+      };
+    in
+    fetchurl urls."${stdenvNoCC.hostPlatform.system}";
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 $src $out/bin/daytona
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/daytonaio/daytona/releases/tag/v${finalAttrs.version}";
+    description = "The Open Source Dev Environment Manager";
+    homepage = "https://github.com/daytonaio/daytona";
+    license = lib.licenses.asl20;
+    mainProgram = "daytona";
+    maintainers = with lib.maintainers; [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/ja/jan/package.nix

@@ -5,10 +5,10 @@
 
 let
   pname = "jan";
-  version = "0.4.9";
+  version = "0.4.10";
   src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-6XnDrr+AkZH69zXf0OKdi8R6LoRWWMZNqWilZhLGynk=";
+    hash = "sha256-IOqwz3pJ4veuxQwfkMs0Zf8dNQcQ0HwnR3SPBVvQXtU=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/ks/kshutdown/package.nix

@@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, fetchurl
+, extra-cmake-modules
+, unzip
+, libsForQt5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kshutdown";
+  version = "5.91-beta";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/kshutdown/KShutdown/${finalAttrs.version}/kshutdown-source-${finalAttrs.version}.zip";
+    hash = "sha256-gWXpVBhoZ57kaQV1C+xCBYc2gZjzJfFViD/SI9D+BRc=";
+    name = "kshutdown-source-${finalAttrs.version}.zip";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules unzip libsForQt5.wrapQtAppsHook ];
+
+  buildInputs = with libsForQt5; [ qtbase kxmlgui knotifyconfig kidletime ];
+
+  meta = with lib; {
+    homepage = "https://kshutdown.sourceforge.io/";
+    description = "A graphical shutdown utility for Linux and Windows";
+    mainProgram = "kshutdown";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers ; [ eymeric ];
+    platforms = platforms.linux;
+  };
+})
+

pkgs/by-name/le/lexical/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  beamPackages,
+  fetchFromGitHub,
+  writeScript,
+  elixir,
+}:
+
+beamPackages.mixRelease rec {
+  pname = "lexical";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "lexical-lsp";
+    repo = "lexical";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HWqwJ7PAz80bm6YeDG84hLWPE11n06K98GOyeDQWZWU=";
+  };
+
+  mixFodDeps = beamPackages.fetchMixDeps {
+    inherit pname version src;
+
+    hash = "sha256-G0mT+rvXZWLJIMfrhxq3TXt26wDImayu44wGEYJ+3CE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mix do compile --no-deps-check, package --path "$out"
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    substituteInPlace "$out/bin/start_lexical.sh" --replace 'elixir_command=' 'elixir_command="${elixir}/bin/"'
+    mv "$out/bin" "$out/libexec"
+    makeWrapper "$out/libexec/start_lexical.sh" "$out/bin/lexical" --set RELEASE_COOKIE lexical
+  '';
+
+  meta = with lib; {
+    description = "Lexical is a next-generation elixir language server";
+    homepage = "https://github.com/lexical-lsp/lexical";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "lexical";
+    platforms = beamPackages.erlang.meta.platforms;
+  };
+}

pkgs/by-name/ma/maa-cli/package.nix

@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A simple CLI for MAA by Rust";
     homepage = "https://github.com/MaaAssistantArknights/maa-cli";
-    license = licenses.agpl3Plus;
+    license = licenses.agpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ Cryolitia ];
     mainProgram = "maa";

pkgs/by-name/oc/ocis-bin/package.nix

@@ -0,0 +1,56 @@
+{
+  fetchurl,
+  lib,
+  stdenv,
+  autoPatchelfHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ocis-bin";
+  version = "5.0.0";
+  system =
+    if stdenv.isLinux && stdenv.isx86_64 then
+      "linux-amd64"
+    else if stdenv.isLinux && stdenv.isAarch64 then
+      "linux-arm64"
+    else
+      "";
+
+  src = fetchurl {
+    url = "https://github.com/owncloud/ocis/releases/download/v${finalAttrs.version}/ocis-${finalAttrs.version}-${finalAttrs.system}";
+
+    hash =
+      if stdenv.isLinux && stdenv.isAarch64 then
+        "sha256-xRgDNwmRovXbyGQ5sTUw5srsXMBDYyBFMpB9MoXoo+w="
+      else if stdenv.isLinux && stdenv.isx86_64 then
+        "sha256-0lgDIHldW67OwinfYPATXkWUZVnR3PoXC4XLM1KkKmY="
+      else
+        builtins.throw "Unsupported platform, please contact Nixpkgs maintainers for ocis package";
+  };
+  dontUnpack = true;
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/bin/ocis
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "ownCloud Infinite Scale Stack ";
+    homepage = "https://owncloud.dev/ocis/";
+    changelog = "https://github.com/owncloud/ocis/releases/tag/v${version}";
+    # oCIS is licensed under non-free EULA which can be found here :
+    # https://github.com/owncloud/ocis/releases/download/v5.0.0/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf
+    license = licenses.unfree;
+    maintainers = with maintainers; [
+      ramblurr
+      bhankas
+      danth
+      ramblurr
+    ];
+    sourceProvenance = [ sourceTypes.binaryNativeCode ];
+    mainProgram = "ocis";
+  };
+})

pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix

@@ -5,17 +5,24 @@
 , wrapQtAppsHook
 , kwin
 , lib
+, useQt5 ? false
 }:
+let
+  latestVersion = "2.0.1";
+  latestSha256 = "sha256-4KvOhQSYmHV/5TxyeK4f1uUmHK5uR5xXC2MfPTM96SM=";
 
+  qt5Version = "1.3.3";
+  qt5Sha256 = "sha256-zTUTsSzy4p0Y7RPOidCtxTjjyvPRyWSQCxA5sUzXcLc=";
+in
 stdenv.mkDerivation rec {
   pname = "sierra-breeze-enhanced";
-  version = "1.3.3";
+  version = if useQt5 then qt5Version else latestVersion;
 
   src = fetchFromGitHub {
     owner = "kupiqu";
     repo = "SierraBreezeEnhanced";
     rev = "V${version}";
-    sha256 = "sha256-zTUTsSzy4p0Y7RPOidCtxTjjyvPRyWSQCxA5sUzXcLc=";
+    sha256 = if useQt5 then qt5Sha256 else latestSha256;
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
@@ -32,6 +39,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/kupiqu/SierraBreezeEnhanced";
     changelog = "https://github.com/kupiqu/SierraBreezeEnhanced/releases/tag/V${version}";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ A1ca7raz ];
   };
 }

pkgs/development/compilers/scala/2.x.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils, writeScript
-, common-updater-scripts, git, gnused, nix, nixfmt, majorVersion }:
+, common-updater-scripts, git, gnused, nix, nixfmt-classic, majorVersion }:
 
 let
   repo = "git@github.com:scala/scala.git";
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
           git
           gnused
           nix
-          nixfmt
+          nixfmt-classic
         ]
       }
       versionSelect='v${lib.versions.major version}.${lib.versions.minor version}.*'

pkgs/development/coq-modules/gappalib/default.nix

@@ -6,7 +6,8 @@ mkCoqDerivation {
   owner = "gappa";
   domain = "gitlab.inria.fr";
   inherit version;
-  defaultVersion = if lib.versions.range "8.8" "8.18" coq.coq-version then "1.5.4" else null;
+  defaultVersion = if lib.versions.range "8.8" "8.19" coq.coq-version then "1.5.5" else null;
+  release."1.5.5".sha256 = "sha256-qxi2Kg3N3o6+ncq7aPNEg98dBmQC5WCa86zROPJSDdo=";
   release."1.5.4".sha256 = "sha256-9PlkXqCu4rbFD7qnMF1GSpPCVmwJ3r593RfAvkJbbdA=";
   release."1.5.3".sha256 = "sha256-SuMopX5sm4jh2uBuE7zr6vhWhHYZYnab+epjqYJqg+s=";
   release."1.5.2".sha256 = "sha256-A021Bhqz5r2CZBayfjIiWrCIfUlejcQAfbTmOaf6QTM=";

pkgs/development/coq-modules/interval/default.nix

@@ -7,6 +7,7 @@ mkCoqDerivation rec {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.19"; out = "4.10.0"; }
     { case = range "8.12" "8.18"; out = "4.9.0"; }
     { case = range "8.12" "8.17"; out = "4.8.0"; }
     { case = range "8.12" "8.16"; out = "4.6.0"; }
@@ -15,6 +16,7 @@ mkCoqDerivation rec {
     { case = range "8.7" "8.11"; out = "3.4.2"; }
     { case = range "8.5" "8.6";  out = "3.3.0"; }
   ] null;
+  release."4.10.0".sha256 = "sha256-MZJVoKGLXjDabdv9BuUSK1L9z1cubzC9cqVuWevKIXQ=";
   release."4.9.0".sha256 = "sha256-+5NppyQahcc1idGu/U3B+EIWuZz2L3/oY7dIJR6pitE=";
   release."4.8.1".sha256 = "sha256-gknZ3bA90YY2AvwfFsP5iMhohwkQ8G96mH+4st2RPDc=";
   release."4.8.0".sha256 = "sha256-YPQ1tuUgGixAVdQUJ9a3lZUNVgm2pKK3RKvl3m+/8rY=";

pkgs/development/coq-modules/vcfloat/default.nix

@@ -1,6 +1,6 @@
 { lib, mkCoqDerivation, coq, interval, compcert, flocq, bignums, version ? null }:
 
-let self = with lib; mkCoqDerivation {
+let self = mkCoqDerivation {
   pname = "vcfloat";
   owner = "VeriNum";
   inherit version;
@@ -8,9 +8,11 @@ let self = with lib; mkCoqDerivation {
   postPatch = ''
     coq_makefile -o Makefile -f _CoqProject *.v
   '';
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.16" "8.17"; out = "2.1.1"; }
+    { case = isEq "8.19"; out = "2.2"; }
+    { case = range "8.16" "8.18"; out = "2.1.1"; }
   ] null;
+  release."2.2".sha256 = "sha256-PyMm84ZYh+dOnl8Kk2wlYsQ+S/d1Hsp6uv2twTedEPg=";
   release."2.1.1".sha256 = "sha256-bd/XSQhyFUAnSm2bhZEZBWB6l4/Ptlm9JrWu6w9BOpw=";
   releaseRev = v: "v${v}";
 
@@ -18,8 +20,8 @@ let self = with lib; mkCoqDerivation {
 
   meta = {
     description = "A tool for Coq proofs about floating-point round-off error";
-    maintainers = with maintainers; [ quinn-dougherty ];
+    maintainers = with lib.maintainers; [ quinn-dougherty ];
-    license = licenses.lgpl3Plus;
+    license = lib.licenses.lgpl3Plus;
   };
 };
 in self

pkgs/development/cuda-modules/backend-stdenv.nix

@@ -21,6 +21,6 @@ let
   assertCondition = true;
 in
 
-  /* TODO: Consider testing whether we in fact use the newer libstdc++ */
+# TODO: Consider testing whether we in fact use the newer libstdc++
 
 lib.extendDerivation assertCondition passthruExtra cudaStdenv

pkgs/development/cuda-modules/cuda-library-samples/extension.nix

@@ -1,4 +1,4 @@
-{hostPlatform, lib}:
+{ hostPlatform, lib }:
 let
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
@@ -8,7 +8,7 @@ let
   extension =
     final: _:
     lib.attrsets.optionalAttrs platformIsSupported {
-      cuda-library-samples = final.callPackage ./generic.nix {};
+      cuda-library-samples = final.callPackage ./generic.nix { };
     };
 in
 extension

pkgs/development/cuda-modules/cuda-library-samples/generic.nix

@@ -22,7 +22,7 @@ let
       cmake
       addOpenGLRunpath
     ];
-    buildInputs = [cudatoolkit];
+    buildInputs = [ cudatoolkit ];
     postFixup = ''
       for exe in $out/bin/*; do
         addOpenGLRunpath $exe
@@ -36,7 +36,7 @@ let
         cuSPARSE, cuSOLVER, cuFFT, cuRAND, NPP and nvJPEG.
       '';
       license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [obsidian-systems-maintenance] ++ lib.teams.cuda.members;
+      maintainers = with lib.maintainers; [ obsidian-systems-maintenance ] ++ lib.teams.cuda.members;
     };
   };
 in
@@ -69,9 +69,9 @@ in
 
       src = "${src}/cuTENSOR";
 
-      buildInputs = [cutensor];
+      buildInputs = [ cutensor ];
 
-      cmakeFlags = ["-DCUTENSOR_EXAMPLE_BINARY_INSTALL_DIR=${builtins.placeholder "out"}/bin"];
+      cmakeFlags = [ "-DCUTENSOR_EXAMPLE_BINARY_INSTALL_DIR=${builtins.placeholder "out"}/bin" ];
 
       # CUTENSOR_ROOT is double escaped
       postPatch = ''

pkgs/development/cuda-modules/cuda-samples/generic.nix

@@ -15,65 +15,63 @@
 let
   inherit (lib) lists strings;
 in
-backendStdenv.mkDerivation (
+backendStdenv.mkDerivation (finalAttrs: {
-  finalAttrs: {
+  strictDeps = true;
-    strictDeps = true;
 
-    pname = "cuda-samples";
+  pname = "cuda-samples";
-    version = cudaVersion;
+  version = cudaVersion;
 
-    src = fetchFromGitHub {
+  src = fetchFromGitHub {
-      owner = "NVIDIA";
+    owner = "NVIDIA";
-      repo = finalAttrs.pname;
+    repo = finalAttrs.pname;
-      rev = "v${finalAttrs.version}";
+    rev = "v${finalAttrs.version}";
-      inherit hash;
+    inherit hash;
-    };
+  };
 
-    nativeBuildInputs =
+  nativeBuildInputs =
-      [
+    [
-        autoAddDriverRunpath
+      autoAddDriverRunpath
-        pkg-config
+      pkg-config
-      ]
+    ]
-      # CMake has to run as a native, build-time dependency for libNVVM samples.
+    # CMake has to run as a native, build-time dependency for libNVVM samples.
-      # However, it's not the primary build tool -- that's still make.
+    # However, it's not the primary build tool -- that's still make.
-      # As such, we disable CMake's build system.
+    # As such, we disable CMake's build system.
-      ++ lists.optionals (strings.versionAtLeast finalAttrs.version "12.2") [cmake];
+    ++ lists.optionals (strings.versionAtLeast finalAttrs.version "12.2") [ cmake ];
 
-    dontUseCmakeConfigure = true;
+  dontUseCmakeConfigure = true;
 
-    buildInputs = [
+  buildInputs = [
-      cudatoolkit
+    cudatoolkit
-      freeimage
+    freeimage
-      glfw3
+    glfw3
-    ];
+  ];
 
-    # See https://github.com/NVIDIA/cuda-samples/issues/75.
+  # See https://github.com/NVIDIA/cuda-samples/issues/75.
-    patches = lib.optionals (finalAttrs.version == "11.3") [
+  patches = lib.optionals (finalAttrs.version == "11.3") [
-      (fetchpatch {
+    (fetchpatch {
-        url = "https://github.com/NVIDIA/cuda-samples/commit/5c3ec60faeb7a3c4ad9372c99114d7bb922fda8d.patch";
+      url = "https://github.com/NVIDIA/cuda-samples/commit/5c3ec60faeb7a3c4ad9372c99114d7bb922fda8d.patch";
-        hash = "sha256-0XxdmNK9MPpHwv8+qECJTvXGlFxc+fIbta4ynYprfpU=";
+      hash = "sha256-0XxdmNK9MPpHwv8+qECJTvXGlFxc+fIbta4ynYprfpU=";
-      })
+    })
-    ];
+  ];
 
-    enableParallelBuilding = true;
+  enableParallelBuilding = true;
 
-    preConfigure = ''
+  preConfigure = ''
-      export CUDA_PATH=${cudatoolkit}
+    export CUDA_PATH=${cudatoolkit}
-    '';
+  '';
 
-    installPhase = ''
+  installPhase = ''
-      runHook preInstall
+    runHook preInstall
 
-      install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
+    install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
 
-      runHook postInstall
+    runHook postInstall
-    '';
+  '';
 
-    meta = {
+  meta = {
-      description = "Samples for CUDA Developers which demonstrates features in CUDA Toolkit";
+    description = "Samples for CUDA Developers which demonstrates features in CUDA Toolkit";
-      # CUDA itself is proprietary, but these sample apps are not.
+    # CUDA itself is proprietary, but these sample apps are not.
-      license = lib.licenses.bsd3;
+    license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [obsidian-systems-maintenance] ++ lib.teams.cuda.members;
+    maintainers = with lib.maintainers; [ obsidian-systems-maintenance ] ++ lib.teams.cuda.members;
-    };
+  };
-  }
+})
-)

pkgs/development/cuda-modules/cuda/extension.nix

@@ -1,4 +1,4 @@
-{cudaVersion, lib}:
+{ cudaVersion, lib }:
 let
   inherit (lib) attrsets modules trivial;
   redistName = "cuda";
@@ -63,23 +63,21 @@ let
             featureRelease
             ;
         }).overrideAttrs
-          (
+          (prevAttrs: {
-            prevAttrs: {
+            # Add the package-specific license.
-              # Add the package-specific license.
+            meta = prevAttrs.meta // {
-              meta = prevAttrs.meta // {
+              license =
-                license =
+                let
-                  let
+                  licensePath =
-                    licensePath =
+                    if redistribRelease.license_path != null then
-                      if redistribRelease.license_path != null then
+                      redistribRelease.license_path
-                        redistribRelease.license_path
+                    else
-                      else
+                      "${pname}/LICENSE.txt";
-                        "${pname}/LICENSE.txt";
+                  url = "https://developer.download.nvidia.com/compute/cuda/redist/${licensePath}";
-                    url = "https://developer.download.nvidia.com/compute/cuda/redist/${licensePath}";
+                in
-                  in
+                lib.licenses.nvidiaCudaRedist // { inherit url; };
-                  lib.licenses.nvidiaCudaRedist // {inherit url;};
+            };
-              };
+          });
-            }
-          );
     in
     drv;
 

pkgs/development/cuda-modules/cuda/overrides.nix

@@ -1,4 +1,8 @@
-{cudaVersion, lib, addDriverRunpath}:
+{
+  cudaVersion,
+  lib,
+  addDriverRunpath,
+}:
 let
   inherit (lib) attrsets lists strings;
   # cudaVersionOlder : Version -> Boolean
@@ -8,96 +12,92 @@ let
 
   addBuildInputs =
     drv: buildInputs:
-    drv.overrideAttrs (prevAttrs: {buildInputs = prevAttrs.buildInputs ++ buildInputs;});
+    drv.overrideAttrs (prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ buildInputs;
+    });
 in
 # NOTE: Filter out attributes that are not present in the previous version of
 # the package set. This is necessary to prevent the appearance of attributes
 # like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
 final: prev:
 attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
-  libcufile = prev.libcufile.overrideAttrs (
+  libcufile = prev.libcufile.overrideAttrs (prevAttrs: {
-    prevAttrs: {
+    buildInputs = prevAttrs.buildInputs ++ [
-      buildInputs = prevAttrs.buildInputs ++ [
+      final.libcublas.lib
-        final.libcublas.lib
+      final.pkgs.numactl
-        final.pkgs.numactl
+      final.pkgs.rdma-core
-        final.pkgs.rdma-core
+    ];
-      ];
+    # Before 11.7 libcufile depends on itself for some reason.
-      # Before 11.7 libcufile depends on itself for some reason.
+    autoPatchelfIgnoreMissingDeps =
-      autoPatchelfIgnoreMissingDeps =
+      prevAttrs.autoPatchelfIgnoreMissingDeps
-        prevAttrs.autoPatchelfIgnoreMissingDeps
+      ++ lists.optionals (cudaVersionOlder "11.7") [ "libcufile.so.0" ];
-        ++ lists.optionals (cudaVersionOlder "11.7") [ "libcufile.so.0" ];
+  });
-    }
-  );
 
   libcusolver = addBuildInputs prev.libcusolver (
     # Always depends on this
-    [final.libcublas.lib]
+    [ final.libcublas.lib ]
     # Dependency from 12.0 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.0") [final.libnvjitlink.lib]
+    ++ lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
     # Dependency from 12.1 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.1") [final.libcusparse.lib]
+    ++ lists.optionals (cudaVersionAtLeast "12.1") [ final.libcusparse.lib ]
   );
 
   libcusparse = addBuildInputs prev.libcusparse (
-    lists.optionals (cudaVersionAtLeast "12.0") [final.libnvjitlink.lib]
+    lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
   );
 
-  cuda_cudart = prev.cuda_cudart.overrideAttrs (
+  cuda_cudart = prev.cuda_cudart.overrideAttrs (prevAttrs: {
-    prevAttrs: {
+    # Remove once cuda-find-redist-features has a special case for libcuda
-      # Remove once cuda-find-redist-features has a special case for libcuda
+    outputs =
-      outputs =
+      prevAttrs.outputs
-        prevAttrs.outputs
+      ++ lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
-        ++ lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
 
-      allowFHSReferences = false;
+    allowFHSReferences = false;
 
-      # The libcuda stub's pkg-config doesn't follow the general pattern:
+    # The libcuda stub's pkg-config doesn't follow the general pattern:
-      postPatch =
+    postPatch =
-        prevAttrs.postPatch or ""
+      prevAttrs.postPatch or ""
-        + ''
+      + ''
-          while IFS= read -r -d $'\0' path ; do
+        while IFS= read -r -d $'\0' path ; do
-            sed -i \
+          sed -i \
-              -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
+            -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
-              -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
+            -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
-              "$path"
+            "$path"
-          done < <(find -iname 'cuda-*.pc' -print0)
+        done < <(find -iname 'cuda-*.pc' -print0)
-        ''
+      ''
-        + ''
+      + ''
-          # Namelink may not be enough, add a soname.
+        # Namelink may not be enough, add a soname.
-          # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/25536
+        # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/25536
-          if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]] ; then
+        if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]] ; then
-            ln -s libcuda.so lib/stubs/libcuda.so.1
+          ln -s libcuda.so lib/stubs/libcuda.so.1
-          fi
+        fi
-        '';
+      '';
 
-      postFixup =
+    postFixup =
-        prevAttrs.postFixup or ""
+      prevAttrs.postFixup or ""
-        + ''
+      + ''
-          moveToOutput lib/stubs "$stubs"
+        moveToOutput lib/stubs "$stubs"
-          ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
+        ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
-          ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
+        ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
-        '';
+      '';
-    }
+  });
-  );
 
-  cuda_compat = prev.cuda_compat.overrideAttrs (
+  cuda_compat = prev.cuda_compat.overrideAttrs (prevAttrs: {
-    prevAttrs: {
+    autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
-      autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
+      "libnvrm_gpu.so"
-        "libnvrm_gpu.so"
+      "libnvrm_mem.so"
-        "libnvrm_mem.so"
+      "libnvdla_runtime.so"
-        "libnvdla_runtime.so"
+    ];
-      ];
+    # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
-      # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
+    badPlatformsConditions = prevAttrs.badPlatformsConditions // {
-      badPlatformsConditions = prevAttrs.badPlatformsConditions // {
+      "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
-        "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
+        !final.flags.isJetsonBuild;
-          !final.flags.isJetsonBuild;
+    };
-      };
+  });
-    }
-  );
 
   cuda_gdb = addBuildInputs prev.cuda_gdb (
     # x86_64 only needs gmp from 12.0 and on
-    lists.optionals (cudaVersionAtLeast "12.0") [final.pkgs.gmp]
+    lists.optionals (cudaVersionAtLeast "12.0") [ final.pkgs.gmp ]
   );
 
   cuda_nvcc = prev.cuda_nvcc.overrideAttrs (
@@ -176,9 +176,9 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
     }
   );
 
-  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (
+  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (prevAttrs: {
-    prevAttrs: {buildInputs = prevAttrs.buildInputs ++ [final.cuda_cupti.lib];}
+    buildInputs = prevAttrs.buildInputs ++ [ final.cuda_cupti.lib ];
-  );
+  });
 
   cuda_demo_suite = addBuildInputs prev.cuda_demo_suite [
     final.pkgs.freeglut
@@ -189,26 +189,24 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
     final.libcurand.lib
   ];
 
-  nsight_compute = prev.nsight_compute.overrideAttrs (
+  nsight_compute = prev.nsight_compute.overrideAttrs (prevAttrs: {
-    prevAttrs: {
+    nativeBuildInputs =
-      nativeBuildInputs =
+      prevAttrs.nativeBuildInputs
-        prevAttrs.nativeBuildInputs
+      ++ (
-        ++ (
+        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
+          [ final.pkgs.qt5.wrapQtAppsHook ]
-            [final.pkgs.qt5.wrapQtAppsHook]
+        else
-          else
+          [ final.pkgs.qt6.wrapQtAppsHook ]
-            [final.pkgs.qt6.wrapQtAppsHook]
+      );
-        );
+    buildInputs =
-      buildInputs =
+      prevAttrs.buildInputs
-        prevAttrs.buildInputs
+      ++ (
-        ++ (
+        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
+          [ final.pkgs.qt5.qtwebview ]
-            [final.pkgs.qt5.qtwebview]
+        else
-          else
+          [ final.pkgs.qt6.qtwebview ]
-            [final.pkgs.qt6.qtwebview]
+      );
-        );
+  });
-    }
-  );
 
   nsight_systems = prev.nsight_systems.overrideAttrs (
     prevAttrs:

pkgs/development/cuda-modules/cudatoolkit/default.nix

@@ -1,6 +1,6 @@
 {
   cudaVersion,
-  runPatches ? [],
+  runPatches ? [ ],
   autoPatchelfHook,
   autoAddDriverRunpath,
   addOpenGLRunpath,
@@ -61,7 +61,7 @@ backendStdenv.mkDerivation rec {
   dontPatchELF = true;
   dontStrip = true;
 
-  src = fetchurl {inherit (release) url sha256;};
+  src = fetchurl { inherit (release) url sha256; };
 
   outputs = [
     "out"
@@ -79,9 +79,9 @@ backendStdenv.mkDerivation rec {
       autoAddDriverRunpath
       markForCudatoolkitRootHook
     ]
-    ++ lib.optionals (lib.versionOlder version "11") [libsForQt5.wrapQtAppsHook]
+    ++ lib.optionals (lib.versionOlder version "11") [ libsForQt5.wrapQtAppsHook ]
-    ++ lib.optionals (lib.versionAtLeast version "11.8") [qt6Packages.wrapQtAppsHook];
+    ++ lib.optionals (lib.versionAtLeast version "11.8") [ qt6Packages.wrapQtAppsHook ];
-  propagatedBuildInputs = [setupCudaHook];
+  propagatedBuildInputs = [ setupCudaHook ];
   buildInputs =
     lib.optionals (lib.versionOlder version "11") [
       libsForQt5.qt5.qtwebengine
@@ -130,7 +130,7 @@ backendStdenv.mkDerivation rec {
       (lib.getLib libtiff)
       qt6Packages.qtwayland
       rdma-core
-      (ucx.override {enableCuda = false;}) # Avoid infinite recursion
+      (ucx.override { enableCuda = false; }) # Avoid infinite recursion
       xorg.libxshmfence
       xorg.libxkbfile
     ]
@@ -144,17 +144,15 @@ backendStdenv.mkDerivation rec {
         gst_all_1.gstreamer
         gst_all_1.gst-plugins-base
       ])
-      ++ (
+      ++ (with qt6; [
-        with qt6; [
+        qtmultimedia
-          qtmultimedia
+        qttools
-          qttools
+        qtpositioning
-          qtpositioning
+        qtscxml
-          qtscxml
+        qtsvg
-          qtsvg
+        qtwebchannel
-          qtwebchannel
+        qtwebengine
-          qtwebengine
+      ])
-        ]
-      )
     ));
 
   # Prepended to runpaths by autoPatchelf.
@@ -170,26 +168,28 @@ backendStdenv.mkDerivation rec {
     "${placeholder "out"}/nvvm/lib64"
   ];
 
-  autoPatchelfIgnoreMissingDeps = [
+  autoPatchelfIgnoreMissingDeps =
-    # This is the hardware-dependent userspace driver that comes from
+    [
-    # nvidia_x11 package. It must be deployed at runtime in
+      # This is the hardware-dependent userspace driver that comes from
-    # /run/opengl-driver/lib or pointed at by LD_LIBRARY_PATH variable, rather
+      # nvidia_x11 package. It must be deployed at runtime in
-    # than pinned in runpath
+      # /run/opengl-driver/lib or pointed at by LD_LIBRARY_PATH variable, rather
-    "libcuda.so.1"
+      # than pinned in runpath
+      "libcuda.so.1"
 
-    # The krb5 expression ships libcom_err.so.3 but cudatoolkit asks for the
+      # The krb5 expression ships libcom_err.so.3 but cudatoolkit asks for the
-    # older
+      # older
-    # This dependency is asked for by target-linux-x64/CollectX/RedHat/x86_64/libssl.so.10
+      # This dependency is asked for by target-linux-x64/CollectX/RedHat/x86_64/libssl.so.10
-    # - do we even want to use nvidia-shipped libssl?
+      # - do we even want to use nvidia-shipped libssl?
-    "libcom_err.so.2"
+      "libcom_err.so.2"
-  ] ++ lib.optionals (lib.versionOlder version "10.1") [
+    ]
-    # For Cuda 10.0, nVidia also shipped a jre implementation which needed
+    ++ lib.optionals (lib.versionOlder version "10.1") [
-    # two old versions of ffmpeg which are not available in nixpkgs
+      # For Cuda 10.0, nVidia also shipped a jre implementation which needed
-    "libavcodec.so.54"
+      # two old versions of ffmpeg which are not available in nixpkgs
-    "libavcodec.so.53"
+      "libavcodec.so.54"
-    "libavformat.so.54"
+      "libavcodec.so.53"
-    "libavformat.so.53"
+      "libavformat.so.54"
-  ];
+      "libavformat.so.53"
+    ];
 
   preFixup =
     if (lib.versionAtLeast version "10.1" && lib.versionOlder version "11") then
@@ -282,7 +282,14 @@ backendStdenv.mkDerivation rec {
               for qtlib in $out/host-linux-x64/Plugins/*/libq*.so; do
                 qtdir=$(basename $(dirname $qtlib))
                 filename=$(basename $qtlib)
-                for qtpkgdir in ${lib.concatMapStringsSep " " (x: qt6Packages.${x}) ["qtbase" "qtimageformats" "qtsvg" "qtwayland"]}; do
+                for qtpkgdir in ${
+                  lib.concatMapStringsSep " " (x: qt6Packages.${x}) [
+                    "qtbase"
+                    "qtimageformats"
+                    "qtsvg"
+                    "qtwayland"
+                  ]
+                }; do
                   if [ -e $qtpkgdir/lib/qt-6/plugins/$qtdir/$filename ]; then
                     ln -snf $qtpkgdir/lib/qt-6/plugins/$qtdir/$filename $qtlib
                   fi
@@ -303,8 +310,9 @@ backendStdenv.mkDerivation rec {
       ''}
 
       # Remove some cruft.
-      ${lib.optionalString ((lib.versionAtLeast version "7.0") && (lib.versionOlder version "10.1"))
+      ${lib.optionalString (
-        "rm $out/bin/uninstall*"}
+        (lib.versionAtLeast version "7.0") && (lib.versionOlder version "10.1")
+      ) "rm $out/bin/uninstall*"}
 
       # Fixup path to samples (needed for cuda 6.5 or else nsight will not find them)
       if [ -d "$out"/cuda-samples ]; then
@@ -360,19 +368,18 @@ backendStdenv.mkDerivation rec {
       wrapProgram "$out/bin/$b" \
         --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
     done
-    ${
+    ${lib.optionalString (lib.versionAtLeast version "12")
-      lib.optionalString (lib.versionAtLeast version "12")
+      # Check we don't have any lurking vendored qt libraries that weren't
-        # Check we don't have any lurking vendored qt libraries that weren't
+      # replaced during installPhase
-        # replaced during installPhase
+      ''
-        ''
+        qtlibfiles=$(find $out -name "libq*.so" -type f)
-          qtlibfiles=$(find $out -name "libq*.so" -type f)
+        if [ ! -z "$qtlibfiles" ]; then
-          if [ ! -z "$qtlibfiles" ]; then
+          echo "Found unexpected vendored Qt library files in $out" >&2
-            echo "Found unexpected vendored Qt library files in $out" >&2
+          echo $qtlibfiles >&2
-            echo $qtlibfiles >&2
+          echo "These should be replaced with symlinks in installPhase" >&2
-            echo "These should be replaced with symlinks in installPhase" >&2
+          exit 1
-            exit 1
+        fi
-          fi
+      ''
-        ''
     }
   '';
 
@@ -405,7 +412,7 @@ backendStdenv.mkDerivation rec {
   meta = with lib; {
     description = "A compiler for NVIDIA GPUs, math libraries, and tools";
     homepage = "https://developer.nvidia.com/cuda-toolkit";
-    platforms = ["x86_64-linux"];
+    platforms = [ "x86_64-linux" ];
     license = licenses.nvidiaCuda;
     maintainers = teams.cuda.members;
   };

pkgs/development/cuda-modules/cudnn/fixup.nix

@@ -17,7 +17,7 @@ let
     ;
 in
 finalAttrs: prevAttrs: {
-  src = fetchurl {inherit (package) url hash;};
+  src = fetchurl { inherit (package) url hash; };
 
   # Useful for inspecting why something went wrong.
   brokenConditions =
@@ -34,9 +34,9 @@ finalAttrs: prevAttrs: {
 
   buildInputs =
     prevAttrs.buildInputs
-    ++ [zlib]
+    ++ [ zlib ]
-    ++ lists.optionals finalAttrs.passthru.useCudatoolkitRunfile [final.cudatoolkit]
+    ++ lists.optionals finalAttrs.passthru.useCudatoolkitRunfile [ final.cudatoolkit ]
-    ++ lists.optionals (!finalAttrs.passthru.useCudatoolkitRunfile) [final.libcublas.lib];
+    ++ lists.optionals (!finalAttrs.passthru.useCudatoolkitRunfile) [ final.libcublas.lib ];
 
   # Tell autoPatchelf about runtime dependencies.
   # NOTE: Versions from CUDNN releases have four components.
@@ -51,13 +51,11 @@ finalAttrs: prevAttrs: {
     homepage = "https://developer.nvidia.com/cudnn";
     maintainers =
       prevAttrs.meta.maintainers
-      ++ (
+      ++ (with maintainers; [
-        with maintainers; [
+        mdaiter
-          mdaiter
+        samuela
-          samuela
+        connorbaker
-          connorbaker
+      ]);
-        ]
-      );
     license = {
       shortName = "cuDNN EULA";
       fullName = "NVIDIA cuDNN Software License Agreement (EULA)";

pkgs/development/cuda-modules/cudnn/releases.nix

@@ -13,7 +13,7 @@
       }
     ];
     # powerpc
-    linux-ppc64le = [];
+    linux-ppc64le = [ ];
     # server-grade arm
     linux-sbsa = [
       {

pkgs/development/cuda-modules/cutensor/extension.nix

@@ -65,12 +65,10 @@ let
       # Un-nest the manifests attribute set.
       releaseGrabber = evaluatedModules: evaluatedModules.config.cutensor.manifests;
     in
-    lists.map
+    lists.map (trivial.flip trivial.pipe [
-      (trivial.flip trivial.pipe [
+      configEvaluator
-        configEvaluator
+      releaseGrabber
-        releaseGrabber
+    ]) cutensorVersions;
-      ])
-      cutensorVersions;
 
   # Our cudaVersion tells us which version of CUDA we're building against.
   # The subdirectories in lib/ tell us which versions of CUDA are supported.
@@ -96,15 +94,11 @@ let
   redistArch = flags.getRedistArch hostPlatform.system;
   # platformIsSupported :: Manifests -> Boolean
   platformIsSupported =
-    {feature, ...}:
+    { feature, ... }:
-    (attrsets.attrByPath
+    (attrsets.attrByPath [
-      [
+      pname
-        pname
+      redistArch
-        redistArch
+    ] null feature) != null;
-      ]
-      null
-      feature
-    ) != null;
 
   # TODO(@connorbaker): With an auxilliary file keeping track of the CUDA versions each release supports,
   # we could filter out releases that don't support our CUDA version.
@@ -116,41 +110,39 @@ let
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
   # computeName :: RedistribRelease -> String
-  computeName = {version, ...}: mkVersionedPackageName redistName version;
+  computeName = { version, ... }: mkVersionedPackageName redistName version;
 in
 final: _:
 let
   # buildCutensorPackage :: Manifests -> AttrSet Derivation
   buildCutensorPackage =
-    {redistrib, feature}:
+    { redistrib, feature }:
     let
       drv = final.callPackage ../generic-builders/manifest.nix {
         inherit pname redistName libPath;
         redistribRelease = redistrib.${pname};
         featureRelease = feature.${pname};
       };
-      fixedDrv = drv.overrideAttrs (
+      fixedDrv = drv.overrideAttrs (prevAttrs: {
-        prevAttrs: {
+        buildInputs =
-          buildInputs =
+          prevAttrs.buildInputs
-            prevAttrs.buildInputs
+          ++ lists.optionals (strings.versionOlder cudaVersion "11.4") [ final.cudatoolkit ]
-            ++ lists.optionals (strings.versionOlder cudaVersion "11.4") [final.cudatoolkit]
+          ++ lists.optionals (strings.versionAtLeast cudaVersion "11.4") (
-            ++ lists.optionals (strings.versionAtLeast cudaVersion "11.4") (
+            [ final.libcublas.lib ]
-              [final.libcublas.lib]
+            # For some reason, the 1.4.x release of cuTENSOR requires the cudart library.
-              # For some reason, the 1.4.x release of cuTENSOR requires the cudart library.
+            ++ lists.optionals (strings.hasPrefix "1.4" redistrib.${pname}.version) [ final.cuda_cudart.lib ]
-              ++ lists.optionals (strings.hasPrefix "1.4" redistrib.${pname}.version) [final.cuda_cudart.lib]
+          );
-            );
+        meta = prevAttrs.meta // {
-          meta = prevAttrs.meta // {
+          description = "cuTENSOR: A High-Performance CUDA Library For Tensor Primitives";
-            description = "cuTENSOR: A High-Performance CUDA Library For Tensor Primitives";
+          homepage = "https://developer.nvidia.com/cutensor";
-            homepage = "https://developer.nvidia.com/cutensor";
+          maintainers = prevAttrs.meta.maintainers ++ [ lib.maintainers.obsidian-systems-maintenance ];
-            maintainers = prevAttrs.meta.maintainers ++ [lib.maintainers.obsidian-systems-maintenance];
+          license = lib.licenses.unfreeRedistributable // {
-            license = lib.licenses.unfreeRedistributable // {
+            shortName = "cuTENSOR EULA";
-              shortName = "cuTENSOR EULA";
+            name = "cuTENSOR SUPPLEMENT TO SOFTWARE LICENSE AGREEMENT FOR NVIDIA SOFTWARE DEVELOPMENT KITS";
-              name = "cuTENSOR SUPPLEMENT TO SOFTWARE LICENSE AGREEMENT FOR NVIDIA SOFTWARE DEVELOPMENT KITS";
+            url = "https://docs.nvidia.com/cuda/cutensor/license.html";
-              url = "https://docs.nvidia.com/cuda/cutensor/license.html";
-            };
           };
-        }
+        };
-      );
+      });
     in
     attrsets.nameValuePair (computeName redistrib.${pname}) fixedDrv;
 
@@ -158,7 +150,7 @@ let
     let
       nameOfNewest = computeName (lists.last supportedManifests).redistrib.${pname};
       drvs = builtins.listToAttrs (lists.map buildCutensorPackage supportedManifests);
-      containsDefault = attrsets.optionalAttrs (drvs != {}) {cutensor = drvs.${nameOfNewest};};
+      containsDefault = attrsets.optionalAttrs (drvs != { }) { cutensor = drvs.${nameOfNewest}; };
     in
     drvs // containsDefault;
 in

pkgs/development/cuda-modules/flags.nix

@@ -3,7 +3,7 @@
 #   - See the documentation in ./gpus.nix.
 {
   config,
-  cudaCapabilities ? (config.cudaCapabilities or []),
+  cudaCapabilities ? (config.cudaCapabilities or [ ]),
   cudaForwardCompat ? (config.cudaForwardCompat or true),
   lib,
   cudaVersion,
@@ -77,9 +77,9 @@ let
   # cudaArchNameToVersions :: AttrSet String (List String)
   # Maps the name of a GPU architecture to different versions of that architecture.
   # For example, "Ampere" maps to [ "8.0" "8.6" "8.7" ].
-  cudaArchNameToVersions =
+  cudaArchNameToVersions = lists.groupBy' (versions: gpu: versions ++ [ gpu.computeCapability ]) [ ] (
-    lists.groupBy' (versions: gpu: versions ++ [gpu.computeCapability]) [] (gpu: gpu.archName)
+    gpu: gpu.archName
-      supportedGpus;
+  ) supportedGpus;
 
   # cudaComputeCapabilityToName :: AttrSet String String
   # Maps the version of a GPU architecture to the name of that architecture.
@@ -108,7 +108,7 @@ let
   jetsonTargets = lists.intersectLists jetsonComputeCapabilities cudaCapabilities;
 
   # dropDot :: String -> String
-  dropDot = ver: builtins.replaceStrings ["."] [""] ver;
+  dropDot = ver: builtins.replaceStrings [ "." ] [ "" ] ver;
 
   # archMapper :: String -> List String -> List String
   # Maps a feature across a list of architecture versions to produce a list of architectures.
@@ -135,25 +135,29 @@ let
   # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
   # systems gracefully.
   # getRedistArch :: String -> String
-  getRedistArch = nixSystem: attrsets.attrByPath [ nixSystem ] "unsupported" {
+  getRedistArch =
-    aarch64-linux = if jetsonTargets != [] then "linux-aarch64" else "linux-sbsa";
+    nixSystem:
-    x86_64-linux = "linux-x86_64";
+    attrsets.attrByPath [ nixSystem ] "unsupported" {
-    ppc64le-linux = "linux-ppc64le";
+      aarch64-linux = if jetsonTargets != [ ] then "linux-aarch64" else "linux-sbsa";
-    x86_64-windows = "windows-x86_64";
+      x86_64-linux = "linux-x86_64";
-  };
+      ppc64le-linux = "linux-ppc64le";
+      x86_64-windows = "windows-x86_64";
+    };
 
   # Maps NVIDIA redist arch to Nix system.
   # NOTE: This function *will* be called by unsupported systems because `cudaPackages` is part of
   # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
   # systems gracefully.
   # getNixSystem :: String -> String
-  getNixSystem = redistArch: attrsets.attrByPath [ redistArch ] "unsupported-${redistArch}" {
+  getNixSystem =
-    linux-sbsa = "aarch64-linux";
+    redistArch:
-    linux-aarch64 = "aarch64-linux";
+    attrsets.attrByPath [ redistArch ] "unsupported-${redistArch}" {
-    linux-x86_64 = "x86_64-linux";
+      linux-sbsa = "aarch64-linux";
-    linux-ppc64le = "ppc64le-linux";
+      linux-aarch64 = "aarch64-linux";
-    windows-x86_64 = "x86_64-windows";
+      linux-x86_64 = "x86_64-linux";
-  };
+      linux-ppc64le = "ppc64le-linux";
+      windows-x86_64 = "x86_64-windows";
+    };
 
   formatCapabilities =
     {
@@ -194,7 +198,7 @@ let
       gencode =
         let
           base = gencodeMapper "sm" cudaCapabilities;
-          forward = gencodeMapper "compute" [(lists.last cudaCapabilities)];
+          forward = gencodeMapper "compute" [ (lists.last cudaCapabilities) ];
         in
         base ++ lib.optionals enableForwardCompat forward;
 
@@ -209,150 +213,151 @@ let
       # isJetsonBuild :: Boolean
       isJetsonBuild =
         let
-          requestedJetsonDevices =
+          requestedJetsonDevices = lists.filter (
-            lists.filter (cap: cudaComputeCapabilityToIsJetson.${cap} or false)
+            cap: cudaComputeCapabilityToIsJetson.${cap} or false
-              cudaCapabilities;
+          ) cudaCapabilities;
-          requestedNonJetsonDevices =
+          requestedNonJetsonDevices = lists.filter (
-            lists.filter (cap: !(builtins.elem cap requestedJetsonDevices))
+            cap: !(builtins.elem cap requestedJetsonDevices)
-              cudaCapabilities;
+          ) cudaCapabilities;
-          jetsonBuildSufficientCondition = requestedJetsonDevices != [];
+          jetsonBuildSufficientCondition = requestedJetsonDevices != [ ];
-          jetsonBuildNecessaryCondition = requestedNonJetsonDevices == [] && hostPlatform.isAarch64;
+          jetsonBuildNecessaryCondition = requestedNonJetsonDevices == [ ] && hostPlatform.isAarch64;
         in
-        trivial.throwIf (jetsonBuildSufficientCondition && !jetsonBuildNecessaryCondition)
+        trivial.throwIf (jetsonBuildSufficientCondition && !jetsonBuildNecessaryCondition) ''
-          ''
+          Jetson devices cannot be targeted with non-Jetson devices. Additionally, they require hostPlatform to be aarch64.
-            Jetson devices cannot be targeted with non-Jetson devices. Additionally, they require hostPlatform to be aarch64.
+          You requested ${builtins.toJSON cudaCapabilities} for host platform ${hostPlatform.system}.
-            You requested ${builtins.toJSON cudaCapabilities} for host platform ${hostPlatform.system}.
+          Requested Jetson devices: ${builtins.toJSON requestedJetsonDevices}.
-            Requested Jetson devices: ${builtins.toJSON requestedJetsonDevices}.
+          Requested non-Jetson devices: ${builtins.toJSON requestedNonJetsonDevices}.
-            Requested non-Jetson devices: ${builtins.toJSON requestedNonJetsonDevices}.
+          Exactly one of the following must be true:
-            Exactly one of the following must be true:
+          - All CUDA capabilities belong to Jetson devices and hostPlatform is aarch64.
-            - All CUDA capabilities belong to Jetson devices and hostPlatform is aarch64.
+          - No CUDA capabilities belong to Jetson devices.
-            - No CUDA capabilities belong to Jetson devices.
+          See ${./gpus.nix} for a list of architectures supported by this version of Nixpkgs.
-            See ${./gpus.nix} for a list of architectures supported by this version of Nixpkgs.
+        '' jetsonBuildSufficientCondition
-          ''
-          jetsonBuildSufficientCondition
         && jetsonBuildNecessaryCondition;
     };
 in
 # When changing names or formats: pause, validate, and update the assert
-assert let
+assert
-  expected = {
+  let
-    cudaCapabilities = [
+    expected = {
-      "7.5"
+      cudaCapabilities = [
-      "8.6"
+        "7.5"
-    ];
+        "8.6"
-    enableForwardCompat = true;
+      ];
+      enableForwardCompat = true;
 
-    archNames = [
+      archNames = [
-      "Turing"
+        "Turing"
-      "Ampere"
+        "Ampere"
-    ];
+      ];
-    realArches = [
+      realArches = [
-      "sm_75"
+        "sm_75"
-      "sm_86"
+        "sm_86"
-    ];
+      ];
-    virtualArches = [
+      virtualArches = [
-      "compute_75"
+        "compute_75"
-      "compute_86"
+        "compute_86"
-    ];
+      ];
-    arches = [
+      arches = [
-      "sm_75"
+        "sm_75"
-      "sm_86"
+        "sm_86"
-      "compute_86"
+        "compute_86"
-    ];
+      ];
 
-    gencode = [
+      gencode = [
-      "-gencode=arch=compute_75,code=sm_75"
+        "-gencode=arch=compute_75,code=sm_75"
-      "-gencode=arch=compute_86,code=sm_86"
+        "-gencode=arch=compute_86,code=sm_86"
-      "-gencode=arch=compute_86,code=compute_86"
+        "-gencode=arch=compute_86,code=compute_86"
-    ];
+      ];
-    gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
+      gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
 
-    isJetsonBuild = false;
+      isJetsonBuild = false;
-  };
+    };
-  actual = formatCapabilities {
+    actual = formatCapabilities {
-    cudaCapabilities = [
+      cudaCapabilities = [
-      "7.5"
+        "7.5"
-      "8.6"
+        "8.6"
-    ];
+      ];
-  };
+    };
-  actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
+    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-in
+  in
-asserts.assertMsg ((strings.versionAtLeast cudaVersion "11.2") -> (expected == actualWrapped)) ''
+  asserts.assertMsg ((strings.versionAtLeast cudaVersion "11.2") -> (expected == actualWrapped)) ''
-  This test should only fail when using a version of CUDA older than 11.2, the first to support
+    This test should only fail when using a version of CUDA older than 11.2, the first to support
-  8.6.
+    8.6.
-  Expected: ${builtins.toJSON expected}
-  Actual: ${builtins.toJSON actualWrapped}
-'';
-# Check mixed Jetson and non-Jetson devices
-assert let
-  expected = false;
-  actual = formatCapabilities {
-    cudaCapabilities = [
-      "7.2"
-      "7.5"
-    ];
-  };
-  actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-in
-asserts.assertMsg (expected == actualWrapped) ''
-  Jetson devices capabilities cannot be mixed with non-jetson devices.
-  Capability 7.5 is non-Jetson and should not be allowed with Jetson 7.2.
-  Expected: ${builtins.toJSON expected}
-  Actual: ${builtins.toJSON actualWrapped}
-'';
-# Check Jetson-only
-assert let
-  expected = {
-    cudaCapabilities = [
-      "6.2"
-      "7.2"
-    ];
-    enableForwardCompat = true;
-
-    archNames = [
-      "Pascal"
-      "Volta"
-    ];
-    realArches = [
-      "sm_62"
-      "sm_72"
-    ];
-    virtualArches = [
-      "compute_62"
-      "compute_72"
-    ];
-    arches = [
-      "sm_62"
-      "sm_72"
-      "compute_72"
-    ];
-
-    gencode = [
-      "-gencode=arch=compute_62,code=sm_62"
-      "-gencode=arch=compute_72,code=sm_72"
-      "-gencode=arch=compute_72,code=compute_72"
-    ];
-    gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
-
-    isJetsonBuild = true;
-  };
-  actual = formatCapabilities {
-    cudaCapabilities = [
-      "6.2"
-      "7.2"
-    ];
-  };
-  actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-in
-asserts.assertMsg
-  # We can't do this test unless we're targeting aarch64
-  (hostPlatform.isAarch64 -> (expected == actualWrapped))
-  ''
-    Jetson devices can only be built with other Jetson devices.
-    Both 6.2 and 7.2 are Jetson devices.
     Expected: ${builtins.toJSON expected}
     Actual: ${builtins.toJSON actualWrapped}
   '';
+# Check mixed Jetson and non-Jetson devices
+assert
+  let
+    expected = false;
+    actual = formatCapabilities {
+      cudaCapabilities = [
+        "7.2"
+        "7.5"
+      ];
+    };
+    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
+  in
+  asserts.assertMsg (expected == actualWrapped) ''
+    Jetson devices capabilities cannot be mixed with non-jetson devices.
+    Capability 7.5 is non-Jetson and should not be allowed with Jetson 7.2.
+    Expected: ${builtins.toJSON expected}
+    Actual: ${builtins.toJSON actualWrapped}
+  '';
+# Check Jetson-only
+assert
+  let
+    expected = {
+      cudaCapabilities = [
+        "6.2"
+        "7.2"
+      ];
+      enableForwardCompat = true;
+
+      archNames = [
+        "Pascal"
+        "Volta"
+      ];
+      realArches = [
+        "sm_62"
+        "sm_72"
+      ];
+      virtualArches = [
+        "compute_62"
+        "compute_72"
+      ];
+      arches = [
+        "sm_62"
+        "sm_72"
+        "compute_72"
+      ];
+
+      gencode = [
+        "-gencode=arch=compute_62,code=sm_62"
+        "-gencode=arch=compute_72,code=sm_72"
+        "-gencode=arch=compute_72,code=compute_72"
+      ];
+      gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
+
+      isJetsonBuild = true;
+    };
+    actual = formatCapabilities {
+      cudaCapabilities = [
+        "6.2"
+        "7.2"
+      ];
+    };
+    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
+  in
+  asserts.assertMsg
+    # We can't do this test unless we're targeting aarch64
+    (hostPlatform.isAarch64 -> (expected == actualWrapped))
+    ''
+      Jetson devices can only be built with other Jetson devices.
+      Both 6.2 and 7.2 are Jetson devices.
+      Expected: ${builtins.toJSON expected}
+      Actual: ${builtins.toJSON actualWrapped}
+    '';
 {
   # formatCapabilities :: { cudaCapabilities: List Capability, enableForwardCompat: Boolean } ->  { ... }
   inherit formatCapabilities;
@@ -376,6 +381,6 @@ asserts.assertMsg
     ;
 }
 // formatCapabilities {
-  cudaCapabilities = if cudaCapabilities == [] then defaultCapabilities else cudaCapabilities;
+  cudaCapabilities = if cudaCapabilities == [ ] then defaultCapabilities else cudaCapabilities;
   enableForwardCompat = cudaForwardCompat;
 }

pkgs/development/cuda-modules/generic-builders/manifest.nix

@@ -50,144 +50,139 @@ let
 
   sourceMatchesHost = flags.getNixSystem redistArch == stdenv.hostPlatform.system;
 in
-backendStdenv.mkDerivation (
+backendStdenv.mkDerivation (finalAttrs: {
-  finalAttrs: {
+  # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
-    # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
+  # redistributables are sensitive to the compiler flags provided to stdenv. The patchelf package
-    # redistributables are sensitive to the compiler flags provided to stdenv. The patchelf package
+  # is sensitive to the compiler flags provided to stdenv, and we depend on it. As such, we are
-    # is sensitive to the compiler flags provided to stdenv, and we depend on it. As such, we are
+  # also sensitive to the compiler flags provided to stdenv.
-    # also sensitive to the compiler flags provided to stdenv.
+  inherit pname;
-    inherit pname;
+  inherit (redistribRelease) version;
-    inherit (redistribRelease) version;
 
-    # Don't force serialization to string for structured attributes, like outputToPatterns
+  # Don't force serialization to string for structured attributes, like outputToPatterns
-    # and brokenConditions.
+  # and brokenConditions.
-    # Avoids "set cannot be coerced to string" errors.
+  # Avoids "set cannot be coerced to string" errors.
-    __structuredAttrs = true;
+  __structuredAttrs = true;
 
-    # Keep better track of dependencies.
+  # Keep better track of dependencies.
-    strictDeps = true;
+  strictDeps = true;
 
-    # NOTE: Outputs are evaluated jointly with meta, so in the case that this is an unsupported platform,
+  # NOTE: Outputs are evaluated jointly with meta, so in the case that this is an unsupported platform,
-    # we still need to provide a list of outputs.
+  # we still need to provide a list of outputs.
-    outputs =
+  outputs =
-      let
+    let
-        # Checks whether the redistributable provides an output.
+      # Checks whether the redistributable provides an output.
-        hasOutput =
+      hasOutput =
-          output:
+        output:
-          attrsets.attrByPath
+        attrsets.attrByPath [
-            [
+          redistArch
-              redistArch
+          "outputs"
-              "outputs"
+          output
-              output
+        ] false featureRelease;
-            ]
+      # Order is important here so we use a list.
-            false
+      possibleOutputs = [
-            featureRelease;
+        "bin"
-        # Order is important here so we use a list.
-        possibleOutputs = [
-          "bin"
-          "lib"
-          "static"
-          "dev"
-          "doc"
-          "sample"
-          "python"
-        ];
-        # Filter out outputs that don't exist in the redistributable.
-        # NOTE: In the case the redistributable isn't supported on the target platform,
-        # we will have `outputs = [ "out" ] ++ possibleOutputs`. This is of note because platforms which
-        # aren't supported would otherwise have evaluation errors when trying to access outputs other than `out`.
-        # The alternative would be to have `outputs = [ "out" ]` when`redistArch = "unsupported"`, but that would
-        # require adding guards throughout the entirety of the CUDA package set to ensure `cudaSupport` is true --
-        # recall that OfBorg will evaluate packages marked as broken and that `cudaPackages` will be evaluated with
-        # `cudaSupport = false`!
-        additionalOutputs =
-          if redistArch == "unsupported"
-          then possibleOutputs
-          else builtins.filter hasOutput possibleOutputs;
-        # The out output is special -- it's the default output and we always include it.
-        outputs = [ "out" ] ++ additionalOutputs;
-      in
-      outputs;
-
-    # Traversed in the order of the outputs speficied in outputs;
-    # entries are skipped if they don't exist in outputs.
-    outputToPatterns = {
-      bin = [ "bin" ];
-      dev = [
-        "share/pkgconfig"
-        "**/*.pc"
-        "**/*.cmake"
-      ];
-      lib = [
         "lib"
-        "lib64"
+        "static"
+        "dev"
+        "doc"
+        "sample"
+        "python"
       ];
-      static = ["**/*.a"];
+      # Filter out outputs that don't exist in the redistributable.
-      sample = ["samples"];
+      # NOTE: In the case the redistributable isn't supported on the target platform,
-      python = ["**/*.whl"];
+      # we will have `outputs = [ "out" ] ++ possibleOutputs`. This is of note because platforms which
-    };
+      # aren't supported would otherwise have evaluation errors when trying to access outputs other than `out`.
+      # The alternative would be to have `outputs = [ "out" ]` when`redistArch = "unsupported"`, but that would
+      # require adding guards throughout the entirety of the CUDA package set to ensure `cudaSupport` is true --
+      # recall that OfBorg will evaluate packages marked as broken and that `cudaPackages` will be evaluated with
+      # `cudaSupport = false`!
+      additionalOutputs =
+        if redistArch == "unsupported" then possibleOutputs else builtins.filter hasOutput possibleOutputs;
+      # The out output is special -- it's the default output and we always include it.
+      outputs = [ "out" ] ++ additionalOutputs;
+    in
+    outputs;
 
-    # Useful for introspecting why something went wrong. Maps descriptions of why the derivation would be marked as
+  # Traversed in the order of the outputs speficied in outputs;
-    # broken on have badPlatforms include the current platform.
+  # entries are skipped if they don't exist in outputs.
-
+  outputToPatterns = {
-    # brokenConditions :: AttrSet Bool
+    bin = [ "bin" ];
-    # Sets `meta.broken = true` if any of the conditions are true.
+    dev = [
-    # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
+      "share/pkgconfig"
-    brokenConditions = { };
+      "**/*.pc"
-
+      "**/*.cmake"
-    # badPlatformsConditions :: AttrSet Bool
-    # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
-    # Example: Broken on a specific architecture when some condition is met (like targeting Jetson).
-    badPlatformsConditions = {
-      "No source" = !sourceMatchesHost;
-    };
-
-    # src :: Optional Derivation
-    src = trivial.pipe redistArch [
-      # If redistArch doesn't exist in redistribRelease, return null.
-      (redistArch: redistribRelease.${redistArch} or null)
-      # If the release is non-null, fetch the source; otherwise, return null.
-      (trivial.mapNullable (
-        { relative_path, sha256, ... }:
-        fetchurl {
-          url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
-          inherit sha256;
-        }
-      ))
     ];
+    lib = [
+      "lib"
+      "lib64"
+    ];
+    static = [ "**/*.a" ];
+    sample = [ "samples" ];
+    python = [ "**/*.whl" ];
+  };
 
-    # Handle the pkg-config files:
+  # Useful for introspecting why something went wrong. Maps descriptions of why the derivation would be marked as
-    # 1. No FHS
+  # broken on have badPlatforms include the current platform.
-    # 2. Location expected by the pkg-config wrapper
-    # 3. Generate unversioned names too
-    postPatch = ''
-      for path in pkg-config pkgconfig ; do
-        [[ -d "$path" ]] || continue
-        mkdir -p share/pkgconfig
-        mv "$path"/* share/pkgconfig/
-        rmdir "$path"
-      done
 
-      for pc in share/pkgconfig/*.pc ; do
+  # brokenConditions :: AttrSet Bool
-        sed -i \
+  # Sets `meta.broken = true` if any of the conditions are true.
-          -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+  # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
-          -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+  brokenConditions = { };
-          -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
-          "$pc"
-      done
 
-      # E.g. cuda-11.8.pc -> cuda.pc
+  # badPlatformsConditions :: AttrSet Bool
-      for pc in share/pkgconfig/*-"$majorMinorVersion.pc" ; do
+  # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
-        ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
+  # Example: Broken on a specific architecture when some condition is met (like targeting Jetson).
-      done
+  badPlatformsConditions = {
-    '';
+    "No source" = !sourceMatchesHost;
+  };
 
-    env.majorMinorVersion = cudaMajorMinorVersion;
+  # src :: Optional Derivation
+  src = trivial.pipe redistArch [
+    # If redistArch doesn't exist in redistribRelease, return null.
+    (redistArch: redistribRelease.${redistArch} or null)
+    # If the release is non-null, fetch the source; otherwise, return null.
+    (trivial.mapNullable (
+      { relative_path, sha256, ... }:
+      fetchurl {
+        url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
+        inherit sha256;
+      }
+    ))
+  ];
 
-    # We do need some other phases, like configurePhase, so the multiple-output setup hook works.
+  # Handle the pkg-config files:
-    dontBuild = true;
+  # 1. No FHS
+  # 2. Location expected by the pkg-config wrapper
+  # 3. Generate unversioned names too
+  postPatch = ''
+    for path in pkg-config pkgconfig ; do
+      [[ -d "$path" ]] || continue
+      mkdir -p share/pkgconfig
+      mv "$path"/* share/pkgconfig/
+      rmdir "$path"
+    done
 
-    nativeBuildInputs = [
+    for pc in share/pkgconfig/*.pc ; do
+      sed -i \
+        -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+        -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+        -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
+        "$pc"
+    done
+
+    # E.g. cuda-11.8.pc -> cuda.pc
+    for pc in share/pkgconfig/*-"$majorMinorVersion.pc" ; do
+      ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
+    done
+  '';
+
+  env.majorMinorVersion = cudaMajorMinorVersion;
+
+  # We do need some other phases, like configurePhase, so the multiple-output setup hook works.
+  dontBuild = true;
+
+  nativeBuildInputs =
+    [
       autoPatchelfHook
       # This hook will make sure libcuda can be found
       # in typically /lib/opengl-driver by adding that
@@ -205,142 +200,140 @@ backendStdenv.mkDerivation (
       autoAddCudaCompatRunpath
     ];
 
-    buildInputs =
+  buildInputs = [
-      [
+    # autoPatchelfHook will search for a libstdc++ and we're giving it
-        # autoPatchelfHook will search for a libstdc++ and we're giving it
+    # one that is compatible with the rest of nixpkgs, even when
-        # one that is compatible with the rest of nixpkgs, even when
+    # nvcc forces us to use an older gcc
-        # nvcc forces us to use an older gcc
+    # NB: We don't actually know if this is the right thing to do
-        # NB: We don't actually know if this is the right thing to do
+    stdenv.cc.cc.lib
-        stdenv.cc.cc.lib
+  ];
-      ];
 
-    # Picked up by autoPatchelf
+  # Picked up by autoPatchelf
-    # Needed e.g. for libnvrtc to locate (dlopen) libnvrtc-builtins
+  # Needed e.g. for libnvrtc to locate (dlopen) libnvrtc-builtins
-    appendRunpaths = ["$ORIGIN"];
+  appendRunpaths = [ "$ORIGIN" ];
 
-    # NOTE: We don't need to check for dev or doc, because those outputs are handled by
+  # NOTE: We don't need to check for dev or doc, because those outputs are handled by
-    # the multiple-outputs setup hook.
+  # the multiple-outputs setup hook.
-    # NOTE: moveToOutput operates on all outputs:
+  # NOTE: moveToOutput operates on all outputs:
-    # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L105-L107
+  # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L105-L107
-    installPhase =
+  installPhase =
-      let
+    let
-        mkMoveToOutputCommand =
+      mkMoveToOutputCommand =
-          output:
+        output:
-          let
-            template = pattern: ''moveToOutput "${pattern}" "${"$" + output}"'';
-            patterns = finalAttrs.outputToPatterns.${output} or [];
-          in
-          strings.concatMapStringsSep "\n" template patterns;
-      in
-      # Pre-install hook
-      ''
-        runHook preInstall
-      ''
-      # Handle the existence of libPath, which requires us to re-arrange the lib directory
-      + strings.optionalString (libPath != null) ''
-        full_lib_path="lib/${libPath}"
-        if [[ ! -d "$full_lib_path" ]] ; then
-          echo "${finalAttrs.pname}: '$full_lib_path' does not exist, only found:" >&2
-          find lib/ -mindepth 1 -maxdepth 1 >&2
-          echo "This release might not support your CUDA version" >&2
-          exit 1
-        fi
-        echo "Making libPath '$full_lib_path' the root of lib" >&2
-        mv "$full_lib_path" lib_new
-        rm -r lib
-        mv lib_new lib
-      ''
-      # Create the primary output, out, and move the other outputs into it.
-      + ''
-        mkdir -p "$out"
-        mv * "$out"
-      ''
-      # Move the outputs into their respective outputs.
-      + strings.concatMapStringsSep "\n" mkMoveToOutputCommand (builtins.tail finalAttrs.outputs)
-      # Add a newline to the end of the installPhase, so that the post-install hook doesn't
-      # get concatenated with the last moveToOutput command.
-      + "\n"
-      # Post-install hook
-      + ''
-        runHook postInstall
-      '';
-
-    doInstallCheck = true;
-    allowFHSReferences = true; # TODO: Default to `false`
-    postInstallCheck = ''
-      echo "Executing postInstallCheck"
-
-      if [[ -z "''${allowFHSReferences-}" ]] ; then
-        mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
-        if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
-          echo "Detected references to /usr" >&2
-          exit 1
-        fi
-      fi
-    '';
-
-    # libcuda needs to be resolved during runtime
-    autoPatchelfIgnoreMissingDeps = [
-      "libcuda.so"
-      "libcuda.so.*"
-    ];
-
-    # The out output leverages the same functionality which backs the `symlinkJoin` function in
-    # Nixpkgs:
-    # https://github.com/NixOS/nixpkgs/blob/d8b2a92df48f9b08d68b0132ce7adfbdbc1fbfac/pkgs/build-support/trivial-builders/default.nix#L510
-    #
-    # That should allow us to emulate "fat" default outputs without having to actually create them.
-    #
-    # It is important that this run after the autoPatchelfHook, otherwise the symlinks in out will reference libraries in lib, creating a circular dependency.
-    postPhases = ["postPatchelf"];
-
-    # For each output, create a symlink to it in the out output.
-    # NOTE: We must recreate the out output here, because the setup hook will have deleted it if it was empty.
-    postPatchelf = ''
-      mkdir -p "$out"
-      for output in $(getAllOutputNames); do
-        if [[ "$output" != "out" ]]; then
-          ${meta.getExe lndir} "''${!output}" "$out"
-        fi
-      done
-    '';
-
-    # Make the CUDA-patched stdenv available
-    passthru.stdenv = backendStdenv;
-
-    # Setting propagatedBuildInputs to false will prevent outputs known to the multiple-outputs
-    # from depending on `out` by default.
-    # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L196
-    # Indeed, we want to do the opposite -- fat "out" outputs that contain all the other outputs.
-    propagatedBuildOutputs = false;
-
-    # By default, if the dev output exists it just uses that.
-    # However, because we disabled propagatedBuildOutputs, dev doesn't contain libraries or
-    # anything of the sort. To remedy this, we set outputSpecified to true, and use
-    # outputsToInstall, which tells Nix which outputs to use when the package name is used
-    # unqualified (that is, without an explicit output).
-    outputSpecified = true;
-
-    meta = {
-      description = "${redistribRelease.name}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
-      sourceProvenance = [sourceTypes.binaryNativeCode];
-      broken = lists.any trivial.id (attrsets.attrValues finalAttrs.brokenConditions);
-      platforms = trivial.pipe supportedRedistArchs [
-        # Map each redist arch to the equivalent nix system or null if there is no equivalent.
-        (builtins.map flags.getNixSystem)
-        # Filter out unsupported systems
-        (builtins.filter (nixSystem: !(strings.hasPrefix "unsupported-" nixSystem)))
-      ];
-      badPlatforms =
         let
-          isBadPlatform = lists.any trivial.id (attrsets.attrValues finalAttrs.badPlatformsConditions);
+          template = pattern: ''moveToOutput "${pattern}" "${"$" + output}"'';
+          patterns = finalAttrs.outputToPatterns.${output} or [ ];
         in
-        lists.optionals isBadPlatform finalAttrs.meta.platforms;
+        strings.concatMapStringsSep "\n" template patterns;
-      license = licenses.unfree;
+    in
-      maintainers = teams.cuda.members;
+    # Pre-install hook
-      # Force the use of the default, fat output by default (even though `dev` exists, which
+    ''
-      # causes Nix to prefer that output over the others if outputSpecified isn't set).
+      runHook preInstall
-      outputsToInstall = ["out"];
+    ''
-    };
+    # Handle the existence of libPath, which requires us to re-arrange the lib directory
-  }
+    + strings.optionalString (libPath != null) ''
-)
+      full_lib_path="lib/${libPath}"
+      if [[ ! -d "$full_lib_path" ]] ; then
+        echo "${finalAttrs.pname}: '$full_lib_path' does not exist, only found:" >&2
+        find lib/ -mindepth 1 -maxdepth 1 >&2
+        echo "This release might not support your CUDA version" >&2
+        exit 1
+      fi
+      echo "Making libPath '$full_lib_path' the root of lib" >&2
+      mv "$full_lib_path" lib_new
+      rm -r lib
+      mv lib_new lib
+    ''
+    # Create the primary output, out, and move the other outputs into it.
+    + ''
+      mkdir -p "$out"
+      mv * "$out"
+    ''
+    # Move the outputs into their respective outputs.
+    + strings.concatMapStringsSep "\n" mkMoveToOutputCommand (builtins.tail finalAttrs.outputs)
+    # Add a newline to the end of the installPhase, so that the post-install hook doesn't
+    # get concatenated with the last moveToOutput command.
+    + "\n"
+    # Post-install hook
+    + ''
+      runHook postInstall
+    '';
+
+  doInstallCheck = true;
+  allowFHSReferences = true; # TODO: Default to `false`
+  postInstallCheck = ''
+    echo "Executing postInstallCheck"
+
+    if [[ -z "''${allowFHSReferences-}" ]] ; then
+      mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
+      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
+        echo "Detected references to /usr" >&2
+        exit 1
+      fi
+    fi
+  '';
+
+  # libcuda needs to be resolved during runtime
+  autoPatchelfIgnoreMissingDeps = [
+    "libcuda.so"
+    "libcuda.so.*"
+  ];
+
+  # The out output leverages the same functionality which backs the `symlinkJoin` function in
+  # Nixpkgs:
+  # https://github.com/NixOS/nixpkgs/blob/d8b2a92df48f9b08d68b0132ce7adfbdbc1fbfac/pkgs/build-support/trivial-builders/default.nix#L510
+  #
+  # That should allow us to emulate "fat" default outputs without having to actually create them.
+  #
+  # It is important that this run after the autoPatchelfHook, otherwise the symlinks in out will reference libraries in lib, creating a circular dependency.
+  postPhases = [ "postPatchelf" ];
+
+  # For each output, create a symlink to it in the out output.
+  # NOTE: We must recreate the out output here, because the setup hook will have deleted it if it was empty.
+  postPatchelf = ''
+    mkdir -p "$out"
+    for output in $(getAllOutputNames); do
+      if [[ "$output" != "out" ]]; then
+        ${meta.getExe lndir} "''${!output}" "$out"
+      fi
+    done
+  '';
+
+  # Make the CUDA-patched stdenv available
+  passthru.stdenv = backendStdenv;
+
+  # Setting propagatedBuildInputs to false will prevent outputs known to the multiple-outputs
+  # from depending on `out` by default.
+  # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L196
+  # Indeed, we want to do the opposite -- fat "out" outputs that contain all the other outputs.
+  propagatedBuildOutputs = false;
+
+  # By default, if the dev output exists it just uses that.
+  # However, because we disabled propagatedBuildOutputs, dev doesn't contain libraries or
+  # anything of the sort. To remedy this, we set outputSpecified to true, and use
+  # outputsToInstall, which tells Nix which outputs to use when the package name is used
+  # unqualified (that is, without an explicit output).
+  outputSpecified = true;
+
+  meta = {
+    description = "${redistribRelease.name}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
+    sourceProvenance = [ sourceTypes.binaryNativeCode ];
+    broken = lists.any trivial.id (attrsets.attrValues finalAttrs.brokenConditions);
+    platforms = trivial.pipe supportedRedistArchs [
+      # Map each redist arch to the equivalent nix system or null if there is no equivalent.
+      (builtins.map flags.getNixSystem)
+      # Filter out unsupported systems
+      (builtins.filter (nixSystem: !(strings.hasPrefix "unsupported-" nixSystem)))
+    ];
+    badPlatforms =
+      let
+        isBadPlatform = lists.any trivial.id (attrsets.attrValues finalAttrs.badPlatformsConditions);
+      in
+      lists.optionals isBadPlatform finalAttrs.meta.platforms;
+    license = licenses.unfree;
+    maintainers = teams.cuda.members;
+    # Force the use of the default, fat output by default (even though `dev` exists, which
+    # causes Nix to prefer that output over the others if outputSpecified isn't set).
+    outputsToInstall = [ "out" ];
+  };
+})

pkgs/development/cuda-modules/generic-builders/multiplex.nix

@@ -52,7 +52,9 @@ let
   # - Package: ../modules/${pname}/releases/package.nix
 
   # FIXME: do this at the module system level
-  propagatePlatforms = lib.mapAttrs (redistArch: packages: map (p: { inherit redistArch; } // p) packages);
+  propagatePlatforms = lib.mapAttrs (
+    redistArch: packages: map (p: { inherit redistArch; } // p) packages
+  );
 
   # All releases across all platforms
   # See ../modules/${pname}/releases/releases.nix
@@ -61,7 +63,7 @@ let
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
   # computeName :: Package -> String
-  computeName = {version, ...}: mkVersionedPackageName pname version;
+  computeName = { version, ... }: mkVersionedPackageName pname version;
 
   # Check whether a package supports our CUDA version and platform.
   # isSupported :: Package -> Bool
@@ -81,16 +83,15 @@ let
 
   # All the supported packages we can build for our platform.
   # perSystemReleases :: List Package
-  allReleases = lib.pipe releaseSets
+  allReleases = lib.pipe releaseSets [
-    [
+    (lib.attrValues)
-      (lib.attrValues)
+    (lists.flatten)
-      (lists.flatten)
+    (lib.groupBy (p: lib.versions.majorMinor p.version))
-      (lib.groupBy (p: lib.versions.majorMinor p.version))
+    (lib.mapAttrs (_: builtins.sort preferable))
-      (lib.mapAttrs (_: builtins.sort preferable))
+    (lib.mapAttrs (_: lib.take 1))
-      (lib.mapAttrs (_: lib.take 1))
+    (lib.attrValues)
-      (lib.attrValues)
+    (lib.concatMap lib.trivial.id)
-      (lib.concatMap lib.trivial.id)
+  ];
-    ];
 
   newest = builtins.head (builtins.sort preferable allReleases);
 
@@ -115,7 +116,10 @@ let
       buildPackage =
         package:
         let
-          shims = final.callPackage shimsFn {inherit package; inherit (package) redistArch; };
+          shims = final.callPackage shimsFn {
+            inherit package;
+            inherit (package) redistArch;
+          };
           name = computeName package;
           drv = final.callPackage ./manifest.nix {
             inherit pname;
@@ -129,7 +133,9 @@ let
       # versionedDerivations :: AttrSet Derivation
       versionedDerivations = builtins.listToAttrs (lists.map buildPackage allReleases);
 
-      defaultDerivation = { ${pname} = (buildPackage newest).value; };
+      defaultDerivation = {
+        ${pname} = (buildPackage newest).value;
+      };
     in
     versionedDerivations // defaultDerivation;
 in

pkgs/development/cuda-modules/modules/cuda/default.nix

@@ -1 +1,4 @@
-{options, ...}: {options.cuda.manifests = options.generic.manifests;}
+{ options, ... }:
+{
+  options.cuda.manifests = options.generic.manifests;
+}

pkgs/development/cuda-modules/modules/cudnn/default.nix

@@ -1,4 +1,4 @@
-{options, ...}:
+{ options, ... }:
 {
   options.cudnn.releases = options.generic.releases;
   # TODO(@connorbaker): Figure out how to add additional options to the

pkgs/development/cuda-modules/modules/cutensor/default.nix

@@ -1 +1,4 @@
-{options, ...}: {options.cutensor.manifests = options.generic.manifests;}
+{ options, ... }:
+{
+  options.cutensor.manifests = options.generic.manifests;
+}

pkgs/development/cuda-modules/modules/generic/manifests/default.nix

@@ -1,7 +1,7 @@
-{lib, config, ...}:
+{ lib, config, ... }:
 {
   options.generic.manifests = {
-    feature = import ./feature/manifest.nix {inherit lib config;};
+    feature = import ./feature/manifest.nix { inherit lib config; };
-    redistrib = import ./redistrib/manifest.nix {inherit lib;};
+    redistrib = import ./redistrib/manifest.nix { inherit lib; };
   };
 }

pkgs/development/cuda-modules/modules/generic/manifests/feature/manifest.nix

@@ -1,7 +1,7 @@
-{lib, config, ...}:
+{ lib, config, ... }:
 let
   inherit (lib) options trivial types;
-  Release = import ./release.nix {inherit lib config;};
+  Release = import ./release.nix { inherit lib config; };
 in
 options.mkOption {
   description = "A feature manifest is an attribute set which includes a mapping from package name to release";

pkgs/development/cuda-modules/modules/generic/manifests/feature/outputs.nix

@@ -1,4 +1,4 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options types;
 in

pkgs/development/cuda-modules/modules/generic/manifests/feature/package.nix

@@ -1,10 +1,10 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options types;
-  Outputs = import ./outputs.nix {inherit lib;};
+  Outputs = import ./outputs.nix { inherit lib; };
 in
 options.mkOption {
   description = "A package in the manifest";
-  example = (import ./release.nix {inherit lib;}).linux-x86_64;
+  example = (import ./release.nix { inherit lib; }).linux-x86_64;
-  type = types.submodule {options.outputs = Outputs;};
+  type = types.submodule { options.outputs = Outputs; };
 }

pkgs/development/cuda-modules/modules/generic/manifests/feature/release.nix

@@ -1,10 +1,10 @@
-{lib, config, ...}:
+{ lib, config, ... }:
 let
   inherit (lib) options types;
-  Package = import ./package.nix {inherit lib config;};
+  Package = import ./package.nix { inherit lib config; };
 in
 options.mkOption {
   description = "A release is an attribute set which includes a mapping from platform to package";
-  example = (import ./manifest.nix {inherit lib;}).cuda_cccl;
+  example = (import ./manifest.nix { inherit lib; }).cuda_cccl;
   type = types.attrsOf Package.type;
 }

pkgs/development/cuda-modules/modules/generic/manifests/redistrib/manifest.nix

@@ -1,7 +1,7 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options trivial types;
-  Release = import ./release.nix {inherit lib;};
+  Release = import ./release.nix { inherit lib; };
 in
 options.mkOption {
   description = "A redistributable manifest is an attribute set which includes a mapping from package name to release";

pkgs/development/cuda-modules/modules/generic/manifests/redistrib/package.nix

@@ -1,10 +1,10 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options types;
 in
 options.mkOption {
   description = "A package in the manifest";
-  example = (import ./release.nix {inherit lib;}).linux-x86_64;
+  example = (import ./release.nix { inherit lib; }).linux-x86_64;
   type = types.submodule {
     options = {
       relative_path = options.mkOption {

pkgs/development/cuda-modules/modules/generic/manifests/redistrib/release.nix

@@ -1,11 +1,11 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options types;
-  Package = import ./package.nix {inherit lib;};
+  Package = import ./package.nix { inherit lib; };
 in
 options.mkOption {
   description = "A release is an attribute set which includes a mapping from platform to package";
-  example = (import ./manifest.nix {inherit lib;}).cuda_cccl;
+  example = (import ./manifest.nix { inherit lib; }).cuda_cccl;
   type = types.submodule {
     # Allow any attribute name as these will be the platform names
     freeformType = types.attrsOf Package.type;

pkgs/development/cuda-modules/modules/generic/releases/default.nix

@@ -1,4 +1,4 @@
-{lib, config, ...}:
+{ lib, config, ... }:
 let
   inherit (config.generic.types) majorMinorVersion majorMinorPatchBuildVersion;
   inherit (lib) options types;

pkgs/development/cuda-modules/modules/generic/types/default.nix

@@ -1,11 +1,11 @@
-{lib, ...}:
+{ lib, ... }:
 let
   inherit (lib) options types;
 in
 {
   options.generic.types = options.mkOption {
     type = types.attrsOf types.optionType;
-    default = {};
+    default = { };
     description = "A set of generic types.";
   };
   config.generic.types = {

pkgs/development/cuda-modules/modules/tensorrt/default.nix

@@ -1,4 +1,4 @@
-{options, ...}:
+{ options, ... }:
 {
   options.tensorrt.releases = options.generic.releases;
   # TODO(@connorbaker): Figure out how to add additional options to the

pkgs/development/cuda-modules/nccl-tests/default.nix

@@ -22,63 +22,61 @@ let
     nccl
     ;
 in
-backendStdenv.mkDerivation (
+backendStdenv.mkDerivation (finalAttrs: {
-  finalAttrs: {
 
-    pname = "nccl-tests";
+  pname = "nccl-tests";
-    version = "2.13.9";
+  version = "2.13.9";
 
-    src = fetchFromGitHub {
+  src = fetchFromGitHub {
-      owner = "NVIDIA";
+    owner = "NVIDIA";
-      repo = finalAttrs.pname;
+    repo = finalAttrs.pname;
-      rev = "v${finalAttrs.version}";
+    rev = "v${finalAttrs.version}";
-      hash = "sha256-QYuMBPhvHHVo2ku14jD1CVINLPW0cyiXJkXxb77IxbE=";
+    hash = "sha256-QYuMBPhvHHVo2ku14jD1CVINLPW0cyiXJkXxb77IxbE=";
-    };
+  };
 
-    strictDeps = true;
+  strictDeps = true;
 
-    nativeBuildInputs =
+  nativeBuildInputs =
-      [which]
+    [ which ]
-      ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [cuda_nvcc];
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
 
-    buildInputs =
+  buildInputs =
-      [nccl]
+    [ nccl ]
-      ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
-        cuda_nvcc.dev # crt/host_config.h
+      cuda_nvcc.dev # crt/host_config.h
-        cuda_cudart
+      cuda_cudart
-      ]
+    ]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [
-        cuda_cccl.dev # <nv/target>
+      cuda_cccl.dev # <nv/target>
-      ]
+    ]
-      ++ lib.optionals mpiSupport [mpi];
+    ++ lib.optionals mpiSupport [ mpi ];
 
-    makeFlags =
+  makeFlags =
-      ["NCCL_HOME=${nccl}"]
+    [ "NCCL_HOME=${nccl}" ]
-      ++ lib.optionals (lib.versionOlder cudaVersion "11.4") ["CUDA_HOME=${cudatoolkit}"]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ "CUDA_HOME=${cudatoolkit}" ]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") ["CUDA_HOME=${cuda_nvcc}"]
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ "CUDA_HOME=${cuda_nvcc}" ]
-      ++ lib.optionals mpiSupport ["MPI=1"];
+    ++ lib.optionals mpiSupport [ "MPI=1" ];
 
-    enableParallelBuilding = true;
+  enableParallelBuilding = true;
 
-    installPhase = ''
+  installPhase = ''
-      mkdir -p $out/bin
+    mkdir -p $out/bin
-      cp -r build/* $out/bin/
+    cp -r build/* $out/bin/
-    '';
+  '';
 
-    passthru.updateScript = gitUpdater {
+  passthru.updateScript = gitUpdater {
-      inherit (finalAttrs) pname version;
+    inherit (finalAttrs) pname version;
-      rev-prefix = "v";
+    rev-prefix = "v";
-    };
+  };
 
-    meta = with lib; {
+  meta = with lib; {
-      description = "Tests to check both the performance and the correctness of NVIDIA NCCL operations";
+    description = "Tests to check both the performance and the correctness of NVIDIA NCCL operations";
-      homepage = "https://github.com/NVIDIA/nccl-tests";
+    homepage = "https://github.com/NVIDIA/nccl-tests";
-      platforms = platforms.linux;
+    platforms = platforms.linux;
-      license = licenses.bsd3;
+    license = licenses.bsd3;
-      broken = !config.cudaSupport || (mpiSupport && mpi == null);
+    broken = !config.cudaSupport || (mpiSupport && mpi == null);
-      maintainers = with maintainers; [jmillerpdt] ++ teams.cuda.members;
+    maintainers = with maintainers; [ jmillerpdt ] ++ teams.cuda.members;
-    };
+  };
-  }
+})
-)

pkgs/development/cuda-modules/nccl/default.nix

@@ -22,94 +22,92 @@ let
     cudaVersion
     ;
 in
-backendStdenv.mkDerivation (
+backendStdenv.mkDerivation (finalAttrs: {
-  finalAttrs: {
+  pname = "nccl";
-    pname = "nccl";
+  version = "2.20.5-1";
-    version = "2.20.5-1";
 
-    src = fetchFromGitHub {
+  src = fetchFromGitHub {
-      owner = "NVIDIA";
+    owner = "NVIDIA";
-      repo = finalAttrs.pname;
+    repo = finalAttrs.pname;
-      rev = "v${finalAttrs.version}";
+    rev = "v${finalAttrs.version}";
-      hash = "sha256-ModIjD6RaRD/57a/PA1oTgYhZsAQPrrvhl5sNVXnO6c=";
+    hash = "sha256-ModIjD6RaRD/57a/PA1oTgYhZsAQPrrvhl5sNVXnO6c=";
-    };
+  };
 
-    strictDeps = true;
+  strictDeps = true;
 
-    outputs = [
+  outputs = [
-      "out"
+    "out"
-      "dev"
+    "dev"
+  ];
+
+  nativeBuildInputs =
+    [
+      which
+      autoAddDriverRunpath
+      python3
+    ]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+
+  buildInputs =
+    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+      cuda_nvcc.dev # crt/host_config.h
+      cuda_cudart
+    ]
+    # NOTE: CUDA versions in Nixpkgs only use a major and minor version. When we do comparisons
+    # against other version, like below, it's important that we use the same format. Otherwise,
+    # we'll get incorrect results.
+    # For example, lib.versionAtLeast "12.0" "12.0.0" == false.
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-unused-function" ];
+
+  preConfigure = ''
+    patchShebangs ./src/device/generate.py
+    makeFlagsArray+=(
+      "NVCC_GENCODE=${lib.concatStringsSep " " cudaFlags.gencode}"
+    )
+  '';
+
+  makeFlags =
+    [ "PREFIX=$(out)" ]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [
+      "CUDA_HOME=${cudatoolkit}"
+      "CUDA_LIB=${lib.getLib cudatoolkit}/lib"
+      "CUDA_INC=${lib.getDev cudatoolkit}/include"
+    ]
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+      "CUDA_HOME=${cuda_nvcc}"
+      "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
+      "CUDA_INC=${lib.getDev cuda_cudart}/include"
     ];
 
-    nativeBuildInputs =
+  enableParallelBuilding = true;
+
+  postFixup = ''
+    moveToOutput lib/libnccl_static.a $dev
+  '';
+
+  passthru.updateScript = gitUpdater {
+    inherit (finalAttrs) pname version;
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Multi-GPU and multi-node collective communication primitives for NVIDIA GPUs";
+    homepage = "https://developer.nvidia.com/nccl";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    # NCCL is not supported on Jetson, because it does not use NVLink or PCI-e for inter-GPU communication.
+    # https://forums.developer.nvidia.com/t/can-jetson-orin-support-nccl/232845/9
+    badPlatforms = lib.optionals cudaFlags.isJetsonBuild [ "aarch64-linux" ];
+    maintainers =
+      with maintainers;
       [
-        which
+        mdaiter
-        autoAddDriverRunpath
+        orivej
-        python3
       ]
-      ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
+      ++ teams.cuda.members;
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [cuda_nvcc];
+  };
-
+})
-    buildInputs =
-      lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
-        cuda_nvcc.dev # crt/host_config.h
-        cuda_cudart
-      ]
-      # NOTE: CUDA versions in Nixpkgs only use a major and minor version. When we do comparisons
-      # against other version, like below, it's important that we use the same format. Otherwise,
-      # we'll get incorrect results.
-      # For example, lib.versionAtLeast "12.0" "12.0.0" == false.
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [cuda_cccl];
-
-    env.NIX_CFLAGS_COMPILE = toString ["-Wno-unused-function"];
-
-    preConfigure = ''
-      patchShebangs ./src/device/generate.py
-      makeFlagsArray+=(
-        "NVCC_GENCODE=${lib.concatStringsSep " " cudaFlags.gencode}"
-      )
-    '';
-
-    makeFlags =
-      ["PREFIX=$(out)"]
-      ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [
-        "CUDA_HOME=${cudatoolkit}"
-        "CUDA_LIB=${lib.getLib cudatoolkit}/lib"
-        "CUDA_INC=${lib.getDev cudatoolkit}/include"
-      ]
-      ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
-        "CUDA_HOME=${cuda_nvcc}"
-        "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
-        "CUDA_INC=${lib.getDev cuda_cudart}/include"
-      ];
-
-    enableParallelBuilding = true;
-
-    postFixup = ''
-      moveToOutput lib/libnccl_static.a $dev
-    '';
-
-    passthru.updateScript = gitUpdater {
-      inherit (finalAttrs) pname version;
-      rev-prefix = "v";
-    };
-
-    meta = with lib; {
-      description = "Multi-GPU and multi-node collective communication primitives for NVIDIA GPUs";
-      homepage = "https://developer.nvidia.com/nccl";
-      license = licenses.bsd3;
-      platforms = platforms.linux;
-      # NCCL is not supported on Jetson, because it does not use NVLink or PCI-e for inter-GPU communication.
-      # https://forums.developer.nvidia.com/t/can-jetson-orin-support-nccl/232845/9
-      badPlatforms = lib.optionals cudaFlags.isJetsonBuild [ "aarch64-linux" ];
-      maintainers =
-        with maintainers;
-        [
-          mdaiter
-          orivej
-        ]
-        ++ teams.cuda.members;
-    };
-  }
-)

pkgs/development/cuda-modules/saxpy/default.nix

@@ -31,18 +31,18 @@ backendStdenv.mkDerivation {
       cmake
       autoAddDriverRunpath
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
+    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [cuda_nvcc];
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
+    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
     ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
       (getDev libcublas)
       (getLib libcublas)
       (getOutput "static" libcublas)
       cuda_cudart
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [cuda_cccl];
+    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
 
   cmakeFlags = [
     (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)

pkgs/development/cuda-modules/setup-hooks/extension.nix

@@ -2,63 +2,50 @@ final: _: {
   # Helper hook used in both autoAddCudaCompatRunpath and
   # autoAddDriverRunpath that applies a generic patching action to all elf
   # files with a dynamic linking section.
-  autoFixElfFiles =
+  autoFixElfFiles = final.callPackage (
-    final.callPackage
+    { makeSetupHook }: makeSetupHook { name = "auto-fix-elf-files"; } ./auto-fix-elf-files.sh
-      (
+  ) { };
-        {makeSetupHook}:
-         makeSetupHook
-          {
-            name = "auto-fix-elf-files";
-          }
-          ./auto-fix-elf-files.sh
-      )
-      {};
 
   # Internal hook, used by cudatoolkit and cuda redist packages
   # to accommodate automatic CUDAToolkit_ROOT construction
-  markForCudatoolkitRootHook =
+  markForCudatoolkitRootHook = final.callPackage (
-    final.callPackage
+    { makeSetupHook }:
-      (
+    makeSetupHook { name = "mark-for-cudatoolkit-root-hook"; } ./mark-for-cudatoolkit-root-hook.sh
-        {makeSetupHook}:
+  ) { };
-        makeSetupHook {name = "mark-for-cudatoolkit-root-hook";} ./mark-for-cudatoolkit-root-hook.sh
-      )
-      {};
 
   # Currently propagated by cuda_nvcc or cudatoolkit, rather than used directly
-  setupCudaHook =
+  setupCudaHook = (
-    (final.callPackage
+    final.callPackage (
-      (
+      { makeSetupHook, backendStdenv }:
-        {makeSetupHook, backendStdenv}:
+      makeSetupHook {
-        makeSetupHook
+        name = "setup-cuda-hook";
-          {
-            name = "setup-cuda-hook";
 
-            substitutions.setupCudaHook = placeholder "out";
+        substitutions.setupCudaHook = placeholder "out";
 
-            # Point NVCC at a compatible compiler
+        # Point NVCC at a compatible compiler
-            substitutions.ccRoot = "${backendStdenv.cc}";
+        substitutions.ccRoot = "${backendStdenv.cc}";
 
-            # Required in addition to ccRoot as otherwise bin/gcc is looked up
+        # Required in addition to ccRoot as otherwise bin/gcc is looked up
-            # when building CMakeCUDACompilerId.cu
+        # when building CMakeCUDACompilerId.cu
-            substitutions.ccFullPath = "${backendStdenv.cc}/bin/${backendStdenv.cc.targetPrefix}c++";
+        substitutions.ccFullPath = "${backendStdenv.cc}/bin/${backendStdenv.cc.targetPrefix}c++";
-          }
+      } ./setup-cuda-hook.sh
-          ./setup-cuda-hook.sh
+    ) { }
-      )
+  );
-      {}
-    );
 
-  autoAddDriverRunpath =
+  autoAddDriverRunpath = final.callPackage (
-    final.callPackage
+    {
-      (
+      addDriverRunpath,
-        {addDriverRunpath, autoFixElfFiles, makeSetupHook}:
+      autoFixElfFiles,
-        makeSetupHook
+      makeSetupHook,
-          {
+    }:
-            name = "auto-add-opengl-runpath-hook";
+    makeSetupHook {
-            propagatedBuildInputs = [addDriverRunpath autoFixElfFiles];
+      name = "auto-add-opengl-runpath-hook";
-          }
+      propagatedBuildInputs = [
-          ./auto-add-driver-runpath-hook.sh
+        addDriverRunpath
-      )
+        autoFixElfFiles
-      {};
+      ];
+    } ./auto-add-driver-runpath-hook.sh
+  ) { };
 
   # Deprecated: an alias kept for compatibility. Consider removing after 24.11
   autoAddOpenGLRunpathHook = final.autoAddDriverRunpath;
@@ -68,27 +55,26 @@ final: _: {
   # patched elf files, but `cuda_compat` path must take precedence (otherwise,
   # it doesn't have any effect) and thus appear first. Meaning this hook must be
   # executed last.
-  autoAddCudaCompatRunpath =
+  autoAddCudaCompatRunpath = final.callPackage (
-    final.callPackage
+    {
-      (
+      makeSetupHook,
-        {makeSetupHook, autoFixElfFiles, cuda_compat ? null }:
+      autoFixElfFiles,
-        makeSetupHook
+      cuda_compat ? null,
-          {
+    }:
-            name = "auto-add-cuda-compat-runpath-hook";
+    makeSetupHook {
-            propagatedBuildInputs = [autoFixElfFiles];
+      name = "auto-add-cuda-compat-runpath-hook";
+      propagatedBuildInputs = [ autoFixElfFiles ];
 
-            substitutions = {
+      substitutions = {
-              # Hotfix Ofborg evaluation
+        # Hotfix Ofborg evaluation
-              libcudaPath = if final.flags.isJetsonBuild then "${cuda_compat}/compat" else null;
+        libcudaPath = if final.flags.isJetsonBuild then "${cuda_compat}/compat" else null;
-            };
+      };
 
-            meta.broken = !final.flags.isJetsonBuild;
+      meta.broken = !final.flags.isJetsonBuild;
 
-            # Pre-cuda_compat CUDA release:
+      # Pre-cuda_compat CUDA release:
-            meta.badPlatforms = final.lib.optionals (cuda_compat == null) final.lib.platforms.all;
+      meta.badPlatforms = final.lib.optionals (cuda_compat == null) final.lib.platforms.all;
-            meta.platforms = cuda_compat.meta.platforms or [ ];
+      meta.platforms = cuda_compat.meta.platforms or [ ];
-          }
+    } ./auto-add-cuda-compat-runpath.sh
-          ./auto-add-cuda-compat-runpath.sh
+  ) { };
-      )
-      {};
 }

pkgs/development/cuda-modules/tensorrt/fixup.nix

@@ -108,6 +108,6 @@ finalAttrs: prevAttrs: {
       prevAttrs.meta.badPlatforms or [ ]
       ++ lib.optionals (targetArch == "unsupported") [ hostPlatform.system ];
     homepage = "https://developer.nvidia.com/tensorrt";
-    maintainers = prevAttrs.meta.maintainers ++ [maintainers.aidalgol];
+    maintainers = prevAttrs.meta.maintainers ++ [ maintainers.aidalgol ];
   };
 }

pkgs/development/cuda-modules/tensorrt/releases.nix

@@ -3,9 +3,9 @@
 {
   tensorrt.releases = {
     # jetson
-    linux-aarch64 = [];
+    linux-aarch64 = [ ];
     # powerpc
-    linux-ppc64le = [];
+    linux-ppc64le = [ ];
     # server-grade arm
     linux-sbsa = [
       {

pkgs/development/libraries/libchardet/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, perl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, perl }:
 
 stdenv.mkDerivation rec {
   pname = "libchardet";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-JhEiWM3q8X+eEBHxv8k9yYOaTGoJOzI+/iFYC0gZJJs=";
   };
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ autoreconfHook perl ];
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/libfabric/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.20.1";
+  version = "1.21.0";
 
   enableParallelBuilding = true;
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rQzsh3Q2xaGwmmsfvUmFE8WbAb1e2JEvunSoqZYRHvE=";
+    sha256 = "sha256-p0L9l1UpxD2WCZWXBNaEz9Zjzr5is3iEODcoQQa1f6M=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/development/libraries/science/math/blis/default.nix

@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
     description = "BLAS-compatible linear algebra library";
     homepage = "https://github.com/flame/blis";
     license = licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with maintainers; [ stephen-huan ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/development/python-modules/ansible-builder/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, python3Packages
+, podman
+, fetchPypi
+, bindep
+}:
+python3Packages.buildPythonPackage rec {
+  pname = "ansible-builder";
+  version = "3.0.1";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-rxyhgj9Cad751tPAptCTLCtXQLUXaRYv39bkoFzzjOk=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  buildInputs = [
+    bindep
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    podman
+    jsonschema
+    requirements-parser
+    pyyaml
+  ];
+
+  patchPhase = ''
+    # the upper limits of setuptools are unnecessary
+    # See https://github.com/ansible/ansible-builder/issues/639
+    sed -i 's/, <=[0-9.]*//g' pyproject.toml
+  '';
+
+  meta = with lib; {
+    description = "An Ansible execution environment builder";
+    homepage = "https://ansible-builder.readthedocs.io/en/stable/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ melkor333 ];
+  };
+}

pkgs/development/python-modules/ansible-navigator/default.nix

@@ -0,0 +1,47 @@
+{ lib
+, pkgs
+, python3Packages
+, podman
+, oniguruma
+, fetchPypi
+, buildPythonPackage
+}:
+buildPythonPackage rec {
+  pname = "ansible-navigator";
+  version = "24.2.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-qXBhM63fFwPwo0pmEhZnZnGC8Eht8eFPfVbDkY98MGM=";
+  };
+
+  buildInputs = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    ansible-builder
+    ansible-runner
+    podman
+    pkgs.ansible-lint
+    jinja2
+    jsonschema
+    tzdata
+    onigurumacffi
+  ];
+
+  patchPhase = ''
+    # scm_git_archive doesn't exist anymore. Fixed upstream but unreleased
+    # Rev: https://github.com/ansible/ansible-navigator/pull/1716
+    sed -i '/setuptools_scm_git_archive/d' pyproject.toml
+  '';
+
+  meta = with lib; {
+    description = "A text-based user interface (TUI) for Ansible.";
+    homepage = "https://ansible.readthedocs.io/projects/navigator/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ melkor333 ];
+  };
+}

pkgs/development/python-modules/bidict/default.nix

@@ -36,12 +36,11 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  pytestFlagsArray = [
+  # Remove the bundled pytest.ini, which adds options to run additional integration
-    # Pass -c /dev/null so that pytest does not use the bundled pytest.ini, which adds
+  # tests that are overkill for our purposes.
-    # options to run additional integration tests that are overkill for our purposes.
+  preCheck = ''
-    "-c"
+    rm pytest.ini
-    "/dev/null"
+  '';
-  ];
 
   pythonImportsCheck = [ "bidict" ];
 

pkgs/development/python-modules/bindep/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, python3Packages
+, fetchPypi
+}:
+python3Packages.buildPythonPackage rec {
+  pname = "bindep";
+  version = "2.11.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-rLLyWbzh/RUIhzR5YJu95bmq5Qg3hHamjWtqGQAufi8=";
+  };
+
+  buildInputs = with python3Packages; [
+    distro
+    pbr
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    parsley
+    pbr
+    packaging
+    distro
+  ];
+
+  patchPhase = ''
+    # Setting the pbr version will skip any version checking logic
+    # This is required because pbr thinks it gets it's own version from git tags
+    # See https://docs.openstack.org/pbr/latest/user/packagers.html
+    export PBR_VERSION=5.11.1
+  '';
+
+  meta = with lib; {
+    description = "Bindep is a tool for checking the presence of binary packages needed to use an application / library";
+    homepage = "https://docs.opendev.org/opendev/bindep/latest/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ melkor333 ];
+  };
+}

pkgs/development/python-modules/google-cloud-asset/default.nix

@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.25.1";
+  version = "3.26.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xKiqk55Ccm6DaB2aG5xo08nVqL69q8hvro+BPaY0/m4=";
+    hash = "sha256-t10XW0dC5cDR6cKnUiicJdKV+jkScximgL4DCi1iIFY=";
   };
 
   build-system = [

pkgs/development/python-modules/mplhep/default.nix

@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "mplhep";
-  version = "0.3.41";
+  version = "0.3.44";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1L9e2A2u+4+QEWJW2ikuENLD0x5Khjfr7I6p+Vt4nwE=";
+    hash = "sha256-UyHjNtkULBzsa76ky+6zgjErXKCfnn2oaJPjG47Pgqw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/onigurumacffi/default.nix

@@ -0,0 +1,24 @@
+{ lib, python3Packages, fetchPypi, oniguruma }:
+python3Packages.buildPythonPackage rec {
+  pname = "onigurumacffi";
+  version = "1.3.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-d0XNxWCWrOyIofOwhmCiKwnGWe040/WdtsHK12qXa+8=";
+  };
+
+  buildInputs = with python3Packages; [
+    oniguruma
+    setuptools
+    cffi
+  ];
+
+  meta = with lib; {
+    description = "Python cffi bindings for the oniguruma regex engine";
+    homepage = "https://github.com/asottile/onigurumacffi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ melkor333 ];
+  };
+}

pkgs/development/python-modules/transformers/default.nix

@@ -53,7 +53,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.39.2";
+  version = "4.39.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -62,7 +62,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eOtXHKTGVV3hYdSK+p2mTgCaG4akivnuMnB/lSh8Lxc=";
+    hash = "sha256-MJZvPbj9ypr6YwFGkzwCp9fVuM3vEGpeXK+gEIFzwRA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/ammonite/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, jre, writeScript, common-updater-scripts, git, nixfmt
+{ lib, stdenv, fetchurl, jre, writeScript, common-updater-scripts, git, nixfmt-classic
 , nix, coreutils, gnused, disableRemoteLogging ? true }:
 
 let
@@ -37,7 +37,7 @@ let
               git
               gnused
               nix
-              nixfmt
+              nixfmt-classic
             ]
           }
           oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"

pkgs/development/tools/build-managers/sbt-extras/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, which, curl, makeWrapper, jdk, writeScript
-, common-updater-scripts, cacert, git, nixfmt, nix, jq, coreutils, gnused }:
+, common-updater-scripts, cacert, git, nixfmt-classic, nix, jq, coreutils, gnused }:
 
 stdenv.mkDerivation rec {
   pname = "sbt-extras";
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
          curl
          cacert
          git
-         nixfmt
+         nixfmt-classic
          nix
          jq
          coreutils

pkgs/development/tools/continuous-integration/jenkins/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, common-updater-scripts, coreutils, git, gnused
-, makeWrapper, nix, nixfmt, openjdk, writeScript, nixosTests, jq, cacert, curl
+, makeWrapper, nix, nixfmt-classic, openjdk, writeScript, nixosTests, jq, cacert, curl
 }:
 
 stdenv.mkDerivation rec {
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
           gnused
           jq
           nix
-          nixfmt
+          nixfmt-classic
         ]
       }
 

pkgs/os-specific/linux/nvme-cli/default.nix

@@ -4,7 +4,6 @@
 , libnvme
 , json_c
 , zlib
-, libhugetlbfs
 , python3Packages
 }:
 

pkgs/os-specific/linux/rdma-core/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "50.0";
+  version = "51.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PJlbY7QR9b2eVaALpuq/67kRTc91HEhs9Wl7WXtSLmA=";
+    hash = "sha256-G5Z2BbmF5fzOg/32BBgGpC6yroDFOnZWtA/+5QatQ1M=";
   };
 
   strictDeps = true;

pkgs/os-specific/linux/tailor-gui/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src sourceRoot;
     name = "${pname}-${version}";
-    hash = "sha256-mt4YQ0iB/Mlnm+o9sGgYVEdbxjF7qArxA5FIK4MAZ8M=";
+    hash = "sha256-jcjq0uls28V8Ka2CMM8oOQmZZRUr9eEQeVtW56AmU28=";
   };
 
   nativeBuildInputs = [

pkgs/os-specific/linux/tuxedo-rs/default.nix

@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tuxedo-rs";
-  version = "0.3.0";
+  version = "0.3.1";
 
   # NOTE: This src is shared with tailor-gui.
   # When updating, the tailor-gui.cargoDeps hash needs to be updated.
@@ -14,14 +14,14 @@ rustPlatform.buildRustPackage rec {
     owner = "AaronErhardt";
     repo = "tuxedo-rs";
     rev = "tailor-v${version}";
-    hash = "sha256-5F9Xo+tnmYqmFiKrKMe+EEqypmG9iIvwai5yuKCm00Y=";
+    hash = "sha256-+NzwUs8TZsA0us9hI1UmEKdiOo9IqTRmTOHs4xmC7MY=";
   };
 
 
   # Some of the tests are impure and rely on files in /etc/tailord
   doCheck = false;
 
-  cargoHash = "sha256-EPbh1elLOJKOrYLeBSaZ27zWGYFajiD60eFGEGaCJKw=";
+  cargoHash = "sha256-HtyCKQ0xDIXevgr4FAnVJcDI8G6vR9fLHFghe9+ADiU=";
 
   passthru.tests.version = testers.testVersion {
     package = tuxedo-rs;

pkgs/servers/monitoring/prometheus/smokeping-prober.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "0.7.3";
+  version = "0.8.0";
 
   ldflags = let
     setVars = rec {
@@ -20,9 +20,9 @@ buildGoModule rec {
     owner = "SuperQ";
     repo = "smokeping_prober";
     rev = "v${version}";
-    sha256 = "sha256-MP8AJ8XnIp/+9s7qeAGRHv2OtLL5zrjEhuzZ36V/GrY=";
+    sha256 = "sha256-f7hYgVksJOqlFwfdZZClRBVRzj3Mk+5D1Y8+xYOSI/I=";
   };
-  vendorHash = "sha256-39/0reEt4Rfe7DfysS4BROUgBUg+x95z6DU3IjC6m5U=";
+  vendorHash = "sha256-iKAT10pD2ctVIBdDw/AmHYtoZDW9XC8ruIxqlVoAuWY=";
 
   doCheck = true;
 

pkgs/servers/roon-server/default.nix

@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1388";
+  version = "2.0-1392";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-FH5edAtPS7qPtShGz1paEmL1O5xDmCLTRvEWFPiiVjg=";
+    hash = "sha256-S6p2xlWa1Xgp+umRx1KCs4g1u7JZTByNBNUSJBQweUs=";
   };
 
   dontConfigure = true;

pkgs/servers/web-apps/pict-rs/default.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pict-rs";
-  version = "0.5.10";
+  version = "0.5.11";
 
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SxGgj4yRtMcRKIQMVhRaeK2NudU581RDYLmAecWyxak=";
+    sha256 = "sha256-xZN9ifeI0cEz9i8JWTgvU0CZhukxwzJY6vwe7TJWkRc=";
   };
 
-  cargoHash = "sha256-T8L6geDOF8qBZYABtJX+MBhwYFyZwT7PCMigk0vuuDc=";
+  cargoHash = "sha256-g1N7yziPbQthdNcwZeDbOQpGFePUf4LXqMyWkS6c1AQ=";
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";

pkgs/shells/zsh/oh-my-zsh/default.nix

@@ -2,7 +2,7 @@
 #
 #   https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=oh-my-zsh-git
 { lib, stdenv, fetchFromGitHub, nixosTests, writeScript, common-updater-scripts
-, git, nix, nixfmt, jq, coreutils, gnused, curl, cacert, bash }:
+, git, nix, nixfmt-classic, jq, coreutils, gnused, curl, cacert, bash }:
 
 stdenv.mkDerivation rec {
   version = "2023-11-29";
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
           curl
           cacert
           git
-          nixfmt
+          nixfmt-classic
           nix
           jq
           coreutils

pkgs/stdenv/darwin/make-bootstrap-tools.nix

@@ -49,14 +49,6 @@ rec {
         scpSupport = false;
       });
 
-      gnutar_ = (gnutar.override { libintl = null; }).overrideAttrs (old: {
-        configureFlags = [
-          "--disable-nls"
-        ] ++ old.configureFlags or [];
-      });
-
-      xz_ = xz.override { enableStatic = true; };
-
       unpackScript = writeText "bootstrap-tools-unpack.sh" ''
         set -euo pipefail
 
@@ -77,6 +69,9 @@ rec {
           updateInstallName "$lib"
         done
 
+        # as is a wrapper around clang. need to replace the nuked store paths
+        sed -i 's|/.*/bin/|'"$out"'/bin/|' $out/bin/as
+
         # Provide a gunzip script.
         cat > $out/bin/gunzip <<EOF
         #!$out/bin/sh
@@ -99,7 +94,7 @@ rec {
 
     in
     ''
-      mkdir -p $out/bin $out/lib $out/lib/system $out/lib/darwin
+      mkdir -p $out/bin $out/lib $out/lib/darwin
 
       ${lib.optionalString stdenv.targetPlatform.isx86_64 ''
         # Copy libSystem's .o files for various low-level boot stuff.
@@ -115,27 +110,42 @@ rec {
       cp -rL ${getDev gnugrep.pcre2}/include/* $out/include
       mv $out/include $out/include-Libsystem
 
+      # Copy binutils.
+      for i in as ld ar ranlib nm strip otool install_name_tool lipo codesign_allocate; do
+        cp ${getBin cctools_}/bin/$i $out/bin
+      done
+
       # Copy coreutils, bash, etc.
       cp ${getBin coreutils_}/bin/* $out/bin
       (cd $out/bin && rm vdir dir sha*sum pinky factor pathchk runcon shuf who whoami shred users)
 
-      cp ${getBin bash}/bin/bash $out/bin
+      cp -d ${getBin bash}/bin/{ba,}sh $out/bin
-      ln -s bash $out/bin/sh
-      cp ${getBin findutils}/bin/find $out/bin
-      cp ${getBin findutils}/bin/xargs $out/bin
       cp -d ${getBin diffutils}/bin/* $out/bin
-      cp -d ${getBin gnused}/bin/* $out/bin
+      cp ${getBin findutils}/bin/{find,xargs} $out/bin
+      cp -d ${getBin gawk}/bin/{g,}awk $out/bin
       cp -d ${getBin gnugrep}/bin/grep $out/bin
-      cp ${getBin gawk}/bin/gawk $out/bin
+      cp -d ${getBin gnumake}/bin/* $out/bin
-      cp -d ${getBin gawk}/bin/awk $out/bin
+      cp -d ${getBin gnused}/bin/* $out/bin
+      cp -d ${getBin patch}/bin/* $out/bin
+
+      cp -d ${getLib gettext}/lib/libintl*.dylib $out/lib
+      cp -d ${getLib gnugrep.pcre2}/lib/libpcre2*.dylib $out/lib
+      cp -d ${getLib libiconv}/lib/lib*.dylib $out/lib
+      cp -d ${getLib libxml2}/lib/libxml2*.dylib $out/lib
+      cp -d ${getLib ncurses}/lib/libncurses*.dylib $out/lib
+
+      # copy package extraction tools
+      cp -d ${getBin bzip2}/bin/b{,un}zip2 $out/bin
+      cp ${getBin cpio}/bin/cpio $out/bin
       cp ${getBin gnutar}/bin/tar $out/bin
       cp ${getBin gzip}/bin/.gzip-wrapped $out/bin/gzip
-      cp ${getBin bzip2}/bin/bzip2 $out/bin
+      cp ${getBin pbzx}/bin/pbzx $out/bin
-      ln -s bzip2 $out/bin/bunzip2
+      cp ${getBin xz}/bin/xz $out/bin
-      cp -d ${getBin gnumake}/bin/* $out/bin
+      cp -d ${getLib bzip2}/lib/libbz2*.dylib $out/lib
-      cp -d ${getBin patch}/bin/* $out/bin
+      cp -d ${getLib gmpxx}/lib/libgmp*.dylib $out/lib
-      cp -d ${getBin xz}/bin/xz $out/bin
+      cp -d ${getLib xar}/lib/libxar*.dylib $out/lib
-      cp ${getBin cpio}/bin/cpio $out/bin
+      cp -d ${getLib xz}/lib/liblzma*.dylib $out/lib
+      cp -d ${getLib zlib}/lib/libz*.dylib $out/lib
 
       # This used to be in-nixpkgs, but now is in the bundle
       # because I can't be bothered to make it partially static
@@ -143,13 +153,6 @@ rec {
       cp -d ${getLib curl_}/lib/libcurl*.dylib $out/lib
       cp -d ${getLib openssl}/lib/*.dylib $out/lib
 
-      cp -d ${getLib gnugrep.pcre2}/lib/libpcre2*.dylib $out/lib
-      cp -d ${getLib libiconv}/lib/lib*.dylib $out/lib
-      cp -d ${getLib gettext}/lib/libintl*.dylib $out/lib
-      chmod +x $out/lib/libintl*.dylib
-      cp -d ${getLib ncurses}/lib/libncurses*.dylib $out/lib
-      cp -d ${getLib libxml2}/lib/libxml2*.dylib $out/lib
-
       # Copy what we need of clang
       cp -d ${getBin llvmPackages.clang-unwrapped}/bin/clang{,++,-cl,-cpp,-[0-9]*} $out/bin
       cp -d ${getLib llvmPackages.clang-unwrapped}/lib/libclang-cpp*.dylib $out/lib
@@ -163,41 +166,26 @@ rec {
       cp -d ${getLib libffi}/lib/libffi*.dylib $out/lib
 
       mkdir $out/include
-      cp -rd ${getDev llvmPackages.libcxx}/include/c++     $out/include
+      cp -rd ${getDev llvmPackages.libcxx}/include/c++ $out/include
 
       # copy .tbd assembly utils
-      cp -d ${getBin pkgs.darwin.rewrite-tbd}/bin/rewrite-tbd $out/bin
+      cp ${getBin darwin.rewrite-tbd}/bin/rewrite-tbd $out/bin
-      cp -d ${getLib pkgs.libyaml}/lib/libyaml*.dylib $out/lib
+      cp -d ${getLib libyaml}/lib/libyaml*.dylib $out/lib
-
-      # copy package extraction tools
-      cp -d ${getBin pkgs.pbzx}/bin/pbzx $out/bin
-      cp -d ${getLib pkgs.xar}/lib/libxar*.dylib $out/lib
-      cp -d ${getLib pkgs.bzip2}/lib/libbz2*.dylib $out/lib
 
       # copy sigtool
-      cp -d ${getBin pkgs.darwin.sigtool}/bin/sigtool $out/bin
+      cp -d ${getBin darwin.sigtool}/bin/{codesign,sigtool} $out/bin
-      cp -d ${getBin pkgs.darwin.sigtool}/bin/codesign $out/bin
 
-      cp -d ${getLib zlib}/lib/libz.*       $out/lib
+      cp -d ${getLib darwin.libtapi}/lib/libtapi*.dylib $out/lib
-      cp -d ${getLib gmpxx}/lib/libgmp*.*   $out/lib
-      cp -d ${getLib xz}/lib/liblzma*.*     $out/lib
 
-      # Copy binutils.
+      # tools needed to unpack bootstrap archive
-      for i in as ld ar ranlib nm strip otool install_name_tool lipo codesign_allocate; do
+      mkdir -p unpack/bin unpack/lib
-        cp ${getBin cctools_}/bin/$i $out/bin
+      cp -d ${getBin bash}/bin/{bash,sh} unpack/bin
-      done
-
-      cp -d ${getLib darwin.libtapi}/lib/libtapi* $out/lib
-
-      # tools needed to unpack bootstrap archive. they should not contain any
-      # external references. we will process them like the other tools but
-      # perform some additional checks and will not pack them into the archive.
-      mkdir -p unpack/bin
-      cp ${getBin bash}/bin/bash unpack/bin
-      ln -s bash unpack/bin/sh
       cp ${getBin coreutils_}/bin/mkdir unpack/bin
-      cp ${getBin gnutar_}/bin/tar unpack/bin
+      cp ${getBin gnutar}/bin/tar unpack/bin
-      cp ${getBin xz_}/bin/xz unpack/bin
+      cp ${getBin xz}/bin/xz unpack/bin
+      cp -d ${getLib gettext}/lib/libintl*.dylib unpack/lib
+      cp -d ${getLib libiconv}/lib/lib*.dylib unpack/lib
+      cp -d ${getLib xz}/lib/liblzma*.dylib unpack/lib
       cp ${unpackScript} unpack/bootstrap-tools-unpack.sh
 
       #
@@ -242,45 +230,37 @@ rec {
         fi
       }
 
-      # check that linked library paths exist in $out/lib
+      # check that linked library paths exist in lib
       # must be run after rpathify is performed
       checkDeps() {
         local deps=$(${stdenv.cc.targetPrefix}otool -l "$1"| grep -o '@rpath/[^      ]*' || true)
         local lib
+        shopt -s extglob
         for lib in $deps; do
-          if [[ ! -e $out/''${lib/@rpath/lib} ]]; then
+          local root="''${1/\/@(lib|bin)\/*}"
+          if [[ ! -e $root/''${lib/@rpath/lib} ]]; then
             echo "error: $1 missing lib for $lib" >&2
             exit 1
           fi
         done
+        shopt -u extglob
       }
 
-      for i in $out/bin/* unpack/bin/* $out/lib{,/darwin}/*.dylib; do
+      for i in {unpack,$out}/bin/* {unpack,$out}/lib{,/darwin}/*.dylib; do
         if [[ ! -L $i ]] && isMachO "$i"; then
           rpathify "$i"
           checkDeps "$i"
         fi
       done
 
-      nuke-refs $out/bin/*
+      nuke-refs {unpack,$out}/bin/*
-      nuke-refs $out/lib/*
+      nuke-refs {unpack,$out}/lib/*
       nuke-refs $out/lib/darwin/*
-      nuke-refs $out/lib/system/*
-      nuke-refs unpack/bin/*
 
       mkdir $out/.pack
       mv $out/* $out/.pack
       mv $out/.pack $out/pack
 
-      # validate that tools contain no references into the archive
-      for tool in unpack/bin/*; do
-        deps=$(${stdenv.cc.targetPrefix}otool -l "$tool"| grep '@rpath/' || true)
-        if [[ -n "$deps" ]]; then
-          printf "error: $tool is not self contained\n$deps\n" >&2
-          exit 1
-        fi
-      done
-
       mkdir $out/on-server
       cp -r unpack $out
 
@@ -339,19 +319,26 @@ rec {
 
     # Create a pure environment where we use just what's in the bootstrap tools.
     buildCommand = ''
+      mkdir -p $out/bin
 
-      ls -l
+      for exe in $tools/bin/*; do
-      mkdir $out
+        [[ $exe =~ bunzip2|codesign.*|false|install_name_tool|ld|lipo|pbzx|ranlib|rewrite-tbd|sigtool ]] && continue
-      mkdir $out/bin
+        $exe --version > /dev/null || { echo $exe failed >&2; exit 1; }
-      sed --version
+      done
-      find --version
+
-      diff --version
+      # run all exes that don't take a --version flag
-      patch --version
+      bunzip2 -h
-      make --version
+      codesign --help
-      awk --version
+      codesign_allocate -i $tools/bin/true -r -o true
-      grep --version
+      false || (($? == 1))
-      clang --version
+      install_name_tool -id true true
-      xz --version
+      ld -v
+      lipo -info true
+      pbzx -v
+      # ranlib gets tested bulding hello
+      rewrite-tbd </dev/null
+      sigtool -h
+      rm true
 
       # The grep will return a nonzero exit code if there is no match, and we want to assert that we have
       # an SSL-capable curl

pkgs/tools/security/rekor/default.nix

@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "1.3.5";
+      version = "1.3.6";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-g/APpfvG1MMTYZfPSXKNa9DdWrOrjOk8uQV3QyzCQjY=";
+        hash = "sha256-CGRR+rOlcFTfvXRxx6x7m0qK6YE6HZGvmMx+X7zu1sQ=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-6ZJ3IgnzoZSDL1+CMYUDumXf1uO+odZ8Y5IZq3GN4bY=";
+      vendorHash = "sha256-PDf3nUvDDBg+POMpklx45VhhjlB55pUMRhQMlwq7lnI=";
 
       nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/text/asciigraph/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "asciigraph";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "guptarohit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tImHxTVKFFE5RcHCyJ3dyV6kGp3keZzDRhpHsp+IGB0=";
+    sha256 = "sha256-pCfjk8ViMY2iAus2/hibSZXgKY9YBFRH3vsD19MTJ+8=";
   };
 
   vendorHash = null;

pkgs/top-level/aliases.nix

@@ -88,6 +88,7 @@ mapAliases ({
   atom-beta = throw "'atom-beta' has been removed because discontinued and deprecated. Consider using 'pulsar', a maintained fork"; # Added 2023-10-01
   atomEnv = throw "'atomEnv' has been removed because 'atom' is discontinued and deprecated. Consider using 'pulsar', a maintained fork"; # Added 2023-10-01
   atomPackages = throw "'atomPackages' has been removed because 'atom' is discontinued and deprecated. Consider using 'pulsar', a maintained fork"; # Added 2023-10-01
+  auditBlasHook = throw "'auditBlasHook' has been removed since it never worked"; # Added 2024-04-02
   avldrums-lv2 = x42-avldrums; # Added 2020-03-29
   awesome-4-0 = awesome; # Added 2022-05-05
 
@@ -848,6 +849,7 @@ mapAliases ({
   nix_2_4 = nixVersions.nix_2_4;
   nix_2_5 = nixVersions.nix_2_5;
   nix_2_6 = nixVersions.nix_2_6;
+  nixfmt = lib.warn "nixfmt was renamed to nixfmt-classic. The nixfmt attribute may be used for the new RFC 166-style formatter in the future, which is currently available as nixfmt-rfc-style" nixfmt-classic; # Added 2024-03-31
   nixops = throw "'nixops' has been removed. Please use 'nixops_unstable_minimal' for the time being. E.g. nixops_unstable_minimal.withPlugins (ps: [ ps.nixops-gce ])"; # Added 2023-10-26
   nixopsUnstable = nixops_unstable; # Added 2022-03-03
 

pkgs/top-level/all-packages.nix

@@ -164,10 +164,6 @@ with pkgs;
 
   ### BUILD SUPPORT
 
-  auditBlasHook = makeSetupHook
-    { name = "auto-blas-hook"; propagatedBuildInputs = [ blas lapack ]; }
-    ../build-support/setup-hooks/audit-blas.sh;
-
   autoreconfHook = callPackage (
     { makeSetupHook, autoconf, automake, gettext, libtool }:
     makeSetupHook {
@@ -17966,8 +17962,6 @@ with pkgs;
 
   infracost = callPackage ../tools/misc/infracost { };
 
-  jetbrains-toolbox = callPackage ../applications/misc/jetbrains-toolbox { };
-
   msp430GccSupport = callPackage ../development/misc/msp430/gcc-support.nix { };
 
   msp430Newlib      = callPackage ../development/misc/msp430/newlib.nix { };
@@ -18060,8 +18054,12 @@ with pkgs;
     };
   }));
 
+  ansible-builder = with python3Packages; toPythonApplication ansible-builder;
+
   ansible-doctor = callPackage ../tools/admin/ansible/doctor.nix { };
 
+  ansible-navigator = with python3Packages; toPythonApplication ansible-navigator;
+
   dbus-test-runner = callPackage ../development/tools/dbus-test-runner { };
 
   doq = callPackage ../development/tools/misc/doq { };
@@ -29401,7 +29399,7 @@ with pkgs;
 
   shades-of-gray-theme = callPackage ../data/themes/shades-of-gray { };
 
-  sierra-breeze-enhanced = libsForQt5.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { };
+  sierra-breeze-enhanced = libsForQt5.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { useQt5 = true; };
 
   simp1e-cursors = callPackage ../data/icons/simp1e-cursors { };
 
@@ -40091,7 +40089,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  nixfmt = haskellPackages.nixfmt.bin;
+  nixfmt-classic = haskellPackages.nixfmt.bin;
 
   nixpkgs-fmt = callPackage ../tools/nix/nixpkgs-fmt { };
 

pkgs/top-level/coq-packages.nix

@@ -122,7 +122,10 @@ let
       tlc = callPackage ../development/coq-modules/tlc {};
       topology = callPackage ../development/coq-modules/topology {};
       trakt = callPackage ../development/coq-modules/trakt {};
-      vcfloat = callPackage ../development/coq-modules/vcfloat {};
+      vcfloat = callPackage ../development/coq-modules/vcfloat (lib.optionalAttrs
+        (lib.versions.range "8.16" "8.18" self.coq.version) {
+          interval = self.interval.override { version = "4.9.0"; };
+        });
       Velisarios = callPackage ../development/coq-modules/Velisarios {};
       Verdi = callPackage ../development/coq-modules/Verdi {};
       Vpl = callPackage ../development/coq-modules/Vpl {};

pkgs/top-level/cuda-packages.nix

@@ -40,78 +40,75 @@ let
   # Backbone
   gpus = builtins.import ../development/cuda-modules/gpus.nix;
   nvccCompatibilities = builtins.import ../development/cuda-modules/nvcc-compatibilities.nix;
-  flags = callPackage ../development/cuda-modules/flags.nix {inherit cudaVersion gpus;};
+  flags = callPackage ../development/cuda-modules/flags.nix { inherit cudaVersion gpus; };
-  passthruFunction =
+  passthruFunction = final: ({
-    final:
+    inherit cudaVersion lib pkgs;
-    (
+    inherit gpus nvccCompatibilities flags;
-      {
+    cudaMajorVersion = versions.major cudaVersion;
-        inherit cudaVersion lib pkgs;
+    cudaMajorMinorVersion = versions.majorMinor cudaVersion;
-        inherit gpus nvccCompatibilities flags;
+    cudaOlder = strings.versionOlder cudaVersion;
-        cudaMajorVersion = versions.major cudaVersion;
+    cudaAtLeast = strings.versionAtLeast cudaVersion;
-        cudaMajorMinorVersion = versions.majorMinor cudaVersion;
-        cudaOlder = strings.versionOlder cudaVersion;
-        cudaAtLeast = strings.versionAtLeast cudaVersion;
 
-        # Maintain a reference to the final cudaPackages.
+    # Maintain a reference to the final cudaPackages.
-        # Without this, if we use `final.callPackage` and a package accepts `cudaPackages` as an argument,
+    # Without this, if we use `final.callPackage` and a package accepts `cudaPackages` as an argument,
-        # it's provided with `cudaPackages` from the top-level scope, which is not what we want. We want to
+    # it's provided with `cudaPackages` from the top-level scope, which is not what we want. We want to
-        # provide the `cudaPackages` from the final scope -- that is, the *current* scope.
+    # provide the `cudaPackages` from the final scope -- that is, the *current* scope.
-        cudaPackages = final;
+    cudaPackages = final;
 
-        # TODO(@connorbaker): `cudaFlags` is an alias for `flags` which should be removed in the future.
+    # TODO(@connorbaker): `cudaFlags` is an alias for `flags` which should be removed in the future.
-        cudaFlags = flags;
+    cudaFlags = flags;
 
-        # Exposed as cudaPackages.backendStdenv.
+    # Exposed as cudaPackages.backendStdenv.
-        # This is what nvcc uses as a backend,
+    # This is what nvcc uses as a backend,
-        # and it has to be an officially supported one (e.g. gcc11 for cuda11).
+    # and it has to be an officially supported one (e.g. gcc11 for cuda11).
-        #
+    #
-        # It, however, propagates current stdenv's libstdc++ to avoid "GLIBCXX_* not found errors"
+    # It, however, propagates current stdenv's libstdc++ to avoid "GLIBCXX_* not found errors"
-        # when linked with other C++ libraries.
+    # when linked with other C++ libraries.
-        # E.g. for cudaPackages_11_8 we use gcc11 with gcc12's libstdc++
+    # E.g. for cudaPackages_11_8 we use gcc11 with gcc12's libstdc++
-        # Cf. https://github.com/NixOS/nixpkgs/pull/218265 for context
+    # Cf. https://github.com/NixOS/nixpkgs/pull/218265 for context
-        backendStdenv = final.callPackage ../development/cuda-modules/backend-stdenv.nix {};
+    backendStdenv = final.callPackage ../development/cuda-modules/backend-stdenv.nix { };
 
-        # Loose packages
+    # Loose packages
-        cudatoolkit = final.callPackage ../development/cuda-modules/cudatoolkit {};
+    cudatoolkit = final.callPackage ../development/cuda-modules/cudatoolkit { };
-        saxpy = final.callPackage ../development/cuda-modules/saxpy {};
+    saxpy = final.callPackage ../development/cuda-modules/saxpy { };
-        nccl = final.callPackage ../development/cuda-modules/nccl {};
+    nccl = final.callPackage ../development/cuda-modules/nccl { };
-        nccl-tests = final.callPackage ../development/cuda-modules/nccl-tests {};
+    nccl-tests = final.callPackage ../development/cuda-modules/nccl-tests { };
-      }
+  });
-    );
 
   mkVersionedPackageName =
     name: version:
     strings.concatStringsSep "_" [
       name
-      (strings.replaceStrings ["."] ["_"] (versions.majorMinor version))
+      (strings.replaceStrings [ "." ] [ "_" ] (versions.majorMinor version))
     ];
 
-  composedExtension = fixedPoints.composeManyExtensions ([
+  composedExtension = fixedPoints.composeManyExtensions (
-    (import ../development/cuda-modules/setup-hooks/extension.nix)
+    [
-    (callPackage ../development/cuda-modules/cuda/extension.nix {inherit cudaVersion;})
+      (import ../development/cuda-modules/setup-hooks/extension.nix)
-    (callPackage ../development/cuda-modules/cuda/overrides.nix {inherit cudaVersion;})
+      (callPackage ../development/cuda-modules/cuda/extension.nix { inherit cudaVersion; })
-    (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
+      (callPackage ../development/cuda-modules/cuda/overrides.nix { inherit cudaVersion; })
-      inherit cudaVersion flags mkVersionedPackageName;
+      (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
-      pname = "cudnn";
+        inherit cudaVersion flags mkVersionedPackageName;
-      releasesModule = ../development/cuda-modules/cudnn/releases.nix;
+        pname = "cudnn";
-      shimsFn = ../development/cuda-modules/cudnn/shims.nix;
+        releasesModule = ../development/cuda-modules/cudnn/releases.nix;
-      fixupFn = ../development/cuda-modules/cudnn/fixup.nix;
+        shimsFn = ../development/cuda-modules/cudnn/shims.nix;
-    })
+        fixupFn = ../development/cuda-modules/cudnn/fixup.nix;
-    (callPackage ../development/cuda-modules/cutensor/extension.nix {
+      })
-      inherit cudaVersion flags mkVersionedPackageName;
+      (callPackage ../development/cuda-modules/cutensor/extension.nix {
-    })
+        inherit cudaVersion flags mkVersionedPackageName;
-    (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
+      })
-      inherit cudaVersion flags mkVersionedPackageName;
+      (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
-      pname = "tensorrt";
+        inherit cudaVersion flags mkVersionedPackageName;
-      releasesModule = ../development/cuda-modules/tensorrt/releases.nix;
+        pname = "tensorrt";
-      shimsFn = ../development/cuda-modules/tensorrt/shims.nix;
+        releasesModule = ../development/cuda-modules/tensorrt/releases.nix;
-      fixupFn = ../development/cuda-modules/tensorrt/fixup.nix;
+        shimsFn = ../development/cuda-modules/tensorrt/shims.nix;
-    })
+        fixupFn = ../development/cuda-modules/tensorrt/fixup.nix;
-    (callPackage ../development/cuda-modules/cuda-samples/extension.nix {inherit cudaVersion;})
+      })
-    (callPackage ../development/cuda-modules/cuda-library-samples/extension.nix {})
+      (callPackage ../development/cuda-modules/cuda-samples/extension.nix { inherit cudaVersion; })
-  ] ++ lib.optionals config.allowAliases [
+      (callPackage ../development/cuda-modules/cuda-library-samples/extension.nix { })
-    (import ../development/cuda-modules/aliases.nix)
+    ]
-  ]);
+    ++ lib.optionals config.allowAliases [ (import ../development/cuda-modules/aliases.nix) ]
+  );
 
   cudaPackages = customisation.makeScope newScope (
     fixedPoints.extends composedExtension passthruFunction

pkgs/top-level/python-packages.nix

@@ -585,12 +585,16 @@ self: super: with self; {
 
   ansible = callPackage ../development/python-modules/ansible { };
 
+  ansible-builder = callPackage ../development/python-modules/ansible-builder { };
+
   ansible-compat = callPackage ../development/python-modules/ansible-compat { };
 
   ansible-core = callPackage ../development/python-modules/ansible/core.nix { };
 
   ansible-kernel = callPackage ../development/python-modules/ansible-kernel { };
 
+  ansible-navigator = callPackage ../development/python-modules/ansible-navigator { };
+
   ansible-pylibssh = callPackage ../development/python-modules/ansible-pylibssh { };
 
   ansible-runner = callPackage ../development/python-modules/ansible-runner { };
@@ -1507,6 +1511,8 @@ self: super: with self; {
 
   bincopy = callPackage ../development/python-modules/bincopy { };
 
+  bindep = callPackage ../development/python-modules/bindep { };
+
   binho-host-adapter = callPackage ../development/python-modules/binho-host-adapter { };
 
   binwalk = callPackage ../development/python-modules/binwalk { };
@@ -8935,6 +8941,8 @@ self: super: with self; {
 
   onetimepass = callPackage ../development/python-modules/onetimepass { };
 
+  onigurumacffi = callPackage ../development/python-modules/onigurumacffi { };
+
   onkyo-eiscp = callPackage ../development/python-modules/onkyo-eiscp { };
 
   online-judge-api-client = callPackage ../development/python-modules/online-judge-api-client { };

pkgs/top-level/qt5-packages.nix

@@ -271,6 +271,8 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   rlottie-qml = callPackage ../development/libraries/rlottie-qml { };
 
+  sierra-breeze-enhanced = callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { useQt5 = true; };
+
   soqt = callPackage ../development/libraries/soqt { };
 
   telepathy = callPackage ../development/libraries/telepathy/qt { };

pkgs/top-level/qt6-packages.nix

@@ -105,6 +105,8 @@ makeScopeWithSplicing' {
   # is, to allow users to choose the right build if needed.
   sddm = callPackage ../applications/display-managers/sddm {};
 
+  sierra-breeze-enhanced = kdePackages.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { };
+
   signond = callPackage ../development/libraries/signond {};
 
   waylib = callPackage ../development/libraries/waylib { };