nixpkgs: acquire via builtins.fetchGit instead of flake

i'll probably delete this toplevel flake at some point as well

flake.lock

@@ -1,60 +1,6 @@
 {
   "nodes": {
-    "nixpkgs-next-unpatched": {
+    "root": {}
-      "locked": {
-        "lastModified": 1717741857,
-        "narHash": "sha256-/zczvqYqfFAVeTm9tihZov5O/44IxUJmTZTsVt3RHLc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "5aa86ae5585cd46299ee46682fda8a9b76baf2ae",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "staging-next",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-staging-unpatched": {
-      "locked": {
-        "lastModified": 1717740106,
-        "narHash": "sha256-s76WduyD0d92oOAFPmbp3MV2wG+JLHdDPMf+cMDzjHk=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "da9d22446697971278edcd4af92f63221f7d21f6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "staging",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unpatched": {
-      "locked": {
-        "lastModified": 1717748405,
-        "narHash": "sha256-who+R7MEJmpX4xH1hjmpJp1DgmT7SzLhvSNebZdNe+o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "716a7056386dcc67eb3b813289499d6329d4befc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs-next-unpatched": "nixpkgs-next-unpatched",
-        "nixpkgs-staging-unpatched": "nixpkgs-staging-unpatched",
-        "nixpkgs-unpatched": "nixpkgs-unpatched"
-      }
-    }
   },
   "root": "root",
   "version": 7

flake.nix

@@ -21,40 +21,8 @@
 #   - `nix flake lock --update-input nixpkgs`
 
 {
-  # XXX: use the `github:` scheme instead of the more readable git+https: because it's *way* more efficient
-  # preferably, i would rewrite the human-readable https URLs to nix-specific github: URLs with a helper,
-  # but `inputs` is required to be a strict attrset: not an expression.
-  inputs = {
-    # branch workflow:
-    # - daily:
-    #   - nixos-unstable cut from master after enough packages have been built in caches.
-    # - every 6 hours:
-    #   - master auto-merged into staging and staging-next
-    #   - staging-next auto-merged into staging.
-    # - manually, approximately once per month:
-    #   - staging-next is cut from staging.
-    #   - staging-next merged into master.
-    #
-    # which branch to source from?
-    # - nixos-unstable: for everyday development; it provides good caching
-    # - master: temporarily if i'm otherwise cherry-picking lots of already-applied patches
-    # - staging-next: if testing stuff that's been PR'd into staging, i.e. base library updates.
-    # - staging: maybe if no staging-next -> master PR has been cut yet?
-    #
-    # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=master";
-    nixpkgs-staging-unpatched.url = "github:nixos/nixpkgs?ref=staging";
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-staging-next";
-    nixpkgs-next-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
-  };
-
   outputs = {
     self,
-    nixpkgs-unpatched,
-    nixpkgs-next-unpatched ? nixpkgs-unpatched,
-    nixpkgs-staging-unpatched ? nixpkgs-unpatched,
-    ...
   }@inputs:
     let
       inherit (builtins) attrNames elem listToAttrs map mapAttrs;
@@ -66,52 +34,13 @@
       # mapAttrs but without the `name` argument
       mapAttrValues = f: mapAttrs (_: f);
 
-      # TODO: rename the various nixpkgs inputs to make this part more straightforward
+      nixpkgs' = import ./pkgs/additional/nixpkgs;
-      unpatchedNixpkgsByBranch = {
+      nixpkgsUnpatched = nixpkgs' { doPatch = false; localSystem = "x86_64-linux"; };
-        master = nixpkgs-unpatched;
-        staging-next = nixpkgs-next-unpatched;
-        staging = nixpkgs-staging-unpatched;
-      };
-      # rather than apply our nixpkgs patches as a flake input, do that here instead.
-      # this (temporarily?) resolves the bad UX wherein a subflake residing in the same git
-      # repo as the main flake causes the main flake to have an unstable hash.
-      # TODO: rename `variant` -> `branch`
-      patchNixpkgs = variant: (import ./nixpatches/flake.nix).outputs {
-        inherit variant;
-        nixpkgs = unpatchedNixpkgsByBranch."${variant}";
-        self = patchNixpkgs variant;
-      };
-
-      nixpkgs' = patchNixpkgs "master";
       nixpkgsCompiledBy = { system, variant ? "master" }:
-        (patchNixpkgs variant).legacyPackages."${system}";
+        (nixpkgs' { inherit variant system; }).legacyPackages."${system}";
 
-      evalHost = { name, local, target, variant ? null, nixpkgs ? nixpkgs' }: nixpkgs.lib.nixosSystem {
+      evalHost = { name, local, target, variant ? null, nixpkgs ? nixpkgs' { localSystem = local; system = target;} }: nixpkgs.nixos (
-        system = target;
+        [
-        modules = [
-          {
-            nixpkgs.buildPlatform.system = local;
-          }
-          (optionalAttrs (local != target) {
-            # XXX(2023/12/11): cache.nixos.org uses `system = ...` instead of `hostPlatform.system`, and that choice impacts the closure of every package.
-            # so avoid specifying hostPlatform.system on non-cross builds, so i can use upstream caches.
-            # nixpkgs.hostPlatform.system = target;
-            nixpkgs.hostPlatform = {
-              system = target;
-            } // optionalAttrs (target == "armv7a-linux") {
-              # as i desperately try to shrink the initramfs...
-              config = "armv7a-unknown-linux-musleabihf";
-              gcc = {
-                # arch = "armv7-a";
-                cpu = "cortex-a15";
-                fpu = "neon-vfpv4";
-                float-abi = "hard";
-              };
-              linux-kernel = {
-                target = "zImage";
-              };
-            };
-          })
           (optionalAttrs (variant == "light") {
             sane.maxBuildCost = 2;
           })
@@ -119,15 +48,15 @@
             sane.maxBuildCost = 0;
           })
           (import ./hosts/instantiate.nix { hostName = name; })
-          self.nixosModules.default
+          (import ./modules)
-          self.nixosModules.passthru
+          (nixpkgs.appendOverlays [ self.overlays.pkgs ]).sops-nix.nixosModules.sops
           {
             nixpkgs.overlays = [
               self.overlays.sane-all
             ];
           }
-        ];
+        ]
-      };
+      );
     in {
       nixosConfigurations = let
         hosts = {
@@ -141,19 +70,31 @@
           moby-light  = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; variant = "light"; };
           moby-min    = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; variant = "min"; };
           # crappy is technically armv7a, and armv7l uses only a _subset_ of the available ISA.
-          # but flakes don't expose that as a target.
+          # but it's not as widely cached.
           crappy      = { name = "crappy"; local = "x86_64-linux"; target = "armv7l-linux"; };
           crappy-min  = { name = "crappy"; local = "x86_64-linux"; target = "armv7l-linux"; variant = "min"; };
-          crappy-musl = { name = "crappy"; local = "x86_64-linux"; target = "armv7a-linux"; variant = "min"; };
+          crappy-7a   = { name = "crappy"; local = "x86_64-linux"; target = "armv7a-linux"; variant = "min"; };
           rescue      = { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux";  };
         };
         hostsNext = mapAttrs' (h: v: {
           name = "${h}-next";
-          value = v // { nixpkgs = patchNixpkgs "staging-next"; };
+          value = v // {
+            nixpkgs = nixpkgs' {
+              localSystem = v.local;
+              system = v.target;
+              variant = "staging-next";
+            };
+          };
         }) hosts;
         hostsStaging = mapAttrs' (h: v: {
           name = "${h}-staging";
-          value = v // { nixpkgs = patchNixpkgs "staging"; };
+          value = v // {
+            nixpkgs = nixpkgs' {
+              localSystem = v.local;
+              system = v.target;
+              variant = "staging";
+            };
+          };
         }) hosts;
       in mapAttrValues evalHost (
         hosts // hostsNext // hostsStaging
@@ -181,8 +122,6 @@
       hostPkgs = mapAttrValues (host: host.config.system.build.pkgs) self.nixosConfigurations;
       hostPrograms = mapAttrValues (host: mapAttrValues (p: p.package) host.config.sane.programs) self.nixosConfigurations;
 
-      patched.nixpkgs = nixpkgs';
-
       overlays = {
         # N.B.: `nix flake check` requires every overlay to take `final: prev:` at defn site,
         #   hence the weird redundancy.
@@ -192,22 +131,11 @@
         preferences = final: prev: import ./overlays/preferences.nix final prev;
       };
 
-      nixosModules = rec {
-        default = sane;
-        sane = import ./modules;
-        passthru = { ... }: {
-          imports = [
-            # TODO: vvv UGLY vvv
-            (nixpkgs-unpatched.legacyPackages.x86_64-linux.appendOverlays [ self.overlays.pkgs ]).sops-nix.nixosModules.sops
-          ];
-        };
-      };
-
       # this includes both our native packages and all the nixpkgs packages.
       legacyPackages =
         let
           allPkgsFor = variant: additionalOverlays: system:
-            (nixpkgsCompiledBy { inherit system variant; })
+            (nixpkgs' { inherit system variant; localSystem = "x86_64-linux"; })
             .appendOverlays (
               [
                 self.overlays.pkgs
@@ -244,7 +172,7 @@
         )
         # self.legacyPackages;
         {
-          x86_64-linux = nixpkgsCompiledBy { system = "x86_64-linux"; };
+          x86_64-linux = nixpkgs' { localSystem = "x86_64-linux"; };
         }
       ;
 
@@ -524,7 +452,7 @@
                 --option restrict-eval true \
                 --option allow-import-from-derivation true \
                 --drv-path --show-trace \
-                -I nixpkgs=${nixpkgs-unpatched} \
+                -I nixpkgs=${nixpkgsUnpatched} \
                 -I nixpkgs-overlays=${./.}/hosts/common/nix/overlay \
                 -I ../../ \
                 | tee  # tee to prevent interactive mode

hosts/common/default.nix

@@ -32,9 +32,6 @@
   sane.programs.sysadminUtils.enableFor.system = lib.mkDefault true;
   sane.programs.consoleUtils.enableFor.user.colin = lib.mkDefault true;
 
-  nixpkgs.config.allowUnfree = true;  # NIXPKGS_ALLOW_UNFREE=1
-  nixpkgs.config.allowBroken = true;  # NIXPKGS_ALLOW_BROKEN=1
-
   # time.timeZone = "America/Los_Angeles";
   time.timeZone = "Etc/UTC";  # DST is too confusing for me => use a stable timezone
 

hosts/modules/hal/pine64.nix

@@ -30,23 +30,24 @@ in
     # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
 
     # nixpkgs.hostPlatform.linux-kernel becomes stdenv.hostPlatform.linux-kernel
-    nixpkgs.hostPlatform.linux-kernel = {
+    # ^ but only if using flakes (or rather, if *not* using `nixpkgs.nixos` to construct the host config)
-      # defaults:
+    # nixpkgs.hostPlatform.linux-kernel = {
-      name = "aarch64-multiplatform";
+    #   # defaults:
-      # baseConfig: defaults to "defconfig";
+    #   name = "aarch64-multiplatform";
-      # baseConfig = "pinephone_defconfig";  #< N.B.: ignored by `pkgs.linux-megous`
+    #   # baseConfig: defaults to "defconfig";
-      DTB = true;  #< DTB: compile device tree blobs
+    #   # baseConfig = "pinephone_defconfig";  #< N.B.: ignored by `pkgs.linux-megous`
-      # autoModules (default: true): for config options not manually specified, answer `m` to anything which supports it.
+    #   DTB = true;  #< DTB: compile device tree blobs
-      # - this effectively builds EVERY MODULE SUPPORTED.
+    #   # autoModules (default: true): for config options not manually specified, answer `m` to anything which supports it.
-      autoModules = true;  #< N.B.: ignored by `pkgs.linux-megous`
+    #   # - this effectively builds EVERY MODULE SUPPORTED.
-      # preferBuiltin (default: false; true for rpi): for config options which default to `Y` upstream, build them as `Y` (overriding `autoModules`)
+    #   autoModules = true;  #< N.B.: ignored by `pkgs.linux-megous`
-      # preferBuiltin = false;
+    #   # preferBuiltin (default: false; true for rpi): for config options which default to `Y` upstream, build them as `Y` (overriding `autoModules`)
+    #   # preferBuiltin = false;
 
-      # build a compressed kernel image: without this i run out of /boot space in < 10 generations
+    #   # build a compressed kernel image: without this i run out of /boot space in < 10 generations
-      # target = "Image";  # <-- default
+    #   # target = "Image";  # <-- default
-      target = "Image.gz";  # <-- compress the kernel image
+    #   target = "Image.gz";  # <-- compress the kernel image
-      # target = "zImage";  # <-- confuses other parts of nixos :-(
+    #   # target = "zImage";  # <-- confuses other parts of nixos :-(
-    };
+    # };
 
     # boot.initrd.kernelModules = [
     #   "drm"  #< force drm to be plugged

nixpatches/02-rpi4-uboot.patch

@@ -1,16 +0,0 @@
-diff --git a/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix b/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-index a4352ab9a24..8a191e0f694 100644
---- a/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-+++ b/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-@@ -16,7 +16,10 @@ let
-       else
-         pkgs.ubootRaspberryPi3_32bit
-     else
--      throw "U-Boot is not yet supported on the raspberry pi 4.";
-+      if isAarch64 then
-+        pkgs.ubootRaspberryPi4_64bit
-+      else
-+        pkgs.ubootRaspberryPi4_32bit;
- 
-   extlinuxConfBuilder =
-     import ../generic-extlinux-compatible/extlinux-conf-builder.nix {

nixpatches/2023-03-03-qtbase-cross-compile.patch

@@ -1,21 +0,0 @@
-diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
-index e71b0a7613d..72779ac57a5 100644
---- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
-+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
-@@ -5,6 +5,7 @@
- , version
- , coreutils
- , bison
-+, buildPackages
- , flex
- , gdb
- , gperf
-@@ -224,6 +225,8 @@ stdenv.mkDerivation rec {
-   ] ++ lib.optionals stdenv.isDarwin [
-     # error: 'path' is unavailable: introduced in macOS 10.15
-     "-DQT_FEATURE_cxx17_filesystem=OFF"
-+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-+    "-DQT_HOST_PATH=${buildPackages.qt6.full}"
-   ];
- 
-   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [

nixpatches/2023-06-02-qt6-qtwebengine-cross.patch

@@ -1,31 +0,0 @@
-diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-index fadbc5d2bfa..e4f2aec5a32 100644
---- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-@@ -97,6 +97,9 @@
- , xnu
- }:
- 
-+let
-+  buildPython = buildPackages.python3.withPackages (ps: with ps; [ html5lib ]);
-+in
- qtModule {
-   pname = "qtwebengine";
-   qtInputs = [ qtdeclarative qtwebchannel qtwebsockets qtpositioning ];
-@@ -108,7 +111,7 @@ qtModule {
-     gperf
-     ninja
-     pkg-config
--    (python3.withPackages (ps: with ps; [ html5lib ]))
-+    buildPython
-     which
-     gn
-     nodejs
-@@ -304,6 +307,7 @@ qtModule {
- 
-   preConfigure = ''
-     export NINJAFLAGS="-j$NIX_BUILD_CORES"
-+    export CMAKE_PREFIX_PATH="${buildPython}/bin:$CMAKE_PREFIX_PATH"
-   '';
- 
-   meta = with lib; {

nixpatches/2023-06-06-jellyfin-no-libsForQt5-callPackage.patch

@@ -1,60 +0,0 @@
-diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
-index e781f80e455..d1990294141 100644
---- a/pkgs/applications/video/jellyfin-media-player/default.nix
-+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
-@@ -1,7 +1,6 @@
- { lib
- , fetchFromGitHub
- , fetchzip
--, mkDerivation
- , stdenv
- , Cocoa
- , CoreAudio
-@@ -12,21 +11,20 @@
- , libGL
- , libX11
- , libXrandr
-+, libsForQt5
- , libvdpau
- , mpv
- , ninja
- , pkg-config
- , python3
--, qtbase
--, qtwayland
--, qtwebchannel
--, qtwebengine
--, qtx11extras
- , jellyfin-web
- , withDbus ? stdenv.isLinux, dbus
- }:
- 
--mkDerivation rec {
-+let
-+  inherit (libsForQt5) qtbase qtwayland qtwebchannel qtwebengine qtx11extras wrapQtAppsHook;
-+in
-+stdenv.mkDerivation rec {
-   pname = "jellyfin-media-player";
-   version = "1.9.1";
- 
-@@ -69,6 +67,7 @@ mkDerivation rec {
-     ninja
-     pkg-config
-     python3
-+    wrapQtAppsHook
-   ];
- 
-   cmakeFlags = [
-diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
-index eb309c9b283..d8a718db698 100644
---- a/pkgs/top-level/all-packages.nix
-+++ b/pkgs/top-level/all-packages.nix
-@@ -5289,7 +5289,7 @@ with pkgs;
- 
-   jellyfin-ffmpeg = callPackage ../development/libraries/jellyfin-ffmpeg { };
- 
--  jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player {
-+  jellyfin-media-player = callPackage ../applications/video/jellyfin-media-player {
-     inherit (darwin.apple_sdk.frameworks) CoreFoundation Cocoa CoreAudio MediaPlayer;
-     # Disable pipewire to avoid segfault, see https://github.com/jellyfin/jellyfin-media-player/issues/341
-     mpv = wrapMpv (mpv-unwrapped.override { pipewireSupport = false; }) { };

nixpatches/flake.lock

@@ -1,25 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1675123384,
-        "narHash": "sha256-RpU+kboEWlIYwbRMGIPBIcztH63CvmqWN1B8GpJogd4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e0fa1ece2f3929726c9b98c539ad14b63ae8e4fd",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

nixpatches/flake.nix

@@ -1,72 +0,0 @@
-{
-  inputs = {
-    # user is expected to define this from their flake via `inputs.nixpkgs.follows = ...`
-    nixpkgs = {};
-  };
-  outputs = { self, nixpkgs, variant ? "master" }@inputs:
-    let
-      patchedPkgsFor = system: nixpkgs.legacyPackages.${system}.applyPatches {
-        name = "nixpkgs-patched-uninsane";
-        version = nixpkgs.sourceInfo.lastModifiedDate;
-        src = nixpkgs;
-        patches = builtins.filter (p: p != null) (
-          nixpkgs.legacyPackages."${system}".callPackage ./list.nix { } variant nixpkgs.lastModifiedDate
-        );
-      };
-      patchedFlakeFor = system: import "${patchedPkgsFor system}/flake.nix";
-      patchedFlakeOutputsFor = system: (patchedFlakeFor system).outputs {
-        self = self // self._forSystem system;
-      };
-
-      extractBuildPlatform = nixosSystemArgs:
-        builtins.foldl'
-          (acc: mod: ((mod.nixpkgs or {}).buildPlatform or {}).system or acc)
-          (nixosSystemArgs.system or null)
-          (nixosSystemArgs.modules or []);
-    in
-    {
-      # i attempt to mirror the non-patched nixpkgs flake outputs,
-      # however the act of patching is dependent on the build system (can't be done in pure nix),
-      # hence a 100% compatible interface has to be segmented by `system`:
-      _forSystem = system: {
-        inherit (patchedFlakeOutputsFor system) lib;
-        legacyPackages = builtins.mapAttrs
-          (system': _:
-            (patchedFlakeOutputsFor (if system != null then system else system'))
-              .legacyPackages."${system'}"
-          )
-          nixpkgs.legacyPackages;
-      };
-
-      # although i can't expose all of the patched nixpkgs outputs without knowing the `system` to use for patching,
-      # several outputs learn about the system implicitly, so i can expose those:
-      lib.nixosSystem = args: (
-        self._forSystem (extractBuildPlatform args)
-      ).lib.nixosSystem args;
-
-      legacyPackages = (self._forSystem null).legacyPackages;
-
-      # sourceInfo includes fields (square brackets for the ones which are not always present):
-      # - [dirtyRev]
-      # - [dirtyShortRev]
-      # - lastModified
-      # - lastModifiedDate
-      # - narHash
-      # - outPath
-      # - [rev]
-      # - [revCount]
-      # - [shortRev]
-      # - submodules
-      #
-      # these values are used within nixpkgs:
-      # - to give a friendly name to the nixos system (`readlink /run/current-system` -> `...nixos-system-desko-24.05.20240227.dirty`)
-      # - to alias `import <nixpkgs>` so that nix uses the system's nixpkgs when called externally (supposedly).
-      #
-      # these values seem to exist both within the `sourceInfo` attrset and at the top-level.
-      # for a list of all implicit flake outputs (which is what these seem to be):
-      # $ nix-repl
-      # > lf .
-      # > <tab>
-      inherit (nixpkgs) sourceInfo;
-    } // nixpkgs.sourceInfo;
-}

pkgs/additional/nixpkgs/default.nix

@@ -0,0 +1,63 @@
+# XXX: this is in the bootstrap path;
+# i'm pretty much restricted to using just `builtin`s here.
+#
+# branch workflow:
+# - daily:
+#   - nixos-unstable cut from master after enough packages have been built in caches.
+# - every 6 hours:
+#   - master auto-merged into staging and staging-next
+#   - staging-next auto-merged into staging.
+# - manually, approximately once per month:
+#   - staging-next is cut from staging.
+#   - staging-next merged into master.
+#
+# which branch to source from?
+# - nixos-unstable: for everyday development; it provides good caching
+# - master: temporarily if i'm otherwise cherry-picking lots of already-applied patches
+# - staging-next: if testing stuff that's been PR'd into staging, i.e. base library updates.
+# - staging: maybe if no staging-next -> master PR has been cut yet?
+{ variant ? "master"
+, doPatch ? true
+, localSystem ? builtins.currentSystem  #< not available in pure mode
+, system ? localSystem
+}:
+let
+  unpatchedSrc = builtins.fetchGit {
+    url = "https://github.com/NixOS/nixpkgs.git";
+    ref = variant;
+    rev = {
+      master = "716a7056386dcc67eb3b813289499d6329d4befc";
+      staging = "da9d22446697971278edcd4af92f63221f7d21f6";
+      staging-next = "5aa86ae5585cd46299ee46682fda8a9b76baf2ae";
+    }."${variant}";
+  };
+  unpatchedNixpkgs = import "${unpatchedSrc}" { inherit localSystem; };
+
+  patchesFor = unpatchedNixpkgs.callPackage ./list.nix { };
+
+  patchedSrc = unpatchedNixpkgs.applyPatches {
+    name = "nixpkgs-patched-uninsane";
+    # version = ...
+    src = unpatchedSrc;
+    patches = patchesFor {
+      inherit variant;
+      date = unpatchedSrc.lastModifiedDate;
+    };
+  };
+
+  src = if doPatch then patchedSrc else unpatchedSrc;
+  args = {
+    inherit localSystem;
+    config = {
+      allowUnfree = true;  # NIXPKGS_ALLOW_UNFREE=1
+      allowBroken = true;  # NIXPKGS_ALLOW_BROKEN=1
+    };
+  } // (if (system != localSystem) then {
+    # XXX(2023/12/11): cache.nixos.org uses `system = ...` instead of `hostPlatform.system`, and that choice impacts the closure of every package.
+    # so avoid specifying hostPlatform.system on non-cross builds, so i can use upstream caches.
+    crossSystem = system;
+  } else {});
+in
+  # N.B.: this is crafted to allow `nixpkgs.FOO` from other nix code
+  # AND `nix-build -A nixpkgs`
+  src // (import "${src}" args)

pkgs/additional/nixpkgs/list.nix

@@ -1,5 +1,5 @@
 { fetchpatch2, fetchurl, lib }:
-variant: date:
+{ variant, date }:
 let
   fetchpatch' = {
     saneCommit ? null,
@@ -25,7 +25,9 @@ let
       // (if hash != null then { inherit hash; } else {})
       // (if title != null then { name = title; } else {})
     ) else null;
-in [
+in
+builtins.filter (p: p != null)
+[
   # if a patch has been merged, use
   #   merged.staging = "<date>";
   #   merged.master = "<date>";

pkgs/default.nix

@@ -5,7 +5,7 @@
 # using the correct invocation is critical if any packages mentioned here are
 # additionally patched elsewhere
 #
-{ pkgs ? import <nixpkgs> {}, final ? null }:
+{ pkgs ? import ./additional/nixpkgs { }, final ? null }:
 let
   lib = pkgs.lib;
   unpatched = pkgs;
@@ -64,6 +64,10 @@ let
     modemmanager-split = callPackage ./additional/modemmanager-split { };
     mx-sanebot = callPackage ./additional/mx-sanebot { };
     networkmanager-split = callPackage ./additional/networkmanager-split { };
+    nixpkgs = import ./additional/nixpkgs {
+      localSystem = stdenv.buildPlatform.system;
+      system = stdenv.hostPlatform.system;
+    };
     nixpkgs-wayland = callPackage ./additional/nixpkgs-wayland { };
     peerswap = callPackage ./additional/peerswap { };
     phog = callPackage ./additional/phog { };