Merge staging-next into staging

2023-12-17 06:01:23 +00:00 · 2023-12-17 06:01:23 +00:00 · 01cb3d14eb
commit 01cb3d14eb
parent cacb3248e1 401ec44a3a
22 changed files with 451 additions and 80 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11248,6 +11248,12 @@
    github = "marius851000";
    githubId = 22586596;
  };
+  mariuskimmina = {
+    email = "mar.kimmina@gmail.com";
+    name = "Marius Kimmina";
+    github = "mariuskimmina";
+    githubId = 38843153;
+  };
  markbeep = {
    email = "mrkswrn@gmail.com";
    github = "markbeep";
@ -20449,6 +20455,15 @@
    githubId = 1557253;
    name = "Lennart Eichhorn";
  };
+  zedseven = {
+    name = "Zacchary Dempsey-Plante";
+    email = "zacc@ztdp.ca";
+    github = "zedseven";
+    githubId = 25164338;
+    keys = [{
+      fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875";
+    }];
+  };
  zendo = {
    name = "zendo";
    email = "linzway@qq.com";
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@ -212,7 +212,7 @@ in

    services.certmgr = {
      enable = true;
-      package = pkgs.certmgr-selfsigned;
+      package = pkgs.certmgr;
      svcManager = "command";
      specs =
        let
--- a/pkgs/applications/audio/jack-passthrough/default.nix
+++ b/pkgs/applications/audio/jack-passthrough/default.nix
@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, libjack2
+, meson
+, ninja
+, fmt_9
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jack-passthrough";
+  version = "2021-9-25";
+
+  # https://github.com/guysherman/jack-passthrough
+  src = fetchFromGitHub {
+    owner = "guysherman";
+    repo = finalAttrs.pname;
+    rev = "aad03b7c5ccc4a4dcb8fa38c49aa64cb9d628660";
+    hash = "sha256-9IsNaLW5dYAqiwe+vX0+D3oIKFP2TIfy1q1YaqmS6wE=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ fmt_9 libjack2 ];
+
+  meta = with lib; {
+    description = "A simple app to help with JACK apps that behave strangely.";
+    longDescription = ''
+      Creates a JACK passthrough client with an arbitrary name and number of
+      ports. Common uses include tricking stubborn applications into creating
+      more ports than they normally would or to prevent them from
+      auto-connecting to certain things.
+    '';
+    # license unknown: https://github.com/guysherman/jack-passthrough/issues/2
+    license = licenses.unfree;
+    maintainers = [ maintainers.PowerUser64 ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
--- a/pkgs/applications/misc/translatelocally/default.nix
+++ b/pkgs/applications/misc/translatelocally/default.nix
@ -1,19 +1,20 @@
 { lib, stdenv, fetchFromGitHub
 , cmake, qt6, libarchive, pcre2, protobuf, gperftools, blas
+, runCommand, translatelocally, translatelocally-models
 }:

 let
-  rev = "f8a2dba0a63989c6b3a7be36f736ed478cad1dd2";
+  rev = "a210037760ca3ca9016ca1831c97531318df70fe";

 in stdenv.mkDerivation (finalAttrs: {
  pname = "translatelocally";
-  version = "unstable-2023-08-25";
+  version = "unstable-2023-09-20";

  src = fetchFromGitHub {
    owner = "XapaJIaMnu";
    repo = "translateLocally";
    inherit rev;
-    hash = "sha256-uUdDi0CwCR/FQjw5D2s088d/Tp7NQOI0ia30oOhlGoc=";
+    hash = "sha256-T7cZdR09yDrPTwYxvDIaKTdV4mrB+gTHYVfch5BQ+PE=";
    fetchSubmodules = true;
  };

@ -26,6 +27,11 @@ in stdenv.mkDerivation (finalAttrs: {
      3rd_party/bergamot-translator/3rd_party/marian-dev/src/common/git_revision.h
  '';

+  # https://github.com/XapaJIaMnu/translateLocally/blob/81ed8b9/.github/workflows/build.yml#L330
+  postConfigure = lib.optionalString stdenv.isAarch64 ''
+    bash ../cmake/fix_ruy_build.sh .. .
+  '';
+
  nativeBuildInputs = [
    cmake
    protobuf
@ -48,6 +54,19 @@ in stdenv.mkDerivation (finalAttrs: {
    "-DCBLAS_LIBRARIES=-lcblas"
  ];

+  passthru.tests = {
+    cli-translate = runCommand "${finalAttrs.pname}-test-cli-translate" {
+      nativeBuildInputs = [
+        translatelocally
+        translatelocally-models.fr-en-tiny
+      ];
+    } ''
+      export LC_ALL="C.UTF-8"
+      echo "Bonjour" | translateLocally -m fr-en-tiny > $out
+      diff "$out" <(echo "Hello")
+    '';
+  };
+
  meta = with lib; {
    mainProgram = "translateLocally";
    homepage = "https://translatelocally.com/";
@ -55,8 +74,5 @@ in stdenv.mkDerivation (finalAttrs: {
    license = licenses.mit;
    maintainers = with maintainers; [ pacien ];
    platforms = platforms.linux;
-
-    # https://github.com/XapaJIaMnu/translateLocally/issues/150
-    broken = stdenv.isAarch64;
  };
 })
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@ -1,9 +1,11 @@
-{ fetchgit, fetchzip, lib }:
+{ lib, fetchgit, fetchzip }:

 lib.makeOverridable (
 # gitlab example
 { owner, repo, rev, protocol ? "https", domain ? "gitlab.com", name ? "source", group ? null
-, fetchSubmodules ? false, leaveDotGit ? false, deepClone ? false
+, fetchSubmodules ? false, leaveDotGit ? false
+, deepClone ? false, forceFetchGit ? false
+, sparseCheckout ? []
 , ... # For hash agility
 } @ args:

@ -11,15 +13,15 @@ let
  slug = lib.concatStringsSep "/" ((lib.optional (group != null) group) ++ [ owner repo ]);
  escapedSlug = lib.replaceStrings [ "." "/" ] [ "%2E" "%2F" ] slug;
  escapedRev = lib.replaceStrings [ "+" "%" "/" ] [ "%2B" "%25" "%2F" ] rev;
-  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "leaveDotGit" "deepClone" ];
+  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "forceFetchGit" "leaveDotGit" "deepClone" ];

-  useFetchGit = deepClone || fetchSubmodules || leaveDotGit;
+  useFetchGit = fetchSubmodules || leaveDotGit || deepClone || forceFetchGit || (sparseCheckout != []);
  fetcher = if useFetchGit then fetchgit else fetchzip;

  gitRepoUrl = "${protocol}://${domain}/${slug}.git";

  fetcherArgs = (if useFetchGit then {
-    inherit rev deepClone fetchSubmodules leaveDotGit;
+    inherit rev deepClone fetchSubmodules sparseCheckout leaveDotGit;
    url = gitRepoUrl;
  } else {
    url = "${protocol}://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${escapedRev}";
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -24,7 +24,7 @@
 # the rest are given to fetchurl as is
 , ... } @ args:

-assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'." true;
+assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'." true;

 let
  tmpFilename =
--- a/pkgs/by-name/en/endlines/package.nix
+++ b/pkgs/by-name/en/endlines/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "endlines";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = "mdolidon";
+    repo = "endlines";
+    rev = finalAttrs.version;
+    hash = "sha256-M0IyY/WXR8qv9/qx5G0pG3EKqMoZAP3fJTZ6sSSMMyQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "/usr/local" "$out"
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = {
+    homepage = "https://github.com/mdolidon/endlines";
+    description = "Easy conversion between new-line conventions";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ zedseven ];
+    mainProgram = "endlines";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@ -1,54 +1,70 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, wine-staging
-, makeBinaryWrapper
-, pkg-config
-, libGL
-, libxkbcommon
-, xorg
-}:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  pkg-config,
+  libGL,
+  libxkbcommon,
+  xorg,
+  wineWowPackages,
+  fetchpatch,
+}: let
+  # wine-staging doesn't support overrideAttrs for now
+  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+    patches =
+      (oldAttrs.patches or [])
+      ++ [
+        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
+        # Here are the currently applied patches for Roblox to run under WINE:
+        (fetchpatch {
+          name = "vinegar-wine-segrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
+          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+        })
+      ];
+  });
+in
+  buildGoModule rec {
+    pname = "vinegar";
+    version = "1.5.9";

-buildGoModule rec {
-  pname = "vinegar";
-  version = "1.5.9";
+    src = fetchFromGitHub {
+      owner = "vinegarhq";
+      repo = "vinegar";
+      rev = "v${version}";
+      hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
+    };

-  src = fetchFromGitHub {
-    owner = "vinegarhq";
-    repo = "vinegar";
-    rev = "v${version}";
-    hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
-  };
+    vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";

-  vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
+    nativeBuildInputs = [pkg-config makeBinaryWrapper];
+    buildInputs = [libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine];

-  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
-  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine-staging ];
+    buildPhase = ''
+      runHook preBuild
+      make PREFIX=$out
+      runHook postBuild
+    '';

-  buildPhase = ''
-    runHook preBuild
-    make PREFIX=$out
-    runHook postBuild
-  '';
+    installPhase = ''
+      runHook preInstall
+      make PREFIX=$out install
+      runHook postInstall
+    '';

-  installPhase = ''
-    runHook preInstall
-    make PREFIX=$out install
-    runHook postInstall
-  '';
+    postInstall = ''
+      wrapProgram $out/bin/vinegar \
+        --prefix PATH : ${lib.makeBinPath [wine]}
+    '';

-  postInstall = ''
-    wrapProgram $out/bin/vinegar \
-      --prefix PATH : ${lib.makeBinPath [ wine-staging ]}
-  '';
-
-  meta = with lib; {
-    description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
-    homepage = "https://github.com/vinegarhq/vinegar";
-    changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
-    mainProgram = "vinegar";
-    license = licenses.gpl3Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ nyanbinary ];
-  };
-}
+    meta = with lib; {
+      description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
+      homepage = "https://github.com/vinegarhq/vinegar";
+      changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+      mainProgram = "vinegar";
+      license = licenses.gpl3Only;
+      platforms = ["x86_64-linux" "i686-linux"];
+      maintainers = with maintainers; [nyanbinary];
+    };
+  }
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libebml";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner  = "Matroska-Org";
    repo   = "libebml";
    rev    = "release-${version}";
-    sha256 = "sha256-36SfZUHJ2sIvrrHox583cQqfWWcrL2zW1IHzgDchC9g=";
+    sha256 = "sha256-PIVBePTWceMgiENdaL9lvXIL/RQIrtg7l0OG2tO0SU8=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/miniaudio/default.nix
+++ b/pkgs/development/libraries/miniaudio/default.nix
@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "miniaudio";
-  version = "0.11.20";
+  version = "0.11.21";

  src = fetchFromGitHub {
    owner = "mackron";
    repo = "miniaudio";
    rev = version;
-    hash = "sha256-qIUqHLHTHFMtZU0GMZp5iWnoBJ/+Zv3tbLopSHolB4s=";
+    hash = "sha256-EOIykyUXYcdDeTYb/Mf3xgcxEpKS4us213tEFwm5mEI=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/physics/geant4/datasets.nix
+++ b/pkgs/development/libraries/physics/geant4/datasets.nix
@ -42,8 +42,8 @@ in

    {
      pname = "G4EMLOW";
-      version = "8.2";
-      sha256 = "sha256-PXdoJk/1pTvLlgh2BLvhHGC3/qkKqsj30SUhg+Go5Cc=";
+      version = "8.5";
+      sha256 = "sha256-ZrrKSaxdReKsEMEltPsmYiXlEYA+ZpgZCc6c0+m873M=";
      envvar = "LE";
    }

@ -77,15 +77,15 @@ in

    {
      pname = "G4ABLA";
-      version = "3.1";
-      sha256 = "sha256-dpiwUrWL8bmIa+rNvWr2B63B4Jn8cwq2shz38JDAJ+0=";
+      version = "3.3";
+      sha256 = "sha256-HgQbMlLunO+IbWJPdT5pMwOqMtfl7zu6h7NPNtkuorE=";
      envvar = "ABLA";
    }

    {
      pname = "G4INCL";
-      version = "1.0";
-      sha256 = "sha256-cWFhghrp89BWX788LPNPTgLj5RnrQZqCI27vIsLENn0=";
+      version = "1.2";
+      sha256 = "sha256-+ICxYHPuCpLXSU8ydqbVLU3h02d6DUx8WHADlu0OGn4=";
      envvar = "INCL";
    }

--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@ -48,12 +48,12 @@ in
 lib.warnIf (enableQT != false) "geant4: enableQT is deprecated, please use enableQt"

 stdenv.mkDerivation rec {
-  version = "11.1.3";
+  version = "11.2.0";
  pname = "geant4";

  src = fetchurl {
    url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-TF++pnidjWGe2sygYx1rUhGmDhv5l0w9P6ue+eImkvU=";
+    hash = "sha256-Rq1/qzxctL0L3XfdbT4igxhIGSNby8AbLRF9gbNVlqY=";
  };

  # Fix broken paths in a .pc
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@ -5,10 +5,12 @@
 , lxml
 , pytestCheckHook
 , pythonOlder
+, python
 , pytz
 , recurring-ical-events
 , requests
 , setuptools
+, toPythonModule
 , tzlocal
 , vobject
 , xandikos
@ -44,7 +46,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    pytestCheckHook
-    xandikos
+    (toPythonModule (xandikos.override { python3Packages = python.pkgs; }))
  ];

  pythonImportsCheck = [ "caldav" ];
--- a/pkgs/games/minesweep-rs/default.nix
+++ b/pkgs/games/minesweep-rs/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "minesweep-rs";
-  version = "6.0.39";
+  version = "6.0.41";

  src = fetchFromGitHub {
    owner = "cpcloud";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-gV+16gxXfogHFFAXz/aG+D/uaXbZTgVjYK24QQizQ0c=";
+    hash = "sha256-j72ragB4cwFGX08Zlz8eF3j+3dp7JZ64oJ461JoLIrU=";
  };

-  cargoHash = "sha256-D6HnpXxixmVugbjr5pMYZiVeGLgje41k3n3xic6Ecps=";
+  cargoHash = "sha256-QtAuUNhBIMz+j6h2DVLDxxWk8iMXy8G2pinS8115qr4=";

  meta = with lib; {
    description = "Sweep some mines for fun, and probably not for profit";
--- a/pkgs/games/teeworlds/default.nix
+++ b/pkgs/games/teeworlds/default.nix
@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, cmake, pkg-config, python3, alsa-lib
+{ fetchFromGitHub, fetchpatch, lib, stdenv, cmake, pkg-config, python3, alsa-lib
 , libX11, libGLU, SDL2, lua5_3, zlib, freetype, wavpack, icoutils
 , nixosTests
 , Cocoa
@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
    # Can't use fetchpatch or fetchpatch2 because of https://github.com/NixOS/nixpkgs/issues/32084
    # Using fetchurl instead is also not a good idea, see https://github.com/NixOS/nixpkgs/issues/32084#issuecomment-727223713
    ./rename-VERSION-to-VERSION.txt.patch
+    (fetchpatch {
+      name = "CVE-2021-43518.patch";
+      url = "https://salsa.debian.org/games-team/teeworlds/-/raw/a6c4b23c1ce73466e6d89bccbede70e61e8c9cba/debian/patches/CVE-2021-43518.patch";
+      hash = "sha256-2MmsucaaYjqLgMww1492gNmHmvBJm/NED+VV5pZDnBY=";
+    })
  ];

  postPatch = ''
--- a/pkgs/misc/translatelocally-models/default.nix
+++ b/pkgs/misc/translatelocally-models/default.nix
@ -0,0 +1,43 @@
+{ lib, stdenvNoCC, fetchurl }:
+
+let
+  modelSpecs = (builtins.fromJSON (builtins.readFile ./models.json));
+  withCodeAsKey = f: { code, ... }@attrs: lib.nameValuePair code (f attrs);
+  mkModelPackage = { name, code, version, url, checksum }:
+    stdenvNoCC.mkDerivation {
+      pname = "translatelocally-model-${code}";
+      version = toString version;
+
+      src = fetchurl {
+        inherit url;
+        sha256 = checksum;
+      };
+      dontUnpack = true;
+
+      installPhase = ''
+        TARGET="$out/share/translateLocally/models"
+        mkdir -p "$TARGET"
+        tar -xzf "$src" -C "$TARGET"
+
+        # avoid patching shebangs in inconsistently executable extra files
+        find "$out" -type f -exec chmod -x {} +
+      '';
+
+      meta = {
+        description = "translateLocally model - ${name}";
+        homepage = "https://translatelocally.com/";
+        # https://github.com/browsermt/students/blob/master/LICENSE.md
+        license = lib.licenses.cc-by-sa-40;
+      };
+    };
+  allModelPkgs =
+    lib.listToAttrs (map (withCodeAsKey mkModelPackage) modelSpecs);
+
+in allModelPkgs // {
+  is-en-tiny = allModelPkgs.is-en-tiny.overrideAttrs (super: {
+    # missing model https://github.com/XapaJIaMnu/translateLocally/issues/147
+    meta = super.meta // { broken = true; };
+  });
+} // {
+  passthru.updateScript = ./update.sh;
+}
--- a/pkgs/misc/translatelocally-models/models.json
+++ b/pkgs/misc/translatelocally-models/models.json
@ -0,0 +1,149 @@
+[
+  {
+    "version": 1,
+    "checksum": "3714539160d5b4dce3ce0d829939315e3daffeaff53647249cc6336d745c09f2",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.base.tar.gz",
+    "name": "Czech-English base",
+    "code": "cs-en-base"
+  },
+  {
+    "version": 1,
+    "checksum": "693aa14ecb86275169ad4b01cbca294f3bd38d8d9bc1fad8dd89fa7e937e7d2c",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.tiny11.tar.gz",
+    "name": "Czech-English tiny",
+    "code": "cs-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "7a57b4e3a11a2c5e03fc6855ffc2b8f61ce3f1a68aeefa4592577a9eebe25031",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.base.tar.gz",
+    "name": "English-Czech base",
+    "code": "en-cs-base"
+  },
+  {
+    "version": 1,
+    "checksum": "f999d6511bdb4f1ff246b0563fdf9b71d836e1c3037fe5306a61836d3b5b8d19",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.tiny11.tar.gz",
+    "name": "English-Czech tiny",
+    "code": "en-cs-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "e7362faa83c4f61e552adf8fbd4bc528fe706746eb9fc1c286ec9af7566e3daf",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.base.tar.gz",
+    "name": "German-English base",
+    "code": "de-en-base"
+  },
+  {
+    "version": 2,
+    "checksum": "5c11b6ccfa0533fd5632b3cbccbb054972076266e2d1d989d3babb0ec0b10e28",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.tiny11.tar.gz",
+    "name": "German-English tiny",
+    "code": "de-en-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "cf9ab5a41ce359672ab47579686f9af50fc1fe040552c375ca86912f0fce7827",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.base.tar.gz",
+    "name": "English-German base",
+    "code": "en-de-base"
+  },
+  {
+    "version": 2,
+    "checksum": "0e85d1d7ee4f8a3ec12680696ffc11fa97d67a54d068ceafcf390a87df94877f",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.tiny11.tar.gz",
+    "name": "English-German tiny",
+    "code": "en-de-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "adf49d0e2f21b82414bc353ae1f0904d93360caa92203ae9f2fc209a83882d81",
+    "url": "https://data.statmt.org/bergamot/models/esen/esen.student.tiny11.tar.gz",
+    "name": "Spanish-English tiny",
+    "code": "es-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "6594dda2a4f5d333969c30f8356f4a9f3fe15a9f8a5fd018b0d85b9d9ad2abb0",
+    "url": "https://data.statmt.org/bergamot/models/esen/enes.student.tiny11.tar.gz",
+    "name": "English-Spanish tiny",
+    "code": "en-es-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "05c6525549c9c621e348f8de74533764ad7696aba8245fc9a504116f8ef4053c",
+    "url": "https://data.statmt.org/bergamot/models/eten/eten.student.tiny11.tar.gz",
+    "name": "Estonian-English tiny",
+    "code": "et-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "afce6c566270abdd4db332e8dcf4fe22057ada3b2a1171aab04d0d4817396fb5",
+    "url": "https://data.statmt.org/bergamot/models/eten/enet.student.tiny11.tar.gz",
+    "name": "English-Estonian tiny",
+    "code": "en-et-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "5c1696747590d1a75bef67348dce96bcd3889eb5a06a0f670c3d7232ed79f60e",
+    "url": "https://data.statmt.org/bergamot/models/isen/isen.student.tiny11.tar.gz",
+    "name": "Icelandic-English tiny",
+    "code": "is-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "9f5dde2f4f87438c24c9561990636e624c53b527ddc8505f822b22b073069de8",
+    "url": "https://data.statmt.org/bergamot/models/nben/nben.student.tiny11.tar.gz",
+    "name": "Norwegian (Bokmål)-English tiny",
+    "code": "nb-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "0bb4b83560caaffae95940574d939999092800a7803fae4c79a97e6481887a4f",
+    "url": "https://data.statmt.org/bergamot/models/nnen/nnen.student.tiny11.tar.gz",
+    "name": "Norwegian (Nynorsk)-English tiny",
+    "code": "nn-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "ecfe9c2b0be3406c0205ad2da58f4005893a4ae969e81dd9c523093cf5c7abc3",
+    "url": "https://data.statmt.org/bergamot/models/bgen/bgen.student.tiny11.tar.gz",
+    "name": "Bulgarian-English tiny",
+    "code": "bg-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "eb9a7511ae9c89fb91ab6da1e9d5061946ad752e5801351f39c8eddca9705c74",
+    "url": "https://data.statmt.org/bergamot/models/bgen/enbg.student.tiny11.tar.gz",
+    "name": "English-Bulgarian tiny",
+    "code": "en-bg-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "87148203cbda28421d76fffbd7d3cd6c1fc0d6dae2843c248870274d6512a388",
+    "url": "https://data.statmt.org/bergamot/models/plen/plen.student.tiny11.tar.gz",
+    "name": "Polish-English tiny",
+    "code": "pl-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "c33219daa12e7872cf7ac8a1b86a2f3e0592ebadd7e756bf11d16d9a7725cf9b",
+    "url": "https://data.statmt.org/bergamot/models/plen/enpl.student.tiny11.tar.gz",
+    "name": "English-Polish tiny",
+    "code": "en-pl-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "817a45ed9ec3228bfb797e5e14781ab7fe9f388fe1e834e280031f05089809f8",
+    "url": "https://data.statmt.org/bergamot/models/fren/fren.student.tiny11.tar.gz",
+    "name": "French-English tiny",
+    "code": "fr-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "28deea86d2a02102a7fedf19391a7628386f01f1f532d430306a9728dc5ec2d6",
+    "url": "https://data.statmt.org/bergamot/models/fren/enfr.student.tiny11.tar.gz",
+    "name": "English-French tiny",
+    "code": "en-fr-tiny"
+  }
+]
--- a/pkgs/misc/translatelocally-models/update.sh
+++ b/pkgs/misc/translatelocally-models/update.sh
@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl -p jq
+
+set -eu -o pipefail
+
+curl https://translatelocally.com/models.json \
+  | jq '.models | map(with_entries(select([.key] | inside([
+      "name",
+      "code",
+      "version",
+      "url",
+      "checksum"
+    ]))))' \
+  > "$(dirname "$0")/models.json"
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests, nix-update-script }:
 buildGoModule rec {
  pname = "mimir";
-  version = "2.10.4";
+  version = "2.10.5";

  src = fetchFromGitHub {
    rev = "${pname}-${version}";
    owner = "grafana";
    repo = pname;
-    hash = "sha256-0OFuMWoYgo8qCxWk93wOy45diLb2JIBsoxptLKTeOC4=";
+    hash = "sha256-+Xlejvdpum1UMUhELUzcF9bJOXx4tIkDA8wHrE88U5w=";
  };

  vendorHash = null;
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "cnquery";
+  version = "9.11.0";
+
+  src = fetchFromGitHub {
+    owner = "mondoohq";
+    repo = "cnquery";
+    rev = "v${version}";
+    hash = "sha256-3fyX6vz3lqnV07gu/H7qeIrLyNSbqhLpICJWqPTv7T0=";
+  };
+
+  subPackages = [ "apps/cnquery" ];
+
+  vendorHash = "sha256-7zZRX0LWDmO7LA0fIjAh8+5kK2dcAV/4HQmKdn9I3Mg=";
+
+  meta = with lib; {
+    description = "cloud-native, graph-based asset inventory";
+    longDescription = ''
+    cnquery is a cloud-native tool for querying your entire fleet. It answers thousands of questions about your infrastructure and integrates with over 300 resources across cloud accounts, Kubernetes, containers, services, VMs, APIs, and more.
+      '';
+    homepage = "https://mondoo.com/cnquery";
+    changelog = "https://github.com/mondoohq/cnquery/releases/tag/v${version}";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [ mariuskimmina ];
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1068,7 +1068,7 @@ mapAliases ({
  inherit (stdenv) buildPlatform hostPlatform targetPlatform; # Added 2023-01-09

  # LLVM packages for (integration) testing that should not be used inside Nixpkgs:
-  llvmPackages_latest = llvmPackages_16;
+  llvmPackages_latest = llvmPackages_17;
  llvmPackages_git = recurseIntoAttrs (callPackage ../development/compilers/llvm/git {
    inherit (stdenvAdapters) overrideCC;
    buildLlvmTools = buildPackages.llvmPackages_git.tools;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -518,6 +518,8 @@ with pkgs;

  cm256cc = callPackage ../development/libraries/cm256cc {  };

+  cnquery = callPackage ../tools/security/cnquery { };
+
  cocogitto = callPackage ../development/tools/cocogitto {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
@ -14108,6 +14110,8 @@ with pkgs;

  translatelocally = callPackage ../applications/misc/translatelocally { };

+  translatelocally-models = recurseIntoAttrs (callPackages ../misc/translatelocally-models { });
+
  translate-shell = callPackage ../applications/misc/translate-shell { };

  translatepy = with python3.pkgs; toPythonApplication translatepy;
@ -32991,6 +32995,8 @@ with pkgs;

  jack_oscrolloscope = callPackage ../applications/audio/jack-oscrolloscope { };

+  jack-passthrough = callPackage ../applications/audio/jack-passthrough { };
+
  jack_rack = callPackage ../applications/audio/jack-rack { };

  jackmeter = callPackage ../applications/audio/jackmeter { };