Merge master into staging-next

nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md

@@ -75,9 +75,10 @@ image with a new one or by updating partitions via an A/B scheme. See the
 [Chrome OS update process][chrome-os-update] for an example of how to achieve
 this. The appliance image built in the following example does not contain a
 `configuration.nix` and thus you will not be able to call `nixos-rebuild` from
-this system.
+this system. Furthermore, it uses a [Unified Kernel Image][unified-kernel-image].
 
 [chrome-os-update]: https://chromium.googlesource.com/aosp/platform/system/update_engine/+/HEAD/README.md
+[unified-kernel-image]: https://uapi-group.org/specifications/specs/unified_kernel_image/
 
 ```nix
 let
@@ -101,18 +102,8 @@ in
             "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
               "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
-            "/loader/entries/nixos.conf".source = pkgs.writeText "nixos.conf" ''
+            "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
-              title NixOS
+              "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
-              linux /EFI/nixos/kernel.efi
-              initrd /EFI/nixos/initrd.efi
-              options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
-            '';
-
-            "/EFI/nixos/kernel.efi".source =
-              "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
-
-            "/EFI/nixos/initrd.efi".source =
-              "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
           };
           repartConfig = {
             Type = "esp";

nixos/modules/misc/version.nix

@@ -5,34 +5,39 @@ let
   opt = options.system.nixos;
 
   inherit (lib)
-    concatStringsSep mapAttrsToList toLower
+    concatStringsSep mapAttrsToList toLower optionalString
     literalExpression mkRenamedOptionModule mkDefault mkOption trivial types;
 
   needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
   escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
   attrsToText = attrs:
-    concatStringsSep "\n" (
+    concatStringsSep "\n"
-      mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs
+      (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)
-    ) + "\n";
+    + "\n";
 
-  osReleaseContents = {
+  osReleaseContents =
-    NAME = "${cfg.distroName}";
+    let
-    ID = "${cfg.distroId}";
+      isNixos = cfg.distroId == "nixos";
-    VERSION = "${cfg.release} (${cfg.codeName})";
+    in
-    VERSION_CODENAME = toLower cfg.codeName;
+    {
-    VERSION_ID = cfg.release;
+      NAME = "${cfg.distroName}";
-    BUILD_ID = cfg.version;
+      ID = "${cfg.distroId}";
-    PRETTY_NAME = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
+      VERSION = "${cfg.release} (${cfg.codeName})";
-    LOGO = "nix-snowflake";
+      VERSION_CODENAME = toLower cfg.codeName;
-    HOME_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/";
+      VERSION_ID = cfg.release;
-    DOCUMENTATION_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/learn.html";
+      BUILD_ID = cfg.version;
-    SUPPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/community.html";
+      PRETTY_NAME = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
-    BUG_REPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://github.com/NixOS/nixpkgs/issues";
+      LOGO = "nix-snowflake";
-    IMAGE_ID = lib.optionalString (config.system.image.id != null) config.system.image.id;
+      HOME_URL = optionalString isNixos "https://nixos.org/";
-    IMAGE_VERSION = lib.optionalString (config.system.image.version != null) config.system.image.version;
+      DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
-  } // lib.optionalAttrs (cfg.variant_id != null) {
+      SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
-    VARIANT_ID = cfg.variant_id;
+      BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
-  };
+      ANSI_COLOR = optionalString isNixos "1;34";
+      IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
+      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+    } // lib.optionalAttrs (cfg.variant_id != null) {
+      VARIANT_ID = cfg.variant_id;
+    };
 
   initrdReleaseContents = (removeAttrs osReleaseContents [ "BUILD_ID" ]) // {
     PRETTY_NAME = "${osReleaseContents.PRETTY_NAME} (Initrd)";
@@ -56,60 +61,61 @@ in
   };
 
   options.system = {
+    nixos = {
+      version = mkOption {
+        internal = true;
+        type = types.str;
+        description = lib.mdDoc "The full NixOS version (e.g. `16.03.1160.f2d4ee1`).";
+      };
 
-    nixos.version = mkOption {
+      release = mkOption {
-      internal = true;
+        readOnly = true;
-      type = types.str;
+        type = types.str;
-      description = lib.mdDoc "The full NixOS version (e.g. `16.03.1160.f2d4ee1`).";
+        default = trivial.release;
-    };
+        description = lib.mdDoc "The NixOS release (e.g. `16.03`).";
+      };
 
-    nixos.release = mkOption {
+      versionSuffix = mkOption {
-      readOnly = true;
+        internal = true;
-      type = types.str;
+        type = types.str;
-      default = trivial.release;
+        default = trivial.versionSuffix;
-      description = lib.mdDoc "The NixOS release (e.g. `16.03`).";
+        description = lib.mdDoc "The NixOS version suffix (e.g. `1160.f2d4ee1`).";
-    };
+      };
 
-    nixos.versionSuffix = mkOption {
+      revision = mkOption {
-      internal = true;
+        internal = true;
-      type = types.str;
+        type = types.nullOr types.str;
-      default = trivial.versionSuffix;
+        default = trivial.revisionWithDefault null;
-      description = lib.mdDoc "The NixOS version suffix (e.g. `1160.f2d4ee1`).";
+        description = lib.mdDoc "The Git revision from which this NixOS configuration was built.";
-    };
+      };
 
-    nixos.revision = mkOption {
+      codeName = mkOption {
-      internal = true;
+        readOnly = true;
-      type = types.nullOr types.str;
+        type = types.str;
-      default = trivial.revisionWithDefault null;
+        default = trivial.codeName;
-      description = lib.mdDoc "The Git revision from which this NixOS configuration was built.";
+        description = lib.mdDoc "The NixOS release code name (e.g. `Emu`).";
-    };
+      };
 
-    nixos.codeName = mkOption {
+      distroId = mkOption {
-      readOnly = true;
+        internal = true;
-      type = types.str;
+        type = types.str;
-      default = trivial.codeName;
+        default = "nixos";
-      description = lib.mdDoc "The NixOS release code name (e.g. `Emu`).";
+        description = lib.mdDoc "The id of the operating system";
-    };
+      };
 
-    nixos.distroId = mkOption {
+      distroName = mkOption {
-      internal = true;
+        internal = true;
-      type = types.str;
+        type = types.str;
-      default = "nixos";
+        default = "NixOS";
-      description = lib.mdDoc "The id of the operating system";
+        description = lib.mdDoc "The name of the operating system";
-    };
+      };
 
-    nixos.distroName = mkOption {
+      variant_id = mkOption {
-      internal = true;
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
-      type = types.str;
+        default = null;
-      default = "NixOS";
+        description = lib.mdDoc "A lower-case string identifying a specific variant or edition of the operating system";
-      description = lib.mdDoc "The name of the operating system";
+        example = "installer";
-    };
+      };
-
-    nixos.variant_id = mkOption {
-      type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
-      default = null;
-      description = lib.mdDoc "A lower-case string identifying a specific variant or edition of the operating system";
-      example = "installer";
     };
 
     image = {

nixos/modules/services/misc/gitlab.nix

@@ -1386,10 +1386,8 @@ in {
 
     systemd.services.gitlab-db-config = {
       after = [ "gitlab-config.service" "gitlab-postgresql.service" "postgresql.service" ];
-      bindsTo = [
+      wants = optional (cfg.databaseHost == "") "postgresql.service" ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
-        "gitlab-config.service"
+      bindsTo = [ "gitlab-config.service" ];
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service"
-        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       serviceConfig = {
@@ -1422,10 +1420,10 @@ in {
         "gitlab-db-config.service"
       ];
       bindsTo = [
-        "redis-gitlab.service"
         "gitlab-config.service"
         "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment = gitlabEnv // (optionalAttrs cfg.sidekiq.memoryKiller.enable {
@@ -1612,10 +1610,10 @@ in {
         "gitlab-db-config.service"
       ];
       bindsTo = [
-        "redis-gitlab.service"
         "gitlab-config.service"
         "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
       requiredBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment = gitlabEnv;

nixos/modules/services/web-apps/tt-rss.nix

@@ -4,6 +4,8 @@ with lib;
 let
   cfg = config.services.tt-rss;
 
+  inherit (cfg) phpPackage;
+
   configVersion = 26;
 
   dbPort = if cfg.database.port == null
@@ -26,7 +28,7 @@ let
       ;
   in pkgs.writeText "config.php" ''
     <?php
-      putenv('TTRSS_PHP_EXECUTABLE=${pkgs.php}/bin/php');
+      putenv('TTRSS_PHP_EXECUTABLE=${phpPackage}/bin/php');
 
       putenv('TTRSS_LOCK_DIRECTORY=${cfg.root}/lock');
       putenv('TTRSS_CACHE_DIR=${cfg.root}/cache');
@@ -456,6 +458,15 @@ let
         '';
       };
 
+      phpPackage = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.php;
+        defaultText = "pkgs.php";
+        description = lib.mdDoc ''
+          php package to use for php fpm and update daemon.
+        '';
+      };
+
       plugins = mkOption {
         type = types.listOf types.str;
         default = ["auth_internal" "note"];
@@ -543,7 +554,7 @@ let
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
         inherit (cfg) user;
-        phpPackage = pkgs.php81;
+        inherit phpPackage;
         settings = mapAttrs (name: mkDefault) {
           "listen.owner" = "nginx";
           "listen.group" = "nginx";
@@ -605,13 +616,13 @@ let
         description = "Tiny Tiny RSS feeds update daemon";
 
         preStart = ''
-          ${pkgs.php81}/bin/php ${cfg.root}/www/update.php --update-schema --force-yes
+          ${phpPackage}/bin/php ${cfg.root}/www/update.php --update-schema --force-yes
         '';
 
         serviceConfig = {
           User = "${cfg.user}";
           Group = "tt_rss";
-          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
+          ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
           Restart = "on-failure";
           RestartSec = "60";
           SyslogIdentifier = "tt-rss";

nixos/tests/gitlab.nix

@@ -419,7 +419,7 @@ in {
       gitlab.systemctl("start gitlab-backup.service")
       gitlab.wait_for_unit("gitlab-backup.service")
       gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
-      gitlab.systemctl("stop postgresql.service gitlab.target")
+      gitlab.systemctl("stop postgresql.service gitlab-config.service gitlab.target")
       gitlab.succeed(
           "find ${nodes.gitlab.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
       )

pkgs/applications/graphics/xv/default.nix

@@ -7,26 +7,25 @@
   libpng,
   libwebp,
   libtiff,
-  libjpeg,
   jasper,
 }:
 
 stdenv.mkDerivation rec {
   pname = "xv";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "xv";
     rev = "v${version}";
-    sha256 = "TXUcdrwtPNiS7z795RbzBXzNYRADeVtF5uz4aovLo/M=";
+    sha256 = "sha256-ATV/LxXQNJB6rjBmurx6a1gRPR8zNuILstvEJoQJhUs=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ xorg.libX11 xorg.libXt libpng libwebp libtiff jasper ];
 
   meta = {
-    description = "Classic image viewer and editor for X.";
+    description = "Classic image viewer and editor for X";
     homepage = "http://www.trilon.com/xv/";
     license = {
       fullName = "XV License";

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -15,9 +15,9 @@
         version = "2023-11-28";
       };
     };
-    hash = "sha256-pZHa4YSJ4rK24f7dNUFeoyf6nDSQeY4MTR81YzPKCtQ=";
+    hash = "sha256-mncN1Np/70r0oMnJ4oV7PU6Ivi5AiRar5O2G8bNdwY8=";
-    hash_deb_amd64 = "sha256-cMoYBCuOYzXS7OzFvvBfSL80hBY/PcEv9kWGSx3mCKw=";
+    hash_deb_amd64 = "sha256-t/5Mx3P3LaH/6GjwMFP+lVoz7xq7jqAKYxLqlWBnwIE=";
-    version = "121.0.6167.139";
+    version = "121.0.6167.160";
   };
   ungoogled-chromium = {
     deps = {

pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix

@@ -44,6 +44,11 @@ let
         --replace "igraph_scg_grouping3" "" \
         --replace "igraph_scg_semiprojectors2" ""
     '';
+    NIX_CFLAGS_COMPILE = (prev.NIX_CFLAGS_COMPILE or []) ++ lib.optionals stdenv.cc.isClang [
+      "-Wno-strict-prototypes"
+      "-Wno-unused-but-set-parameter"
+      "-Wno-unused-but-set-variable"
+    ];
     # general options brought back from the old 0.9.x package
     buildInputs = prev.buildInputs ++ [ suitesparse ];
     cmakeFlags = prev.cmakeFlags ++ [ "-DIGRAPH_USE_INTERNAL_CXSPARSE=OFF" ];
@@ -138,7 +143,6 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
     homepage = "https://github.com/emsec/hal";
     license = licenses.mit;

pkgs/by-name/aw/aws-gate/disable-bootstrap.patch

@@ -38,14 +38,3 @@ index ac37c2f..9743415 100644
      elif args.subcommand == "exec":
          exec(
              config=config,
-diff --git a/requirements/requirements.txt b/requirements/requirements.txt
-index 50b203e..8c3496f 100644
---- a/requirements/requirements.txt
-+++ b/requirements/requirements.txt
-@@ -3,5 +3,4 @@ cryptography==39.0.2
- marshmallow==3.19.0
- packaging==23.0
- PyYAML>=5.1,<6.1
--requests==2.28.2
- unix-ar==0.2.1
- wrapt==1.15.0

pkgs/by-name/aw/aws-gate/package.nix

@@ -26,14 +26,25 @@ python3Packages.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
+    installShellFiles
+    python3Packages.pythonRelaxDepsHook
     python3Packages.setuptools
     python3Packages.wheel
-    installShellFiles
   ];
 
-  propagatedBuildInputs = [ ssm-session-manager-plugin ] ++ builtins.attrValues {
+  pythonRelaxDeps = true;
-    inherit (python3Packages) marshmallow boto3 pyyaml wrapt cryptography;
+
-  };
+  propagatedBuildInputs = [
+    python3Packages.boto3
+    python3Packages.cryptography
+    python3Packages.marshmallow
+    python3Packages.packaging
+    python3Packages.pyyaml
+    python3Packages.requests
+    python3Packages.unix-ar
+    python3Packages.wrapt
+    ssm-session-manager-plugin
+  ];
 
   postInstall = ''
     installShellCompletion --bash completions/bash/aws-gate

pkgs/by-name/bi/bitmagnet/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "bitmagnet";
-  version = "0.5.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "bitmagnet-io";
     repo = "bitmagnet";
     rev = "v${version}";
-    hash = "sha256-tqxmPr7O3WkFgo8tYk4iFr/k76Z5kq75YF+6uDuBOik=";
+    hash = "sha256-17jRktEqBCAXiddx8FnqHg3+c/03nqKHC8BQc9AhQA0=";
   };
 
   vendorHash = "sha256-YfsSz72CeHdrh5610Ilo1NYxlCT993hxWRWh0OsvEQc=";

pkgs/by-name/nw/nwg-hello/package.nix

@@ -0,0 +1,67 @@
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk-layer-shell
+, gtk3
+, python3Packages
+, wrapGAppsHook
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nwg-hello";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = "nwg-hello";
+    rev = "v${version}";
+    hash = "sha256-+D89QTFUV7/dhfcOWnQshG8USh35Vdm/QPHbsxiV0j0=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    gtk-layer-shell
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.pygobject3
+  ];
+
+  postPatch = ''
+    # hard coded paths
+    substituteInPlace nwg_hello/main.py \
+      --replace '/etc/nwg-hello' "$out/etc/nwg-hello" \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg-hello-default.json \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg_hello/ui.py --replace '/usr/share/nwg-hello' "$out/share/nwg-hello"
+  '';
+
+  postInstall = ''
+    install -D -m 644 -t "$out/etc/nwg-hello/" nwg-hello-default.json nwg-hello-default.css hyprland.conf sway-config README
+    install -D -m 644 -t "$out/share/nwg-hello/" nwg.jpg
+    install -D -m 644 -t "$out/share/nwg-hello/" img/*
+  '';
+
+  # Upstream has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "nwg_hello" ];
+
+  meta = {
+    homepage = "https://github.com/nwg-piotr/nwg-hello";
+    description = "GTK3-based greeter for the greetd daemon, written in python";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ ];
+    mainProgram = "nwg-hello";
+  };
+}

pkgs/by-name/pd/pdf-sign/package.nix

@@ -10,12 +10,12 @@
 }:
 
 let
-  python-env = python3.withPackages (ps: with ps; [ tkinter ]);
+  python = python3.withPackages (ps: with ps; [ tkinter ]);
   binPath = lib.makeBinPath [ ghostscript pdftk poppler_utils ];
 in
 stdenv.mkDerivation {
   pname = "pdf-sign";
-  version = "unstable-2023-08-08";
+  version = "0-unstable-2023-08-08";
 
   src = fetchFromGitHub {
     owner = "svenssonaxel";
@@ -26,18 +26,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
+  buildInputs = [ python ];
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out
+    install -Dm755 pdf-sign pdf-create-empty -t $out/bin
-    cp pdf-sign pdf-create-empty $out
+    wrapProgram $out/bin/pdf-sign --prefix PATH : ${binPath}
-
+    wrapProgram $out/bin/pdf-create-empty --prefix PATH : ${binPath}
-    makeWrapper ${python-env}/bin/python $out/bin/pdf-sign \
-          --add-flags $out/pdf-sign \
-          --prefix PATH : ${binPath}
-    makeWrapper ${python-env}/bin/python $out/bin/pdf-create-empty \
-          --add-flags $out/pdf-create-empty \
-          --prefix PATH : ${binPath}
 
     runHook postInstall
   '';

pkgs/by-name/sm/smb3-foundry/package.nix

@@ -2,11 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , python3
-, makeWrapper
 }:
 
 let
-  pythonEnv = (python3.withPackages (ps: with ps; [
+  python = (python3.withPackages (ps: with ps; [
     pyside6
     py65
     qdarkstyle
@@ -23,18 +22,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8cf7VhvC372Cqi94n2FSHcoCGblpZoZvBXcXq5jU6CY=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/app
+    mkdir -p $out/share/smb3-foundry $out/bin
-    cp -R smb3parse foundry scribe data doc VERSION smb3-foundry.py smb3-scribe.py $out/app
+    cp -r smb3parse foundry scribe data doc VERSION smb3-foundry.py smb3-scribe.py $out/share/smb3-foundry
 
-    makeWrapper ${pythonEnv}/bin/python $out/bin/smb3-foundry \
+    ln -s $out/share/smb3-foundry/smb3-foundry.py $out/bin/smb3-foundry
-          --add-flags "$out/app/smb3-foundry.py"
+    ln -s $out/share/smb3-foundry/smb3-scribe.py $out/bin/smb3-scribe
-    makeWrapper ${pythonEnv}/bin/python $out/bin/smb3-scribe \
-          --add-flags "$out/app/smb3-scribe.py"
 
     runHook postInstall
   '';

pkgs/by-name/sn/snicat/package.nix

@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildGoPackage
 , fetchFromGitHub
 }:
@@ -14,19 +13,12 @@ buildGoPackage rec {
     hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
   };
 
-  patchPhase = ''
-    runHook prePatch
-
-    substituteInPlace snicat.go \
-      --replace-warn "v0.0.0" "v${version}"
-
-    runHook postPatch
-  '';
-
   goPackagePath = "github.com/CTFd/snicat";
 
   goDeps = ./deps.nix;
 
+  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
+
   installPhase = ''
     runHook preInstall
 

pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch

@@ -0,0 +1,45 @@
+From a29cffa646356228d6ec7bd7ce21fe3ab90fdd19 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Wed, 7 Feb 2024 16:59:09 +0000
+Subject: [PATCH] eigen: allow dependency injection
+
+---
+ cmake/external/eigen.cmake | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/cmake/external/eigen.cmake b/cmake/external/eigen.cmake
+index c0f7ddc50e..996b83d18a 100644
+--- a/cmake/external/eigen.cmake
++++ b/cmake/external/eigen.cmake
+@@ -1,4 +1,3 @@
+-
+ if (onnxruntime_USE_PREINSTALLED_EIGEN)
+     add_library(eigen INTERFACE)
+     file(TO_CMAKE_PATH ${eigen_SOURCE_PATH} eigen_INCLUDE_DIRS)
+@@ -10,14 +9,21 @@ else ()
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
+             PATCH_COMMAND ${Patch_EXECUTABLE} --ignore-space-change --ignore-whitespace < ${PROJECT_SOURCE_DIR}/patches/eigen/Fix_Eigen_Build_Break.patch
++            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     else()
+         FetchContent_Declare(
+             eigen
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
++            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     endif()
+-    FetchContent_Populate(eigen)
+-    set(eigen_INCLUDE_DIRS  "${eigen_SOURCE_DIR}")
++    FetchContent_MakeAvailable(eigen)
++    add_library(eigen ALIAS Eigen3::Eigen)
++
++    # Onnxruntime doesn't always use `eigen` as a target in
++    # `target_link_libraries`, sometimes it just uses
++    # `target_include_directories`:
++    get_target_property(eigen_INCLUDE_DIRS Eigen3::Eigen INTERFACE_INCLUDE_DIRECTORIES)
+ endif()
+-- 
+2.42.0
+

pkgs/development/libraries/onnxruntime/default.nix

@@ -2,11 +2,11 @@
 , lib
 , fetchFromGitHub
 , fetchFromGitLab
-, fetchpatch
-, fetchurl
 , Foundation
 , abseil-cpp
 , cmake
+, eigen
+, gtest
 , libpng
 , nlohmann_json
 , nsync
@@ -16,7 +16,6 @@
 , zlib
 , microsoft-gsl
 , iconv
-, gtest
 , protobuf_21
 , pythonSupport ? true
 }:
@@ -30,25 +29,18 @@ let
     sha256 = "sha256-BYL7wxsYRI45l8C3VwxYIIocn5TzJnBtU0UZ9pHwwZw=";
   };
 
-  eigen = fetchFromGitLab {
-    owner = "libeigen";
-    repo = "eigen";
-    rev = "d10b27fe37736d2944630ecd7557cefa95cf87c9";
-    sha256 = "sha256-Lmco0s9gIm9sIw7lCr5Iewye3RmrHEE4HLfyzRkQCm0=";
-  };
-
   mp11 = fetchFromGitHub {
     owner = "boostorg";
     repo = "mp11";
     rev = "boost-1.79.0";
-    sha256 = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
+    hash = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
   };
 
   safeint = fetchFromGitHub {
     owner = "dcleblanc";
     repo = "safeint";
     rev = "ff15c6ada150a5018c5ef2172401cb4529eac9c0";
-    sha256 = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
+    hash = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
   };
 
   pytorch_cpuinfo = fetchFromGitHub {
@@ -56,14 +48,14 @@ let
     repo = "cpuinfo";
     # There are no tags in the repository
     rev = "5916273f79a21551890fd3d56fc5375a78d1598d";
-    sha256 = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
+    hash = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
   };
 
   flatbuffers = fetchFromGitHub {
     owner = "google";
     repo = "flatbuffers";
     rev = "v1.12.0";
-    sha256 = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
+    hash = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
   };
 
   gtest' = gtest.overrideAttrs (oldAttrs: rec {
@@ -74,44 +66,62 @@ let
       rev = "v${version}";
       hash = "sha256-LVLEn+e7c8013pwiLzJiiIObyrlbBHYaioO/SWbItPQ=";
     };
-    });
+  });
+
+  onnx = fetchFromGitHub {
+    owner = "onnx";
+    repo = "onnx";
+    rev = "refs/tags/v1.14.1";
+    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
+  };
 in
 stdenv.mkDerivation rec {
   pname = "onnxruntime";
-  version = "1.15.1";
+  version = "1.16.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "onnxruntime";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-SnHo2sVACc++fog7Tg6f2LK/Sv/EskFzN7RZS7D113s=";
+    hash = "sha256-bTW9Pc3rvH+c8VIlDDEtAXyA3sajVyY5Aqr6+SxaMF4=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    # If you stumble on these patches trying to update onnxruntime, check
+    # `git blame` and ping the introducers.
+
+    # Context: we want the upstream to
+    # - always try find_package first (FIND_PACKAGE_ARGS),
+    # - use MakeAvailable instead of the low-level Populate,
+    # - use Eigen3::Eigen as the target name (as declared by libeigen/eigen).
+    ./0001-eigen-allow-dependency-injection.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
     python3Packages.python
     protobuf_21
   ] ++ lib.optionals pythonSupport (with python3Packages; [
+    pip
+    python
+    pythonOutputDistHook
     setuptools
     wheel
-    pip
-    pythonOutputDistHook
   ]);
 
   buildInputs = [
+    eigen
     libpng
     zlib
     nlohmann_json
-    nsync
-    re2
     microsoft-gsl
-  ] ++ lib.optionals pythonSupport [
+  ] ++ lib.optionals pythonSupport (with python3Packages; [
-    python3Packages.numpy
+    numpy
-    python3Packages.pybind11
+    pybind11
-    python3Packages.packaging
+    packaging
-  ] ++ lib.optionals stdenv.isDarwin [
+  ]) ++ lib.optionals stdenv.isDarwin [
     Foundation
     iconv
   ];
@@ -137,11 +147,10 @@ stdenv.mkDerivation rec {
     "-DFETCHCONTENT_QUIET=OFF"
     "-DFETCHCONTENT_SOURCE_DIR_ABSEIL_CPP=${abseil-cpp.src}"
     "-DFETCHCONTENT_SOURCE_DIR_DATE=${howard-hinnant-date}"
-    "-DFETCHCONTENT_SOURCE_DIR_EIGEN=${eigen}"
     "-DFETCHCONTENT_SOURCE_DIR_FLATBUFFERS=${flatbuffers}"
     "-DFETCHCONTENT_SOURCE_DIR_GOOGLE_NSYNC=${nsync.src}"
     "-DFETCHCONTENT_SOURCE_DIR_MP11=${mp11}"
-    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${python3Packages.onnx.src}"
+    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${onnx}"
     "-DFETCHCONTENT_SOURCE_DIR_PYTORCH_CPUINFO=${pytorch_cpuinfo}"
     "-DFETCHCONTENT_SOURCE_DIR_RE2=${re2.src}"
     "-DFETCHCONTENT_SOURCE_DIR_SAFEINT=${safeint}"
@@ -165,14 +174,14 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace cmake/libonnxruntime.pc.cmake.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
+      --replace-fail '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
   '' + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
     # https://github.com/NixOS/nixpkgs/pull/226734#issuecomment-1663028691
     rm -v onnxruntime/test/optimizer/nhwc_transformer_test.cc
   '';
 
   postBuild = lib.optionalString pythonSupport ''
-    python ../setup.py bdist_wheel
+    ${python3Packages.python.interpreter} ../setup.py bdist_wheel
   '';
 
   postInstall = ''

pkgs/development/python-modules/cmdstanpy/default.nix

@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , substituteAll
-, fetchpatch
 , cmdstan
 , pythonRelaxDepsHook
 , setuptools
@@ -17,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cmdstanpy";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstanpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1/X5JDvCx21qLNamNQXpg+w3d3DdSRlB+liIv2fThs4=";
+    hash = "sha256-q+AFhWEzjYElJpiHT4h6YfZrwZJ56pv+8R+001vREyQ=";
   };
 
   patches = [
@@ -32,11 +31,6 @@ buildPythonPackage rec {
       src = ./use-nix-cmdstan-path.patch;
       cmdstan = "${cmdstan}/opt/cmdstan";
     })
-    (fetchpatch {
-      name = "stan-2.34-fix-parsing-of-unit_e-output-files.patch";
-      url = "https://github.com/stan-dev/cmdstanpy/commit/144d641739ccd1109055d13b5b96e4e76607305d.patch";
-      hash = "sha256-21hcbK3Xs7vGBNRs4hMfY5g7jIwEG49WYnsOxYJ6ccs=";
-    })
   ];
 
   postPatch = ''
@@ -77,7 +71,6 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    "test_lp_good" # Fails for some reason
     "test_serialization" # Pickle class mismatch errors
     # These tests use the flag -DSTAN_THREADS which doesn't work in cmdstan (missing file)
     "test_multi_proc_threads"

pkgs/development/tools/nwjs/default.nix

@@ -85,7 +85,7 @@ let
     extraOutputsToInstall = [ "lib" "out" ];
   };
 
-  version = "0.83.0";
+  version = "0.84.0";
 in
 stdenv.mkDerivation {
   pname = "nwjs";
@@ -96,10 +96,10 @@ stdenv.mkDerivation {
     in fetchurl {
       url = "https://dl.nwjs.io/v${version}/nwjs-${flavor}v${version}-linux-${bits}.tar.gz";
       hash = {
-        "sdk-ia32" = "sha256-Sps0XFOnnJIkDRPI+PJSjseF8cyaYvXXs4ZeVI8mcm8=";
+        "sdk-ia32" = "sha256-uy6WZuA5b79yACSe3wiKiEeMb6K/z84cSeQDrKFUUdE=";
-        "sdk-x64" = "sha256-qsNPfmDQK/BZzMTlX9MDaV7KZsU32YQ1B/Qh/EHIZrQ=";
+        "sdk-x64" = "sha256-xI/YMHg5RWYh9XCLskSkuDwemH77U43Fzb8C9+fS9wE=";
-        "ia32" = "sha256-99+EU4Kg8lH8facRmIl2SV3GyWUw46rGYpso5QSP//k=";
+        "ia32" = "sha256-Sc9geGuwl9TIdLrKr97Wz2h4S+AEgP3DAd12Toyk7b8=";
-        "x64" = "sha256-y0oBVvVguRDe391EsQs6qYqkTRPzUfm50m6NDOZh+7o=";
+        "x64" = "sha256-VIygMzCPTKzLr47bG1DYy/zj0OxsjGcms0G1BkI/TEI=";
       }."${flavor + bits}";
     };
 

pkgs/games/angband/default.nix

@@ -2,18 +2,17 @@
 , enableSdl2 ? false, SDL2, SDL2_image, SDL2_sound, SDL2_mixer, SDL2_ttf
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "angband";
   version = "4.2.5";
 
   src = fetchFromGitHub {
     owner = "angband";
     repo = "angband";
-    rev = version;
+    rev = finalAttrs.version;
-    sha256 = "sha256-XH2FUTJJaH5TqV2UD1CKKAXE4CRAb6zfg1UQ79a15k0=";
+    hash = "sha256-XH2FUTJJaH5TqV2UD1CKKAXE4CRAb6zfg1UQ79a15k0=";
   };
 
-
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ncurses5 ]
   ++ lib.optionals enableSdl2 [
@@ -33,5 +32,6 @@ stdenv.mkDerivation rec {
     description = "A single-player roguelike dungeon exploration game";
     maintainers = [ maintainers.kenran ];
     license = licenses.gpl2;
+    platforms = platforms.unix;
   };
-}
+})

pkgs/servers/geospatial/pg_featureserv/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pg_featureserv";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "CrunchyData";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Kii9Qbff6dIAaHx3QfNPTg8g+QrBpZghGlHxrsGaMbo=";
+    sha256 = "sha256-GsloUZFgrOrJc23vKv+8iSeyIEKblaukPSCpZGRtSL4=";
   };
 
   vendorHash = "sha256-BHiEVyi3FXPovYy3iDP8q+y+LgfI4ElDPVZexd7nnuo=";

pkgs/servers/minio/default.nix

@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-01-31T20-20-33Z";
+  version = "2024-02-04T22-36-13Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-cQqgLjUGjLGV9o1asMbZrmGZ2FPB0/08JaoYW6hgDPE=";
+    hash = "sha256-vA1xrwvHyhqrdWjEXqs0MUaPq8S3J2r1uE0IndpwdjQ=";
   };
 
-  vendorHash = "sha256-v6Mn0f8xNsaV1ixnuVs9cPi5FghAGKjX5nWiBZLhBUU=";
+  vendorHash = "sha256-eE8F/cG7SdSHrFW4qg+MBdS/rxoz4xB0JbCQ3vi38ok=";
 
   doCheck = false;
 

pkgs/tools/networking/godns/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "godns";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "refs/tags/v${version}";
-    hash = "sha256-e4d0q4Sw0/Oq5AHw1ikRKakKSVdtf+hTbg7OX/RLT+o=";
+    hash = "sha256-7zgvrEVt8xg54NijcqnXoZcXetzOu9h3Ucw7w03YagU=";
   };
 
-  vendorHash = "sha256-PVp09gWk35T0gQoYOPzaVFtrqua0a8cNjPOgfYyu7zg=";
+  vendorHash = "sha256-veDrGB6gjUa8G/UyKzEgH2ItGGEPlXDePahq2XP2nAo=";
 
   # Some tests require internet access, broken in sandbox
   doCheck = false;

pkgs/tools/text/mdbook-katex/default.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-katex";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-IecCEXoWkjCgIHlhmtF2H+FM/0B8yK4XmHuBHv/yGk8=";
+    hash = "sha256-yq5cKb9Kzto+vM1/FEZhxB/+sHY7H0S1knSEtVklJvk=";
   };
 
-  cargoHash = "sha256-vHbTL62Z4UdU77VePN2HSRzS9amn33smw1Yy6I2Btcc=";
+  cargoHash = "sha256-GtQoWNOs1SU8yoMyxh81weqMkhhRC09tNuTBNPoPj7U=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 

pkgs/top-level/all-packages.nix

@@ -2050,10 +2050,6 @@ with pkgs;
 
   sorted-grep = callPackage ../tools/text/sorted-grep { };
 
-  smb3-foundry = callPackage ../applications/misc/smb3-foundry {
-    python3 = python311;
-  };
-
   smbmap = callPackage ../tools/security/smbmap { };
 
   smbscan = callPackage ../tools/security/smbscan { };
@@ -9084,7 +9080,9 @@ with pkgs;
 
   hatch = python3Packages.callPackage ../development/tools/hatch { };
 
-  hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer { };
+  hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer {
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
 
   half = callPackage ../development/libraries/half { };
 
@@ -11965,8 +11963,6 @@ with pkgs;
 
   pdf-quench = callPackage ../applications/misc/pdf-quench { };
 
-  pdf-sign = callPackage ../tools/graphics/pdf-sign { };
-
   pdfarranger = callPackage ../applications/misc/pdfarranger { };
 
   briss = callPackage ../tools/graphics/briss { };