Merge branch 'staging-next' into staging

maintainers/maintainer-list.nix

@@ -1257,6 +1257,12 @@
     githubId = 24651767;
     name = "Felix Andreas";
   };
+  andreasvoss = {
+    name = "andreasvoss";
+    email = "andreas@anvo.dk";
+    github = "andreasuvoss";
+    githubId = 25469495;
+  };
   andres = {
     email = "ksnixos@andres-loeh.de";
     github = "kosmikus";
@@ -3986,6 +3992,12 @@
     githubId = 11145016;
     name = "J.C.";
   };
+  confusedalex = {
+    email = "alex@confusedalex.dev";
+    github = "ConfusedAlex";
+    githubId = 29258035;
+    name = "Alexander Loll";
+  };
   congee = {
     email = "changshengwu@pm.me";
     matrix = "@congeec:matrix.org";
@@ -7358,6 +7370,14 @@
     github = "Gigahawk";
     githubId = 10356230;
   };
+  giggio = {
+    email = "giggio@giggio.net";
+    github = "giggio";
+    githubId = 334958;
+    matrix = "@giggio:matrix.org";
+    name = "Giovanni Bassi";
+    keys = [ { fingerprint = "275F 6749 AFD2 379D 1033  548C 1237 AB12 2E6F 4761"; } ];
+  };
   gigglesquid = {
     email = "jack.connors@protonmail.com";
     github = "gigglesquid";
@@ -9537,6 +9557,12 @@
     githubId = 8900;
     name = "Johan Magnus Jonsson";
   };
+  JManch = {
+    email = "jmanch@protonmail.com";
+    github = "JManch";
+    githubId = 61563764;
+    name = "Joshua Manchester";
+  };
   jmarmstrong1207 = {
     name = "James Armstrong";
     email = "jm.armstrong1207@gmail.com";
@@ -15040,10 +15066,10 @@
   };
   onemoresuza = {
     name = "Coutinho de Souza";
-    email = "dev@onemoresuza.mailer.me";
+    email = "dev@onemoresuza.com";
     github = "onemoresuza";
     githubId = 106456302;
-    keys = [ { fingerprint = "484F D3B8 BAD7 BF5D 8B68  2AEA A2ED 1159 935E 4D7E"; } ];
+    keys = [ { fingerprint = "6FD3 7E64 11C5 C659 2F34  EDBC 4352 D15F B177 F2A8"; } ];
   };
   onixie = {
     email = "onixie@gmail.com";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -24,6 +24,8 @@
 
 - [Eintopf](https://eintopf.info), community event and calendar web application. Available as [services.eintopf](options.html#opt-services.eintopf).
 
+- [Radicle](https://radicle.xyz), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).
+
 - [Renovate](https://github.com/renovatebot/renovate), a dependency updating tool for various git forges and language ecosystems. Available as [services.renovate](#opt-services.renovate.enable).
 
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
@@ -34,6 +36,8 @@
 
 - [realm](https://github.com/zhboner/realm), a simple, high performance relay server written in rust. Available as [services.realm.enable](#opt-services.realm.enable).
 
+- [Gotenberg](https://gotenberg.dev), an API server for converting files to PDFs that can be used alongside Paperless-ngx. Available as [services.gotenberg](options.html#opt-services.gotenberg).
+
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
 
 - [Glance](https://github.com/glanceapp/glance), a self-hosted dashboard that puts all your feeds in one place. Available as [services.glance](option.html#opt-services.glance).

nixos/modules/module-list.nix

@@ -741,6 +741,7 @@
   ./services/misc/gitweb.nix
   ./services/misc/gogs.nix
   ./services/misc/gollum.nix
+  ./services/misc/gotenberg.nix
   ./services/misc/gpsd.nix
   ./services/misc/graphical-desktop.nix
   ./services/misc/greenclip.nix
@@ -802,6 +803,7 @@
   ./services/misc/pufferpanel.nix
   ./services/misc/pykms.nix
   ./services/misc/radarr.nix
+  ./services/misc/radicle.nix
   ./services/misc/readarr.nix
   ./services/misc/redmine.nix
   ./services/misc/renovate.nix

nixos/modules/services/misc/etebase-server.nix

@@ -45,7 +45,7 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.python3.pkgs.etebase-server;
+        default = pkgs.etebase-server;
         defaultText = literalExpression "pkgs.python3.pkgs.etebase-server";
         description = "etebase-server package to use.";
       };

nixos/modules/services/misc/gotenberg.nix

@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.gotenberg;
+
+  args =
+    [
+      "--api-port=${toString cfg.port}"
+      "--api-timeout=${cfg.timeout}"
+      "--api-root-path=${cfg.rootPath}"
+      "--log-level=${cfg.logLevel}"
+      "--chromium-max-queue-size=${toString cfg.chromium.maxQueueSize}"
+      "--libreoffice-restart-after=${toString cfg.libreoffice.restartAfter}"
+      "--libreoffice-max-queue-size=${toString cfg.libreoffice.maxQueueSize}"
+      "--pdfengines-engines=${lib.concatStringsSep "," cfg.pdfEngines}"
+    ]
+    ++ optional cfg.enableBasicAuth "--api-enable-basic-auth"
+    ++ optional cfg.chromium.autoStart "--chromium-auto-start"
+    ++ optional cfg.chromium.disableJavascript "--chromium-disable-javascript"
+    ++ optional cfg.chromium.disableRoutes "--chromium-disable-routes"
+    ++ optional cfg.libreoffice.autoStart "--libreoffice-auto-start"
+    ++ optional cfg.libreoffice.disableRoutes "--libreoffice-disable-routes";
+
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    types
+    mkIf
+    optional
+    optionalAttrs
+    ;
+in
+{
+  options = {
+    services.gotenberg = {
+      enable = mkEnableOption "Gotenberg, a stateless API for PDF files";
+
+      # Users can override only gotenberg, libreoffice and chromium if they want to (eg. ungoogled-chromium, different LO version, etc)
+      # Don't allow setting the qpdf, pdftk, or unoconv paths, as those are very stable
+      # and there's only one version of each.
+      package = mkPackageOption pkgs "gotenberg" { };
+
+      port = mkOption {
+        type = types.port;
+        default = 3000;
+        description = "Port on which the API should listen.";
+      };
+
+      timeout = mkOption {
+        type = types.nullOr types.str;
+        default = "30s";
+        description = "Timeout for API requests.";
+      };
+
+      rootPath = mkOption {
+        type = types.str;
+        default = "/";
+        description = "Root path for the Gotenberg API.";
+      };
+
+      enableBasicAuth = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          HTTP Basic Authentication.
+
+          If you set this, be sure to set `GOTENBERG_API_BASIC_AUTH_USERNAME`and `GOTENBERG_API_BASIC_AUTH_PASSWORD`
+          in your `services.gotenberg.environmentFile` file.
+        '';
+      };
+
+      extraFontPackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        description = "Extra fonts to make available.";
+      };
+
+      chromium = {
+        package = mkPackageOption pkgs "chromium" { };
+
+        maxQueueSize = mkOption {
+          type = types.int;
+          default = 0;
+          description = "Maximum queue size for chromium-based conversions. Setting to 0 disables the limit.";
+        };
+
+        autoStart = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Automatically start chromium when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it.";
+        };
+
+        disableJavascript = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Disable Javascript execution.";
+        };
+
+        disableRoutes = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Disable all routes allowing Chromium-based conversion.";
+        };
+      };
+
+      libreoffice = {
+        package = mkPackageOption pkgs "libreoffice" { };
+
+        restartAfter = mkOption {
+          type = types.int;
+          default = 10;
+          description = "Restart LibreOffice after this many conversions. Setting to 0 disables this feature.";
+        };
+
+        maxQueueSize = mkOption {
+          type = types.int;
+          default = 0;
+          description = "Maximum queue size for LibreOffice-based conversions. Setting to 0 disables the limit.";
+        };
+
+        autoStart = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Automatically start LibreOffice when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it.";
+        };
+
+        disableRoutes = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Disable all routes allowing LibreOffice-based conversion.";
+        };
+      };
+
+      pdfEngines = mkOption {
+        type = types.listOf (
+          types.enum [
+            "pdftk"
+            "qpdf"
+            "libreoffice-pdfengine"
+            "exiftool"
+            "pdfcpu"
+          ]
+        );
+        default = [
+          "pdftk"
+          "qpdf"
+          "libreoffice-pdfengine"
+          "exiftool"
+          "pdfcpu"
+        ];
+        description = ''
+          PDF engines to enable. Each one can be used to perform a specific task.
+          See [the documentation](https://gotenberg.dev/docs/configuration#pdf-engines) for more details.
+          Defaults to all possible PDF engines.
+        '';
+      };
+
+      logLevel = mkOption {
+        type = types.enum [
+          "error"
+          "warn"
+          "info"
+          "debug"
+        ];
+        default = "info";
+        description = "The logging level for Gotenberg.";
+      };
+
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Environment file to load extra environment variables from.";
+      };
+
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = "Any extra command-line flags to pass to the Gotenberg service.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enableBasicAuth -> cfg.environmentFile != null;
+        message = ''
+          When enabling HTTP Basic Authentication with `services.gotenberg.enableBasicAuth`,
+          you must provide an environment file via `services.gotenberg.environmentFile` with the appropriate environment variables set in it.
+
+          See `services.gotenberg.enableBasicAuth` for the names of those variables.
+        '';
+      }
+    ];
+
+    systemd.services.gotenberg = {
+      description = "Gotenberg API server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ cfg.package ];
+      environment = {
+        LIBREOFFICE_BIN_PATH = "${cfg.libreoffice.package}/lib/libreoffice/program/soffice.bin";
+        CHROMIUM_BIN_PATH = lib.getExe cfg.chromium.package;
+        FONTCONFIG_FILE = pkgs.makeFontsConf {
+          fontDirectories = [ pkgs.liberation_ttf_v2 ] ++ cfg.extraFontPackages;
+        };
+      };
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs args}";
+
+        # Hardening options
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateUsers = true;
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+
+        SystemCallFilter = [
+          "@system-service"
+          "~@resources"
+          "~@privileged"
+        ];
+        SystemCallArchitectures = "native";
+
+        UMask = 77;
+      } // optionalAttrs (cfg.environmentFile != null) { EnvironmentFile = cfg.environmentFile; };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ pyrox0 ];
+}

nixos/modules/services/misc/radicle.nix

@@ -0,0 +1,347 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.radicle;
+
+  json = pkgs.formats.json { };
+
+  env = rec {
+    # rad fails if it cannot stat $HOME/.gitconfig
+    HOME = "/var/lib/radicle";
+    RAD_HOME = HOME;
+  };
+
+  # Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`
+  rad-system = pkgs.writeShellScriptBin "rad-system" ''
+    set -o allexport
+    ${toShellVars env}
+    # Note that --env is not used to preserve host's envvars like $TERM
+    exec ${getExe' pkgs.util-linux "nsenter"} -a \
+      -t "$(${getExe' config.systemd.package "systemctl"} show -P MainPID radicle-node.service)" \
+      -S "$(${getExe' config.systemd.package "systemctl"} show -P UID radicle-node.service)" \
+      -G "$(${getExe' config.systemd.package "systemctl"} show -P GID radicle-node.service)" \
+      ${getExe' cfg.package "rad"} "$@"
+  '';
+
+  commonServiceConfig = serviceName: {
+    environment = env // {
+      RUST_LOG = mkDefault "info";
+    };
+    path = [
+      pkgs.gitMinimal
+    ];
+    documentation = [
+      "https://docs.radicle.xyz/guides/seeder"
+    ];
+    after = [
+      "network.target"
+      "network-online.target"
+    ];
+    requires = [
+      "network-online.target"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = mkMerge [
+      {
+        BindReadOnlyPaths = [
+          "${cfg.configFile}:${env.RAD_HOME}/config.json"
+          "${if isPath cfg.publicKeyFile then cfg.publicKeyFile else pkgs.writeText "radicle.pub" cfg.publicKeyFile}:${env.RAD_HOME}/keys/radicle.pub"
+        ];
+        KillMode = "process";
+        StateDirectory = [ "radicle" ];
+        User = config.users.users.radicle.name;
+        Group = config.users.groups.radicle.name;
+        WorkingDirectory = env.HOME;
+      }
+      # The following options are only for optimizing:
+      # systemd-analyze security ${serviceName}
+      {
+        BindReadOnlyPaths = [
+          "-/etc/resolv.conf"
+          "/etc/ssl/certs/ca-certificates.crt"
+          "/run/systemd"
+        ];
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        DeviceAllow = ""; # ProtectClock= adds DeviceAllow=char-rtc r
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RuntimeDirectoryMode = "700";
+        SocketBindDeny = [ "any" ];
+        StateDirectoryMode = "0750";
+        SystemCallFilter = [
+          "@system-service"
+          "~@aio"
+          "~@chown"
+          "~@keyring"
+          "~@memlock"
+          "~@privileged"
+          "~@resources"
+          "~@setuid"
+          "~@timer"
+        ];
+        SystemCallArchitectures = "native";
+        # This is for BindPaths= and BindReadOnlyPaths=
+        # to allow traversal of directories they create inside RootDirectory=
+        UMask = "0066";
+      }
+    ];
+    confinement = {
+      enable = true;
+      mode = "full-apivfs";
+      packages = [
+        pkgs.gitMinimal
+        cfg.package
+        pkgs.iana-etc
+        (getLib pkgs.nss)
+        pkgs.tzdata
+      ];
+    };
+  };
+in
+{
+  options = {
+    services.radicle = {
+      enable = mkEnableOption "Radicle Seed Node";
+      package = mkPackageOption pkgs "radicle-node" { };
+      privateKeyFile = mkOption {
+        type = with types; either path str;
+        description = ''
+          SSH private key generated by `rad auth`.
+
+          If it contains a colon (`:`) the string before the colon
+          is taken as the credential name
+          and the string after as a path encrypted with `systemd-creds`.
+        '';
+      };
+      publicKeyFile = mkOption {
+        type = with types; either path str;
+        description = ''
+          SSH public key generated by `rad auth`.
+        '';
+      };
+      node = {
+        listenAddress = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          example = "127.0.0.1";
+          description = "The IP address on which `radicle-node` listens.";
+        };
+        listenPort = mkOption {
+          type = types.port;
+          default = 8776;
+          description = "The port on which `radicle-node` listens.";
+        };
+        openFirewall = mkEnableOption "opening the firewall for `radicle-node`";
+        extraArgs = mkOption {
+          type = with types; listOf str;
+          default = [ ];
+          description = "Extra arguments for `radicle-node`";
+        };
+      };
+      configFile = mkOption {
+        type = types.package;
+        internal = true;
+        default = (json.generate "config.json" cfg.settings).overrideAttrs (previousAttrs: {
+          preferLocalBuild = true;
+          # None of the usual phases are run here because runCommandWith uses buildCommand,
+          # so just append to buildCommand what would usually be a checkPhase.
+          buildCommand = previousAttrs.buildCommand + optionalString cfg.checkConfig ''
+            ln -s $out config.json
+            install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
+            export RAD_HOME=$PWD
+            ${getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
+              cat -n config.json
+              echo "Invalid config.json according to rad."
+              echo "Please double-check your services.radicle.settings (producing the config.json above),"
+              echo "some settings may be missing or have the wrong type."
+              exit 1
+            } >&2
+          '';
+        });
+      };
+      checkConfig = mkEnableOption "checking the {file}`config.json` file resulting from {option}`services.radicle.settings`" // { default = true; };
+      settings = mkOption {
+        description = ''
+          See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
+        '';
+        default = { };
+        type = types.submodule {
+          freeformType = json.type;
+        };
+      };
+      httpd = {
+        enable = mkEnableOption "Radicle HTTP gateway to radicle-node";
+        package = mkPackageOption pkgs "radicle-httpd" { };
+        listenAddress = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "The IP address on which `radicle-httpd` listens.";
+        };
+        listenPort = mkOption {
+          type = types.port;
+          default = 8080;
+          description = "The port on which `radicle-httpd` listens.";
+        };
+        nginx = mkOption {
+          # Type of a single virtual host, or null.
+          type = types.nullOr (types.submodule (
+            recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
+              options.serverName = {
+                default = "radicle-${config.networking.hostName}.${config.networking.domain}";
+                defaultText = "radicle-\${config.networking.hostName}.\${config.networking.domain}";
+              };
+            }
+          ));
+          default = null;
+          example = literalExpression ''
+            {
+              serverAliases = [
+                "seed.''${config.networking.domain}"
+              ];
+              enableACME = false;
+              useACMEHost = config.networking.domain;
+            }
+          '';
+          description = ''
+            With this option, you can customize an nginx virtual host which already has sensible defaults for `radicle-httpd`.
+            Set to `{}` if you do not need any customization to the virtual host.
+            If enabled, then by default, the {option}`serverName` is
+            `radicle-''${config.networking.hostName}.''${config.networking.domain}`,
+            TLS is active, and certificates are acquired via ACME.
+            If this is set to null (the default), no nginx virtual host will be configured.
+          '';
+        };
+        extraArgs = mkOption {
+          type = with types; listOf str;
+          default = [ ];
+          description = "Extra arguments for `radicle-httpd`";
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      systemd.services.radicle-node = mkMerge [
+        (commonServiceConfig "radicle-node")
+        {
+          description = "Radicle Node";
+          documentation = [ "man:radicle-node(1)" ];
+          serviceConfig = {
+            ExecStart = "${getExe' cfg.package "radicle-node"} --force --listen ${cfg.node.listenAddress}:${toString cfg.node.listenPort} ${escapeShellArgs cfg.node.extraArgs}";
+            Restart = mkDefault "on-failure";
+            RestartSec = "30";
+            SocketBindAllow = [ "tcp:${toString cfg.node.listenPort}" ];
+            SystemCallFilter = mkAfter [
+              # Needed by git upload-pack which calls alarm() and setitimer() when providing a rad clone
+              "@timer"
+            ];
+          };
+          confinement.packages = [
+            cfg.package
+          ];
+        }
+        # Give only access to the private key to radicle-node.
+        {
+          serviceConfig =
+            let keyCred = builtins.split ":" "${cfg.privateKeyFile}"; in
+            if length keyCred > 1
+            then {
+              LoadCredentialEncrypted = [ cfg.privateKeyFile ];
+              # Note that neither %d nor ${CREDENTIALS_DIRECTORY} works in BindReadOnlyPaths=
+              BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/${head keyCred}:${env.RAD_HOME}/keys/radicle" ];
+            }
+            else {
+              LoadCredential = [ "radicle:${cfg.privateKeyFile}" ];
+              BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/radicle:${env.RAD_HOME}/keys/radicle" ];
+            };
+        }
+      ];
+
+      environment.systemPackages = [
+        rad-system
+      ];
+
+      networking.firewall = mkIf cfg.node.openFirewall {
+        allowedTCPPorts = [ cfg.node.listenPort ];
+      };
+
+      users = {
+        users.radicle = {
+          description = "Radicle";
+          group = "radicle";
+          home = env.HOME;
+          isSystemUser = true;
+        };
+        groups.radicle = {
+        };
+      };
+    }
+
+    (mkIf cfg.httpd.enable (mkMerge [
+      {
+        systemd.services.radicle-httpd = mkMerge [
+          (commonServiceConfig "radicle-httpd")
+          {
+            description = "Radicle HTTP gateway to radicle-node";
+            documentation = [ "man:radicle-httpd(1)" ];
+            serviceConfig = {
+              ExecStart = "${getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${escapeShellArgs cfg.httpd.extraArgs}";
+              Restart = mkDefault "on-failure";
+              RestartSec = "10";
+              SocketBindAllow = [ "tcp:${toString cfg.httpd.listenPort}" ];
+              SystemCallFilter = mkAfter [
+                # Needed by git upload-pack which calls alarm() and setitimer() when providing a git clone
+                "@timer"
+              ];
+            };
+          confinement.packages = [
+            cfg.httpd.package
+          ];
+          }
+        ];
+      }
+
+      (mkIf (cfg.httpd.nginx != null) {
+        services.nginx.virtualHosts.${cfg.httpd.nginx.serverName} = lib.mkMerge [
+          cfg.httpd.nginx
+          {
+            forceSSL = mkDefault true;
+            enableACME = mkDefault true;
+            locations."/" = {
+              proxyPass = "http://${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort}";
+              recommendedProxySettings = true;
+            };
+          }
+        ];
+
+        services.radicle.settings = {
+          node.alias = mkDefault cfg.httpd.nginx.serverName;
+          node.externalAddresses = mkDefault [
+            "${cfg.httpd.nginx.serverName}:${toString cfg.node.listenPort}"
+          ];
+        };
+      })
+    ]))
+  ]);
+
+  meta.maintainers = with lib.maintainers; [
+    julm
+    lorenzleutgeb
+  ];
+}

nixos/tests/all-tests.nix

@@ -381,6 +381,7 @@ in {
   gonic = handleTest ./gonic.nix {};
   google-oslogin = handleTest ./google-oslogin {};
   goss = handleTest ./goss.nix {};
+  gotenberg = handleTest ./gotenberg.nix {};
   gotify-server = handleTest ./gotify-server.nix {};
   gotosocial = runTest ./web-apps/gotosocial.nix;
   grafana = handleTest ./grafana {};
@@ -812,6 +813,7 @@ in {
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
   radicale = handleTest ./radicale.nix {};
+  radicle = runTest ./radicle.nix;
   ragnarwm = handleTest ./ragnarwm.nix {};
   rasdaemon = handleTest ./rasdaemon.nix {};
   readarr = handleTest ./readarr.nix {};

nixos/tests/gotenberg.nix

@@ -0,0 +1,26 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "gotenberg";
+    meta.maintainers = with lib.maintainers; [ pyrox0 ];
+
+    nodes.machine = {
+      services.gotenberg = {
+        enable = true;
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("gotenberg.service")
+
+      # Gotenberg startup
+      machine.wait_for_open_port(3000)
+
+      # Ensure healthcheck endpoint succeeds
+      machine.succeed("curl http://localhost:3000/health")
+    '';
+  }
+)

nixos/tests/radicle.nix

@@ -0,0 +1,207 @@
+# This test runs the radicle-node and radicle-httpd services on a seed host,
+# and verifies that an alice peer can host a repository on the seed,
+# and that a bob peer can send alice a patch via the seed.
+
+{ pkgs, ... }:
+
+let
+  # The Node ID depends on nodes.seed.services.radicle.privateKeyFile
+  seed-nid = "z6Mkg52RcwDrPKRzzHaYgBkHH3Gi5p4694fvPstVE9HTyMB6";
+  seed-ssh-keys = import ./ssh-keys.nix pkgs;
+  seed-tls-certs = import common/acme/server/snakeoil-certs.nix;
+
+  commonHostConfig = { nodes, config, pkgs, ... }: {
+    environment.systemPackages = [
+      config.services.radicle.package
+      pkgs.curl
+      pkgs.gitMinimal
+      pkgs.jq
+    ];
+    environment.etc."gitconfig".text = ''
+      [init]
+        defaultBranch = main
+      [user]
+        email = root@${config.networking.hostName}
+        name = ${config.networking.hostName}
+    '';
+    networking = {
+      extraHosts = ''
+        ${nodes.seed.networking.primaryIPAddress} ${nodes.seed.services.radicle.httpd.nginx.serverName}
+      '';
+    };
+    security.pki.certificateFiles = [
+      seed-tls-certs.ca.cert
+    ];
+  };
+
+  radicleConfig = { nodes, ... }: alias:
+    pkgs.writeText "config.json" (builtins.toJSON {
+      preferredSeeds = [
+        "${seed-nid}@seed:${toString nodes.seed.services.radicle.node.listenPort}"
+      ];
+      node = {
+        inherit alias;
+        relay = "never";
+        seedingPolicy = {
+          default = "block";
+        };
+      };
+    });
+in
+
+{
+  name = "radicle";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      julm
+      lorenzleutgeb
+    ];
+  };
+
+  nodes = {
+    seed = { pkgs, config, ... }: {
+      imports = [ commonHostConfig ];
+
+      services.radicle = {
+        enable = true;
+        privateKeyFile = seed-ssh-keys.snakeOilEd25519PrivateKey;
+        publicKeyFile = seed-ssh-keys.snakeOilEd25519PublicKey;
+        node = {
+          openFirewall = true;
+        };
+        httpd = {
+          enable = true;
+          nginx = {
+            serverName = seed-tls-certs.domain;
+            addSSL = true;
+            sslCertificate = seed-tls-certs.${seed-tls-certs.domain}.cert;
+            sslCertificateKey = seed-tls-certs.${seed-tls-certs.domain}.key;
+          };
+        };
+        settings = {
+          preferredSeeds = [];
+          node = {
+            relay = "always";
+            seedingPolicy = {
+              default = "allow";
+              scope = "all";
+            };
+          };
+        };
+      };
+
+      services.nginx = {
+        enable = true;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 443 ];
+    };
+
+    alice = {
+      imports = [ commonHostConfig ];
+    };
+
+    bob = {
+      imports = [ commonHostConfig ];
+    };
+  };
+
+  testScript = { nodes, ... }@args: ''
+    start_all()
+
+    with subtest("seed can run radicle-node"):
+      # The threshold and/or hardening may have to be changed with new features/checks
+      print(seed.succeed("systemd-analyze security radicle-node.service --threshold=10 --no-pager"))
+      seed.wait_for_unit("radicle-node.service")
+      seed.wait_for_open_port(${toString nodes.seed.services.radicle.node.listenPort})
+
+    with subtest("seed can run radicle-httpd"):
+      # The threshold and/or hardening may have to be changed with new features/checks
+      print(seed.succeed("systemd-analyze security radicle-httpd.service --threshold=10 --no-pager"))
+      seed.wait_for_unit("radicle-httpd.service")
+      seed.wait_for_open_port(${toString nodes.seed.services.radicle.httpd.listenPort})
+      seed.wait_for_open_port(443)
+      assert alice.succeed("curl -sS 'https://${nodes.seed.services.radicle.httpd.nginx.serverName}/api/v1' | jq -r .nid") == "${seed-nid}\n"
+      assert bob.succeed("curl -sS 'https://${nodes.seed.services.radicle.httpd.nginx.serverName}/api/v1' | jq -r .nid") == "${seed-nid}\n"
+
+    with subtest("alice can create a Node ID"):
+      alice.succeed("rad auth --alias alice --stdin </dev/null")
+      alice.copy_from_host("${radicleConfig args "alice"}", "/root/.radicle/config.json")
+    with subtest("alice can run a node"):
+      alice.succeed("rad node start")
+    with subtest("alice can create a Git repository"):
+      alice.succeed(
+        "mkdir /tmp/repo",
+        "git -C /tmp/repo init",
+        "echo hello world > /tmp/repo/testfile",
+        "git -C /tmp/repo add .",
+        "git -C /tmp/repo commit -m init"
+      )
+    with subtest("alice can create a Repository ID"):
+      alice.succeed(
+        "cd /tmp/repo && rad init --name repo --description descr --default-branch main --public"
+      )
+    alice_repo_rid=alice.succeed("cd /tmp/repo && rad inspect --rid").rstrip("\n")
+    with subtest("alice can send a repository to the seed"):
+      alice.succeed(f"rad sync --seed ${seed-nid} {alice_repo_rid}")
+
+    with subtest(f"seed can receive the repository {alice_repo_rid}"):
+      seed.wait_until_succeeds("test 1 = \"$(rad-system stats | jq .local.repos)\"")
+
+    with subtest("bob can create a Node ID"):
+      bob.succeed("rad auth --alias bob --stdin </dev/null")
+      bob.copy_from_host("${radicleConfig args "bob"}", "/root/.radicle/config.json")
+      bob.succeed("rad node start")
+    with subtest("bob can clone alice's repository from the seed"):
+      bob.succeed(f"rad clone {alice_repo_rid} /tmp/repo")
+      assert bob.succeed("cat /tmp/repo/testfile") == "hello world\n"
+
+    with subtest("bob can clone alice's repository from the seed through the HTTP gateway"):
+      bob.succeed(f"git clone https://${nodes.seed.services.radicle.httpd.nginx.serverName}/{alice_repo_rid[4:]}.git /tmp/repo-http")
+      assert bob.succeed("cat /tmp/repo-http/testfile") == "hello world\n"
+
+    with subtest("alice can push the main branch to the rad remote"):
+      alice.succeed(
+        "echo hello bob > /tmp/repo/testfile",
+        "git -C /tmp/repo add .",
+        "git -C /tmp/repo commit -m 'hello to bob'",
+        "git -C /tmp/repo push rad main"
+      )
+    with subtest("bob can sync bob's repository from the seed"):
+      bob.succeed(
+        "cd /tmp/repo && rad sync --seed ${seed-nid}",
+        "cd /tmp/repo && git pull"
+      )
+      assert bob.succeed("cat /tmp/repo/testfile") == "hello bob\n"
+
+    with subtest("bob can push a patch"):
+      bob.succeed(
+        "echo hello alice > /tmp/repo/testfile",
+        "git -C /tmp/repo checkout -b for-alice",
+        "git -C /tmp/repo add .",
+        "git -C /tmp/repo commit -m 'hello to alice'",
+        "git -C /tmp/repo push -o patch.message='hello for alice' rad HEAD:refs/patches"
+      )
+
+    bob_repo_patch1_pid=bob.succeed("cd /tmp/repo && git branch --remotes | sed -ne 's:^ *rad/patches/::'p").rstrip("\n")
+    with subtest("alice can receive the patch"):
+      alice.wait_until_succeeds("test 1 = \"$(rad stats | jq .local.patches)\"")
+      alice.succeed(
+        f"cd /tmp/repo && rad patch show {bob_repo_patch1_pid} | grep 'opened by bob'",
+        f"cd /tmp/repo && rad patch checkout {bob_repo_patch1_pid}"
+      )
+      assert alice.succeed("cat /tmp/repo/testfile") == "hello alice\n"
+    with subtest("alice can comment the patch"):
+      alice.succeed(
+        f"cd /tmp/repo && rad patch comment {bob_repo_patch1_pid} -m thank-you"
+      )
+    with subtest("alice can merge the patch"):
+      alice.succeed(
+        "git -C /tmp/repo checkout main",
+        f"git -C /tmp/repo merge patch/{bob_repo_patch1_pid[:7]}",
+        "git -C /tmp/repo push rad main",
+        "cd /tmp/repo && rad patch list | grep -qxF 'Nothing to show.'"
+      )
+  '';
+}

pkgs/applications/audio/lollypop/default.nix

@@ -70,7 +70,7 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs;
     [ beautifulsoup4 pillow pycairo pygobject3 ]
     ++ lib.optional lastFMSupport pylast
-    ++ lib.optional youtubeSupport youtube-dl
+    ++ lib.optional youtubeSupport yt-dlp
     ++ lib.optional kid3Support pkgs.kid3;
 
   postPatch = ''

pkgs/applications/audio/tageditor/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-caki8WVnu8ELE2mXwRvT9TTTXCtMZEa0E3KVpHl05jg=";
+    hash = "sha256-FX0wb6GVTB/Y0m6qmoMbaeXPf8bA3+JqbGE8PPS6vAA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4266,6 +4266,23 @@ let
         };
       };
 
+      sswg.swift-lang = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "swift-lang";
+          publisher = "sswg";
+          version = "1.10.4";
+          hash = "sha256-5NrWBuaNdDNF0ON0HUwdwPFsRO3Hfe0UW4AooJbjiA0=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/sswg.swift-lang/changelog";
+          description = "Swift Language Support for Visual Studio Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=sswg.swift-lang";
+          homepage = "https://github.com/swiftlang/vscode-swift";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.uncenter ];
+        };
+      };
+
       stefanjarina.vscode-eex-snippets = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-eex-snippets";

pkgs/applications/graphics/ImageMagick/default.nix

@@ -30,11 +30,9 @@
 , ApplicationServices
 , Foundation
 , testers
-, imagemagick
 , nixos-icons
 , perlPackages
 , python3
-, fetchpatch
 }:
 
 assert libXtSupport -> libX11Support;

pkgs/applications/graphics/gscreenshot/default.nix

@@ -18,13 +18,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gscreenshot";
-  version = "3.5.1";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "thenaterhood";
     repo = "${pname}";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-3CvPJLenEVpTLNZUj+TG1cEfyWGmtaPZH/FD/AgK1io=";
+    sha256 = "sha256-JQnXjKl+BBSblHT0qQgz8iie33wnwfPSkFnZM5xNE7k=";
   };
 
   # needed for wrapGAppsHook3 to function

pkgs/applications/misc/themechanger/default.nix

@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "themechanger";
-  version = "0.11.1";
+  version = "0.12.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "ALEX11BR";
     repo = "ThemeChanger";
     rev = "v${version}";
-    sha256 = "sha256-zSbh+mqCKquOyQASwVUW6hghmUc37nTuoa8pWCHM/a8=";
+    hash = "sha256-/quCi2srn9XlhJQKYNkOaZDHTwdciB9SAlF/RML0q+M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240708";
+  version = "20240715-2";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-UwUygYbmwDdv37mo8rEsHx4mMGdXVfAcscrnn1g0wio=";
+    hash = "sha256-QyukKuRoF6TWFa73EaOO429u9AF+1NCKsLjwQT/fD6U=";
   };
 
   postPatch = ''

pkgs/applications/networking/mailreaders/electron-mail/default.nix

@@ -1,16 +1,22 @@
-{ appimageTools, lib, fetchurl }:
+{
+  appimageTools,
+  lib,
+  fetchurl,
+  nix-update-script,
+}:
 
 let
   pname = "electron-mail";
-  version = "5.1.8";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-btqlxFrQUyb728i99IE65A9jwEFNvJ5b6zji0kwwATU=";
+    sha256 = "sha256-bGqTPP+djpr+RFS6X7jUlSbxl7UDUaZLWQ3D/R76zEI=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
-in appimageTools.wrapType2 {
+in
+appimageTools.wrapType2 {
   inherit pname version src;
 
   extraInstallCommands = ''
@@ -25,6 +31,8 @@ in appimageTools.wrapType2 {
     pkgs.libappindicator-gtk3
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "ElectronMail is an Electron-based unofficial desktop client for ProtonMail";
     mainProgram = "electron-mail";
@@ -32,5 +40,6 @@ in appimageTools.wrapType2 {
     license = licenses.gpl3;
     maintainers = [ maintainers.princemachiavelli ];
     platforms = [ "x86_64-linux" ];
+    changelog = "https://github.com/vladimiry/ElectronMail/releases/tag/v${version}";
   };
 }

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -50,8 +50,8 @@ in rec {
   thunderbird = thunderbird-115;
 
   thunderbird-115 = common {
-    version = "115.12.2";
+    version = "115.13.0";
-    sha512 = "182f35e8e5ece98d18dfefe106c73bc97fbc619f59772d9b3455b7c8af412021ecc5eae97a12515224e91deb814abb7a6ef7f538c450e9e77fdfd84078678038";
+    sha512 = "98ee23f684aa7a166878459a6a217bf3bcc4ddd8fa8ebbd0a1d2d66392ec1ebff67dbad55d145cdd0771539f127d91c4137211cf4efc80e450e6a34c95e8529c";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-115";

pkgs/applications/office/libreoffice/src-fresh/deps.nix

@@ -238,11 +238,11 @@
     md5name = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a-NotoSerif-v2.012.zip";
   }
   {
-    name = "NotoSerifHebrew-v2.003.zip";
+    name = "NotoSerifHebrew-v2.004.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSerifHebrew-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerifHebrew-v2.004.zip";
-    sha256 = "e45c149d6c29b38b8981401f875ab4304e73a366312783c41c082eb5366d3921";
+    sha256 = "99523f4f21051495f18cbd5169ed0d1e9b395eefe770fece1844a4a7a00c46da";
     md5 = "";
-    md5name = "e45c149d6c29b38b8981401f875ab4304e73a366312783c41c082eb5366d3921-NotoSerifHebrew-v2.003.zip";
+    md5name = "99523f4f21051495f18cbd5169ed0d1e9b395eefe770fece1844a4a7a00c46da-NotoSerifHebrew-v2.004.zip";
   }
   {
     name = "NotoSansArabic-v2.010.zip";
@@ -252,18 +252,18 @@
     md5name = "a5a34ac1ea01d0d71c083f99440ebfb1f64224474a0d88bb7ef0e2f8d9a996d2-NotoSansArabic-v2.010.zip";
   }
   {
-    name = "NotoNaskhArabic-v2.016.zip";
+    name = "NotoNaskhArabic-v2.019.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoNaskhArabic-v2.016.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoNaskhArabic-v2.019.zip";
-    sha256 = "2b6a3f30f21d27bc6b75b40a350221e12e64b753604d613bf3ddf71cdbe331ac";
+    sha256 = "7a509e10c9c8d21f384a26807ef2f5fbbecec46fdb8626c5441bed6d894edb81";
     md5 = "";
-    md5name = "2b6a3f30f21d27bc6b75b40a350221e12e64b753604d613bf3ddf71cdbe331ac-NotoNaskhArabic-v2.016.zip";
+    md5name = "7a509e10c9c8d21f384a26807ef2f5fbbecec46fdb8626c5441bed6d894edb81-NotoNaskhArabic-v2.019.zip";
   }
   {
-    name = "NotoSansHebrew-v2.003.zip";
+    name = "NotoSansHebrew-v3.001.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSansHebrew-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansHebrew-v3.001.zip";
-    sha256 = "ded809309ff924bc45834bf19afaa5693cadf17580972468f6041f5e599ddb8a";
+    sha256 = "df0a71814b4e63644cf40fcc4529111b61266b7a2dafbe95068b29a7520cc3cb";
     md5 = "";
-    md5name = "ded809309ff924bc45834bf19afaa5693cadf17580972468f6041f5e599ddb8a-NotoSansHebrew-v2.003.zip";
+    md5name = "df0a71814b4e63644cf40fcc4529111b61266b7a2dafbe95068b29a7520cc3cb-NotoSansHebrew-v3.001.zip";
   }
   {
     name = "NotoSansArmenian-v2.008.zip";
@@ -539,11 +539,11 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2023-08-02.tar.bz2";
+    name = "language-subtag-registry-2024-06-14.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2023-08-02.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2024-06-14.tar.bz2";
-    sha256 = "59fdc026b5088e7947e1e6add482d2a40e1f7e25c50f198b456954216462c2eb";
+    sha256 = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75";
     md5 = "";
-    md5name = "59fdc026b5088e7947e1e6add482d2a40e1f7e25c50f198b456954216462c2eb-language-subtag-registry-2023-08-02.tar.bz2";
+    md5name = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75-language-subtag-registry-2024-06-14.tar.bz2";
   }
   {
     name = "lcms2-2.16.tar.gz";
@@ -630,11 +630,11 @@
     md5name = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf-xmlsec1-1.3.2.tar.gz";
   }
   {
-    name = "libxml2-2.12.6.tar.xz";
+    name = "libxml2-2.12.8.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.6.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.8.tar.xz";
-    sha256 = "889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb";
+    sha256 = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93";
     md5 = "";
-    md5name = "889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb-libxml2-2.12.6.tar.xz";
+    md5name = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93-libxml2-2.12.8.tar.xz";
   }
   {
     name = "libxslt-1.1.39.tar.xz";
@@ -742,11 +742,11 @@
     md5name = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930-openldap-2.6.7.tgz";
   }
   {
-    name = "openssl-3.0.13.tar.gz";
+    name = "openssl-3.0.14.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/openssl-3.0.13.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/openssl-3.0.14.tar.gz";
-    sha256 = "88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313";
+    sha256 = "eeca035d4dd4e84fc25846d952da6297484afa0650a6f84c682e39df3a4123ca";
     md5 = "";
-    md5name = "88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313-openssl-3.0.13.tar.gz";
+    md5name = "eeca035d4dd4e84fc25846d952da6297484afa0650a6f84c682e39df3a4123ca-openssl-3.0.14.tar.gz";
   }
   {
     name = "liborcus-0.19.2.tar.xz";

pkgs/applications/office/libreoffice/src-fresh/help.nix

@@ -1,4 +1,4 @@
 {
-  sha256 = "0sxvc6raij7rd8n0rg8pg61ppxlpvsx1i551hs53x972156cz2lf";
+  sha256 = "090pi8dnj5izpvng94hgmjid14n7xvy3rlqqvang3pqdn35xnpsl";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.3/libreoffice-help-24.2.3.2.tar.xz";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-help-24.2.5.2.tar.xz";
 }

pkgs/applications/office/libreoffice/src-fresh/main.nix

@@ -1,4 +1,4 @@
 {
-  sha256 = "0r0y92c7i42iiimzg9b1pyldnswh28j8p0lmilz7j1sxv2f0bqpn";
+  sha256 = "03halzc9w4z8pfs8krpswp2qzrqq9rhnmms8v8ny88am87vy85lw";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.3/libreoffice-24.2.3.2.tar.xz";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-24.2.5.2.tar.xz";
 }

pkgs/applications/office/libreoffice/src-fresh/translations.nix

@@ -1,4 +1,4 @@
 {
-  sha256 = "0jibmsghr9719nmq6w2m947g4arc8dl3wrj5yyg0fy8znnim6477";
+  sha256 = "0fri41y59zhm8lq0kh6hvf5rpdjdqx0lg1sl40mhh1d6lf1izc1w";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.3/libreoffice-translations-24.2.3.2.tar.xz";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-translations-24.2.5.2.tar.xz";
 }

pkgs/applications/office/libreoffice/src-fresh/version.nix

@@ -1 +1 @@
-"24.2.3.2"
+"24.2.5.2"

pkgs/applications/science/math/numworks-epsilon/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numworks-epsilon";
-  version = "22.2.0";
+  version = "23.2.2";
 
   src = fetchFromGitHub {
     owner = "numworks";
     repo = "epsilon";
     rev = version;
-    hash = "sha256-E2WaXTn8+Ky9kdZxvQmEt63Ggo6Ns0fZ0Za+rQGIMSg=";
+    hash = "sha256-XyKi0IMvXDOYgF7e8nU14sE5YuJPTTfkZnoWZOoJdC0=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/window-managers/herbstluftwm/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, cmake, pkg-config, python3, libX11, libXext, libXinerama, libXrandr, libXft, libXrender, libXdmcp, libXfixes, freetype, asciidoc
-, xdotool, xorg, xsetroot, xterm, runtimeShell
+, xdotool, xorgserver, xsetroot, xterm, runtimeShell
 , fetchpatch
 , nixosTests }:
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   nativeCheckInputs = [
     (python3.withPackages (ps: with ps; [ ewmh pytest xlib ]))
     xdotool
-    xorg.xvfb
+    xorgserver
     xsetroot
     xterm
     python3.pkgs.pytestCheckHook

pkgs/build-support/docker/default.nix

@@ -24,6 +24,7 @@
 , runtimeShell
 , shadow
 , skopeo
+, stdenv
 , storeDir ? builtins.storeDir
 , substituteAll
 , symlinkJoin
@@ -922,6 +923,13 @@ rec {
       assert
       (lib.assertMsg (maxLayers > 1)
         "the maxLayers argument of dockerTools.buildLayeredImage function must be greather than 1 (current value: ${toString maxLayers})");
+      assert
+      (lib.assertMsg (enableFakechroot -> !stdenv.isDarwin) ''
+        cannot use `enableFakechroot` because `proot` is not portable to Darwin. Workarounds:
+              - use `fakeRootCommands` with the restricted `fakeroot` environment
+              - cross-compile your packages
+              - run your packages in a virtual machine
+              Discussion: https://github.com/NixOS/nixpkgs/issues/327311'');
       let
         baseName = baseNameOf name;
 

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -11,6 +11,18 @@
 }:
 
 {
+  application-insights = mkAzExtension rec {
+    pname = "application-insights";
+    version = "1.2.1";
+    url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
+    sha256 = "e1fa824eb587e2bec7f4cb4d1c4ce1033ab3d3fac65af42dd6218f673b019cee";
+    description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
+    propagatedBuildInputs = with python3Packages; [
+      isodate
+    ];
+    meta.maintainers = with lib.maintainers; [ andreasvoss ];
+  };
+
   azure-devops = mkAzExtension rec {
     pname = "azure-devops";
     version = "1.0.1";
@@ -21,6 +33,19 @@
     meta.maintainers = with lib.maintainers; [ katexochen ];
   };
 
+  containerapp = mkAzExtension rec {
+    pname = "containerapp";
+    version = "0.3.53";
+    url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
+    sha256 = "f9b4f3928469efcc1bfbc98cd906d9d92e72617e5c21cf3ade8b37651607c3e1";
+    description = "Microsoft Azure Command-Line Tools Containerapp Extension";
+    propagatedBuildInputs = with python3Packages; [
+      docker
+      pycomposefile
+    ];
+    meta.maintainers = with lib.maintainers; [ giggio ];
+  };
+
   rdbms-connect = mkAzExtension rec {
     pname = "rdbms-connect";
     version = "1.0.6";

pkgs/by-name/ev/evil-helix/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evil-helix";
-  version = "20240618";
+  version = "20240716";
 
   src = fetchFromGitHub {
     owner = "usagi-flow";
     repo = "evil-helix";
     rev = "release-${version}";
-    hash = "sha256-lzae2ypoTyHDpAkL3L7t8FhZ1XXSSkD5958dBEcsTOc=";
+    hash = "sha256-nvLo8bWjiLJjM+pZArMKu4gjEFPrlqDI/Kf+W8fs9L8=";
   };
 
-  cargoHash = "sha256-803maQB+QYuLlZnvDGfE4jRjLnwkufPcfU7Lq9SX9uM=";
+  cargoHash = "sha256-2qrfw/QVfZZ3GTBalNne4QYQsI+JZBf5FdLJD84gnS4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/gn/gnuastro/package.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnuastro";
-  version = "0.22";
+  version = "0.23";
 
   src = fetchurl {
     url = "mirror://gnu/gnuastro/gnuastro-${version}.tar.gz";
-    sha256 = "sha256-f9fxaga95VrtliggkM2SITW+6pAjaeWvgUOJ6rnMcwg=";
+    sha256 = "sha256-+X53X/tZgcY/it++lY/Ov5FHwT8OfpZAfd398zs/dwI=";
   };
 
   nativeBuildInputs = [ libtool ];

pkgs/by-name/go/gotenberg/package.nix

@@ -0,0 +1,92 @@
+{
+  lib,
+  buildGoModule,
+  chromium,
+  fetchFromGitHub,
+  libreoffice,
+  makeBinaryWrapper,
+  pdftk,
+  qpdf,
+  unoconv,
+  mktemp,
+  makeFontsConf,
+  liberation_ttf_v2,
+  exiftool,
+  nix-update-script,
+}:
+let
+  fontsConf = makeFontsConf { fontDirectories = [ liberation_ttf_v2 ]; };
+  jre' = libreoffice.unwrapped.jdk;
+  libreoffice' = "${libreoffice}/lib/libreoffice/program/soffice.bin";
+  inherit (lib) getExe;
+in
+buildGoModule rec {
+  pname = "gotenberg";
+  version = "8.8.0";
+
+  src = fetchFromGitHub {
+    owner = "gotenberg";
+    repo = "gotenberg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OHvtdUFZYm+I8DN8lAdlNAIRLWNRC/GbVEueRfyrwDA=";
+  };
+
+  vendorHash = "sha256-w9Q3hK8d5NwDYp8kydrWrlBlOmMyDqDixdv3z79yhK8=";
+
+  postPatch = ''
+    find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \;
+  '';
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/gotenberg/gotenberg/v8/cmd.Version=${version}"
+  ];
+
+  checkInputs = [
+    chromium
+    libreoffice
+    pdftk
+    qpdf
+    unoconv
+    mktemp
+    jre'
+  ];
+
+  preCheck = ''
+    export CHROMIUM_BIN_PATH=${getExe chromium}
+    export PDFTK_BIN_PATH=${getExe pdftk}
+    export QPDF_BIN_PATH=${getExe qpdf}
+    export UNOCONVERTER_BIN_PATH=${getExe unoconv}
+    export EXIFTOOL_BIN_PATH=${getExe exiftool}
+    # LibreOffice needs all of these set to work properly
+    export LIBREOFFICE_BIN_PATH=${libreoffice'}
+    export FONTCONFIG_FILE=${fontsConf}
+    export HOME=$(mktemp -d)
+    export JAVA_HOME=${jre'}
+  '';
+
+  # These tests fail with a panic, so disable them.
+  checkFlags = [ "-skip=^TestChromiumBrowser_(screenshot|pdf)$" ];
+
+  preFixup = ''
+    wrapProgram $out/bin/gotenberg \
+      --set PDFTK_BIN_PATH "${getExe pdftk}" \
+      --set QPDF_BIN_PATH "${getExe qpdf}" \
+      --set UNOCONVERTER_BIN_PATH "${getExe unoconv}" \
+      --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \
+      --set JAVA_HOME "${jre'}"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Converts numerous document formats into PDF files";
+    homepage = "https://gotenberg.dev";
+    changelog = "https://github.com/gotenberg/gotenberg/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+}

pkgs/by-name/me/media-downloader/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "media-downloader";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "mhogomchungu";
     repo = "media-downloader";
     rev = finalAttrs.version;
-    hash = "sha256-ykPYxRgzKZrA0KwS1FoxZOkSL+7TbLgy0yLfs7Iqpf4=";
+    hash = "sha256-qSZb83gB9Kw6goY7RkWRWXpzHTF27EV5T59RitjSuc4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ni/nixtract/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  stdenv,
+  libiconv,
+  darwin,
+  nix,
+  testers,
+  nixtract,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nixtract";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "tweag";
+    repo = "nixtract";
+    rev = "v${version}";
+    hash = "sha256-36ciPNSlB1LU+UXP8MLakrBRRqbyiVFN8Jp/JbCe1OY=";
+  };
+
+  cargoHash = "sha256-fawBRIVcOhtDxxRYCf+HWYadoSB/ENKguTbS0M4odVU=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [
+      libiconv
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  nativeCheckInputs = [ nix ];
+
+  checkFlags = [
+    # Requiring network access
+    "--skip=nix::narinfo::tests::test_fetch"
+    "--skip=nix::substituters::tests::test_from_flake_ref"
+    # Requiring write to `/nix/var`
+    "--skip=nix::substituters::tests::test_get_substituters"
+    "--skip=tests::test_main_fixtures"
+  ];
+
+  passthru.tests.version = testers.testVersion { package = nixtract; };
+
+  meta = {
+    description = "CLI tool to extract the graph of derivations from a Nix flake";
+    homepage = "https://github.com/tweag/nixtract";
+    license = with lib.licenses; [
+      mit # or
+      asl20
+    ];
+    mainProgram = "nixtract";
+    maintainers = with lib.maintainers; [ aleksana ];
+  };
+}

pkgs/by-name/op/openvswitch/generic.nix

@@ -26,19 +26,23 @@
   which,
   writeScript,
   makeWrapper,
+  withDPDK ? false,
+  dpdk,
+  numactl,
+  libpcap,
 }:
 
 let
   _kernel = kernel;
 in
 stdenv.mkDerivation rec {
-  pname = "openvswitch";
+  pname = if withDPDK then "openvswitch-dpdk" else "openvswitch";
   inherit version;
 
   kernel = lib.optional (_kernel != null) _kernel.dev;
 
   src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
+    url = "https://www.openvswitch.org/releases/openvswitch-${version}.tar.gz";
     inherit hash;
   };
 
@@ -69,7 +73,8 @@ stdenv.mkDerivation rec {
 
   sphinxRoot = "./Documentation";
 
-  buildInputs = [
+  buildInputs =
+    [
       libcap_ng
       openssl
       perl
@@ -77,15 +82,23 @@ stdenv.mkDerivation rec {
       python3
       util-linux
       which
-  ];
+    ]
+    ++ (lib.optionals withDPDK [
+      dpdk
+      numactl
+      libpcap
+    ]);
 
   preConfigure = "./boot.sh";
 
-  configureFlags = [
+  configureFlags =
+    [
       "--localstatedir=/var"
       "--sharedstatedir=/var"
       "--sbindir=$(out)/bin"
-  ] ++ (lib.optionals (_kernel != null) [ "--with-linux" ]);
+    ]
+    ++ (lib.optionals (_kernel != null) [ "--with-linux" ])
+    ++ (lib.optionals withDPDK [ "--with-dpdk=shared" ]);
 
   # Leave /var out of this!
   installFlags = [
@@ -104,7 +117,7 @@ stdenv.mkDerivation rec {
       --prefix PYTHONPATH : $out/share/openvswitch/python
 
     wrapProgram $out/bin/ovs-tcpdump \
-      --prefix PATH : ${lib.makeBinPath [tcpdump]} \
+      --prefix PATH : ${lib.makeBinPath [ tcpdump ]} \
       --prefix PYTHONPATH : $out/share/openvswitch/python
   '';
 
@@ -148,6 +161,7 @@ stdenv.mkDerivation rec {
       adamcstephens
       kmcopper
       netixx
+      xddxdd
     ];
     platforms = platforms.linux;
   };

pkgs/by-name/ph/phpunit/package.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "phpunit";
-  version = "11.2.6";
+  version = "11.2.7";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     rev = finalAttrs.version;
-    hash = "sha256-cR7tJlx0cnWPDWoZAVrGY1UGe9lS4pohFaViC/MxT+w=";
+    hash = "sha256-s/zfTW8a+E/FOuHg+oSpVZdxBdfIVL0RmvBBcI6zB9Y=";
   };
 
-  vendorHash = "sha256-B/uo1isTpGPwQc2K752OwwuNU6jy/YFNWvun8nSSKqM=";
+  vendorHash = "sha256-Gjii3m8wWmZbozKnJW/n9+wQUupemIU8XjmlCuTtfxU=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ra/radicle-node/package.nix

@@ -7,6 +7,8 @@
 , lib
 , makeWrapper
 , man-db
+, nixos
+, nixosTests
 , openssh
 , radicle-node
 , runCommand
@@ -89,6 +91,19 @@
 
         touch $out
       '';
+      nixos-build = lib.recurseIntoAttrs {
+        checkConfig-success = (nixos {
+            services.radicle.settings = {
+              node.alias = "foo";
+            };
+          }).config.services.radicle.configFile;
+        checkConfig-failure = testers.testBuildFailure (nixos {
+            services.radicle.settings = {
+              node.alias = null;
+            };
+          }).config.services.radicle.configFile;
+      };
+      nixos-run = nixosTests.radicle;
     };
 
   meta = {

pkgs/by-name/sh/shoutrrr/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "0.8.0";
+in
+buildGoModule {
+  pname = "shoutrrr";
+  inherit version;
+
+  src = fetchFromGitHub {
+    repo = "shoutrrr";
+    owner = "containrrr";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DGyFo2oRZ39r1awqh5AXjOL2VShABarFbOMIcEXlWq4=";
+  };
+
+  vendorHash = "sha256-+LDA3Q6OSxHwKYoO5gtNUryB9EbLe2jJtUbLXnA2Lug=";
+
+  meta = {
+    description = "Notification library for gophers and their furry friends";
+    homepage = "https://github.com/containrrr/shoutrrr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ JManch ];
+    platforms = lib.platforms.unix;
+    mainProgram = "shoutrrr";
+  };
+}

pkgs/by-name/ta/talecast/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchCrate,
+  darwin,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
+  stdenv,
+  testers,
+  talecast
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "talecast";
+  version = "0.1.39";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-RwB+X+i3CEcTyKac81he9/cT2aQ4M7AqgqSDBEvhFJU=";
+  };
+
+  cargoHash = "sha256-mIzrYlAqHYrK2bb/ZUzqIwhPJKcTQpNpqijpEuwLc5A=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = talecast; };
+  };
+
+  meta = {
+    description = "Simple CLI podcatcher";
+    homepage = "https://github.com/TBS1996/TaleCast";
+    license = lib.licenses.mit;
+    mainProgram = "talecast";
+    maintainers = with lib.maintainers; [ confusedalex getchoo ];
+  };
+}

pkgs/by-name/td/tdnf/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tdnf";
-  version = "3.5.7";
+  version = "3.5.8";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "tdnf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+oVmIZqWi1JdiOv40C4dS2a9VqK3hzGl+PQ7sk1l11o=";
+    hash = "sha256-rs6NMIwpJCBsO7Ca+za8pVJXQwpcgFvpd15ayS01mQM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ti/tippecanoe/package.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.55.0";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-hF1tiI5M8BdJoJEZDqC6BkzndmYRQU4jHhjUvYowBTU=";
+    hash = "sha256-n1ZhOlhrI1cSOwv7NP2VDAPC/2HmMJBkNLH6NPY3BnM=";
   };
 
   buildInputs = [ sqlite zlib ];

pkgs/by-name/ty/typstyle/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typstyle";
-  version = "0.11.29";
+  version = "0.11.30";
 
   src = fetchFromGitHub {
     owner = "Enter-tainer";
     repo = "typstyle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7BjbML7mz5ohEdh+x6qL8pH2BTFW8WdtB0g91NHFIBY=";
+    hash = "sha256-pdIgngLn0y4+N4nD5b6E8UL1ftinWO9ofde1Vw3Pn7o=";
   };
 
-  cargoHash = "sha256-bcOfgiQ7mT7HE1hUXfBlj6SzMUtS5Ar2X9kjFGKPR2w=";
+  cargoHash = "sha256-+iBxVTwAzYpLio9BKD1hYsTw4GgK6CkmbyM5QIiswck=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/wi/wit-bindgen/package.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wit-bindgen";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${version}";
-    hash = "sha256-df2MBn5Ob9lQleiaKJnxFotI0AmdGJs/ifS9WCObXUo=";
+    hash = "sha256-WE+a0y97aPWEUHZT/LRjZ/WRZP7QxF4DXVjJVRjuJFU=";
   };
 
-  cargoHash = "sha256-y1jyDRPoaeoZYPTqonYwMOtOkQ/S54mbbTU2jBX6Teg=";
+  cargoHash = "sha256-Z6dBlYT4aYh92LZGH/+NAkkf80KZtId1emVaeOfpEjM=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.

pkgs/by-name/ya/yandex-cloud/package.nix

@@ -0,0 +1,99 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeBinaryWrapper,
+  installShellFiles,
+  buildPackages,
+  withShellCompletions ? stdenv.hostPlatform.emulatorAvailable buildPackages,
+  # update script
+  writers,
+  python3Packages,
+  nix,
+  # tests
+  testers,
+  yandex-cloud,
+}:
+let
+  pname = "yandex-cloud";
+  sources = lib.importJSON ./sources.json;
+  inherit (sources) version binaries;
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchurl binaries.${stdenv.hostPlatform.system};
+
+  dontUnpack = true;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
+
+  emulator = lib.optionalString (
+    withShellCompletions && !stdenv.buildPlatform.canExecute stdenv.hostPlatform
+  ) (stdenv.hostPlatform.emulator buildPackages);
+
+  installPhase =
+    ''
+      runHook preInstall
+      mkdir -p -- "$out/bin"
+      cp -- "$src" "$out/bin/yc"
+      chmod +x -- "$out/bin/yc"
+    ''
+    + lib.optionalString withShellCompletions ''
+      for shell in bash zsh; do
+        ''${emulator:+"$emulator"} "$out/bin/yc" completion $shell >yc.$shell
+        installShellCompletion yc.$shell
+      done
+    ''
+    + ''
+      makeWrapper "$out/bin/yc" "$out/bin/docker-credential-yc" \
+        --add-flags --no-user-output \
+        --add-flags container \
+        --add-flags docker-credential
+      runHook postInstall
+    '';
+
+  passthru = {
+    updateScript = writers.writePython3 "${pname}-updater" {
+      libraries = with python3Packages; [ requests ];
+      makeWrapperArgs = [
+        "--prefix"
+        "PATH"
+        ":"
+        (lib.makeBinPath [ nix ])
+      ];
+    } ./update.py;
+    tests.version = testers.testVersion { package = yandex-cloud; };
+  };
+
+  meta = {
+    description = "Command line interface that helps you interact with Yandex Cloud services";
+    homepage = "https://cloud.yandex/docs/cli";
+    changelog = "https://cloud.yandex/docs/cli/release-notes#version${version}";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.tie ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "aarch64-linux"
+      "x86_64-linux"
+      # Built with GO386=sse2.
+      #
+      # Unfortunately, we don’t have anything about SSE2 support in lib.systems,
+      # so we can’t mark this a broken or bad platform if host platform does not
+      # support SSE2. See also https://github.com/NixOS/nixpkgs/issues/132217
+      #
+      # Perhaps it would be possible to mark it as broken if platform declares
+      # GO386=softfloat once https://github.com/NixOS/nixpkgs/pull/256761 is
+      # ready and merged.
+      "i686-linux"
+    ];
+    mainProgram = "yc";
+  };
+}

pkgs/by-name/ya/yandex-cloud/sources.json

@@ -0,0 +1,25 @@
+{
+  "version": "0.129.0",
+  "binaries": {
+    "aarch64-darwin": {
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.129.0/darwin/arm64/yc",
+      "hash": "sha256-ULd/fmWDBPPALf6Rb95n6zXsSuDBAkeWNH11f5PLIpE="
+    },
+    "aarch64-linux": {
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.129.0/linux/arm64/yc",
+      "hash": "sha256-Tvy9hTpp37EUrEIDglNFqrH0laD0O+wwVWlCIBh6Jag="
+    },
+    "i686-linux": {
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.129.0/linux/386/yc",
+      "hash": "sha256-rmcXdz7z1iXOUQTq0sFNNcZ1jG/Dypxfl2oyeJiwkjs="
+    },
+    "x86_64-darwin": {
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.129.0/darwin/amd64/yc",
+      "hash": "sha256-DjAifjGBiRvJDx3j4iMR/t7zOITaz/iulfeDUZCvIhE="
+    },
+    "x86_64-linux": {
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.129.0/linux/amd64/yc",
+      "hash": "sha256-igj1iwznsL1OG3V8hOQVCbticzOtDH8dF8jLzMxO5Fg="
+    }
+  }
+}

pkgs/by-name/ya/yandex-cloud/update.py

@@ -0,0 +1,107 @@
+import json
+import os
+import requests
+import shutil
+import subprocess
+import sys
+import tempfile
+
+# See YC_SDK_STORAGE_URL in
+# https://storage.yandexcloud.net/yandexcloud-yc/install.sh
+storage_url = "https://storage.yandexcloud.net/yandexcloud-yc"
+
+systems = [
+    ("aarch64", "darwin"),
+    ("aarch64", "linux"),
+    ("i686", "linux"),
+    ("x86_64", "darwin"),
+    ("x86_64", "linux"),
+]
+
+
+def to_goarch(cpu):
+    return {
+        "aarch64": "arm64",
+        "i686": "386",
+        "x86_64": "amd64",
+    }.get(cpu, cpu)
+
+
+nixpkgs_path = "."
+attr_path = os.getenv("UPDATE_NIX_ATTR_PATH", "yandex-cloud")
+
+package_attrs = json.loads(subprocess.run(
+    [
+        "nix",
+        "--extra-experimental-features", "nix-command",
+        "eval",
+        "--json",
+        "--file", nixpkgs_path,
+        "--apply", """p: {
+          dir = builtins.dirOf p.meta.position;
+          version = p.version;
+        }""",
+        "--",
+        attr_path,
+    ],
+    stdout=subprocess.PIPE,
+    text=True,
+    check=True,
+).stdout)
+
+old_version = package_attrs["version"]
+new_version = requests.get(f"{storage_url}/release/stable").text.rstrip()
+
+if new_version == old_version:
+    sys.exit()
+
+binaries = {}
+for cpu, kernel in systems:
+    goos = kernel
+    goarch = to_goarch(cpu)
+    system = f"{cpu}-{kernel}"
+
+    url = f"{storage_url}/release/{new_version}/{goos}/{goarch}/yc"
+
+    nix_hash = subprocess.run(
+        [
+            "nix-prefetch-url",
+            "--type", "sha256",
+            url,
+        ],
+        stdout=subprocess.PIPE,
+        text=True,
+        check=True,
+    ).stdout.rstrip()
+
+    sri_hash = subprocess.run(
+        [
+            "nix",
+            "--extra-experimental-features", "nix-command",
+            "hash",
+            "to-sri",
+            "--type", "sha256",
+            "--",
+            nix_hash,
+        ],
+        stdout=subprocess.PIPE,
+        text=True,
+        check=True,
+    ).stdout.rstrip()
+
+    binaries[system] = {
+        "url": url,
+        "hash": sri_hash,
+    }
+
+package_dir = package_attrs["dir"]
+file_path = os.path.join(package_dir, "sources.json")
+file_content = json.dumps({
+    "version": new_version,
+    "binaries": binaries,
+}, indent=2) + "\n"
+
+with tempfile.NamedTemporaryFile(mode="w") as t:
+    t.write(file_content)
+    t.flush()
+    shutil.copyfile(t.name, file_path)

pkgs/development/compilers/go/1.23.nix

@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.23rc1";
+  version = "1.23rc2";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-bpxHZYcoCGY8zwuTflY3x99nFGlD+m6JCagaDRKcgEU=";
+    hash = "sha256-9pnOJWD8Iq2CwGseBLYxi4Xn9obLy0/OFWWCEyxX2Ps=";
   };
 
   strictDeps = true;

pkgs/development/libraries/audio/ntk/default.nix

@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
     cairo libjpeg libXft python3
   ];
 
+  # NOTE: ntk provides its own waf script that is incompatible with new
+  # python versions. If the script is not present, wafHook will install
+  # a compatible version from nixpkgs.
+  prePatch = ''
+    rm waf
+  '';
+
   meta = {
     description = "Fork of FLTK 1.3.0 with additional functionality";
     version = version;

pkgs/development/libraries/clipper2/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clipper2";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "AngusJohnson";
     repo = "Clipper2";
     rev = "Clipper2_${version}";
-    sha256 = "sha256-3TKhb48cABl0QcbeG12xlA1taQ/8/RdUUHSp0Qh85eE=";
+    sha256 = "sha256-ASL9uKkXsWyIbD1qaKEL7gf/JuCqzZQZSKHwLT5dKJU=";
   };
 
   sourceRoot = "${src.name}/CPP";

pkgs/development/libraries/onnxruntime/default.nix

@@ -159,6 +159,7 @@ effectiveStdenv.mkDerivation rec {
     libcufft # cufft.h
     cudnn # cudnn.h
     cuda_cudart
+    nccl
   ]);
 
   nativeCheckInputs = [

pkgs/development/libraries/qt-6/modules/qtwayland.nix

@@ -20,5 +20,19 @@ qtModule {
       url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/92bcb8f6b7a852c7a5d662fc34de561692a7a454.diff";
       sha256 = "sha256-XgGO8VnmQHLhUxTGf9CniwkCr5FsFiuUbnVP0NLNekI=";
     })
+
+    # Included in qtwayland 6.7.3
+    # Fixes https://bugs.kde.org/show_bug.cgi?id=489072
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/c4f91b479303dda2e49499de249018d7c66c5f99.diff";
+      sha256 = "sha256-4rUdl6WuJHONW0Uy2wjTvyvDY3bJWeRvhk3tCkaOOro=";
+    })
+
+    # Included in qtwayland 6.7.3
+    # Fixes https://bugs.kde.org/show_bug.cgi?id=489180
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/632127d7f1d86cba4dd17361f24f9fd70a0ae44c.diff";
+      sha256 = "sha256-1EIcMj6+yIpqXAGZB3ZbrwRkl4n1o7TVP2SC1Nu1t78=";
+    })
   ];
 }

pkgs/development/ocaml-modules/alcotest/lwt.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, alcotest, logs, lwt, fmt
+{ buildDunePackage, alcotest, logs, lwt, fmt
 , re, cmdliner
 }:
 

pkgs/development/ocaml-modules/asetmap/default.nix

@@ -1,5 +1,4 @@
-{ lib
+{ fetchurl
-, fetchurl
 , buildDunePackage
 , topkg
 , findlib

pkgs/development/ocaml-modules/atdgen/default.nix

@@ -1,4 +1,4 @@
-{ buildDunePackage, alcotest, atd, atdgen-codec-runtime, atdgen-runtime, biniou, re, yojson
+{ buildDunePackage, alcotest, atd, atdgen-codec-runtime, atdgen-runtime, re
 , python3
 }:
 

pkgs/development/ocaml-modules/awa/default.nix

@@ -2,7 +2,7 @@
 , ppx_sexp_conv
 , mirage-crypto, mirage-crypto-ec, mirage-crypto-rng, mirage-crypto-pk
 , x509, cstruct, cstruct-unix, cstruct-sexp, sexplib, eqaf-cstruct
-, rresult, mtime, logs, fmt, cmdliner, base64
+, mtime, logs, fmt, cmdliner, base64
 , zarith
 }:
 

pkgs/development/ocaml-modules/batteries/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildDunePackage, ocaml, qtest, qcheck, num, camlp-streams
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, qtest, qcheck, num, camlp-streams
 , doCheck ? lib.versionAtLeast ocaml.version "4.08"
 }:
 

pkgs/development/ocaml-modules/bigstringaf/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml, alcotest, bigarray-compat, pkg-config }:
+{ lib, fetchFromGitHub, buildDunePackage, alcotest, pkg-config }:
 
 buildDunePackage rec {
   pname = "bigstringaf";

pkgs/development/ocaml-modules/caqti/async.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, async_kernel, async_unix, caqti, core_kernel }:
+{ buildDunePackage, async_kernel, async_unix, caqti, core_kernel }:
 
 buildDunePackage {
   pname = "caqti-async";

pkgs/development/ocaml-modules/caqti/driver-mariadb.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, caqti, mariadb }:
+{ buildDunePackage, caqti, mariadb }:
 
 buildDunePackage {
   pname = "caqti-driver-mariadb";

pkgs/development/ocaml-modules/caqti/driver-postgresql.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, caqti, postgresql }:
+{ buildDunePackage, caqti, postgresql }:
 
 buildDunePackage {
   pname = "caqti-driver-postgresql";

pkgs/development/ocaml-modules/caqti/driver-sqlite3.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, caqti, ocaml_sqlite3, alcotest }:
+{ buildDunePackage, caqti, ocaml_sqlite3, alcotest }:
 
 buildDunePackage {
   pname = "caqti-driver-sqlite3";

pkgs/development/ocaml-modules/caqti/dynload.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, caqti, findlib }:
+{ buildDunePackage, caqti, findlib }:
 
 buildDunePackage {
   pname = "caqti-dynload";

pkgs/development/ocaml-modules/caqti/lwt.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, caqti, logs, lwt }:
+{ buildDunePackage, caqti, logs, lwt }:
 
 buildDunePackage {
   pname = "caqti-lwt";

pkgs/development/ocaml-modules/caqti/type-calendar.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, calendar, caqti }:
+{ buildDunePackage, calendar, caqti }:
 
 buildDunePackage {
   pname = "caqti-type-calendar";

pkgs/development/ocaml-modules/carton/git.nix

@@ -1,8 +1,6 @@
 { buildDunePackage, carton, carton-lwt
 , bigstringaf, lwt, fpath, result
 , fmt, decompress, astring
-, alcotest, alcotest-lwt, cstruct, logs
-, mirage-flow, rresult, ke
 }:
 
 buildDunePackage {

pkgs/development/ocaml-modules/cmdliner/1_0.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, result }:
+{ lib, stdenv, fetchurl, ocaml }:
 
 assert (lib.versionAtLeast ocaml.version "4.03");
 

pkgs/development/ocaml-modules/cmdliner/1_1.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, result }:
+{ lib, stdenv, fetchurl, ocaml }:
 
 lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
   "cmdliner 1.1 is not available for OCaml ${ocaml.version}"

pkgs/development/ocaml-modules/cohttp/async.nix

@@ -1,5 +1,4 @@
-{ lib
+{ buildDunePackage
-, buildDunePackage
 , ppx_sexp_conv
 , base
 , async

pkgs/development/ocaml-modules/cohttp/default.nix

@@ -1,6 +1,6 @@
 { lib, fetchurl, buildDunePackage
 , ppx_sexp_conv, base64, jsonm, re, stringext, uri-sexp
-, ocaml, fmt, alcotest
+, fmt, alcotest
 , crowbar
 }:
 

pkgs/development/ocaml-modules/cohttp/lwt-jsoo.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage
+{ buildDunePackage
 , cohttp, cohttp-lwt, logs, lwt, js_of_ocaml, js_of_ocaml-ppx, js_of_ocaml-lwt
 , nodejs, lwt_ppx
 }:

pkgs/development/ocaml-modules/cohttp/lwt-unix.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, cohttp-lwt
+{ buildDunePackage, cohttp-lwt
 , conduit-lwt-unix, conduit-lwt, ppx_sexp_conv
 , cmdliner, fmt, logs, magic-mime
 , ounit

pkgs/development/ocaml-modules/cohttp/lwt.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, cohttp, lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
+{ buildDunePackage, cohttp, lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
 
 buildDunePackage {
   pname = "cohttp-lwt";

pkgs/development/ocaml-modules/cohttp/top.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, cohttp }:
+{ buildDunePackage, cohttp }:
 
 buildDunePackage {
   pname = "cohttp-top";

pkgs/development/ocaml-modules/conduit/async.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, async, async_ssl ? null, ppx_sexp_conv, ppx_here, uri, conduit
+{ buildDunePackage, async, async_ssl ? null, ppx_sexp_conv, ppx_here, uri, conduit
 , core, ipaddr, ipaddr-sexp, sexplib
 }:
 

pkgs/development/ocaml-modules/cstruct/async.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, cstruct, async_unix, async, core }:
+{ buildDunePackage, cstruct, async_unix, async, core }:
 
 buildDunePackage rec {
   pname = "cstruct-async";

pkgs/development/ocaml-modules/csv/csvtool.nix

@@ -1,4 +1,4 @@
-{ lib, ocamlPackages }:
+{ ocamlPackages }:
 
 let inherit (ocamlPackages) buildDunePackage csv uutf; in
 

pkgs/development/ocaml-modules/csv/lwt.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, csv, lwt }:
+{ buildDunePackage, csv, lwt }:
 
 buildDunePackage {
   pname = "csv-lwt";

pkgs/development/ocaml-modules/curly/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, buildDunePackage, fetchurl, ocaml
-, result, alcotest, cohttp-lwt-unix, odoc, curl, cacert
+, result, alcotest, cohttp-lwt-unix, curl, cacert
 }:
 
 buildDunePackage rec {

pkgs/development/ocaml-modules/data-encoding/default.nix

@@ -9,8 +9,6 @@
 , hex
 , json-data-encoding
 , json-data-encoding-bson
-, alcotest
-, crowbar
 , ppx_expect
 }:
 

pkgs/development/ocaml-modules/dns/client-lwt.nix

@@ -1,9 +1,8 @@
-{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+{ buildDunePackage, dns, dns-client, lwt
-, mirage-random, mirage-crypto-rng, mtime, randomconv
+, mirage-crypto-rng, mtime
-, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, ipaddr, alcotest
-, ca-certs, ca-certs-nss
+, ca-certs
 , happy-eyeballs
-, tcpip
 , tls-lwt
 }:
 

pkgs/development/ocaml-modules/dns/client-mirage.nix

@@ -1,7 +1,7 @@
-{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+{ buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
-, mirage-random, mirage-crypto-rng, mtime, randomconv
+, mirage-random
-, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, domain-name, ipaddr
-, ca-certs, ca-certs-nss
+, ca-certs-nss
 , happy-eyeballs
 , tcpip
 , tls, tls-mirage

pkgs/development/ocaml-modules/dns/client.nix

@@ -1,10 +1,6 @@
-{ lib, buildDunePackage, dns, lwt, mirage-clock, mirage-time
+{ buildDunePackage, dns
-, mirage-random, mirage-crypto-rng, mtime, randomconv
+, mirage-crypto-rng, mtime, randomconv
-, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, domain-name, alcotest
-, ca-certs, ca-certs-nss
-, happy-eyeballs
-, tcpip
-, tls, tls-mirage
 }:
 
 buildDunePackage {

pkgs/development/ocaml-modules/dyn/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, dune_3, ordering }:
+{ buildDunePackage, dune_3, ordering }:
 
 buildDunePackage {
   pname = "dyn";

pkgs/development/ocaml-modules/earley/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, ocaml, buildDunePackage
+{ lib, fetchFromGitHub, buildDunePackage
 , stdlib-shims
 }:
 

pkgs/development/ocaml-modules/earlybird/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, ocaml, buildDunePackage
+{ lib, fetchFromGitHub, buildDunePackage
 , cmdliner, dap, fmt, iter, logs, lru, lwt_ppx, lwt_react, menhir, menhirLib, path_glob, ppx_deriving_yojson
 , ppx_optcomp
 , gitUpdater

pkgs/development/ocaml-modules/eio/default.nix

@@ -5,7 +5,6 @@
 , bigstringaf
 , cstruct
 , domain-local-await
-, dune-configurator
 , fetchurl
 , fmt
 , hmap

pkgs/development/ocaml-modules/emile/default.nix

@@ -1,7 +1,6 @@
 { lib
 , buildDunePackage
 , fetchurl
-, ocaml
 , angstrom
 , ipaddr
 , base64

pkgs/development/ocaml-modules/faraday/async.nix

@@ -1,4 +1,4 @@
-{ buildDunePackage, lib, faraday, core_unix ? null, async }:
+{ buildDunePackage, faraday, core_unix ? null, async }:
 
 buildDunePackage rec {
   pname = "faraday-async";

pkgs/development/ocaml-modules/faraday/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml, alcotest, bigstringaf }:
+{ lib, fetchFromGitHub, buildDunePackage, alcotest, bigstringaf }:
 
 buildDunePackage rec {
   pname = "faraday";

pkgs/development/ocaml-modules/ff/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, ff-pbt, ff-sig, zarith, alcotest }:
+{ buildDunePackage, ff-pbt, ff-sig, zarith, alcotest }:
 
 buildDunePackage rec {
   pname = "ff";

pkgs/development/ocaml-modules/ff/pbt.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, zarith, ff-sig, alcotest }:
+{ buildDunePackage, zarith, ff-sig, alcotest }:
 
 buildDunePackage {
   pname = "ff-pbt";

pkgs/development/ocaml-modules/ffmpeg/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, callPackage
+{ buildDunePackage, callPackage
 , ffmpeg-base ? callPackage ./base.nix { }
 , ffmpeg-avutil
 , ffmpeg-avcodec

pkgs/development/ocaml-modules/fiber/default.nix

@@ -2,7 +2,6 @@
 , buildDunePackage
 , dyn
 , fetchurl
-, ocaml
 , ppx_expect
 , stdune
 }:

pkgs/development/ocaml-modules/gapi-ocaml/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml
+{ lib, fetchFromGitHub, buildDunePackage
 , camlp-streams, cppo, cryptokit, ocurl, yojson
 , ounit2
 }:

pkgs/development/ocaml-modules/git/mirage.nix

@@ -1,5 +1,4 @@
-{ lib
+{ buildDunePackage
-, buildDunePackage
 , git
 , mimic
 , mimic-happy-eyeballs

pkgs/development/ocaml-modules/git/paf.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage
+{ buildDunePackage
 , git
 , mimic
 , paf

pkgs/development/ocaml-modules/github/data.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, github
+{ buildDunePackage, github
 , yojson, atdgen
 }:
 

pkgs/development/ocaml-modules/github/jsoo.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, github
+{ buildDunePackage, github
 , cohttp, cohttp-lwt-jsoo, js_of_ocaml-lwt
 }:
 

pkgs/development/ocaml-modules/github/unix.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, github
+{ buildDunePackage, github
 , cohttp, cohttp-lwt-unix, stringext, cmdliner, lwt
 }:
 

pkgs/development/ocaml-modules/gitlab/jsoo.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   buildDunePackage,
   gitlab,
   cohttp,

pkgs/development/ocaml-modules/gitlab/unix.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   buildDunePackage,
   gitlab,
   cmdliner,

pkgs/development/ocaml-modules/gluten/eio.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, gluten, eio }:
+{ buildDunePackage, gluten, eio }:
 
 buildDunePackage {
   pname = "gluten-eio";