From 751f2037b730cb3a6fb879c5502cb51c7bc36b95 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Tue, 15 Aug 2023 09:35:18 +0200
Subject: [PATCH 01/84] python311Packages.base64io: init at 1.0.3

---
 .../python-modules/base64io/default.nix       | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/python-modules/base64io/default.nix

diff --git a/pkgs/development/python-modules/base64io/default.nix b/pkgs/development/python-modules/base64io/default.nix
new file mode 100644
index 0000000000000..8e5b121759fc4
--- /dev/null
+++ b/pkgs/development/python-modules/base64io/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "base64io";
+  version = "1.0.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-JPLQ/nZcNTOeGy0zqpX5E3sbdltZQWT60QFsFYJ6cHM=";
+  };
+
+  nativeCheckInputs = [
+    mock
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    homepage = "https://base64io-python.readthedocs.io/";
+    changelog = "https://github.com/aws/base64io-python/blob/${version}/CHANGELOG.rst";
+    description = "Python stream implementation for base64 encoding/decoding";
+    license = licenses.apsl20;
+    maintainers = with maintainers; [ anthonyroussel ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1dab3acea7183..4f8349a689390 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1239,6 +1239,8 @@ self: super: with self; {
 
   base58check = callPackage ../development/python-modules/base58check { };
 
+  base64io = callPackage ../development/python-modules/base64io { };
+
   baseline = callPackage ../development/python-modules/baseline { };
 
   baselines = callPackage ../development/python-modules/baselines { };

From 212f361bc57af3a2f0526f178c1ad93eb3c56090 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Tue, 15 Aug 2023 09:36:15 +0200
Subject: [PATCH 02/84] python311Packages.aws-encryption-sdk: init at 3.1.1

---
 .../aws-encryption-sdk/default.nix            | 54 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 56 insertions(+)
 create mode 100644 pkgs/development/python-modules/aws-encryption-sdk/default.nix

diff --git a/pkgs/development/python-modules/aws-encryption-sdk/default.nix b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
new file mode 100644
index 0000000000000..6088e22e80d7f
--- /dev/null
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, attrs
+, boto3
+, cryptography
+, setuptools
+, wrapt
+, mock
+, pytest
+, pytest-mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "aws-encryption-sdk";
+  version = "3.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-jV+/AY/GjWscrL5N0Df9gFKWx3Nqn+RX62hNBT9/lWM=";
+  };
+
+  propagatedBuildInputs = [
+    attrs
+    boto3
+    cryptography
+    setuptools
+    wrapt
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    mock
+    pytest
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # requires networking
+    "examples"
+    "test/integration"
+  ];
+
+  meta = with lib; {
+    homepage = "https://aws-encryption-sdk-python.readthedocs.io/";
+    changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/v${version}/CHANGELOG.rst";
+    description = "Fully compliant, native Python implementation of the AWS Encryption SDK.";
+    license = licenses.apsl20;
+    maintainers = with maintainers; [ anthonyroussel ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f8349a689390..5b794ecb7e4dc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -903,6 +903,8 @@ self: super: with self; {
 
   aws-adfs = callPackage ../development/python-modules/aws-adfs { };
 
+  aws-encryption-sdk = callPackage ../development/python-modules/aws-encryption-sdk { };
+
   aws-lambda-builders = callPackage ../development/python-modules/aws-lambda-builders { };
 
   aws-sam-translator = callPackage ../development/python-modules/aws-sam-translator { };

From c8866dd30227d2353beb14ddeb294c16d59d5536 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Tue, 15 Aug 2023 09:36:46 +0200
Subject: [PATCH 03/84] aws-encryption-sdk-cli: init at 4.1.0

---
 .../admin/aws-encryption-sdk-cli/default.nix  | 52 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/tools/admin/aws-encryption-sdk-cli/default.nix

diff --git a/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix b/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
new file mode 100644
index 0000000000000..29b51a678dbf9
--- /dev/null
+++ b/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, python3Packages
+, fetchPypi
+, nix-update-script
+, testers
+, aws-encryption-sdk-cli
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "aws-encryption-sdk-cli";
+  version = "4.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-OCbt0OkDVfpzUIogbsKzaPAle2L6l6N3cmZoS2hEaSM=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    attrs
+    aws-encryption-sdk
+    base64io
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = with python3Packages; [
+    mock
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # requires networking
+    "test/integration"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = aws-encryption-sdk-cli;
+      command = "aws-encryption-cli --version";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://aws-encryption-sdk-cli.readthedocs.io/";
+    changelog = "https://github.com/aws/aws-encryption-sdk-cli/blob/v${version}/CHANGELOG.rst";
+    description = "CLI wrapper around aws-encryption-sdk-python";
+    license = licenses.apsl20;
+    maintainers = with maintainers; [ anthonyroussel ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dd3d3e9cc05c9..706d3fe1b5f0b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3246,6 +3246,8 @@ with pkgs;
 
   aliyun-cli = callPackage ../tools/admin/aliyun-cli { };
 
+  aws-encryption-sdk-cli = callPackage ../tools/admin/aws-encryption-sdk-cli { };
+
   aws-iam-authenticator = callPackage ../tools/security/aws-iam-authenticator { };
 
   awscli = callPackage ../tools/admin/awscli { };

From 5b8893c5653b64300e86a1b515f31737b2cee18e Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 26 Aug 2023 12:22:19 +0200
Subject: [PATCH 04/84] CODEOWNERS: remove matthewbauer

matthewbauer has been missing for almost a year now, it does not seem reasonable
to keep them and spam their GitHub notifications further.
---
 .github/CODEOWNERS | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ba5bf4eef25d1..6369e757c7cb5 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -23,7 +23,7 @@
 
 # Libraries
 /lib                        @edolstra @infinisil
-/lib/systems                @alyssais @ericson2314 @matthewbauer @amjoseph-nixpkgs
+/lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
 /lib/generators.nix         @edolstra @Profpatsch
 /lib/cli.nix                @edolstra @Profpatsch
 /lib/debug.nix              @edolstra @Profpatsch
@@ -34,12 +34,12 @@
 /default.nix                                     @Ericson2314
 /pkgs/top-level/default.nix                      @Ericson2314
 /pkgs/top-level/impure.nix                       @Ericson2314
-/pkgs/top-level/stage.nix                        @Ericson2314 @matthewbauer
-/pkgs/top-level/splice.nix                       @Ericson2314 @matthewbauer
-/pkgs/top-level/release-cross.nix                @Ericson2314 @matthewbauer
-/pkgs/stdenv/generic                             @Ericson2314 @matthewbauer @amjoseph-nixpkgs
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @matthewbauer @piegamesde
-/pkgs/stdenv/cross                               @Ericson2314 @matthewbauer @amjoseph-nixpkgs
+/pkgs/top-level/stage.nix                        @Ericson2314
+/pkgs/top-level/splice.nix                       @Ericson2314
+/pkgs/top-level/release-cross.nix                @Ericson2314
+/pkgs/stdenv/generic                             @Ericson2314 @amjoseph-nixpkgs
+/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @piegamesde
+/pkgs/stdenv/cross                               @Ericson2314 @amjoseph-nixpkgs
 /pkgs/build-support/cc-wrapper                   @Ericson2314 @amjoseph-nixpkgs
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
@@ -135,12 +135,8 @@
 /doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
 # C compilers
-/pkgs/development/compilers/gcc @matthewbauer @amjoseph-nixpkgs
-/pkgs/development/compilers/llvm @matthewbauer @RaitoBezarius
-
-# Compatibility stuff
-/pkgs/top-level/unix-tools.nix @matthewbauer
-/pkgs/development/tools/xcbuild @matthewbauer
+/pkgs/development/compilers/gcc @amjoseph-nixpkgs
+/pkgs/development/compilers/llvm @RaitoBezarius
 
 # Audio
 /nixos/modules/services/audio/botamusique.nix @mweinelt

From 48abfde844547c1b62c8a082ccccd9caf2d650bd Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 18:42:12 +0200
Subject: [PATCH 05/84] lib/fileset: Test function improvement

We can now test returned paths being equal, no need to work around it
anymore by making sure paths aren't returned (which would import them
with the previous --json)
---
 lib/fileset/tests.sh | 59 +++++++++++++++++++++++++-------------------
 1 file changed, 34 insertions(+), 25 deletions(-)

diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 9492edf4f55e4..88cd4bcc47c9c 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -50,27 +50,37 @@ with lib;
 with internal;
 with lib.fileset;'
 
-# Check that a nix expression evaluates successfully (strictly, coercing to json, read-write-mode).
+# Check that two nix expression successfully evaluate to the same value.
+# The expressions have `lib.fileset` in scope.
+# Usage: expectEqual NIX NIX
+expectEqual() {
+    local actualExpr=$1
+    local expectedExpr=$2
+    if ! actualResult=$(nix-instantiate --eval --strict --show-trace \
+        --expr "$prefixExpression ($actualExpr)"); then
+        die "$actualExpr failed to evaluate, but it was expected to succeed"
+    fi
+    if ! expectedResult=$(nix-instantiate --eval --strict --show-trace \
+        --expr "$prefixExpression ($expectedExpr)"); then
+        die "$expectedExpr failed to evaluate, but it was expected to succeed"
+    fi
+
+    if [[ "$actualResult" != "$expectedResult" ]]; then
+        die "$actualExpr should have evaluated to $expectedExpr:\n$expectedResult\n\nbut it evaluated to\n$actualResult"
+    fi
+}
+
+# Check that a nix expression evaluates successfully to a store path and returns it (without quotes).
 # The expression has `lib.fileset` in scope.
-# If a second argument is provided, the result is checked against it as a regex.
-# Otherwise, the result is output.
-# Usage: expectSuccess NIX [REGEX]
-expectSuccess() {
+# Usage: expectStorePath NIX
+expectStorePath() {
     local expr=$1
-    if [[ "$#" -gt 1 ]]; then
-        local expectedResultRegex=$2
-    fi
     if ! result=$(nix-instantiate --eval --strict --json --read-write-mode --show-trace \
-        --expr "$prefixExpression $expr"); then
+        --expr "$prefixExpression ($expr)"); then
         die "$expr failed to evaluate, but it was expected to succeed"
     fi
-    if [[ -v expectedResultRegex ]]; then
-        if [[ ! "$result" =~ $expectedResultRegex ]]; then
-            die "$expr should have evaluated to this regex pattern:\n\n$expectedResultRegex\n\nbut this was the actual result:\n\n$result"
-        fi
-    else
-        echo "$result"
-    fi
+    # This is safe because we assume to get back a store path in a string
+    crudeUnquoteJSON <<< "$result"
 }
 
 # Check that a nix expression fails to evaluate (strictly, coercing to json, read-write-mode).
@@ -164,8 +174,7 @@ checkFileset() (
 
     # Call toSource with the fileset, triggering open events for all files that are added to the store
     expression="toSource { root = ./.; fileset = $fileset; }"
-    # crudeUnquoteJSON is safe because we get back a store path in a string
-    storePath=$(expectSuccess "$expression" | crudeUnquoteJSON)
+    storePath=$(expectStorePath "$expression")
 
     # Remove all files immediately after, triggering delete_self events for all of them
     rm -rf -- *
@@ -262,15 +271,15 @@ expectFailure '_coerce "<tests>: value" { _type = "fileset"; _internalVersion =
 \s*Make sure to update your Nixpkgs to have a newer version of `lib.fileset`.'
 
 # _create followed by _coerce should give the inputs back without any validation
-expectSuccess '{
-  inherit (_coerce "<test>" (_create "base" "tree"))
+expectEqual '{
+  inherit (_coerce "<test>" (_create ./. "directory"))
     _internalVersion _internalBase _internalTree;
-}' '\{"_internalBase":"base","_internalTree":"tree","_internalVersion":0\}'
+}' '{ _internalBase = ./.; _internalTree = "directory"; _internalVersion = 0; }'
 
 #### Resulting store path ####
 
 # The store path name should be "source"
-expectSuccess 'toSource { root = ./.; fileset = ./.; }' '"'"${NIX_STORE_DIR:-/nix/store}"'/.*-source"'
+expectEqual 'toSource { root = ./.; fileset = ./.; }' 'sources.cleanSourceWith { name = "source"; src = ./.; }'
 
 # We should be able to import an empty directory and end up with an empty result
 tree=(
@@ -341,9 +350,9 @@ checkFileset './c'
 
 # Test the source filter for the somewhat special case of files in the filesystem root
 # We can't easily test this with the above functions because we can't write to the filesystem root and we don't want to make any assumptions which files are there in the sandbox
-expectSuccess '_toSourceFilter (_create /. null) "/foo" ""' 'false'
-expectSuccess '_toSourceFilter (_create /. { foo = "regular"; }) "/foo" ""' 'true'
-expectSuccess '_toSourceFilter (_create /. { foo = null; }) "/foo" ""' 'false'
+expectEqual '_toSourceFilter (_create /. null) "/foo" ""' 'false'
+expectEqual '_toSourceFilter (_create /. { foo = "regular"; }) "/foo" ""' 'true'
+expectEqual '_toSourceFilter (_create /. { foo = null; }) "/foo" ""' 'false'
 
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 

From 19b39dcc934aba37e39b5f492c2919dd93b74870 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 18:50:45 +0200
Subject: [PATCH 06/84] lib.fileset: Internal representation v1

---
 lib/fileset/README.md    | 12 ++++++--
 lib/fileset/internal.nix | 64 +++++++++++++++++++++++++++++-----------
 lib/fileset/tests.sh     | 12 +++++---
 3 files changed, 64 insertions(+), 24 deletions(-)

diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index dbb591a4c8c83..306dcdaa421d8 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -41,13 +41,21 @@ An attribute set with these values:
 - `_type` (constant string `"fileset"`):
   Tag to indicate this value is a file set.
 
-- `_internalVersion` (constant string equal to the current version):
-  Version of the representation
+- `_internalVersion` (constant `1`, the current version):
+  Version of the representation.
 
 - `_internalBase` (path):
   Any files outside of this path cannot influence the set of files.
   This is always a directory.
 
+- `_internalBaseRoot` (path):
+  The filesystem root of `_internalBase`, same as `(lib.path.splitRoot _internalBase).root`.
+  This is here because this needs to be computed anyways, and this computation shouldn't be duplicated.
+
+- `_internalBaseComponents` (list of strings):
+  The path components of `_internalBase`, same as `lib.path.subpath.components (lib.path.splitRoot _internalBase).subpath`.
+  This is here because this needs to be computed anyways, and this computation shouldn't be duplicated.
+
 - `_internalTree` ([filesetTree](#filesettree)):
   A tree representation of all included files under `_internalBase`.
 
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index eeaa7d96875e0..ae8eb20e3ed29 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -23,7 +23,9 @@ let
   inherit (lib.lists)
     all
     elemAt
+    foldl'
     length
+    sublist
     ;
 
   inherit (lib.path)
@@ -50,24 +52,48 @@ in
 rec {
 
   # If you change the internal representation, make sure to:
-  # - Update this version
-  # - Adjust _coerce to also accept and coerce older versions
+  # - Increment this version
+  # - Add an additional migration function below
   # - Update the description of the internal representation in ./README.md
-  _currentVersion = 0;
+  _currentVersion = 1;
+
+  # Migrations between versions. The 0th element converts from v0 to v1, and so on
+  migrations = [
+    # Convert v0 into v1: Add the _internalBase{Root,Components} attributes
+    (
+      filesetV0:
+      let
+        parts = splitRoot filesetV0._internalBase;
+      in
+      filesetV0 // {
+        _internalVersion = 1;
+        _internalBaseRoot = parts.root;
+        _internalBaseComponents = components parts.subpath;
+      }
+    )
+  ];
 
   # Create a fileset, see ./README.md#fileset
   # Type: path -> filesetTree -> fileset
-  _create = base: tree: {
-    _type = "fileset";
+  _create = base: tree:
+    let
+      # Decompose the base into its components
+      # See ../path/README.md for why we're not just using `toString`
+      parts = splitRoot base;
+    in
+    {
+      _type = "fileset";
 
-    _internalVersion = _currentVersion;
-    _internalBase = base;
-    _internalTree = tree;
+      _internalVersion = _currentVersion;
+      _internalBase = base;
+      _internalBaseRoot = parts.root;
+      _internalBaseComponents = components parts.subpath;
+      _internalTree = tree;
 
-    # Double __ to make it be evaluated and ordered first
-    __noEval = throw ''
-      lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'';
-  };
+      # Double __ to make it be evaluated and ordered first
+      __noEval = throw ''
+        lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'';
+    };
 
   # Coerce a value to a fileset, erroring when the value cannot be coerced.
   # The string gives the context for error messages.
@@ -80,6 +106,12 @@ rec {
               - Internal version of the file set: ${toString value._internalVersion}
               - Internal version of the library: ${toString _currentVersion}
               Make sure to update your Nixpkgs to have a newer version of `lib.fileset`.''
+      else if value._internalVersion < _currentVersion then
+        let
+          # Get all the migration functions necessary to convert from the old to the current version
+          migrationsToApply = sublist value._internalVersion (_currentVersion - value._internalVersion) migrations;
+        in
+        foldl' (value: migration: migration value) value migrationsToApply
       else
         value
     else if ! isPath value then
@@ -193,17 +225,13 @@ rec {
       # which has the effect that they aren't included in the result
       tree = _simplifyTree fileset._internalBase fileset._internalTree;
 
-      # Decompose the base into its components
-      # See ../path/README.md for why we're not just using `toString`
-      baseComponents = components (splitRoot fileset._internalBase).subpath;
-
       # The base path as a string with a single trailing slash
       baseString =
-        if baseComponents == [] then
+        if fileset._internalBaseComponents == [] then
           # Need to handle the filesystem root specially
           "/"
         else
-          "/" + concatStringsSep "/" baseComponents + "/";
+          "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
       baseLength = stringLength baseString;
 
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 88cd4bcc47c9c..e27610573a86e 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -264,17 +264,21 @@ expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `
 # File sets cannot be evaluated directly
 expectFailure '_create ./. null' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
 
+# Past versions of the internal representation are supported
+expectEqual '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 0; _internalBase = ./.; }' \
+    '{ _internalBase = ./.; _internalBaseComponents = path.subpath.components (path.splitRoot ./.).subpath; _internalBaseRoot = /.; _internalVersion = 1; _type = "fileset"; }'
+
 # Future versions of the internal representation are unsupported
-expectFailure '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 1; }' '<tests>: value is a file set created from a future version of the file set library with a different internal representation:
-\s*- Internal version of the file set: 1
-\s*- Internal version of the library: 0
+expectFailure '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 2; }' '<tests>: value is a file set created from a future version of the file set library with a different internal representation:
+\s*- Internal version of the file set: 2
+\s*- Internal version of the library: 1
 \s*Make sure to update your Nixpkgs to have a newer version of `lib.fileset`.'
 
 # _create followed by _coerce should give the inputs back without any validation
 expectEqual '{
   inherit (_coerce "<test>" (_create ./. "directory"))
     _internalVersion _internalBase _internalTree;
-}' '{ _internalBase = ./.; _internalTree = "directory"; _internalVersion = 0; }'
+}' '{ _internalBase = ./.; _internalTree = "directory"; _internalVersion = 1; }'
 
 #### Resulting store path ####
 

From 7d4eb3f1b7c74b3812c1873b6136a18387310bb8 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 22:26:16 +0200
Subject: [PATCH 07/84] lib.fileset.toSource: Evaluate fileset even for empty
 directories

---
 lib/fileset/default.nix  | 4 +++-
 lib/fileset/internal.nix | 1 +
 lib/fileset/tests.sh     | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index b301252655207..51002332a3195 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -92,6 +92,7 @@ The only way to change which files get added to the store is by changing the `fi
       fileset = _coerce "lib.fileset.toSource: `fileset`" filesetPath;
       rootFilesystemRoot = (splitRoot root).root;
       filesetFilesystemRoot = (splitRoot fileset._internalBase).root;
+      filter = _toSourceFilter fileset;
     in
     if ! isPath root then
       if isStringLike root then
@@ -123,9 +124,10 @@ The only way to change which files get added to the store is by changing the `fi
             - Set `root` to ${toString fileset._internalBase} or any directory higher up. This changes the layout of the resulting store path.
             - Set `fileset` to a file set that cannot contain files outside the `root` ${toString root}. This could change the files included in the result.''
     else
+      builtins.seq filter
       cleanSourceWith {
         name = "source";
         src = root;
-        filter = _toSourceFilter fileset;
+        inherit filter;
       };
 }
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index ae8eb20e3ed29..946ea1014f303 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -294,6 +294,7 @@ rec {
     in
     # Special case because the code below assumes that the _internalBase is always included in the result
     # which shouldn't be done when we have no files at all in the base
+    # This also forces the tree before returning the filter, leads to earlier error messages
     if tree == null then
       empty
     else
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index e27610573a86e..5bd798ae79422 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -246,6 +246,9 @@ expectFailure 'toSource { root = ./a; fileset = ./a; }' 'lib.fileset.toSource: `
 \s*- If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as '"$work"', and set `fileset` to the file path.'
 rm -rf *
 
+# The fileset argument should be evaluated, even if the directory is empty
+expectFailure 'toSource { root = ./.; fileset = abort "This should be evaluated"; }' 'evaluation aborted with the following error message: '\''This should be evaluated'\'
+
 # Only paths under `root` should be able to influence the result
 mkdir a
 expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `fileset` could contain files in '"$work"', which is not under the `root` '"$work"'/a. Potential solutions:

From 7c6b0b107a5f212503b12e0656cac2ac27227e84 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 22:27:04 +0200
Subject: [PATCH 08/84] lib.fileset: Minor internal type doc fix

---
 lib/fileset/internal.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 946ea1014f303..bd5d0c6d429fb 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -97,7 +97,7 @@ rec {
 
   # Coerce a value to a fileset, erroring when the value cannot be coerced.
   # The string gives the context for error messages.
-  # Type: String -> Path -> fileset
+  # Type: String -> (fileset | Path) -> fileset
   _coerce = context: value:
     if value._type or "" == "fileset" then
       if value._internalVersion > _currentVersion then

From 8a8c5cfb5ee113cba6e439b0b6b1916dd2ffd19f Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 20 Sep 2023 00:28:04 +0200
Subject: [PATCH 09/84] ogre: 14.0.1 -> 14.1.0

---
 pkgs/development/libraries/ogre/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 6bac6c5a425b8..d9b907ebeaaec 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -100,8 +100,8 @@ let
 in
 {
   ogre_14 = common {
-    version = "14.0.1";
-    hash = "sha256-jtUm0jy0GsxkGlFdODGodPsuSaQgiE77BORnA6SFViU=";
+    version = "14.1.0";
+    hash = "sha256-CPyXqlUb69uLCsoomjFUbBj7bzPyI01m2yinFuoX5nE=";
   };
 
   ogre_13 = common {

From 4575a2917f4a25fe69d754e91860df0b1819501f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 08:57:48 +0200
Subject: [PATCH 10/84] python311Packages.tldextract: 3.5.0 -> 3.6.0

---
 pkgs/development/python-modules/tldextract/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 1b2c1a7e6ba0a..04a6762c8c906 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname   = "tldextract";
-  version = "3.5.0";
+  version = "3.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TfHGW5W+YdWUKOhhHpVeVObx1Eg9Po1XM9OpBiFV6RA=";
+    hash = "sha256-pdi2WDeR2sominWS6892QVL6SWF5g8SZFu6d6Zs2YiI=";
   };
 
   nativeBuildInputs = [

From 236357f97198774a4893451521e907c69b3fb929 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 20 Sep 2023 19:46:11 +0200
Subject: [PATCH 11/84] honk: 1.0.0 -> 1.1.1

---
 pkgs/servers/honk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/honk/default.nix b/pkgs/servers/honk/default.nix
index 5c342fd24a029..63b2fb5b09840 100644
--- a/pkgs/servers/honk/default.nix
+++ b/pkgs/servers/honk/default.nix
@@ -8,11 +8,11 @@
 
 buildGoModule rec {
   pname = "honk";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "https://humungus.tedunangst.com/r/honk/d/honk-${version}.tgz";
-    hash = "sha256-+0W9HncN+51dRE9bWJU4cAfYOc5bxNAqPe4xY+4UFg0=";
+    hash = "sha256-kfoSVGm1QKVjDiWvjK4QzAoA/iiU9j6DS3SYFSM+AaA=";
   };
   vendorHash = null;
 

From 434329e02a60f632e80d125b2d9d503f973de770 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 20 Sep 2023 22:19:41 +0200
Subject: [PATCH 12/84] mongoose: 3.0.5 -> 3.2.1

---
 .../development/libraries/science/math/mongoose/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/science/math/mongoose/default.nix b/pkgs/development/libraries/science/math/mongoose/default.nix
index 691140dbf8477..8e872f9f8f078 100644
--- a/pkgs/development/libraries/science/math/mongoose/default.nix
+++ b/pkgs/development/libraries/science/math/mongoose/default.nix
@@ -6,11 +6,11 @@
 }:
 
 let
-  suitesparseVersion = "7.1.0";
+  suitesparseVersion = "7.2.0";
 in
 stdenv.mkDerivation {
   pname = "mongoose";
-  version = "3.0.5";
+  version = "3.2.1";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "DrTimothyAldenDavis";
     repo = "SuiteSparse";
     rev = "v${suitesparseVersion}";
-    hash = "sha256-UizybioU1J01PLBpu+PfnSzWScGTvMuJN5j9PjuZRwE=";
+    hash = "sha256-Ss1R3P1fyRwlGQxJchydV36xLEMAGJabMMiQiKykKrc=";
   };
 
   nativeBuildInputs = [

From 6b8d5090eba54ae885e8b96ee9845e4e285d2a3d Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 20 Sep 2023 22:27:52 +0200
Subject: [PATCH 13/84] python310Packages.pyngrok: 6.1.2 -> 7.0.0

---
 pkgs/development/python-modules/pyngrok/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index 12121e242270c..251c08f026087 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "6.1.2";
+  version = "7.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9fT2fnntBQ7y+c52tuqHM7iVAqoLgwAs6izmuZRUNiI=";
+    hash = "sha256-YOE9t/W4LsZqBFMbJRbyB6oQqrqW02iecqQYR6yZfV8=";
   };
 
   propagatedBuildInputs = [

From 4b8e8171345893f0b2d80511f8b95d665caa6856 Mon Sep 17 00:00:00 2001
From: Emily Trau <emily@downunderctf.com>
Date: Fri, 7 Jul 2023 22:04:40 +1000
Subject: [PATCH 14/84] rectangle-pro: init at 3.0.9

---
 pkgs/by-name/re/rectangle-pro/package.nix | 37 +++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/re/rectangle-pro/package.nix

diff --git a/pkgs/by-name/re/rectangle-pro/package.nix b/pkgs/by-name/re/rectangle-pro/package.nix
new file mode 100644
index 0000000000000..26b39da655eee
--- /dev/null
+++ b/pkgs/by-name/re/rectangle-pro/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "rectangle-pro";
+  version = "3.0.9";
+
+  src = fetchurl {
+    url = "https://rectangleapp.com/pro/downloads/Rectangle%20Pro%20${finalAttrs.version}.dmg";
+    hash = "sha256-wD8yi2Pbgrn1fW/xrocepDcpzSMsQH5yjB/Jv90PuGQ=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Move and resize windows in macOS using keyboard shortcuts or snap areas";
+    homepage = "https://rectangleapp.com/pro";
+    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ emilytrau Enzime ];
+    platforms = platforms.darwin;
+  };
+})

From 1387e36a73873e1f74b2cee267616a2fa37cb28b Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Wed, 20 Sep 2023 22:36:57 +0200
Subject: [PATCH 15/84] gns3-server,gns3-gui: 2.2.42 -> 2.2.43

https://github.com/GNS3/gns3-server/releases/tag/v2.2.43
https://github.com/GNS3/gns3-gui/releases/tag/v2.2.43
---
 pkgs/applications/networking/gns3/default.nix | 16 ++++++++--------
 pkgs/applications/networking/gns3/gui.nix     |  8 ++------
 pkgs/applications/networking/gns3/server.nix  |  9 +--------
 3 files changed, 11 insertions(+), 22 deletions(-)

diff --git a/pkgs/applications/networking/gns3/default.nix b/pkgs/applications/networking/gns3/default.nix
index 43aa6e7343a72..bd1b74fe4a744 100644
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@@ -12,25 +12,25 @@ in {
 
   guiStable = mkGui {
     channel = "stable";
-    version = "2.2.42";
-    hash = "sha256-FW8Nuha+NrYVhR/66AiBpcCLHRhiLTW8KdHFyWSao84=";
+    version = "2.2.43";
+    hash = "sha256-+2dcyWnTJqGaH9yhknYc9/0gnj3qh80eAy6uxG7+fFM=";
   };
 
   guiPreview = mkGui {
     channel = "stable";
-    version = "2.2.42";
-    hash = "sha256-FW8Nuha+NrYVhR/66AiBpcCLHRhiLTW8KdHFyWSao84=";
+    version = "2.2.43";
+    hash = "sha256-+2dcyWnTJqGaH9yhknYc9/0gnj3qh80eAy6uxG7+fFM=";
   };
 
   serverStable = mkServer {
     channel = "stable";
-    version = "2.2.42";
-    hash = "sha256-YM07krEay2W+/6mKLAg+B7VEnAyDlkD+0+cSO1FAJzA=";
+    version = "2.2.43";
+    hash = "sha256-xWt2qzeqBtt86Wv3dYl4GXkfjr+7WAKn5HdDeUzOQd8=";
   };
 
   serverPreview = mkServer {
     channel = "stable";
-    version = "2.2.42";
-    hash = "sha256-YM07krEay2W+/6mKLAg+B7VEnAyDlkD+0+cSO1FAJzA=";
+    version = "2.2.43";
+    hash = "sha256-xWt2qzeqBtt86Wv3dYl4GXkfjr+7WAKn5HdDeUzOQd8=";
   };
 }
diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
index 13764d5066979..57228d1a97f61 100644
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     wrapQtAppsHook
   ];
 
@@ -33,11 +32,8 @@ python3.pkgs.buildPythonApplication rec {
     setuptools
     sip_4 (pyqt5.override { withWebSockets = true; })
     truststore
-  ];
-
-  pythonRelaxDeps = [
-    "jsonschema"
-    "sentry-sdk"
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
   ];
 
   doCheck = false; # Failing
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index 200153b15e031..f8d8d7381ec5c 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -25,14 +25,6 @@ python3.pkgs.buildPythonApplication {
     cp ${pkgsStatic.busybox}/bin/busybox gns3server/compute/docker/resources/bin/busybox
   '';
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = [
-    "jsonschema"
-  ];
-
   propagatedBuildInputs = with python3.pkgs; [
     aiofiles
     aiohttp
@@ -43,6 +35,7 @@ python3.pkgs.buildPythonApplication {
     jinja2
     jsonschema
     multidict
+    platformdirs
     prompt-toolkit
     psutil
     py-cpuinfo

From 7517f61dfe783ce9c33ed78e15f19763d3cd2da6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 22:56:54 +0200
Subject: [PATCH 16/84] python311Packages.dbus-fast: 2.7.0 -> 2.8.0

Diff: https://github.com/Bluetooth-Devices/dbus-fast/compare/refs/tags/v2.7.0...2.8.0

Changelog: https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v2.8.0
---
 pkgs/development/python-modules/dbus-fast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 5dc9b5675a4d3..343a2cc46e50d 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.7.0";
+  version = "2.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-o75N/msocSYBe3tTLYGJbqMnbiQb/t3nfJIDDr6kPxM=";
+    hash = "sha256-LThasicAGs3jtUEIcNLutWvQtUlseG+mh6YB+BcCIO0=";
   };
 
   # The project can build both an optimized cython version and an unoptimized

From 965d5ee395001d9c91915f2f6c04638126783f56 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 22:57:44 +0200
Subject: [PATCH 17/84] python311Packages.google-cloud-websecurityscanner:
 1.12.2 -> 1.12.3

Changelog: https://github.com/googleapis/python-websecurityscanner/blob/v1.12.3/CHANGELOG.md
---
 .../google-cloud-websecurityscanner/default.nix               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index 1ad657a827b62..8804ad810aaa4 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.12.2";
+  version = "1.12.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C2WQmyQjoe2t6RZ8HtnNkzN3V8FuYQwgtlhCOwaHNt8=";
+    hash = "sha256-zu4e4MTpc24p5ZWeRfVQwX0brciaz80FDGbxy6UppEA=";
   };
 
   propagatedBuildInputs = [

From 23f7e56fc5ff1cfc0f73e8453ab333a99cfbec81 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 22:58:19 +0200
Subject: [PATCH 18/84] python311Packages.google-cloud-videointelligence:
 2.11.3 -> 2.11.4

Changelog: https://github.com/googleapis/python-videointelligence/blob/v2.11.4/CHANGELOG.md
---
 .../python-modules/google-cloud-videointelligence/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index b0c883a56bfda..3ff18366e426e 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.11.3";
+  version = "2.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qWpj8ATCcGj0WyJ6ZidfimqMPs0Gu1gfkvppiX1bF5c=";
+    hash = "sha256-B6zimaY/Wz1EQTdWNIU7Vc6PkMYsaiT4pH6wVBSfb5k=";
   };
 
   propagatedBuildInputs = [

From f79ffca7ab2adc7c406e343f87a22d1ecd332eb5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 22:58:46 +0200
Subject: [PATCH 19/84] python311Packages.dbus-fast: 2.8.0 -> 2.9.0

Diff: https://github.com/Bluetooth-Devices/dbus-fast/compare/refs/tags/v2.8.0...v2.9.0

Changelog: https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v2.9.0
---
 pkgs/development/python-modules/dbus-fast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 343a2cc46e50d..a4cf927ec9014 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.8.0";
+  version = "2.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LThasicAGs3jtUEIcNLutWvQtUlseG+mh6YB+BcCIO0=";
+    hash = "sha256-0+uWnm0gygDL4sc2b+3dekgZfgAQZKfmJRMSDgyeMjk=";
   };
 
   # The project can build both an optimized cython version and an unoptimized

From 44d3249190b725e1b118220aa3d59dfff6242254 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 22:59:30 +0200
Subject: [PATCH 20/84] python311Packages.google-cloud-secret-manager: 2.16.3
 -> 2.16.4

Changelog: https://github.com/googleapis/python-secret-manager/blob/v2.16.4/CHANGELOG.md
---
 .../python-modules/google-cloud-secret-manager/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 6791ad76a1279..5bb5940f55a42 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.16.3";
+  version = "2.16.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bKtcvxkno0xYbkr5BDfuo9RP9LQbmoLshvz/CaWsJuo=";
+    hash = "sha256-Nx3HL5FFrzI+ioE8jlA4DmrEvWpdvNQtzzFi2PN+UIA=";
   };
 
   propagatedBuildInputs = [

From de7be48c811adc4b0b1ce7d639cb1e53ccae8171 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:00:00 +0200
Subject: [PATCH 21/84] python311Packages.google-cloud-resource-manager: 1.10.3
 -> 1.10.4

Changelog: https://github.com/googleapis/python-resource-manager/blob/v1.10.4/CHANGELOG.md
---
 .../python-modules/google-cloud-resource-manager/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
index 5e47e53cd8fa0..50f605f5fc99e 100644
--- a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "1.10.3";
+  version = "1.10.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+A786jbxDFqBiJr+k5EJJuOXi0sc7rgvVjovyGMHLRQ=";
+    hash = "sha256-RWsl3do9TNJ0iKcnNrvDrwTXE64v42VcAbZqM50o1nk=";
   };
 
   propagatedBuildInputs = [

From 62808bf3c5204a28da06c765a0e57c7d7f4b2dd9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:00:10 +0200
Subject: [PATCH 22/84] python311Packages.google-cloud-redis: 2.13.1 -> 2.13.2

Changelog: https://github.com/googleapis/python-redis/blob/v2.13.2/CHANGELOG.md
---
 .../development/python-modules/google-cloud-redis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index e935fc37e5727..37b9dcf80958e 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.13.1";
+  version = "2.13.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UtT1z5zMzc7+Xhqcx5u77IS8GC8KaNOpYstZ8BlrFGc=";
+    hash = "sha256-XEhXMDVdlnI9ZK5jfxsiZPNbV8MB7A7yxtMLLwbcoU4=";
   };
 
   propagatedBuildInputs = [

From 67578c9193f3402d053d8c1703a72bc165e293ad Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:01:01 +0200
Subject: [PATCH 23/84] python311Packages.google-cloud-language: 2.11.0 ->
 2.11.1

Changelog: https://github.com/googleapis/python-language/blob/v2.11.1/CHANGELOG.md
---
 .../python-modules/google-cloud-language/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-language/default.nix b/pkgs/development/python-modules/google-cloud-language/default.nix
index 7b60965573207..a07053ea91729 100644
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.11.0";
+  version = "2.11.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ldI19QPZBOiFQRfpKO82rJMMJIJfy4QAw/NoqQj9vhQ=";
+    hash = "sha256-XxhECfBAwMcwV8JhbmvS6G5FrrZGGA0ZwYnfSqPQLbo=";
   };
 
   propagatedBuildInputs = [

From ab9c99d54f46bd4cfd32fceb89dd2f5171c77753 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:05:39 +0200
Subject: [PATCH 24/84] python311Packages.json-schema-for-humans: 0.45.1 ->
 0.45.2

Diff: https://github.com/coveooss/json-schema-for-humans/compare/refs/tags/v0.45.1...v0.45.2

Changelog: https://github.com/coveooss/json-schema-for-humans/releases/tag/v0.45.2
---
 .../python-modules/json-schema-for-humans/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 972455056d371..0469943e334aa 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.45.1";
+  version = "0.45.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "coveooss";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9dX9+YwJdJpgU3cZkxk7+CgdRFgcVhrvU0amO8zHZhs=";
+    hash = "sha256-DmUQ06UabLcB67PyfRC/gmSkEY/V8kuZ/T/ZW1D11vA=";
   };
 
   nativeBuildInputs = [

From ce1a78003fe712b107ad4afe6cf26c7d68dca007 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 28 Jan 2023 09:17:15 +0100
Subject: [PATCH 25/84] python310Packages.ismartgate: 4.0.4 -> 5.0.0

Diff: https://github.com/bdraco/ismartgate/compare/refs/tags/v4.0.4...v5.0.0

Changelog: https://github.com/bdraco/ismartgate/releases/tag/v5.0.0
---
 pkgs/development/python-modules/ismartgate/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ismartgate/default.nix b/pkgs/development/python-modules/ismartgate/default.nix
index fd1d81014c820..c0200c6765414 100644
--- a/pkgs/development/python-modules/ismartgate/default.nix
+++ b/pkgs/development/python-modules/ismartgate/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   version = "5.0.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "bdraco";

From a5e86bb4445b86b8bbb2f0ddd6bc06cf3e246be1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:07:10 +0200
Subject: [PATCH 26/84] python311Packages.ismartgate: 5.0.0 -> 5.0.1

Diff: https://github.com/bdraco/ismartgate/compare/refs/tags/v5.0.0...v5.0.1

Changelog: https://github.com/bdraco/ismartgate/releases/tag/v5.0.1
---
 pkgs/development/python-modules/ismartgate/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ismartgate/default.nix b/pkgs/development/python-modules/ismartgate/default.nix
index c0200c6765414..1a61b002aa3ae 100644
--- a/pkgs/development/python-modules/ismartgate/default.nix
+++ b/pkgs/development/python-modules/ismartgate/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ismartgate";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-o2yzMxrF0WB6MbeL1Tuf0Sq4wS4FDIWZZx1x2rvwLmY=";
+    hash = "sha256-mfiHoli0ldw/E1SrtOBpDO8ZTC0wTeaoSZ2nPnx5EaQ=";
   };
 
   postPatch = ''

From 800b8094ffe46de8aef57e754f3c14b1ed07a023 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:13:54 +0200
Subject: [PATCH 27/84] python311Packages.meshtastic: 2.2.5 -> 2.2.6

Diff: https://github.com/meshtastic/Meshtastic-python/compare/refs/tags/2.2.5...2.2.6

Changelog: https://github.com/meshtastic/python/releases/tag/2.2.6
---
 pkgs/development/python-modules/meshtastic/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 51db2a480aa9f..dcac8a6b277b8 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.2.5";
+  version = "2.2.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-qRSJN1tWMECQU/jbC2UzhEZAVQwvm7hTIr3cqvFO4TM=";
+    hash = "sha256-JnheGeiLJMI0zsb+jiuMxjXg/3rDbMyA2XVtl1ujiso=";
   };
 
   propagatedBuildInputs = [

From 73afddd2a5f4d15067a4aa08dbf755530763d62b Mon Sep 17 00:00:00 2001
From: Puck Meerburg <puck@puckipedia.com>
Date: Wed, 20 Sep 2023 21:17:53 +0000
Subject: [PATCH 28/84] perlPackages.SDL: fix on perl >= 5.38.0

This applies the patch from [1], fixing the most important game in
nixpkgs.

[1]: https://github.com/PerlGameDev/SDL/pull/304
---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8193fd271b1df..16e0d438deb46 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -21442,6 +21442,13 @@ with self; {
       url = "mirror://cpan/authors/id/F/FR/FROGGS/SDL-2.548.tar.gz";
       hash = "sha256-JSoZK/qcIHCkiDcH0TnDpF2cRRjM1moeaZtbeVm9T7U=";
     };
+    patches = [
+      # https://github.com/PerlGameDev/SDL/pull/304
+      (fetchpatch {
+        url = "https://github.com/PerlGameDev/SDL/commit/d734d03862d7dcc776bd2fa3ba662cdd5879b32e.patch";
+        hash = "sha256-YjtnAbJxCvx5QckiatZjD8v7dKefG3DCnXeLaNnEO8U=";
+      })
+    ];
     perlPreHook = "export LD=$CC";
     preCheck = "rm t/core_audiospec.t";
     buildInputs = [ pkgs.SDL pkgs.SDL_gfx pkgs.SDL_mixer pkgs.SDL_image pkgs.SDL_ttf pkgs.SDL_Pango pkgs.SDL_net AlienSDL CaptureTiny TestDeep TestDifferences TestException TestMost TestWarn ];

From e206ee4cf3b4fd8b5bf848d115b4a6baa305f632 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Wed, 20 Sep 2023 22:37:59 +0200
Subject: [PATCH 29/84] gns3-server,gns3-gui: enable checkPhase

---
 pkgs/applications/networking/gns3/gui.nix    | 16 +++++++++++--
 pkgs/applications/networking/gns3/server.nix | 24 +++++++++++++++++---
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
index 57228d1a97f61..a9537d9931711 100644
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@@ -6,6 +6,7 @@
 { lib
 , python3
 , fetchFromGitHub
+, qt5
 , wrapQtAppsHook
 }:
 
@@ -36,14 +37,25 @@ python3.pkgs.buildPythonApplication rec {
     importlib-resources
   ];
 
-  doCheck = false; # Failing
-
   dontWrapQtApps = true;
 
   preFixup = ''
     wrapQtApp "$out/bin/gns3"
   '';
 
+  doCheck = true;
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export QT_PLUGIN_PATH="${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_QPA_PLATFORM_PLUGIN_PATH="${qt5.qtbase.bin}/lib/qt-${qt5.qtbase.version}/plugins";
+    export QT_QPA_PLATFORM=offscreen
+  '';
+
   meta = with lib; {
     description = "Graphical Network Simulator 3 GUI (${channel} release)";
     longDescription = ''
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index f8d8d7381ec5c..98ae803492f0f 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -46,13 +46,31 @@ python3.pkgs.buildPythonApplication {
     zipstream
   ];
 
-  # Requires network access
-  doCheck = false;
-
   postInstall = ''
     rm $out/bin/gns3loopback # For Windows only
   '';
 
+  doCheck = true;
+
+  # Otherwise tests will fail to create directory
+  # Permission denied: '/homeless-shelter'
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  checkInputs = with python3.pkgs; [
+    pytest-aiohttp
+    pytest-rerunfailures
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    # fails on ofborg because of lack of cpu vendor information
+    "--deselect=tests/controller/gns3vm/test_virtualbox_gns3_vm.py::test_cpu_vendor_id"
+    # Rerun failed tests up to three times (flaky tests)
+    "--reruns 3"
+  ];
+
   meta = with lib; {
     description = "Graphical Network Simulator 3 server (${channel} release)";
     longDescription = ''

From 62eb1578944f01e36264129b1d2342251f346787 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Wed, 20 Sep 2023 22:41:03 +0200
Subject: [PATCH 30/84] gns3-server: keep gns3loopack on windows host platforms

---
 pkgs/applications/networking/gns3/server.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index 98ae803492f0f..48d48de83b2a5 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -7,6 +7,7 @@
 , python3
 , fetchFromGitHub
 , pkgsStatic
+, stdenv
 }:
 
 python3.pkgs.buildPythonApplication {
@@ -46,8 +47,8 @@ python3.pkgs.buildPythonApplication {
     zipstream
   ];
 
-  postInstall = ''
-    rm $out/bin/gns3loopback # For Windows only
+  postInstall = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
+    rm $out/bin/gns3loopback
   '';
 
   doCheck = true;

From 68f44ae21ccff62c1f736eab674b8200d7b9a489 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:21:02 +0200
Subject: [PATCH 31/84] python311Packages.python-benedict: 0.32.0 -> 0.32.1

Diff: https://github.com/fabiocaccamo/python-benedict/compare/refs/tags/0.32.0...0.32.1

Changelog: https://github.com/fabiocaccamo/python-benedict/blob/0.32.1/CHANGELOG.md
---
 pkgs/development/python-modules/python-benedict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index e2daf959abb0a..b100ba2292c92 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.32.0";
+  version = "0.32.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4fBV7sInw/jrKt7CmG7riMTmpLyrsyvWZGRY6s3YbHw=";
+    hash = "sha256-q9EIOMmUcttL1ohxQD+SkZTxKv8PwdN29+ez2xB7rvM=";
   };
 
   nativeBuildInputs = [

From 3f2f26298538abf5b6d482e9e950a7c6242b4e10 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:23:05 +0200
Subject: [PATCH 32/84] python311Packages.rarfile: 4.0 -> 4.1

Diff: https://github.com/markokr/rarfile/compare/v4.0...v4.1
---
 pkgs/development/python-modules/rarfile/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rarfile/default.nix b/pkgs/development/python-modules/rarfile/default.nix
index 6bc0c7f2a24ef..2f988ddace7f6 100644
--- a/pkgs/development/python-modules/rarfile/default.nix
+++ b/pkgs/development/python-modules/rarfile/default.nix
@@ -8,14 +8,14 @@ assert !useUnrar -> libarchive != null;
 
 buildPythonPackage rec {
   pname = "rarfile";
-  version = "4.0";
+  version = "4.1";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "markokr";
     repo = "rarfile";
     rev = "v${version}";
-    sha256 = "0gpriqkvcb6bsccvq8b099xjv5fkjs0d7g4636d5jphy417jxk5m";
+    sha256 = "sha256-9PT4/KgkdFhTjZIia2xiSM5VnaZ4040Ww7bG9Nr3XDU=";
   };
 
   nativeCheckInputs = [ pytestCheckHook nose glibcLocales ];

From 62dd6340eeb4c07014cfb4b04803f4becebf4ef5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:32:06 +0200
Subject: [PATCH 33/84] python311Packages.s3fs: 2023.9.0 -> 2023.9.1

Changelog: https://github.com/fsspec/s3fs/raw/2023.9.1/docs/source/changelog.rst
---
 pkgs/development/python-modules/s3fs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/s3fs/default.nix b/pkgs/development/python-modules/s3fs/default.nix
index c66df5ec520f0..bc37fc0550065 100644
--- a/pkgs/development/python-modules/s3fs/default.nix
+++ b/pkgs/development/python-modules/s3fs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "s3fs";
-  version = "2023.9.0";
+  version = "2023.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NQV9TVlyLKuf6RyaMBR+Plvd/FXsFP3od2xRIXnII90=";
+    hash = "sha256-QuGCHtlMFgfISIU9HXFevNJcEzgLb1EMLLSYx+Wz5nQ=";
   };
 
   postPatch = ''

From 18791476dabeae406195dc6c1d042a0b21cd9ae0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:36:51 +0200
Subject: [PATCH 34/84] python311Packages.slackclient: 3.21.3 -> 3.22.0

Diff: https://github.com/slackapi/python-slack-sdk/compare/refs/tags/v3.21.3...v3.22.0

Changelog: https://github.com/slackapi/python-slack-sdk/releases/tag/v3.22.0
---
 pkgs/development/python-modules/slackclient/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/slackclient/default.nix b/pkgs/development/python-modules/slackclient/default.nix
index 4715e58d36be0..10b31c02ad24a 100644
--- a/pkgs/development/python-modules/slackclient/default.nix
+++ b/pkgs/development/python-modules/slackclient/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "slackclient";
-  version = "3.21.3";
+  version = "3.22.0";
   format =  "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-begpT/DaDqOi8HZE10FCuIIv18KSU/i5G/Z5DXKUT7Y=";
+    hash = "sha256-PRJgOAC1IJjQb1c4FAbpV8bxOPL9PTbAxNXo2MABRzc=";
   };
 
   propagatedBuildInputs = [

From 2bf37b45d09128a2eec67f591409ef5ade719bf7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:42:00 +0200
Subject: [PATCH 35/84] python311Packages.yaramod: 3.20.1 -> 3.20.2

Diff: https://github.com/avast/yaramod/compare/refs/tags/v3.20.1...v3.20.2

Changelog: https://github.com/avast/yaramod/blob/v3.20.2/CHANGELOG.md
---
 pkgs/development/python-modules/yaramod/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yaramod/default.nix b/pkgs/development/python-modules/yaramod/default.nix
index 83f1f87c2c5d0..1f459858dfa07 100644
--- a/pkgs/development/python-modules/yaramod/default.nix
+++ b/pkgs/development/python-modules/yaramod/default.nix
@@ -20,7 +20,7 @@ let
 in
   buildPythonPackage rec {
     pname = "yaramod";
-    version = "3.20.1";
+    version = "3.20.2";
     format = "setuptools";
 
     disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ in
       owner = "avast";
       repo = pname;
       rev = "refs/tags/v${version}";
-      hash = "sha256-je4BBJ34VcA8pkvIBXfqrHAhWF+DdakSqeFma3mHpWo=";
+      hash = "sha256-OLsTvG+qaUJlKdHwswGBifzoT/uNunrrVWQg7hJxkhE=";
     };
 
     postPatch = ''

From eba051393be43488c7b73dbf1bacc70e32501c31 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:49:06 +0200
Subject: [PATCH 36/84] checkov: 2.4.42 -> 2.4.47

Diff: https://github.com/bridgecrewio/checkov/compare/refs/tags/2.4.42...2.4.47

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/2.4.47
---
 pkgs/development/tools/analysis/checkov/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 55a1454d77bd8..3c1fa26e27da7 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.4.42";
+  version = "2.4.47";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5G7ErzWxyQ17rn5k+3BpLhrGmU6YSBZ6BEK9y0cpki4=";
+    hash = "sha256-v4epPGUII2xu5e8yM4dCmEmu0ShmOIPd3h+UsFzdt6Q=";
   };
 
   patches = [

From a982ab590c2507eb975f021afbfbef0fd0d36c74 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:50:23 +0200
Subject: [PATCH 37/84] mediawriter: 5.0.7 -> 5.0.8

Diff: https://github.com/FedoraQt/MediaWriter/compare/refs/tags/5.0.7...5.0.8

Changelog: https://github.com/FedoraQt/MediaWriter/releases/tag/5.0.8
---
 pkgs/tools/system/mediawriter/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/system/mediawriter/default.nix b/pkgs/tools/system/mediawriter/default.nix
index 800133a0b3789..eaea077c8520f 100644
--- a/pkgs/tools/system/mediawriter/default.nix
+++ b/pkgs/tools/system/mediawriter/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawriter";
-  version = "5.0.7";
+  version = "5.0.8";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "MediaWriter";
     rev = "refs/tags/${version}";
-    hash = "sha256-dznvldk2FGCQGnVbo9tv+gH1cqRvoRqm/e+0MUVcI9I=";
+    hash = "sha256-6c2RXBIsJiW/xk+Q89RGibh6CIqIWHlBDBLb5o/mIGQ=";
   };
 
   nativeBuildInputs = [

From 7ebcff87859ec46918bdb6253c72367952c0a0c2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:53:01 +0200
Subject: [PATCH 38/84] natscli: 0.0.35 -> 0.1.1

Diff: https://github.com/nats-io/natscli/compare/v0.0.35...v0.1.1
---
 pkgs/tools/system/natscli/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/system/natscli/default.nix b/pkgs/tools/system/natscli/default.nix
index b7cf8fb2056d6..0bff6fbc1b4e3 100644
--- a/pkgs/tools/system/natscli/default.nix
+++ b/pkgs/tools/system/natscli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "natscli";
-  version = "0.0.35";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Sro0EwHP1pszuOYP6abZO5XjJvbXrDDeSAbzPA2p00M=";
+    sha256 = "sha256-ktO+WrsacnQOgPZeyNTyUSATVwVud399YmcqgJ4PLTw=";
   };
 
-  vendorHash = "sha256-HSKBUw9ZO150hLXyGX66U9XpLX2yowxYVdcdDVdqrAc=";
+  vendorHash = "sha256-5v3pPzt/U6kAHF9K7bb+Wu39gLh0O4TDIRgEToPNT6c=";
 
   meta = with lib; {
     description = "NATS Command Line Interface";

From 7bc6a1c62a4d93ea887dec6e586b77b63bac4d21 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 20 Sep 2023 23:53:49 +0200
Subject: [PATCH 39/84] python311Packages.mypy-boto3-s3: 1.28.36 -> 1.28.52

Changelog: https://github.com/youtype/mypy_boto3_builder/releases/tag/1.28.52
---
 pkgs/development/python-modules/mypy-boto3-s3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 61aa96fa13407..91df8b1ce0bc6 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.28.36";
+  version = "1.28.52";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RNo3X9TXWxxczCbc075IKUxwYURe/W2Q6/ykP/67s+Q=";
+    hash = "sha256-F5y3VCzF72VvEyOtUesjevy6d9Hl7QfSGgE/427/uLI=";
   };
 
   nativeBuildInputs = [

From 15eb417c0a2794654cdb39041804a0347120c159 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 19 Sep 2023 23:52:25 -0700
Subject: [PATCH 40/84] binsort: init at 0.4-1

---
 pkgs/by-name/bi/binsort/package.nix | 35 +++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/bi/binsort/package.nix

diff --git a/pkgs/by-name/bi/binsort/package.nix b/pkgs/by-name/bi/binsort/package.nix
new file mode 100644
index 0000000000000..edb41c6422685
--- /dev/null
+++ b/pkgs/by-name/bi/binsort/package.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "binsort";
+  version = "0.4-1";
+
+  src = fetchurl {
+    url = "http://neoscientists.org/~tmueller/binsort/download/binsort-${finalAttrs.version}.tar.gz";
+    hash = "sha256-l9T0LlDslxCgZYf8NrbsRly7bREOTGwptLteeg3TNRg=";
+  };
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp binsort $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Sort files by binary similarity";
+    homepage = "http://neoscientists.org/~tmueller/binsort/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ numinit ];
+    platforms = platforms.unix;
+  };
+})

From 72a7138f8864a7f0dc3b7ddc60fde57d744a0e99 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 21 Sep 2023 00:07:13 +0200
Subject: [PATCH 41/84] python311Packages.certipy-ad: 4.8.0 -> 4.8.1

Diff: https://github.com/ly4k/Certipy/compare/refs/tags/4.8.0...4.8.1

Changelog: https://github.com/ly4k/Certipy/releases/tag/4.8.1
---
 pkgs/development/python-modules/certipy-ad/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/certipy-ad/default.nix b/pkgs/development/python-modules/certipy-ad/default.nix
index 175a454ab1eaf..a0411655c26d2 100644
--- a/pkgs/development/python-modules/certipy-ad/default.nix
+++ b/pkgs/development/python-modules/certipy-ad/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "certipy-ad";
-  version = "4.8.0";
+  version = "4.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "ly4k";
     repo = "Certipy";
     rev = "refs/tags/${version}";
-    hash = "sha256-CyTwaCYhxUqvycZBKSzTWLKmKvebCNyE4vqTUnaX1V0=";
+    hash = "sha256-HgRUpltkai68tDkanXIOEdrJ4DJYDcbNk0op0enUAXU=";
   };
 
   postPatch = ''

From 4d84f32dd29b9a841cc5c3b12771966bcb0a1caf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 21 Sep 2023 00:07:58 +0200
Subject: [PATCH 42/84] python311Packages.adafruit-platformdetect: 3.52.1 ->
 3.52.3

Changelog: https://github.com/adafruit/Adafruit_Python_PlatformDetect/releases/tag/3.52.3
---
 .../python-modules/adafruit-platformdetect/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 11c01fe8dbb56..7bd3f7b403cdb 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.52.1";
+  version = "3.52.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    hash = "sha256-iAz+cGFUZWJIHNEzQyGjJkwVj9GOK8onHTO8t3bs13g=";
+    hash = "sha256-5JEnsTvY4PgAuaoIyTHriJVJUPAHMYETgqbhAuAPJcI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From d866a0bda162155df43c019e1c4a4c9ef89470eb Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 23:29:28 +0200
Subject: [PATCH 43/84] lib.fileset.union: init

---
 lib/fileset/default.nix  |  45 ++++++++++++++++
 lib/fileset/internal.nix | 113 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 158 insertions(+)

diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index 51002332a3195..d04a653bd91b0 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -3,7 +3,9 @@ let
 
   inherit (import ./internal.nix { inherit lib; })
     _coerce
+    _coerceMany
     _toSourceFilter
+    _unionMany
     ;
 
   inherit (builtins)
@@ -130,4 +132,47 @@ The only way to change which files get added to the store is by changing the `fi
         src = root;
         inherit filter;
       };
+
+  /*
+    The file set containing all files that are in either of two given file sets.
+    See also [Union (set theory)](https://en.wikipedia.org/wiki/Union_(set_theory)).
+
+    The given file sets are evaluated as lazily as possible,
+    with the first argument being evaluated first if needed.
+
+    Type:
+      union :: FileSet -> FileSet -> FileSet
+
+    Example:
+      # Create a file set containing the file `Makefile`
+      # and all files recursively in the `src` directory
+      union ./Makefile ./src
+
+      # Create a file set containing the file `Makefile`
+      # and the LICENSE file from the parent directory
+      union ./Makefile ../LICENSE
+  */
+  union =
+    # The first file set.
+    # This argument can also be a path,
+    # which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
+    fileset1:
+    # The second file set.
+    # This argument can also be a path,
+    # which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
+    fileset2:
+    let
+      filesets = _coerceMany "lib.fileset.union" [
+        {
+          context = "first argument";
+          value = fileset1;
+        }
+        {
+          context = "second argument";
+          value = fileset2;
+        }
+      ];
+    in
+    _unionMany filesets;
+
 }
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index bd5d0c6d429fb..19db7adcff4b0 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -22,10 +22,15 @@ let
 
   inherit (lib.lists)
     all
+    commonPrefix
+    drop
     elemAt
+    findFirstIndex
     foldl'
+    head
     length
     sublist
+    tail
     ;
 
   inherit (lib.path)
@@ -35,6 +40,7 @@ let
 
   inherit (lib.path.subpath)
     components
+    join
     ;
 
   inherit (lib.strings)
@@ -128,6 +134,31 @@ rec {
     else
       _singleton value;
 
+  # Coerce many values to filesets, erroring when any value cannot be coerced,
+  # or if the filesystem root of the values doesn't match.
+  # Type: String -> [ { context :: String, value :: fileset | Path } ] -> [ fileset ]
+  _coerceMany = functionContext: list:
+    let
+      filesets = map ({ context, value }:
+        _coerce "${functionContext}: ${context}" value
+      ) list;
+
+      firstBaseRoot = (head filesets)._internalBaseRoot;
+
+      # Finds the first element with a filesystem root different than the first element, if any
+      differentIndex = findFirstIndex (fileset:
+        firstBaseRoot != fileset._internalBaseRoot
+      ) null filesets;
+    in
+    if differentIndex != null then
+      throw ''
+        ${functionContext}: Filesystem roots are not the same:
+            ${(head list).context}: root "${toString firstBaseRoot}"
+            ${(elemAt list differentIndex).context}: root "${toString (elemAt filesets differentIndex)._internalBaseRoot}"
+            Different roots are not supported.''
+    else
+      filesets;
+
   # Create a file set from a path.
   # Type: Path -> fileset
   _singleton = path:
@@ -300,4 +331,86 @@ rec {
     else
       nonEmpty;
 
+  # Computes the union of a list of filesets.
+  # The filesets must already be coerced and validated to be in the same filesystem root
+  # Type: [ Fileset ] -> Fileset
+  _unionMany = filesets:
+    let
+      first = head filesets;
+
+      # To be able to union filesetTree's together, they need to have the same base path.
+      # Base paths can be unioned by taking their common prefix,
+      # e.g. such that `union /foo/bar /foo/baz` has the base path `/foo`
+
+      # A list of path components common to all base paths
+      commonBaseComponents = foldl'
+        (components: el: commonPrefix components el._internalBaseComponents)
+        first._internalBaseComponents
+        # We could also not do the `tail` here to avoid a list allocation,
+        # but then we'd have to pay for a potentially expensive
+        # but unnecessary `commonPrefix` call
+        (tail filesets);
+
+      # The common base path assembled from a filesystem root and the common components
+      commonBase = append first._internalBaseRoot (join commonBaseComponents);
+
+      # The number of path components common to all base paths
+      commonBaseComponentsCount = length commonBaseComponents;
+
+      # A list of filesetTree's that all have the same base path
+      # This is achieved by nesting the trees into the components they have over the common base path
+      # E.g. `union /foo/bar /foo/baz` has the base path /foo
+      # So the tree under `/foo/bar` gets nested under `{ bar = ...; ... }`,
+      # while the tree under `/foo/baz` gets nested under `{ baz = ...; ... }`
+      # Therefore allowing combined operations over them.
+      trees = map (fileset:
+        _nestTree
+          commonBase
+          (drop commonBaseComponentsCount fileset._internalBaseComponents)
+          fileset._internalTree
+        ) filesets;
+
+      # Folds all trees together into a single one using _unionTree
+      resultTree = foldl'
+        _unionTree
+        (head trees)
+        # We could also not do the `tail` here to avoid a list allocation,
+        # but then we'd have to pay for a potentially expensive
+        # but unnecessary `_unionTree (head trees) (head trees)` call.
+        (tail trees);
+    in
+    _create commonBase resultTree;
+
+
+  # Legend for branch tables in the below tree combinator functions
+  # - lhs\rhs  : The values for the left hand side (columns) and right hand side (rows) arguments
+  # - null     : Value `null`, a file/directory that's not included
+  # - attrs    : Satisfies `isAttrs value`, an explicitly listed directory containing nested trees
+  # - str      : Satisfies `isString value`, either "directory" or a file type, a fully included file/directory
+  # - rec      : A result computed by recursing
+  # - <number> : Indicates that the result is computed by the branch with that number
+  # - *        : Only the lhs/rhs needs to be evaluated, the result is always the same no matter the other side
+
+  # The union of two filesetTree's with the same base path.
+  # The second argument is only evaluated if necessary.
+  # Type: filesetTree -> filesetTree -> filesetTree
+  _unionTree = lhs: rhs:
+    # This branch table shows the correctness of the branch conditions,
+    # see the legend above for more details
+    #
+    # lhs\rhs |   null  |   attrs |   str |
+    # ------- | ------- | ------- | ----- |
+    #   null  | 1 null  | 3 attrs | 3 str |
+    #   attrs | 1 attrs | 2 rec   | 3 str |
+    # * str   | 1 str   | 1 str   | 1 str |
+
+    if isString lhs || rhs == null then
+      # Branch 1
+      lhs
+    else if isAttrs lhs && isAttrs rhs then
+      # Branch 2
+      mapAttrs (name: _unionTree lhs.${name}) rhs
+    else
+      # Branch 3
+      rhs;
 }

From bd52895222b90c6dc75b081cb8f263e6bfbd1bf0 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 23:29:57 +0200
Subject: [PATCH 44/84] lib.fileset.unions: init

---
 lib/fileset/default.nix | 65 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index d04a653bd91b0..1bda8ef789a42 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -9,11 +9,16 @@ let
     ;
 
   inherit (builtins)
+    isList
     isPath
     pathExists
     typeOf
     ;
 
+  inherit (lib.lists)
+    imap0
+    ;
+
   inherit (lib.path)
     hasPrefix
     splitRoot
@@ -135,6 +140,8 @@ The only way to change which files get added to the store is by changing the `fi
 
   /*
     The file set containing all files that are in either of two given file sets.
+    This is the same as [`unions`](#function-library-lib.fileset.unions),
+    but takes just two file sets instead of a list.
     See also [Union (set theory)](https://en.wikipedia.org/wiki/Union_(set_theory)).
 
     The given file sets are evaluated as lazily as possible,
@@ -175,4 +182,62 @@ The only way to change which files get added to the store is by changing the `fi
     in
     _unionMany filesets;
 
+  /*
+    The file set containing all files that are in any of the given file sets.
+    This is the same as [`union`](#function-library-lib.fileset.unions),
+    but takes a list of file sets instead of just two.
+    See also [Union (set theory)](https://en.wikipedia.org/wiki/Union_(set_theory)).
+
+    The given file sets are evaluated as lazily as possible,
+    with earlier elements being evaluated first if needed.
+
+    Type:
+      unions :: [ FileSet ] -> FileSet
+
+    Example:
+      # Create a file set containing selected files
+      unions [
+        # Include the single file `Makefile` in the current directory
+        # This errors if the file doesn't exist
+        ./Makefile
+
+        # Recursively include all files in the `src/code` directory
+        # If this directory is empty this has no effect
+        ./src/code
+
+        # Include the files `run.sh` and `unit.c` from the `tests` directory
+        ./tests/run.sh
+        ./tests/unit.c
+
+        # Include the `LICENSE` file from the parent directory
+        ../LICENSE
+      ]
+  */
+  unions =
+    # A list of file sets.
+    # Must contain at least 1 element.
+    # The elements can also be paths,
+    # which get [implicitly coerced to file sets](#sec-fileset-path-coercion).
+    filesets:
+    let
+      # We cannot rename matched attribute arguments, so let's work around it with an extra `let in` statement
+      maybeFilesets = filesets;
+    in
+    let
+      # Annotate the elements with context, used by _coerceMany for better errors
+      annotated = imap0 (i: el: {
+        context = "element ${toString i} of the argument";
+        value = el;
+      }) maybeFilesets;
+
+      filesets = _coerceMany "lib.fileset.unions" annotated;
+    in
+    if ! isList maybeFilesets then
+      throw "lib.fileset.unions: Expected argument to be a list, but got a ${typeOf maybeFilesets}."
+    else if maybeFilesets == [ ] then
+      # TODO: This could be supported, but requires an extra internal representation for the empty file set
+      throw "lib.fileset.unions: Expected argument to be a list with at least one element, but it contains no elements."
+    else
+      _unionMany filesets;
+
 }

From f78d65067fe0a9ccd97ba901449ac948dcd07f94 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 23:30:30 +0200
Subject: [PATCH 45/84] lib.fileset: Create tests for union and unions

---
 lib/fileset/tests.sh | 82 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 5bd798ae79422..d4a175acf6c7a 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -361,6 +361,88 @@ expectEqual '_toSourceFilter (_create /. null) "/foo" ""' 'false'
 expectEqual '_toSourceFilter (_create /. { foo = "regular"; }) "/foo" ""' 'true'
 expectEqual '_toSourceFilter (_create /. { foo = null; }) "/foo" ""' 'false'
 
+
+## lib.fileset.union, lib.fileset.unions
+
+
+# Different filesystem roots in root and fileset are not supported
+mkdir -p {foo,bar}/mock-root
+expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/mock-splitRoot.nix>)).fileset;
+  toSource { root = ./.; fileset = union ./foo/mock-root ./bar/mock-root; }
+' 'lib.fileset.union: Filesystem roots are not the same:
+\s*first argument: root "'"$work"'/foo/mock-root"
+\s*second argument: root "'"$work"'/bar/mock-root"
+\s*Different roots are not supported.'
+
+expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/mock-splitRoot.nix>)).fileset;
+  toSource { root = ./.; fileset = unions [ ./foo/mock-root ./bar/mock-root ]; }
+' 'lib.fileset.unions: Filesystem roots are not the same:
+\s*element 0 of the argument: root "'"$work"'/foo/mock-root"
+\s*element 1 of the argument: root "'"$work"'/bar/mock-root"
+\s*Different roots are not supported.'
+rm -rf *
+
+# Coercion errors show the correct context
+expectFailure 'toSource { root = ./.; fileset = union ./a ./.; }' 'lib.fileset.union: first argument '"$work"'/a does not exist.'
+expectFailure 'toSource { root = ./.; fileset = union ./. ./b; }' 'lib.fileset.union: second argument '"$work"'/b does not exist.'
+expectFailure 'toSource { root = ./.; fileset = unions [ ./a ./. ]; }' 'lib.fileset.unions: element 0 of the argument '"$work"'/a does not exist.'
+expectFailure 'toSource { root = ./.; fileset = unions [ ./. ./b ]; }' 'lib.fileset.unions: element 1 of the argument '"$work"'/b does not exist.'
+
+# unions needs a list with at least 1 element
+expectFailure 'toSource { root = ./.; fileset = unions null; }' 'lib.fileset.unions: Expected argument to be a list, but got a null.'
+expectFailure 'toSource { root = ./.; fileset = unions [ ]; }' 'lib.fileset.unions: Expected argument to be a list with at least one element, but it contains no elements.'
+
+# The tree of later arguments should not be evaluated if a former argument already includes all files
+tree=()
+checkFileset 'union ./. (_create ./. (abort "This should not be used!"))'
+checkFileset 'unions [ ./. (_create ./. (abort "This should not be used!")) ]'
+
+# union doesn't include files that weren't specified
+tree=(
+    [x]=1
+    [y]=1
+    [z]=0
+)
+checkFileset 'union ./x ./y'
+checkFileset 'unions [ ./x ./y ]'
+
+# Also for directories
+tree=(
+    [x/a]=1
+    [x/b]=1
+    [y/a]=1
+    [y/b]=1
+    [z/a]=0
+    [z/b]=0
+)
+checkFileset 'union ./x ./y'
+checkFileset 'unions [ ./x ./y ]'
+
+# And for very specific paths
+tree=(
+    [x/a]=1
+    [x/b]=0
+    [y/a]=0
+    [y/b]=1
+    [z/a]=0
+    [z/b]=0
+)
+checkFileset 'union ./x/a ./y/b'
+checkFileset 'unions [ ./x/a ./y/b ]'
+
+# unions or chained union's can include more paths
+tree=(
+    [x/a]=1
+    [x/b]=1
+    [y/a]=1
+    [y/b]=0
+    [z/a]=0
+    [z/b]=1
+)
+checkFileset 'unions [ ./x/a ./x/b ./y/a ./z/b ]'
+checkFileset 'union (union ./x/a ./x/b) (union ./y/a ./z/b)'
+checkFileset 'union (union (union ./x/a ./x/b) ./y/a) ./z/b'
+
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 
 echo >&2 tests ok

From c5ae093f13ed2a2a1b9b82331b5cfccad1fb7bdd Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Sep 2023 23:31:02 +0200
Subject: [PATCH 46/84] lib.fileset: Various updates relating to union/unions

Also some minor formatting improvements
---
 doc/functions/fileset.section.md |  2 +-
 lib/fileset/README.md            |  8 +----
 lib/fileset/default.nix          | 61 ++++++++++++++++++++++++++------
 lib/fileset/tests.sh             |  2 +-
 4 files changed, 54 insertions(+), 19 deletions(-)

diff --git a/doc/functions/fileset.section.md b/doc/functions/fileset.section.md
index b24ebe26cc3b7..08b9ba9eaedc0 100644
--- a/doc/functions/fileset.section.md
+++ b/doc/functions/fileset.section.md
@@ -9,7 +9,7 @@ File sets are easy and safe to use, providing obvious and composable semantics w
 These sections apply to the entire library.
 See the [function reference](#sec-functions-library-fileset) for function-specific documentation.
 
-The file set library is currently very limited but is being expanded to include more functions over time.
+The file set library is currently somewhat limited but is being expanded to include more functions over time.
 
 ## Implicit coercion from paths to file sets {#sec-fileset-path-coercion}
 
diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index 306dcdaa421d8..a75efc496c4ed 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -177,15 +177,9 @@ Arguments:
 ## To update in the future
 
 Here's a list of places in the library that need to be updated in the future:
-- > The file set library is currently very limited but is being expanded to include more functions over time.
+- > The file set library is currently somewhat limited but is being expanded to include more functions over time.
 
   in [the manual](../../doc/functions/fileset.section.md)
-- > Currently the only way to construct file sets is using implicit coercion from paths.
-
-  in [the `toSource` reference](./default.nix)
-- > For now filesets are always paths
-
-  in [the `toSource` implementation](./default.nix), also update the variable name there
 - Once a tracing function exists, `__noEval` in [internal.nix](./internal.nix) should mention it
 - If/Once a function to convert `lib.sources` values into file sets exists, the `_coerce` and `toSource` functions should be updated to mention that function in the error when such a value is passed
 - If/Once a function exists that can optionally include a path depending on whether it exists, the error message for the path not existing in `_coerce` should mention the new function
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index 1bda8ef789a42..2c8997d71fc20 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -58,16 +58,51 @@ in {
       } -> SourceLike
 
     Example:
-      # Import the current directory into the store but only include files under ./src
-      toSource { root = ./.; fileset = ./src; }
+      # Import the current directory into the store
+      # but only include files under ./src
+      toSource {
+        root = ./.;
+        fileset = ./src;
+      }
       => "/nix/store/...-source"
 
-      # The file set coerced from path ./bar could contain files outside the root ./foo, which is not allowed
-      toSource { root = ./foo; fileset = ./bar; }
+      # Import the current directory into the store
+      # but only include ./Makefile and all files under ./src
+      toSource {
+        root = ./.;
+        fileset = union
+          ./Makefile
+          ./src;
+      }
+      => "/nix/store/...-source"
+
+      # Trying to include a file outside the root will fail
+      toSource {
+        root = ./.;
+        fileset = unions [
+          ./Makefile
+          ./src
+          ../LICENSE
+        ];
+      }
       => <error>
 
+      # The root needs to point to a directory that contains all the files
+      toSource {
+        root = ../.;
+        fileset = unions [
+          ./Makefile
+          ./src
+          ../LICENSE
+        ];
+      }
+      => "/nix/store/...-source"
+
       # The root has to be a local filesystem path
-      toSource { root = "/nix/store/...-source"; fileset = ./.; }
+      toSource {
+        root = "/nix/store/...-source";
+        fileset = ./.;
+      }
       => <error>
   */
   toSource = {
@@ -85,18 +120,24 @@ The only way to change which files get added to the store is by changing the `fi
     root,
     /*
       (required) The file set whose files to import into the store.
-      Currently the only way to construct file sets is using [implicit coercion from paths](#sec-fileset-path-coercion).
-      If a directory does not recursively contain any file, it is omitted from the store path contents.
+      File sets can be created using other functions in this library.
+      This argument can also be a path,
+      which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
+
+<!-- Ignore the indentation here, this is a nixdoc rendering bug that needs to be fixed -->
+:::{.note}
+If a directory does not recursively contain any file, it is omitted from the store path contents.
+:::
+
     */
     fileset,
   }:
     let
       # We cannot rename matched attribute arguments, so let's work around it with an extra `let in` statement
-      # For now filesets are always paths
-      filesetPath = fileset;
+      maybeFileset = fileset;
     in
     let
-      fileset = _coerce "lib.fileset.toSource: `fileset`" filesetPath;
+      fileset = _coerce "lib.fileset.toSource: `fileset`" maybeFileset;
       rootFilesystemRoot = (splitRoot root).root;
       filesetFilesystemRoot = (splitRoot fileset._internalBase).root;
       filter = _toSourceFilter fileset;
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index d4a175acf6c7a..69ce29bbbfb31 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -265,7 +265,7 @@ expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.to
 expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` '"$work"'/a does not exist.'
 
 # File sets cannot be evaluated directly
-expectFailure '_create ./. null' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
+expectFailure 'union ./. ./.' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
 
 # Past versions of the internal representation are supported
 expectEqual '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 0; _internalBase = ./.; }' \

From e04e40d05e5d959e30188d62c76e3dfb5cb26b16 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 21:40:17 +0200
Subject: [PATCH 47/84] lib.fileset: Optimise tests

Previously a lot of processes were used, slowing it down considerably
the more files were tested
---
 lib/fileset/tests.sh | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 69ce29bbbfb31..cee93615d56f8 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -124,18 +124,19 @@ checkFileset() (
     local fileset=$1
 
     # Process the tree into separate arrays for included paths, excluded paths and excluded files.
-    # Also create all the paths in the local directory
     local -a included=()
     local -a excluded=()
     local -a excludedFiles=()
+    # Track which paths need to be created
+    local -a dirsToCreate=()
+    local -a filesToCreate=()
     for p in "${!tree[@]}"; do
         # If keys end with a `/` we treat them as directories, otherwise files
         if [[ "$p" =~ /$ ]]; then
-            mkdir -p "$p"
+            dirsToCreate+=("$p")
             isFile=
         else
-            mkdir -p "$(dirname "$p")"
-            touch "$p"
+            filesToCreate+=("$p")
             isFile=1
         fi
         case "${tree[$p]}" in
@@ -153,6 +154,19 @@ checkFileset() (
         esac
     done
 
+    # Create all the necessary paths.
+    # This is done with only a fixed number of processes,
+    # in order to not be too slow
+    # Though this does mean we're a bit limited with how many files can be created
+    if (( ${#dirsToCreate[@]} != 0 )); then
+        mkdir -p "${dirsToCreate[@]}"
+    fi
+    if (( ${#filesToCreate[@]} != 0 )); then
+        readarray -d '' -t parentsToCreate < <(dirname -z "${filesToCreate[@]}")
+        mkdir -p "${parentsToCreate[@]}"
+        touch "${filesToCreate[@]}"
+    fi
+
     # Start inotifywait in the background to monitor all excluded files (if any)
     if [[ -n "$canMonitorFiles" ]] && (( "${#excludedFiles[@]}" != 0 )); then
         coproc watcher {

From 7ab764e575135586cb8ac496702663a40a2bfa56 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 21:41:03 +0200
Subject: [PATCH 48/84] lib.fileset.unions: Don't stack overflow for many files

---
 lib/fileset/internal.nix | 65 ++++++++++++++++------------------------
 lib/fileset/tests.sh     | 13 ++++++++
 2 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 19db7adcff4b0..43af0acc73e2b 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -14,6 +14,7 @@ let
   inherit (lib.attrsets)
     attrValues
     mapAttrs
+    zipAttrsWith
     ;
 
   inherit (lib.filesystem)
@@ -25,6 +26,7 @@ let
     commonPrefix
     drop
     elemAt
+    filter
     findFirstIndex
     foldl'
     head
@@ -342,7 +344,9 @@ rec {
       # Base paths can be unioned by taking their common prefix,
       # e.g. such that `union /foo/bar /foo/baz` has the base path `/foo`
 
-      # A list of path components common to all base paths
+      # A list of path components common to all base paths.
+      # Note that commonPrefix can only be fully evaluated,
+      # so this cannot cause a stack overflow due to a build-up of unevaluated thunks.
       commonBaseComponents = foldl'
         (components: el: commonPrefix components el._internalBaseComponents)
         first._internalBaseComponents
@@ -371,46 +375,29 @@ rec {
         ) filesets;
 
       # Folds all trees together into a single one using _unionTree
-      resultTree = foldl'
-        _unionTree
-        (head trees)
-        # We could also not do the `tail` here to avoid a list allocation,
-        # but then we'd have to pay for a potentially expensive
-        # but unnecessary `_unionTree (head trees) (head trees)` call.
-        (tail trees);
+      # We do not use a fold here because it would cause a thunk build-up
+      # which could cause a stack overflow for a large number of trees
+      resultTree = _unionTrees trees;
     in
     _create commonBase resultTree;
 
-
-  # Legend for branch tables in the below tree combinator functions
-  # - lhs\rhs  : The values for the left hand side (columns) and right hand side (rows) arguments
-  # - null     : Value `null`, a file/directory that's not included
-  # - attrs    : Satisfies `isAttrs value`, an explicitly listed directory containing nested trees
-  # - str      : Satisfies `isString value`, either "directory" or a file type, a fully included file/directory
-  # - rec      : A result computed by recursing
-  # - <number> : Indicates that the result is computed by the branch with that number
-  # - *        : Only the lhs/rhs needs to be evaluated, the result is always the same no matter the other side
-
-  # The union of two filesetTree's with the same base path.
-  # The second argument is only evaluated if necessary.
-  # Type: filesetTree -> filesetTree -> filesetTree
-  _unionTree = lhs: rhs:
-    # This branch table shows the correctness of the branch conditions,
-    # see the legend above for more details
-    #
-    # lhs\rhs |   null  |   attrs |   str |
-    # ------- | ------- | ------- | ----- |
-    #   null  | 1 null  | 3 attrs | 3 str |
-    #   attrs | 1 attrs | 2 rec   | 3 str |
-    # * str   | 1 str   | 1 str   | 1 str |
-
-    if isString lhs || rhs == null then
-      # Branch 1
-      lhs
-    else if isAttrs lhs && isAttrs rhs then
-      # Branch 2
-      mapAttrs (name: _unionTree lhs.${name}) rhs
+  # The union of multiple filesetTree's with the same base path.
+  # Later elements are only evaluated if necessary.
+  # Type: [ filesetTree ] -> filesetTree
+  _unionTrees = trees:
+    let
+      stringIndex = findFirstIndex isString null trees;
+      withoutNull = filter (tree: tree != null) trees;
+    in
+    if stringIndex != null then
+      # If there's a string, it's always a fully included tree (dir or file),
+      # no need to look at other elements
+      elemAt trees stringIndex
+    else if withoutNull == [ ] then
+      # If all trees are null, then the resulting tree is also null
+      null
     else
-      # Branch 3
-      rhs;
+      # The non-null elements have to be attribute sets representing partial trees
+      # We need to recurse into those
+      zipAttrsWith (name: _unionTrees) withoutNull;
 }
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index cee93615d56f8..1a8f1372ebfa0 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -457,6 +457,19 @@ checkFileset 'unions [ ./x/a ./x/b ./y/a ./z/b ]'
 checkFileset 'union (union ./x/a ./x/b) (union ./y/a ./z/b)'
 checkFileset 'union (union (union ./x/a ./x/b) ./y/a) ./z/b'
 
+# unions should not stack overflow, even if many elements are passed
+tree=()
+for i in $(seq 1000); do
+    tree[$i/a]=1
+    tree[$i/b]=0
+done
+(
+    # Locally limit the maximum stack size to 100 * 1024 bytes
+    # If unions was implemented recursively, this would stack overflow
+    ulimit -s 100
+    checkFileset 'unions (mapAttrsToList (name: _: ./. + "/${name}/a") (builtins.readDir ./.))'
+)
+
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 
 echo >&2 tests ok

From 631ad2169243e656cb622365e76ee480bb6a3419 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 22:14:06 +0200
Subject: [PATCH 49/84] lib.fileset: More reusable benchmark code

---
 lib/fileset/benchmark.sh | 101 +++++++++++++++++++++------------------
 1 file changed, 55 insertions(+), 46 deletions(-)

diff --git a/lib/fileset/benchmark.sh b/lib/fileset/benchmark.sh
index f72686c4ab3fa..b68d2fcefe902 100755
--- a/lib/fileset/benchmark.sh
+++ b/lib/fileset/benchmark.sh
@@ -28,38 +28,6 @@ work="$tmp/work"
 mkdir "$work"
 cd "$work"
 
-# Create a fairly populated tree
-touch f{0..5}
-mkdir d{0..5}
-mkdir e{0..5}
-touch d{0..5}/f{0..5}
-mkdir -p d{0..5}/d{0..5}
-mkdir -p e{0..5}/e{0..5}
-touch d{0..5}/d{0..5}/f{0..5}
-mkdir -p d{0..5}/d{0..5}/d{0..5}
-mkdir -p e{0..5}/e{0..5}/e{0..5}
-touch d{0..5}/d{0..5}/d{0..5}/f{0..5}
-mkdir -p d{0..5}/d{0..5}/d{0..5}/d{0..5}
-mkdir -p e{0..5}/e{0..5}/e{0..5}/e{0..5}
-touch d{0..5}/d{0..5}/d{0..5}/d{0..5}/f{0..5}
-
-bench() {
-    NIX_PATH=nixpkgs=$1 NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=$tmp/stats.json \
-        nix-instantiate --eval --strict --show-trace >/dev/null \
-        --expr '(import <nixpkgs/lib>).fileset.toSource { root = ./.; fileset = ./.; }'
-    cat "$tmp/stats.json"
-}
-
-echo "Running benchmark on index" >&2
-bench "$nixpkgs" > "$tmp/new.json"
-(
-    echo "Checking out $compareTo" >&2
-    git -C "$nixpkgs" worktree add --quiet "$tmp/worktree" "$compareTo"
-    trap 'git -C "$nixpkgs" worktree remove "$tmp/worktree"' EXIT
-    echo "Running benchmark on $compareTo" >&2
-    bench "$tmp/worktree" > "$tmp/old.json"
-)
-
 declare -a stats=(
     ".envs.elements"
     ".envs.number"
@@ -77,18 +45,59 @@ declare -a stats=(
     ".values.number"
 )
 
-different=0
-for stat in "${stats[@]}"; do
-    oldValue=$(jq "$stat" "$tmp/old.json")
-    newValue=$(jq "$stat" "$tmp/new.json")
-    if (( oldValue != newValue )); then
-        percent=$(bc <<< "scale=100; result = 100/$oldValue*$newValue; scale=4; result / 1")
-        if (( oldValue < newValue )); then
-            echo -e "Statistic $stat ($newValue) is \e[0;31m$percent% (+$(( newValue - oldValue )))\e[0m of the old value $oldValue" >&2
-        else
-            echo -e "Statistic $stat ($newValue) is \e[0;32m$percent% (-$(( oldValue - newValue )))\e[0m of the old value $oldValue" >&2
+# TODO: Measure time
+run() {
+    NIX_PATH=nixpkgs=$1 NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=$tmp/stats.json \
+        nix-instantiate --eval --strict --show-trace >/dev/null \
+        --expr 'with import <nixpkgs/lib>; with fileset; '"$2"
+    cat "$tmp/stats.json"
+}
+
+bench() {
+    echo "Benchmarking expression $1" >&2
+    #echo "Running benchmark on index" >&2
+    run "$nixpkgs" "$1" > "$tmp/new.json"
+    (
+        #echo "Checking out $compareTo" >&2
+        git -C "$nixpkgs" worktree add --quiet "$tmp/worktree" "$compareTo"
+        trap 'git -C "$nixpkgs" worktree remove "$tmp/worktree"' EXIT
+        #echo "Running benchmark on $compareTo" >&2
+        run "$tmp/worktree" "$1" > "$tmp/old.json"
+    )
+
+    different=0
+    for stat in "${stats[@]}"; do
+        oldValue=$(jq "$stat" "$tmp/old.json")
+        newValue=$(jq "$stat" "$tmp/new.json")
+        if (( oldValue != newValue )); then
+            percent=$(bc <<< "scale=100; result = 100/$oldValue*$newValue; scale=4; result / 1")
+            if (( oldValue < newValue )); then
+                echo -e "Statistic $stat ($newValue) is \e[0;31m$percent% (+$(( newValue - oldValue )))\e[0m of the old value $oldValue" >&2
+            else
+                echo -e "Statistic $stat ($newValue) is \e[0;32m$percent% (-$(( oldValue - newValue )))\e[0m of the old value $oldValue" >&2
+            fi
+            (( different++ )) || true
         fi
-        (( different++ )) || true
-    fi
-done
-echo "$different stats differ between the current tree and $compareTo"
+    done
+    echo "$different stats differ between the current tree and $compareTo"
+    echo ""
+}
+
+# Create a fairly populated tree
+touch f{0..5}
+mkdir d{0..5}
+mkdir e{0..5}
+touch d{0..5}/f{0..5}
+mkdir -p d{0..5}/d{0..5}
+mkdir -p e{0..5}/e{0..5}
+touch d{0..5}/d{0..5}/f{0..5}
+mkdir -p d{0..5}/d{0..5}/d{0..5}
+mkdir -p e{0..5}/e{0..5}/e{0..5}
+touch d{0..5}/d{0..5}/d{0..5}/f{0..5}
+mkdir -p d{0..5}/d{0..5}/d{0..5}/d{0..5}
+mkdir -p e{0..5}/e{0..5}/e{0..5}/e{0..5}
+touch d{0..5}/d{0..5}/d{0..5}/d{0..5}/f{0..5}
+
+bench 'toSource { root = ./.; fileset = ./.; }'
+
+rm -rf -- *

From c8bac6ea0f9afb3ec622aa2a579f3bb0f7488ae9 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 22:14:57 +0200
Subject: [PATCH 50/84] lib.fileset: Add benchmark for unions

---
 lib/fileset/benchmark.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/fileset/benchmark.sh b/lib/fileset/benchmark.sh
index b68d2fcefe902..79ab890d6e836 100755
--- a/lib/fileset/benchmark.sh
+++ b/lib/fileset/benchmark.sh
@@ -101,3 +101,7 @@ touch d{0..5}/d{0..5}/d{0..5}/d{0..5}/f{0..5}
 bench 'toSource { root = ./.; fileset = ./.; }'
 
 rm -rf -- *
+
+touch {0..1000}
+bench 'toSource { root = ./.; fileset = unions (mapAttrsToList (name: value: ./. + "/${name}") (builtins.readDir ./.)); }'
+rm -rf -- *

From c9c9c093cfbc7b32be5579ca21312c6b5e093d66 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 23:21:58 +0200
Subject: [PATCH 51/84] lib.fileset: Have benchmark.sh measure the time

---
 lib/fileset/benchmark.sh | 41 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/lib/fileset/benchmark.sh b/lib/fileset/benchmark.sh
index 79ab890d6e836..19aae31cb6c54 100755
--- a/lib/fileset/benchmark.sh
+++ b/lib/fileset/benchmark.sh
@@ -45,12 +45,29 @@ declare -a stats=(
     ".values.number"
 )
 
-# TODO: Measure time
+runs=10
+
 run() {
-    NIX_PATH=nixpkgs=$1 NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=$tmp/stats.json \
-        nix-instantiate --eval --strict --show-trace >/dev/null \
-        --expr 'with import <nixpkgs/lib>; with fileset; '"$2"
-    cat "$tmp/stats.json"
+    # Empty the file
+    : > cpuTimes
+
+    for i in $(seq 0 "$runs"); do
+        NIX_PATH=nixpkgs=$1 NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=$tmp/stats.json \
+            nix-instantiate --eval --strict --show-trace >/dev/null \
+            --expr 'with import <nixpkgs/lib>; with fileset; '"$2"
+
+        # Only measure the time after the first run, one is warmup
+        if (( i > 0 )); then
+            jq '.cpuTime' "$tmp/stats.json" >> cpuTimes
+        fi
+    done
+
+    # Compute mean and standard deviation
+    read -r mean sd < <(sta --mean --sd --brief <cpuTimes)
+
+    jq --argjson mean "$mean" --argjson sd "$sd" \
+        '.cpuTimeMean = $mean | .cpuTimeSd = $sd' \
+        "$tmp/stats.json"
 }
 
 bench() {
@@ -65,6 +82,20 @@ bench() {
         run "$tmp/worktree" "$1" > "$tmp/old.json"
     )
 
+    read -r oldMean oldSd newMean newSd percentageMean percentageSd < \
+        <(jq -rn --slurpfile old "$tmp/old.json" --slurpfile new "$tmp/new.json" \
+        ' $old[0].cpuTimeMean as $om
+        | $old[0].cpuTimeSd as $os
+        | $new[0].cpuTimeMean as $nm
+        | $new[0].cpuTimeSd as $ns
+        | (100 / $om * $nm) as $pm
+        # Copied from https://github.com/sharkdp/hyperfine/blob/b38d550b89b1dab85139eada01c91a60798db9cc/src/benchmark/relative_speed.rs#L46-L53
+        | ($pm * pow(pow($ns / $nm; 2) + pow($os / $om; 2); 0.5)) as $ps
+        | [ $om, $os, $nm, $ns, $pm, $ps ]
+        | @sh')
+
+    echo -e "Mean CPU time $newMean (σ = $newSd) for $runs runs is \e[0;33m$percentageMean% (σ = $percentageSd%)\e[0m of the old value $oldMean (σ = $oldSd)" >&2
+
     different=0
     for stat in "${stats[@]}"; do
         oldValue=$(jq "$stat" "$tmp/old.json")

From e05cf47184441438c7527b0f2986fa4a89cc86e0 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 23:22:17 +0200
Subject: [PATCH 52/84] lib.fileset: Use a nix-shell shebang for benchmark.sh

---
 lib/fileset/benchmark.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/fileset/benchmark.sh b/lib/fileset/benchmark.sh
index 19aae31cb6c54..ee861ad3c382c 100755
--- a/lib/fileset/benchmark.sh
+++ b/lib/fileset/benchmark.sh
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p sta jq bc nix -I nixpkgs=../..
 
 # Benchmarks lib.fileset
 # Run:

From 45bf2c7617afd7ac794fb56519301e1ee3324c08 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Fri, 15 Sep 2023 00:09:34 +0200
Subject: [PATCH 53/84] lib.fileset: Ignore irrelevant shellcheck warnings

---
 lib/fileset/benchmark.sh | 1 +
 lib/fileset/tests.sh     | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/lib/fileset/benchmark.sh b/lib/fileset/benchmark.sh
index ee861ad3c382c..59ddb6d49af79 100755
--- a/lib/fileset/benchmark.sh
+++ b/lib/fileset/benchmark.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p sta jq bc nix -I nixpkgs=../..
+# shellcheck disable=SC2016
 
 # Benchmarks lib.fileset
 # Run:
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 1a8f1372ebfa0..ce936a9b02261 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2016
 
 # Tests lib.fileset
 # Run:
@@ -178,6 +179,7 @@ checkFileset() (
         }
         # This will trigger when this subshell exits, no matter if successful or not
         # After exiting the subshell, the parent shell will continue executing
+        # shellcheck disable=SC2154
         trap 'kill "${watcher_PID}"' exit
 
         # Synchronously wait until inotifywait is ready

From fe6c1539cc27c52d1f4cffd28c1479e973689766 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 14 Sep 2023 23:34:21 +0200
Subject: [PATCH 54/84] lib.fileset: Internal representation v2, ~12x faster
 unions!
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

    $ ./benchmark.sh HEAD
    [...]
    Mean CPU time 0.04006 (σ = 0.0040146) for 10 runs is 8.193619775953792% (σ = 0.9584251052704821%) of the old value 0.488917 (σ = 0.0294955)
    [...]
---
 lib/fileset/README.md    |  6 ++--
 lib/fileset/internal.nix | 62 ++++++++++++++--------------------------
 lib/fileset/tests.sh     | 12 ++++----
 3 files changed, 32 insertions(+), 48 deletions(-)

diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index a75efc496c4ed..c50f7936aa771 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -41,7 +41,7 @@ An attribute set with these values:
 - `_type` (constant string `"fileset"`):
   Tag to indicate this value is a file set.
 
-- `_internalVersion` (constant `1`, the current version):
+- `_internalVersion` (constant `2`, the current version):
   Version of the representation.
 
 - `_internalBase` (path):
@@ -67,8 +67,8 @@ An attribute set with these values:
 One of the following:
 
 - `{ <name> = filesetTree; }`:
-  A directory with a nested `filesetTree` value for every directory entry.
-  Even entries that aren't included are present as `null` because it improves laziness and allows using this as a sort of `builtins.readDir` cache.
+  A directory with a nested `filesetTree` value for directory entries.
+  Entries not included may either be omitted or set to `null`, as necessary to improve efficiency or laziness.
 
 - `"directory"`:
   A directory with all its files included recursively, allowing early cutoff for some operations.
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 43af0acc73e2b..3462b510b367f 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -14,6 +14,7 @@ let
   inherit (lib.attrsets)
     attrValues
     mapAttrs
+    setAttrByPath
     zipAttrsWith
     ;
 
@@ -63,7 +64,7 @@ rec {
   # - Increment this version
   # - Add an additional migration function below
   # - Update the description of the internal representation in ./README.md
-  _currentVersion = 1;
+  _currentVersion = 2;
 
   # Migrations between versions. The 0th element converts from v0 to v1, and so on
   migrations = [
@@ -79,6 +80,15 @@ rec {
         _internalBaseComponents = components parts.subpath;
       }
     )
+
+    # Convert v1 into v2: filesetTree's can now also omit attributes to signal paths not being included
+    (
+      filesetV1:
+      # This change is backwards compatible (but not forwards compatible, so we still need a new version)
+      filesetV1 // {
+        _internalVersion = 2;
+      }
+    )
   ];
 
   # Create a fileset, see ./README.md#fileset
@@ -174,50 +184,23 @@ rec {
       # - _internalBase: ./.
       # - _internalTree: {
       #     "default.nix" = <type>;
-      #     # Other directory entries
-      #     <name> = null;
       #   }
       # See ./README.md#single-files
       _create (dirOf path)
-        (_nestTree
-          (dirOf path)
-          [ (baseNameOf path) ]
-          type
-        );
-
-  /*
-    Nest a filesetTree under some extra components, while filling out all the other directory entries that aren't included with null
-
-    _nestTree ./. [ "foo" "bar" ] tree == {
-      foo = {
-        bar = tree;
-        <other-entries> = null;
-      }
-      <other-entries> = null;
-    }
-
-    Type: Path -> [ String ] -> filesetTree -> filesetTree
-  */
-  _nestTree = targetBase: extraComponents: tree:
-    let
-      recurse = index: focusPath:
-        if index == length extraComponents then
-          tree
-        else
-          mapAttrs (_: _: null) (readDir focusPath)
-          // {
-            ${elemAt extraComponents index} = recurse (index + 1) (append focusPath (elemAt extraComponents index));
-          };
-    in
-    recurse 0 targetBase;
+        {
+          ${baseNameOf path} = type;
+        };
 
-  # Expand "directory" filesetTree representation to the equivalent { <name> = filesetTree; }
+  # Expand a directory representation to an equivalent one in attribute set form.
+  # All directory entries are included in the result.
   # Type: Path -> filesetTree -> { <name> = filesetTree; }
   _directoryEntries = path: value:
-    if isAttrs value then
-      value
+    if value == "directory" then
+      readDir path
     else
-      readDir path;
+      # Set all entries not present to null
+      mapAttrs (name: value: null) (readDir path)
+      // value;
 
   /*
     Simplify a filesetTree recursively:
@@ -368,8 +351,7 @@ rec {
       # while the tree under `/foo/baz` gets nested under `{ baz = ...; ... }`
       # Therefore allowing combined operations over them.
       trees = map (fileset:
-        _nestTree
-          commonBase
+        setAttrByPath
           (drop commonBaseComponentsCount fileset._internalBaseComponents)
           fileset._internalTree
         ) filesets;
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index ce936a9b02261..7d38aaa7f41df 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -285,19 +285,21 @@ expectFailure 'union ./. ./.' 'lib.fileset: Directly evaluating a file set is no
 
 # Past versions of the internal representation are supported
 expectEqual '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 0; _internalBase = ./.; }' \
-    '{ _internalBase = ./.; _internalBaseComponents = path.subpath.components (path.splitRoot ./.).subpath; _internalBaseRoot = /.; _internalVersion = 1; _type = "fileset"; }'
+    '{ _internalBase = ./.; _internalBaseComponents = path.subpath.components (path.splitRoot ./.).subpath; _internalBaseRoot = /.; _internalVersion = 2; _type = "fileset"; }'
+expectEqual '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 1; }' \
+    '{ _type = "fileset"; _internalVersion = 2; }'
 
 # Future versions of the internal representation are unsupported
-expectFailure '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 2; }' '<tests>: value is a file set created from a future version of the file set library with a different internal representation:
-\s*- Internal version of the file set: 2
-\s*- Internal version of the library: 1
+expectFailure '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 3; }' '<tests>: value is a file set created from a future version of the file set library with a different internal representation:
+\s*- Internal version of the file set: 3
+\s*- Internal version of the library: 2
 \s*Make sure to update your Nixpkgs to have a newer version of `lib.fileset`.'
 
 # _create followed by _coerce should give the inputs back without any validation
 expectEqual '{
   inherit (_coerce "<test>" (_create ./. "directory"))
     _internalVersion _internalBase _internalTree;
-}' '{ _internalBase = ./.; _internalTree = "directory"; _internalVersion = 1; }'
+}' '{ _internalBase = ./.; _internalTree = "directory"; _internalVersion = 2; }'
 
 #### Resulting store path ####
 

From 94e103ee3f2096fd8b0484988ef65ff0e68fd73f Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Fri, 15 Sep 2023 00:08:04 +0200
Subject: [PATCH 55/84] lib.fileset: Minor changes from feedback

Co-authored-by: Robert Hensing <robert@roberthensing.nl>
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 lib/fileset/README.md    |  4 +--
 lib/fileset/default.nix  | 69 +++++++++++++++++++---------------------
 lib/fileset/internal.nix |  9 ++----
 lib/fileset/tests.sh     | 28 ++++++++--------
 4 files changed, 52 insertions(+), 58 deletions(-)

diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index c50f7936aa771..6e57f1f8f2b4a 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -50,11 +50,11 @@ An attribute set with these values:
 
 - `_internalBaseRoot` (path):
   The filesystem root of `_internalBase`, same as `(lib.path.splitRoot _internalBase).root`.
-  This is here because this needs to be computed anyways, and this computation shouldn't be duplicated.
+  This is here because this needs to be computed anyway, and this computation shouldn't be duplicated.
 
 - `_internalBaseComponents` (list of strings):
   The path components of `_internalBase`, same as `lib.path.subpath.components (lib.path.splitRoot _internalBase).subpath`.
-  This is here because this needs to be computed anyways, and this computation shouldn't be duplicated.
+  This is here because this needs to be computed anyway, and this computation shouldn't be duplicated.
 
 - `_internalTree` ([filesetTree](#filesettree)):
   A tree representation of all included files under `_internalBase`.
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index 2c8997d71fc20..88c8dcd1a70b8 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -36,6 +36,10 @@ let
     cleanSourceWith
     ;
 
+  inherit (lib.trivial)
+    pipe
+    ;
+
 in {
 
   /*
@@ -111,7 +115,7 @@ in {
       Paths in [strings](https://nixos.org/manual/nix/stable/language/values.html#type-string), including Nix store paths, cannot be passed as `root`.
       `root` has to be a directory.
 
-<!-- Ignore the indentation here, this is a nixdoc rendering bug that needs to be fixed -->
+<!-- Ignore the indentation here, this is a nixdoc rendering bug that needs to be fixed: https://github.com/nix-community/nixdoc/issues/75 -->
 :::{.note}
 Changing `root` only affects the directory structure of the resulting store path, it does not change which files are added to the store.
 The only way to change which files get added to the store is by changing the `fileset` attribute.
@@ -124,7 +128,7 @@ The only way to change which files get added to the store is by changing the `fi
       This argument can also be a path,
       which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
 
-<!-- Ignore the indentation here, this is a nixdoc rendering bug that needs to be fixed -->
+<!-- Ignore the indentation here, this is a nixdoc rendering bug that needs to be fixed: https://github.com/nix-community/nixdoc/issues/75 -->
 :::{.note}
 If a directory does not recursively contain any file, it is omitted from the store path contents.
 :::
@@ -134,18 +138,18 @@ If a directory does not recursively contain any file, it is omitted from the sto
   }:
     let
       # We cannot rename matched attribute arguments, so let's work around it with an extra `let in` statement
-      maybeFileset = fileset;
+      filesetArg = fileset;
     in
     let
-      fileset = _coerce "lib.fileset.toSource: `fileset`" maybeFileset;
+      fileset = _coerce "lib.fileset.toSource: `fileset`" filesetArg;
       rootFilesystemRoot = (splitRoot root).root;
       filesetFilesystemRoot = (splitRoot fileset._internalBase).root;
-      filter = _toSourceFilter fileset;
+      sourceFilter = _toSourceFilter fileset;
     in
     if ! isPath root then
       if isStringLike root then
         throw ''
-          lib.fileset.toSource: `root` "${toString root}" is a string-like value, but it should be a path instead.
+          lib.fileset.toSource: `root` ("${toString root}") is a string-like value, but it should be a path instead.
               Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
         throw ''
@@ -154,29 +158,29 @@ If a directory does not recursively contain any file, it is omitted from the sto
     # See also ../path/README.md
     else if rootFilesystemRoot != filesetFilesystemRoot then
       throw ''
-        lib.fileset.toSource: Filesystem roots are not the same for `fileset` and `root` "${toString root}":
+        lib.fileset.toSource: Filesystem roots are not the same for `fileset` and `root` ("${toString root}"):
             `root`: root "${toString rootFilesystemRoot}"
             `fileset`: root "${toString filesetFilesystemRoot}"
             Different roots are not supported.''
     else if ! pathExists root then
       throw ''
-        lib.fileset.toSource: `root` ${toString root} does not exist.''
+        lib.fileset.toSource: `root` (${toString root}) does not exist.''
     else if pathType root != "directory" then
       throw ''
-        lib.fileset.toSource: `root` ${toString root} is a file, but it should be a directory instead. Potential solutions:
+        lib.fileset.toSource: `root` (${toString root}) is a file, but it should be a directory instead. Potential solutions:
             - If you want to import the file into the store _without_ a containing directory, use string interpolation or `builtins.path` instead of this function.
             - If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as ${toString (dirOf root)}, and set `fileset` to the file path.''
     else if ! hasPrefix root fileset._internalBase then
       throw ''
-        lib.fileset.toSource: `fileset` could contain files in ${toString fileset._internalBase}, which is not under the `root` ${toString root}. Potential solutions:
+        lib.fileset.toSource: `fileset` could contain files in ${toString fileset._internalBase}, which is not under the `root` (${toString root}). Potential solutions:
             - Set `root` to ${toString fileset._internalBase} or any directory higher up. This changes the layout of the resulting store path.
-            - Set `fileset` to a file set that cannot contain files outside the `root` ${toString root}. This could change the files included in the result.''
+            - Set `fileset` to a file set that cannot contain files outside the `root` (${toString root}). This could change the files included in the result.''
     else
-      builtins.seq filter
+      builtins.seq sourceFilter
       cleanSourceWith {
         name = "source";
         src = root;
-        inherit filter;
+        filter = sourceFilter;
       };
 
   /*
@@ -209,8 +213,8 @@ If a directory does not recursively contain any file, it is omitted from the sto
     # This argument can also be a path,
     # which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
     fileset2:
-    let
-      filesets = _coerceMany "lib.fileset.union" [
+    _unionMany
+      (_coerceMany "lib.fileset.union" [
         {
           context = "first argument";
           value = fileset1;
@@ -219,9 +223,7 @@ If a directory does not recursively contain any file, it is omitted from the sto
           context = "second argument";
           value = fileset2;
         }
-      ];
-    in
-    _unionMany filesets;
+      ]);
 
   /*
     The file set containing all files that are in any of the given file sets.
@@ -260,25 +262,20 @@ If a directory does not recursively contain any file, it is omitted from the sto
     # The elements can also be paths,
     # which get [implicitly coerced to file sets](#sec-fileset-path-coercion).
     filesets:
-    let
-      # We cannot rename matched attribute arguments, so let's work around it with an extra `let in` statement
-      maybeFilesets = filesets;
-    in
-    let
-      # Annotate the elements with context, used by _coerceMany for better errors
-      annotated = imap0 (i: el: {
-        context = "element ${toString i} of the argument";
-        value = el;
-      }) maybeFilesets;
-
-      filesets = _coerceMany "lib.fileset.unions" annotated;
-    in
-    if ! isList maybeFilesets then
-      throw "lib.fileset.unions: Expected argument to be a list, but got a ${typeOf maybeFilesets}."
-    else if maybeFilesets == [ ] then
-      # TODO: This could be supported, but requires an extra internal representation for the empty file set
+    if ! isList filesets then
+      throw "lib.fileset.unions: Expected argument to be a list, but got a ${typeOf filesets}."
+    else if filesets == [ ] then
+      # TODO: This could be supported, but requires an extra internal representation for the empty file set, which would be special for not having a base path.
       throw "lib.fileset.unions: Expected argument to be a list with at least one element, but it contains no elements."
     else
-      _unionMany filesets;
+      pipe filesets [
+        # Annotate the elements with context, used by _coerceMany for better errors
+        (imap0 (i: el: {
+          context = "element ${toString i}";
+          value = el;
+        }))
+        (_coerceMany "lib.fileset.unions")
+        _unionMany
+      ];
 
 }
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 3462b510b367f..2c329edb390d6 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -135,14 +135,14 @@ rec {
     else if ! isPath value then
       if isStringLike value then
         throw ''
-          ${context} "${toString value}" is a string-like value, but it should be a path instead.
+          ${context} ("${toString value}") is a string-like value, but it should be a path instead.
               Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
         throw ''
           ${context} is of type ${typeOf value}, but it should be a path instead.''
     else if ! pathExists value then
       throw ''
-        ${context} ${toString value} does not exist.''
+        ${context} (${toString value}) does not exist.''
     else
       _singleton value;
 
@@ -341,9 +341,6 @@ rec {
       # The common base path assembled from a filesystem root and the common components
       commonBase = append first._internalBaseRoot (join commonBaseComponents);
 
-      # The number of path components common to all base paths
-      commonBaseComponentsCount = length commonBaseComponents;
-
       # A list of filesetTree's that all have the same base path
       # This is achieved by nesting the trees into the components they have over the common base path
       # E.g. `union /foo/bar /foo/baz` has the base path /foo
@@ -352,7 +349,7 @@ rec {
       # Therefore allowing combined operations over them.
       trees = map (fileset:
         setAttrByPath
-          (drop commonBaseComponentsCount fileset._internalBaseComponents)
+          (drop (length commonBaseComponents) fileset._internalBaseComponents)
           fileset._internalTree
         ) filesets;
 
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 7d38aaa7f41df..0ea96859e7a34 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -236,7 +236,7 @@ checkFileset() (
 #### Error messages #####
 
 # Absolute paths in strings cannot be passed as `root`
-expectFailure 'toSource { root = "/nix/store/foobar"; fileset = ./.; }' 'lib.fileset.toSource: `root` "/nix/store/foobar" is a string-like value, but it should be a path instead.
+expectFailure 'toSource { root = "/nix/store/foobar"; fileset = ./.; }' 'lib.fileset.toSource: `root` \("/nix/store/foobar"\) is a string-like value, but it should be a path instead.
 \s*Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.'
 
 # Only paths are accepted as `root`
@@ -246,18 +246,18 @@ expectFailure 'toSource { root = 10; fileset = ./.; }' 'lib.fileset.toSource: `r
 mkdir -p {foo,bar}/mock-root
 expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/mock-splitRoot.nix>)).fileset;
   toSource { root = ./foo/mock-root; fileset = ./bar/mock-root; }
-' 'lib.fileset.toSource: Filesystem roots are not the same for `fileset` and `root` "'"$work"'/foo/mock-root":
+' 'lib.fileset.toSource: Filesystem roots are not the same for `fileset` and `root` \("'"$work"'/foo/mock-root"\):
 \s*`root`: root "'"$work"'/foo/mock-root"
 \s*`fileset`: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
 rm -rf *
 
 # `root` needs to exist
-expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `root` '"$work"'/a does not exist.'
+expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) does not exist.'
 
 # `root` needs to be a file
 touch a
-expectFailure 'toSource { root = ./a; fileset = ./a; }' 'lib.fileset.toSource: `root` '"$work"'/a is a file, but it should be a directory instead. Potential solutions:
+expectFailure 'toSource { root = ./a; fileset = ./a; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) is a file, but it should be a directory instead. Potential solutions:
 \s*- If you want to import the file into the store _without_ a containing directory, use string interpolation or `builtins.path` instead of this function.
 \s*- If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as '"$work"', and set `fileset` to the file path.'
 rm -rf *
@@ -267,18 +267,18 @@ expectFailure 'toSource { root = ./.; fileset = abort "This should be evaluated"
 
 # Only paths under `root` should be able to influence the result
 mkdir a
-expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `fileset` could contain files in '"$work"', which is not under the `root` '"$work"'/a. Potential solutions:
+expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `fileset` could contain files in '"$work"', which is not under the `root` \('"$work"'/a\). Potential solutions:
 \s*- Set `root` to '"$work"' or any directory higher up. This changes the layout of the resulting store path.
-\s*- Set `fileset` to a file set that cannot contain files outside the `root` '"$work"'/a. This could change the files included in the result.'
+\s*- Set `fileset` to a file set that cannot contain files outside the `root` \('"$work"'/a\). This could change the files included in the result.'
 rm -rf *
 
 # Path coercion only works for paths
 expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a path instead.'
-expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.toSource: `fileset` "/some/path" is a string-like value, but it should be a path instead.
+expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.toSource: `fileset` \("/some/path"\) is a string-like value, but it should be a path instead.
 \s*Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.'
 
 # Path coercion errors for non-existent paths
-expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` '"$work"'/a does not exist.'
+expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` \('"$work"'/a\) does not exist.'
 
 # File sets cannot be evaluated directly
 expectFailure 'union ./. ./.' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
@@ -395,16 +395,16 @@ expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/
 expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/mock-splitRoot.nix>)).fileset;
   toSource { root = ./.; fileset = unions [ ./foo/mock-root ./bar/mock-root ]; }
 ' 'lib.fileset.unions: Filesystem roots are not the same:
-\s*element 0 of the argument: root "'"$work"'/foo/mock-root"
-\s*element 1 of the argument: root "'"$work"'/bar/mock-root"
+\s*element 0: root "'"$work"'/foo/mock-root"
+\s*element 1: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
 rm -rf *
 
 # Coercion errors show the correct context
-expectFailure 'toSource { root = ./.; fileset = union ./a ./.; }' 'lib.fileset.union: first argument '"$work"'/a does not exist.'
-expectFailure 'toSource { root = ./.; fileset = union ./. ./b; }' 'lib.fileset.union: second argument '"$work"'/b does not exist.'
-expectFailure 'toSource { root = ./.; fileset = unions [ ./a ./. ]; }' 'lib.fileset.unions: element 0 of the argument '"$work"'/a does not exist.'
-expectFailure 'toSource { root = ./.; fileset = unions [ ./. ./b ]; }' 'lib.fileset.unions: element 1 of the argument '"$work"'/b does not exist.'
+expectFailure 'toSource { root = ./.; fileset = union ./a ./.; }' 'lib.fileset.union: first argument \('"$work"'/a\) does not exist.'
+expectFailure 'toSource { root = ./.; fileset = union ./. ./b; }' 'lib.fileset.union: second argument \('"$work"'/b\) does not exist.'
+expectFailure 'toSource { root = ./.; fileset = unions [ ./a ./. ]; }' 'lib.fileset.unions: element 0 \('"$work"'/a\) does not exist.'
+expectFailure 'toSource { root = ./.; fileset = unions [ ./. ./b ]; }' 'lib.fileset.unions: element 1 \('"$work"'/b\) does not exist.'
 
 # unions needs a list with at least 1 element
 expectFailure 'toSource { root = ./.; fileset = unions null; }' 'lib.fileset.unions: Expected argument to be a list, but got a null.'

From d29fd527ea311b6c009719f43708b1a06f9b6ae4 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 21 Sep 2023 00:22:16 +0200
Subject: [PATCH 56/84] heptagon: refactor

---
 .../compilers/heptagon/default.nix            | 28 +++++++++++--------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/compilers/heptagon/default.nix b/pkgs/development/compilers/heptagon/default.nix
index e7a9360a64675..7f9c1c849f4a5 100644
--- a/pkgs/development/compilers/heptagon/default.nix
+++ b/pkgs/development/compilers/heptagon/default.nix
@@ -5,31 +5,34 @@
 , ocamlPackages
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "heptagon";
   version = "1.05.00";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
     owner = "synchrone";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-b4O48MQT3Neh8a1Z5wRgS701w6XrwpsbSMprlqTT+CE=";
+    repo = "heptagon";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-b4O48MQT3Neh8a1Z5wRgS701w6XrwpsbSMprlqTT+CE=";
   };
 
-  nativeBuildInputs = [
+  strictDeps = true;
+
+  nativeBuildInputs = with ocamlPackages; [
+    camlp4
+    findlib
     makeWrapper
+    menhir
+    ocaml
+    ocamlbuild
   ];
 
   buildInputs = with ocamlPackages; [
-    ocaml
-    findlib
-    menhir
-    menhirLib
-    ocamlgraph
     camlp4
-    ocamlbuild
     lablgtk
+    menhirLib
+    ocamlgraph
   ];
 
   # the heptagon library in lib/heptagon is not executable
@@ -48,5 +51,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ wegank ];
     mainProgram = "heptc";
+    platforms = platforms.unix;
   };
-}
+})

From 5179f98fc787f988b91e0ac6a8670593d25d1cd3 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 20 Sep 2023 18:43:39 -0400
Subject: [PATCH 57/84] cargo-nextest: 0.9.57 -> 0.9.58

Diff: https://github.com/nextest-rs/nextest/compare/cargo-nextest-0.9.57...cargo-nextest-0.9.58

Changelog: https://nexte.st/CHANGELOG.html
---
 pkgs/development/tools/rust/cargo-nextest/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-nextest/default.nix b/pkgs/development/tools/rust/cargo-nextest/default.nix
index c8dea37daf06c..c4e87e9d670a2 100644
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.57";
+  version = "0.9.58";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-vtKe0cl9PxZgc1zUJQI1YCQm4cRHmzqlBEC4RGUxM44=";
+    hash = "sha256-D3mSDh6IliKbtxitMRXy1L4YH/qZfdXtXiPvf45mTno=";
   };
 
-  cargoHash = "sha256-o7nuDoBpSst84jyAVfrE8pLoYcKMF922r39G+gruBUo=";
+  cargoHash = "sha256-TjQHSaBVM4pJoTp6Vdz6WGWIyw5uC6UG7Wle6LsXP+4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 

From bc969e6d8e4022ac51e85e76c9d0e81662baa854 Mon Sep 17 00:00:00 2001
From: Jerry Starke <42114389+JerrySM64@users.noreply.github.com>
Date: Thu, 21 Sep 2023 01:30:18 +0200
Subject: [PATCH 58/84] linuxKernel.kernels.linux_zen: 6.5.3-zen1 -> 6.5.4-zen1

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 28e0158394fbf..e8c5ecaf3ce78 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,9 +4,9 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.5.3"; #zen
+    version = "6.5.4"; #zen
     suffix = "zen1"; #zen
-    sha256 = "0jc50cb30dzysqdhm91ykcg5xhy062dc69gwak6q33bn56n7dw3m"; #zen
+    sha256 = "1s0a2706xk60k9w6dr3zx2ma8bsny1dkvv0fmsk3kd8ghyg3xswh"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx

From b40e3d6c2dfaa9b43588d521e8ef498192118b48 Mon Sep 17 00:00:00 2001
From: Jerry Starke <42114389+JerrySM64@users.noreply.github.com>
Date: Thu, 21 Sep 2023 01:31:40 +0200
Subject: [PATCH 59/84] linuxKernel.kernels.linux_lqx: 6.4.15-lqx1 ->
 6.5.4-lqx2

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index e8c5ecaf3ce78..ff54d8cfec09a 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -11,9 +11,9 @@ let
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.4.15"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "1xhm73z074niz1dd0w24q5lxlpma6xraqil5kzp3j4qsyr5wg8hz"; #lqx
+    version = "6.5.4"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "0zz7jn2fic7llppv4ih91jfz0k0q6c04xsyqljhiw6279dsv8h7c"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {

From 8a77757b7ebfcf0958951a096f005ab919d6567f Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 21 Sep 2023 04:09:34 +0300
Subject: [PATCH 60/84] writers.writeCBin: fix binary name when cross-compiling

`$name` contains cross-compilation info `bin/wrapped-argv0-aarch64-unknown-linux-gnu`

name should not be set directly.
---
 pkgs/build-support/trivial-builders/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index c4f2cfd754cd8..8b8732af0656a 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -379,21 +379,21 @@ rec {
     };
 
   # Create a C binary
-  writeCBin = name: code:
-    runCommandCC name
+  writeCBin = pname: code:
+    runCommandCC pname
     {
-      inherit name code;
+      inherit pname code;
       executable = true;
       passAsFile = ["code"];
       # Pointless to do this on a remote machine.
       preferLocalBuild = true;
       allowSubstitutes = false;
       meta = {
-        mainProgram = name;
+        mainProgram = pname;
       };
     }
     ''
-      n=$out/bin/$name
+      n=$out/bin/${pname}
       mkdir -p "$(dirname "$n")"
       mv "$codePath" code.c
       $CC -x c code.c -o "$n"

From 37cd85b2e46291b4e6ed31d19e0a8e37f5ce6f6d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 21 Sep 2023 08:35:53 +0200
Subject: [PATCH 61/84] python311Packages.botocore-stubs: 1.31.50 -> 1.31.52

---
 pkgs/development/python-modules/botocore-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 81340edb03dca..7a74a0b5964b2 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.31.50";
+  version = "1.31.52";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-sLqNn6YnyOBse3bFyRzQseUpBCgF2rhsprR2dBYiUds=";
+    hash = "sha256-L6m3jHozWpTZGAeXc9wxmHht50FYYYfYR6hxC5wzcAk=";
   };
 
   nativeBuildInputs = [

From 5c3a366f0c49278394e0e30b39e1cbb117a29cbf Mon Sep 17 00:00:00 2001
From: IogaMaster <iogamastercode@gmail.com>
Date: Wed, 20 Sep 2023 21:13:00 -0600
Subject: [PATCH 62/84] Make postman and beekeeper compatible with
 NIXOS_OZONE_WL

---
 .../development/tools/database/beekeeper-studio/default.nix | 6 +++++-
 pkgs/development/web/postman/linux.nix                      | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/database/beekeeper-studio/default.nix b/pkgs/development/tools/database/beekeeper-studio/default.nix
index be53f57cac61f..fdc01addcc3c4 100644
--- a/pkgs/development/tools/database/beekeeper-studio/default.nix
+++ b/pkgs/development/tools/database/beekeeper-studio/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, pkgs }:
+{ lib, fetchurl, appimageTools, pkgs, makeWrapper }:
 
 let
   pname = "beekeeper-studio";
@@ -23,11 +23,15 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     ln -s $out/bin/${name} $out/bin/${pname}
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/${pname} \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
     install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop
     install -m 444 -D ${appimageContents}/${pname}.png \
       $out/share/icons/hicolor/512x512/apps/${pname}.png
     substituteInPlace $out/share/applications/${pname}.desktop \
       --replace 'Exec=AppRun' 'Exec=${pname}'
+
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/web/postman/linux.nix b/pkgs/development/web/postman/linux.nix
index 6ba2182e462bf..6a242531edb87 100644
--- a/pkgs/development/web/postman/linux.nix
+++ b/pkgs/development/web/postman/linux.nix
@@ -41,6 +41,7 @@
 , version
 , meta
 , copyDesktopItems
+, makeWrapper
 }:
 
 let
@@ -129,6 +130,10 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     ln -s $out/share/postman/postman $out/bin/postman
 
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/${pname} \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
     mkdir -p $out/share/icons/hicolor/128x128/apps
     ln -s $out/share/postman/resources/app/assets/icon.png $out/share/icons/postman.png
     ln -s $out/share/postman/resources/app/assets/icon.png $out/share/icons/hicolor/128x128/apps/postman.png

From 8ec182e5704dfdbc6540d281e2a3bac38e4fa836 Mon Sep 17 00:00:00 2001
From: hexchen <hexchen@lilwit.ch>
Date: Thu, 21 Sep 2023 00:43:13 +0000
Subject: [PATCH 63/84] nixos/prometheus: fix blackbox exporter

---
 .../services/monitoring/prometheus/exporters/blackbox.nix       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
index 66eaed51d2ead..407bff1d62dea 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
@@ -21,7 +21,7 @@ let
       throw
       "${logPrefix}: configuration file must not reside within /tmp - it won't be visible to the systemd service."
     else
-      true;
+      file;
   checkConfig = file:
     pkgs.runCommand "checked-blackbox-exporter.conf" {
       preferLocalBuild = true;

From 0ee55af2ec95b87332c9b803b8869766e2f63a01 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 21 Sep 2023 09:29:46 +0200
Subject: [PATCH 64/84] python311Packages.scrapy: disable failing test

---
 pkgs/development/python-modules/scrapy/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 03b660fcc3141..7bfa428efaef5 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -109,6 +109,8 @@ buildPythonPackage rec {
     "test_peek_one_element"
     "test_peek_lifo"
     "test_callback_kwargs"
+    # Test fails on Hydra
+    "test_start_requests_laziness"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_xmliter_encoding"
     "test_download"

From 3b6bbfa609b44e6673a1dea40baaeefafe90ee1e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 21 Sep 2023 09:43:10 +0200
Subject: [PATCH 65/84] python311Packages.dvc-data: 2.16.1 -> 2.16.3

Diff: https://github.com/iterative/dvc-data/compare/refs/tags/2.16.1...2.16.3

Changelog: https://github.com/iterative/dvc-data/releases/tag/2.16.3
---
 pkgs/development/python-modules/dvc-data/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 65ad409aaee36..004fceaaa8a10 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.16.1";
+  version = "2.16.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hnKOSo/RUzGnj7JbdKOGogVN925LZQiL3uvy5+dQfPw=";
+    hash = "sha256-cuUxVDc//O0FjPyBgXh8gBkCHSqfHELtTLT4VAu4HSA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 8dcd2545ab40875dc0a8e7aa41d2229479fb946c Mon Sep 17 00:00:00 2001
From: Jon Seager <jon@sgrs.uk>
Date: Thu, 21 Sep 2023 09:14:07 +0100
Subject: [PATCH 66/84] homepage-dashboard: 0.6.29 -> 0.6.35

---
 pkgs/servers/homepage-dashboard/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index 280f3349e733a..d9ea056f9f83c 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage rec {
   pname = "homepage-dashboard";
-  version = "0.6.29";
+  version = "0.6.35";
 
   src = fetchFromGitHub {
     owner = "benphelps";
     repo = "homepage";
     rev = "v${version}";
-    hash = "sha256-v2DpF96prpavvhf5Qq2//sskJVNMgGTWltRi/+85KDM=";
+    hash = "sha256-+mn90kN/YyjVnVjuvVNpsXsDYVCRmke5Rz0hmQ54VjA=";
   };
 
-  npmDepsHash = "sha256-3sjMWQ40FqdTfx1QkMoIwpIGWRQKPOqOKfPVDWzjz3w=";
+  npmDepsHash = "sha256-vzht2nmyUxIphvrgBHzELh97k1Q1XzmAXfiVCDEnRNU=";
 
   preBuild = ''
     mkdir -p config

From 812b1f2955400970332f1058050588288b78d675 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Sun, 27 Aug 2023 19:47:55 +0200
Subject: [PATCH 67/84] linuxPackages.evdi: 1.13.1 -> 1.14.1

https://github.com/DisplayLink/evdi/compare/v1.13.1...v1.14.1
---
 .../linux/evdi/0000-fix-drm-path.patch        | 31 -------------------
 pkgs/os-specific/linux/evdi/default.nix       | 10 +++---
 2 files changed, 4 insertions(+), 37 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch

diff --git a/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch b/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch
deleted file mode 100644
index a389b73185ddc..0000000000000
--- a/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/module/Makefile b/module/Makefile
-index fe573de..c8022c8 100644
---- a/module/Makefile
-+++ b/module/Makefile
-@@ -50,7 +50,7 @@ ifneq ($(KERNELRELEASE),)
- # inside kbuild
- # Note: this can be removed once it is in kernel tree and Kconfig is properly used
- CONFIG_DRM_EVDI := m
--ccflags-y := -isystem include/uapi/drm include/drm $(CFLAGS) $(EL8FLAG) $(EL9FLAG) $(RPIFLAG)
-+ccflags-y := -isystem include/uapi/drm $(CFLAGS) $(EL8FLAG) $(EL9FLAG) $(RPIFLAG)
- evdi-y := evdi_platform_drv.o evdi_platform_dev.o evdi_sysfs.o evdi_modeset.o evdi_connector.o evdi_encoder.o evdi_drm_drv.o evdi_fb.o evdi_gem.o evdi_painter.o evdi_params.o evdi_cursor.o evdi_debug.o evdi_i2c.o
- evdi-$(CONFIG_COMPAT) += evdi_ioc32.o
- obj-$(CONFIG_DRM_EVDI) := evdi.o
-diff --git a/module/evdi_drm.h b/module/evdi_drm.h
-index 29b8427..5012693 100644
---- a/module/evdi_drm.h
-+++ b/module/evdi_drm.h
-@@ -12,12 +12,11 @@
- 
- #ifdef __KERNEL__
- #include <linux/types.h>
-+#include <drm/drm.h>
- #else
- #include <stdint.h>
- #endif
- 
--#include "drm.h"
--
- /* Output events sent from driver to evdi lib */
- #define DRM_EVDI_EVENT_UPDATE_READY  0x80000000
- #define DRM_EVDI_EVENT_DPMS          0x80000001
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 71ab8bea79e00..ebb6fbe2cc6be 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchFromGitHub, kernel, libdrm, python3 }:
+
 let
   python3WithLibs = python3.withPackages (ps: with ps; [
     pybind11
@@ -6,13 +7,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "evdi";
-  version = "1.13.1";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Or4hhnFOtC8vmB4kFUHbFHn2wg/NsUMY3d2Tiea6YbY=";
+    hash = "sha256-em3Y56saB7K3Wr31Y0boc38xGb57gdveN0Cstgy8y20=";
   };
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
@@ -35,11 +36,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [
-    ./0000-fix-drm-path.patch
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${version}";
     description = "Extensible Virtual Display Interface";
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;

From 89052d98aa294912afdac99d3de02549c9a86b67 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Sun, 27 Aug 2023 19:39:52 +0200
Subject: [PATCH 68/84] displaylink: 5.7.0-61.129 -> 5.8.0-63.33

https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.8
---
 pkgs/os-specific/linux/displaylink/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index a6f0adc5df30f..5df8e92b13afa 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -9,6 +9,7 @@
 , requireFile
 , substituteAll
 }:
+
 let
   arch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
@@ -20,22 +21,22 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "5.7.0-61.129";
+  version = "5.8.0-63.33";
 
   src = requireFile rec {
-    name = "displaylink-570.zip";
-    sha256 = "807f1c203ac1e71c6f1f826493b9bb32e277f07cb2cf48537bf8cfdc68dd1515";
+    name = "displaylink-580.zip";
+    sha256 = "05m8vm6i9pc9pmvar021lw3ls60inlmq92nling0vj28skm55i92";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.7
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.8
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.7-EXE.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.8-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };
@@ -74,5 +75,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ abbradar ];
     platforms = [ "x86_64-linux" "i686-linux" ];
     hydraPlatforms = [];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 }

From daf602d9fcd3380801320fde6e17396b954c5881 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Thu, 21 Sep 2023 10:12:03 +0200
Subject: [PATCH 69/84] displaylink: add passthru.tests.displaylink

---
 pkgs/os-specific/linux/displaylink/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index 5df8e92b13afa..463795936e728 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -8,6 +8,7 @@
 , makeWrapper
 , requireFile
 , substituteAll
+, nixosTests
 }:
 
 let
@@ -68,6 +69,12 @@ stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 
+  passthru = {
+    tests = {
+      inherit (nixosTests) displaylink;
+    };
+  };
+
   meta = with lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
     homepage = "https://www.displaylink.com/";

From e19d87d2ec8a6606b3cf2ceaea5553aac4aadc2c Mon Sep 17 00:00:00 2001
From: Martino Fontana <tinozzo123@gmail.com>
Date: Sun, 13 Aug 2023 12:33:44 +0200
Subject: [PATCH 70/84] bottles: fix GStreamer on 32 bit apps Because of the
 gst_all_1 input, 64 bit GStreamer was sneaking into the 32 bit libs.

Basically:
```nix
{ buildFHSEnv
, gst_all_1 # Because of this input...
}:
buildFHSEnv {
  multiPkgs = pkgs: with pkgs; {
    # This is both 32 bit and 64 bit
    hello

    # ...this is target arch only (bcause the `with pkgs;` doesn't apply in this case)
    gst_all_1.gst-plugins-base
  };
}
```

This commit removes the `gst_all_1` input to correct that.

Also removes setting `GST_PLUGIN_PATH`, as it doesn't seem necessary anymore.
(That env is the reason why I added the `gst_all_1` input and accidentally causing the issue in the first place. Ugh...)

Closes #207641.
---
 pkgs/applications/misc/bottles/fhsenv.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/applications/misc/bottles/fhsenv.nix b/pkgs/applications/misc/bottles/fhsenv.nix
index 969a2d8178efa..730b65e4c3db0 100644
--- a/pkgs/applications/misc/bottles/fhsenv.nix
+++ b/pkgs/applications/misc/bottles/fhsenv.nix
@@ -1,7 +1,6 @@
 { buildFHSEnv
 , symlinkJoin
 , bottles-unwrapped
-, gst_all_1
 , extraPkgs ? pkgs: [ ]
 , extraLibraries ? pkgs: [ ]
 }:
@@ -92,10 +91,6 @@ let fhsEnv = {
       zlib # Freetype
     ] ++ xorgDeps pkgs
     ++ extraLibraries pkgs;
-
-  profile = ''
-    export GST_PLUGIN_PATH=/usr/lib32/gstreamer-1.0:/usr/lib64/gstreamer-1.0
-  '';
 };
 in
 symlinkJoin {

From dd2277f8b23bae087fbef069b83befd93b2d2df0 Mon Sep 17 00:00:00 2001
From: Martino Fontana <tinozzo123@gmail.com>
Date: Thu, 21 Sep 2023 10:07:26 +0200
Subject: [PATCH 71/84] bottles: move GStreamer deps in a separate variable

---
 pkgs/applications/misc/bottles/fhsenv.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/misc/bottles/fhsenv.nix b/pkgs/applications/misc/bottles/fhsenv.nix
index 730b65e4c3db0..fd0d38f69892e 100644
--- a/pkgs/applications/misc/bottles/fhsenv.nix
+++ b/pkgs/applications/misc/bottles/fhsenv.nix
@@ -36,6 +36,14 @@ let fhsEnv = {
         libXv
         libXxf86vm
       ];
+      gstreamerDeps = pkgs: with pkgs.gst_all_1; [
+        gstreamer
+        gst-plugins-base
+        gst-plugins-good
+        gst-plugins-ugly
+        gst-plugins-bad
+        gst-libav
+      ];
     in
     pkgs: with pkgs; [
       # https://wiki.winehq.org/Building_Wine
@@ -48,12 +56,6 @@ let fhsEnv = {
       gnutls
       libglvnd
       gsm
-      gst_all_1.gstreamer
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-      gst_all_1.gst-plugins-ugly
-      gst_all_1.gst-plugins-bad
-      gst_all_1.gst-libav
       libgphoto2
       libjpeg_turbo
       libkrb5
@@ -90,6 +92,7 @@ let fhsEnv = {
       p11-kit
       zlib # Freetype
     ] ++ xorgDeps pkgs
+    ++ gstreamerDeps pkgs
     ++ extraLibraries pkgs;
 };
 in

From 8ace65ff3d7696b7a03ea9583b39df27b3153984 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 21 Sep 2023 11:31:17 +0300
Subject: [PATCH 72/84] treewide: use finalAttrs in all packages I maintain
 (#255902)

* mpd-touch-screen-gui: use finalAttrs in mkDerivation; reformat

* musescore: use finalAttrs in mkDerivation

* syncthingtray: use stdenv.mkDerivation with a function; reformat

* ocrfeeder: use finalAttrs in mkDerivation; reformat

* castget: use finalAttrs in mkDerivation

* gnome-network-displays: use finalAttrs in mkDerivation

* mailreaders: use finalAttrs in mkDerivation

* mswatch: use finalAttrs in mkDerivation

* uhd: use finalAttrs in mkDerivation

* maxima: use finalAttrs in mkDerivation

* qalculate-gtk: use finalAttrs in mkDerivation

* qalculate-qt: use finalAttrs in mkDerivation

* wxmaxima: use finalAttrs in mkDerivation

* lammps: use finalAttrs in mkDerivation

* mlterm: use finalAttrs in mkDerivation

* video-trimmer: use finalAttrs in mkDerivation

* nerdfonts: use finalAttrs in mkDerivation

* gnomeExtensions.easyScreenCast: use finalAttrs in mkDerivation

* octave: use finalAttrs in mkDerivation; reformat

* comedilib: use finalAttrs in mkDerivation

* cpp-utilities: use finalAttrs in mkDerivation

* libsForQt5.kpeoplevcard: use finalAttrs in mkDerivation; reformat

* liberio: use finalAttrs in mkDerivation

* libqalculate: use finalAttrs in mkDerivation; reformat

* libwtk-sdl2: use finalAttrs in mkDerivation

* libsForQt5.pulseaudio-qt: use finalAttrs in mkDerivation; reformat

* qrupdate: use finalAttrs in mkDerivation; reformat

* libsForQt5.qtforkawesome: use finalAttrs in mkDerivation; reformat

* libsForQt5.qtutilities: use finalAttrs in mkDerivation; reformat

* sqlitecpp: use finalAttrs in mkDerivation; reformat

* tweeny: use finalAttrs in mkDerivation

* volk: use finalAttrs in mkDerivation

* wiringpi: use finalAttrs in mkDerivation

* snzip: use finalAttrs in mkDerivation; reformat

* bpm-tools: use finalAttrs in mkDerivation; reformat

* sacd: use finalAttrs in mkDerivation

* gtk-gnutella: use finalAttrs in mkDerivation; reformat

* sile: use finalAttrs in mkDerivation

* pplatex: use finalAttrs in mkDerivation; reformat
---
 .../audio/mpd-touch-screen-gui/default.nix    |   8 +-
 pkgs/applications/audio/musescore/default.nix |   6 +-
 .../graphics/ocrfeeder/default.nix            |  20 +--
 .../misc/syncthingtray/default.nix            |  10 +-
 .../feedreaders/castget/default.nix           |   6 +-
 .../gnome-network-displays/default.nix        |   6 +-
 .../networking/mailreaders/imapfilter.nix     |   6 +-
 .../mailreaders/mswatch/default.nix           |   4 +-
 pkgs/applications/radio/uhd/default.nix       |  13 +-
 .../science/math/maxima/default.nix           |  12 +-
 .../science/math/qalculate-gtk/default.nix    |   6 +-
 .../science/math/qalculate-qt/default.nix     |   6 +-
 .../science/math/wxmaxima/default.nix         |   6 +-
 .../molecular-dynamics/lammps/default.nix     |   6 +-
 .../terminal-emulators/mlterm/default.nix     |   8 +-
 .../video/video-trimmer/default.nix           |  12 +-
 pkgs/data/fonts/nerdfonts/default.nix         |   4 +-
 .../extensions/EasyScreenCast/default.nix     |   6 +-
 .../interpreters/octave/default.nix           | 126 ++++++++----------
 .../libraries/comedilib/default.nix           |   6 +-
 .../libraries/cpp-utilities/default.nix       |   8 +-
 .../libraries/kpeoplevcard/default.nix        |  14 +-
 .../development/libraries/liberio/default.nix |   4 +-
 .../libraries/libqalculate/default.nix        |  51 +++++--
 .../libraries/libwtk-sdl2/default.nix         |   6 +-
 .../libraries/pulseaudio-qt/default.nix       |  22 +--
 .../libraries/qrupdate/default.nix            |  10 +-
 .../libraries/qtforkawesome/default.nix       |  25 ++--
 .../libraries/qtutilities/default.nix         |  26 ++--
 .../libraries/sqlitecpp/default.nix           |  25 +++-
 pkgs/development/libraries/tweeny/default.nix |   6 +-
 pkgs/development/libraries/volk/2.5.0.nix     |   8 +-
 pkgs/development/libraries/volk/default.nix   |   8 +-
 pkgs/os-specific/linux/wiringpi/default.nix   |   4 +-
 pkgs/tools/archivers/snzip/default.nix        |  20 ++-
 pkgs/tools/audio/bpm-tools/default.nix        |  10 +-
 pkgs/tools/cd-dvd/sacd/default.nix            |   9 +-
 .../networking/p2p/gtk-gnutella/default.nix   |  28 ++--
 pkgs/tools/typesetting/sile/default.nix       |  17 +--
 .../tools/typesetting/tex/pplatex/default.nix |  21 ++-
 pkgs/top-level/all-packages.nix               |  10 +-
 41 files changed, 331 insertions(+), 278 deletions(-)

diff --git a/pkgs/applications/audio/mpd-touch-screen-gui/default.nix b/pkgs/applications/audio/mpd-touch-screen-gui/default.nix
index 482fe8f66f4c9..ce00cb2bd03e7 100644
--- a/pkgs/applications/audio/mpd-touch-screen-gui/default.nix
+++ b/pkgs/applications/audio/mpd-touch-screen-gui/default.nix
@@ -1,8 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
 , pkg-config
+, autoreconfHook
 , SDL2
 , SDL2_ttf
 , SDL2_image
@@ -14,13 +14,13 @@
 , dejavu_fonts
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mpd-touch-screen-gui";
   version = "unstable-2022-12-30";
 
   src = fetchFromGitHub {
     owner = "muesli4";
-    repo = pname;
+    repo = "mpd-touch-screen-gui";
     rev = "156eaebede89da2b83a98d8f9dfa46af12282fb4";
     sha256 = "sha256-vr/St4BghrndjUQ0nZI/uJq+F/MjEj6ulc4DYwQ/pgU=";
   };
@@ -60,4 +60,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index 6c5b772521136..d42117e1babe7 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -46,14 +46,14 @@ let
       Carbon
     ;
   } else portaudio;
-in stdenv'.mkDerivation rec {
+in stdenv'.mkDerivation (finalAttrs: {
   pname = "musescore";
   version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-jXievVIA0tqLdKLy6oPaOHPIbDoFstveEQBri9M0Aoo=";
   };
   patches = [
@@ -168,4 +168,4 @@ in stdenv'.mkDerivation rec {
     broken = (stdenv.isLinux && stdenv.isAarch64);
     mainProgram = "mscore";
   };
-}
+})
diff --git a/pkgs/applications/graphics/ocrfeeder/default.nix b/pkgs/applications/graphics/ocrfeeder/default.nix
index 1c473d2c41f66..25df4c69c66c0 100644
--- a/pkgs/applications/graphics/ocrfeeder/default.nix
+++ b/pkgs/applications/graphics/ocrfeeder/default.nix
@@ -1,27 +1,27 @@
 { lib, stdenv
 , fetchurl
 , pkg-config
-, gtk3
-, gtkspell3
-, isocodes
-, goocanvas2
+, wrapGAppsHook
 , intltool
 , itstool
 , libxml2
+, gobject-introspection
+, gtk3
+, goocanvas2
+, gtkspell3
+, isocodes
 , gnome
 , python3
-, gobject-introspection
-, wrapGAppsHook
 , tesseract4
 , extraOcrEngines ? [] # other supported engines are: ocrad gocr cuneiform
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocrfeeder";
   version = "0.8.5";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/${finalAttrs.pname}/${lib.versions.majorMinor finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     sha256 = "sha256-sD0qWUndguJzTw0uy0FIqupFf4OX6dTFvcd+Mz+8Su0=";
   };
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   ] ++ extraOcrEngines);
 
   preFixup = ''
-    gappsWrapperArgs+=(--prefix PATH : "${enginesPath}")
+    gappsWrapperArgs+=(--prefix PATH : "${finalAttrs.enginesPath}")
     gappsWrapperArgs+=(--set ISO_CODES_DIR "${isocodes}/share/xml/iso-codes")
   '';
 
@@ -70,4 +70,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 627f099796389..c464fddcc7022 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -11,6 +11,7 @@
 , qtutilities
 , qtforkawesome
 , boost
+, wrapQtAppsHook
 , cmake
 , kio
 , plasma-framework
@@ -29,14 +30,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 , autostartExecPath ? "syncthingtray"
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "1.4.6";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-/HAqO0eVFt4YLGeTbZSZcH2pOojvykukAGTBHZTfKLQ=";
   };
 
@@ -54,6 +55,7 @@ mkDerivation rec {
   ;
 
   nativeBuildInputs = [
+    wrapQtAppsHook
     cmake
     qttools
   ]
@@ -64,7 +66,7 @@ mkDerivation rec {
   # Don't test on Darwin because output is .app
   doInstallCheck = !stdenv.isDarwin;
   installCheckPhase = ''
-    $out/bin/syncthingtray --help | grep ${version}
+    $out/bin/syncthingtray --help | grep ${finalAttrs.version}
   '';
 
   cmakeFlags = [
@@ -85,4 +87,4 @@ mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/applications/networking/feedreaders/castget/default.nix b/pkgs/applications/networking/feedreaders/castget/default.nix
index e79a387e07f57..86bb8f3042ec1 100644
--- a/pkgs/applications/networking/feedreaders/castget/default.nix
+++ b/pkgs/applications/networking/feedreaders/castget/default.nix
@@ -10,12 +10,12 @@
 , glibcLocales
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "castget";
   version = "2.0.1";
 
   src = fetchurl {
-    url = "http://savannah.nongnu.org/download/castget/castget-${version}.tar.bz2";
+    url = "http://savannah.nongnu.org/download/castget/castget-${finalAttrs.version}.tar.bz2";
     hash = "sha256-Q4tffsfjGkXtN1ZjD+RH9CAVrNpT7AkgL0hihya16HU=";
   };
 
@@ -51,4 +51,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/networking/gnome-network-displays/default.nix b/pkgs/applications/networking/gnome-network-displays/default.nix
index f2f26a85f61f9..b9722b6989ff1 100644
--- a/pkgs/applications/networking/gnome-network-displays/default.nix
+++ b/pkgs/applications/networking/gnome-network-displays/default.nix
@@ -20,12 +20,12 @@
 , pipewire
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-network-displays";
   version = "0.90.5";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/${finalAttrs.pname}/${lib.versions.majorMinor finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     sha256 = "sha256-2SBVQK4fJeK8Y2UrrL0g5vQIerDdGE1nhFc6ke4oIpI=";
   };
 
@@ -77,4 +77,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/networking/mailreaders/imapfilter.nix b/pkgs/applications/networking/mailreaders/imapfilter.nix
index d0072a00c5a61..3a9e2db3ecd88 100644
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, openssl, lua, pcre2 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "imapfilter";
   version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "lefcha";
     repo = "imapfilter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-nHKZ3skRbDhKWocaw5mbaRnZC37FxFIVd08iFgrEA0s=";
   };
   makeFlags = [
@@ -24,4 +24,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ doronbehar ];
   };
-}
+})
diff --git a/pkgs/applications/networking/mailreaders/mswatch/default.nix b/pkgs/applications/networking/mailreaders/mswatch/default.nix
index 2706b9c4597f2..f7ba4bb1bf126 100644
--- a/pkgs/applications/networking/mailreaders/mswatch/default.nix
+++ b/pkgs/applications/networking/mailreaders/mswatch/default.nix
@@ -8,7 +8,7 @@
 , glib
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mswatch";
   # Stable release won't compile successfully
   version = "unstable-2018-11-21";
@@ -35,4 +35,4 @@ stdenv.mkDerivation {
     platforms = platforms.linux;
     maintainers = with maintainers; [ doronbehar ];
   };
-}
+})
diff --git a/pkgs/applications/radio/uhd/default.nix b/pkgs/applications/radio/uhd/default.nix
index 873c49dd9a7c8..23c0a7285868c 100644
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@@ -41,7 +41,7 @@ let
   );
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "uhd";
   # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
   # and xxx.yyy.zzz. Hrmpf... style keeps changing
@@ -52,14 +52,15 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "EttusResearch";
     repo = "uhd";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-khVOHlvacZc4EMg4m55rxEqPvLY1xURpAfOW905/3jg=";
   };
   # Firmware images are downloaded (pre-built) from the respective release on Github
   uhdImagesSrc = fetchurl {
-    url = "https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz";
+    url = "https://github.com/EttusResearch/uhd/releases/download/v${finalAttrs.version}/uhd-images_${finalAttrs.version}.tar.xz";
     sha256 = "V8ldW8bvYWbrDAvpWpHcMeLf9YvF8PIruDAyNK/bru4=";
   };
+  # TODO: Add passthru.updateScript that will update both of the above hashes...
 
   cmakeFlags = [
     "-DENABLE_LIBUHD=ON"
@@ -105,7 +106,7 @@ stdenv.mkDerivation rec {
     # pythonEnv for runtime as well. The utilities' runtime dependencies are
     # handled at the environment
     ++ optionals (enableExamples) [ ncurses ncurses.dev ]
-    ++ optionals (enablePythonApi || enableUtils) [ pythonEnv ]
+    ++ optionals (enablePythonApi || enableUtils) [ finalAttrs.pythonEnv ]
     ++ optionals (enableDpdk) [ dpdk ]
   ;
 
@@ -128,7 +129,7 @@ stdenv.mkDerivation rec {
   # UHD expects images in `$CMAKE_INSTALL_PREFIX/share/uhd/images`
   installFirmware = ''
     mkdir -p "$out/share/uhd/images"
-    tar --strip-components=1 -xvf "${uhdImagesSrc}" -C "$out/share/uhd/images"
+    tar --strip-components=1 -xvf "${finalAttrs.uhdImagesSrc}" -C "$out/share/uhd/images"
   '';
 
   # -DENABLE_TESTS=ON installs the tests, we don't need them in the output
@@ -157,4 +158,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ bjornfor fpletz tomberek doronbehar ];
   };
-}
+})
diff --git a/pkgs/applications/science/math/maxima/default.nix b/pkgs/applications/science/math/maxima/default.nix
index c102c645b3bf9..e7ac178cd5d13 100644
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@@ -18,12 +18,12 @@ let
   searchPath = lib.makeBinPath
     (lib.filter (x: x != null) [ lisp-compiler rlwrap tk gnuplot ]);
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maxima";
   version = "5.46.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://sourceforge/${finalAttrs.pname}/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-c5Dwa0jaZckDPosvYpuXi5AFZFSlQCLbfecOIiWqiwc=";
   };
 
@@ -52,11 +52,11 @@ stdenv.mkDerivation rec {
     done
     # Move emacs modules and documentation into the right place.
     mkdir -p $out/share/emacs $out/share/doc
-    ln -s ../maxima/${version}/emacs $out/share/emacs/site-lisp
-    ln -s ../maxima/${version}/doc $out/share/doc/maxima
+    ln -s ../maxima/${finalAttrs.version}/emacs $out/share/emacs/site-lisp
+    ln -s ../maxima/${finalAttrs.version}/doc $out/share/doc/maxima
   ''
    + (lib.optionalString (lisp-compiler.pname == "ecl") ''
-     cp src/binary-ecl/maxima.fas* "$out/lib/maxima/${version}/binary-ecl/"
+     cp src/binary-ecl/maxima.fas* "$out/lib/maxima/${finalAttrs.version}/binary-ecl/"
    '')
   ;
 
@@ -115,4 +115,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/science/math/qalculate-gtk/default.nix b/pkgs/applications/science/math/qalculate-gtk/default.nix
index 405561510be0e..f245e8745b4a0 100644
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, intltool, autoreconfHook, pkg-config, libqalculate, gtk3, curl, wrapGAppsHook }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-gtk";
   version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-gtk";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-GYy3Ot2vjXpCp89Rib3Ua0XeVGOOTejKcaqNZvPmxm0=";
   };
 
@@ -24,4 +24,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/applications/science/math/qalculate-qt/default.nix b/pkgs/applications/science/math/qalculate-qt/default.nix
index be9dd27695f7e..34d2d98171eb5 100644
--- a/pkgs/applications/science/math/qalculate-qt/default.nix
+++ b/pkgs/applications/science/math/qalculate-qt/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, intltool, pkg-config, qmake, wrapQtAppsHook, libqalculate, qtbase, qttools, qtsvg, qtwayland }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-qt";
   version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-qt";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-7VlaoiY+HgHCMZCegUdy2wpgfx3fKaViMtkdNRleHaA=";
   };
 
@@ -33,4 +33,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/science/math/wxmaxima/default.nix b/pkgs/applications/science/math/wxmaxima/default.nix
index ee2f62317c0cd..c475dbd5ef2b6 100644
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@@ -10,14 +10,14 @@
 , glib
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs:{
   pname = "wxmaxima";
   version = "23.02.1";
 
   src = fetchFromGitHub {
     owner = "wxMaxima-developers";
     repo = "wxmaxima";
-    rev = "Version-${version}";
+    rev = "Version-${finalAttrs.version}";
     sha256 = "sha256-Lrj/oJNmKlCkNbnCGY2TewCospwajKdWgmKkreHzEIU=";
   };
 
@@ -51,4 +51,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/science/molecular-dynamics/lammps/default.nix b/pkgs/applications/science/molecular-dynamics/lammps/default.nix
index 580dbb6796800..f11e9bdeeb13e 100644
--- a/pkgs/applications/science/molecular-dynamics/lammps/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/lammps/default.nix
@@ -43,7 +43,7 @@
 , extraBuildInputs ? []
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   # LAMMPS has weird versioning converted to ISO 8601 format
   version = "2Aug2023";
   pname = "lammps";
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "lammps";
     repo = "lammps";
-    rev = "stable_${version}";
+    rev = "stable_${finalAttrs.version}";
     hash = "sha256-6T4YAa4iN3pJpODGPW+faR16xxyYYdkHLavtiPUbZ4o=";
   };
   preConfigure = ''
@@ -117,4 +117,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.costrouc maintainers.doronbehar ];
     mainProgram = "lmp";
   };
-}
+})
diff --git a/pkgs/applications/terminal-emulators/mlterm/default.nix b/pkgs/applications/terminal-emulators/mlterm/default.nix
index dce5ad9d063a7..3614046f6846c 100644
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@@ -96,14 +96,14 @@ let
   in
     lib.withFeatureAs (commaSepList != "") featureName commaSepList
   ;
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: {
   pname = "mlterm";
   version = "3.9.3";
 
   src = fetchFromGitHub {
     owner = "arakiken";
-    repo = pname;
-    rev = version;
+    repo = "mlterm";
+    rev = finalAttrs.version;
     sha256 = "sha256-gfs5cdwUUwSBWwJJSaxrQGWJvLkI27RMlk5QvDALEDg=";
   };
 
@@ -217,4 +217,4 @@ in stdenv.mkDerivation rec {
     platforms = platforms.all;
     mainProgram = desktopBinary;
   };
-}
+})
diff --git a/pkgs/applications/video/video-trimmer/default.nix b/pkgs/applications/video/video-trimmer/default.nix
index a0ca4b5b19064..d61f30de1be57 100644
--- a/pkgs/applications/video/video-trimmer/default.nix
+++ b/pkgs/applications/video/video-trimmer/default.nix
@@ -16,21 +16,21 @@
 , ffmpeg-full
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "video-trimmer";
   version = "0.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "YaLTeR";
-    repo = pname;
-    rev = "v${version}";
+    repo = "video-trimmer";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-nr0PAvp4wlswQBNN2LLyYQMpk3IIleHf3+978XhUGGQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
     hash = "sha256-YFbLMpQbHUtxRrBVarcoIeDsvc26NWc1YhMeCaLgJAc=";
   };
 
@@ -74,4 +74,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/data/fonts/nerdfonts/default.nix b/pkgs/data/fonts/nerdfonts/default.nix
index 123e5cb18abe6..b2576d0fca468 100644
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@@ -37,7 +37,7 @@ let
   ) selectedFontsShas;
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   inherit version;
   inherit srcs;
   pname = "nerdfonts";
@@ -69,4 +69,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     hydraPlatforms = []; # 'Output limit exceeded' on Hydra
   };
-}
+})
diff --git a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
index 342f03d618ad4..51c3c83609572 100644
--- a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
+++ b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, substituteAll, glib, gnome, gettext, jq, intltool }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extension-EasyScreenCast";
   version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "EasyScreenCast";
     repo = "EasyScreenCast";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-+cH/gczCdxoSrLp5nD82Spo8bSGyRnUUut3Xkmr9f3o=";
   };
 
@@ -34,4 +34,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     broken = true;
   };
-}
+})
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index b257933e0d63a..c8441cbae1fb8 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -1,9 +1,6 @@
 { stdenv
 , pkgs
 , lib
-# Note: either stdenv.mkDerivation or, for octaveFull, the qt-5 mkDerivation
-# with wrapQtAppsHook (comes from libsForQt5.callPackage)
-, mkDerivation
 , fetchurl
 , gfortran
 , ncurses
@@ -27,26 +24,25 @@
 , curl
 , rapidjson
 , blas, lapack
-# These two should use the same lapack and blas as the above
-, qrupdate, arpack, suitesparse ? null
+# These 3 should use the same lapack and blas as the above, see code prepending
+, qrupdate, arpack, suitesparse
 # If set to true, the above 5 deps are overridden to use the blas and lapack
 # with 64 bit indexes support. If all are not compatible, the build will fail.
 , use64BitIdx ? false
 , libwebp
 , gl2ps
-, ghostscript ? null
-, hdf5 ? null
-, glpk ? null
-, gnuplot ? null
+, ghostscript
+, hdf5
+, glpk
+, gnuplot
 # - Include support for GNU readline:
 , enableReadline ? true
-, readline ? null
+, readline
 # - Build Java interface:
 , enableJava ? true
-, jdk ? null
-, python ? null
-, overridePlatforms ? null
-, sundials ? null
+, jdk
+, python3
+, sundials
 # - Packages required for building extra packages.
 , newScope
 , callPackage
@@ -54,17 +50,13 @@
 , makeWrapper
 # - Build Octave Qt GUI:
 , enableQt ? false
-, qtbase ? null
-, qtsvg ? null
-, qtscript ? null
-, qscintilla ? null
-, qttools ? null
+, qt5
+, qscintilla
 , libiconv
 , darwin
 }:
 
 let
-
   # Not always evaluated
   blas' = if use64BitIdx then
     blas.override {
@@ -90,7 +82,7 @@ let
     blas = blas';
     lapack = lapack';
   };
-  # Not always suitesparse is required at all
+  # We keep the option to not enable suitesparse support by putting it null
   suitesparse' = if suitesparse != null then
     suitesparse.override {
       blas = blas';
@@ -99,24 +91,14 @@ let
   else
     null
   ;
-
-  octavePackages = import ../../../top-level/octave-packages.nix {
-    inherit pkgs;
-    inherit lib stdenv fetchurl newScope;
-    octave = self;
-  };
-
-  wrapOctave = callPackage ./wrap-octave.nix {
-    octave = self;
-    inherit (pkgs) makeSetupHook makeWrapper;
-  };
-
-  self = mkDerivation rec {
+  # To avoid confusion later in passthru
+  allPkgs = pkgs;
+in stdenv.mkDerivation (finalAttrs: {
     version = "8.3.0";
     pname = "octave";
 
     src = fetchurl {
-      url = "mirror://gnu/octave/${pname}-${version}.tar.gz";
+      url = "mirror://gnu/octave/octave-${finalAttrs.version}.tar.gz";
       sha256 = "sha256-K0gRHLZ7MSgX5dHz4XH1utFRK7Bn4WdLnEspKBiVuXo=";
     };
 
@@ -142,41 +124,35 @@ let
       arpack'
       libwebp
       gl2ps
-    ]
-    ++ lib.optionals enableQt [
-      qtbase
-      qtsvg
+      ghostscript
+      hdf5
+      glpk
+      suitesparse'
+      sundials
+      gnuplot
+      python3
+    ] ++ lib.optionals enableQt [
+      qt5.qtbase
+      qt5.qtsvg
       qscintilla
-    ]
-    ++ lib.optionals (ghostscript != null) [ ghostscript ]
-    ++ lib.optionals (hdf5 != null) [ hdf5 ]
-    ++ lib.optionals (glpk != null) [ glpk ]
-    ++ lib.optionals (suitesparse != null) [ suitesparse' ]
-    ++ lib.optionals (enableJava) [ jdk ]
-    ++ lib.optionals (sundials != null) [ sundials ]
-    ++ lib.optionals (gnuplot != null) [ gnuplot ]
-    ++ lib.optionals (python != null) [ python ]
-    ++ lib.optionals (!stdenv.isDarwin) [ libGL libGLU libX11 ]
-    ++ lib.optionals stdenv.isDarwin [
+    ] ++ lib.optionals (enableJava) [
+      jdk
+    ] ++ lib.optionals (!stdenv.isDarwin) [
+      libGL libGLU libX11
+    ] ++ lib.optionals stdenv.isDarwin [
       libiconv
       darwin.apple_sdk.frameworks.Accelerate
       darwin.apple_sdk.frameworks.Cocoa
-    ]
-    ;
+    ];
     nativeBuildInputs = [
       pkg-config
       gfortran
-      # Listed here as well because it's outputs are split
-      fftw
-      fftwSinglePrec
       texinfo
-    ]
-    ++ lib.optionals (sundials != null) [ sundials ]
-    ++ lib.optionals enableQt [
-      qtscript
-      qttools
-    ]
-    ;
+    ] ++ lib.optionals enableQt [
+      qt5.wrapQtAppsHook
+      qt5.qtscript
+      qt5.qttools
+    ];
 
     doCheck = !stdenv.isDarwin;
 
@@ -202,30 +178,39 @@ let
     # Keep a copy of the octave tests detailed results in the output
     # derivation, because someone may care
     postInstall = ''
-      cp test/fntests.log $out/share/octave/${pname}-${version}-fntests.log || true
+      cp test/fntests.log $out/share/octave/octave-${finalAttrs.version}-fntests.log || true
     '';
 
     passthru = rec {
-      sitePath = "share/octave/${version}/site";
+      sitePath = "share/octave/${finalAttrs.version}/site";
       octPkgsPath = "share/octave/octave_packages";
       blas = blas';
       lapack = lapack';
       qrupdate = qrupdate';
       arpack = arpack';
       suitesparse = suitesparse';
+      octavePackages = import ../../../top-level/octave-packages.nix {
+        pkgs = allPkgs;
+        inherit lib stdenv fetchurl newScope;
+        octave = finalAttrs.finalPackage;
+      };
+      wrapOctave = callPackage ./wrap-octave.nix {
+        octave = finalAttrs.finalPackage;
+        inherit (allPkgs) makeSetupHook makeWrapper;
+      };
       inherit fftw fftwSinglePrec;
       inherit portaudio;
       inherit jdk;
-      inherit python;
+      python = python3;
       inherit enableQt enableReadline enableJava;
       buildEnv = callPackage ./build-env.nix {
-        octave = self;
+        octave = finalAttrs.finalPackage;
         inherit octavePackages wrapOctave;
         inherit (octavePackages) computeRequiredOctavePackages;
       };
       withPackages = import ./with-packages.nix { inherit buildEnv octavePackages; };
       pkgs = octavePackages;
-      interpreter = "${self}/bin/octave";
+      interpreter = "${finalAttrs.finalPackage}/bin/octave";
     };
 
     meta = {
@@ -233,10 +218,5 @@ let
       license = lib.licenses.gpl3Plus;
       maintainers = with lib.maintainers; [ raskin doronbehar ];
       description = "Scientific Programming Language";
-      platforms = if overridePlatforms == null then
-        (lib.platforms.linux ++ lib.platforms.darwin)
-      else overridePlatforms;
     };
-  };
-
-in self
+  })
diff --git a/pkgs/development/libraries/comedilib/default.nix b/pkgs/development/libraries/comedilib/default.nix
index d59f4acd8dcce..ab97ac09a57ec 100644
--- a/pkgs/development/libraries/comedilib/default.nix
+++ b/pkgs/development/libraries/comedilib/default.nix
@@ -12,14 +12,14 @@
 , python3
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "comedilib";
   version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "Linux-Comedi";
     repo = "comedilib";
-    rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
+    rev = "r${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
     sha256 = "0kfs2dw62vjz8j7fgsxq6ky8r8kca726gyklbm6kljvgfh47lyfw";
   };
 
@@ -53,4 +53,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.doronbehar ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index c3731c0e7a759..debc2b7aebdc7 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -6,14 +6,14 @@
 , iconv
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cpp-utilities";
   version = "5.24.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
-    repo = pname;
-    rev = "v${version}";
+    repo = "cpp-utilities";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-krskfuoCRxYcAIDqrae4+yEABXXZ9Nv0BjBVwSMjC7g=";
   };
 
@@ -41,4 +41,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/development/libraries/kpeoplevcard/default.nix b/pkgs/development/libraries/kpeoplevcard/default.nix
index d2244a2523477..2ba786800fb32 100644
--- a/pkgs/development/libraries/kpeoplevcard/default.nix
+++ b/pkgs/development/libraries/kpeoplevcard/default.nix
@@ -1,20 +1,21 @@
-{ mkDerivation
+{ stdenv
 , lib
 , fetchurl
 , cmake
-, extra-cmake-modules
 , pkg-config
+, wrapQtAppsHook
+, extra-cmake-modules
 , kcoreaddons
 , kpeople
 , kcontacts
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kpeoplevcard";
   version = "0.1";
 
   src = fetchurl {
-    url = "https://download.kde.org/stable/${pname}/${version}/${pname}-${version}.tar.xz";
+    url = "https://download.kde.org/stable/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     sha256 = "1hv3fq5k0pps1wdvq9r1zjnr0nxf8qc3vwsnzh9jpvdy79ddzrcd";
   };
 
@@ -25,8 +26,9 @@ mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    pkg-config
     cmake
+    pkg-config
+    wrapQtAppsHook
     extra-cmake-modules
   ];
 
@@ -36,5 +38,5 @@ mkDerivation rec {
     license     = with licenses; [ lgpl2 ];
     maintainers = with maintainers; [ doronbehar ];
   };
-}
+})
 
diff --git a/pkgs/development/libraries/liberio/default.nix b/pkgs/development/libraries/liberio/default.nix
index 743455b836d5d..f7e4fa6e73299 100644
--- a/pkgs/development/libraries/liberio/default.nix
+++ b/pkgs/development/libraries/liberio/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "liberio";
   version = "unstable-2019-12-11";
 
@@ -35,4 +35,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.doronbehar ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/libqalculate/default.nix b/pkgs/development/libraries/libqalculate/default.nix
index a8826e4381eb3..893c7b4e3a1e4 100644
--- a/pkgs/development/libraries/libqalculate/default.nix
+++ b/pkgs/development/libraries/libqalculate/default.nix
@@ -1,28 +1,55 @@
-{ lib, stdenv, fetchFromGitHub
-, mpfr, gnuplot
+{ lib
+, stdenv
+, fetchFromGitHub
+, intltool
+, pkg-config
+, doxygen
+, autoreconfHook
+, buildPackages
+, curl
+, gettext
+, libiconv
 , readline
-, libxml2, curl
-, intltool, libiconv, icu, gettext
-, pkg-config, doxygen, autoreconfHook, buildPackages
+, libxml2
+, mpfr
+, icu
+, gnuplot
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libqalculate";
   version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-wONqqd8Ds10SvkUrj7Ps6BfqUNPE6hCnQrKDTEglVEQ=";
   };
 
   outputs = [ "out" "dev" "doc" ];
 
-  nativeBuildInputs = [ intltool pkg-config autoreconfHook doxygen ];
-  buildInputs = [ curl gettext libiconv readline ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  propagatedBuildInputs = [ libxml2 mpfr icu ];
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    autoreconfHook
+    doxygen
+  ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  buildInputs = [
+    curl
+    gettext
+    libiconv
+    readline
+  ];
+  propagatedBuildInputs = [
+    libxml2
+    mpfr
+    icu
+  ];
   enableParallelBuilding = true;
 
   preConfigure = ''
@@ -52,4 +79,4 @@ stdenv.mkDerivation rec {
     mainProgram = "qalc";
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/libwtk-sdl2/default.nix b/pkgs/development/libraries/libwtk-sdl2/default.nix
index 00c8ae675e7bc..bdfe404c547c2 100644
--- a/pkgs/development/libraries/libwtk-sdl2/default.nix
+++ b/pkgs/development/libraries/libwtk-sdl2/default.nix
@@ -9,13 +9,13 @@
 , SDL2_image
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libwtk-sdl2";
   version = "unstable-2023-02-28";
 
   src = fetchFromGitHub {
     owner = "muesli4";
-    repo = pname;
+    repo = "libwtk-sdl2";
     rev = "0504f8342c8c97d0c8b43d33751427c564ad8d44";
     sha256 = "sha256-NAjsDQ4/hklYRfa85uleOr50tmc6UJVo2xiDnEbmIxk=";
   };
@@ -48,4 +48,4 @@ stdenv.mkDerivation rec {
     */
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/pulseaudio-qt/default.nix b/pkgs/development/libraries/pulseaudio-qt/default.nix
index c1ba89f05842d..9605b5875ec30 100644
--- a/pkgs/development/libraries/pulseaudio-qt/default.nix
+++ b/pkgs/development/libraries/pulseaudio-qt/default.nix
@@ -1,29 +1,31 @@
-{ mkDerivation
+{ stdenv
 , lib
 , fetchurl
 , cmake
-, extra-cmake-modules
 , pkg-config
+, extra-cmake-modules
+, wrapQtAppsHook
 , pulseaudio
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pulseaudio-qt";
   version = "1.3.0";
 
   src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${pname}-${lib.versions.majorMinor version}.tar.xz";
+    url = "mirror://kde/stable/${finalAttrs.pname}/${finalAttrs.pname}-${lib.versions.majorMinor finalAttrs.version}.tar.xz";
     sha256 = "1i4yb0v1mmhih8c2i61hybg6q60qys3pc5wbjb7a0vwl1mihgsxw";
   };
 
-  buildInputs = [
-    pulseaudio
-  ];
-
   nativeBuildInputs = [
-    pkg-config
     cmake
+    pkg-config
     extra-cmake-modules
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    pulseaudio
   ];
 
   meta = with lib; {
@@ -32,4 +34,4 @@ mkDerivation rec {
     license     = with licenses; [ lgpl2 ];
     maintainers = with maintainers; [ doronbehar ];
   };
-}
+})
diff --git a/pkgs/development/libraries/qrupdate/default.nix b/pkgs/development/libraries/qrupdate/default.nix
index bc4263928078b..12531286d33d3 100644
--- a/pkgs/development/libraries/qrupdate/default.nix
+++ b/pkgs/development/libraries/qrupdate/default.nix
@@ -1,21 +1,21 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, gfortran
-, blas
 , cmake
 , lapack
 , which
+, gfortran
+, blas
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qrupdate";
   version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "mpimd-csc";
     repo = "qrupdate-ng";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-dHxLPrN00wwozagY2JyfZkD3sKUD2+BcnbjNgZepzFg=";
   };
 
@@ -49,4 +49,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/qtforkawesome/default.nix b/pkgs/development/libraries/qtforkawesome/default.nix
index 8fec60db13624..0841c0d457fd7 100644
--- a/pkgs/development/libraries/qtforkawesome/default.nix
+++ b/pkgs/development/libraries/qtforkawesome/default.nix
@@ -1,12 +1,12 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, cmake
+, qttools
+, perl
 , cpp-utilities
 , qtutilities
-, qttools
 , qtbase
-, cmake
-, perl
 }:
 
 let
@@ -16,28 +16,29 @@ let
     rev = "1.2.0";
     sha256 = "sha256-zG6/0dWjU7/y/oDZuSEv+54Mchng64LVyV8bluskYzc=";
   };
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: {
   pname = "qtforkawesome";
   version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
-    repo = pname;
-    rev = "v${version}";
+    repo = "qtforkawesome";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-9e2TCg3itYtHZSvzCoaiIZmgsCMIoebh6C/XWtKz/2Q=";
   };
 
-  buildInputs = [
-    qtbase
-    cpp-utilities
-    qtutilities
-  ];
   nativeBuildInputs = [
     cmake
     qttools
     perl
     perl.pkgs.YAML
   ];
+
+  buildInputs = [
+    qtbase
+    cpp-utilities
+    qtutilities
+  ];
   cmakeFlags = [
     # Current freetype used by NixOS users doesn't support the `.woff2` font
     # format, so we use ttf. See
@@ -55,5 +56,5 @@ in stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms   = platforms.linux ++ platforms.darwin;
   };
-}
+})
 
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index a629e8a2ac12d..de80fc0709d3a 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -1,27 +1,35 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, cpp-utilities
+, cmake
 , qttools
+, cpp-utilities
 , qtbase
-, cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qtutilities";
   version = "6.13.1";
 
   src = fetchFromGitHub {
     owner = "Martchus";
-    repo = pname;
-    rev = "v${version}";
+    repo = "qtutilities";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-ic1Xnle1fGZ5elf0yH0BF+3spAmIo9kP62WhXLmBVNc=";
   };
 
-  buildInputs = [ qtbase cpp-utilities ];
-  nativeBuildInputs = [ cmake qttools ];
+  nativeBuildInputs = [
+    cmake
+    qttools
+  ];
+  buildInputs = [
+    qtbase
+    cpp-utilities
+  ];
 
-  cmakeFlags = ["-DBUILD_SHARED_LIBS=ON"];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+  ];
 
   dontWrapQtApps = true;
 
@@ -32,4 +40,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms   = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/development/libraries/sqlitecpp/default.nix b/pkgs/development/libraries/sqlitecpp/default.nix
index 8c9e3cba5dfbe..e2c0b4ec35b97 100644
--- a/pkgs/development/libraries/sqlitecpp/default.nix
+++ b/pkgs/development/libraries/sqlitecpp/default.nix
@@ -1,18 +1,29 @@
-{ lib, stdenv, fetchFromGitHub, cmake, sqlite, gtest }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, sqlite
+, gtest
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sqlitecpp";
   version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "SRombauts";
-    repo = pname;
-    rev = version;
+    repo = "sqlitecpp";
+    rev = finalAttrs.version;
     sha256 = "sha256-8l1JRaE7w9vJ4bCSLGAk9zwYHDFeKkBi9pE5fUJfLRc=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ sqlite gtest ];
+  nativeBuildInputs = [
+    cmake
+  ];
+  buildInputs = [
+    sqlite
+    gtest
+  ];
   doCheck = true;
 
   cmakeFlags = [
@@ -27,4 +38,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     maintainers = [ maintainers.jbedo maintainers.doronbehar ];
   };
-}
+})
diff --git a/pkgs/development/libraries/tweeny/default.nix b/pkgs/development/libraries/tweeny/default.nix
index 0afc82321d8cf..257b966808d20 100644
--- a/pkgs/development/libraries/tweeny/default.nix
+++ b/pkgs/development/libraries/tweeny/default.nix
@@ -4,14 +4,14 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tweeny";
   version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "mobius3";
     repo = "tweeny";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-VmvOMK+FjYZXKH9kPUT2L7pmJMPSr5eXptCcoGWK+qo=";
   };
 
@@ -28,4 +28,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.doronbehar ];
     platforms = with platforms; darwin ++ linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/volk/2.5.0.nix b/pkgs/development/libraries/volk/2.5.0.nix
index 5ac88083aa663..35216cb7e31c2 100644
--- a/pkgs/development/libraries/volk/2.5.0.nix
+++ b/pkgs/development/libraries/volk/2.5.0.nix
@@ -8,7 +8,7 @@
 , fetchpatch
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
   # Version 2.5.1 seems to cause a build issue for aarch64-darwin, see:
   # https://github.com/NixOS/nixpkgs/pull/160152#issuecomment-1043380478A
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "gnuradio";
-    repo = pname;
-    rev = "v${version}";
+    repo = "volk";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-XvX6emv30bSB29EFm6aC+j8NGOxWqHCNv0Hxtdrq/jc=";
     fetchSubmodules = true;
   };
@@ -57,4 +57,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/volk/default.nix b/pkgs/development/libraries/volk/default.nix
index 7271a700e92db..02240ac1febff 100644
--- a/pkgs/development/libraries/volk/default.nix
+++ b/pkgs/development/libraries/volk/default.nix
@@ -8,14 +8,14 @@
 , removeReferencesTo
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
   version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "gnuradio";
-    repo = pname;
-    rev = "v${version}";
+    repo = "volk";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-kI4IuO6TLplo5lLAGIPWQWtePcjIEWB9XaJDA6WlqSg=";
     fetchSubmodules = true;
   };
@@ -55,4 +55,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/wiringpi/default.nix b/pkgs/os-specific/linux/wiringpi/default.nix
index e2412b37aab5c..bc80e2a33543b 100644
--- a/pkgs/os-specific/linux/wiringpi/default.nix
+++ b/pkgs/os-specific/linux/wiringpi/default.nix
@@ -15,7 +15,7 @@ let
     rev = version;
     sha256 = "sha256-VxAaPhaPXd9xYt663Ju6SLblqiSLizauhhuFqCqbO5M=";
   }
-  }: stdenv.mkDerivation rec {
+  }: stdenv.mkDerivation (finalAttrs: {
     pname = "wiringpi-${subprj}";
     inherit version src;
     sourceRoot = "${src.name}/${subprj}";
@@ -31,7 +31,7 @@ let
       # On NixOS we don't need to run ldconfig during build:
       "LDCONFIG=echo"
     ];
-  };
+  });
   passthru = {
     inherit mkSubProject;
     wiringPi = mkSubProject {
diff --git a/pkgs/tools/archivers/snzip/default.nix b/pkgs/tools/archivers/snzip/default.nix
index c759a7ac07f1e..6ae59143f3e95 100644
--- a/pkgs/tools/archivers/snzip/default.nix
+++ b/pkgs/tools/archivers/snzip/default.nix
@@ -1,24 +1,32 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , autoreconfHook
 , pkg-config
 , snappy
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "snzip";
   version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "kubo";
     repo = "snzip";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-trxCGVNw2MugE7kmth62Qrp7JZcHeP1gdTZk32c3hFg=";
   };
 
-  buildInputs = [ snappy ];
   # We don't use a release tarball so we don't have a `./configure` script to
   # run. That's why we generate it.
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    snappy
+  ];
 
   meta = with lib; {
     description = "A compression/decompression tool based on snappy";
@@ -27,5 +35,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     platforms = platforms.linux;
   };
-}
+})
 
diff --git a/pkgs/tools/audio/bpm-tools/default.nix b/pkgs/tools/audio/bpm-tools/default.nix
index 6e7236b1008df..e791c838422aa 100644
--- a/pkgs/tools/audio/bpm-tools/default.nix
+++ b/pkgs/tools/audio/bpm-tools/default.nix
@@ -12,16 +12,18 @@
 let
   path = lib.makeBinPath [ gnuplot sox flac id3v2 vorbis-tools ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bpm-tools";
   version = "0.3";
 
   src = fetchurl {
-    url = "http://www.pogo.org.uk/~mark/bpm-tools/releases/bpm-tools-${version}.tar.gz";
+    url = "http://www.pogo.org.uk/~mark/bpm-tools/releases/bpm-tools-${finalAttrs.version}.tar.gz";
     sha256 = "151vfbs8h3cibs7kbdps5pqrsxhpjv16y2iyfqbxzsclylgfivrp";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
 
   installFlags = [
     "PREFIX=${placeholder "out"}"
@@ -39,5 +41,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ doronbehar ];
   };
-}
+})
 
diff --git a/pkgs/tools/cd-dvd/sacd/default.nix b/pkgs/tools/cd-dvd/sacd/default.nix
index 23bf808c50fe6..963300c9ca110 100644
--- a/pkgs/tools/cd-dvd/sacd/default.nix
+++ b/pkgs/tools/cd-dvd/sacd/default.nix
@@ -1,16 +1,17 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sacd";
   version = "19.7.16.37";
 
   src = fetchFromGitHub {
     owner = "Sound-Linux-More";
     repo = "sacd";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "03s7jr75pzqj1xd41rkgbszlgf9zx6vzhd0nizc05wyf0fxq5xif";
   };
 
@@ -38,4 +39,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.doronbehar ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/tools/networking/p2p/gtk-gnutella/default.nix b/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
index 16eaf0d14e972..a9708dd4713c7 100644
--- a/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
+++ b/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
@@ -1,9 +1,10 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , bison
-, pkg-config
-, gettext
 , desktop-file-utils
+, gettext
+, pkg-config
 , glib
 , gtk2
 , libxml2
@@ -13,14 +14,14 @@
 , enableGui ? true
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtk-gnutella";
   version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "gtk-gnutella";
     repo = "gtk-gnutella";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-LbSUdU+a9G8qL7gCZVJQ6UQMATpOMtktY6FeOkUuaYI=";
   };
 
@@ -36,24 +37,23 @@ stdenv.mkDerivation rec {
     libbfd
     libxml2
     zlib
-  ]
-  ++
-    lib.optionals enableGui [ gtk2 ]
-  ;
+  ] ++ lib.optionals enableGui [
+    gtk2
+  ];
 
   configureScript = "./build.sh";
   configureFlags = [
     "--configure-only"
     # See https://sourceforge.net/p/gtk-gnutella/bugs/555/
     "--disable-malloc"
-  ]
-    ++ lib.optionals (!enableGui) [ "--topless" ]
-  ;
+  ] ++ lib.optionals (!enableGui) [
+    "--topless"
+  ];
 
   enableParallelBuilding = true;
 
   postInstall = ''
-    install -Dm0444 src/${pname}.man $out/share/man/man1/${pname}.1
+    install -Dm0444 src/gtk-gnutella.man $out/share/man/man1/gtk-gnutella.1
   '';
 
   meta = with lib; {
@@ -64,4 +64,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 22ac034c12251..7c436ac419b2f 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , darwin
 , fetchurl
 , makeWrapper
@@ -43,12 +44,12 @@ let
   ]);
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
   version = "0.14.11";
 
   src = fetchurl {
-    url = "https://github.com/sile-typesetter/sile/releases/download/v${version}/${pname}-${version}.tar.xz";
+    url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.xz";
     sha256 = "sha256-JXlgiK1XyZZSe5QXz06zwEAnVYhiIZhhIaBmfxAgRS4=";
   };
 
@@ -76,14 +77,14 @@ stdenv.mkDerivation rec {
     inherit luaEnv;
     # Copied from Makefile.am
     tests.test = lib.optionalAttrs (!(stdenv.isDarwin && stdenv.isAarch64)) (
-      runCommand "${pname}-test"
+      runCommand "sile-test"
         {
           nativeBuildInputs = [ poppler_utils sile ];
-          inherit FONTCONFIG_FILE;
+          inherit (finalAttrs) FONTCONFIG_FILE;
         } ''
         output=$(mktemp -t selfcheck-XXXXXX.pdf)
         echo "<sile>foo</sile>" | sile -o $output -
-        pdfinfo $output | grep "SILE v${version}" > $out
+        pdfinfo $output | grep "SILE v${finalAttrs.version}" > $out
       '');
   };
 
@@ -132,9 +133,9 @@ stdenv.mkDerivation rec {
       such as InDesign.
     '';
     homepage = "https://sile-typesetter.org";
-    changelog = "https://github.com/sile-typesetter/sile/raw/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/sile-typesetter/sile/raw/v${finalAttrs.version}/CHANGELOG.md";
     platforms = platforms.unix;
     maintainers = with maintainers; [ doronbehar alerque ];
     license = licenses.mit;
   };
-}
+})
diff --git a/pkgs/tools/typesetting/tex/pplatex/default.nix b/pkgs/tools/typesetting/tex/pplatex/default.nix
index 8e0c65bf346c6..89d08b43e845a 100644
--- a/pkgs/tools/typesetting/tex/pplatex/default.nix
+++ b/pkgs/tools/typesetting/tex/pplatex/default.nix
@@ -1,6 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, pcre }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, pcre
+}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pplatex";
   version = "unstable-2023-04-18";
 
@@ -11,9 +17,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-wPPJBn/UfmTWsD5JOg6po83Qn4qlpwgsPUV3iJzw5KU=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = [ pcre ];
+  buildInputs = [
+    pcre
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -29,4 +40,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.srgom maintainers.doronbehar ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3dabd1bcd6234..5fd8b501860eb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17985,14 +17985,10 @@ with pkgs;
 
   obb = callPackage ../development/interpreters/clojure/obb.nix { };
 
-  octave = callPackage ../development/interpreters/octave {
-    python = python3;
-    mkDerivation = stdenv.mkDerivation;
-  };
-  octaveFull = libsForQt5.callPackage ../development/interpreters/octave {
-    python = python3;
+  octave = callPackage ../development/interpreters/octave { };
+
+  octaveFull = octave.override {
     enableQt = true;
-    overridePlatforms = ["x86_64-linux" "x86_64-darwin"];
   };
 
   octave-kernel = callPackage ../applications/editors/jupyter-kernels/octave { };

From 702f067ff0c698ac9daf9d5ab63c6f8c0b2c1688 Mon Sep 17 00:00:00 2001
From: Niols <niols@niols.fr>
Date: Wed, 3 May 2023 11:56:49 +0000
Subject: [PATCH 73/84] licenses: add OCaml LGPL Linking Exception

---
 lib/licenses.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/licenses.nix b/lib/licenses.nix
index 599e8ee53c93a..02b89b00f3d0d 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -856,6 +856,11 @@ in mkLicense lset) ({
     free = false;
   };
 
+  ocamlLgplLinkingException = {
+    spdxId = "OCaml-LGPL-linking-exception";
+    fullName = "OCaml LGPL Linking Exception";
+  };
+
   ocamlpro_nc = {
     fullName = "OCamlPro Non Commercial license version 1";
     url = "https://alt-ergo.ocamlpro.com/http/alt-ergo-2.2.0/OCamlPro-Non-Commercial-License.pdf";

From 3b49077fbe5f783047edb21e8d69354d5a2a80c8 Mon Sep 17 00:00:00 2001
From: Niols <niols@niols.fr>
Date: Wed, 3 May 2023 11:42:24 +0000
Subject: [PATCH 74/84] ocamlPackages.opam-publish: init at 2.2.0

---
 .../tools/ocaml/opam-publish/default.nix      | 34 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/tools/ocaml/opam-publish/default.nix

diff --git a/pkgs/development/tools/ocaml/opam-publish/default.nix b/pkgs/development/tools/ocaml/opam-publish/default.nix
new file mode 100644
index 0000000000000..e5278068c8f10
--- /dev/null
+++ b/pkgs/development/tools/ocaml/opam-publish/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, ocamlPackages }:
+
+with ocamlPackages;
+
+buildDunePackage rec {
+  pname = "opam-publish";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "ocaml-opam";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-FNAWok5tjTOwwpNZ0Xcu9E/R8iXStZqCk/Vqdf9l+zs=";
+  };
+
+  duneVersion = "3";
+
+  buildInputs = [
+    cmdliner
+    lwt_ssl
+    opam-core
+    opam-format
+    opam-state
+    github
+    github-unix
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/ocaml-opam/${pname}";
+    description = "A tool to ease contributions to opam repositories";
+    license = with licenses; [ lgpl21Only ocamlLgplLinkingException ];
+    maintainers = with maintainers; [ niols ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5fd8b501860eb..7b119f9c0d8b2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6178,6 +6178,8 @@ with pkgs;
 
   ondir = callPackage ../tools/misc/ondir { };
 
+  opam-publish = callPackage ../development/tools/ocaml/opam-publish { };
+
   opencomposite = callPackage ../development/libraries/opencomposite { };
 
   opencomposite-helper = callPackage ../development/libraries/opencomposite/helper.nix { };

From 0de60535c958d6631744a1ad803b851b27e62128 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 15 Sep 2023 14:54:08 +0200
Subject: [PATCH 75/84] =?UTF-8?q?coqPackages.flocq:=204.1.1=20=E2=86=92=20?=
 =?UTF-8?q?4.1.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/coq-modules/flocq/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index 3ad6f6d478102..bf8155e928fec 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -7,11 +7,13 @@ mkCoqDerivation {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.14" "8.18"; out = "4.1.3"; }
     { case = range "8.14" "8.17"; out = "4.1.1"; }
     { case = range "8.14" "8.16"; out = "4.1.0"; }
     { case = range "8.7" "8.15"; out = "3.4.3"; }
     { case = range "8.5" "8.8"; out = "2.6.1"; }
   ] null;
+  release."4.1.3".sha256 = "sha256-os3cI885xNpxI+1p5rb8fSNnxKr7SFxqh83+3AM3t4I=";
   release."4.1.1".sha256 = "sha256-FbClxlV0ZaxITe7s9SlNbpeMNDJli+Dfh2TMrjaMtHo=";
   release."4.1.0".sha256 = "sha256:09rak9cha7q11yfqracbcq75mhmir84331h1218xcawza48rbjik";
   release."3.4.3".sha256 = "sha256-YTdWlEmFJjCcHkl47jSOgrGqdXoApJY4u618ofCaCZE=";

From 2abfae9e9b4afed840705484990575537fc586ed Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 15 Sep 2023 14:42:45 +0200
Subject: [PATCH 76/84] coq: 8.17.1 -> 8.18.0

---
 pkgs/applications/science/logic/coq/default.nix | 2 +-
 pkgs/top-level/all-packages.nix                 | 2 +-
 pkgs/top-level/coq-packages.nix                 | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 86111327f063f..fe8180899c0a4 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -55,7 +55,7 @@ let
    "8.16.1".sha256   = "sha256-n7830+zfZeyYHEOGdUo57bH6bb2/SZs8zv8xJhV+iAc=";
    "8.17.0".sha256   = "sha256-TGwm7S6+vkeZ8cidvp8pkiAd9tk008jvvPvYgfEOXhM=";
    "8.17.1".sha256   = "sha256-x+RwkbxMg9aR0L3WSCtpIz8jwA5cJA4tXAtHMZb20y4=";
-   "8.18+rc1".sha256   = "sha256-TmV0lzfzhpSnBoVyfTfVFUyBrXpUWSnyN1Le7b8IPTs=";
+   "8.18.0".sha256   = "sha256-WhiBs4nzPHQ0R24xAdM49kmxSCPOxiOVMA1iiMYunz4=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7b119f9c0d8b2..1f1c69ed1ebc7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15699,7 +15699,7 @@ with pkgs;
 
   comby = callPackage ../development/tools/comby { };
 
-  inherit (coqPackages) compcert;
+  inherit (coqPackages_8_17) compcert;
 
   computecpp-unwrapped = callPackage ../development/compilers/computecpp { };
   computecpp = wrapCCWith rec {
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 8280942d8b782..fe3eb9ebe85d2 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -197,7 +197,7 @@ in rec {
   coqPackages_8_16 = mkCoqPackages coq_8_16;
   coqPackages_8_17 = mkCoqPackages coq_8_17;
   coqPackages_8_18 = mkCoqPackages coq_8_18;
-  coqPackages = recurseIntoAttrs coqPackages_8_17;
+  coqPackages = recurseIntoAttrs coqPackages_8_18;
   coq = coqPackages.coq;
 
 }

From 7c33c8d4529c5f40237c39d83ea4a6e2b32d50a7 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 15 Sep 2023 16:38:17 +0200
Subject: [PATCH 77/84] coqPackages.itauto: enable for Coq 8.18

---
 pkgs/development/coq-modules/itauto/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/coq-modules/itauto/default.nix b/pkgs/development/coq-modules/itauto/default.nix
index 804fc8ee87e5b..23bde1b1506fe 100644
--- a/pkgs/development/coq-modules/itauto/default.nix
+++ b/pkgs/development/coq-modules/itauto/default.nix
@@ -5,6 +5,7 @@
   owner = "fbesson";
   domain = "gitlab.inria.fr";
 
+  release."8.18.0".sha256 = "sha256-4mDDnKTeYrf27uRMkydQxO7j2tfgTFXOREW474d40eo=";
   release."8.17.0".sha256 = "sha256-fgdnKchNT1Hyrq14gU8KWYnlSfg3qlsSw5A4+RoA26w=";
   release."8.16.0".sha256 = "sha256-4zAUYGlw/pBcLPv2GroIduIlvbfi1+Vy+TdY8KLCqO4=";
   release."8.15.0".sha256 = "sha256:10qpv4nx1p0wm9sas47yzsg9z22dhvizszfa21yff08a8fr0igya";
@@ -12,6 +13,7 @@
   release."8.13+no".sha256 = "sha256-gXoxtLcHPoyjJkt7WqvzfCMCQlh6kL2KtCGe3N6RC/A=";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = isEq "8.18"; out = "8.18.0"; }
     { case = isEq "8.17"; out = "8.17.0"; }
     { case = isEq "8.16"; out = "8.16.0"; }
     { case = isEq "8.15"; out = "8.15.0"; }
@@ -33,4 +35,7 @@
 }).overrideAttrs (o: lib.optionalAttrs
   (o.version == "dev" || lib.versionAtLeast o.version "8.16") {
     propagatedBuildInputs = [ coq.ocamlPackages.findlib ];
+} // lib.optionalAttrs
+  (o.version == "dev" || lib.versionAtLeast o.version "8.18") {
+    nativeBuildInputs = with coq.ocamlPackages; [ ocaml findlib dune_3 ];
 })

From 5742d5a8fdee5dd31035b9b497458f1eea931a5b Mon Sep 17 00:00:00 2001
From: Puck Meerburg <puck@puckipedia.com>
Date: Thu, 21 Sep 2023 09:14:44 +0000
Subject: [PATCH 78/84] perlPackages.SDL: import patch

---
 .../perl-modules/sdl-modern-perl.patch        | 64 +++++++++++++++++++
 pkgs/top-level/perl-packages.nix              |  5 +-
 2 files changed, 65 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/perl-modules/sdl-modern-perl.patch

diff --git a/pkgs/development/perl-modules/sdl-modern-perl.patch b/pkgs/development/perl-modules/sdl-modern-perl.patch
new file mode 100644
index 0000000000000..c97eeb034486e
--- /dev/null
+++ b/pkgs/development/perl-modules/sdl-modern-perl.patch
@@ -0,0 +1,64 @@
+From d734d03862d7dcc776bd2fa3ba662cdd5879b32e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Wed, 12 Jul 2023 17:55:27 +0200
+Subject: [PATCH] Adapt to perl 5.37.1
+
+Perl 5.37.1 removed a deprecated sv_nv() macro and SDL fails to build
+with Perl 5.38.0:
+
+lib/SDLx/Controller/Interface.xs:60:26: error: implicit declaration of function 'sv_nv'
+   60 |         out->dv_x      = sv_nv(temp);
+      |                          ^~~~~
+
+Users are advised to use SvNVx() macro instead. SvNVx() seems to have been
+available all the time (it predates a commit from 1993-10-07).
+
+This patch does that.
+
+https://github.com/PerlGameDev/SDL/issues/303
+---
+ src/SDLx/Controller/Interface.xs | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/SDLx/Controller/Interface.xs b/src/SDLx/Controller/Interface.xs
+index 3dc202b7..d326c885 100644
+--- a/src/SDLx/Controller/Interface.xs
++++ b/src/SDLx/Controller/Interface.xs
+@@ -57,15 +57,15 @@ void evaluate(SDLx_Interface *obj, SDLx_Derivative *out, SDLx_State *initial, fl
+ 
+ 	SV *temp;
+ 	temp           = av_pop(accel);
+-	out->dv_x      = sv_nv(temp);
++	out->dv_x      = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	temp           = av_pop(accel);
+-	out->dv_y      = sv_nv(temp);
++	out->dv_y      = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	temp           = av_pop(accel);
+-	out->dang_v    = sv_nv(temp);
++	out->dang_v    = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	SvREFCNT_dec((SV *)accel);
+@@ -90,15 +90,15 @@ void evaluate_dt(SDLx_Interface *obj, SDLx_Derivative *out, SDLx_State *initial,
+ 
+ 	SV *temp;
+ 	temp           = av_pop(accel);
+-	out->dv_x      = sv_nv(temp);
++	out->dv_x      = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	temp           = av_pop(accel);
+-	out->dv_y      = sv_nv(temp);
++	out->dv_y      = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	temp           = av_pop(accel);
+-	out->dang_v    = sv_nv(temp);
++	out->dang_v    = SvNVx(temp);
+ 	SvREFCNT_dec(temp);
+ 
+ 	SvREFCNT_dec((SV *)accel);
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 16e0d438deb46..b45f7aff1150b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -21444,10 +21444,7 @@ with self; {
     };
     patches = [
       # https://github.com/PerlGameDev/SDL/pull/304
-      (fetchpatch {
-        url = "https://github.com/PerlGameDev/SDL/commit/d734d03862d7dcc776bd2fa3ba662cdd5879b32e.patch";
-        hash = "sha256-YjtnAbJxCvx5QckiatZjD8v7dKefG3DCnXeLaNnEO8U=";
-      })
+      ../development/perl-modules/sdl-modern-perl.patch
     ];
     perlPreHook = "export LD=$CC";
     preCheck = "rm t/core_audiospec.t";

From 35892c0b590f1417f69a18c39a52d56c91ed1528 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 21 Sep 2023 10:23:54 +0200
Subject: [PATCH 79/84] ocamlPackages.lustre-v6: 6.107.3 -> 6.107.4

---
 pkgs/development/ocaml-modules/lustre-v6/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ocaml-modules/lustre-v6/default.nix b/pkgs/development/ocaml-modules/lustre-v6/default.nix
index 102977634c297..d4ecdc7e28812 100644
--- a/pkgs/development/ocaml-modules/lustre-v6/default.nix
+++ b/pkgs/development/ocaml-modules/lustre-v6/default.nix
@@ -2,14 +2,13 @@
 
 buildDunePackage rec {
   pname = "lustre-v6";
-  version = "6.107.3";
+  version = "6.107.4";
 
   minimalOCamlVersion = "4.12";
-  duneVersion = "3";
 
   src = fetchurl {
     url = "https://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/pool/lustre-v6.v${version}.tgz";
-    hash = "sha256-z3cljDyxtotCGUIdYEzYu7fQd04RC3hhWpROcMh6Zng=";
+    hash = "sha256-baT5ZJtg5oFoJ5eHb3ISsmY6G31UG10KlNXC+ta+M1c=";
   };
 
   propagatedBuildInputs = [

From c585510601a674bea989329e817a00962bc3ddc9 Mon Sep 17 00:00:00 2001
From: Maksym Balatsko <maksym.balatsko-ext@arista.com>
Date: Wed, 20 Sep 2023 23:48:18 -0700
Subject: [PATCH 80/84] seaborn-data: init at unstable-2023-01-26

---
 pkgs/tools/misc/seaborn-data/default.nix | 41 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix          |  2 ++
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/tools/misc/seaborn-data/default.nix

diff --git a/pkgs/tools/misc/seaborn-data/default.nix b/pkgs/tools/misc/seaborn-data/default.nix
new file mode 100644
index 0000000000000..2ff8c4d40a5c0
--- /dev/null
+++ b/pkgs/tools/misc/seaborn-data/default.nix
@@ -0,0 +1,41 @@
+{ lib, newScope, fetchFromGitHub, unzip, stdenvNoCC }:
+let
+  base = {
+    version = "unstable-2023-01-26";
+    dontBuild = true;
+    meta = with lib; {
+      description = "Data repository for seaborn examples.";
+      homepage = "https://github.com/mwaskom/seaborn-data";
+      platforms = platforms.all;
+      maintainers = with maintainers; [ mbalatsko ];
+    };
+  };
+  makeSeabornDataPackage = {pname, hash}:
+    let
+      src = fetchFromGitHub {
+        owner = "mwaskom";
+        repo = "seaborn-data";
+        rev = "2b29313169bf8dfa77d8dc930f7bd3eba559a906";
+        inherit hash;
+        sparseCheckout = [ "${pname}.csv" ];
+      };
+    in
+    stdenvNoCC.mkDerivation (base // {
+      inherit pname src;
+      version = base.version;
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        cp ${pname}.csv $out/${pname}.csv
+
+        runHook postInstall
+      '';
+    });
+in
+lib.makeScope newScope (self: {
+  exercise = makeSeabornDataPackage ({
+    pname = "exercise";
+    hash = "sha256-icoc2HkG303A8hCoW6kZxD5qhOKIpdxErLr288o04wE=";
+  });
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1f1c69ed1ebc7..66e04b69fb523 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6095,6 +6095,8 @@ with pkgs;
 
   nltk-data = callPackage ../tools/text/nltk_data { };
 
+  seaborn-data = callPackage ../tools/misc/seaborn-data { };
+
   nodepy-runtime = with python3.pkgs; toPythonApplication nodepy-runtime;
 
   nixpkgs-pytools = with python3.pkgs; toPythonApplication nixpkgs-pytools;

From 05e470828d4afc60431aca0d1f25192681ed2abf Mon Sep 17 00:00:00 2001
From: Maksym Balatsko <maksym.balatsko-ext@arista.com>
Date: Wed, 20 Sep 2023 23:48:28 -0700
Subject: [PATCH 81/84] python3Packages.scikit-posthocs: init at 0.7.0

---
 ...ased-abs-tolerance-for-wilcoxon-test.patch | 25 +++++++
 .../0002-Update-test_posthocs.py.patch        | 34 ++++++++++
 .../scikit-posthocs/default.nix               | 65 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 4 files changed, 126 insertions(+)
 create mode 100644 pkgs/development/python-modules/scikit-posthocs/0001-increased-abs-tolerance-for-wilcoxon-test.patch
 create mode 100644 pkgs/development/python-modules/scikit-posthocs/0002-Update-test_posthocs.py.patch
 create mode 100644 pkgs/development/python-modules/scikit-posthocs/default.nix

diff --git a/pkgs/development/python-modules/scikit-posthocs/0001-increased-abs-tolerance-for-wilcoxon-test.patch b/pkgs/development/python-modules/scikit-posthocs/0001-increased-abs-tolerance-for-wilcoxon-test.patch
new file mode 100644
index 0000000000000..e3fa524e5a4ff
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-posthocs/0001-increased-abs-tolerance-for-wilcoxon-test.patch
@@ -0,0 +1,25 @@
+From 02266a00ce0eb6a089e7efe07816da1aa5152fc9 Mon Sep 17 00:00:00 2001
+From: Maksim Terpilovskii <maximtrp@gmail.com>
+Date: Sun, 31 Jul 2022 12:25:14 +0300
+Subject: [PATCH] increased abs tolerance for wilcoxon test
+
+---
+ tests/test_posthocs.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/test_posthocs.py b/tests/test_posthocs.py
+index 956d808..8cc65e4 100644
+--- a/tests/test_posthocs.py
++++ b/tests/test_posthocs.py
+@@ -471,7 +471,7 @@ class TestPosthocs(unittest.TestCase):
+                               [2.857818e-06, 1.230888e-05, 1]])
+ 
+         results = sp.posthoc_wilcoxon(self.df.sort_index(), val_col = 'pulse', group_col = 'kind')
+-        self.assertTrue(np.allclose(results, r_results))
++        self.assertTrue(np.allclose(results, r_results, atol=1e-4))
+ 
+ 
+     def test_posthoc_scheffe(self):
+-- 
+2.36.1
+
diff --git a/pkgs/development/python-modules/scikit-posthocs/0002-Update-test_posthocs.py.patch b/pkgs/development/python-modules/scikit-posthocs/0002-Update-test_posthocs.py.patch
new file mode 100644
index 0000000000000..fa4d6d3ececff
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-posthocs/0002-Update-test_posthocs.py.patch
@@ -0,0 +1,34 @@
+From 5416ffba3ab01aebab3909400b5a9e847022898e Mon Sep 17 00:00:00 2001
+From: Maksim Terpilovskii <maximtrp@gmail.com>
+Date: Thu, 16 Mar 2023 00:20:02 +0300
+Subject: [PATCH] Update test_posthocs.py
+
+---
+ tests/test_posthocs.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/test_posthocs.py b/tests/test_posthocs.py
+index 8cc65e4..42ca5f3 100644
+--- a/tests/test_posthocs.py
++++ b/tests/test_posthocs.py
+@@ -71,7 +71,7 @@ class TestPosthocs(unittest.TestCase):
+         a = splt.sign_plot(x, flat=True, labels=False)
+         with self.assertRaises(ValueError):
+             splt.sign_plot(x.astype(float), flat=True, labels=False)
+-        self.assertTrue(isinstance(a, ma._subplots.Axes))
++        self.assertTrue(isinstance(a, ma._axes.Axes))
+ 
+     def test_sign_plot_nonflat(self):
+ 
+@@ -85,7 +85,7 @@ class TestPosthocs(unittest.TestCase):
+         with self.assertRaises(ValueError):
+             splt.sign_plot(x.astype(np.int64), labels=False)
+ 
+-        self.assertTrue(isinstance(a, ma._subplots.Axes) and isinstance(cbar, mpl.colorbar.ColorbarBase))
++        self.assertTrue(isinstance(a, ma._axes.Axes) and isinstance(cbar, mpl.colorbar.ColorbarBase))
+ 
+     # Outliers tests
+     def test_outliers_iqr(self):
+-- 
+2.36.1
+
diff --git a/pkgs/development/python-modules/scikit-posthocs/default.nix b/pkgs/development/python-modules/scikit-posthocs/default.nix
new file mode 100644
index 0000000000000..d7df6518903e0
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-posthocs/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, wheel
+, matplotlib
+, numpy
+, pandas
+, scipy
+, seaborn
+, statsmodels
+, pytestCheckHook
+, seaborn-data
+}:
+
+buildPythonPackage rec {
+  pname = "scikit-posthocs";
+  version = "0.7.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "maximtrp";
+    repo = "scikit-posthocs";
+    rev = "v${version}";
+    hash = "sha256-IkvAc684AWEK427OGAa4qVy6leWmd3b8Dnhd5bYAt5I=";
+  };
+
+  patches = [
+    # Fixed on master: https://github.com/maximtrp/scikit-posthocs/commit/02266a00ce0eb6a089e7efe07816da1aa5152fc9
+    ./0001-increased-abs-tolerance-for-wilcoxon-test.patch
+    # Fixed on master: https://github.com/maximtrp/scikit-posthocs/commit/5416ffba3ab01aebab3909400b5a9e847022898e
+    ./0002-Update-test_posthocs.py.patch
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    pandas
+    scipy
+    seaborn
+    statsmodels
+  ];
+
+  preCheck = ''
+    # tests require to write to home directory
+    export SEABORN_DATA=${seaborn-data.exercise}
+  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+  pythonImportsCheck = [ "scikit_posthocs" ];
+
+  meta = with lib; {
+    description = "Multiple Pairwise Comparisons (Post Hoc) Tests in Python";
+    homepage = "https://github.com/maximtrp/scikit-posthocs";
+    changelog = "https://github.com/maximtrp/scikit-posthocs/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 94dee18cd0deb..ff7569c7ca031 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11649,6 +11649,8 @@ self: super: with self; {
 
   scikit-optimize = callPackage ../development/python-modules/scikit-optimize { };
 
+  scikit-posthocs = callPackage ../development/python-modules/scikit-posthocs { };
+
   scikit-rf = callPackage ../development/python-modules/scikit-rf { };
 
   scikits-odes = callPackage ../development/python-modules/scikits-odes { };

From f35534ca8065e803cb3708f25eaaa7930bbf74ba Mon Sep 17 00:00:00 2001
From: Gabriel Simmer <g@gmem.ca>
Date: Wed, 20 Sep 2023 17:52:59 +0100
Subject: [PATCH 82/84] nushell: 0.84.0 -> 0.85.0

---
 pkgs/shells/nushell/default.nix            | 6 +++---
 pkgs/shells/nushell/nu_scripts/default.nix | 4 ++--
 pkgs/shells/nushell/plugins/formats.nix    | 4 ++--
 pkgs/shells/nushell/plugins/gstat.nix      | 4 ++--
 pkgs/shells/nushell/plugins/query.nix      | 4 ++--
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index d87d842be08c3..34b8f9504f8b3 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.84.0";
+  version = "0.85.0";
 in
 
 rustPlatform.buildRustPackage {
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage {
     owner = "nushell";
     repo = "nushell";
     rev = version;
-    hash = "sha256-vXtQUWKRPS53IBUgO9Dw8dVzfD5W2kHSPOZHs293O5Q=";
+    hash = "sha256-/c3JTgIT+T41D0S7irQ0jq2MDzmx3os4pYpVr10cL3E=";
   };
 
-  cargoHash = "sha256-NtTCuTWbGTrGKF7ulm3Bfal/WuBtPEX7QvHoOyKY1V8=";
+  cargoHash = "sha256-lBipwX72j0Af3PCat18s9NIjJiKZFZTcU9Utwt+eQzI=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]
diff --git a/pkgs/shells/nushell/nu_scripts/default.nix b/pkgs/shells/nushell/nu_scripts/default.nix
index 9170e8452460a..0abe1d4abfe92 100644
--- a/pkgs/shells/nushell/nu_scripts/default.nix
+++ b/pkgs/shells/nushell/nu_scripts/default.nix
@@ -11,8 +11,8 @@ stdenvNoCC.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "45c051dad0e243a63608c8274b7fddd5f0b74941";
-    hash = "sha256-kpE+vgobYsQuh8sS3gK/yg68nQykquwteeuecjLtIrE=";
+    rev = "36a45f28a39ee1526a748b53f438a41ae939fc7c";
+    hash = "sha256-QhERyWomyOOk9aYRjm69ykzOR3G/uGM/A4Pr9PlB71w=";
   };
 
   installPhase = ''
diff --git a/pkgs/shells/nushell/plugins/formats.nix b/pkgs/shells/nushell/plugins/formats.nix
index bc63789633a23..8c511782e3de0 100644
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@@ -12,9 +12,9 @@ let
 in
 rustPlatform.buildRustPackage {
   inherit pname;
-  version = "0.84.0";
+  version = "0.85.0";
   src = nushell.src;
-  cargoHash = "sha256-pwOdSJHd9njR0lr4n2EzCcqRonh0cbBHGZgAJ1l8FEk=";
+  cargoHash = "sha256-OKtktjBOujvljAX260TbC2sQWZOiGgU+sXsbYRhGPRM=";
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ IOKit Foundation ];
   cargoBuildFlags = [ "--package nu_plugin_formats" ];
diff --git a/pkgs/shells/nushell/plugins/gstat.nix b/pkgs/shells/nushell/plugins/gstat.nix
index 39af12a6a9350..f7e912a6fdc67 100644
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@@ -12,9 +12,9 @@ let
 in
 rustPlatform.buildRustPackage {
   inherit pname;
-  version = "0.84.0";
+  version = "0.85.0";
   src = nushell.src;
-  cargoHash = "sha256-RcwCYfIEV0+NbZ99uWaCOLqLap3wZ4qXIsc02fqkBSQ=";
+  cargoHash = "sha256-Fj70uKYzEKxeZeNrqlwM7ZFJ+K1tz10RqLndrdY40CE=";
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
   cargoBuildFlags = [ "--package nu_plugin_gstat" ];
diff --git a/pkgs/shells/nushell/plugins/query.nix b/pkgs/shells/nushell/plugins/query.nix
index 0988d4f80bb78..51db91bec2665 100644
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@@ -9,11 +9,11 @@
 
 rustPlatform.buildRustPackage {
   pname = "nushell_plugin_query";
-  version = "0.84.0";
+  version = "0.85.0";
 
   src = nushell.src;
 
-  cargoHash = "sha256-8uAoiurQpI++duheNqwEDw/0CIPE1dHcgL48hKWqNUg=";
+  cargoHash = "sha256-8iUqOdGWm2kDW72ptlCBIqqe4zjckN09MOQD77kCf5Y=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
 

From 55f434b1d4e370bb2d059fa865795b6f42fad8c8 Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Tue, 19 Sep 2023 14:26:57 -0300
Subject: [PATCH 83/84] snagboot: 1.1 -> 1.2

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/applications/misc/snagboot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/snagboot/default.nix b/pkgs/applications/misc/snagboot/default.nix
index 35ac8b28aa994..94c5a747492a4 100644
--- a/pkgs/applications/misc/snagboot/default.nix
+++ b/pkgs/applications/misc/snagboot/default.nix
@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snagboot";
-  version = "1.1";
+  version = "1.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "bootlin";
     repo = "snagboot";
     rev = "v${version}";
-    hash = "sha256-MU6LzjH6s2MS7T3u1OUeJ5ZmWgL0otA/q0ylwTNH4fA=";
+    hash = "sha256-OuHY5+2puZAERtwmXduUW5Wjus6KeQLJLcGcl48umLA=";
   };
 
   passthru = {

From 0ee02d5b428714ffd66fed882c691b6a83be4a5c Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Wed, 20 Sep 2023 08:34:58 -0300
Subject: [PATCH 84/84] snagboot: move passthru before meta

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/applications/misc/snagboot/default.nix | 26 ++++++++++-----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/applications/misc/snagboot/default.nix b/pkgs/applications/misc/snagboot/default.nix
index 94c5a747492a4..61c906ec464ac 100644
--- a/pkgs/applications/misc/snagboot/default.nix
+++ b/pkgs/applications/misc/snagboot/default.nix
@@ -20,19 +20,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-OuHY5+2puZAERtwmXduUW5Wjus6KeQLJLcGcl48umLA=";
   };
 
-  passthru = {
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-      ignoredVersions = ".(rc|beta).*";
-    };
-
-    tests.version = testers.testVersion {
-      package = snagboot;
-      command = "snagrecover --version";
-      version = "v${version}";
-    };
-  };
-
   nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
@@ -69,6 +56,19 @@ python3.pkgs.buildPythonApplication rec {
   # There are no tests
   doCheck = false;
 
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+      ignoredVersions = ".(rc|beta).*";
+    };
+
+    tests.version = testers.testVersion {
+      package = snagboot;
+      command = "snagrecover --version";
+      version = "v${version}";
+    };
+  };
+
   meta = {
     homepage = "https://github.com/bootlin/snagboot";
     description = "Generic recovery and reflashing tool for embedded platforms";