Merge remote-tracking branch 'origin/master' into staging-next

nixos/modules/services/continuous-integration/github-runner/service.nix

···
               else
                 args+=(--token "$token")
               fi
-              ${cfg.package}/bin/config.sh "''${args[@]}"
+              ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
               # Move the automatically created _diag dir to the logs dir
               mkdir -p  "$STATE_DIRECTORY/_diag"
               cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"

nixos/tests/all-tests.nix

···
   ghostunnel = handleTest ./ghostunnel.nix {};
   gitdaemon = handleTest ./gitdaemon.nix {};
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
+  github-runner = handleTest ./github-runner.nix {};
   gitlab = handleTest ./gitlab.nix {};
   gitolite = handleTest ./gitolite.nix {};
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};

nixos/tests/github-runner.nix

···
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "github-runner";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ veehaitch ];
+  };
+  nodes.machine = { pkgs, ... }: {
+    services.github-runners.test = {
+      enable = true;
+      url = "https://github.com/yaxitech";
+      tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
+    };
+
+    systemd.services.dummy-github-com = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "github-runner-test.service" ];
+      script = "${pkgs.netcat}/bin/nc -Fl 443 | true && touch /tmp/registration-connect";
+    };
+    networking.hosts."127.0.0.1" = [ "api.github.com" ];
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("dummy-github-com")
+
+    try:
+      machine.wait_for_unit("github-runner-test")
+    except Exception:
+      pass
+
+    out = machine.succeed("journalctl -u github-runner-test")
+    assert "Self-hosted runner registration" in out, "did not read runner registration header"
+
+    machine.wait_until_succeeds("test -f /tmp/registration-connect")
+  '';
+})

pkgs/applications/display-managers/greetd/regreet.nix

···
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, glib
+, gtk4
+, pango
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "regreet";
+  version = "unstable-2023-02-27";
+
+  src = fetchFromGitHub {
+    owner = "rharish101";
+    repo = "ReGreet";
+    rev = "2bbabe90f112b4feeb0aea516c265daaec8ccf2a";
+    hash = "sha256-71ji4x/NUE4qmBuO5PkWTPE1a0uPXqJSwW1Ai1amPJE=";
+  };
+
+  cargoHash = "sha256-rz2eMMhoMtzBXCH6ZJOvGuYLeHSWga+Ebc4+ZO8Kk1g=";
+
+  buildFeatures = [ "gtk4_8" ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib gtk4 pango ];
+
+  meta = with lib; {
+    description = "Clean and customizable greeter for greetd";
+    homepage = "https://github.com/rharish101/ReGreet";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fufexan ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/cluster/acorn/default.nix

···
 
 buildGoModule rec {
   pname = "acorn";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "acorn-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9+jI3GBRuX06+aN8C8C3K72kKtQVwmfAwhYLViuERxk=";
+    hash = "sha256-X4EXF6t6RzjHCbo2+oB69sFoqeRc5blSmB7x1iQCYIA=";
   };
 
-  vendorHash = "sha256-t/q94B+ihcHh/XFHs1Z9yQTwoFKv/nkhIDykymGNA2w=";
+  vendorHash = "sha256-cx+7vbVpoeNwE4mNaQKuguALObyCrEA7EQPdnJ0H9mM=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/sniffers/wireshark/default.nix

···
-{ lib, stdenv, buildPackages, fetchurl, pkg-config, pcre2, perl, flex, bison
-, gettext, libpcap, libnl, c-ares, gnutls, libgcrypt, libgpg-error, geoip, openssl
-, lua5, python3, libcap, glib, libssh, nghttp2, zlib, cmake, makeWrapper, wrapGAppsHook
-, withQt ? true, qt5 ? null
-, ApplicationServices, SystemConfiguration, gmp
+{ lib
+, stdenv
+, buildPackages
+, fetchFromGitLab
+, pkg-config
+, pcre2
+, perl
+, flex
+, bison
+, gettext
+, libpcap
+, libnl
+, c-ares
+, gnutls
+, libgcrypt
+, libgpg-error
+, libmaxminddb
+, libopus
+, bcg729
+, spandsp3
+, libkrb5
+, speexdsp
+, libsmi
+, lz4
+, snappy
+, zstd
+, minizip
+, sbc
+, openssl
+, lua5
+, python3
+, libcap
+, glib
+, libssh
+, nghttp2
+, zlib
+, cmake
+, ninja
+, makeWrapper
+, wrapGAppsHook
+, withQt ? true
+, qt5 ? null
+, ApplicationServices
+, SystemConfiguration
+, gmp
 , asciidoctor
 }:
 
-assert withQt  -> qt5  != null;
+assert withQt -> qt5 != null;
 
 let
-  version = "4.0.3";
+  version = "4.0.4";
   variant = if withQt then "qt" else "cli";
-
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "wireshark-${variant}";
   inherit version;
   outputs = [ "out" "dev" ];
 
-  src = fetchurl {
-    url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "sha256-bFHhW8wK+5NzTmhtv/NU/9FZ9XC9KQS8u61vP+t+lRE=";
+  src = fetchFromGitLab {
+    repo = "wireshark";
+    owner = "wireshark";
+    rev = "v${version}";
+    hash = "sha256-x7McplQVdLczTov+u9eqmT1Ons22KqRsCN65pUuwYGw=";
   };
 
   cmakeFlags = [
···
   # Avoid referencing -dev paths because of debug assertions.
   env.NIX_CFLAGS_COMPILE = toString [ "-DQT_NO_DEBUG" ];
 
-  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config python3 perl ]
+  nativeBuildInputs = [ asciidoctor bison cmake ninja flex makeWrapper pkg-config python3 perl ]
     ++ lib.optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   buildInputs = [
-    gettext pcre2 libpcap lua5 libssh nghttp2 openssl libgcrypt
-    libgpg-error gnutls geoip c-ares glib zlib
-  ] ++ lib.optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools qtwayland ])
-    ++ lib.optionals stdenv.isLinux  [ libcap libnl ]
-    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
-    ++ lib.optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
+    gettext
+    pcre2
+    libpcap
+    lua5
+    libssh
+    nghttp2
+    openssl
+    libgcrypt
+    libgpg-error
+    gnutls
+    libmaxminddb
+    libopus
+    bcg729
+    spandsp3
+    libkrb5
+    speexdsp
+    libsmi
+    lz4
+    snappy
+    zstd
+    minizip
+    c-ares
+    glib
+    zlib
+  ] ++ lib.optionals withQt (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
+  ++ lib.optionals (withQt && stdenv.isLinux) [ qt5.qtwayland ]
+  ++ lib.optionals stdenv.isLinux [ libcap libnl sbc ]
+  ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
+  ++ lib.optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
 
   strictDeps = true;
 
···
             install_name_tool -change "$dylib" "$out/lib/$dylib" "$f"
         done
     done
-  '' else lib.optionalString withQt ''
-    pwd
-    install -Dm644 -t $out/share/applications ../resources/freedesktop/org.wireshark.Wireshark.desktop
+  '' else
+    lib.optionalString withQt ''
+      pwd
+      install -Dm644 -t $out/share/applications ../resources/freedesktop/org.wireshark.Wireshark.desktop
 
-    install -Dm644 ../resources/icons/wsicon.svg $out/share/icons/wireshark.svg
-    mkdir -pv $dev/include/{epan/{wmem,ftypes,dfilter},wsutil/wmem,wiretap}
+      install -Dm644 ../resources/icons/wsicon.svg $out/share/icons/wireshark.svg
+      mkdir -pv $dev/include/{epan/{wmem,ftypes,dfilter},wsutil/wmem,wiretap}
 
-    cp config.h $dev/include/wireshark/
-    cp ../epan/*.h $dev/include/epan/
-    cp ../epan/ftypes/*.h $dev/include/epan/ftypes/
-    cp ../epan/dfilter/*.h $dev/include/epan/dfilter/
-    cp ../include/ws_*.h $dev/include/
-    cp ../wiretap/*.h $dev/include/wiretap/
-    cp ../wsutil/*.h $dev/include/wsutil/
-    cp ../wsutil/wmem/*.h $dev/include/wsutil/wmem/
-  '');
+      cp config.h $dev/include/wireshark/
+      cp ../epan/*.h $dev/include/epan/
+      cp ../epan/ftypes/*.h $dev/include/epan/ftypes/
+      cp ../epan/dfilter/*.h $dev/include/epan/dfilter/
+      cp ../include/ws_*.h $dev/include/
+      cp ../wiretap/*.h $dev/include/wiretap/
+      cp ../wsutil/*.h $dev/include/wsutil/
+      cp ../wsutil/wmem/*.h $dev/include/wsutil/wmem/
+    '');
 
   dontFixCmake = true;
 

pkgs/data/themes/orchis-theme/default.nix

···
 , gtk-engine-murrine
 , sassc
 , border-radius ? null # Suggested: 2 < value < 16
-, tweaks ? [ ] # can be "solid" "compact" "black" "primary"
+, tweaks ? [ ] # can be "solid" "compact" "black" "primary" "macos" "submenu" "nord|dracula"
 , withWallpapers ? false
 }:
 
 let
-  validTweaks = [ "solid" "compact" "black" "primary" ];
-  unknownTweaks = lib.subtractLists validTweaks tweaks;
+  pname = "orchis-theme";
+
+  validTweaks = [ "solid" "compact" "black" "primary" "macos" "submenu" "nord" "dracula" ];
+
+  nordXorDracula = with builtins; lib.assertMsg (!(elem "nord" tweaks) || !(elem "dracula" tweaks)) ''
+    ${pname}: dracula and nord cannot be mixed. Tweaks ${toString tweaks}
+  '';
 in
-assert lib.assertMsg (unknownTweaks == [ ]) ''
-  You entered wrong tweaks: ${toString unknownTweaks}
-  Valid tweaks are: ${toString validTweaks}
-'';
+
+assert nordXorDracula;
+lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 
 stdenvNoCC.mkDerivation
 rec {
-  pname = "orchis-theme";
-  version = "2022-10-19";
+  inherit pname;
+  version = "2023-02-26";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    sha256 = "sha256-1lJUrWkb8IoUyCMn8J4Lwvs/pWsibrY0pSXrepuQcug=";
+    sha256 = "sha256-Qk5MK8S8rIcwO7Kmze6eAl5qcwnrGsiWbn0WNIPjRnA=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];

pkgs/development/python-modules/bpycv/default.nix

···
 
 buildPythonPackage rec {
   pname = "bpycv";
-  version = "0.2.43";
+  version = "0.3.6";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6LXhKuNkX3yKeZARLXmOVNAUQhJghtzKhnszJ1G/a8U=";
+    hash = "sha256-4N4rCVhbfJx7H7jS88QR3EcRupISIhnLuZ+cgfwIzg4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/continuous-integration/github-runner/default.nix

···
 { autoPatchelfHook
 , autoSignDarwinBinariesHook
-, coreutils
-, curl
+, buildDotnetModule
 , dotnetCorePackages
-, dotnetPackages
 , fetchFromGitHub
-, fetchurl
+, fetchpatch
 , git
 , glibc
-, icu
-, libkrb5
+, glibcLocales
 , lib
-, linkFarmFromDrvs
-, lttng-ust
-, makeWrapper
+, nixosTests
 , nodejs-16_x
-, openssl
 , stdenv
-, zlib
-, writeShellApplication
-, nuget-to-nix
+, which
 }:
-let
-  fetchNuGet = { pname, version, sha256 }: fetchurl {
-    name = "${pname}.${version}.nupkg";
-    url = "https://www.nuget.org/api/v2/package/${pname}/${version}";
-    inherit sha256;
-  };
-
-  nugetSource = linkFarmFromDrvs "nuget-packages" (
-    import ./deps.nix { inherit fetchNuGet; }
-  );
-
-  dotnetSdk = dotnetCorePackages.sdk_6_0;
-  # Map Nix systems to .NET runtime ids
-  runtimeIds = {
-    "x86_64-linux" = "linux-x64";
-    "aarch64-linux" = "linux-arm64";
-    "x86_64-darwin" = "osx-x64";
-    "aarch64-darwin" = "osx-arm64";
-  };
-  runtimeId = runtimeIds.${stdenv.system};
-  fakeSha1 = "0000000000000000000000000000000000000000";
-in
-stdenv.mkDerivation rec {
+buildDotnetModule rec {
   pname = "github-runner";
   version = "2.302.1";
 
···
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-l7kGKhHpE5kEo8QMmwZKnG4cctj2INhnko7KfAXfrQ8=";
+    hash = "sha256-hPZzqTJGwcBxajLjU0TuIQ2KLnDl9E66seuutm9JWDo=";
+    # Required to obtain HEAD's Git commit hash
+    leaveDotGit = true;
   };
 
-  nativeBuildInputs = [
-    dotnetSdk
-    dotnetPackages.Nuget
-    makeWrapper
-  ] ++ lib.optionals stdenv.isLinux [
-    autoPatchelfHook
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    autoSignDarwinBinariesHook
-  ];
-
-  buildInputs = [
-    curl # libcurl.so.4
-    libkrb5 # libgssapi_krb5.so.2
-    stdenv.cc.cc.lib # libstdc++.so.6
-    zlib # libz.so.1
-    icu
-  ] ++ lib.optionals stdenv.isLinux [
-    lttng-ust # liblttng-ust.so.0
-  ];
 
   patches = [
-    # Don't run Git, no restore on build/test
-    ./patches/dir-proj.patch
     # Replace some paths that originally point to Nix's read-only store
     ./patches/host-context-dirs.patch
     # Use GetDirectory() to obtain "diag" dir
     ./patches/use-get-directory-for-diag.patch
-    # Don't try to install systemd service
-    ./patches/dont-install-systemd-service.patch
+    # Don't try to install service
+    ./patches/dont-install-service.patch
+    # Access `.env` and `.path` relative to `$RUNNER_ROOT`, if set
+    ./patches/env-sh-use-runner-root.patch
+    # Fix FHS path: https://github.com/actions/runner/pull/2464
+    (fetchpatch {
+      name = "ln-fhs.patch";
+      url = "https://github.com/actions/runner/commit/5ff0ce1.patch";
+      hash = "sha256-2Vg3cKZK3cE/OcPDZkdN2Ro2WgvduYTTwvNGxwCfXas=";
+    })
   ];
 
   postPatch = ''
-    # Relax the version requirement
-    substituteInPlace src/global.json \
-      --replace '6.0.300' '${dotnetSdk.version}'
-
-    # Disable specific tests
-    substituteInPlace src/dir.proj \
-      --replace 'dotnet test Test/Test.csproj' \
-                "dotnet test Test/Test.csproj --filter '${lib.concatStringsSep "&" (map (x: "FullyQualifiedName!=${x}") disabledTests)}'"
-
-    # We don't use a Git checkout
+    # Ignore changes to src/Runner.Sdk/BuildConstants.cs
     substituteInPlace src/dir.proj \
       --replace 'git update-index --assume-unchanged ./Runner.Sdk/BuildConstants.cs' \
-                'echo Patched out.'
-
-    # Fix FHS path
-    substituteInPlace src/Test/L0/Util/IOUtilL0.cs \
-      --replace '/bin/ln' '${coreutils}/bin/ln'
+                'true'
   '';
 
-  DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = stdenv.isDarwin;
+  DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = isNull glibcLocales;
+  LOCALE_ARCHIVE = lib.optionalString (!DOTNET_SYSTEM_GLOBALIZATION_INVARIANT) "${glibcLocales}/lib/locale/locale-archive";
 
-  configurePhase = ''
-    runHook preConfigure
+  postConfigure = ''
+    # Generate src/Runner.Sdk/BuildConstants.cs
+    dotnet msbuild \
+      -t:GenerateConstant \
+      -p:ContinuousIntegrationBuild=true \
+      -p:Deterministic=true \
+      -p:PackageRuntime="${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}" \
+      -p:RunnerVersion="${version}" \
+      src/dir.proj
+  '';
 
-    export HOME=$(mktemp -d)
-
-    # Never use nuget.org
-    nuget sources Disable -Name "nuget.org"
-
-    # Restore the dependencies
-    dotnet restore src/ActionsRunner.sln \
-      --runtime "${runtimeId}" \
-      --source "${dotnetSdk.packages}" \
-      --source "${nugetSource}"
+  nativeBuildInputs = [
+    git
+    which
+  ] ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    autoSignDarwinBinariesHook
+  ];
 
-    runHook postConfigure
-  '';
+  buildInputs = [ stdenv.cc.cc.lib ];
 
-  buildPhase = ''
-    runHook preBuild
+  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-runtime = dotnetCorePackages.runtime_6_0;
 
-    dotnet msbuild \
-      -t:Build \
-      -p:PackageRuntime="${runtimeId}" \
-      -p:BUILDCONFIG="Release" \
-      -p:RunnerVersion="${version}" \
-      -p:GitInfoCommitHash="${fakeSha1}" \
-      src/dir.proj
+  dotnetFlags = [ "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}" ];
 
-    runHook postBuild
-  '';
+  # As given here: https://github.com/actions/runner/blob/0befa62/src/dir.proj#L33-L41
+  projectFile = [
+    "src/Sdk/Sdk.csproj"
+    "src/Runner.Common/Runner.Common.csproj"
+    "src/Runner.Listener/Runner.Listener.csproj"
+    "src/Runner.Worker/Runner.Worker.csproj"
+    "src/Runner.PluginHost/Runner.PluginHost.csproj"
+    "src/Runner.Sdk/Runner.Sdk.csproj"
+    "src/Runner.Plugins/Runner.Plugins.csproj"
+  ];
+  nugetDeps = ./deps.nix;
 
   doCheck = true;
 
···
       "CompositeActionWithActionfile_MaxLimit"
       "CompositeActionWithActionfile_Node"
       "DownloadActionFromGraph"
-      "DownloadActionFromGraph_Legacy"
       "NotPullOrBuildImagesMultipleTimes"
-      "NotPullOrBuildImagesMultipleTimes_Legacy"
       "RepositoryActionWithActionYamlFile_DockerHubImage"
-      "RepositoryActionWithActionYamlFile_DockerHubImage_Legacy"
       "RepositoryActionWithActionfileAndDockerfile"
-      "RepositoryActionWithActionfileAndDockerfile_Legacy"
       "RepositoryActionWithActionfile_DockerHubImage"
-      "RepositoryActionWithActionfile_DockerHubImage_Legacy"
       "RepositoryActionWithActionfile_Dockerfile"
-      "RepositoryActionWithActionfile_Dockerfile_Legacy"
       "RepositoryActionWithActionfile_DockerfileRelativePath"
-      "RepositoryActionWithActionfile_DockerfileRelativePath_Legacy"
       "RepositoryActionWithActionfile_Node"
-      "RepositoryActionWithActionfile_Node_Legacy"
       "RepositoryActionWithDockerfile"
-      "RepositoryActionWithDockerfile_Legacy"
       "RepositoryActionWithDockerfileInRelativePath"
-      "RepositoryActionWithDockerfileInRelativePath_Legacy"
       "RepositoryActionWithDockerfilePrepareActions_Repository"
       "RepositoryActionWithInvalidWrapperActionfile_Node"
-      "RepositoryActionWithInvalidWrapperActionfile_Node_Legacy"
       "RepositoryActionWithWrapperActionfile_PreSteps"
-      "RepositoryActionWithWrapperActionfile_PreSteps_Legacy"
     ]
     ++ map (x: "GitHub.Runner.Common.Tests.DotnetsdkDownloadScriptL0.${x}") [
       "EnsureDotnetsdkBashDownloadScriptUpToDate"
···
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchCancellation"
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchRunNewJob"
     ];
-  nativeCheckInputs = [ git ];
 
-  checkPhase = ''
-    runHook preCheck
+  testProjectFile = [ "src/Test/Test.csproj" ];
 
+  preCheck = ''
     mkdir -p _layout/externals
     ln -s ${nodejs-16_x} _layout/externals/node16
-
-    printf 'Disabled tests:\n%s\n' '${lib.concatMapStringsSep "\n" (x: " - ${x}") disabledTests}'
-
-    # BUILDCONFIG needs to be "Debug"
-    dotnet msbuild \
-      -t:test \
-      -p:PackageRuntime="${runtimeId}" \
-      -p:BUILDCONFIG="Debug" \
-      -p:RunnerVersion="${version}" \
-      -p:GitInfoCommitHash="${fakeSha1}" \
-      src/dir.proj
-
-    runHook postCheck
   '';
 
-  installPhase = ''
-    runHook preInstall
+  postInstall = ''
+    mkdir -p $out/bin
 
-    # Copy the built binaries to lib/ instead of bin/ as they
-    # have to be wrapped in the fixup phase to work
-    mkdir -p $out/lib
-    cp -r _layout/bin/. $out/lib/
+    install -m755 src/Misc/layoutbin/runsvc.sh                 $out/lib/github-runner
+    install -m755 src/Misc/layoutbin/RunnerService.js          $out/lib/github-runner
+    install -m755 src/Misc/layoutroot/run.sh                   $out/lib/github-runner
+    install -m755 src/Misc/layoutroot/run-helper.sh.template   $out/lib/github-runner/run-helper.sh
+    install -m755 src/Misc/layoutroot/config.sh                $out/lib/github-runner
+    install -m755 src/Misc/layoutroot/env.sh                   $out/lib/github-runner
 
-    # Delete debugging files
-    find "$out/lib" -type f -name '*.pdb' -delete
+    # env.sh is patched to not require any wrapping
+    ln -sr "$out/lib/github-runner/env.sh" "$out/bin/"
 
-    # Install the helper scripts to bin/ to resemble the upstream package
-    mkdir -p $out/bin
-    install -m755 src/Misc/layoutbin/runsvc.sh                 $out/bin/
-    install -m755 src/Misc/layoutbin/RunnerService.js          $out/lib/
-    install -m755 src/Misc/layoutroot/run.sh                   $out/lib/
-    install -m755 src/Misc/layoutroot/run-helper.sh.template   $out/lib/run-helper.sh
-    install -m755 src/Misc/layoutroot/config.sh                $out/lib/
-    install -m755 src/Misc/layoutroot/env.sh                   $out/lib/
-
-    # Rewrite reference in helper scripts from bin/ to lib/
-    substituteInPlace $out/lib/run.sh    --replace '"$DIR"/bin' '"$DIR"/lib'
-    substituteInPlace $out/lib/config.sh --replace './bin' $out'/lib' \
-      --replace 'source ./env.sh' $out/bin/env.sh
+    substituteInPlace $out/lib/github-runner/config.sh \
+      --replace './bin/Runner.Listener' "$out/bin/Runner.Listener"
   '' + lib.optionalString stdenv.isLinux ''
-    # Make binary paths absolute
-    substituteInPlace $out/lib/config.sh \
-      --replace 'ldd' '${glibc.bin}/bin/ldd' \
+    substituteInPlace $out/lib/github-runner/config.sh \
+      --replace 'command -v ldd' 'command -v ${glibc.bin}/bin/ldd' \
+      --replace 'ldd ./bin' '${glibc.bin}/bin/ldd ${dotnet-runtime}/shared/Microsoft.NETCore.App/${dotnet-runtime.version}/' \
       --replace '/sbin/ldconfig' '${glibc.bin}/bin/ldconfig'
   '' + ''
     # Remove uneeded copy for run-helper template
-    substituteInPlace $out/lib/run.sh --replace 'cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh' ' '
-    substituteInPlace $out/lib/run-helper.sh --replace '"$DIR"/bin/' '"$DIR"/'
+    substituteInPlace $out/lib/github-runner/run.sh --replace 'cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh' ' '
+    substituteInPlace $out/lib/github-runner/run-helper.sh --replace '"$DIR"/bin/' '"$DIR"/'
 
     # Make paths absolute
-    substituteInPlace $out/bin/runsvc.sh \
-      --replace './externals' "$out/externals" \
-      --replace './bin' "$out/lib"
+    substituteInPlace $out/lib/github-runner/runsvc.sh \
+      --replace './externals' "$out/lib/externals" \
+      --replace './bin/RunnerService.js' "$out/lib/github-runner/RunnerService.js"
 
-    # The upstream package includes Node {12,16} and expects it at the path
-    # externals/node{12,16}. As opposed to the official releases, we don't
+    # The upstream package includes Node 16 and expects it at the path
+    # externals/node16. As opposed to the official releases, we don't
     # link the Alpine Node flavors.
-    mkdir -p $out/externals
-    ln -s ${nodejs-16_x} $out/externals/node16
+    mkdir -p $out/lib/externals
+    ln -s ${nodejs-16_x} $out/lib/externals/node16
 
     # Install Nodejs scripts called from workflows
-    install -D src/Misc/layoutbin/hashFiles/index.js $out/lib/hashFiles/index.js
-    mkdir -p $out/lib/checkScripts
-    install src/Misc/layoutbin/checkScripts/* $out/lib/checkScripts/
-
-    runHook postInstall
-  '';
-
-  # Stripping breaks the binaries
-  dontStrip = true;
-
-  preFixup = lib.optionalString stdenv.isLinux ''
-    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so $out/lib/libcoreclrtraceptprovider.so
-  '';
-
-  postFixup = ''
-    fix_rpath() {
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/lib/$1
-    }
-    wrap() {
-      makeWrapper $out/lib/$1 $out/bin/$1 \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath (buildInputs ++ [ openssl ])} \
-        "''${@:2}"
-    }
+    install -D src/Misc/layoutbin/hashFiles/index.js $out/lib/github-runner/hashFiles/index.js
+    mkdir -p $out/lib/github-runner/checkScripts
+    install src/Misc/layoutbin/checkScripts/* $out/lib/github-runner/checkScripts/
   '' + lib.optionalString stdenv.isLinux ''
-    fix_rpath Runner.Listener
-    fix_rpath Runner.PluginHost
-    fix_rpath Runner.Worker
+    # Wrap explicitly to, e.g., prevent extra entries for LD_LIBRARY_PATH
+    makeWrapperArgs=()
+
+    # We don't wrap with libicu
+    substituteInPlace $out/lib/github-runner/config.sh \
+      --replace '$LDCONFIG_COMMAND -NXv ''${libpath//:/ }' 'echo libicu'
   '' + ''
-    wrap Runner.Listener
-    wrap Runner.PluginHost
-    wrap Runner.Worker
-    wrap run.sh --run 'export RUNNER_ROOT=''${RUNNER_ROOT:-$HOME/.github-runner}'
-    wrap env.sh --run 'cd $RUNNER_ROOT'
-
-    wrap config.sh --run 'export RUNNER_ROOT=''${RUNNER_ROOT:-$HOME/.github-runner}' \
-      --run 'mkdir -p $RUNNER_ROOT' \
-      --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]} \
-      --chdir $out
+    # XXX: Using the corresponding Nix argument does not work as expected:
+    #      https://github.com/NixOS/nixpkgs/issues/218449
+    # Common wrapper args for `executables`
+    makeWrapperArgs+=(
+      --run 'export RUNNER_ROOT="''${RUNNER_ROOT:-"$HOME/.github-runner"}"'
+      --run 'mkdir -p "$RUNNER_ROOT"'
+      --chdir "$out"
+    )
   '';
 
-  # Script to create deps.nix file for dotnet dependencies. Run it with
-  # $(nix-build -A github-runner.passthru.createDepsFile)/bin/create-deps-file
-  #
-  # Default output path is /tmp/${pname}-deps.nix, but can be overridden with cli argument.
-  #
-  # Inspired by passthru.fetch-deps in pkgs/build-support/build-dotnet-module/default.nix
-  passthru.createDepsFile = writeShellApplication {
-    name = "create-deps-file";
-    runtimeInputs = [ coreutils dotnetSdk (nuget-to-nix.override { dotnet-sdk = dotnetSdk; }) ];
-    text = ''
-      # Disable telemetry data
-      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+  # List of files to wrap
+  executables = [
+    "config.sh"
+    "Runner.Listener"
+    "Runner.PluginHost"
+    "Runner.Worker"
+    "run.sh"
+    "runsvc.sh"
+  ];
 
-      deps_file="$(realpath "''${1:-$(mktemp -t "${pname}-deps-XXXXXX.nix")}")"
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
 
-      printf "\n* Setup workdir\n"
-      workdir="$(mktemp -d /tmp/${pname}.XXX)"
-      HOME="$workdir"/.fake-home
-      cp -rT "${src}" "$workdir"
-      chmod -R +w "$workdir"
-      trap 'rm -rf "$workdir"' EXIT
+    export RUNNER_ROOT="$TMPDIR"
+
+    $out/bin/config.sh --help >/dev/null
+    $out/bin/Runner.Listener --help >/dev/null
 
-      pushd "$workdir"
+    version=$($out/bin/Runner.Listener --version)
+    if [[ "$version" != "${version}" ]]; then
+      printf 'Unexpected version %s' "$version"
+      exit 1
+    fi
 
-      mkdir nuget_pkgs
+    commit=$($out/bin/Runner.Listener --commit)
+    if [[ "$commit" != "$(git rev-parse HEAD)" ]]; then
+      printf 'Unexpected commit %s' "$commit"
+      exit 1
+    fi
 
-      ${lib.concatMapStrings (rid: ''
-      printf "\n* Restore ${pname} (${rid}) dotnet project\n"
-      dotnet restore src/ActionsRunner.sln --packages nuget_pkgs --no-cache --force --runtime "${rid}"
-      '') (lib.attrValues runtimeIds)}
+    runHook postInstallCheck
+  '';
 
-      printf "\n* Make %s file\n" "$(basename "$deps_file")"
-      nuget-to-nix "$workdir/nuget_pkgs" "${dotnetSdk.packages}" > "$deps_file"
-      printf "\n* Dependency file writen to %s" "$deps_file"
-    '';
+  passthru = {
+    tests.smoke-test = nixosTests.github-runner;
+    updateScript = ./update.sh;
   };
 
   meta = with lib; {
+    changelog = "https://github.com/actions/runner/releases/tag/v${version}";
     description = "Self-hosted runner for GitHub Actions";
     homepage = "https://github.com/actions/runner";
     license = licenses.mit;
     maintainers = with maintainers; [ veehaitch newam kfollesdal aanderse zimbatm ];
-    platforms = attrNames runtimeIds;
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 }

pkgs/development/tools/continuous-integration/github-runner/deps.nix

···
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
 { fetchNuGet }: [
   (fetchNuGet { pname = "Castle.Core"; version = "4.4.0"; sha256 = "0rpcbmyhckvlvp6vbzpj03c1gqz56ixc6f15vgmxmyf1g40c24pf"; })
   (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.4"; sha256 = "00fkczf69z2rwarcd8kjjdp47517a0ca6lggn72qbilsp03a5scj"; })

pkgs/development/tools/continuous-integration/github-runner/patches/dir-proj.patch

···
-From 5a850bb7946ce5c0620ac5f072d93a77cc064219 Mon Sep 17 00:00:00 2001
-From: Aaron Andersen <[e-mail]>
-Date: Thu, 29 Sep 2022 10:12:28 -0400
-Subject: [PATCH] [PATCH] Patch dir.proj
-
-Don't execute Git for GitInfoCommitHash property
-Don't restore for build target
-Don't restore for test target
----
- src/dir.proj | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
-diff --git a/src/dir.proj b/src/dir.proj
-index 056a312..f029720 100644
---- a/src/dir.proj
-+++ b/src/dir.proj
-@@ -2,9 +2,6 @@
- <Project ToolsVersion="14.0" DefaultTargets="Build"
-     xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-     <Target Name="GenerateConstant">
--        <Exec Command="git rev-parse HEAD" ConsoleToMSBuild="true">
--            <Output TaskParameter="ConsoleOutput" PropertyName="GitInfoCommitHash" />
--        </Exec>
-         <Message Text="Building $(Product): $(GitInfoCommitHash) --- $(PackageRuntime)" Importance="high"/>
- 
-         <ItemGroup>
-@@ -41,14 +38,13 @@
-     </ItemGroup>
- 
-     <Target Name="Build" DependsOnTargets="GenerateConstant">
--        <MSBuild Targets="Restore" Projects="@(ProjectFiles)" StopOnFirstFailure="true" />
-         <MSBuild Targets="Publish" Projects="@(ProjectFiles)" BuildInParallel="false" StopOnFirstFailure="true" Properties="Configuration=$(BUILDCONFIG);PackageRuntime=$(PackageRuntime);Version=$(RunnerVersion);RuntimeIdentifier=$(PackageRuntime);PublishDir=$(MSBuildProjectDirectory)/../_layout/bin" />
-         <Exec Command="%22$(DesktopMSBuild)%22 Runner.Service/Windows/RunnerService.csproj /p:Configuration=$(BUILDCONFIG) /p:PackageRuntime=$(PackageRuntime) /p:OutputPath=%22$(MSBuildProjectDirectory)/../_layout/bin%22" ConsoleToMSBuild="true" Condition="'$(PackageRuntime)' == 'win-x64' Or '$(PackageRuntime)' == 'win-x86' Or '$(PackageRuntime)' == 'win-arm64'" />
-     </Target>
- 
-     <Target Name="Test" DependsOnTargets="GenerateConstant">
--        <Exec Command="dotnet build Test/Test.csproj -c $(BUILDCONFIG) /p:PackageRuntime=$(PackageRuntime)" ConsoleToMSBuild="true" />
--        <Exec Command="dotnet test Test/Test.csproj -c $(BUILDCONFIG) --no-build --logger:trx" ConsoleToMSBuild="true" />
-+        <Exec Command="dotnet build Test/Test.csproj --no-restore -c $(BUILDCONFIG) /p:PackageRuntime=$(PackageRuntime)" ConsoleToMSBuild="true" />
-+        <Exec Command="dotnet test Test/Test.csproj --no-restore -c $(BUILDCONFIG) --no-build --logger:trx" ConsoleToMSBuild="true" />
-     </Target>
- 
-     <Target Name="Layout" DependsOnTargets="Clean;Build">
--- 
-2.36.2

pkgs/development/tools/continuous-integration/github-runner/patches/dont-install-service.patch

···
+From 369b3d98b44abbf061080ab1b17b22f99706ef69 Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <[e-mail]>
+Date: Sun, 26 Feb 2023 12:55:38 +0100
+Subject: [PATCH] Don't generate service config on Linux and OSX
+
+---
+ src/Runner.Listener/Configuration/ConfigurationManager.cs | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/src/Runner.Listener/Configuration/ConfigurationManager.cs b/src/Runner.Listener/Configuration/ConfigurationManager.cs
+index 392eb0e..4c75324 100644
+--- a/src/Runner.Listener/Configuration/ConfigurationManager.cs
++++ b/src/Runner.Listener/Configuration/ConfigurationManager.cs
+@@ -367,11 +367,6 @@ namespace GitHub.Runner.Listener.Configuration
+                 var serviceControlManager = HostContext.GetService<IWindowsServiceControlManager>();
+                 serviceControlManager.ConfigureService(runnerSettings, command);
+             }
+-
+-#elif OS_LINUX || OS_OSX
+-            // generate service config script for OSX and Linux, GenerateScripts() will no-opt on windows.
+-            var serviceControlManager = HostContext.GetService<ILinuxServiceControlManager>();
+-            serviceControlManager.GenerateScripts(runnerSettings);
+ #endif
+         }
+ 
+-- 
+2.38.1
+

pkgs/development/tools/continuous-integration/github-runner/patches/dont-install-systemd-service.patch

···
-diff --git a/src/Runner.Listener/Configuration/ConfigurationManager.cs b/src/Runner.Listener/Configuration/ConfigurationManager.cs
-index 8d08b06..bdfa3a2 100644
---- a/src/Runner.Listener/Configuration/ConfigurationManager.cs
-+++ b/src/Runner.Listener/Configuration/ConfigurationManager.cs
-@@ -320,10 +320,6 @@ namespace GitHub.Runner.Listener.Configuration
-                 serviceControlManager.ConfigureService(runnerSettings, command);
-             }
- 
--#elif OS_LINUX || OS_OSX
--            // generate service config script for OSX and Linux, GenerateScripts() will no-opt on windows.
--            var serviceControlManager = HostContext.GetService<ILinuxServiceControlManager>();
--            serviceControlManager.GenerateScripts(runnerSettings);
- #endif
-         }
- 

pkgs/development/tools/continuous-integration/github-runner/patches/env-sh-use-runner-root.patch

···
+From 84b2fcdf042771ae8adc0f59f1a3ecd9788a808d Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <[e-mail]>
+Date: Sun, 26 Feb 2023 11:37:01 +0100
+Subject: [PATCH] Access `.env` and `.path` relative to `$RUNNER_ROOT`, if set
+
+---
+ src/Misc/layoutbin/runsvc.sh   |  4 ++--
+ src/Misc/layoutroot/env.sh     | 10 +++++-----
+ src/Runner.Listener/Program.cs |  2 +-
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/Misc/layoutbin/runsvc.sh b/src/Misc/layoutbin/runsvc.sh
+index c135645..bb0fbf6 100755
+--- a/src/Misc/layoutbin/runsvc.sh
++++ b/src/Misc/layoutbin/runsvc.sh
+@@ -4,9 +4,9 @@
+ # for more info on how to propagate SIGTERM to a child process see: http://veithen.github.io/2014/11/16/sigterm-propagation.html
+ trap 'kill -INT $PID' TERM INT
+ 
+-if [ -f ".path" ]; then
++if [ -f "${RUNNER_ROOT:-"."}/.path" ]; then
+     # configure
+-    export PATH=`cat .path`
++    export PATH=`cat "${RUNNER_ROOT:-"."}/.path"`
+     echo ".path=${PATH}"
+ fi
+ 
+diff --git a/src/Misc/layoutroot/env.sh b/src/Misc/layoutroot/env.sh
+index 641d244..85379bf 100755
+--- a/src/Misc/layoutroot/env.sh
++++ b/src/Misc/layoutroot/env.sh
+@@ -16,10 +16,10 @@ varCheckList=(
+ 
+ envContents=""
+ 
+-if [ -f ".env" ]; then
+-    envContents=`cat .env`
++if [ -f "${RUNNER_ROOT:-"."}/.env" ]; then
++    envContents=`cat "${RUNNER_ROOT:-"."}/.env"`
+ else
+-    touch .env
++    touch "${RUNNER_ROOT:-"."}/.env"
+ fi
+ 
+ function writeVar()
+@@ -29,12 +29,12 @@ function writeVar()
+     if test "${envContents#*$checkDelim}" = "$envContents"
+     then
+         if [ ! -z "${!checkVar}" ]; then
+-            echo "${checkVar}=${!checkVar}">>.env
++            echo "${checkVar}=${!checkVar}">>"${RUNNER_ROOT:-"."}/.env"
+         fi
+     fi 
+ }
+ 
+-echo $PATH>.path
++echo $PATH>"${RUNNER_ROOT:-"."}/.path"
+ 
+ for var_name in ${varCheckList[@]}
+ do
+diff --git a/src/Runner.Listener/Program.cs b/src/Runner.Listener/Program.cs
+index d4d5e43..beacc9d 100644
+--- a/src/Runner.Listener/Program.cs
++++ b/src/Runner.Listener/Program.cs
+@@ -148,7 +148,7 @@ namespace GitHub.Runner.Listener
+         private static void LoadAndSetEnv()
+         {
+             var binDir = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
+-            var rootDir = new DirectoryInfo(binDir).Parent.FullName;
++            var rootDir = Environment.GetEnvironmentVariable("RUNNER_ROOT") ?? new DirectoryInfo(binDir).Parent.FullName;
+             string envFile = Path.Combine(rootDir, ".env");
+             if (File.Exists(envFile))
+             {
+-- 
+2.38.1
+

pkgs/development/tools/continuous-integration/github-runner/update.sh

···
+#! /usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=./. -i bash -p coreutils common-updater-scripts jq curl
+
+set -euo pipefail
+
+currentVersion="$(nix --extra-experimental-features nix-command eval -f . github-runner.version --raw)"
+latestVersion="$(curl -s -H "Accept: application/vnd.github.v3+json" \
+            ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+            "https://api.github.com/repos/actions/runner/releases/latest" | jq -r ".tag_name")"
+latestVersion="${latestVersion#?}" # v2.296.2 -> 2.296.2
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "github-runner is already up to date: $currentVersion"
+    exit
+fi
+
+update-source-version github-runner "$latestVersion"
+$(nix-build -A github-runner.fetch-deps --no-out-link) "$(dirname "$BASH_SOURCE")/deps.nix"
+

pkgs/top-level/all-packages.nix

···
     dlm = callPackage ../applications/display-managers/greetd/dlm.nix { };
     greetd = callPackage ../applications/display-managers/greetd { };
     gtkgreet = callPackage ../applications/display-managers/greetd/gtkgreet.nix { };
+    regreet = callPackage ../applications/display-managers/greetd/regreet.nix { };
     tuigreet = callPackage ../applications/display-managers/greetd/tuigreet.nix { };
     wlgreet = callPackage ../applications/display-managers/greetd/wlgreet.nix { };
   };