Merge staging-next into staging

nixos/modules/services/misc/prowlarr.nix

···
         Type = "simple";
         DynamicUser = true;
         StateDirectory = "prowlarr";
-        ExecStart = "${cfg.package}/bin/Prowlarr -nobrowser -data=/var/lib/prowlarr";
+        ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
         Restart = "on-failure";
       };
     };

nixos/modules/virtualisation/vmware-guest.nix

···
 
   config = mkIf cfg.enable {
     assertions = [ {
-      assertion = pkgs.stdenv.hostPlatform.isx86;
+      assertion = pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isAarch64;
       message = "VMWare guest is not currently supported on ${pkgs.stdenv.hostPlatform.system}";
     } ];
 
     boot.initrd.availableKernelModules = [ "mptspi" ];
-    boot.initrd.kernelModules = [ "vmw_pvscsi" ];
+    boot.initrd.kernelModules = lib.optionals pkgs.stdenv.hostPlatform.isx86 [ "vmw_pvscsi" ];
 
     environment.systemPackages = [ open-vm-tools ];
 

nixos/tests/kernel-generic.nix

···
       linux_5_15_hardened
       linux_6_1_hardened
       linux_6_3_hardened
+      linux_6_4_hardened
 
       linux_testing;
   };

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.homepage = "https://github.com/winston0410/cmd-parser.nvim/";
   };
 
+  cmp-beancount = buildVimPluginFrom2Nix {
+    pname = "cmp-beancount";
+    version = "2022-11-27";
+    src = fetchFromGitHub {
+      owner = "crispgm";
+      repo = "cmp-beancount";
+      rev = "da154ea94d598e6649d6ad01efa0a8611eff460d";
+      sha256 = "14y2h8g5ddcf2rqwgrrsk8m3j4wmk26vdlqzx439n893dzmzd2yg";
+    };
+    meta.homepage = "https://github.com/crispgm/cmp-beancount/";
+  };
+
   cmp-buffer = buildVimPluginFrom2Nix {
     pname = "cmp-buffer";
     version = "2022-08-10";

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/ekickx/clipboard-image.nvim/,,
 https://github.com/asheq/close-buffers.vim/,HEAD,
 https://github.com/winston0410/cmd-parser.nvim/,,
+https://github.com/crispgm/cmp-beancount/,HEAD,
 https://github.com/hrsh7th/cmp-buffer/,,
 https://github.com/hrsh7th/cmp-calc/,,
 https://github.com/vappolinario/cmp-clippy/,HEAD,

pkgs/applications/editors/vscode/extensions/default.nix

···
       };
 
       mgt19937.typst-preview = buildVscodeMarketplaceExtension {
-        mktplcRef = {
+        mktplcRef =
+        let
+          sources = {
+            "x86_64-linux" = {
+              arch = "linux-x64";
+              sha256 = "sha256-O8sFv23tlhJS6N8LRKkHcTJTupZejCLDRdVVCdDlWbA=";
+            };
+            "x86_64-darwin" = {
+              arch = "darwin-x64";
+              sha256 = "1npzjch67agswh3nm14dbbsx777daq2rdw1yny10jf3858z2qynr";
+            };
+            "aarch64-linux" = {
+              arch = "linux-arm64";
+              sha256 = "1vv1jfgnyjbmshh4w6rf496d9dpdsk3f0049ii4d9vi23igk4xpk";
+            };
+            "aarch64-darwin" = {
+              arch = "darwin-arm64";
+              sha256 = "0dfchzqm61kddq20zvp1pcpk1625b9wgj32ymc08piq06pbadk29";
+            };
+          };
+        in
+        {
           name = "typst-preview";
           publisher = "mgt19937";
-          version = "0.6.0";
-          sha256 = "sha256-ZrsTtbD3oIUjxSC1osGYwTynwvDFQxuGeDglopBJGxA=";
-        };
+          version = "0.6.1";
+        } // sources.${stdenv.system};
+
+        nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+
+        buildInputs = lib.optionals stdenv.isLinux [ stdenv.cc.cc.lib ];
+
         meta = {
           description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=mgt19937.typst-preview";

pkgs/applications/gis/grass/default.nix

···
-{ lib, stdenv, fetchFromGitHub, flex, bison, pkg-config, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg, makeWrapper, wxGTK32, libiconv, libxml2, netcdf, blas
-, proj, gdal, geos, sqlite, postgresql, libmysqlclient, python3Packages, proj-datumgrid
-, zstd, pdal, wrapGAppsHook
+{ lib
+, stdenv
+, callPackage
+, fetchFromGitHub
+, makeWrapper
+, wrapGAppsHook
+
+, bison
+, blas
+, cairo
+, ffmpeg
+, fftw
+, flex
+, gdal
+, geos
+, libiconv
+, libmysqlclient
+, libpng
+, libtiff
+, libxml2
+, netcdf
+, pdal
+, pkg-config
+, postgresql
+, proj
+, proj-datumgrid
+, python3Packages
+, readline
+, sqlite
+, wxGTK32
+, zlib
+, zstd
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
   pname = "grass";
   version = "8.3.0";
 
···
   };
 
   nativeBuildInputs = [
-    pkg-config bison flex makeWrapper wrapGAppsHook
+    makeWrapper
+    wrapGAppsHook
+
+    bison
+    flex
     gdal # for `gdal-config`
     geos # for `geos-config`
-    netcdf # for `nc-config`
     libmysqlclient # for `mysql_config`
+    netcdf # for `nc-config`
+    pkg-config
   ] ++ (with python3Packages; [ python-dateutil numpy wxPython_4_2 ]);
 
   buildInputs = [
-    cairo zlib proj libtiff libpng libxml2 fftw sqlite
-    readline ffmpeg postgresql blas wxGTK32
-    proj-datumgrid zstd
+    blas
+    cairo
+    ffmpeg
+    fftw
     gdal
     geos
+    libmysqlclient
+    libpng
+    libtiff
+    libxml2
     netcdf
-    libmysqlclient
     pdal
+    postgresql
+    proj
+    proj-datumgrid
+    readline
+    sqlite
+    wxGTK32
+    zlib
+    zstd
   ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   strictDeps = true;
···
   '';
 
   configureFlags = [
-    "--with-proj-share=${proj}/share/proj"
-    "--with-proj-includes=${proj.dev}/include"
-    "--with-proj-libs=${proj}/lib"
-    "--without-opengl"
-    "--with-readline"
-    "--with-wxwidgets"
-    "--with-netcdf"
+    "--with-blas"
+    "--with-fftw"
     "--with-geos"
-    "--with-postgres"
-    "--with-postgres-libs=${postgresql.lib}/lib/"
-    # it complains about missing libmysqld but doesn't really seem to need it
+    # It complains about missing libmysqld but doesn't really seem to need it
     "--with-mysql"
     "--with-mysql-includes=${lib.getDev libmysqlclient}/include/mysql"
     "--with-mysql-libs=${libmysqlclient}/lib/mysql"
-    "--with-blas"
-    "--with-zstd"
-    "--with-fftw"
+    "--with-netcdf"
+    "--with-postgres"
+    "--with-postgres-libs=${postgresql.lib}/lib/"
+    "--with-proj-includes=${proj.dev}/include"
+    "--with-proj-libs=${proj}/lib"
+    "--with-proj-share=${proj}/share/proj"
     "--with-pthread"
+    "--with-readline"
+    "--with-wxwidgets"
+    "--with-zstd"
+    "--without-opengl"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-pdal"
   ] ++ lib.optionals stdenv.isDarwin [
···
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    grass = callPackage ./tests.nix { grass = finalAttrs.finalPackage; };
+  };
+
   meta = with lib; {
-    homepage = "https://grass.osgeo.org/";
     description = "GIS software suite used for geospatial data management and analysis, image processing, graphics and maps production, spatial modeling, and visualization";
+    homepage = "https://grass.osgeo.org/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; teams.geospatial.members ++ [ mpickering ];
     platforms = platforms.all;
   };
-}
+})

pkgs/applications/gis/grass/tests.nix

···
+{ runCommand, grass }:
+
+let
+  inherit (grass) pname version;
+
+in
+runCommand "${pname}-tests" { meta.timeout = 60; }
+  ''
+    HOME=$(mktemp -d)
+
+    ${grass}/bin/grass --tmp-location EPSG:3857 --exec g.version \
+      | grep 'GRASS ${version}'
+
+    ${grass}/bin/grass --tmp-location EPSG:3857 --exec g.mapset -l \
+      | grep 'PERMANENT'
+
+    touch $out
+  ''

pkgs/applications/misc/tango/default.nix

···
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "tango";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "masakichi";
+    repo = "tango";
+    rev = "v${version}";
+    hash = "sha256-e/M2iRm/UwfnRVnMo1PmQTkz4IGTxnsCXNSSUkhsiHk=";
+  };
+
+  vendorHash = "sha256-83nKtiEy1na1HgAQcbTEfl+0vGg6BkCLBK1REN9fP+k=";
+
+  meta = with lib; {
+    description = "A local command-line Japanese dictionary tool using yomichan's dictionary files";
+    homepage = "https://github.com/masakichi/tango";
+    license = licenses.mit;
+    maintainers = with maintainers; [ donovanglover ];
+  };
+}

pkgs/applications/networking/cluster/bosh-cli/default.nix

···
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.2.4";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LVDWgyIBVp7UVnEuQ42eVfxDZB3BZn5InnPX7WN6MrA=";
+    sha256 = "sha256-o/JhfS2VkN5qzZglFN1YNSZV2A2LowNouQee4Tv2dFc=";
   };
   vendorHash = null;
 

pkgs/applications/video/mpv/scripts/default.nix

···
+{ lib
+, callPackage
+, config
+}:
+
+lib.recurseIntoAttrs
+  ({
+    acompressor = callPackage ./acompressor.nix { };
+    autocrop = callPackage ./autocrop.nix { };
+    autodeint = callPackage ./autodeint.nix { };
+    autoload = callPackage ./autoload.nix { };
+    convert = callPackage ./convert.nix { };
+    inhibit-gnome = callPackage ./inhibit-gnome.nix { };
+    mpris = callPackage ./mpris.nix { };
+    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
+    mpvacious = callPackage ./mpvacious.nix { };
+    quality-menu = callPackage ./quality-menu.nix { };
+    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
+    sponsorblock = callPackage ./sponsorblock.nix { };
+    thumbfast = callPackage ./thumbfast.nix { };
+    thumbnail = callPackage ./thumbnail.nix { };
+    uosc = callPackage ./uosc.nix { };
+    vr-reversal = callPackage ./vr-reversal.nix { };
+    webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
+    cutter = callPackage ./cutter.nix { };
+  }
+  // (callPackage ./occivink.nix { }))
+  // lib.optionalAttrs config.allowAliases {
+  youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
+}

pkgs/applications/video/mpv/scripts/quality-menu.nix

···
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, oscSupport ? false
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "mpv-quality-menu";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "christoph-heinrich";
+    repo = "mpv-quality-menu";
+    rev = "v${version}";
+    hash = "sha256-93WoTeX61xzbjx/tgBgUVuwyR9MkAUzCfVSrbAC7Ddc=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/mpv/scripts
+    cp quality-menu.lua $out/share/mpv/scripts
+  '' + lib.optionalString oscSupport ''
+    cp quality-menu-osc.lua $out/share/mpv/scripts
+  '' + ''
+    runHook postInstall
+  '';
+
+  passthru.scriptName = "quality-menu.lua";
+
+  meta = with lib; {
+    description = "A userscript for MPV that allows you to change youtube video quality (ytdl-format) on the fly";
+    homepage = "https://github.com/christoph-heinrich/mpv-quality-menu";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ lunik1 ];
+  };
+}

pkgs/applications/video/mpv/scripts/youtube-quality.nix

···
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-, oscSupport ? false
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "mpv-youtube-quality";
-  version = "unstable-2020-02-11";
-
-  src = fetchFromGitHub {
-    owner = "jgreco";
-    repo = "mpv-youtube-quality";
-    rev = "1f8c31457459ffc28cd1c3f3c2235a53efad7148";
-    sha256 = "voNP8tCwCv8QnAZOPC9gqHRV/7jgCAE63VKBd/1s5ic=";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/mpv/scripts
-    cp youtube-quality.lua $out/share/mpv/scripts
-  '' + lib.optionalString oscSupport ''
-    cp youtube-quality-osc.lua $out/share/mpv/scripts
-  '' + ''
-    runHook postInstall
-  '';
-
-  passthru.scriptName = "youtube-quality.lua";
-
-  meta = with lib; {
-    description = "A userscript for MPV that allows you to change youtube video quality (ytdl-format) on the fly";
-    homepage = "https://github.com/jgreco/mpv-youtube-quality";
-    license = licenses.unfree;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ lunik1 ];
-  };
-}

pkgs/development/compilers/cairo/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cairo";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "starkware-libs";
     repo = "cairo";
     rev = "v${version}";
-    hash = "sha256-bqLkCP1hzdOMrVyyyiOZYN0BKPe8OjKMfpFGCr1/anU=";
+    hash = "sha256-tFWY4bqI+YVVu0E9EPl+c0UAsSn/cjgvEOQtyT9tkYg=";
   };
 
-  cargoHash = "sha256-FzQkAlNKFFLK8XmLafm37MvLekGE24BoLliaDpc+44w=";
+  cargoHash = "sha256-fnkzR07MIwzjvg2ZRhhzYIUhuidEBZt0mGfxwHyhyVE=";
 
   nativeCheckInputs = [
     rustfmt

pkgs/development/libraries/raylib/default.nix

···
 , raylib-games
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "raylib";
-  version = "4.2.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "raysan5";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-aMIjywcQxki0cKlNznPAMfvrtGj3qcR95D4/BDuPZZM=";
+    repo = "raylib";
+    rev = finalAttrs.version;
+    hash = "sha256-Uqqzq5shDp0AgSBT5waHBNUkEu0LRj70SNOlR5R2yAM=";
   };
 
   nativeBuildInputs = [ cmake ];
···
     ++ lib.optional pulseSupport libpulseaudio;
   propagatedBuildInputs = [ libGLU libX11 ];
 
-  patches = [
-    # fixes glfw compile error;
-    # remove with next raylib version > 4.2.0 or when glfw 3.4.0 is released.
-    (fetchpatch {
-      url = "https://github.com/raysan5/raylib/commit/2ad7967db80644a25ca123536cf2f6efcb869684.patch";
-      sha256 = "sha256-/xgzox1ITeoZ91QWdwnJJ+jJ5nJsMHcEgbIEdNYh4NY=";
-      name = "raylib-glfw-fix.patch";
-    })
-  ];
-
   # https://github.com/raysan5/raylib/wiki/CMake-Build-Options
   cmakeFlags = [
     "-DUSE_EXTERNAL_GLFW=ON"
···
   ] ++ lib.optional includeEverything "-DINCLUDE_EVERYTHING=ON"
     ++ lib.optional sharedLib "-DBUILD_SHARED_LIBS=ON";
 
-  # fix libasound.so/libpulse.so not being found
-  preFixup = ''
-    ${lib.optionalString alsaSupport "patchelf --add-needed ${alsa-lib}/lib/libasound.so $out/lib/libraylib.so.${version}"}
-    ${lib.optionalString pulseSupport "patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/libraylib.so.${version}"}
-  '';
-
   passthru.tests = [ raylib-games ];
 
   meta = with lib; {
···
     license = licenses.zlib;
     maintainers = with maintainers; [ adamlwgriffiths ];
     platforms = platforms.linux;
-    changelog = "https://github.com/raysan5/raylib/blob/${version}/CHANGELOG";
+    changelog = "https://github.com/raysan5/raylib/blob/${finalAttrs.version}/CHANGELOG";
   };
-}
+})

pkgs/development/python-modules/python3-application/default.nix

···
 
 buildPythonPackage rec {
   pname = "python3-application";
-  version = "3.0.4";
+  version = "3.0.6";
 
   disabled = !isPy3k;
 
···
     owner = "AGProjects";
     repo = pname;
     rev = "release-${version}";
-    hash = "sha256-XXAKp/RlBVs3KmcnuiexdYfxf0zt2A/DrsJzdC9I4vA=";
+    hash = "sha256-L7KN6rKkbjNmkSoy8vdMYpXSBkWN7afNpreJO0twjq8=";
   };
 
   propagatedBuildInputs = [ zope_interface twisted ];
···
   pythonImportsCheck = [ "application" ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = stdenv.isDarwin;
     description = "A collection of modules that are useful when building python applications";
     homepage = "https://github.com/AGProjects/python3-application";
     license = licenses.lgpl21Plus;

pkgs/development/tools/build-managers/buck2/default.nix

···
 { fetchurl, lib, stdenv, zstd
 , autoPatchelfHook, gcc-unwrapped
+, testers, buck2 # for passthru.tests
 }:
 
 let
···
   doInstallCheck = true;
   installCheckPhase = "$out/bin/buck2 --version";
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = testers.testVersion {
+      package = buck2;
+
+      # NOTE (aseipp): the buck2 --version command doesn't actually print out
+      # the given version tagged in the release, but a hash, but not the git
+      # hash; the entire version logic is bizarrely specific to buck2, and needs
+      # to be reworked the open source build to behave like expected. in the
+      # mean time, it *does* always print out 'buck2 <hash>...' so we can just
+      # match on "buck2"
+      version = "buck2";
+    };
+  };
+
   meta = with lib; {
     description = "Fast, hermetic, multi-language build system";
     homepage = "https://buck2.build";
+    changelog = "https://github.com/facebook/buck2/releases/tag/${buck2-version}";
     license = with licenses; [ asl20 /* or */ mit ];
+    mainProgram = "buck2";
+    maintainers = with maintainers; [ thoughtpolice ];
     platforms = [
       "x86_64-linux" "aarch64-linux"
       "x86_64-darwin" "aarch64-darwin"
     ];
-    maintainers = with maintainers; [ thoughtpolice ];
   };
 }

pkgs/development/tools/fnm/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "fnm";
-  version = "1.34.0";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ttzfyTfv0835w4BaSWxT17/e/fjNCxWABW/kZKpy7q8=";
+    sha256 = "sha256-EqaEbPMjDybsl8IsLyjDXVPaF9oH1DYRjNb94uBOxL8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation Security ];
 
-  cargoHash = "sha256-hYRVlCQ9+FCQFtT6uku7FynzHMdHvKATqkr5tCJoZCU=";
+  cargoHash = "sha256-MkfgK+fm0kKZpFobNFtv6cVvTF/76U2Kzs/MxMwXHjs=";
 
   doCheck = false;
 

pkgs/development/tools/language-servers/ansible-language-server/default.nix

···
 
 buildNpmPackage rec {
   pname = "ansible-language-server";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kyyYHA0+n8zo1GOzC5lW+QnAn2EtLq0bB1L11yONJbE=";
+    hash = "sha256-5QzwDsWjuq/gMWFQEkl4sqvsqfxTOZhaFBMhjiiOZSY=";
   };
 
-  npmDepsHash = "sha256-0mOj0HV6fbImuYDKr3S2SUO8nHN7R0FX9Ihi0GtoSR4=";
+  npmDepsHash = "sha256-bzffCAGn0aYVoG8IDaXd5I3x3AnGl5urX7BaBKf0tVI=";
   npmBuildScript = "compile";
 
   # We remove/ignore the prepare and prepack scripts because they run the

pkgs/development/tools/misc/doq/default.nix

···
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "doq";
+  version = "0.9.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "heavenshell";
+    repo = "py-doq";
+    rev = "refs/tags/${version}";
+    hash = "sha256-6ff7R/2Jo4jYm1hA70yopjklpKIMWlj7DH9eKxOlfgU=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    jinja2
+    parso
+    toml
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    parameterized
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [ "doq" ];
+
+  meta = with lib; {
+    description = "Docstring generator for Python";
+    homepage = "https://github.com/heavenshell/py-doq";
+    changelog = "https://github.com/heavenshell/py-doq/releases/tag/${src.rev}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}

pkgs/development/tools/reindeer/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "unstable-2023-06-20";
+  version = "unstable-2023-07-14";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = pname;
-    rev = "43a317cad6e7205bd4aee067539bf613971a5624";
-    sha256 = "sha256-y2/tQR8kYLpBwhow59F9pvyh/pgZ0fAGYd5zow2N1Es=";
+    rev = "381fe232bcab77b432e2f29dbbd685e013d19c76";
+    sha256 = "sha256-xyoGmleJAZA/tdB2Q11vPe9rcn74SCBPiTR//Cpx1Lw=";
   };
 
-  cargoSha256 = "sha256-mzQHEtKEiP/COHgeZnRN1CfFPcK+RaD7WuvWJO0OJHs=";
+  cargoSha256 = "sha256-GVOkZcleKakXE58LbJthAa5ZWArKkIok/RawLXcwGPw=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =

pkgs/os-specific/linux/kernel/hardened/config.nix

···
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
   SECURITY_WRITABLE_HOOKS  = option no;
 
   STRICT_KERNEL_RWX = yes;

pkgs/os-specific/linux/kernel/hardened/patches.json

···
         },
         "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb",
         "version": "6.3.12"
+    },
+    "6.4": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.4.3-hardened1.patch",
+            "sha256": "1xwy9088f8qy7algv1gad90gd6sv03diz16jvfnk2yb01k4f87wv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.3-hardened1/linux-hardened-6.4.3-hardened1.patch"
+        },
+        "sha256": "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i",
+        "version": "6.4.3"
     }
 }

pkgs/servers/prowlarr/default.nix

···
     changelog = "https://github.com/Prowlarr/Prowlarr/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ jdreaver ];
+    mainProgram = "Prowlarr";
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"

pkgs/tools/networking/pritunl-client/default.nix

···
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-
-buildGoModule rec {
-  pname = "pritunl-client";
+{ lib
+, stdenv
+, fetchFromGitHub
+, runtimeShell
+, runCommand
+, makeWrapper
+, installShellFiles
+, buildGoModule
+, coreutils
+, which
+, gnugrep
+, gnused
+, openresolv
+, systemd
+, iproute2
+, openvpn
+, electron
+}: let
   version = "1.3.3584.5";
-
   src = fetchFromGitHub {
     owner = "pritunl";
     repo = "pritunl-client-electron";
···
     sha256 = "sha256-wWpP2u+oQSESjkRvAn5by7efvssYtKBYg2E+FZ/+tg0=";
   };
 
-  modRoot = "cli";
-  vendorHash = "sha256-miwGLWpoaavg/xcw/0pNBYCdovBnvjP5kdaaGPcRuWk=";
+  cli = buildGoModule {
+    pname = "pritunl-cli";
+    inherit version src;
+
+    modRoot = "cli";
+    vendorHash = "sha256-miwGLWpoaavg/xcw/0pNBYCdovBnvjP5kdaaGPcRuWk=";
+
+    postInstall = ''
+      mv $out/bin/cli $out/bin/pritunl-client
+    '';
+  };
+
+  service = buildGoModule {
+    pname = "pritunl-client-service";
+    inherit version src;
+
+    modRoot = "service";
+    vendorHash = "sha256-9Fv8m3eWlxv4WWDSdI0VMavgy+0OSIVZ98dkDBwm4Gc=";
+
+    nativeBuildInputs = [ makeWrapper ];
+
+    postPatch = ''
+      sed -Ei service/profile/scripts.go \
+        -e 's|#!\s*(/usr)?/bin/(env )?bash\b|#! ${runtimeShell}|g'
+    '' + lib.optionalString stdenv.isLinux ''
+      sed -Ei service/profile/scripts.go \
+        -e 's|(/usr)?/s?bin/busctl\b|busctl|g' \
+        -e 's|(/usr)?/s?bin/resolvectl\b|resolvectl|g' \
+        -e 's|(/usr)?/s?bin/ip\b|ip|g'
+    '';
+
+    postInstall = ''
+      mv $out/bin/service $out/bin/pritunl-client-service
+    '' + lib.optionalString stdenv.isLinux ''
+      mkdir -p $out/lib/systemd/system/
+      cp $src/resources_linux/pritunl-client.service $out/lib/systemd/system/
+      substituteInPlace $out/lib/systemd/system/pritunl-client.service \
+        --replace "/usr" "$out"
+    '';
+
+    postFixup = let
+      hookScriptsDeps = [
+        coreutils
+        which
+        gnused
+        gnugrep
+      ] ++ lib.optionals stdenv.isLinux [
+        openresolv
+        systemd
+        iproute2
+      ];
+      openvpn-wrapped = runCommand "openvpn-wrapped" {
+        nativeBuildInputs = [ makeWrapper ];
+      } ''
+        mkdir -p $out/bin
+        makeWrapper ${openvpn}/bin/openvpn $out/bin/openvpn \
+          --prefix PATH : ${lib.makeBinPath hookScriptsDeps} \
+          --add-flags "--setenv PATH \$PATH"
+      '';
+    in lib.optionalString stdenv.isLinux ''
+      wrapProgram $out/bin/pritunl-client-service \
+        --prefix PATH : "${lib.makeBinPath ([ openvpn-wrapped ])}"
+    '';
+  };
+in stdenv.mkDerivation {
+  pname = "pritunl-client";
+  inherit version src;
+
+  dontBuild = true;
+  dontConfigure = true;
 
   nativeBuildInputs = [
+    makeWrapper
     installShellFiles
   ];
 
-  postInstall = ''
-    mv $out/bin/cli $out/bin/pritunl-client
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin/
+    ln -s ${cli}/bin/pritunl-client $out/bin/
+    ln -s ${service}/bin/pritunl-client-service $out/bin/
+
+    mkdir -p $out/lib/
+    cp -r client $out/lib/pritunl_client_electron
+
+    makeWrapper ${electron}/bin/electron $out/bin/pritunl-client-electron \
+      --add-flags $out/lib/pritunl_client_electron
+
+  '' + lib.optionalString stdenv.isLinux ''
+    mkdir -p $out/lib/systemd/system/
+    ln -s ${service}/lib/systemd/system/pritunl-client.service $out/lib/systemd/system/
+
+    mkdir -p $out/share/icons/
+    cp -r resources_linux/icons $out/share/icons/hicolor
+
+    mkdir -p $out/share/applications/
+    cp resources_linux/pritunl-client-electron.desktop $out/share/applications/
+    substituteInPlace $out/share/applications/pritunl-client-electron.desktop \
+      --replace "/usr/lib/pritunl_client_electron/Pritunl" "$out/bin/pritunl-client-electron"
+  '' + ''
+    # install shell completions for pritunl-client
     installShellCompletion --cmd pritunl-client \
       --bash <($out/bin/pritunl-client completion bash) \
       --fish <($out/bin/pritunl-client completion fish) \
       --zsh <($out/bin/pritunl-client completion zsh)
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    description = "Pritunl OpenVPN client CLI";
-    homepage = "https://github.com/pritunl/pritunl-client-electron/tree/master/cli";
+    description = "Pritunl OpenVPN client";
+    homepage = "https://client.pritunl.com/";
     license = licenses.unfree;
-    maintainers = with maintainers; [ minizilla ];
+    maintainers = with maintainers; [ minizilla andrevmatos ];
   };
 }

pkgs/tools/system/openipmi/default.nix

···
-{ stdenv, fetchurl, popt, ncurses, python39, readline, lib }:
+{ stdenv, fetchurl, popt, ncurses, python3, readline, lib }:
 
 stdenv.mkDerivation rec {
   pname = "OpenIPMI";
···
     sha256 = "sha256-+1Pp6l4mgc+K982gJLGgBExnX4QRbKJ66WFsi3rZW0k=";
   };
 
-  buildInputs = [ ncurses popt python39 readline ];
+  buildInputs = [ ncurses popt python3 readline ];
 
   outputs = [ "out" "lib" "dev" "man" ];
 

pkgs/tools/text/xml/xq/default.nix

···
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, xq
+}:
+
+buildGoModule rec {
+  pname = "xq";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "sibprogrammer";
+    repo = "xq";
+    rev = "v${version}";
+    hash = "sha256-Z14x1b25wKNm9fECkNqGJglK/Z8Xq8VHmYfp5aEvvMU=";
+  };
+
+  vendorHash = "sha256-CP4QsrTkFcOLDxnFc0apevXRmXHA9aJSU4AK9+TAxOU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.commit=${src.rev}"
+    "-X=main.version=${version}"
+  ];
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = xq;
+    };
+  };
+
+  meta = with lib; {
+    description = "Command-line XML and HTML beautifier and content extractor";
+    homepage = "https://github.com/sibprogrammer/xq";
+    changelog = "https://github.com/sibprogrammer/xq/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/top-level/all-packages.nix

···
 
   tandoor-recipes = callPackage ../applications/misc/tandoor-recipes { };
 
+  tango = callPackage ../applications/misc/tango { };
+
   tangram = callPackage ../applications/networking/instant-messengers/tangram { };
 
   t1utils = callPackage ../tools/misc/t1utils { };
···
   xprite-editor = callPackage ../tools/misc/xprite-editor {
     inherit (darwin.apple_sdk.frameworks) AppKit;
   };
+
+  xq-xml = callPackage ../tools/text/xml/xq { };
 
   xsecurelock = callPackage ../tools/X11/xsecurelock { };
 
···
   ansible-doctor = callPackage ../tools/admin/ansible/doctor.nix { };
 
   dbus-test-runner = callPackage ../development/tools/dbus-test-runner { };
+
+  doq = callPackage ../development/tools/misc/doq { };
 
   phpunit = callPackage ../development/tools/misc/phpunit { };
 
···
   linux_6_1_hardened = linuxKernel.kernels.linux_6_1_hardened;
   linuxPackages_6_3_hardened = linuxKernel.packages.linux_6_3_hardened;
   linux_6_3_hardened = linuxKernel.kernels.linux_6_3_hardened;
+  linuxPackages_6_4_hardened = linuxKernel.packages.linux_6_4_hardened;
+  linux_6_4_hardened = linuxKernel.kernels.linux_6_4_hardened;
 
   # Hardkernel (Odroid) kernels.
   linuxPackages_hardkernel_latest = linuxKernel.packageAliases.linux_hardkernel_latest;
···
 
   mpvpaper = callPackage ../tools/wayland/mpvpaper { };
 
-  mpvScripts = recurseIntoAttrs ({
-    acompressor = callPackage ../applications/video/mpv/scripts/acompressor.nix {};
-    autocrop = callPackage ../applications/video/mpv/scripts/autocrop.nix { };
-    autodeint = callPackage ../applications/video/mpv/scripts/autodeint.nix { };
-    autoload = callPackage ../applications/video/mpv/scripts/autoload.nix { };
-    convert = callPackage ../applications/video/mpv/scripts/convert.nix { };
-    inhibit-gnome = callPackage ../applications/video/mpv/scripts/inhibit-gnome.nix { };
-    mpris = callPackage ../applications/video/mpv/scripts/mpris.nix { };
-    mpv-playlistmanager = callPackage ../applications/video/mpv/scripts/mpv-playlistmanager.nix { };
-    mpvacious = callPackage ../applications/video/mpv/scripts/mpvacious.nix { };
-    simple-mpv-webui = callPackage ../applications/video/mpv/scripts/simple-mpv-webui.nix { };
-    sponsorblock = callPackage ../applications/video/mpv/scripts/sponsorblock.nix { };
-    thumbfast = callPackage ../applications/video/mpv/scripts/thumbfast.nix { };
-    thumbnail = callPackage ../applications/video/mpv/scripts/thumbnail.nix { };
-    uosc = callPackage ../applications/video/mpv/scripts/uosc.nix { };
-    vr-reversal = callPackage ../applications/video/mpv/scripts/vr-reversal.nix { };
-    webtorrent-mpv-hook = callPackage ../applications/video/mpv/scripts/webtorrent-mpv-hook.nix { };
-    youtube-quality = callPackage ../applications/video/mpv/scripts/youtube-quality.nix { };
-    cutter = callPackage ../applications/video/mpv/scripts/cutter.nix { };
-  } // (callPackage ../applications/video/mpv/scripts/occivink.nix {}));
+  mpvScripts = import ../applications/video/mpv/scripts { inherit lib callPackage config; };
 
   open-in-mpv = callPackage ../applications/video/open-in-mpv { };
 
···
 
   bitcoin  = libsForQt5.callPackage ../applications/blockchains/bitcoin {
     stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
-    boost = boost179;
     withGui = true;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
   bitcoind = callPackage ../applications/blockchains/bitcoin {
-    boost = boost179;
     withGui = false;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
   bitcoind-knots = callPackage ../applications/blockchains/bitcoin-knots {
-    boost = boost179;
     withGui = false;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
···
   besu = callPackage ../applications/blockchains/besu { };
 
   bitcoin-abc  = libsForQt5.callPackage ../applications/blockchains/bitcoin-abc {
-    boost = boost179;
     withGui = true;
   };
   bitcoind-abc = callPackage ../applications/blockchains/bitcoin-abc {
-    boost = boost179;
     mkDerivation = stdenv.mkDerivation;
     withGui = false;
   };
···
   dcrwallet = callPackage ../applications/blockchains/dcrwallet { };
 
   dogecoin  = libsForQt5.callPackage ../applications/blockchains/dogecoin {
-    boost = boost179;
     withGui = true;
   };
   dogecoind = callPackage ../applications/blockchains/dogecoin {
-    boost = boost179;
     withGui = false;
   };
 
···
 
   groestlcoin  = libsForQt5.callPackage ../applications/blockchains/groestlcoin {
     stdenv = darwin.apple_sdk_11_0.stdenv;
-    boost = boost179;
     withGui = true;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
   groestlcoind = callPackage ../applications/blockchains/groestlcoin {
-    boost = boost179;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
···
     inherit (darwin.apple_sdk.frameworks) CoreData IOKit PCSC;
   };
 
-  monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui {
-    boost = boost179;
-  };
+  monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui { };
 
   oxen = callPackage ../applications/blockchains/oxen
     { stdenv = gcc10StdenvCompat; boost = boost179; };
···
 
   stellar-core = callPackage ../applications/blockchains/stellar-core { };
 
-  sumokoin = callPackage ../applications/blockchains/sumokoin {
-    boost = boost179;
-  };
+  sumokoin = callPackage ../applications/blockchains/sumokoin { };
 
   solana-cli = callPackage ../applications/blockchains/solana { };
 
···
   torq = callPackage ../applications/blockchains/torq { };
 
   vertcoin  = libsForQt5.callPackage ../applications/blockchains/vertcoin {
-    boost = boost179;
     withGui = true;
   };
   vertcoind = callPackage ../applications/blockchains/vertcoin {
-    boost = boost179;
     withGui = false;
   };
 

pkgs/top-level/linux-kernels.nix

···
     linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
     linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
     linux_6_3_hardened = hardenedKernelFor kernels.linux_6_3 { };
+    linux_6_4_hardened = hardenedKernelFor kernels.linux_6_4 { };
 
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";
···
     linux_5_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_5_15_hardened);
     linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
     linux_6_3_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_3_hardened);
+    linux_6_4_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_4_hardened);
 
     linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
     linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);