Merge master into staging-next

doc/stdenv/multiple-output.chapter.md

···
 # Multiple-output packages {#chap-multiple-output}
 
-## Introduction {#sec-multiple-outputs-introduction}
-
 The Nix language allows a derivation to produce multiple outputs, which is similar to what is utilized by other Linux distribution packaging systems. The outputs reside in separate Nix store paths, so they can be mostly handled independently of each other, including passing to build inputs, garbage collection or binary substitution. The exception is that building from source always produces all the outputs.
 
 The main motivation is to save disk space by reducing runtime closure sizes; consequently also sizes of substituted binaries get reduced. Splitting can be used to have more granular runtime dependencies, for example the typical reduction is to split away development-only files, as those are typically not needed during runtime. As a result, closure sizes of many packages can get reduced to a half or even much less.
···
 The reduction effects could be instead achieved by building the parts in completely separate derivations. That would often additionally reduce build-time closures, but it tends to be much harder to write such derivations, as build systems typically assume all parts are being built at once. This compromise approach of single source package producing multiple binary packages is also utilized often by rpm and deb.
 :::
 
-A number of attributes can be used to work with a derivation with multiple outputs. The attribute `outputs` is a list of strings, which are the names of the outputs. For each of these names, an identically named attribute is created, corresponding to that output. The attribute `meta.outputsToInstall` is used to determine the default set of outputs to install when using the derivation name unqualified.
-
-## Installing a split package {#sec-multiple-outputs-installing}
-
-When installing a package with multiple outputs, the package’s `meta.outputsToInstall` attribute determines which outputs are actually installed. `meta.outputsToInstall` is a list whose [default installs binaries and the associated man pages](https://github.com/NixOS/nixpkgs/blob/f1680774340d5443a1409c3421ced84ac1163ba9/pkgs/stdenv/generic/make-derivation.nix#L310-L320). The following sections describe ways to install different outputs.
-
-### Selecting outputs to install via NixOS {#sec-multiple-outputs-installing-nixos}
-
-NixOS provides two ways to select the outputs to install for packages listed in `environment.systemPackages`:
-
-- The configuration option `environment.extraOutputsToInstall` is appended to each package’s `meta.outputsToInstall` attribute to determine the outputs to install. It can for example be used to install `info` documentation or debug symbols for all packages.
-
-- The outputs can be listed as packages in `environment.systemPackages`. For example, the `"out"` and `"info"` outputs for the `coreutils` package can be installed by including `coreutils` and `coreutils.info` in `environment.systemPackages`.
-
-### Selecting outputs to install via `nix-env` {#sec-multiple-outputs-installing-nix-env}
-
-`nix-env` lacks an easy way to select the outputs to install. When installing a package, `nix-env` always installs the outputs listed in `meta.outputsToInstall`, even when the user explicitly selects an output.
-
-::: {.warning}
-`nix-env` silently disregards the outputs selected by the user, and instead installs the outputs from `meta.outputsToInstall`. For example,
-
-```ShellSession
-$ nix-env -iA nixpkgs.coreutils.info
-```
-
-installs the `"out"` output (`coreutils.meta.outputsToInstall` is `[ "out" ]`) instead of the requested `"info"`.
-:::
-
-The only recourse to select an output with `nix-env` is to override the package’s `meta.outputsToInstall`, using the functions described in [](#chap-overrides). For example, the following overlay adds the `"info"` output for the `coreutils` package:
+A number of attributes can be used to work with a derivation with multiple outputs.
+The attribute `outputs` is a list of strings, which are the names of the outputs.
+For each of these names, an identically named attribute is created, corresponding to that output.
 
-```nix
-self: super:
-{
-  coreutils = super.coreutils.overrideAttrs (oldAttrs: {
-    meta = oldAttrs.meta // { outputsToInstall = oldAttrs.meta.outputsToInstall or [ "out" ] ++ [ "info" ]; };
-  });
-}
-```
+The attribute `meta.outputsToInstall` is used to determine the [default set of outputs to install](https://github.com/NixOS/nixpkgs/blob/08c3198f1c6fd89a09f8f0ea09b425028a34de3e/pkgs/stdenv/generic/check-meta.nix#L411-L426) when using the derivation name unqualified:
+`bin`, or `out`, or the first specified output; as well as `man` if that is specified.
 
 ## Using a split package {#sec-multiple-outputs-using-split-packages}
 

maintainers/maintainer-list.nix

···
     github = "blaggacao";
     githubId = 7548295;
   };
+  blankparticle = {
+    name = "BlankParticle";
+    email = "[e-mail]";
+    github = "BlankParticle";
+    githubId = 130567419;
+    keys = [{
+      fingerprint = "1757 64C3 7065 AA8D 614D  41C9 0ACE 126D 7B35 9261";
+    }];
+  };
   blanky0230 = {
     email = "[e-mail]";
     github = "blanky0230";

nixos/doc/manual/release-notes/rl-2311.section.md

···
 
 - `himalaya` has been updated to `0.8.0`, which drops the native TLS support (in favor of Rustls) and add OAuth 2.0 support. See the [release note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more details.
 
+- `nix-prefetch-git` now ignores global and user git config, to improve reproducibility.
+
 - The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option now defaults to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"`, to use all of Caddy's default ACME CAs and enable Caddy's automatic issuer fallback feature by default, as recommended by upstream.
 
 - The default priorities of [`services.nextcloud.phpOptions`](#opt-services.nextcloud.phpOptions) have changed. This means that e.g.
···
 - `services.matrix-synapse` has new options to configure worker processes for matrix-synapse using [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers). It's also now possible to configure a local redis server using [`services.matrix-synapse.configureRedisLocally`](#opt-services.matrix-synapse.configureRedisLocally).
 
 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
-
-- `generic-extlinux-compatible` bootloader (and raspberry pi with uboot) supports appending secrets to the initramfs
 
 - `services.restic.backups` now adds wrapper scripts to your system path, which set the same environment variables as the service, so restic operations can easly be run from the command line. This behavior can be disabled by setting `createWrapper` to `false`, per backup configuration.
 

nixos/modules/config/system-path.nix

···
       extraOutputsToInstall = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        example = [ "doc" "info" "devdoc" ];
-        description = lib.mdDoc "List of additional package outputs to be symlinked into {file}`/run/current-system/sw`.";
+        example = [ "dev" "info" ];
+        description = lib.mdDoc ''
+          Entries listed here will be appended to the `meta.outputsToInstall` attribute for each package in `environment.systemPackages`, and the files from the corresponding derivation outputs symlinked into {file}`/run/current-system/sw`.
+
+          For example, this can be used to install the `dev` and `info` outputs for all packages in the system environment, if they are available.
+
+          To use specific outputs instead of configuring them globally, select the corresponding attribute on the package derivation, e.g. `libxml2.dev` or `coreutils.info`.
+        '';
       };
 
       extraSetup = mkOption {

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh

···
 addEntry() {
     local path=$(readlink -f "$1")
     local tag="$2" # Generation number or 'default'
-    local current="$3" # whether this is the current/latest generation
 
     if ! test -e $path/kernel -a -e $path/initrd; then
         return
     fi
 
-    if test -e "$path/append-initrd-secrets"; then
-        local initrd="$target/nixos/$(basename "$path")-initramfs-with-secrets"
-        cp $(readlink -f "$path/initrd") "$initrd"
-        chmod 600 "${initrd}"
-        chown 0:0 "${initrd}"
-        filesCopied[$initrd]=1
-
-        "$path/append-initrd-secrets" "$initrd" || if test "${current}" = "1"; then
-            echo "failed to create initrd secrets for the current generation." >&2
-            echo "are your \`boot.initrd.secrets\` still in place?" >&2
-            exit 1
-        else
-            echo "warning: failed to create initrd secrets for \"$path\", an older generation" >&2
-            echo "note: this is normal after having removed or renamed a file in \`boot.initrd.secrets\`" >&2
-        fi
-    else
-        copyToKernelsDir "$path/initrd"; initrd=$result
-    fi
-
     copyToKernelsDir "$path/kernel"; kernel=$result
-
+    copyToKernelsDir "$path/initrd"; initrd=$result
     dtbDir=$(readlink -m "$path/dtbs")
     if [ -e "$dtbDir" ]; then
         copyToKernelsDir "$dtbDir"; dtbs=$result
···
 TIMEOUT $timeout
 EOF
 
-addEntry $default default 1 >> $tmpFile
+addEntry $default default >> $tmpFile
 
 if [ "$numGenerations" -gt 0 ]; then
     # Add up to $numGenerations generations of the system profile to the menu,
     # in reverse (most recent to least recent) order.
-    current=1
     for generation in $(
             (cd /nix/var/nix/profiles && ls -d system-*-link) \
             | sed 's/system-\([0-9]\+\)-link/\1/' \
             | sort -n -r \
             | head -n $numGenerations); do
         link=/nix/var/nix/profiles/system-$generation-link
-        addEntry $link $generation $current
-        current=0
+        addEntry $link $generation
     done >> $tmpFile
 fi
 

nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix

···
         assertion = !pkgs.stdenv.hostPlatform.isAarch64 || cfg.version >= 3;
         message = "Only Raspberry Pi >= 3 supports aarch64.";
       };
-      boot.loader.supportsInitrdSecrets = cfg.uboot.enable;
 
       system.build.installBootLoader = builder;
       system.boot.loader.id = "raspberrypi";

nixos/modules/system/boot/stage-1.nix

···
             path the secret should have inside the initrd, the value
             is the path it should be copied from (or null for the same
             path inside and out).
-
-            The loader `generic-extlinux-compatible` supports this. Because
-            it is not well know how different implementations react to
-            concatenated cpio archives, this is disabled by default. It can be
-            enabled by setting {option}`boot.loader.supportsInitrdSecrets`
-            to true. If this works for you, please report your findings at
-            https://github.com/NixOS/nixpkgs/issues/247145 .
           '';
         example = literalExpression
           ''

pkgs/applications/editors/mg/default.nix

···
     description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
     homepage = "https://man.openbsd.org/OpenBSD-current/man1/mg.1";
     license = licenses.publicDomain;
+    mainProgram = "mg";
     platforms = platforms.all;
   };
 }

pkgs/applications/kde/default.nix

···
       kdebugsettings = callPackage ./kdebugsettings.nix {};
       kdeconnect-kde = callPackage ./kdeconnect-kde.nix {};
       kdegraphics-mobipocket = callPackage ./kdegraphics-mobipocket.nix {};
-      kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers.nix {};
+      kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers {};
       kdenetwork-filesharing = callPackage ./kdenetwork-filesharing.nix {};
       kdenlive = callPackage ./kdenlive {};
       kdepim-addons = callPackage ./kdepim-addons.nix {};

pkgs/applications/kde/kdegraphics-thumbnailers.nix

···
-{
-  mkDerivation, lib, fetchpatch,
-  extra-cmake-modules, karchive, kio, libkexiv2, libkdcraw, kdegraphics-mobipocket
-}:
-
-mkDerivation {
-  pname = "kdegraphics-thumbnailers";
-  meta = {
-    license = [ lib.licenses.lgpl21 ];
-    maintainers = [ lib.maintainers.ttuegel ];
-  };
-  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ karchive kio libkexiv2 libkdcraw kdegraphics-mobipocket ];
-}

pkgs/applications/kde/kdegraphics-thumbnailers/default.nix

···
+{
+  mkDerivation, lib, ghostscript, substituteAll,
+  extra-cmake-modules, karchive, kio, libkexiv2, libkdcraw, kdegraphics-mobipocket
+}:
+
+mkDerivation {
+  pname = "kdegraphics-thumbnailers";
+  meta = {
+    license = [ lib.licenses.lgpl21 ];
+    maintainers = [ lib.maintainers.ttuegel ];
+  };
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [ karchive kio libkexiv2 libkdcraw kdegraphics-mobipocket ];
+
+  patches = [
+    # Hardcode patches to Ghostscript so PDF thumbnails work OOTB.
+    # Intentionally not doing the same for dvips because TeX is big.
+    (substituteAll {
+      gs = "${ghostscript}/bin/gs";
+      src = ./gs-paths.patch;
+    })
+  ];
+}

pkgs/applications/kde/kdegraphics-thumbnailers/gs-paths.patch

···
+diff --git a/ps/gscreator.cpp b/ps/gscreator.cpp
+index 5b84e49..cbb7c25 100644
+--- a/ps/gscreator.cpp
++++ b/ps/gscreator.cpp
+@@ -101,7 +101,7 @@ static const char *epsprolog =
+     "[ ] 0 setdash newpath false setoverprint false setstrokeadjust\n";
+ 
+ static const char * gsargs_ps[] = {
+-    "gs",
++    "@gs@",
+     "-sDEVICE=png16m",
+     "-sOutputFile=-",
+     "-dSAFER",
+@@ -120,7 +120,7 @@ static const char * gsargs_ps[] = {
+ };
+ 
+ static const char * gsargs_eps[] = {
+-    "gs",
++    "@gs@",
+     "-sDEVICE=png16m",
+     "-sOutputFile=-",
+     "-dSAFER",

pkgs/applications/misc/keepassxc/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "keepassxc";
-  version = "2.7.5";
+  version = "2.7.6";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
     rev = version;
-    sha256 = "sha256-OBEjczUIkY3pQXJfsuNj9Bm2TIbVWEHqMSolQnSfvLE=";
+    hash = "sha256-xgrkMz7BCBxjfxHsAz/CFLv1d175LnrAJIOZMM3GmU0=";
   };
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
···
     '';
     homepage = "https://keepassxc.org/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ jonafato srapenne ];
+    maintainers = with maintainers; [ jonafato srapenne blankparticle ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }

pkgs/applications/networking/browsers/chromium/upstream-info.nix

···
   };
   stable = {
     chromedriver = {
-      sha256_darwin = "0phhcqid7wjw923qdi65zql3fid25swwszksgnw3b8fgz67jn955";
+      sha256_darwin = "138mw5p6r0n0531fs6322yxsjgj9hia5plw4mj0b3mclykzy5l37";
       sha256_darwin_aarch64 =
-        "00fwq8slvjm6c7krgwjd4mxhkkrp23n4icb63qlvi2hy06gfj4l6";
-      sha256_linux = "0ws8ch1j2hzp483vr0acvam1zxmzg9d37x6gqdwiqwgrk6x5pvkh";
-      version = "117.0.5938.88";
+        "1cym94av2gw2zwj3rdqbjcqkigpzf0zk2bam2hw9n2hiabb4rm0p";
+      sha256_linux = "1q1vyhmcx6b5criz5bn1c3x3z2dzqdgsmwcvlb0rzqlzpla9q26m";
+      version = "117.0.5938.92";
     };
     deps = {
       gn = {
···
         version = "2023-08-01";
       };
     };
-    sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6";
-    sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi";
-    version = "117.0.5938.88";
+    sha256 = "0b1l8gjhqbsyqi30rsn8dyq2hdvwasdqfk1qzk55f9ch4wclkjk5";
+    sha256bin64 = "047w7y4c8k076yzrjc50lvwncbk8b3lyqnd1si9nrsl7c66j2h0q";
+    version = "117.0.5938.92";
   };
   ungoogled-chromium = {
     deps = {
···
         version = "2023-08-01";
       };
       ungoogled-patches = {
-        rev = "117.0.5938.88-1";
-        sha256 = "1wz15ib56j8c84bgrbf0djk5wli49b1lvaqbg18pdclkp1mqy5w9";
+        rev = "117.0.5938.92-1";
+        sha256 = "0ix0vaki9r305js61qraiah3vqjaj3dyycabi6grfavdgjpjkasb";
       };
     };
-    sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6";
-    sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi";
-    version = "117.0.5938.88";
+    sha256 = "0b1l8gjhqbsyqi30rsn8dyq2hdvwasdqfk1qzk55f9ch4wclkjk5";
+    sha256bin64 = "047w7y4c8k076yzrjc50lvwncbk8b3lyqnd1si9nrsl7c66j2h0q";
+    version = "117.0.5938.92";
   };
 }

pkgs/applications/networking/browsers/firefox-bin/default.nix

···
-{ lib, stdenv, fetchurl, config, wrapGAppsHook
+{ lib, stdenv, fetchurl, config, wrapGAppsHook, autoPatchelfHook
 , alsa-lib
-, atk
-, cairo
 , curl
-, cups
 , dbus-glib
-, dbus
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, glibc
 , gtk3
-, libkrb5
-, libX11
-, libXScrnSaver
-, libxcb
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXext
-, libXfixes
-, libXi
-, libXinerama
-, libXrender
-, libXrandr
-, libXt
 , libXtst
-, libcanberra
-, libnotify
-, adwaita-icon-theme
-, libGLU, libGL
-, nspr
-, nss
-, pango
-, pipewire
+, libva
 , pciutils
-, heimdal
-, libpulseaudio
-, systemd
+, pipewire
+, adwaita-icon-theme
 , channel
 , generated
 , writeScript
···
 , gnused
 , gnugrep
 , gnupg
-, ffmpeg
 , runtimeShell
-, mesa # firefox wants gbm for drm+dmabuf
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 }:
 
 let
 
   inherit (generated) version sources;
+
+  binaryName = if channel == "release" then "firefox" else "firefox-${channel}";
 
   mozillaPlatforms = {
     i686-linux = "linux-i686";
···
 
   src = fetchurl { inherit (source) url sha256; };
 
-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc
-      alsa-lib
-      atk
-      cairo
-      curl
-      cups
-      dbus-glib
-      dbus
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      glibc
-      gtk3
-      libkrb5
-      mesa
-      libX11
-      libXScrnSaver
-      libXcomposite
-      libXcursor
-      libxcb
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXinerama
-      libXrender
-      libXrandr
-      libXt
-      libXtst
-      libcanberra
-      libnotify
-      libGLU libGL
-      nspr
-      nss
-      pango
-      pipewire
-      pciutils
-      heimdal
-      libpulseaudio
-      systemd
-      ffmpeg
-    ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [
-      stdenv.cc.cc
-    ];
-
-  inherit gtk3;
-
-  nativeBuildInputs = [ wrapGAppsHook ];
-  buildInputs = [ gtk3 adwaita-icon-theme ];
-
-  # "strip" after "patchelf" may break binaries.
-  # See: https://github.com/NixOS/patchelf/issues/10
-  dontStrip = true;
-  dontPatchELF = true;
-
-  postPatch = ''
-    # Don't download updates from Mozilla directly
-    echo 'pref("app.update.auto", "false");' >> defaults/pref/channel-prefs.js
-  '';
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook ];
+  buildInputs = [
+    gtk3
+    adwaita-icon-theme
+    alsa-lib
+    dbus-glib
+    libXtst
+  ];
+  runtimeDependencies = [
+    curl
+    libva.out
+    pciutils
+  ];
+  appendRunpaths = [
+    "${pipewire.lib}/lib"
+  ];
 
   installPhase =
     ''
-      mkdir -p "$prefix/usr/lib/firefox-bin-${version}"
-      cp -r * "$prefix/usr/lib/firefox-bin-${version}"
+      mkdir -p "$prefix/lib/firefox-bin-${version}"
+      cp -r * "$prefix/lib/firefox-bin-${version}"
 
       mkdir -p "$out/bin"
-      ln -s "$prefix/usr/lib/firefox-bin-${version}/firefox" "$out/bin/"
-
-      for executable in \
-        firefox firefox-bin plugin-container \
-        updater crashreporter webapprt-stub \
-        glxtest vaapitest
-      do
-        if [ -e "$out/usr/lib/firefox-bin-${version}/$executable" ]; then
-          patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-            "$out/usr/lib/firefox-bin-${version}/$executable"
-        fi
-      done
-
-      find . -executable -type f -exec \
-        patchelf --set-rpath "$libPath" \
-          "$out/usr/lib/firefox-bin-${version}/{}" \;
-
-      # wrapFirefox expects "$out/lib" instead of "$out/usr/lib"
-      ln -s "$out/usr/lib" "$out/lib"
-
-      gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
+      ln -s "$prefix/lib/firefox-bin-${version}/firefox" "$out/bin/${binaryName}"
 
       # See: https://github.com/mozilla/policy-templates/blob/master/README.md
       mkdir -p "$out/lib/firefox-bin-${version}/distribution";
       ln -s ${policiesJson} "$out/lib/firefox-bin-${version}/distribution/policies.json";
     '';
 
-  passthru.binaryName = "firefox";
-  passthru.libName = "firefox-bin-${version}";
-  passthru.execdir = "/bin";
-  passthru.ffmpegSupport = true;
-  passthru.gssSupport = true;
-  # update with:
-  # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
-  passthru.updateScript = import ./update.nix {
-    inherit pname channel lib writeScript xidel coreutils gnused gnugrep gnupg curl runtimeShell;
-    baseUrl =
-      if channel == "devedition"
-        then "https://archive.mozilla.org/pub/devedition/releases/"
-        else "https://archive.mozilla.org/pub/firefox/releases/";
+  passthru = {
+    inherit binaryName;
+    libName = "firefox-bin-${version}";
+    ffmpegSupport = true;
+    gssSupport = true;
+    gtk3 = gtk3;
+
+    # update with:
+    # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
+    updateScript = import ./update.nix {
+      inherit pname channel lib writeScript xidel coreutils gnused gnugrep gnupg curl runtimeShell;
+      baseUrl =
+        if channel == "devedition"
+          then "https://archive.mozilla.org/pub/devedition/releases/"
+          else "https://archive.mozilla.org/pub/firefox/releases/";
+    };
   };
+
   meta = with lib; {
     changelog = "https://www.mozilla.org/en-US/firefox/${version}/releasenotes/";
     description = "Mozilla Firefox, free web browser (binary package)";
···
     platforms = builtins.attrNames mozillaPlatforms;
     hydraPlatforms = [];
     maintainers = with maintainers; [ taku0 lovesegfault ];
+    mainProgram = binaryName;
   };
 }

pkgs/applications/networking/browsers/lynx/default.nix

···
   meta = with lib; {
     description = "A text-mode web browser";
     homepage = "https://lynx.invisible-island.net/";
+    mainProgram = "lynx";
     maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;

pkgs/applications/networking/instant-messengers/slack/update.sh

···
 latest_linux_version=$(curl -L --silent https://slack.com/downloads/linux | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
 latest_mac_version=$(curl -L --silent https://slack.com/downloads/mac | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
 
-# Double check that the latest mac and linux versions are in sync.
-if [[ "$latest_linux_version" != "$latest_mac_version" ]]; then
-  echo "the latest linux ($latest_linux_version) and mac ($latest_mac_version) versions are not the same"
-  exit 1
-fi
-
 nixpkgs="$(git rev-parse --show-toplevel)"
 slack_nix="$nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix"
 nixpkgs_linux_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-linux-version = \"\([0-9\.]\+\)\";.*/\1/p')

pkgs/applications/networking/irc/catgirl/default.nix

···
     license = licenses.gpl3Plus;
     description = "A TLS-only terminal IRC client";
     platforms = platforms.unix;
+    mainProgram = "catgirl";
     maintainers = with maintainers; [ xfnw ];
   };
 }

pkgs/applications/virtualization/cloud-hypervisor/default.nix

···
     description = "Open source Virtual Machine Monitor (VMM) that runs on top of KVM";
     changelog = "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v${version}";
     license = with licenses; [ asl20 bsd3 ];
+    mainProgram = "cloud-hypervisor";
     maintainers = with maintainers; [ offline qyliss ];
     platforms = [ "aarch64-linux" "x86_64-linux" ];
   };

pkgs/applications/virtualization/crosvm/default.nix

···
   meta = with lib; {
     description = "A secure virtual machine monitor for KVM";
     homepage = "https://chromium.googlesource.com/crosvm/crosvm/";
+    mainProgram = "crosvm";
     maintainers = with maintainers; [ qyliss ];
     license = licenses.bsd3;
     platforms = [ "aarch64-linux" "x86_64-linux" ];

pkgs/applications/window-managers/weston/default.nix

···
     homepage = "https://gitlab.freedesktop.org/wayland/weston";
     license = licenses.mit; # Expat version
     platforms = platforms.linux;
+    mainProgram = "weston";
     maintainers = with maintainers; [ primeos qyliss ];
   };
 }

pkgs/build-support/fetchgit/nix-prefetch-git

···
     local rev="${3:-HEAD}"
 
     if [ -n "$fetchLFS" ]; then
-        tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
-        exit_handlers+=(remove_tmpHomePath)
-        HOME="$tmpHomePath"
         clean_git lfs install
     fi
 
···
 if test -z "$branchName"; then
     branchName=fetchgit
 fi
+
+tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
+exit_handlers+=(remove_tmpHomePath)
+HOME="$tmpHomePath"
+unset XDG_CONFIG_HOME
+export GIT_CONFIG_NOSYSTEM=1
 
 if test -n "$builder"; then
     test -n "$out" -a -n "$url" -a -n "$rev" || usage

pkgs/build-support/php/build-pecl.nix

···
 , nativeBuildInputs ? [ ]
 , postPhpize ? ""
 , makeFlags ? [ ]
-, src ? fetchurl {
+, src ? fetchurl ({
     url = "https://pecl.php.net/get/${pname}-${version}.tgz";
-    inherit (args) sha256;
-  }
+  } // lib.filterAttrs (attrName: _: lib.elem attrName [ "sha256" "hash" ]) args)
 , passthru ? { }
 , ...
 }@args:

pkgs/by-name/ar/armbian-firmware/package.nix

···
+{ stdenvNoCC, lib, fetchFromGitHub }:
+stdenvNoCC.mkDerivation rec {
+  pname = "armbian-firmware";
+  version = "unstable-2023-09-16";
+
+  src = fetchFromGitHub {
+    owner = "armbian";
+    repo = "firmware";
+    rev = "01f9809bb0c4bd60c0c84b9438486b02d58b03f7";
+    hash = "sha256-ozKADff7lFjIT/Zf5dkNlCe8lOK+kwYb/60NaCJ8i2k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/firmware
+    cp -a * $out/lib/firmware/
+
+    runHook postInstall
+  '';
+
+  # Firmware blobs do not need fixing and should not be modified
+  dontBuild = true;
+  dontFixup = true;
+
+  meta = with lib; {
+    description = "Firmware from Armbian";
+    homepage = "https://github.com/armbian/firmware";
+    license = licenses.unfree;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ zaldnoay ];
+  };
+}

pkgs/desktops/pantheon/apps/appcenter/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Lj3j812XaCIN+TFSDAvIgtl49n5jG4fVlAFvrWqngpM=";
+    sha256 = "sha256-L6MGbzzujr4tEB2Cpd7IU+3mOtSCt2hLPw4mOfZ4TkQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/amdvlk/default.nix

···
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2023.Q3.1";
+  version = "2023.Q3.2";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "W+igZbdQG1L62oGJa2Rz0n8YkTsZFqSm7w8VFfPu8k0=";
+    sha256 = "/1D2BbT1gnMLvIHfpkxLkeo1pjbG9LkTx9Zl5+gGU/M=";
   };
 
   buildInputs = [

pkgs/development/libraries/libmongocrypt/default.nix

···
     mongoc
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk_11_0.frameworks.Security
   ];
 
   cmakeFlags = [

pkgs/development/php-packages/rrd/default.nix

···
+{ buildPecl, lib, pkg-config, rrdtool }:
+
+buildPecl {
+  pname = "rrd";
+
+  version = "2.0.3";
+  hash = "sha256-pCFh5YzcioU7cs/ymJidy96CsPdkVt1ZzgKFTJK3MPc=";
+
+  nativeBuildInputs = [ pkg-config rrdtool ];
+
+  meta = {
+    description = "PHP bindings to RRD tool system";
+    license = lib.licenses.bsd0;
+    homepage = "https://github.com/php/pecl-processing-rrd";
+    maintainers = lib.teams.wdz.members;
+  };
+}

pkgs/development/python-modules/aiocomelit/default.nix

···
 
 buildPythonPackage rec {
   pname = "aiocomelit";
-  version = "0.0.6";
+  version = "0.0.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
···
     owner = "chemelli74";
     repo = "aiocomelit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u6CyqDFLgnIVak0UqN4JmL8ll/li3k9EhFs7iC5oZ9U=";
+    hash = "sha256-lPwkTWkzXe5c5+KJkLHr7/cydtnDOFGniNNeOk2UXdA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/aioesphomeapi/default.nix

···
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "16.0.5";
+  version = "16.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
···
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SueK59CZTKkQPsHThs7k9eCEmc1GwaRIrw3oSK4E80E=";
+    hash = "sha256-BcFNxm4JpHaqKEhUTCXIrF18OMFxLbQHCQ9jfs+U0hc=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/bellows/default.nix

···
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.36.3";
+  version = "0.36.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
···
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-5s2I24gvHRXHm7ZTNZxc6ge9Kbe6UObcY29SvbIUWJg=";
+    hash = "sha256-iouGT3ZqCFW34ududrtCHL/NmKgB9SznLA8p313B12Y=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/gspread/default.nix

···
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.11.1";
+  version = "5.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "burnash";
     repo = "gspread";
     rev = "refs/tags/v${version}";
-    hash = "sha256-a8A47il9NrMdHkSX4YmQj4VIAYDXK5V+FUdwv+LGIfQ=";
+    hash = "sha256-geP01U34HzBSmA8FTTaTMlv508hzGBXFiASjGw3uUmQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/python-roborock/default.nix

···
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "0.33.2";
+  version = "0.34.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
···
     owner = "humbertogontijo";
     repo = "python-roborock";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UAQlKfh6oljeWtEGYx7JiT1z9yFCAXRSlI4Ot6JUnoQ=";
+    hash = "sha256-WLnMc2UQyjHaHRms6SEdF/TSum3Cf5NC3SGXHtGj6d0=";
   };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry-core==1.6.1" "poetry-core"
+  '';
 
   pythonRelaxDeps = [
     "pycryptodome"

pkgs/development/python-modules/softlayer/default.nix

···
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.1.8";
+  version = "6.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = pname;
     repo = "softlayer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6LZ2vy6nkyWA7xbUl4aNi2ygRWDJTj7J9Af0GTvNLd4=";
+    hash = "sha256-mYezVJSBtZuNT6mG544dJhRFh26M4nN4nE3tUVB3cZQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/universal-silabs-flasher/default.nix

···
 
 buildPythonPackage rec {
   pname = "universal-silabs-flasher";
-  version = "0.0.13";
+  version = "0.0.14";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "NabuCasa";
     repo = "universal-silabs-flasher";
     rev = "v${version}";
-    hash = "sha256-qiaDPCnVb6JQ2fZRFK+QF4o8K2UbIWGNKl5oo6MQUW0=";
+    hash = "sha256-0c9b571gJXFOAe5ct8O/qy7D6rDosmBHDYEv6odLQ2s=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/uproot/default.nix

···
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.0.11";
+  version = "5.0.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qp1iffElJSAwqaycelnILBzeW8kG7Yy0R1bjMumW8UU=";
+    hash = "sha256-5RJPRrnPRRj1KXeyCqrGwaurXPx0aT6gso1o7gQ1aNs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/zigpy/default.nix

···
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.57.1";
+  version = "0.57.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-aVrLiWPjc4xn2GvKmZCrRJGGbxP545PKqAH9rPq8IPo=";
+    hash = "sha256-v4H8syWbXqmfvOznRECgSjYi246+socPJTffb79MXK4=";
   };
 
   postPatch = ''

pkgs/development/python-modules/zwave-js-server-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "zwave-js-server-python";
-  version = "0.51.2";
+  version = "0.51.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.11";
···
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-SRBH7HdsgS60Z8y6ef5/VCunzMGBEWw0u1jR7wSByNc=";
+    hash = "sha256-79INvk5WLuSki/kBU25hMHRxGk7FAznU89U+y3Eh+wI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/gi-crystal/default.nix

···
 }:
 crystal.buildCrystalPackage rec {
   pname = "gi-crystal";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "gi-crystal";
     rev = "v${version}";
-    hash = "sha256-DIH8L8P8lkWzzVUj1Tbf9oTUvu9X7OT66APyUHiDkYk=";
+    hash = "sha256-9px6JRdVzsUoU5wlO+blH1OBGKskozF3WvqLV/EYiiA=";
   };
 
   # Make sure gi-crystal picks up the name of the so or dylib and not the leading nix store path

pkgs/servers/home-assistant/component-packages.nix

···
 # Do not edit!
 
 {
-  version = "2023.9.2";
+  version = "2023.9.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];

pkgs/servers/home-assistant/default.nix

···
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.9.2";
+  hassVersion = "2023.9.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
···
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pVW9NQYEf2pmGCp342lCzEiWfAyFCiWeRMVbhPd8wxQ=";
+    hash = "sha256-tcIGYJ+r2+0jnf3xUxnFdwnLiOK9P0Y6sw0Mpd/YIT0=";
   };
 
   # Secondary source is git for tests
···
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-4sZBrGd5gz4W7c7Ok5Bj/47MaXAqAFC4qufcidbU5zA=";
+    hash = "sha256-zAUMevj2xvRkhZg4wuHDz0+X//cEU/D/HmokmX9oeCU=";
   };
 
   nativeBuildInputs = with python.pkgs; [

pkgs/servers/home-assistant/intents.nix

···
 
 buildPythonPackage rec {
   pname = "home-assistant-intents";
-  version = "2023.8.2";
+  version = "2023.9.22";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "home-assistant";
     repo = "intents-package";
     rev = "refs/tags/${version}";
-    hash = "sha256-pNLH3GGfY8upKi7uYGZ466cIQkpdA16tR1tjwuiQ3JI=";
+    hash = "sha256-n0IIWS5edh4XD/W9Eo88pal2+zJQtrHg74FSGvPIlPg=";
     fetchSubmodules = true;
   };
 

pkgs/servers/home-assistant/stubs.nix

···
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.9.2";
+  version = "2023.9.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
···
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-cKBf7S6ZvLlRp0L23mDu1CvG7d1d34LaIev60JPD0TE=";
+    hash = "sha256-dZOpfSfq47sGJJB6CvcBDlSLBG8EVAX8RMuNzbP7bTs=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/tlp/default.nix

···
 , networkmanager
 }: stdenv.mkDerivation rec {
   pname = "tlp";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linrunner";
     repo = "TLP";
     rev = version;
-    hash = "sha256-XAyko2MxFyo5RyioaexhoFAR3E+I3t/8vD2K3WYNmsI=";
+    hash = "sha256-CxO1KU7F6sT5D8vjKOmntjDxcieoRSHTvuSqXfplcHk=";
   };
 
   # XXX: See patch files for relevant explanations.

pkgs/tools/wayland/wayland-proxy-virtwl/default.nix

···
     homepage = "https://github.com/talex5/wayland-virtwl-proxy";
     description = "Proxy Wayland connections across a VM boundary";
     license = licenses.asl20;
+    mainProgram = "wayland-proxy-virtwl";
     maintainers = [ maintainers.qyliss maintainers.sternenseemann ];
     platforms = platforms.linux;
   };

pkgs/top-level/all-packages.nix

···
 
   libmbim = callPackage ../development/libraries/libmbim { };
 
-  libmongocrypt = callPackage ../development/libraries/libmongocrypt { };
+  libmongocrypt = darwin.apple_sdk_11_0.callPackage ../development/libraries/libmongocrypt { };
 
   libmesode = callPackage ../development/libraries/libmesode { };
 
···
   firefox-beta-bin = res.wrapFirefox firefox-beta-bin-unwrapped {
     pname = "firefox-beta-bin";
     desktopName = "Firefox Beta";
-    wmClass = "firefox-beta";
   };
 
   firefox-devedition-bin-unwrapped = callPackage ../applications/networking/browsers/firefox-bin {
     inherit (gnome) adwaita-icon-theme;
-    channel = "devedition";
+    channel = "developer-edition";
     generated = import ../applications/networking/browsers/firefox-bin/devedition_sources.nix;
   };
 
   firefox-devedition-bin = res.wrapFirefox firefox-devedition-bin-unwrapped {
-    nameSuffix = "-devedition";
     pname = "firefox-devedition-bin";
     desktopName = "Firefox DevEdition";
-    wmClass = "firefox-devedition";
+    wmClass = "firefox-aurora";
   };
 
   librewolf-unwrapped = callPackage ../applications/networking/browsers/librewolf { };

pkgs/top-level/php-packages.nix

···
 
     relay = callPackage ../development/php-packages/relay { inherit php; };
 
+    rrd = callPackage ../development/php-packages/rrd { };
+
     smbclient = callPackage ../development/php-packages/smbclient { };
 
     snuffleupagus = callPackage ../development/php-packages/snuffleupagus {