Merge staging-next into staging

2023-05-10 00:03:33 +00:00 · 2023-05-10 00:03:33 +00:00 · 2d07e76d1a
parent a53aae8c3b 850af72cde
commit 2d07e76d1a
72 changed files with 10593 additions and 1359 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6792,6 +6792,15 @@
    githubId = 54999;
    name = "Ariel Nunez";
  };
+  Intuinewin = {
+    email = "antoinelabarussias@gmail.com";
+    github = "Intuinewin";
+    githubId = 13691729;
+    name = "Antoine Labarussias";
+    keys = [{
+      fingerprint = "5CB5 9AA0 D180 1997 2FB3  E0EC 943A 1DE9 372E BE4E";
+    }];
+  };
  ionutnechita = {
    email = "ionut_n2001@yahoo.com";
    github = "ionutnechita";
@ -7905,6 +7914,12 @@
    githubId = 2469618;
    name = "Junji Hashimoto";
  };
+  jurraca = {
+    email = "julienu@pm.me";
+    github = "jurraca";
+    githubId = 5124422;
+    name = "Julien Urraca";
+  };
  justinas = {
    email = "justinas@justinas.org";
    github = "justinas";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -292,6 +292,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `zplug` package changes its output path from `$out` to `$out/share/zplug`. Users should update their dependency on `${pkgs.zplug}/init.zsh` to `${pkgs.zplug}/share/zplug/init.zsh`.

+- The `pict-rs` package was updated from an 0.3 alpha release to 0.3 stable, and related environment variables now require two underscores instead of one.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/services/web-apps/pict-rs.nix
+++ b/nixos/modules/services/web-apps/pict-rs.nix
@ -34,8 +34,8 @@ in
  config = lib.mkIf cfg.enable {
    systemd.services.pict-rs = {
      environment = {
-        PICTRS_PATH = cfg.dataDir;
-        PICTRS_ADDR = "${cfg.address}:${toString cfg.port}";
+        PICTRS__PATH = cfg.dataDir;
+        PICTRS__ADDR = "${cfg.address}:${toString cfg.port}";
      };
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -2848,7 +2848,7 @@ let
        ''
        + optionalString (def.tokenBucketFilterConfig != { }) ''
          [TokenBucketFilter]
-          ${attrsToSection def.tockenBucketFilterConfig}
+          ${attrsToSection def.tokenBucketFilterConfig}
        ''
        + optionalString (def.pieConfig != { }) ''
          [PIE]
--- a/pkgs/applications/audio/in-formant/0001-Avoid-using-vendored-dependencies-we-have-in-nixpkgs.patch
+++ b/pkgs/applications/audio/in-formant/0001-Avoid-using-vendored-dependencies-we-have-in-nixpkgs.patch
@ -0,0 +1,47 @@
+From 42eda1afc1cfb0506b02baae894fb32f7e21755d Mon Sep 17 00:00:00 2001
+From: ckie <git-525ff67@ckie.dev>
+Date: Fri, 10 Mar 2023 04:39:38 +0200
+Subject: [PATCH] Avoid using vendored dependencies we have in nixpkgs
+
+---
+ CMakeLists.txt | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 136e7b0..5416da1 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -246,8 +246,6 @@ qt6_add_resources(RESOURCES_OBJ resources/qml.qrc)
+ qt6_add_big_resources(RESOURCES_OBJ resources/other.qrc)
+ set_property(SOURCE "${RESOURCES_OBJ}" PROPERTY SKIP_AUTOMOC ON)
+ 
+-set(ARMADILLO_INCLUDE_DIR external/armadillo/include)
+-set(TOMLPP_INCLUDE_DIR external/tomlplusplus/include)
+ 
+ ### SEARCH AUDIO MODULES 
+ 
+@@ -334,17 +332,15 @@ target_include_directories(in-formant SYSTEM PRIVATE ${ARMADILLO_INCLUDE_DIR} ${
+ target_link_libraries(in-formant PRIVATE Eigen3::Eigen ${FFTW_LIBRARIES} Qt6::Charts Qt6::Quick Qt6::QuickControls2 Qt6::QuickTemplates2 Qt6::Qml Qt6::Widgets Qt6::OpenGL Qt6::Gui Qt6::Core)
+ target_link_directories(in-formant PRIVATE ${FFTW_LIBRARY_DIRS})
+ 
+-set(BUILD_SHARED_LIBS TRUE)
+-add_subdirectory(external/freetype EXCLUDE_FROM_ALL)
+find_package(Freetype)
+ target_link_libraries(in-formant PRIVATE freetype)
+-set(BUILD_SHARED_LIBS)
+ 
+ add_subdirectory(external/rpmalloc EXCLUDE_FROM_ALL)
+ target_link_libraries(in-formant PRIVATE rpcxx_only)
+ 
+-add_subdirectory(external/libsamplerate)
+-target_link_libraries(in-formant PRIVATE lsr)
+-target_include_directories(in-formant PRIVATE external/libsamplerate/src)
+
+find_library(LIBSAMPLERATE_LIBRARY NAMES samplerate libsamplerate-0 samplerate-0)
+target_link_libraries(in-formant PRIVATE ${LIBSAMPLERATE_LIBRARY})
+ 
+ target_compile_definitions(in-formant PRIVATE
+     -DINFORMANT_VERSION=${CUR_VERSION} -DARMA_DONT_USE_WRAPPER
+-- 
+2.39.0
+
--- a/pkgs/applications/audio/in-formant/default.nix
+++ b/pkgs/applications/audio/in-formant/default.nix
@ -1,33 +1,56 @@
-{ stdenv, cmake, lib, fetchFromGitHub, qt5, fftw, libtorch-bin, portaudio, eigen
-, xorg, pkg-config, autoPatchelfHook, soxr
+{ stdenv
+, cmake
+, lib
+, fetchFromGitHub
+, wrapQtAppsHook
+, qtbase
+, qtcharts
+, fftw
+, libtorch-bin
+, portaudio
+, eigen
+, xorg
+, pkg-config
+, autoPatchelfHook
+, soxr
+, freetype
+, libsamplerate
+, armadillo
+, tomlplusplus
 }:

 stdenv.mkDerivation rec {
  pname = "in-formant";
-  version = "2021-06-30";
+  version = "unstable-2022-09-15";

-  # no Qt6 yet, so we're stuck in the last Qt5-supporting commit: https://github.com/NixOS/nixpkgs/issues/108008
  src = fetchFromGitHub {
    owner = "in-formant";
    repo = "in-formant";
-    rev = "e28e628cf5ff0949a7b046d220cc884f6035f31a";
-    sha256 = "sha256-YvtV0wGUNmI/+GGxrIfTk/l8tqUsWgc/LAI17X+AWGI=";
+    rev = "e0606feecff70f0fd4226ff8f116e46817dd7462";
+    hash = "sha256-/4eKny9M2e8Lb9LOiKBj9QLE00CAaD+2ZAwn48lnvKQ=";
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ cmake pkg-config qt5.wrapQtAppsHook autoPatchelfHook ];
+  patches = [
+    # Ignore the freetype sources bundled as a submodule:
+    # /nix/store/…-harfbuzz-7.0.0/lib/libharfbuzz.so.0: undefined reference to `FT_Get_Transform'
+    ./0001-Avoid-using-vendored-dependencies-we-have-in-nixpkgs.patch
+  ];
+
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook autoPatchelfHook ];

  buildInputs = [
-    qt5.qtbase
-    qt5.qtquickcontrols
-    qt5.qtquickcontrols2
-    qt5.qtcharts
+    qtbase
+    qtcharts
    fftw
    libtorch-bin
    portaudio
    eigen
    xorg.libxcb
    soxr
+    libsamplerate
+    armadillo
+    tomlplusplus
  ];

  installPhase = ''
@ -35,14 +58,12 @@ stdenv.mkDerivation rec {
    cp in-formant $out/bin
  '';

-  # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=ON" ];
-
  meta = with lib; {
    description = "A real-time pitch and formant tracking software";
    homepage = "https://github.com/in-formant/in-formant";
    license = licenses.asl20;
-    platforms = platforms.linux;
+    # currently broken on i686-linux and aarch64-linux due to other nixpkgs dependencies
+    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ ckie ];
  };
 }
--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256:1gn09kpkw8q2lxc8nic7hd1lhp0z4vscs8yvvxjzp1i9mw8s35xh";
+    hash = "sha256:0ijqnlh234pqkx6yzz2kxdnj8hnqarp2scq7gfsp8wpq7s42ivg8";
  };

-  vendorHash = "sha256-Y76Y3KR80dCx8+f6M0h5J6glGQGhXYE2KQM4jdJcDEM=";
+  vendorHash = "sha256-IbqE0aI7utYuu1XpQijEFVu/IpUDK6CQLu7g8GUR4e8=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/tfupdate/default.nix
+++ b/pkgs/applications/networking/cluster/tfupdate/default.nix
@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "tfupdate";
+  version = "0.6.7";
+
+  src = fetchFromGitHub {
+    owner = "minamijoyo";
+    repo = "tfupdate";
+    rev = "v${version}";
+    sha256 = "sha256-zDrmzubk5ScqZapp58U8NsyKl9yZ48VtWafamDdlWK0=";
+  };
+
+  vendorHash = "sha256-nhAeN/UXLR0QBb7PT9hdtNSz1whfXxt6SYejpLJbDbk=";
+
+  # Tests start http servers which need to bind to local addresses:
+  # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
+  __darwinAllowLocalNetworking = true;
+
+  meta = with lib; {
+    description = "Update version constraints in your Terraform configurations";
+    homepage = "https://github.com/minamijoyo/tfupdate";
+    changelog = "https://github.com/minamijoyo/tfupdate/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Intuinewin ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -48,23 +48,23 @@ let
  # and often with different versions.  We write them on three lines
  # like this (rather than using {}) so that the updater script can
  # find where to edit them.
-  versions.aarch64-darwin = "5.14.5.17687";
-  versions.x86_64-darwin = "5.14.5.17687";
-  versions.x86_64-linux = "5.14.5.2430";
+  versions.aarch64-darwin = "5.14.7.18149";
+  versions.x86_64-darwin = "5.14.7.18149";
+  versions.x86_64-linux = "5.14.7.2928";

  srcs = {
    aarch64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
      name = "zoomusInstallerFull.pkg";
-      hash = "sha256-cklNvp6q/4yGWpLhDbruGiBHgaQrY5wHwhtsVapRxx4=";
+      hash = "sha256-8Yu/1oDjTOpL5KbS/PJlGIHTRevBxkZ7/1Rp/dgpnOw=";
    };
    x86_64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-1w41TGBqUl8lnl08PglQImSV7JM71khlshacxh1oTJo=";
+      hash = "sha256-un4tV7fitm097ES9J2Ght3U2NUJSNiyouwwKrsNXL/w=";
    };
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-sf7w9P6Gajm8/D7DHo/u5d4kZwjxeJjAE96BUW/e4KE=";
+      hash = "sha256-xvJeVjzBKD1qxpr/t4sEhIWcqz3aQ4jllXoHX4pjrTU=";
    };
  };

--- a/pkgs/applications/radio/qdmr/default.nix
+++ b/pkgs/applications/radio/qdmr/default.nix
@ -52,7 +52,10 @@ stdenv.mkDerivation rec {
      --replace /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook\.xsl ${docbook_xsl_ns}/xml/xsl/docbook/manpages/docbook.xsl
  '';

-  cmakeFlags = [ "-DBUILD_MAN=ON" ];
+  cmakeFlags = [
+    "-DBUILD_MAN=ON"
+    "-DINSTALL_UDEV_RULES=OFF"
+  ];

  postInstall = ''
    installManPage doc/dmrconf.1 doc/qdmr.1
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@ -76,6 +76,19 @@ let
    # XDG_DATA_DIRS is used by pressure-vessel (steam proton) and vulkan loaders to find the corresponding icd
    export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share

+    # Following XDG spec [1], XDG_DATA_DIRS should default to "/usr/local/share:/usr/share".
+    # In nix, it is commonly set without containing these values, so we add them as fallback.
+    #
+    # [1] <https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html>
+    case ":$XDG_DATA_DIRS:" in
+      *:/usr/local/share:*) ;;
+      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/local/share" ;;
+    esac
+    case ":$XDG_DATA_DIRS:" in
+      *:/usr/share:*) ;;
+      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/share" ;;
+    esac
+
    # Force compilers and other tools to look in default search paths
    unset NIX_ENFORCE_PURITY
    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
--- a/pkgs/build-support/build-fhsenv-chroot/env.nix
+++ b/pkgs/build-support/build-fhsenv-chroot/env.nix
@ -63,6 +63,19 @@ let
    # XDG_DATA_DIRS is used by pressure-vessel (steam proton) and vulkan loaders to find the corresponding icd
    export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share

+    # Following XDG spec [1], XDG_DATA_DIRS should default to "/usr/local/share:/usr/share".
+    # In nix, it is commonly set without containing these values, so we add them as fallback.
+    #
+    # [1] <https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html>
+    case ":$XDG_DATA_DIRS:" in
+      *:/usr/local/share:*) ;;
+      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/local/share" ;;
+    esac
+    case ":$XDG_DATA_DIRS:" in
+      *:/usr/share:*) ;;
+      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/share" ;;
+    esac
+
    # Force compilers and other tools to look in default search paths
    unset NIX_ENFORCE_PURITY
    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
--- a/pkgs/desktops/deepin/go-package/dde-daemon/0005-fix-custom-wallpapers-path.diff
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/0005-fix-custom-wallpapers-path.diff
@ -0,0 +1,22 @@
+diff --git a/bin/dde-system-daemon/wallpaper.go b/bin/dde-system-daemon/wallpaper.go
+index d4af13da..1ff36f84 100644
+--- a/bin/dde-system-daemon/wallpaper.go
+++ b/bin/dde-system-daemon/wallpaper.go
+@@ -24,7 +24,7 @@ import (
+ 
+ const maxCount = 5
+ const maxSize = 32 * 1024 * 1024
+-const wallPaperDir = "/usr/share/wallpapers/custom-wallpapers/"
+const wallPaperDir = "/var/lib/dde-daemon/wallpapers/custom-wallpapers/"
+ 
+ func GetUserDir(username string) (string, error) {
+ 	dir := filepath.Join(wallPaperDir, username)
+@@ -136,7 +136,7 @@ func (d *Daemon) SaveCustomWallPaper(sender dbus.Sender, username string, file s
+ 		"-u",
+ 		username,
+ 		"--",
+-		"head",
+		"@coreutils@/bin/head",
+ 		"-c",
+ 		"0",
+ 		file,
--- a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
@ -32,6 +32,9 @@
 , xdotool
 , getconf
 , dbus
+, coreutils
+, util-linux
+, dde-session-ui
 }:

 buildGoPackage rec {
@ -55,6 +58,10 @@ buildGoPackage rec {
      src = ./0004-aviod-use-hardcode-path.patch;
      inherit dbus;
    })
+    (substituteAll {
+      src = ./0005-fix-custom-wallpapers-path.diff;
+      inherit coreutils;
+    })
  ];

  postPatch = ''
@ -70,7 +77,7 @@ buildGoPackage rec {
    substituteInPlace system/uadp/crypto.go \
      --replace "/usr/share/uadp" "/var/lib/dde-daemon/uadp"

-    substituteInPlace appearance/background/{background.go,custom_wallpapers.go} accounts/user.go bin/dde-system-daemon/wallpaper.go \
+    substituteInPlace appearance/background/{background.go,custom_wallpapers.go} accounts/user.go \
     --replace "/usr/share/wallpapers" "/run/current-system/sw/share/wallpapers"

    substituteInPlace appearance/manager.go timedate/zoneinfo/zone.go \
@ -138,6 +145,12 @@ buildGoPackage rec {
    runHook postInstall
  '';

+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ util-linux dde-session-ui ]}"
+    )
+  '';
+
  postFixup = ''
    for f in "$out"/lib/deepin-daemon/*; do
      echo "Wrapping $f"
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@ -71,13 +71,13 @@ let

 in stdenv.mkDerivation rec {
  pname   = "yosys";
-  version = "0.27";
+  version = "0.28";

  src = fetchFromGitHub {
    owner = "YosysHQ";
    repo  = "yosys";
    rev   = "${pname}-${version}";
-    hash  = "sha256-u6SeVlmQVCF3xCGajxsv0ZAgMKg6aa6WdN3DLKTPNYo=";
+    hash  = "sha256-z550IAyo4Rbq9/S2Vwgec3sy7KH2n95PH0k8vo/pBSE=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/gsl-lite/default.nix
+++ b/pkgs/development/libraries/gsl-lite/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , ninja
 , installCompatHeader ? false
@ -18,6 +19,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-cuuix302bVA7dWa7EJoxJ+otf1rSzjWQK8DHJsVkQio=";
  };

+  patches = [
+    (fetchpatch {
+      name = "type-limits-cast-fix.patch";
+      url = "https://github.com/gsl-lite/gsl-lite/commit/13475be0e5bf5f464c398f4a07ef5c7684bc57c5.patch";
+      hash = "sha256-rSz7OBmgQ3KcQ971tS3Z3QNC+U4XmrPjgmuOyG7J6Bo=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ninja ];

  cmakeFlags = lib.mapAttrsToList
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, httpx
+, importlib-metadata
+, requests
+, tokenizers
+, aiohttp
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "anthropic";
+  version = "0.2.7";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2v3WF8eRIruXvFNjRRno3LoXt+dlpaI3LHf243RBJ+U=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    httpx
+    requests
+    tokenizers
+    aiohttp
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  # try downloading tokenizer in tests
+  # relates https://github.com/anthropics/anthropic-sdk-python/issues/24
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "anthropic"
+  ];
+
+  meta = with lib; {
+    description = "Anthropic's safety-first language model APIs";
+    homepage = "https://github.com/anthropics/anthropic-sdk-python";
+    changelog = "https://github.com/anthropics/anthropic-sdk-python/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, poetry-core
+, pythonOlder
+, requests
+, aiohttp
+, backoff
+}:
+
+buildPythonPackage rec {
+  pname = "cohere";
+  version = "4.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-koIDk7JPKb8lhBkwaX/o76AuaNrFaeapVp54RRxEY9U=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    requests
+    aiohttp
+    backoff
+  ];
+
+  # tests require CO_API_KEY
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "cohere"
+  ];
+
+  meta = with lib; {
+    description = "Simplify interfacing with the Cohere API";
+    homepage = "https://docs.cohere.com/docs";
+    changelog = "https://github.com/cohere-ai/cohere-python/blob/main/CHANGELOG.md#${builtins.replaceStrings ["."] [""] version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/flet-core/default.nix
+++ b/pkgs/development/python-modules/flet-core/default.nix
@ -0,0 +1,35 @@
+{ lib
+, python3
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "flet-core";
+  version = "0.6.2";
+  format = "pyproject";
+
+  src = fetchPypi {
+    pname = "flet_core";
+    inherit version;
+    hash = "sha256-WMkm+47xhuYz1HsiPfF7YbOCg7Xlbj9oHI9nVtwAb/w=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    typing-extensions
+    repath
+  ];
+
+  doCheck = false;
+
+  meta = {
+    description = "The library is the foundation of Flet framework and is not intended to be used directly";
+    homepage = "https://flet.dev/";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.heyimnova ];
+  };
+}
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@ -0,0 +1,50 @@
+{ lib
+, python3
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "flet";
+  version = "0.6.2";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-EDNATwO2N4jXVC5H1VmXqC9XGTnQo8vLvTEozRYZuj4=";
+  };
+
+  patches = [
+    ./pyproject.toml.patch
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    flet-core
+    typing-extensions
+    websocket-client
+    watchdog
+    oauthlib
+    websockets
+    httpx
+    packaging
+  ];
+
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "flet"
+  ];
+
+  meta = {
+    description = "A framework that enables you to easily build realtime web, mobile, and desktop apps in Python";
+    homepage = "https://flet.dev/";
+    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.heyimnova ];
+    mainProgram = "flet";
+  };
+}
--- a/pkgs/development/python-modules/flet/pyproject.toml.patch
+++ b/pkgs/development/python-modules/flet/pyproject.toml.patch
@ -0,0 +1,11 @@
+--- a/pyproject.toml
+++ b/pyproject.toml
+@@ -20,7 +20,7 @@ flet-core = "0.6.2"
+ python = "^3.7"
+ typing-extensions = { version = "^4.4.0", python = "<3.8" }
+ websocket-client = "^1.4.2"
+-watchdog = "^2.2.1"
+watchdog = ">=2.2.1"
+ oauthlib = "^3.2.2"
+ websockets = "^10.4"
+ httpx = "^0.23.3"
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@ -16,8 +16,12 @@
 , tenacity
 , bash
  # optional dependencies
+, anthropic
+, cohere
 , openai
+, nlpcloud
 , huggingface-hub
+, manifest-ml
 , torch
 , transformers
 , qdrant-client
@ -105,12 +109,12 @@ buildPythonPackage rec {

  passthru.optional-dependencies = {
    llms = [
-      # anthropic
-      # cohere
+      anthropic
+      cohere
      openai
-      # nlpcloud
+      nlpcloud
      huggingface-hub
-      # manifest-ml
+      manifest-ml
      torch
      transformers
    ];
@ -121,7 +125,7 @@ buildPythonPackage rec {
      openai
    ];
    cohere = [
-      # cohere
+      cohere
    ];
    embeddings = [
      sentence-transformers
@ -133,13 +137,13 @@ buildPythonPackage rec {
      azure-core
    ];
    all = [
-      # anthropic
-      # cohere
+      anthropic
+      cohere
      openai
-      # nlpcloud
+      nlpcloud
      huggingface-hub
      # jina
-      # manifest-ml
+      manifest-ml
      elasticsearch
      opensearch-py
      # google-search-results
--- a/pkgs/development/python-modules/manifest-ml/default.nix
+++ b/pkgs/development/python-modules/manifest-ml/default.nix
@ -0,0 +1,107 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, numpy
+, pydantic
+, redis
+, requests
+, aiohttp
+, sqlitedict
+, tenacity
+, tiktoken
+, xxhash
+, # optional dependencies
+  accelerate
+, flask
+, sentence-transformers
+, torch
+, transformers
+, fastapi
+, uvicorn
+, pillow
+, pg8000
+, sqlalchemy
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "manifest-ml";
+  version = "0.1.5";
+  format = "setuptools";
+
+  disalbed = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "HazyResearch";
+    repo = "manifest";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WKibIJv4eJ0IOCRgTl02Zusf0XNTPLBIyme6HMANr8I=";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    pydantic
+    redis
+    requests
+    aiohttp
+    sqlitedict
+    tenacity
+    tiktoken
+    xxhash
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  passthru.optional-dependencies = {
+    api = [
+      accelerate
+      # deepspeed
+      # diffusers
+      flask
+      sentence-transformers
+      torch
+      transformers
+    ];
+    app = [
+      fastapi
+      uvicorn
+    ];
+    diffusers = [
+      pillow
+    ];
+    gcp = [
+      pg8000
+      # cloud-sql-python-connector
+      sqlalchemy
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  pytestFlagsArray = [
+    # this file tries importing `deepspeed`, which is not yet packaged in nixpkgs
+    "--ignore=tests/test_huggingface_api.py"
+  ];
+
+  disabledTests = [
+    # these tests have db access
+    "test_init"
+    "test_key_get_and_set"
+    "test_get"
+    # this test has network access
+    "test_retry_handling"
+  ];
+
+  meta = with lib; {
+    description = "Manifest for Prompting Foundation Models";
+    homepage = "https://github.com/HazyResearch/manifest";
+    changelog = "https://github.com/HazyResearch/manifest/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/nlpcloud/default.nix
+++ b/pkgs/development/python-modules/nlpcloud/default.nix
@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "nlpcloud";
+  version = "1.0.41";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-LtwN1fF/lfvXrB30P0VvuVGnsG8p1ZAalDCYL/a9uGE=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "nlpcloud"
+  ];
+
+  meta = with lib; {
+    description = "Python client for the NLP Cloud API";
+    homepage = "https://nlpcloud.com/";
+    changelog = "https://github.com/nlpcloud/nlpcloud-python/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/pydicom-seg/default.nix
+++ b/pkgs/development/python-modules/pydicom-seg/default.nix
@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, pythonRelaxDepsHook
+, poetry-core
+, jsonschema
+, numpy
+, pydicom
+, simpleitk
+}:
+
+buildPythonPackage rec {
+  pname = "pydicom-seg";
+  version = "0.4.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "razorx89";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2Y3fZHKfZqdp5EU8HfVsmJ5JFfVGZuAR7+Kj7qaTiPM=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  pythonRelaxDeps = [
+    "jsonschema"
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    jsonschema
+    numpy
+    pydicom
+    simpleitk
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pydicom_seg"
+  ];
+
+  meta = with lib; {
+    description = "Medical segmentation file reading and writing";
+    homepage = "https://github.com/razorx89/pydicom-seg";
+    changelog = "https://github.com/razorx89/pydicom-seg/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/pysnooz/default.nix
+++ b/pkgs/development/python-modules/pysnooz/default.nix
@ -5,6 +5,7 @@
 , buildPythonPackage
 , events
 , fetchFromGitHub
+, fetchpatch
 , freezegun
 , home-assistant-bluetooth
 , poetry-core
@ -29,6 +30,16 @@ buildPythonPackage rec {
    hash = "sha256-K99sE9vxJo6grkp04DmTKOVqdfpQI0kUzJjSR6gnSew=";
  };

+  patches = [
+    (fetchpatch {
+      # fix tests against bleak 0.20.0+
+      # https://github.com/AustinBrunkhorst/pysnooz/pull/9
+      name = "pysnooz-bleak-0.20.0-compat.patch";
+      url = "https://github.com/AustinBrunkhorst/pysnooz/commit/594951051ceb40003975e61d64cfc683188d87d3.patch";
+      hash = "sha256-cWQt9V9IOB0YoW5zUR0PBTqS0a30fMTHpXH6CxWKRcc=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace 'transitions = "^0.8.11"' 'transitions = ">0.8.11"' \
--- a/pkgs/development/python-modules/repath/default.nix
+++ b/pkgs/development/python-modules/repath/default.nix
@ -0,0 +1,30 @@
+{ lib
+, python3
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "repath";
+  version = "0.9.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-gpITm6xqDkP9nXBgXU6NrrJdRmcuSE7TGiTHzgrvD7c=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    six
+  ];
+
+  pythonImportsCheck = [
+    "repath"
+  ];
+
+  meta = {
+    description = "A port of the node module path-to-regexp to Python";
+    homepage = "https://github.com/nickcoutsos/python-repath";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.heyimnova ];
+  };
+}
--- a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@ -13,15 +13,15 @@
 }:

 buildPythonPackage rec {
-  version = "6.0.0";
+  version = "6.1.0";
  pname = "robotframework-seleniumlibrary";

  # no tests included in PyPI tarball
  src = fetchFromGitHub {
    owner = "robotframework";
    repo = "SeleniumLibrary";
-    rev = "v${version}";
-    sha256 = "1rjzz6mrx4zavcck2ry8269rf3dkvvs1qfa9ra7dkppbarrjin3f";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-iCZU+9xFUPoyucdQ/26dgxAm8jRf92P3JyA2KqV8bYI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
@ -11,7 +11,7 @@
 buildPythonPackage rec {
  pname = "sphinxcontrib-spelling";
  version = "8.0.0";
-  format = "setuptools";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

--- a/pkgs/development/python-modules/stem/default.nix
+++ b/pkgs/development/python-modules/stem/default.nix
@ -1,9 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, python, mock }:
+{ lib, buildPythonPackage, fetchPypi, python, mock, pythonAtLeast }:

 buildPythonPackage rec {
  pname = "stem";
  version = "1.8.1";

+  # As of May 2023, the master branch of stem contains fixes for Python 3.11
+  # that the last release (1.8.1) doesn't. The test suite fails on both master
+  # and the 1.8.1 release, so disabling rather than switching to an unstable
+  # source.
+  disabled = pythonAtLeast "3.11";
+
  src = fetchPypi {
    inherit pname version;
    hash = "sha256-gdQ6fGaLqde8EQOy56kR6dFIKUs3PSelmujaee96Pi8=";
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@ -5,14 +5,14 @@

 buildPythonPackage rec {
  pname = "tlds";
-  version = "2023050800";
+  version = "2023050900";
  format = "setuptools";

  src = fetchFromGitHub {
-    owner = "mweinelt";
-    repo = "python-tlds";
+    owner = "kichik";
+    repo = "tlds";
    rev = "refs/tags/${version}";
-    hash = "sha256-uXYRkalJGJ2o8ptvKCkMBc/U+9DpgPGxINM8w21ZIKM=";
+    hash = "sha256-Fm2cRhUb1Gsr7mrcym/JjYAeG8f3RDhUnxzYIvpxmQE=";
  };

  pythonImportsCheck = [
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "radare2";
-  version = "5.8.4";
+  version = "5.8.6";

  src = fetchFromGitHub {
    owner = "radare";
    repo = "radare2";
    rev = "refs/tags/${version}";
-    hash = "sha256-Fbluq3Q/BgPwTVNKW28FJL+Ok46hDiBjwFt6KwN4anc=";
+    hash = "sha256-mKcwsxvWkeRNytGs+37jX9misxnQQgvKPY7LGNtRvZA=";
  };

  preBuild = ''
--- a/pkgs/development/tools/rust/cargo-supply-chain/default.nix
+++ b/pkgs/development/tools/rust/cargo-supply-chain/default.nix
@ -1,22 +1,31 @@
-{ lib, rustPlatform, fetchCrate, stdenv, Security }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-supply-chain";
-  version = "0.3.2";
+  version = "0.3.3";

-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-0WyaenLyD1MNkV+mzCIodhtkU6FqbGnuTdw6PvzIrVU=";
+  src = fetchFromGitHub {
+    owner = "rust-secure-code";
+    repo = "cargo-supply-chain";
+    rev = "v${version}";
+    hash = "sha256-KjeYB9TFbuJ2KPaObeM0ADs5F8uJJ6/czMPQjBUgIk8=";
  };

-  cargoSha256 = "sha256-K3qBhd090BUZyJIAbhPBCQpCwgudCSGL7i7EezOp66Y=";
+  cargoHash = "sha256-Fx1C4X0dQqePqLa+X+4ZDrIMFKBQ6J50nBApYXcGbFM=";

-  buildInputs = lib.optional stdenv.isDarwin Security;
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];

  meta = with lib; {
    description = "Gather author, contributor and publisher data on crates in your dependency graph";
    homepage = "https://github.com/rust-secure-code/cargo-supply-chain";
-    changelog = "https://github.com/rust-secure-code/cargo-supply-chain/blob/master/CHANGELOG.md";
+    changelog = "https://github.com/rust-secure-code/cargo-supply-chain/blob/${src.rev}/CHANGELOG.md";
    license = with licenses; [ asl20 mit zlib ]; # any of three
    maintainers = with maintainers; [ figsoda ];
  };
--- a/pkgs/development/tools/rust/rustup/Cargo.lock
+++ b/pkgs/development/tools/rust/rustup/Cargo.lock
--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@ -23,20 +23,17 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "rustup";
-  version = "1.25.2";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rustup";
    rev = version;
-    sha256 = "sha256-zFdw6P4yrLDshtF9A5MbkxFcUE8KvlZGx5qkW4LSPzw=";
+    sha256 = "sha256-rdhG9MdjWyvoaMGdjgFyCfQaoV48QtAZE7buA5TkDKg=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "home-0.5.3" = "sha256-lb+FGJmGnBm64pddhQWclErwFLFnd7scFcuA+auw1Rk=";
-    };
  };

  nativeBuildInputs = [ makeBinaryWrapper pkg-config ];
@ -62,12 +59,22 @@ rustPlatform.buildRustPackage rec {

  doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;

+  # skip failing tests
+  checkFlags = [
+    # auto-self-update mode is set to 'disable' for nix rustup
+    "--skip=suite::cli_exact::check_updates_none"
+    "--skip=suite::cli_exact::check_updates_some"
+    "--skip=suite::cli_exact::check_updates_with_update"
+    # rustup-init is not used in nix rustup
+    "--skip=suite::cli_ui::rustup_init_ui_doc_text_tests"
+  ];
+
  postInstall = ''
    pushd $out/bin
    mv rustup-init rustup
    binlinks=(
      cargo rustc rustdoc rust-gdb rust-lldb rls rustfmt cargo-fmt
-      cargo-clippy clippy-driver cargo-miri rust-gdbgui
+      cargo-clippy clippy-driver cargo-miri rust-gdbgui rust-analyzer
    )
    for link in ''${binlinks[@]}; do
      ln -s rustup $link
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@ -116,6 +116,7 @@ in buildFHSEnv rec {
    SDL2
    libusb1
    dbus-glib
+    gsettings-desktop-schemas
    ffmpeg
    libudev0-shim

--- a/pkgs/games/wyvern/cargo-lock.patch
+++ b/pkgs/games/wyvern/cargo-lock.patch
--- a/pkgs/games/wyvern/default.nix
+++ b/pkgs/games/wyvern/default.nix
@ -12,10 +12,12 @@ rustPlatform.buildRustPackage rec {

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-OjL3wEoh4fT2nKqb7lMefP5B0vYyUaTRj09OXPEVfW4=";
+    hash = "sha256-OjL3wEoh4fT2nKqb7lMefP5B0vYyUaTRj09OXPEVfW4=";
  };

-  cargoSha256 = "sha256-CL6VXe7heyBbGX0qI4uaD7g7DLiFbykSfOcWemnEe8U=";
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoHash = "sha256-cwk8yFt8JrYkYlNUW9n/bgMUA6jyOpG0TSh5C+eERLY=";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ openssl ];
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@ -0,0 +1,24 @@
+{ lib
+, config
+, buildPlatform
+, hostPlatform
+}:
+
+lib.makeScope
+  # Prevent using top-level attrs to protect against introducing dependency on
+  # non-bootstrap packages by mistake. Any top-level inputs must be explicitly
+  # declared here.
+  (extra: lib.callPackageWith ({ inherit lib config buildPlatform hostPlatform; } // extra))
+  (self: with self; {
+    inherit (callPackage ./utils.nix { }) fetchurl derivationWithMeta writeTextFile writeText runCommand;
+
+    inherit (callPackage ./stage0-posix { }) kaem m2libc mescc-tools mescc-tools-extra;
+
+    mes = callPackage ./mes { };
+    mes-libc = callPackage ./mes/libc.nix { };
+
+    ln-boot = callPackage ./ln-boot { };
+
+    tinycc-bootstrappable = callPackage ./tinycc/bootstrappable.nix { };
+    tinycc-mes = callPackage ./tinycc/mes.nix { };
+  })
--- a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
@ -0,0 +1,27 @@
+{ lib
+, runCommand
+, mes
+}:
+let
+  pname = "ln-boot";
+  version = "unstable-2023-05-01";
+
+  src = ./ln.c;
+in
+runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  meta = with lib; {
+    description = "Basic tool for creating symbolic links";
+    license = licenses.mit;
+    maintainers = with maintainers; [ emilytrau ];
+    mainProgram = "ln";
+    platforms = platforms.unix;
+  };
+} ''
+  mkdir -p ''${out}/bin
+  ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
+    -lc+tcc \
+    -o ''${out}/bin/ln \
+    ${src}
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
+++ b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int main(int argc, char** argv)
+{
+  if (argc != 4 || strcmp(argv[1], "-s")) {
+    fputs("Usage: ", stdout);
+    fputs(argv[0], stdout);
+    fputs("ln -s TARGET LINK_NAME\n", stdout);
+    exit(EXIT_FAILURE);
+  }
+
+  symlink(argv[2], argv[3]);
+  exit(EXIT_SUCCESS);
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@ -0,0 +1,189 @@
+{ lib
+, runCommand
+, fetchurl
+, writeText
+, callPackage
+, m2libc
+, mescc-tools
+}:
+let
+  pname = "mes";
+  version = "0.24.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/mes/mes-${version}.tar.gz";
+    sha256 = "0vp8v88zszh1imm3dvdfi3m8cywshdj7xcrsq4cgmss69s2y1nkx";
+  };
+
+  nyacc = callPackage ./nyacc.nix { inherit nyacc; };
+
+  config_h = builtins.toFile "config.h" ''
+    #undef SYSTEM_LIBC
+    #define MES_VERSION "${version}"
+  '';
+
+  sources = (import ./sources.nix).x86.linux.mescc;
+  inherit (sources) libc_mini_SOURCES libmescc_SOURCES libc_SOURCES mes_SOURCES;
+
+  # add symlink() to libc+tcc so we can use it in ln-boot
+  libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+
+  compile = sources:
+    lib.concatMapStringsSep
+      "\n"
+      (f: ''CC -c ''${MES_PREFIX}/${f}'')
+      sources;
+  replaceExt = ext: source:
+    lib.replaceStrings
+      [ ".c" ]
+      [ ext ]
+      (builtins.baseNameOf source);
+  archive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (replaceExt ".o") sources}";
+  sourceArchive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (replaceExt ".s") sources}";
+in
+runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  passthru = { inherit src nyacc; };
+
+  meta = with lib; {
+    description = "Scheme interpreter and C compiler for bootstrapping";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+}
+# Maintenance note:
+# Build steps have been adapted from build-aux/bootstrap.sh.in
+# as well as the live-bootstrap project
+# https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/mes-0.24.2/mes-0.24.2.kaem
+''
+  # Unpack source
+  ungz --file ${src} --output mes.tar
+  mkdir ''${out} ''${out}/bin ''${out}/share
+  cd ''${out}/share
+  untar --non-strict --file ''${NIX_BUILD_TOP}/mes.tar # ignore symlinks
+
+  MES_PREFIX=''${out}/share/mes-${version}
+  LIBDIR=''${MES_PREFIX}/lib
+
+  cd ''${MES_PREFIX}
+
+  cp ${config_h} include/mes/config.h
+
+  mkdir include/arch
+  cp include/linux/x86/syscall.h include/arch/syscall.h
+  cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
+
+  # Remove pregenerated files
+  rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
+
+  # These files are symlinked in the repo
+  cp mes/module/srfi/srfi-9-struct.mes mes/module/srfi/srfi-9.mes
+  cp mes/module/srfi/srfi-9/gnu-struct.mes mes/module/srfi/srfi-9/gnu.mes
+
+  # Fixes to support newer M2-Planet
+  catm x86_defs.M1 ${m2libc}/x86/x86_defs.M1 lib/m2/x86/x86_defs.M1
+  cp x86_defs.M1 lib/m2/x86/x86_defs.M1
+  rm x86_defs.M1
+
+  # Remove environment impurities
+  __GUILE_LOAD_PATH="\"''${MES_PREFIX}/mes/module:''${MES_PREFIX}/module:${nyacc.guilePath}\""
+  boot0_scm=mes/module/mes/boot-0.scm
+  guile_mes=mes/module/mes/guile.mes
+  replace --file ''${boot0_scm} --output ''${boot0_scm} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+  replace --file ''${guile_mes} --output ''${guile_mes} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+
+  module_mescc_scm=module/mescc/mescc.scm
+  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"M1\")" --replace-with "\"${mescc-tools}/bin/M1\""
+  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"HEX2\")" --replace-with "\"${mescc-tools}/bin/hex2\""
+  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"BLOOD_ELF\")" --replace-with "\"${mescc-tools}/bin/blood-elf\""
+  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+  mes_c=src/mes.c
+  replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+  replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+  # Increase runtime resource limits
+  gc_c=src/gc.c
+  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_ARENA\")" --replace-with "\"100000000\""
+  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_MAX_ARENA\")" --replace-with "\"100000000\""
+  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_STACK\")" --replace-with "\"6000000\""
+
+  # Create mescc.scm
+  mescc_in=scripts/mescc.scm.in
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"includedir\")" --replace-with "\"''${MES_PREFIX}/include\""
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
+  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
+  cp ''${mescc_in} ''${out}/bin/mescc.scm
+
+  # Build mes-m2
+  mes_cpu=x86
+  stage0_cpu=x86
+  kaem --verbose --strict --file kaem.run
+  cp bin/mes-m2 ''${out}/bin/mes-m2
+  chmod 555 ''${out}/bin/mes-m2
+
+
+  # Recompile Mes and Mes C library using mes-m2 bootstrapped Mes
+  cd ''${NIX_BUILD_TOP}
+  alias CC="''${out}/bin/mes-m2 -e main ''${out}/bin/mescc.scm -- -D HAVE_CONFIG_H=1 -I ''${MES_PREFIX}/include -I ''${MES_PREFIX}/include/linux/x86"
+  mkdir -p ''${LIBDIR}/x86-mes
+
+  # crt1.o
+  CC -c ''${MES_PREFIX}/lib/linux/x86-mes-mescc/crt1.c
+  cp crt1.o ''${LIBDIR}/x86-mes
+  cp crt1.s ''${LIBDIR}/x86-mes
+
+  # libc-mini.a
+  ${compile libc_mini_SOURCES}
+  ${archive "libc-mini.a" libc_mini_SOURCES}
+  ${sourceArchive "libc-mini.s" libc_mini_SOURCES}
+  cp libc-mini.a ''${LIBDIR}/x86-mes
+  cp libc-mini.s ''${LIBDIR}/x86-mes
+
+  # libmescc.a
+  ${compile libmescc_SOURCES}
+  ${archive "libmescc.a" libmescc_SOURCES}
+  ${sourceArchive "libmescc.s" libmescc_SOURCES}
+  cp libmescc.a ''${LIBDIR}/x86-mes
+  cp libmescc.s ''${LIBDIR}/x86-mes
+
+  # libc.a
+  ${compile libc_SOURCES}
+  ${archive "libc.a" libc_SOURCES}
+  ${sourceArchive "libc.s" libc_SOURCES}
+  cp libc.a ''${LIBDIR}/x86-mes
+  cp libc.s ''${LIBDIR}/x86-mes
+
+  # libc+tcc.a
+  # optimisation: don't recompile common libc sources
+  ${compile (lib.subtractLists libc_SOURCES libc_tcc_SOURCES)}
+  ${archive "libc+tcc.a" libc_tcc_SOURCES}
+  ${sourceArchive "libc+tcc.s" libc_tcc_SOURCES}
+  cp libc+tcc.a ''${LIBDIR}/x86-mes
+  cp libc+tcc.s ''${LIBDIR}/x86-mes
+
+  # Build mes itself
+  ${compile mes_SOURCES}
+  ''${out}/bin/mes-m2 -e main ''${out}/bin/mescc.scm -- \
+    --base-address 0x08048000 \
+    -L ''${MES_PREFIX}/lib \
+    -L . \
+    -lc \
+    -lmescc \
+    -nostdlib \
+    -o ''${out}/bin/mes \
+    crt1.o \
+    ${lib.concatMapStringsSep " " (replaceExt ".o") mes_SOURCES}
+
+  # Check
+  ''${out}/bin/mes --version
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
@ -0,0 +1,95 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash coreutils gnutar
+
+# Generate a sources.nix for a version of GNU mes. Creates lists of source files
+# from build-aux/configure-lib.sh.
+#
+# You may point this tool at a manually downloaded tarball, but more ideal is
+# using the source tarball from Nixpkgs. For example:
+#
+# MES_TARBALL="$(nix-build --no-link -A minimal-bootstrap.mes.src ../../../../..)"
+# ./gen-sources.sh "$MES_TARBALL" > ./new-sources.nix
+
+set -eu
+
+# Supported platforms
+ARCHS="x86"
+KERNELS="linux"
+COMPILERS="mescc gcc"
+
+
+format() {
+  echo -n "[ "
+  # Terrible hack to convert a newline-delimited string to space-delimited
+  echo $* | xargs printf '"%s" '
+  echo -n "]"
+}
+
+gen_sources() {
+  # Configuration variables used by configure-lib.sh
+  export mes_libc=mes
+  export mes_cpu=$1
+  export mes_kernel=$2
+  export compiler=$3
+
+  # Populate source file lists
+  source $CONFIGURE_LIB_SH
+
+  cat <<EOF
+  $mes_cpu.$mes_kernel.$compiler = {
+    libc_mini_SOURCES = $(format $libc_mini_SOURCES);
+    libmescc_SOURCES  = $(format $libmescc_SOURCES);
+    libtcc1_SOURCES   = $(format $libtcc1_SOURCES);
+    libc_SOURCES      = $(format $libc_SOURCES);
+    libc_tcc_SOURCES  = $(format $libc_tcc_SOURCES);
+    libc_gnu_SOURCES  = $(format $libc_gnu_SOURCES);
+    mes_SOURCES       = $(format $mes_SOURCES);
+  };
+EOF
+}
+
+
+MES_TARBALL=$1
+if [ ! -f $MES_TARBALL ]; then
+    echo "Provide path to mes-x.x.x.tar.gz as first argument" >&2
+    exit 1
+fi
+echo "Generating sources.nix from $MES_TARBALL" >&2
+
+TMP=$(mktemp -d)
+cd $TMP
+echo "Workdir: $TMP" >&2
+
+echo "Extracting $MES_TARBALL" >&2
+tar --strip-components 1 -xf $MES_TARBALL
+
+CONFIGURE_LIB_SH="$TMP/build-aux/configure-lib.sh"
+if [ ! -f $CONFIGURE_LIB_SH ]; then
+    echo "Could not find mes's configure-lib.sh script at $CONFIGURE_LIB_SH" >&2
+    exit 1
+fi
+
+# Create dummy config expected by configure-lib.sh
+touch config.sh
+chmod +x config.sh
+
+
+echo "Configuring with $CONFIGURE_LIB_SH" >&2
+
+cat <<EOF
+# This file is generated by ./gen-sources.sh.
+# Do not edit!
+{
+EOF
+
+for arch in $ARCHS; do
+  for kernel in $KERNELS; do
+    for compiler in $COMPILERS; do
+      gen_sources $arch $kernel $compiler
+    done
+  done
+done
+
+cat <<EOF
+}
+EOF
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@ -0,0 +1,62 @@
+{ lib
+, runCommand
+, ln-boot
+, mes
+, mes-libc
+}:
+let
+  pname = "mes-libc";
+  inherit (mes) version;
+
+  sources = (import ./sources.nix).x86.linux.gcc;
+  inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
+
+  prefix = "${mes}/share/mes-${version}";
+
+  # Concatenate all source files into a convenient bundle
+  # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
+  # compiled by tinycc
+  #
+  # Passing this many arguments is too much for kaem so we need to split
+  # the operation in two
+  firstLibc = lib.take 100 libc_gnu_SOURCES;
+  lastLibc = lib.drop 100 libc_gnu_SOURCES;
+in runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ ln-boot ];
+
+  passthru.CFLAGS = "-DHAVE_CONFIG_H=1 -I${mes-libc}/include -I${mes-libc}/include/linux/x86";
+
+  meta = with lib; {
+    description = "The Mes C Library";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+} ''
+  cd ${prefix}
+
+  # mescc compiled libc.a
+  mkdir -p ''${out}/lib/x86-mes
+  cp lib/x86-mes/libc.a ''${out}/lib/x86-mes
+
+  # libc.c
+  catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
+  catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
+
+  # crt{1,n,i}.c
+  cp lib/linux/x86-mes-gcc/crt1.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crtn.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crti.c ''${out}/lib
+
+  # libtcc1.c
+  catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}
+
+  # getopt.c
+  cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
+
+  # Install headers
+  ln -s ${prefix}/include ''${out}/include
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
@ -0,0 +1,39 @@
+{ lib
+, runCommand
+, fetchurl
+, nyacc
+}:
+let
+  pname = "nyacc";
+  # NYACC is a tightly coupled dependency of mes. This version is known to work
+  # with mes 0.24.2.
+  # https://git.savannah.gnu.org/cgit/mes.git/tree/INSTALL?h=v0.24.2&id=7562330ec746f09b4060d3081e3377fb7083897d#n31
+  version = "1.00.2";
+
+  src = fetchurl {
+    url = "mirror://savannah/nyacc/nyacc-${version}.tar.gz";
+    sha256 = "065ksalfllbdrzl12dz9d9dcxrv97wqxblslngsc6kajvnvlyvpk";
+  };
+in
+runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  passthru.guilePath = "${nyacc}/share/${pname}-${version}/module";
+
+  meta = with lib; {
+    description = "Modules for generating parsers and lexical analyzers";
+    longDescription = ''
+      Not Yet Another Compiler Compiler is a set of guile modules for
+      generating computer language parsers and lexical analyzers.
+    '';
+    homepage = "https://savannah.nongnu.org/projects/nyacc";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = platforms.all;
+  };
+} ''
+  ungz --file ${src} --output nyacc.tar
+  mkdir -p ''${out}/share
+  cd ''${out}/share
+  untar --file ''${NIX_BUILD_TOP}/nyacc.tar
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@ -0,0 +1,34 @@
+rec {
+  name = "stage0-posix-${version}-${rev}-source";
+  # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
+  version = "unstable-2023-05-02";
+  rev = "3189b5f325b7ef8b88e3edec7c1cde4fce73c76c";
+
+  # This 256 byte seed is the only pre-compiled binary in the bootstrap chain.
+  # While it is included in the stage0-posix source bundle and is synced with
+  # stage0-posix updates, we have split it out into its own derivation to highlight
+  # its unique status as a trusted binary seed.
+  hex0-seed = import <nix/fetchurl.nix> {
+    name = "hex0-seed-${version}";
+    url = "https://github.com/oriansj/bootstrap-seeds/raw/b1263ff14a17835f4d12539226208c426ced4fba/POSIX/x86/hex0-seed";
+    hash = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
+    executable = true;
+  };
+
+  # Packaged resources required for the first bootstrapping stage.
+  # Contains source code and 256-byte hex0 binary seed.
+  #
+  # We don't have access to utilities such as fetchgit and fetchzip since this
+  # is this is part of the bootstrap process and would introduce a circular
+  # dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
+  # with the unpack option, taking a NAR file as input. This requires source
+  # tarballs to be repackaged.
+  #
+  # To build see `make-bootstrap-sources.nix`
+  src = import <nix/fetchurl.nix> {
+    inherit name;
+    url = "https://github.com/emilytrau/bootstrap-tools-nar-mirror/releases/download/2023-05-02/${name}.nar.xz";
+    hash = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
+    unpack = true;
+  };
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
@ -0,0 +1,20 @@
+{ lib
+, newScope
+}:
+
+lib.makeScope newScope (self: with self; {
+  inherit (import ./bootstrap-sources.nix) version hex0-seed src;
+
+  m2libc = src + "/M2libc";
+
+  hex0 = callPackage ./hex0.nix { };
+
+  kaem = callPackage ./kaem { };
+  kaem-minimal = callPackage ./kaem/minimal.nix { };
+
+  inherit (callPackage ./stage0-posix-x86.nix { }) blood-elf-0 hex2 kaem-unwrapped M1 M2;
+
+  mescc-tools = callPackage ./mescc-tools { };
+
+  mescc-tools-extra = callPackage ./mescc-tools-extra { };
+})
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
@ -0,0 +1,28 @@
+{ lib
+, derivationWithMeta
+, hex0-seed
+, src
+, version
+}:
+derivationWithMeta {
+  inherit version;
+  pname = "hex0";
+  builder = hex0-seed;
+  args = [
+    "${src}/bootstrap-seeds/POSIX/x86/hex0_x86.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "Minimal assembler for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+
+  # Ensure the untrusted hex0-seed binary produces a known-good hex0
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
@ -0,0 +1,33 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, mescc-tools-extra
+, version
+}:
+
+# Once mescc-tools-extra is available we can install kaem at /bin/kaem
+# to make it findable in environments
+derivationWithMeta {
+  inherit version kaem-unwrapped;
+  pname = "kaem";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    (builtins.toFile "kaem-wrapper.kaem" ''
+      mkdir -p ''${out}/bin
+      cp ''${kaem-unwrapped} ''${out}/bin/kaem
+      chmod 555 ''${out}/bin/kaem
+    '')
+  ];
+  PATH = lib.makeBinPath [ mescc-tools-extra ];
+
+  meta = with lib; {
+    description = "Minimal build tool for running scripts on systems that lack any shell";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
@ -0,0 +1,24 @@
+{ lib
+, derivationWithMeta
+, src
+, hex0
+, version
+}:
+derivationWithMeta {
+  inherit version;
+  pname = "kaem-minimal";
+  builder = hex0;
+  args = [
+    "${src}/bootstrap-seeds/POSIX/x86/kaem-minimal.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "First stage minimal scriptable build tool for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+}
+
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@ -0,0 +1,46 @@
+# Packaged resources required for the first bootstrapping stage.
+# Contains source code and 256-byte hex0 binary seed.
+#
+# We don't have access to utilities such as fetchgit and fetchzip since this
+# is this is part of the bootstrap process and would introduce a circular
+# dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
+# with the unpack option, taking a NAR file as input. This requires source
+# tarballs to be repackaged.
+#
+# To build:
+#
+#   nix-build pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+#   => ./result/stage0-posix-$version-$rev-source.nar.xz
+#
+
+{ pkgs ? import ../../../../.. {} }:
+let
+  inherit (pkgs) callPackage runCommand fetchFromGitHub nix xz;
+
+  inherit (import ./bootstrap-sources.nix) name rev;
+
+  src = fetchFromGitHub {
+    owner = "oriansj";
+    repo = "stage0-posix";
+    inherit rev;
+    sha256 = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
+    fetchSubmodules = true;
+    postFetch = ''
+      # Remove vendored/duplicate M2libc's
+      echo "Removing duplicate M2libc"
+      rm -rf \
+        $out/M2-Mesoplanet/M2libc \
+        $out/M2-Planet/M2libc \
+        $out/mescc-tools/M2libc \
+        $out/mescc-tools-extra/M2libc
+    '';
+  };
+in
+runCommand name {
+  nativeBuildInputs = [ nix xz ];
+
+  passthru = { inherit src; };
+} ''
+  mkdir $out
+  nix-store --dump ${src} | xz -c > "$out/${name}.nar.xz"
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
@ -0,0 +1,39 @@
+# This is a modified version of mescc-tools-extra/mescc-tools-extra.kaem
+# https://github.com/oriansj/mescc-tools-extra/blob/ec53af69d6d2119b47b369cd0ec37ac806e7ad60/mescc-tools-extra.kaem
+# - Paths to build inputs have been changed for nix
+# - Added additional step to create $out directory
+
+## Copyright (C) 2017 Jeremiah Orians
+## This file is part of mescc-tools.
+##
+## mescc-tools is free software: you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation, either version 3 of the License, or
+## (at your option) any later version.
+##
+## mescc-tools is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+##
+## You should have received a copy of the GNU General Public License
+## along with mescc-tools.  If not, see <http://www.gnu.org/licenses/>.
+
+alias CC="${mescc-tools}/bin/M2-Mesoplanet --operating-system ${OPERATING_SYSTEM} --architecture ${ARCH} -f"
+cd ${src}/mescc-tools-extra
+
+# Create output folder
+CC mkdir.c -o ${TMP}/mkdir
+${TMP}/mkdir -p ${out}/bin
+
+CC sha256sum.c -o ${out}/bin/sha256sum
+CC match.c -o ${out}/bin/match
+CC mkdir.c -o ${out}/bin/mkdir
+CC untar.c -o ${out}/bin/untar
+CC ungz.c -o ${out}/bin/ungz
+CC unbz2.c -o ${out}/bin/unbz2
+CC catm.c -o ${out}/bin/catm
+CC cp.c -o ${out}/bin/cp
+CC chmod.c -o ${out}/bin/chmod
+CC rm.c -o ${out}/bin/rm
+CC replace.c -o ${out}/bin/replace
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
@ -0,0 +1,29 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, mescc-tools
+, src
+, version
+}:
+derivationWithMeta {
+  inherit version src mescc-tools;
+  pname = "mescc-tools-extra";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+
+  ARCH = "x86";
+  OPERATING_SYSTEM = "linux";
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools-extra";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
@ -0,0 +1,204 @@
+# This is a modified version of stage0-posix/x86/mescc-tools-full-kaem.kaem
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-full-kaem.kaem
+# - Paths to build inputs have been changed for nix
+
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+${mkdir} -p ${out}/bin
+${cp} ${M2} ${out}/bin/M2
+${chmod} 0555 ${out}/bin/M2
+${cp} ${M1} ${out}/bin/M1
+${chmod} 0555 ${out}/bin/M1
+${cp} ${hex2} ${out}/bin/hex2
+${chmod} 0555 ${out}/bin/hex2
+
+# M2-Mesoplanet searches for runtime dependencies in environment variables
+# We can hardcode them with the "replace" utility from mescc-tools-extra
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc.c \
+	--output ./cc_patched.c \
+	--match-on "env_lookup(\"M2LIBC_PATH\")" \
+	--replace-with "\"${m2libc}\""
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc_spawn.c \
+	--output ./cc_spawn_patched.c \
+	--match-on "env_lookup(\"PATH\")" \
+	--replace-with "\"${out}/bin:\""
+
+###############################################
+# Phase-12 Build M2-Mesoplanet from M2-Planet #
+###############################################
+
+${M2} --architecture ${ARCH} \
+  -f ${m2libc}/sys/types.h \
+  -f ${m2libc}/stddef.h \
+  -f ${m2libc}/${ARCH}/linux/fcntl.c \
+  -f ${m2libc}/fcntl.c \
+  -f ${m2libc}/${ARCH}/linux/unistd.c \
+  -f ${m2libc}/${ARCH}/linux/sys/stat.c \
+  -f ${m2libc}/stdlib.c \
+  -f ${m2libc}/stdio.h \
+  -f ${m2libc}/stdio.c \
+  -f ${m2libc}/string.c \
+  -f ${m2libc}/bootstrappable.c \
+  -f ${src}/M2-Mesoplanet/cc.h \
+  -f ${src}/M2-Mesoplanet/cc_globals.c \
+  -f ${src}/M2-Mesoplanet/cc_env.c \
+  -f ${src}/M2-Mesoplanet/cc_reader.c \
+  -f ./cc_spawn_patched.c \
+  -f ${src}/M2-Mesoplanet/cc_core.c \
+  -f ${src}/M2-Mesoplanet/cc_macro.c \
+  -f ./cc_patched.c \
+  --debug \
+  -o ./M2-Mesoplanet-1.M1
+
+${blood-elf-0} ${ENDIAN_FLAG} ${BLOOD_FLAG} -f ./M2-Mesoplanet-1.M1 -o ./M2-Mesoplanet-1-footer.M1
+
+${M1} --architecture ${ARCH} \
+  ${ENDIAN_FLAG} \
+  -f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+  -f ${m2libc}/${ARCH}/libc-full.M1 \
+  -f ./M2-Mesoplanet-1.M1 \
+  -f ./M2-Mesoplanet-1-footer.M1 \
+  -o ./M2-Mesoplanet-1.hex2
+
+${hex2} --architecture ${ARCH} \
+  ${ENDIAN_FLAG} \
+  --base-address ${BASE_ADDRESS} \
+  -f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+  -f ./M2-Mesoplanet-1.hex2 \
+  -o ${out}/bin/M2-Mesoplanet
+
+#################################################
+# Phase-13 Build final blood-elf from C sources #
+#################################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/stringify.c \
+	-f ${src}/mescc-tools/blood-elf.c \
+	--debug \
+	-o ./blood-elf-1.M1
+
+${blood-elf-0} ${BLOOD_FLAG} ${ENDIAN_FLAG} -f ./blood-elf-1.M1 -o ./blood-elf-1-footer.M1
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./blood-elf-1.M1 \
+	-f ./blood-elf-1-footer.M1 \
+	-o ./blood-elf-1.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./blood-elf-1.hex2 \
+	-o ${out}/bin/blood-elf
+
+# Now we have our shipping debuggable blood-elf, the rest will be down hill from
+# here as we have ALL of the core pieces of compiling and assembling debuggable
+# programs in a debuggable form with corresponding C source code.
+
+#############################################
+# Phase-14 Build get_machine from C sources #
+#############################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/get_machine.c \
+	--debug \
+	-o get_machine.M1
+
+${out}/bin/blood-elf ${BLOOD_FLAG} ${ENDIAN_FLAG} -f ./get_machine.M1 -o ./get_machine-footer.M1
+
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./get_machine.M1 \
+	-f ./get_machine-footer.M1 \
+	-o ./get_machine.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./get_machine.hex2 \
+	-o ${out}/bin/get_machine
+
+############################################
+# Phase-15 Build M2-Planet from M2-Planet  #
+############################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/M2-Planet/cc.h \
+	-f ${src}/M2-Planet/cc_globals.c \
+	-f ${src}/M2-Planet/cc_reader.c \
+	-f ${src}/M2-Planet/cc_strings.c \
+	-f ${src}/M2-Planet/cc_types.c \
+	-f ${src}/M2-Planet/cc_core.c \
+	-f ${src}/M2-Planet/cc_macro.c \
+	-f ${src}/M2-Planet/cc.c \
+	--debug \
+	-o ./M2-1.M1
+
+${out}/bin/blood-elf ${ENDIAN_FLAG} ${BLOOD_FLAG} -f ./M2-1.M1 -o ./M2-1-footer.M1
+
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./M2-1.M1 \
+	-f ./M2-1-footer.M1 \
+	-o ./M2-1.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./M2-1.hex2 \
+	-o ${out}/bin/M2-Planet
+
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
@ -0,0 +1,88 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, M1
+, M2
+, blood-elf-0
+, hex2
+, m2libc
+, src
+, version
+}:
+
+let
+  ARCH = "x86";
+  BLOOD_FLAG = " ";
+  BASE_ADDRESS = "0x8048000";
+  ENDIAN_FLAG = "--little-endian";
+
+  # We need a few tools from mescc-tools-extra to assemble the output folder
+  buildMesccToolsExtraUtil = name:
+    derivationWithMeta {
+      pname = "mescc-tools-extra-${name}";
+      builder = kaem-unwrapped;
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "build-${name}.kaem" ''
+          ''${M2} --architecture ''${ARCH} \
+            -f ''${m2libc}/sys/types.h \
+            -f ''${m2libc}/stddef.h \
+            -f ''${m2libc}/''${ARCH}/linux/fcntl.c \
+            -f ''${m2libc}/fcntl.c \
+            -f ''${m2libc}/''${ARCH}/linux/unistd.c \
+            -f ''${m2libc}/''${ARCH}/linux/sys/stat.c \
+            -f ''${m2libc}/stdlib.c \
+            -f ''${m2libc}/stdio.h \
+            -f ''${m2libc}/stdio.c \
+            -f ''${m2libc}/string.c \
+            -f ''${m2libc}/bootstrappable.c \
+            -f ''${src}/mescc-tools-extra/${name}.c \
+            --debug \
+            -o ${name}.M1
+
+          ''${blood-elf-0} ''${ENDIAN_FLAG} -f ${name}.M1 -o ${name}-footer.M1
+
+          ''${M1} --architecture ''${ARCH} \
+            ''${ENDIAN_FLAG} \
+            -f ''${m2libc}/''${ARCH}/''${ARCH}_defs.M1 \
+            -f ''${m2libc}/''${ARCH}/libc-full.M1 \
+            -f ${name}.M1 \
+            -f ${name}-footer.M1 \
+            -o ${name}.hex2
+
+          ''${hex2} --architecture ''${ARCH} \
+            ''${ENDIAN_FLAG} \
+            -f ''${m2libc}/''${ARCH}/ELF-''${ARCH}-debug.hex2 \
+            -f ${name}.hex2 \
+            --base-address ''${BASE_ADDRESS} \
+            -o ''${out}
+        '')
+      ];
+      inherit version M1 M2 blood-elf-0 hex2 m2libc src ARCH BLOOD_FLAG BASE_ADDRESS ENDIAN_FLAG;
+    };
+  mkdir = buildMesccToolsExtraUtil "mkdir";
+  cp = buildMesccToolsExtraUtil "cp";
+  chmod = buildMesccToolsExtraUtil "chmod";
+  replace = buildMesccToolsExtraUtil "replace";
+in
+derivationWithMeta {
+  pname = "mescc-tools";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+  inherit version M1 M2 blood-elf-0 hex2 mkdir cp chmod replace m2libc src ARCH BLOOD_FLAG BASE_ADDRESS ENDIAN_FLAG;
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix
@ -0,0 +1,345 @@
+# This is a translation of stage0-posix/stage0-posix/x86/mescc-tools-mini-kaem.kaem to nix
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-mini-kaem.kaem
+#
+# We have access to mini-kaem at this point but it doesn't support substituting
+# environment variables. Without variables there's no way of passing in store inputs,
+# or the $out path, other than as command line arguments directly
+
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+# Warning all binaries prior to the use of blood-elf will not be readable by
+# Objdump, you may need to use ndism or gdb to view the assembly in the binary.
+
+{ lib
+, derivationWithMeta
+, hex0
+, m2libc
+, src
+, version
+}:
+rec {
+  out = placeholder "out";
+
+  run = pname: builder: args:
+    derivationWithMeta {
+      inherit pname version builder args;
+
+      meta = with lib; {
+        description = "Collection of tools written for use in bootstrapping";
+        homepage = "https://github.com/oriansj/stage0-posix";
+        license = licenses.gpl3Plus;
+        maintainers = with maintainers; [ emilytrau ];
+        platforms = [ "i686-linux" ];
+      };
+    };
+
+  ################################
+  # Phase-1 Build hex1 from hex0 #
+  ################################
+
+  hex1 = run "hex1" hex0 ["${src}/x86/hex1_x86.hex0" out];
+
+  # hex1 adds support for single character labels and is available in various forms
+  # in mescc-tools/x86_bootstrap to allow you various ways to verify correctness
+
+  ################################
+  # Phase-2 Build hex2 from hex1 #
+  ################################
+
+  hex2-0 = run "hex2" hex1 ["${src}/x86/hex2_x86.hex1" out];
+
+  # hex2 adds support for long labels and absolute addresses thus allowing it
+  # to function as an effective linker for later stages of the bootstrap
+  # This is a minimal version which will be used to bootstrap a much more advanced
+  # version in a later stage.
+
+  #################################
+  # Phase-2b Build catm from hex2 #
+  #################################
+
+  catm = run "catm" hex2-0 ["${src}/x86/catm_x86.hex2" out];
+
+  # catm removes the need for cat or shell support for redirection by providing
+  # equivalent functionality via catm output_file input1 input2 ... inputN
+
+  ##############################
+  # Phase-3 Build M0 from hex2 #
+  ##############################
+
+  M0_hex2 = run "M0.hex2" catm [out "${src}/x86/ELF-i386.hex2" "${src}/x86/M0_x86.hex2"];
+  M0 = run "M0" hex2-0 [M0_hex2 out];
+
+  # M0 is the architecture specific version of M1 and is by design single
+  # architecture only and will be replaced by the C code version of M1
+
+  ################################
+  # Phase-4 Build cc_x86 from M0 #
+  ################################
+
+  cc_x86-0_hex2 = run "cc_x86-0.hex2" M0 ["${src}/x86/cc_x86.M1" out];
+  cc_x86-1_hex2 = run "cc_x86-1.hex2" catm [out "${src}/x86/ELF-i386.hex2" cc_x86-0_hex2];
+  cc_x86 = run "cc_x86" hex2-0 [cc_x86-1_hex2 out];
+
+  #######################################
+  # Phase-5 Build M2-Planet from cc_x86 #
+  #######################################
+
+  M2-0_c = run "M2-0.c" catm [
+    out
+    "${m2libc}/x86/linux/bootstrap.c"
+    "${src}/M2-Planet/cc.h"
+    "${m2libc}/bootstrappable.c"
+    "${src}/M2-Planet/cc_globals.c"
+    "${src}/M2-Planet/cc_reader.c"
+    "${src}/M2-Planet/cc_strings.c"
+    "${src}/M2-Planet/cc_types.c"
+    "${src}/M2-Planet/cc_core.c"
+    "${src}/M2-Planet/cc_macro.c"
+    "${src}/M2-Planet/cc.c"
+  ];
+  M2-0_M1 = run "M2-0.M1" cc_x86 [M2-0_c out];
+  M2-0-0_M1 = run "M2-0-0.M1" catm [out "${src}/x86/x86_defs.M1" "${src}/x86/libc-core.M1" M2-0_M1];
+  M2-0_hex2 = run "M2-0.hex2" M0 [M2-0-0_M1 out];
+  M2-0-0_hex2 = run "M2-0-0.hex2" catm [out "${src}/x86/ELF-i386.hex2" M2-0_hex2];
+  M2 = run "M2" hex2-0 [M2-0-0_hex2 out];
+
+  ############################################
+  # Phase-6 Build blood-elf-0 from C sources #
+  ############################################
+
+  blood-elf-0_M1 = run "blood-elf-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/x86/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/blood-elf.c"
+    "--bootstrap-mode"
+    "-o" out
+  ];
+
+  blood-elf-0-0_M1 = run "blood-elf-0-0.M1" catm [out "${m2libc}/x86/x86_defs.M1" "${m2libc}/x86/libc-core.M1" blood-elf-0_M1];
+  blood-elf-0_hex2 = run "blood-elf-0.hex2" M0 [blood-elf-0-0_M1 out];
+  blood-elf-0-0_hex2 = run "blood-elf-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86.hex2" blood-elf-0_hex2];
+  blood-elf-0 = run "blood-elf-0" hex2-0 [blood-elf-0-0_hex2 out];
+
+  # This is the last stage where the binaries will not have debug info
+  # and the last piece built that isn't part of the output binaries
+
+  #####################################
+  # Phase-7 Build M1-0 from C sources #
+  #####################################
+
+  M1-macro-0_M1 = run "M1-macro-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/x86/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--bootstrap-mode"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-0-footer_M1 = run "M1-macro-0-footer.M1" blood-elf-0 ["-f" M1-macro-0_M1 "--little-endian" "-o" out];
+  M1-macro-0-0_M1 = run "M1-macro-0-0.M1" catm [out "${m2libc}/x86/x86_defs.M1" "${m2libc}/x86/libc-core.M1" M1-macro-0_M1 M1-macro-0-footer_M1];
+  M1-macro-0_hex2 = run "M1-macro-0.hex2" M0 [M1-macro-0-0_M1 out];
+  M1-macro-0-0_hex2 = run "M1-macro-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86-debug.hex2" M1-macro-0_hex2];
+  M1-0 = run "M1-0" hex2-0 [M1-macro-0-0_hex2 out];
+
+  # This is the last stage where catm will need to be used and the last stage where
+  # M0 is used, as we will being using it's much more powerful and cross-platform
+  # version with a bunch of extra goodies.
+
+  #######################################
+  # Phase-8 Build hex2-1 from C sources #
+  #######################################
+
+  hex2_linker-0_M1 = run "hex2_linker-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-0-footer_M1 = run "hex2_linker-0-footer.M1" blood-elf-0 ["-f" hex2_linker-0_M1 "--little-endian" "-o" out];
+
+  hex2_linker-0_hex2 = run "hex2_linker-0.hex2" M1-0 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" hex2_linker-0_M1
+    "-f" hex2_linker-0-footer_M1
+    "-o" out
+  ];
+
+  hex2_linker-0-0_hex2 = run "hex2_linker-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86-debug.hex2" hex2_linker-0_hex2];
+
+  hex2-1 = run "hex2-1" hex2-0 [hex2_linker-0-0_hex2 out];
+
+  # This is the last stage where we will be using the handwritten hex2 and instead
+  # be using the far more powerful, cross-platform version with a bunch more goodies
+
+  ###################################
+  # Phase-9 Build M1 from C sources #
+  ###################################
+
+  M1-macro-1_M1 = run "M1-macro-1.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-1-footer_M1 = run "M1-macro-1-footer.M1" blood-elf-0 ["-f" M1-macro-1_M1 "--little-endian" "-o" out];
+
+  M1-macro-1_hex2 = run "M1-macro-1.hex2" M1-0 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" M1-macro-1_M1
+    "-f" M1-macro-1-footer_M1
+    "-o" out
+  ];
+
+  M1 = run "M1" hex2-1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "--base-address" "0x8048000"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" M1-macro-1_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-10 Build hex2 from C sources #
+  ######################################
+
+  hex2_linker-2_M1 = run "hex2_linker-2.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-2-footer_M1 = run "hex2_linker-2-footer.M1" blood-elf-0 ["-f" hex2_linker-2_M1 "--little-endian" "-o" out];
+
+  hex2_linker-2_hex2 = run "hex2_linker-2.hex2" M1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" hex2_linker-2_M1
+    "-f" hex2_linker-2-footer_M1
+    "-o" out
+  ];
+
+  hex2 = run "hex2" hex2-1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "--base-address" "0x8048000"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" hex2_linker-2_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-11 Build kaem from C sources #
+  ######################################
+
+  kaem_M1 = run "kaem.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.h"
+    "-f" "${src}/mescc-tools/Kaem/variable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem_globals.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.c"
+    "--debug"
+    "-o" out
+  ];
+
+  kaem-footer_M1 = run "kaem-footer.M1" blood-elf-0 ["-f" kaem_M1 "--little-endian" "-o" out];
+
+  kaem_hex2 = run "kaem.hex2" M1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" kaem_M1
+    "-f" kaem-footer_M1
+    "-o" out
+  ];
+
+  kaem-unwrapped = run "kaem-unwrapped" hex2 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" kaem_hex2
+    "--base-address" "0x8048000"
+    "-o" out
+  ];
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
@ -0,0 +1,163 @@
+# Bootstrappable TCC is a fork from mainline TCC development
+# that can be compiled by MesCC
+
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.26/tcc-0.9.26.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, runCommand
+, callPackage
+, fetchurl
+, mes
+, mes-libc
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes;
+
+  version = "unstable-2023-04-20";
+  rev = "80114c4da6b17fbaabb399cc29f427e368309bc8";
+
+  tarball = fetchurl {
+    url = "https://gitlab.com/janneke/tinycc/-/archive/${rev}/tinycc-${rev}.tar.gz";
+    sha256 = "1a0cw9a62qc76qqn5sjmp3xrbbvsz2dxrw21lrnx9q0s74mwaxbq";
+  };
+  src = (runCommand "tinycc-bootstrappable-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+  '') + "/tinycc-${rev}";
+
+  meta = with lib; {
+    description = "Tiny C Compiler's bootstrappable fork";
+    homepage = "https://gitlab.com/janneke/tinycc";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+
+  tinycc-boot-mes = runCommand "tinycc-boot-mes-${version}" {} ''
+    catm config.h
+    ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
+      -S \
+      -o tcc.s \
+      -I . \
+      -D BOOTSTRAP=1 \
+      -I ${src} \
+      -D TCC_TARGET_I386=1 \
+      -D inline= \
+      -D CONFIG_TCCDIR=\"''${out}/lib\" \
+      -D CONFIG_SYSROOT=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"''${out}/lib\" \
+      -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+      -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
+      -D CONFIG_TCC_LIBTCC1_MES=0 \
+      -D CONFIG_TCCBOOT=1 \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_MES_LIBC=1 \
+      -D TCC_VERSION=\"${version}\" \
+      -D ONE_SOURCE=1 \
+      ${src}/tcc.c
+    mkdir -p ''${out}/bin
+    ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
+      -l c+tcc \
+      -o ''${out}/bin/tcc \
+      tcc.s
+
+    ''${out}/bin/tcc -version
+
+    # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+    mkdir -p ''${out}/lib
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libc.o ${mes-libc}/lib/libc.c
+    ''${out}/bin/tcc -ar cr ''${out}/lib/libc.a libc.o
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libtcc1.o ${mes-libc}/lib/libtcc1.c
+    ''${out}/bin/tcc -ar cr ''${out}/lib/libtcc1.a libtcc1.o
+    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libgetopt.o ${mes-libc}/lib/libgetopt.c
+    ''${out}/bin/tcc -ar cr ''${out}/lib/libgetopt.a libgetopt.o
+  '';
+
+  # Bootstrap stage build flags obtained from
+  # https://gitlab.com/janneke/tinycc/-/blob/80114c4da6b17fbaabb399cc29f427e368309bc8/boot.sh
+
+  tinycc-boot0 = buildTinyccMes {
+    pname = "tinycc-boot0";
+    inherit src version meta;
+    prev = tinycc-boot-mes;
+    buildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+    ];
+  };
+
+  tinycc-boot1 = buildTinyccMes {
+    pname = "tinycc-boot1";
+    inherit src version meta;
+    prev = tinycc-boot0;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot2 = buildTinyccMes {
+    pname = "tinycc-boot2";
+    inherit src version meta;
+    prev = tinycc-boot1;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot3 = buildTinyccMes {
+    pname = "tinycc-boot3";
+    inherit src version meta;
+    prev = tinycc-boot2;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-bootstrappable";
+  inherit src version meta;
+  prev = tinycc-boot3;
+  buildOptions = [
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+  ];
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
@ -0,0 +1,69 @@
+{ lib
+, runCommand
+, mes-libc
+, ln-boot
+}:
+{
+  buildTinyccMes = {
+    pname,
+    version,
+    src,
+    prev,
+    buildOptions,
+    libtccBuildOptions,
+    meta
+  }:
+    let
+      options = lib.strings.concatStringsSep " " buildOptions;
+      libtccOptions = lib.strings.concatStringsSep " " libtccBuildOptions;
+    in
+    runCommand "${pname}-${version}" {
+      inherit pname version meta;
+      nativeBuildInputs = [ ln-boot ];
+    } ''
+      catm config.h
+      mkdir -p ''${out}/bin
+      ${prev}/bin/tcc \
+        -g \
+        -v \
+        -static \
+        -o ''${out}/bin/tcc \
+        -D BOOTSTRAP=1 \
+        ${options} \
+        -I . \
+        -I ${src} \
+        -D TCC_TARGET_I386=1 \
+        -D CONFIG_TCCDIR=\"''${out}/lib\" \
+        -D CONFIG_TCC_CRTPREFIX=\"''${out}/lib\" \
+        -D CONFIG_TCC_ELFINTERP=\"\" \
+        -D CONFIG_TCC_LIBPATHS=\"''${out}/lib\" \
+        -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include:${src}/include\" \
+        -D TCC_LIBGCC=\"libc.a\" \
+        -D TCC_LIBTCC1=\"libtcc1.a\" \
+        -D CONFIG_TCCBOOT=1 \
+        -D CONFIG_TCC_STATIC=1 \
+        -D CONFIG_USE_LIBGCC=1 \
+        -D TCC_MES_LIBC=1 \
+        -D TCC_VERSION=\"${version}\" \
+        -D ONE_SOURCE=1 \
+        -L ${prev}/lib \
+        ${src}/tcc.c
+
+      ''${out}/bin/tcc -v
+
+      # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+      mkdir -p ''${out}/lib
+      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
+      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
+      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
+      ''${out}/bin/tcc -c -D TCC_TARGET_I386=1 ${libtccOptions} -o libtcc1.o ${src}/lib/libtcc1.c
+      ''${out}/bin/tcc -ar cr ''${out}/lib/libtcc1.a libtcc1.o
+      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libc.o ${mes-libc}/lib/libc.c
+      ''${out}/bin/tcc -ar cr ''${out}/lib/libc.a libc.o
+      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libgetopt.o ${mes-libc}/lib/libgetopt.c
+      ''${out}/bin/tcc -ar cr ''${out}/lib/libgetopt.a libgetopt.o
+
+      # Install headers
+      ln -s ${mes-libc}/include ''${out}/include
+    '';
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
@ -0,0 +1,87 @@
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.27/tcc-0.9.27.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, runCommand
+, fetchurl
+, callPackage
+, tinycc-bootstrappable
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes;
+
+  version = "unstable-2023-04-20";
+  rev = "86f3d8e33105435946383aee52487b5ddf918140";
+
+  tarball = fetchurl {
+    url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
+    sha256 = "11idrvbwfgj1d03crv994mpbbbyg63j1k64lw1gjy7mkiifw2xap";
+  };
+  src = (runCommand "tinycc-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+  '') + "/tinycc-${builtins.substring 0 7 rev}";
+
+  meta = with lib; {
+    description = "Small, fast, and embeddable C compiler and interpreter";
+    homepage = "https://repo.or.cz/w/tinycc.git";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = [ "i686-linux" ];
+  };
+
+  tccdefs = runCommand "tccdefs-${version}" {} ''
+    mkdir ''${out}
+    ${tinycc-bootstrappable}/bin/tcc -static -DC2STR -o c2str ${src}/conftest.c
+    ./c2str ${src}/include/tccdefs.h ''${out}/tccdefs_.h
+  '';
+
+  tinycc-mes-boot = buildTinyccMes {
+    pname = "tinycc-mes-boot";
+    inherit src version meta;
+    prev = tinycc-bootstrappable;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-mes";
+  inherit src version meta;
+  prev = tinycc-mes-boot;
+  buildOptions = [
+    "-std=c99"
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+}
--- a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@ -0,0 +1,83 @@
+{ lib
+, buildPlatform
+, callPackage
+, kaem
+, mescc-tools
+, mescc-tools-extra
+}:
+
+let
+  checkMeta = callPackage ../../../stdenv/generic/check-meta.nix { };
+in
+rec {
+  fetchurl = import ../../../build-support/fetchurl/boot.nix {
+    inherit (buildPlatform) system;
+  };
+
+  derivationWithMeta = attrs:
+    let
+      passthru = attrs.passthru or {};
+      validity = checkMeta.assertValidity { inherit meta attrs; };
+      meta = checkMeta.commonMeta { inherit validity attrs; };
+    in
+    lib.extendDerivation
+      validity.handled
+      ({ inherit meta passthru; } // passthru)
+      (derivation ({
+        inherit (buildPlatform) system;
+        inherit (meta) name;
+      } // (builtins.removeAttrs attrs [ "meta" "passthru" ])));
+
+  writeTextFile =
+    { name # the name of the derivation
+    , text
+    , executable ? false # run chmod +x ?
+    , destination ? ""   # relative path appended to $out eg "/bin/foo"
+    , allowSubstitutes ? false
+    , preferLocalBuild ? true
+    }:
+    derivationWithMeta {
+      inherit name text executable allowSubstitutes preferLocalBuild;
+      passAsFile = [ "text" ];
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "write-text-file.kaem" ''
+          target=''${out}''${destination}
+          if match x''${mkdirDestination} x1; then
+            mkdir -p ''${out}''${destinationDir}
+          fi
+          cp ''${textPath} ''${target}
+          if match x''${executable} x1; then
+            chmod 555 ''${target}
+          fi
+        '')
+      ];
+
+      PATH = lib.makeBinPath [ mescc-tools-extra ];
+      mkdirDestination = if builtins.dirOf destination == "." then "0" else "1";
+      destinationDir = builtins.dirOf destination;
+      inherit destination;
+    };
+
+  writeText = name: text: writeTextFile {inherit name text;};
+
+  runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name;
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (writeText "${name}-builder" buildCommand)
+      ];
+
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [ kaem mescc-tools mescc-tools-extra ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+}
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
  pname = "minio";
-  version = "2023-04-28T18-11-17Z";
+  version = "2023-05-04T21-44-30Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-aNJ0HbFMl5Ihm5zmxS/1AMxxE3FobraBn4Kahl0bqpA=";
+    sha256 = "sha256-CSB7QFKb96QVgcBlfP+ghVlLlPGkcI0um6hC2rp+CWc=";
  };

-  vendorHash = "sha256-6O6fuScGu7OBNC/iJAzV7AXGz0pAodEiqXhRpRTY9e0=";
+  vendorHash = "sha256-EthPqudNGnXTixnDRbRXdgOfJHIrIYZ8IHy5BZLSwJQ=";

  doCheck = false;

--- a/pkgs/servers/nostr-rs-relay/default.nix
+++ b/pkgs/servers/nostr-rs-relay/default.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, openssl
+, pkg-config
+, libiconv
+, darwin
+, protobuf
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nostr-rs-relay";
+  version = "0.8.9";
+  src = fetchFromGitHub {
+    owner = "scsibug";
+    repo = "nostr-rs-relay";
+    rev = version;
+    hash = "sha256-x5y/d76Qel8FMIlUn8NdwihWebJsNIt2it2vs/Xlk0Q=";
+  };
+
+  cargoHash = "sha256-1wgBABgcogHCk183AaTwbbSGk8d8FvlZYvw1//5y93I=";
+
+  buildInputs = [ openssl.dev ]
+    ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  nativeBuildInputs = [
+    pkg-config # for openssl
+    protobuf
+  ];
+
+  meta = with lib; {
+    description = "Nostr relay written in Rust";
+    homepage = "https://sr.ht/~gheartsfield/nostr-rs-relay/";
+    changelog = "https://github.com/scsibug/nostr-rs-relay/releases/tag/${version}";
+    maintainers = with maintainers; [ jurraca ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/servers/web-apps/pict-rs/Cargo.lock
+++ b/pkgs/servers/web-apps/pict-rs/Cargo.lock
--- a/pkgs/servers/web-apps/pict-rs/default.nix
+++ b/pkgs/servers/web-apps/pict-rs/default.nix
@ -13,17 +13,22 @@

 rustPlatform.buildRustPackage rec {
  pname = "pict-rs";
-  version = "0.3.0-alpha.37";
+  version = "0.3.3";

  src = fetchFromGitea {
    domain = "git.asonix.dog";
    owner = "asonix";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-21yfsCicn2bjSNEMMWDG8wvnw10uT3M1L3cXCUhc24c=";
+    sha256 = "mEZBFDR+/aMRFw54Yq+f1gyEz8H+5IggNCpzv3UdDFg=";
  };

-  cargoSha256 = "sha256-F/mqdIjF5QOq5Plnq0DyeFP1+b7dCBcoU9iFxzcaZws=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "aws-creds-0.29.1" = "bwDFmDPThMLrpaB7cAj/2/vJKhbX6/DqgcIRBVKSZhg=";
+    };
+  };

  # needed for internal protobuf c wrapper library
  PROTOC = "${protobuf}/bin/protoc";
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@ -545,7 +545,13 @@ lib.extendDerivation
       # binaries). By writing this to $out, Nix can find and register
       # them as runtime dependencies (since Nix greps for store paths
       # through $out to find them)
-       args = [ "-c" "export > $out" ];
+       args = [ "-c" ''
+         export > $out
+         for var in $passAsFile; do
+             pathVar="''${var}Path"
+             printf "%s" "$(< "''${!pathVar}")" >> $out
+         done
+       '' ];

       # inputDerivation produces the inputs; not the outputs, so any
       # restrictions on what used to be the outputs don't serve a purpose
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@ -142,6 +142,21 @@ in
    '';
  };

+  test-inputDerivation = let
+    inherit (stdenv.mkDerivation {
+      dep1 = derivation { name = "dep1"; builder = "/bin/sh"; args = [ "-c" ": > $out" ]; system = builtins.currentSystem; };
+      dep2 = derivation { name = "dep2"; builder = "/bin/sh"; args = [ "-c" ": > $out" ]; system = builtins.currentSystem; };
+      passAsFile = [ "dep2" ];
+    }) inputDerivation;
+  in
+    runCommand "test-inputDerivation" {
+      exportReferencesGraph = [ "graph" inputDerivation ];
+    } ''
+      grep ${inputDerivation.dep1} graph
+      grep ${inputDerivation.dep2} graph
+      touch $out
+    '';
+
  test-prepend-append-to-var = testPrependAndAppendToVar {
    name = "test-prepend-append-to-var";
    stdenv' = bootStdenv;
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@ -6,26 +6,24 @@

 stdenv.mkDerivation rec {
  pname = "vtm";
-  version = "0.9.8v";
+  version = "0.9.9h";

  src = fetchFromGitHub {
    owner = "netxs-group";
    repo = "vtm";
    rev = "v${version}";
-    sha256 = "sha256-7ECYbw51MXhYsbQxnuS4QUr5HN0cIUqgMx7V7D/kYTg=";
+    sha256 = "sha256-6JyOoEJoJ/y6pXfhQV4nei2NAOCClScFDscwqNPKZu8=";
  };

  nativeBuildInputs = [ cmake ];

  cmakeFlags = [ "../src" ];

-  meta = {
-    homepage = "https://vtm.netxs.online/";
+  meta = with lib; {
    description = "Terminal multiplexer with window manager and session sharing";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ ahuzik ];
-    # never built on aarch64-linux since first introduction in nixpkgs
-    broken = stdenv.isLinux && stdenv.isAarch64;
+    homepage = "https://vtm.netxs.online/";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ ahuzik ];
  };
 }
--- a/pkgs/tools/security/gowitness/default.nix
+++ b/pkgs/tools/security/gowitness/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gowitness";
-  version = "2.4.2";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "sensepost";
    repo = pname;
    rev = version;
-    sha256 = "sha256-e4J+W5VHVy/ngC5FDsDBStIaIR7jODWPt8VGTfAse44=";
+    sha256 = "sha256-rylft6v6Np8xOm2AUtH7e/zDZQ87WNPeerXEtziSrDw=";
  };

-  vendorSha256 = "sha256-NFQbulW07sljskjLn6A4f+PMMCJxploYqAHE+K7XxH8=";
+  vendorHash = "sha256-l6jdVsKKLqEyFpz7JhkLLjVTWX1pZenlCY5UqSZVMdc=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5489,6 +5489,8 @@ with pkgs;

  nixpkgs-pytools = with python3.pkgs; toPythonApplication nixpkgs-pytools;

+  nostr-rs-relay = callPackage ../servers/nostr-rs-relay { };
+
  notemap = callPackage ../tools/networking/notemap { };

  noteshrink = callPackage ../tools/misc/noteshrink { };
@ -8636,7 +8638,7 @@ with pkgs;

  imgurbash2 = callPackage ../tools/graphics/imgurbash2 { };

-  in-formant = callPackage ../applications/audio/in-formant { };
+  in-formant = qt6Packages.callPackage ../applications/audio/in-formant { };

  inadyn = callPackage ../tools/networking/inadyn { };

@ -16297,9 +16299,7 @@ with pkgs;
  cargo-spellcheck = callPackage ../development/tools/rust/cargo-spellcheck {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
-  cargo-supply-chain = callPackage ../development/tools/rust/cargo-supply-chain {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-supply-chain = callPackage ../development/tools/rust/cargo-supply-chain { };
  cargo-sweep = callPackage ../development/tools/rust/cargo-sweep { };
  cargo-sync-readme = callPackage ../development/tools/rust/cargo-sync-readme { };
  cargo-tally = callPackage ../development/tools/rust/cargo-tally { };
@ -26999,6 +26999,11 @@ with pkgs;

  metastore = callPackage ../os-specific/linux/metastore { };

+  minimal-bootstrap = recurseIntoAttrs (import ../os-specific/linux/minimal-bootstrap {
+    inherit (stdenv) buildPlatform hostPlatform;
+    inherit lib config;
+  });
+
  mingetty = callPackage ../os-specific/linux/mingetty { };

  miraclecast = callPackage ../os-specific/linux/miraclecast { };
@ -39484,6 +39489,8 @@ with pkgs;

  tfswitch = callPackage ../applications/networking/cluster/tfswitch { };

+  tfupdate = callPackage ../applications/networking/cluster/tfupdate { };
+
  tgswitch = callPackage ../applications/networking/cluster/tgswitch { };

  tilt = callPackage ../applications/networking/cluster/tilt { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -516,6 +516,8 @@ self: super: with self; {

  ansiwrap = callPackage ../development/python-modules/ansiwrap { };

+  anthropic = callPackage ../development/python-modules/anthropic { };
+
  antlr4-python3-runtime = callPackage ../development/python-modules/antlr4-python3-runtime {
    inherit (pkgs) antlr4;
  };
@ -1657,6 +1659,8 @@ self: super: with self; {

  cexprtk = callPackage ../development/python-modules/cexprtk { };

+  cohere = callPackage ../development/python-modules/cohere { };
+
  coincurve = callPackage ../development/python-modules/coincurve {
    inherit (pkgs) secp256k1;
  };
@ -3667,6 +3671,10 @@ self: super: with self; {

  fleep = callPackage ../development/python-modules/fleep { };

+  flet = callPackage ../development/python-modules/flet { };
+
+  flet-core = callPackage ../development/python-modules/flet-core { };
+
  flexmock = callPackage ../development/python-modules/flexmock { };

  flickrapi = callPackage ../development/python-modules/flickrapi { };
@ -5909,6 +5917,8 @@ self: super: with self; {
    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
  };

+  manifest-ml = callPackage ../development/python-modules/manifest-ml { };
+
  manifestparser = callPackage ../development/python-modules/marionette-harness/manifestparser.nix { };

  manuel = callPackage ../development/python-modules/manuel { };
@ -6660,6 +6670,8 @@ self: super: with self; {

  nkdfu = callPackage ../development/python-modules/nkdfu { };

+  nlpcloud = callPackage ../development/python-modules/nlpcloud { };
+
  nltk = callPackage ../development/python-modules/nltk { };

  nnpdf = toPythonModule (pkgs.nnpdf.override {
@ -8279,6 +8291,8 @@ self: super: with self; {

  pydicom = callPackage ../development/python-modules/pydicom { };

+  pydicom-seg = callPackage ../development/python-modules/pydicom-seg { };
+
  pydigiham = callPackage ../development/python-modules/pydigiham { };

  pydispatcher = callPackage ../development/python-modules/pydispatcher { };
@ -10324,6 +10338,8 @@ self: super: with self; {

  reparser = callPackage ../development/python-modules/reparser { };

+  repath = callPackage ../development/python-modules/repath { };
+
  repeated-test = callPackage ../development/python-modules/repeated-test { };

  repocheck = callPackage ../development/python-modules/repocheck { };
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@ -6,6 +6,10 @@
   e.g.

   $ nix-build pkgs/top-level/release-cross.nix -A crossMingw32.nixUnstable --arg supportedSystems '[builtins.currentSystem]'
+
+   To build all of the bootstrapFiles bundles on every enabled platform, use:
+
+   $ nix-build --expr 'with import ./pkgs/top-level/release-cross.nix {supportedSystems = [builtins.currentSystem];}; builtins.mapAttrs (k: v: v.build) bootstrapTools'
 */

 { # The platforms *from* which we cross compile.