Merge branch 'master' into haskell-updates

lib/fileset/README.md

@@ -212,6 +212,5 @@ Here's a list of places in the library that need to be updated in the future:
 - > The file set library is currently somewhat limited but is being expanded to include more functions over time.
 
   in [the manual](../../doc/functions/fileset.section.md)
-- Once a tracing function exists, `__noEval` in [internal.nix](./internal.nix) should mention it
 - If/Once a function to convert `lib.sources` values into file sets exists, the `_coerce` and `toSource` functions should be updated to mention that function in the error when such a value is passed
 - If/Once a function exists that can optionally include a path depending on whether it exists, the error message for the path not existing in `_coerce` should mention the new function

lib/fileset/default.nix

@@ -6,12 +6,14 @@ let
     _coerceMany
     _toSourceFilter
     _unionMany
+    _printFileset
     ;
 
   inherit (builtins)
     isList
     isPath
     pathExists
+    seq
     typeOf
     ;
 
@@ -274,4 +276,93 @@ If a directory does not recursively contain any file, it is omitted from the sto
         _unionMany
       ];
 
+  /*
+    Incrementally evaluate and trace a file set in a pretty way.
+    This function is only intended for debugging purposes.
+    The exact tracing format is unspecified and may change.
+
+    This function takes a final argument to return.
+    In comparison, [`traceVal`](#function-library-lib.fileset.traceVal) returns
+    the given file set argument.
+
+    This variant is useful for tracing file sets in the Nix repl.
+
+    Type:
+      trace :: FileSet -> Any -> Any
+
+    Example:
+      trace (unions [ ./Makefile ./src ./tests/run.sh ]) null
+      =>
+      trace: /home/user/src/myProject
+      trace: - Makefile (regular)
+      trace: - src (all files in directory)
+      trace: - tests
+      trace:   - run.sh (regular)
+      null
+  */
+  trace =
+    /*
+    The file set to trace.
+
+    This argument can also be a path,
+    which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
+    */
+    fileset:
+    let
+      # "fileset" would be a better name, but that would clash with the argument name,
+      # and we cannot change that because of https://github.com/nix-community/nixdoc/issues/76
+      actualFileset = _coerce "lib.fileset.trace: argument" fileset;
+    in
+    seq
+      (_printFileset actualFileset)
+      (x: x);
+
+  /*
+    Incrementally evaluate and trace a file set in a pretty way.
+    This function is only intended for debugging purposes.
+    The exact tracing format is unspecified and may change.
+
+    This function returns the given file set.
+    In comparison, [`trace`](#function-library-lib.fileset.trace) takes another argument to return.
+
+    This variant is useful for tracing file sets passed as arguments to other functions.
+
+    Type:
+      traceVal :: FileSet -> FileSet
+
+    Example:
+      toSource {
+        root = ./.;
+        fileset = traceVal (unions [
+          ./Makefile
+          ./src
+          ./tests/run.sh
+        ]);
+      }
+      =>
+      trace: /home/user/src/myProject
+      trace: - Makefile (regular)
+      trace: - src (all files in directory)
+      trace: - tests
+      trace:   - run.sh (regular)
+      "/nix/store/...-source"
+  */
+  traceVal =
+    /*
+    The file set to trace and return.
+
+    This argument can also be a path,
+    which gets [implicitly coerced to a file set](#sec-fileset-path-coercion).
+    */
+    fileset:
+    let
+      # "fileset" would be a better name, but that would clash with the argument name,
+      # and we cannot change that because of https://github.com/nix-community/nixdoc/issues/76
+      actualFileset = _coerce "lib.fileset.traceVal: argument" fileset;
+    in
+    seq
+      (_printFileset actualFileset)
+      # We could also return the original fileset argument here,
+      # but that would then duplicate work for consumers of the fileset, because then they have to coerce it again
+      actualFileset;
 }

lib/fileset/internal.nix

@@ -7,11 +7,14 @@ let
     isString
     pathExists
     readDir
-    typeOf
+    seq
     split
+    trace
+    typeOf
     ;
 
   inherit (lib.attrsets)
+    attrNames
     attrValues
     mapAttrs
     setAttrByPath
@@ -103,7 +106,9 @@ rec {
   ];
 
   _noEvalMessage = ''
-    lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'';
+    lib.fileset: Directly evaluating a file set is not supported.
+      To turn it into a usable source, use `lib.fileset.toSource`.
+      To pretty-print the contents, use `lib.fileset.trace` or `lib.fileset.traceVal`.'';
 
   # The empty file set without a base path
   _emptyWithoutBase = {
@@ -114,8 +119,10 @@ rec {
     # The one and only!
     _internalIsEmptyWithoutBase = true;
 
-    # Double __ to make it be evaluated and ordered first
-    __noEval = throw _noEvalMessage;
+    # Due to alphabetical ordering, this is evaluated last,
+    # which makes the nix repl output nicer than if it would be ordered first.
+    # It also allows evaluating it strictly up to this error, which could be useful
+    _noEval = throw _noEvalMessage;
   };
 
   # Create a fileset, see ./README.md#fileset
@@ -137,8 +144,10 @@ rec {
       _internalBaseComponents = components parts.subpath;
       _internalTree = tree;
 
-      # Double __ to make it be evaluated and ordered first
-      __noEval = throw _noEvalMessage;
+      # Due to alphabetical ordering, this is evaluated last,
+      # which makes the nix repl output nicer than if it would be ordered first.
+      # It also allows evaluating it strictly up to this error, which could be useful
+      _noEval = throw _noEvalMessage;
     };
 
   # Coerce a value to a fileset, erroring when the value cannot be coerced.
@@ -237,22 +246,22 @@ rec {
       // value;
 
   /*
-    Simplify a filesetTree recursively:
-    - Replace all directories that have no files with `null`
+    A normalisation of a filesetTree suitable filtering with `builtins.path`:
+    - Replace all directories that have no files with `null`.
       This removes directories that would be empty
-    - Replace all directories with all files with `"directory"`
+    - Replace all directories with all files with `"directory"`.
       This speeds up the source filter function
 
     Note that this function is strict, it evaluates the entire tree
 
     Type: Path -> filesetTree -> filesetTree
   */
-  _simplifyTree = path: tree:
+  _normaliseTreeFilter = path: tree:
     if tree == "directory" || isAttrs tree then
       let
         entries = _directoryEntries path tree;
-        simpleSubtrees = mapAttrs (name: _simplifyTree (path + "/${name}")) entries;
-        subtreeValues = attrValues simpleSubtrees;
+        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
+        subtreeValues = attrValues normalisedSubtrees;
       in
       # This triggers either when all files in a directory are filtered out
       # Or when the directory doesn't contain any files at all
@@ -262,10 +271,112 @@ rec {
       else if all isString subtreeValues then
         "directory"
       else
-        simpleSubtrees
+        normalisedSubtrees
     else
       tree;
 
+  /*
+    A minimal normalisation of a filesetTree, intended for pretty-printing:
+    - If all children of a path are recursively included or empty directories, the path itself is also recursively included
+    - If all children of a path are fully excluded or empty directories, the path itself is an empty directory
+    - Other empty directories are represented with the special "emptyDir" string
+      While these could be replaced with `null`, that would take another mapAttrs
+
+    Note that this function is partially lazy.
+
+    Type: Path -> filesetTree -> filesetTree (with "emptyDir"'s)
+  */
+  _normaliseTreeMinimal = path: tree:
+    if tree == "directory" || isAttrs tree then
+      let
+        entries = _directoryEntries path tree;
+        normalisedSubtrees = mapAttrs (name: _normaliseTreeMinimal (path + "/${name}")) entries;
+        subtreeValues = attrValues normalisedSubtrees;
+      in
+      # If there are no entries, or all entries are empty directories, return "emptyDir".
+      # After this branch we know that there's at least one file
+      if all (value: value == "emptyDir") subtreeValues then
+        "emptyDir"
+
+      # If all subtrees are fully included or empty directories
+      # (both of which are coincidentally represented as strings), return "directory".
+      # This takes advantage of the fact that empty directories can be represented as included directories.
+      # Note that the tree == "directory" check allows avoiding recursion
+      else if tree == "directory" || all (value: isString value) subtreeValues then
+        "directory"
+
+      # If all subtrees are fully excluded or empty directories, return null.
+      # This takes advantage of the fact that empty directories can be represented as excluded directories
+      else if all (value: isNull value || value == "emptyDir") subtreeValues then
+        null
+
+      # Mix of included and excluded entries
+      else
+        normalisedSubtrees
+    else
+      tree;
+
+  # Trace a filesetTree in a pretty way when the resulting value is evaluated.
+  # This can handle both normal filesetTree's, and ones returned from _normaliseTreeMinimal
+  # Type: Path -> filesetTree (with "emptyDir"'s) -> Null
+  _printMinimalTree = base: tree:
+    let
+      treeSuffix = tree:
+        if isAttrs tree then
+          ""
+        else if tree == "directory" then
+          " (all files in directory)"
+        else
+          # This does "leak" the file type strings of the internal representation,
+          # but this is the main reason these file type strings even are in the representation!
+          # TODO: Consider removing that information from the internal representation for performance.
+          # The file types can still be printed by querying them only during tracing
+          " (${tree})";
+
+      # Only for attribute set trees
+      traceTreeAttrs = prevLine: indent: tree:
+        foldl' (prevLine: name:
+          let
+            subtree = tree.${name};
+
+            # Evaluating this prints the line for this subtree
+            thisLine =
+              trace "${indent}- ${name}${treeSuffix subtree}" prevLine;
+          in
+          if subtree == null || subtree == "emptyDir" then
+            # Don't print anything at all if this subtree is empty
+            prevLine
+          else if isAttrs subtree then
+            # A directory with explicit entries
+            # Do print this node, but also recurse
+            traceTreeAttrs thisLine "${indent}  " subtree
+          else
+            # Either a file, or a recursively included directory
+            # Do print this node but no further recursion needed
+            thisLine
+        ) prevLine (attrNames tree);
+
+      # Evaluating this will print the first line
+      firstLine =
+        if tree == null || tree == "emptyDir" then
+          trace "(empty)" null
+        else
+          trace "${toString base}${treeSuffix tree}" null;
+    in
+    if isAttrs tree then
+      traceTreeAttrs firstLine "" tree
+    else
+      firstLine;
+
+  # Pretty-print a file set in a pretty way when the resulting value is evaluated
+  # Type: fileset -> Null
+  _printFileset = fileset:
+    if fileset._internalIsEmptyWithoutBase then
+      trace "(empty)" null
+    else
+      _printMinimalTree fileset._internalBase
+        (_normaliseTreeMinimal fileset._internalBase fileset._internalTree);
+
   # Turn a fileset into a source filter function suitable for `builtins.path`
   # Only directories recursively containing at least one files are recursed into
   # Type: Path -> fileset -> (String -> String -> Bool)
@@ -273,7 +384,7 @@ rec {
     let
       # Simplify the tree, necessary to make sure all empty directories are null
       # which has the effect that they aren't included in the result
-      tree = _simplifyTree fileset._internalBase fileset._internalTree;
+      tree = _normaliseTreeFilter fileset._internalBase fileset._internalTree;
 
       # The base path as a string with a single trailing slash
       baseString =

lib/fileset/tests.sh

@@ -57,18 +57,35 @@ with lib.fileset;'
 expectEqual() {
     local actualExpr=$1
     local expectedExpr=$2
-    if ! actualResult=$(nix-instantiate --eval --strict --show-trace \
+    if actualResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/actualStderr \
         --expr "$prefixExpression ($actualExpr)"); then
-        die "$actualExpr failed to evaluate, but it was expected to succeed"
+        actualExitCode=$?
+    else
+        actualExitCode=$?
     fi
-    if ! expectedResult=$(nix-instantiate --eval --strict --show-trace \
+    actualStderr=$(< "$tmp"/actualStderr)
+
+    if expectedResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/expectedStderr \
         --expr "$prefixExpression ($expectedExpr)"); then
-        die "$expectedExpr failed to evaluate, but it was expected to succeed"
+        expectedExitCode=$?
+    else
+        expectedExitCode=$?
+    fi
+    expectedStderr=$(< "$tmp"/expectedStderr)
+
+    if [[ "$actualExitCode" != "$expectedExitCode" ]]; then
+        echo "$actualStderr" >&2
+        echo "$actualResult" >&2
+        die "$actualExpr should have exited with $expectedExitCode, but it exited with $actualExitCode"
     fi
 
     if [[ "$actualResult" != "$expectedResult" ]]; then
         die "$actualExpr should have evaluated to $expectedExpr:\n$expectedResult\n\nbut it evaluated to\n$actualResult"
     fi
+
+    if [[ "$actualStderr" != "$expectedStderr" ]]; then
+        die "$actualExpr should have had this on stderr:\n$expectedStderr\n\nbut it was\n$actualStderr"
+    fi
 }
 
 # Check that a nix expression evaluates successfully to a store path and returns it (without quotes).
@@ -84,14 +101,14 @@ expectStorePath() {
     crudeUnquoteJSON <<< "$result"
 }
 
-# Check that a nix expression fails to evaluate (strictly, coercing to json, read-write-mode).
+# Check that a nix expression fails to evaluate (strictly, read-write-mode).
 # And check the received stderr against a regex
 # The expression has `lib.fileset` in scope.
 # Usage: expectFailure NIX REGEX
 expectFailure() {
     local expr=$1
     local expectedErrorRegex=$2
-    if result=$(nix-instantiate --eval --strict --json --read-write-mode --show-trace 2>"$tmp/stderr" \
+    if result=$(nix-instantiate --eval --strict --read-write-mode --show-trace 2>"$tmp/stderr" \
         --expr "$prefixExpression $expr"); then
         die "$expr evaluated successfully to $result, but it was expected to fail"
     fi
@@ -101,16 +118,112 @@ expectFailure() {
     fi
 }
 
-# We conditionally use inotifywait in checkFileset.
+# Check that the traces of a Nix expression are as expected when evaluated.
+# The expression has `lib.fileset` in scope.
+# Usage: expectTrace NIX STR
+expectTrace() {
+    local expr=$1
+    local expectedTrace=$2
+
+    nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTrace \
+        --expr "$prefixExpression trace ($expr)" || true
+
+    actualTrace=$(sed -n 's/^trace: //p' "$tmp/stderrTrace")
+
+    nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTraceVal \
+        --expr "$prefixExpression traceVal ($expr)" || true
+
+    actualTraceVal=$(sed -n 's/^trace: //p' "$tmp/stderrTraceVal")
+
+    # Test that traceVal returns the same trace as trace
+    if [[ "$actualTrace" != "$actualTraceVal" ]]; then
+        cat "$tmp"/stderrTrace >&2
+        die "$expr traced this for lib.fileset.trace:\n\n$actualTrace\n\nand something different for lib.fileset.traceVal:\n\n$actualTraceVal"
+    fi
+
+    if [[ "$actualTrace" != "$expectedTrace" ]]; then
+        cat "$tmp"/stderrTrace >&2
+        die "$expr should have traced this:\n\n$expectedTrace\n\nbut this was actually traced:\n\n$actualTrace"
+    fi
+}
+
+# We conditionally use inotifywait in withFileMonitor.
 # Check early whether it's available
 # TODO: Darwin support, though not crucial since we have Linux CI
 if type inotifywait 2>/dev/null >/dev/null; then
-    canMonitorFiles=1
+    canMonitor=1
 else
-    echo "Warning: Not checking that excluded files don't get accessed since inotifywait is not available" >&2
-    canMonitorFiles=
+    echo "Warning: Cannot check for paths not getting read since the inotifywait command (from the inotify-tools package) is not available" >&2
+    canMonitor=
 fi
 
+# Run a function while monitoring that it doesn't read certain paths
+# Usage: withFileMonitor FUNNAME PATH...
+# - FUNNAME should be a bash function that:
+#   - Performs some operation that should not read some paths
+#   - Delete the paths it shouldn't read without triggering any open events
+# - PATH... are the paths that should not get read
+#
+# This function outputs the same as FUNNAME
+withFileMonitor() {
+    local funName=$1
+    shift
+
+    # If we can't monitor files or have none to monitor, just run the function directly
+    if [[ -z "$canMonitor" ]] || (( "$#" == 0 )); then
+        "$funName"
+    else
+
+        # Use a subshell to start the coprocess in and use a trap to kill it when exiting the subshell
+        (
+            # Assigned by coproc, makes shellcheck happy
+            local watcher watcher_PID
+
+            # Start inotifywait in the background to monitor all excluded paths
+            coproc watcher {
+                # inotifywait outputs a string on stderr when ready
+                # Redirect it to stdout so we can access it from the coproc's stdout fd
+                # exec so that the coprocess is inotify itself, making the kill below work correctly
+                # See below why we listen to both open and delete_self events
+                exec inotifywait --format='%e %w' --event open,delete_self --monitor "$@" 2>&1
+            }
+
+            # This will trigger when this subshell exits, no matter if successful or not
+            # After exiting the subshell, the parent shell will continue executing
+            trap 'kill "${watcher_PID}"' exit
+
+            # Synchronously wait until inotifywait is ready
+            while read -r -u "${watcher[0]}" line && [[ "$line" != "Watches established." ]]; do
+                :
+            done
+
+            # Call the function that should not read the given paths and delete them afterwards
+            "$funName"
+
+            # Get the first event
+            read -r -u "${watcher[0]}" event file
+
+            # With funName potentially reading files first before deleting them,
+            # there's only these two possible event timelines:
+            # - open*, ..., open*, delete_self, ..., delete_self: If some excluded paths were read
+            # - delete_self, ..., delete_self: If no excluded paths were read
+            # So by looking at the first event we can figure out which one it is!
+            # This also means we don't have to wait to collect all events.
+            case "$event" in
+                OPEN*)
+                    die "$funName opened excluded file $file when it shouldn't have"
+                    ;;
+                DELETE_SELF)
+                    # Expected events
+                    ;;
+                *)
+                    die "During $funName, Unexpected event type '$event' on file $file that should be excluded"
+                    ;;
+            esac
+        )
+    fi
+}
+
 # Check whether a file set includes/excludes declared paths as expected, usage:
 #
 # tree=(
@@ -120,7 +233,7 @@ fi
 # )
 # checkFileset './a' # Pass the fileset as the argument
 declare -A tree
-checkFileset() (
+checkFileset() {
     # New subshell so that we can have a separate trap handler, see `trap` below
     local fileset=$1
 
@@ -168,54 +281,21 @@ checkFileset() (
         touch "${filesToCreate[@]}"
     fi
 
-    # Start inotifywait in the background to monitor all excluded files (if any)
-    if [[ -n "$canMonitorFiles" ]] && (( "${#excludedFiles[@]}" != 0 )); then
-        coproc watcher {
-            # inotifywait outputs a string on stderr when ready
-            # Redirect it to stdout so we can access it from the coproc's stdout fd
-            # exec so that the coprocess is inotify itself, making the kill below work correctly
-            # See below why we listen to both open and delete_self events
-            exec inotifywait --format='%e %w' --event open,delete_self --monitor "${excludedFiles[@]}" 2>&1
-        }
-        # This will trigger when this subshell exits, no matter if successful or not
-        # After exiting the subshell, the parent shell will continue executing
-        # shellcheck disable=SC2154
-        trap 'kill "${watcher_PID}"' exit
-
-        # Synchronously wait until inotifywait is ready
-        while read -r -u "${watcher[0]}" line && [[ "$line" != "Watches established." ]]; do
-            :
-        done
-    fi
-
-    # Call toSource with the fileset, triggering open events for all files that are added to the store
     expression="toSource { root = ./.; fileset = $fileset; }"
-    storePath=$(expectStorePath "$expression")
 
-    # Remove all files immediately after, triggering delete_self events for all of them
-    rm -rf -- *
+    # We don't have lambda's in bash unfortunately,
+    # so we just define a function instead and then pass its name
+    # shellcheck disable=SC2317
+    run() {
+        # Call toSource with the fileset, triggering open events for all files that are added to the store
+        expectStorePath "$expression"
+        if (( ${#excludedFiles[@]} != 0 )); then
+            rm "${excludedFiles[@]}"
+        fi
+    }
 
-    # Only check for the inotify events if we actually started inotify earlier
-    if [[ -v watcher ]]; then
-        # Get the first event
-        read -r -u "${watcher[0]}" event file
-
-        # There's only these two possible event timelines:
-        # - open, ..., open, delete_self, ..., delete_self: If some excluded files were read
-        # - delete_self, ..., delete_self: If no excluded files were read
-        # So by looking at the first event we can figure out which one it is!
-        case "$event" in
-            OPEN)
-                die "$expression opened excluded file $file when it shouldn't have"
-                ;;
-            DELETE_SELF)
-                # Expected events
-                ;;
-            *)
-                die "Unexpected event type '$event' on file $file that should be excluded"
-                ;;
-        esac
-    fi
+    # Runs the function while checking that the given excluded files aren't read
+    storePath=$(withFileMonitor run "${excludedFiles[@]}")
 
     # For each path that should be included, make sure it does occur in the resulting store path
     for p in "${included[@]}"; do
@@ -230,7 +310,9 @@ checkFileset() (
             die "$expression included path $p when it shouldn't have"
         fi
     done
-)
+
+    rm -rf -- *
+}
 
 
 #### Error messages #####
@@ -281,8 +363,12 @@ expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.to
 expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` \('"$work"'/a\) does not exist.'
 
 # File sets cannot be evaluated directly
-expectFailure 'union ./. ./.' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
-expectFailure '_emptyWithoutBase' 'lib.fileset: Directly evaluating a file set is not supported. Use `lib.fileset.toSource` to turn it into a usable source instead.'
+expectFailure 'union ./. ./.' 'lib.fileset: Directly evaluating a file set is not supported.
+\s*To turn it into a usable source, use `lib.fileset.toSource`.
+\s*To pretty-print the contents, use `lib.fileset.trace` or `lib.fileset.traceVal`.'
+expectFailure '_emptyWithoutBase' 'lib.fileset: Directly evaluating a file set is not supported.
+\s*To turn it into a usable source, use `lib.fileset.toSource`.
+\s*To pretty-print the contents, use `lib.fileset.trace` or `lib.fileset.traceVal`.'
 
 # Past versions of the internal representation are supported
 expectEqual '_coerce "<tests>: value" { _type = "fileset"; _internalVersion = 0; _internalBase = ./.; }' \
@@ -501,6 +587,147 @@ done
 # So, just using 1000 files for now.
 checkFileset 'unions (mapAttrsToList (name: _: ./. + "/${name}/a") (builtins.readDir ./.))'
 
+## Tracing
+
+# The second trace argument is returned
+expectEqual 'trace ./. "some value"' 'builtins.trace "(empty)" "some value"'
+
+# The fileset traceVal argument is returned
+expectEqual 'traceVal ./.' 'builtins.trace "(empty)" (_create ./. "directory")'
+
+# The tracing happens before the final argument is needed
+expectEqual 'trace ./.' 'builtins.trace "(empty)" (x: x)'
+
+# Tracing an empty directory shows it as such
+expectTrace './.' '(empty)'
+
+# This also works if there are directories, but all recursively without files
+mkdir -p a/b/c
+expectTrace './.' '(empty)'
+rm -rf -- *
+
+# The empty file set without a base also prints as empty
+expectTrace '_emptyWithoutBase' '(empty)'
+expectTrace 'unions [ ]' '(empty)'
+
+# If a directory is fully included, print it as such
+touch a
+expectTrace './.' "$work"' (all files in directory)'
+rm -rf -- *
+
+# If a directory is not fully included, recurse
+mkdir a b
+touch a/{x,y} b/{x,y}
+expectTrace 'union ./a/x ./b' "$work"'
+- a
+  - x (regular)
+- b (all files in directory)'
+rm -rf -- *
+
+# If an included path is a file, print its type
+touch a x
+ln -s a b
+mkfifo c
+expectTrace 'unions [ ./a ./b ./c ]' "$work"'
+- a (regular)
+- b (symlink)
+- c (unknown)'
+rm -rf -- *
+
+# Do not print directories without any files recursively
+mkdir -p a/b/c
+touch b x
+expectTrace 'unions [ ./a ./b ]' "$work"'
+- b (regular)'
+rm -rf -- *
+
+# If all children are either fully included or empty directories,
+# the parent should be printed as fully included
+touch a
+mkdir b
+expectTrace 'union ./a ./b' "$work"' (all files in directory)'
+rm -rf -- *
+
+mkdir -p x/b x/c
+touch x/a
+touch a
+# If all children are either fully excluded or empty directories,
+# the parent should be shown (or rather not shown) as fully excluded
+expectTrace 'unions [ ./a ./x/b ./x/c ]' "$work"'
+- a (regular)'
+rm -rf -- *
+
+# Completely filtered out directories also print as empty
+touch a
+expectTrace '_create ./. {}' '(empty)'
+rm -rf -- *
+
+# A general test to make sure the resulting format makes sense
+# Such as indentation and ordering
+mkdir -p bar/{qux,someDir}
+touch bar/{baz,qux,someDir/a} foo
+touch bar/qux/x
+ln -s x bar/qux/a
+mkfifo bar/qux/b
+expectTrace 'unions [
+  ./bar/baz
+  ./bar/qux/a
+  ./bar/qux/b
+  ./bar/someDir/a
+  ./foo
+]' "$work"'
+- bar
+  - baz (regular)
+  - qux
+    - a (symlink)
+    - b (unknown)
+  - someDir (all files in directory)
+- foo (regular)'
+rm -rf -- *
+
+# For recursively included directories,
+# `(all files in directory)` should only be used if there's at least one file (otherwise it would be `(empty)`)
+# and this should be determined without doing a full search
+#
+# a is intentionally ordered first here in order to allow triggering the short-circuit behavior
+# We then check that b is not read
+# In a more realistic scenario, some directories might need to be recursed into,
+# but a file would be quickly found to trigger the short-circuit.
+touch a
+mkdir b
+# We don't have lambda's in bash unfortunately,
+# so we just define a function instead and then pass its name
+# shellcheck disable=SC2317
+run() {
+    # This shouldn't read b/
+    expectTrace './.' "$work"' (all files in directory)'
+    # Remove all files immediately after, triggering delete_self events for all of them
+    rmdir b
+}
+# Runs the function while checking that b isn't read
+withFileMonitor run b
+rm -rf -- *
+
+# Partially included directories trace entries as they are evaluated
+touch a b c
+expectTrace '_create ./. { a = null; b = "regular"; c = throw "b"; }' "$work"'
+- b (regular)'
+
+# Except entries that need to be evaluated to even figure out if it's only partially included:
+# Here the directory could be fully excluded or included just from seeing a and b,
+# so c needs to be evaluated before anything can be traced
+expectTrace '_create ./. { a = null; b = null; c = throw "c"; }' ''
+expectTrace '_create ./. { a = "regular"; b = "regular"; c = throw "c"; }' ''
+rm -rf -- *
+
+# We can trace large directories (10000 here) without any problems
+filesToCreate=({0..9}{0..9}{0..9}{0..9})
+expectedTrace=$work$'\n'$(printf -- '- %s (regular)\n' "${filesToCreate[@]}")
+# We need an excluded file so it doesn't print as `(all files in directory)`
+touch 0 "${filesToCreate[@]}"
+expectTrace 'unions (mapAttrsToList (n: _: ./. + "/${n}") (removeAttrs (builtins.readDir ./.) [ "0" ]))' "$expectedTrace"
+rm -rf -- *
+
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 
 echo >&2 tests ok

lib/licenses.nix

@@ -620,6 +620,12 @@ in mkLicense lset) ({
     free     = false;
   };
 
+  inria-zelus = {
+    fullName = "INRIA Non-Commercial License Agreement for the Zélus compiler";
+    url = "https://github.com/INRIA/zelus/raw/829f2b97cba93b0543a9ca0272269e6b8fdad356/LICENSE";
+    free = false;
+  };
+
   ipa = {
     spdxId = "IPA";
     fullName = "IPA Font License";

maintainers/maintainer-list.nix

@@ -13959,7 +13959,7 @@
     name = "Pedro Pombeiro";
   };
   pongo1231 = {
-    email = "pongo1999712@gmail.com";
+    email = "pongo12310@gmail.com";
     github = "pongo1231";
     githubId = 4201956;
     name = "pongo1231";

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -93,6 +93,9 @@
 
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
+- `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
+  Workarounds for this can be removed.
+
 - The `boot.loader.raspberryPi` options have been marked deprecated, with intent for removal for NixOS 24.11. They had a limited use-case, and do not work like people expect. They required either very old installs ([before mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds out of scope of the standard and generic AArch64 support. That option set never supported the Raspberry Pi 4 family of devices.
 
 - `python3.pkgs.sequoia` was removed in favor of `python3.pkgs.pysequoia`. The latter package is based on upstream's dedicated repository for sequoia's Python bindings, where the Python bindings from [gitlab:sequoia-pgp/sequoia](https://gitlab.com/sequoia-pgp/sequoia) were removed long ago.
@@ -376,6 +379,7 @@ The module update takes care of the new config syntax and the data itself (user
 
   If you use this feature, updates to CoreDNS may require updating `vendorHash` by following these steps again.
 
+- `fusuma` now enables the following plugins: [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher), [keypress](https://github.com/iberianpig/fusuma-plugin-keypress), [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey), [tap](https://github.com/iberianpig/fusuma-plugin-tap) and [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl).
 
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 

nixos/lib/systemd-lib.nix

@@ -80,6 +80,10 @@ in rec {
     optional (attr ? ${name} && !elem attr.${name} values)
       "Systemd ${group} field `${name}' cannot have value `${toString attr.${name}}'.";
 
+  assertValuesSomeOfOr = name: values: default: group: attr:
+    optional (attr ? ${name} && !(all (x: elem x values) (splitString " " attr.${name}) || attr.${name} == default))
+      "Systemd ${group} field `${name}' cannot have value `${toString attr.${name}}'.";
+
   assertHasField = name: group: attr:
     optional (!(attr ? ${name}))
       "Systemd ${group} field `${name}' must exist.";

nixos/modules/profiles/installation-device.nix

@@ -102,8 +102,6 @@ with lib;
         jq # for closureInfo
         # For boot.initrd.systemd
         makeInitrdNGTool
-        systemdStage1
-        systemdStage1Network
       ];
 
     boot.swraid.enable = true;

nixos/modules/programs/gnupg.nix

@@ -102,7 +102,7 @@ in
       unitConfig = {
         Description = "GnuPG cryptographic agent and passphrase cache";
         Documentation = "man:gpg-agent(1)";
-        Requires = [ "gpg-agent.socket" ];
+        Requires = [ "sockets.target" ];
       };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/gpg-agent --supervised";

nixos/modules/programs/rust-motd.nix

@@ -5,6 +5,23 @@ with lib;
 let
   cfg = config.programs.rust-motd;
   format = pkgs.formats.toml { };
+
+  # Order the sections in the TOML according to the order of sections
+  # in `cfg.order`.
+  motdConf = pkgs.runCommand "motd.conf"
+    {
+      __structuredAttrs = true;
+      inherit (cfg) order settings;
+      nativeBuildInputs = [ pkgs.remarshal pkgs.jq ];
+    }
+    ''
+      cat "$NIX_ATTRS_JSON_FILE" \
+        | jq '.settings as $settings
+              | .order
+              | map({ key: ., value: $settings."\(.)" })
+              | from_entries' -r \
+        | json2toml /dev/stdin "$out"
+    '';
 in {
   options.programs.rust-motd = {
     enable = mkEnableOption (lib.mdDoc "rust-motd");
@@ -27,10 +44,43 @@ in {
         For possible formats, please refer to {manpage}`systemd.time(7)`.
       '';
     };
+    order = mkOption {
+      type = types.listOf types.str;
+      default = attrNames cfg.settings;
+      defaultText = literalExpression "attrNames cfg.settings";
+      description = mdDoc ''
+        The order of the sections in [](#opt-programs.rust-motd.settings).
+        By default they are ordered alphabetically.
+
+        Context: since attribute sets in Nix are always
+        ordered alphabetically internally this means that
+
+        ```nix
+        {
+          uptime = { /* ... */ };
+          banner = { /* ... */ };
+        }
+        ```
+
+        will still have `banner` displayed before `uptime`.
+
+        To work around that, this option can be used to define the order of all keys,
+        i.e.
+
+        ```nix
+        {
+          order = [
+            "uptime"
+            "banner"
+          ];
+        }
+        ```
+
+        makes sure that `uptime` is placed before `banner` in the motd.
+      '';
+    };
     settings = mkOption {
-      type = types.submodule {
-        freeformType = format.type;
-      };
+      type = types.attrsOf format.type;
       description = mdDoc ''
         Settings on what to generate. Please read the
         [upstream documentation](https://github.com/rust-motd/rust-motd/blob/main/README.md#configuration)
@@ -45,14 +95,21 @@ in {
           `programs.rust-motd` is incompatible with `users.motd`!
         '';
       }
+      { assertion = sort (a: b: a < b) cfg.order == attrNames cfg.settings;
+        message = ''
+          Please ensure that every section from `programs.rust-motd.settings` is present in
+          `programs.rust-motd.order`.
+        '';
+      }
     ];
     systemd.services.rust-motd = {
       path = with pkgs; [ bash ];
       documentation = [ "https://github.com/rust-motd/rust-motd/blob/v${pkgs.rust-motd.version}/README.md" ];
       description = "motd generator";
+      wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         ExecStart = "${pkgs.writeShellScript "update-motd" ''
-          ${pkgs.rust-motd}/bin/rust-motd ${format.generate "motd.conf" cfg.settings} > motd
+          ${pkgs.rust-motd}/bin/rust-motd ${motdConf} > motd
         ''}";
         CapabilityBoundingSet = [ "" ];
         LockPersonality = true;

nixos/modules/system/boot/networkd.nix

@@ -83,7 +83,7 @@ let
         (assertByteFormat "BitsPerSecond")
         (assertValueOneOf "Duplex" ["half" "full"])
         (assertValueOneOf "AutoNegotiation" boolValues)
-        (assertValueOneOf "WakeOnLan" ["phy" "unicast" "multicast" "broadcast" "arp" "magic" "secureon" "off"])
+        (assertValuesSomeOfOr "WakeOnLan" ["phy" "unicast" "multicast" "broadcast" "arp" "magic" "secureon"] "off")
         (assertValueOneOf "Port" ["tp" "aui" "bnc" "mii" "fibre"])
         (assertValueOneOf "ReceiveChecksumOffload" boolValues)
         (assertValueOneOf "TransmitChecksumOffload" boolValues)
@@ -2724,9 +2724,12 @@ let
         description = lib.mdDoc ''
           Whether to consider the network online when any interface is online, as opposed to all of them.
           This is useful on portable machines with a wired and a wireless interface, for example.
+
+          This is on by default if {option}`networking.useDHCP` is enabled.
         '';
         type = types.bool;
-        default = false;
+        defaultText = "config.networking.useDHCP";
+        default = config.networking.useDHCP;
       };
 
       ignoredInterfaces = mkOption {
@@ -2858,6 +2861,17 @@ let
     })
   ];
 
+  stage1Options = {
+    options.boot.initrd.systemd.network.networks = mkOption {
+      type = with types; attrsOf (submodule {
+        # Default in initrd is dhcp-on-stop, which is correct if flushBeforeStage2 = false
+        config = mkIf config.boot.initrd.network.flushBeforeStage2 {
+          networkConfig.KeepConfiguration = mkDefault false;
+        };
+      });
+    };
+  };
+
   stage1Config = let
     cfg = config.boot.initrd.systemd.network;
   in mkMerge [
@@ -2876,8 +2890,6 @@ let
 
     (mkIf cfg.enable {
 
-      systemd.package = mkDefault pkgs.systemdStage1Network;
-
       # For networkctl
       systemd.dbus.enable = mkDefault true;
 
@@ -2921,45 +2933,14 @@ let
       ];
       kernelModules = [ "af_packet" ];
 
-      systemd.services.nixos-flush-networkd = mkIf config.boot.initrd.network.flushBeforeStage2 {
-        description = "Flush Network Configuration";
-        wantedBy = ["initrd.target"];
-        after = ["systemd-networkd.service" "dbus.socket" "dbus.service"];
-        before = ["shutdown.target" "initrd-switch-root.target"];
-        conflicts = ["shutdown.target" "initrd-switch-root.target"];
-        unitConfig.DefaultDependencies = false;
-        serviceConfig = {
-          # This service does nothing when starting, but brings down
-          # interfaces when switching root. This is the easiest way to
-          # ensure proper ordering while stopping. See systemd.unit(5)
-          # section on Before= and After=. The important part is that
-          # we are stopped before units we need, like dbus.service,
-          # and that we are stopped before starting units like
-          # initrd-switch-root.target
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = "/bin/true";
-        };
-        # systemd-networkd doesn't bring down interfaces on its own
-        # when it exits (see: systemd-networkd(8)), so we have to do
-        # it ourselves. The networkctl command doesn't have a way to
-        # bring all interfaces down, so we have to iterate over the
-        # list and filter out unmanaged interfaces to bring them down
-        # individually.
-        preStop = ''
-          networkctl list --full --no-legend | while read _idx link _type _operational setup _; do
-            [ "$setup" = unmanaged ] && continue
-            networkctl down "$link"
-          done
-        '';
-      };
-
     })
   ];
 
 in
 
 {
+  imports = [ stage1Options ];
+
   options = {
     systemd.network = commonOptions true;
     boot.initrd.systemd.network = commonOptions "shallow";

nixos/modules/system/boot/systemd/initrd.nix

@@ -135,8 +135,13 @@ in {
       '';
     };
 
-    package = mkPackageOptionMD pkgs "systemd" {
-      default = "systemdStage1";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = config.systemd.package;
+      defaultText = lib.literalExpression "config.systemd.package";
+      description = ''
+        The systemd package to use.
+      '';
     };
 
     extraConfig = mkOption {

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -62,7 +62,7 @@ let
         } // optionalAttrs (i.mtu != null) {
           MTUBytes = toString i.mtu;
         } // optionalAttrs (i.wakeOnLan.enable == true) {
-          WakeOnLan = "magic";
+          WakeOnLan = concatStringsSep " " i.wakeOnLan.policy;
         };
       };
     in listToAttrs (map createNetworkLink interfaces);

nixos/modules/tasks/network-interfaces-systemd.nix

@@ -59,23 +59,14 @@ let
       # more likely to result in interfaces being configured to
       # use DHCP when they shouldn't.
 
-      # When wait-online.anyInterface is enabled, RequiredForOnline really
-      # means "sufficient for online", so we can enable it.
-      # Otherwise, don't block the network coming online because of default networks.
       matchConfig.Name = ["en*" "eth*"];
       DHCP = "yes";
-      linkConfig.RequiredForOnline =
-        lib.mkDefault (if initrd
-        then config.boot.initrd.systemd.network.wait-online.anyInterface
-        else config.systemd.network.wait-online.anyInterface);
       networkConfig.IPv6PrivacyExtensions = "kernel";
     };
     networks."99-wireless-client-dhcp" = {
       # Like above, but this is much more likely to be correct.
       matchConfig.WLANInterfaceType = "station";
       DHCP = "yes";
-      linkConfig.RequiredForOnline =
-        lib.mkDefault config.systemd.network.wait-online.anyInterface;
       networkConfig.IPv6PrivacyExtensions = "kernel";
       # We also set the route metric to one more than the default
       # of 1024, so that Ethernet is preferred if both are

nixos/modules/tasks/network-interfaces.nix

@@ -327,6 +327,24 @@ let
           default = false;
           description = lib.mdDoc "Whether to enable wol on this interface.";
         };
+        policy = mkOption {
+          type = with types; listOf (
+            enum ["phy" "unicast" "multicast" "broadcast" "arp" "magic" "secureon"]
+          );
+          default = ["magic"];
+          description = lib.mdDoc ''
+            The [Wake-on-LAN policy](https://www.freedesktop.org/software/systemd/man/systemd.link.html#WakeOnLan=)
+            to set for the device.
+
+            The options are
+            - `phy`: Wake on PHY activity
+            - `unicast`: Wake on unicast messages
+            - `multicast`: Wake on multicast messages
+            - `broadcast`: Wake on broadcast messages
+            - `arp`: Wake on ARP
+            - `magic`: Wake on receipt of a magic packet
+          '';
+        };
       };
     };
 

nixos/tests/all-tests.nix

@@ -825,7 +825,8 @@ in {
   tor = handleTest ./tor.nix {};
   traefik = handleTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix {};
   trafficserver = handleTest ./trafficserver.nix {};
-  transmission = handleTest ./transmission.nix {};
+  transmission = handleTest ./transmission.nix { transmission = pkgs.transmission; };
+  transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
   # tracee requires bpf
   tracee = handleTestOn ["x86_64-linux"] ./tracee.nix {};
   trezord = handleTest ./trezord.nix {};

nixos/tests/transmission.nix

@@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, transmission, ... }: {
   name = "transmission";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ coconnor ];
@@ -12,6 +12,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     security.apparmor.enable = true;
 
     services.transmission.enable = true;
+    services.transmission.package = transmission;
   };
 
   testScript =

pkgs/applications/audio/exaile/default.nix

@@ -8,28 +8,26 @@
 , notificationSupport ? true
 , scalableIconSupport ? true
 , translationSupport ? true
-, bpmCounterSupport ? false
 , ipythonSupport ? false
+, cdMetadataSupport ? false
 , lastfmSupport ? false
 , lyricsManiaSupport ? false
-, lyricsWikiSupport ? false
 , multimediaKeySupport ? false
 , musicBrainzSupport ? false
 , podcastSupport ? false
 , streamripperSupport ? false
 , wikipediaSupport ? false
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "exaile";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "exaile";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GZyCuPy57NhGwgbLMrRKW5xmc1Udon7WtsrD4upviuQ=";
+    sha256 = "sha256-9SK0nvGdz2j6qp1JTmSuLezxX/kB93CZReSfAnfKZzg=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +47,9 @@ stdenv.mkDerivation rec {
     gstreamer
     gst-plugins-base
     gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
   ]) ++ (with python3.pkgs; [
     bsddb3
     dbus-python
@@ -59,13 +60,12 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optional deviceDetectionSupport udisks
   ++ lib.optional notificationSupport libnotify
   ++ lib.optional scalableIconSupport librsvg
-  ++ lib.optional bpmCounterSupport gst_all_1.gst-plugins-bad
   ++ lib.optional ipythonSupport python3.pkgs.ipython
+  ++ lib.optional cdMetadataSupport python3.pkgs.discid
   ++ lib.optional lastfmSupport python3.pkgs.pylast
-  ++ lib.optional (lyricsManiaSupport || lyricsWikiSupport) python3.pkgs.lxml
-  ++ lib.optional lyricsWikiSupport python3.pkgs.beautifulsoup4
+  ++ lib.optional lyricsManiaSupport python3.pkgs.lxml
   ++ lib.optional multimediaKeySupport keybinder3
-  ++ lib.optional musicBrainzSupport python3.pkgs.musicbrainzngs
+  ++ lib.optional (musicBrainzSupport || cdMetadataSupport) python3.pkgs.musicbrainzngs
   ++ lib.optional podcastSupport python3.pkgs.feedparser
   ++ lib.optional wikipediaSupport webkitgtk;
 

pkgs/applications/audio/lsp-plugins/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.10";
+  version = "1.2.11";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-2Yf+4TYGWF/AMI1kNvVOx9g6CSIoeZKY63qC/zJNilc=";
+    sha256 = "sha256-9zLs1J7rZkMaVQxOwihjCsKSLyb9q64pTZLVg/UVf2o=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/applications/audio/spotify-player/default.nix

@@ -33,16 +33,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.15.0";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5+YBlXHpAzGgw6MqgnMSggCASS++A/WWomftX8Jxe7g=";
+    hash = "sha256-yYn8xuJE0mILF7poiTbHCmFswP/xG+BbL+AASrLpbAs=";
   };
 
-  cargoHash = "sha256-PIYaJC3rVbPjc2CASzMGWAzUdrBwFnKqhrZO6nywdN8=";
+  cargoHash = "sha256-/q7xrsuRym5oDCGJRpBTdBach2CAbhCCC3cPFzCT4PU=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/blockchains/fulcrum/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fulcrum";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "cculianu";
     repo = "Fulcrum";
     rev = "v${version}";
-    sha256 = "sha256-guvOs/HsSuj5QOMTzmKxMaC8iUyTkVgEpp8pQ63aIIQ=";
+    sha256 = "sha256-iHVrJySNdbZ9RXP7QgsDy2o2U/EISAp1/9NFpcEOGeI=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];

pkgs/applications/editors/jetbrains/darwin.nix

@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation {
     runHook preInstall
     APP_DIR="$out/Applications/${product}.app"
     mkdir -p "$APP_DIR"
-    cp -Tr "${product}.app" "$APP_DIR"
+    cp -Tr *.app "$APP_DIR"
     mkdir -p "$out/bin"
     cat << EOF > "$out/bin/${loname}"
     open -na '$APP_DIR' --args "\$@"

pkgs/applications/emulators/retroarch/cores.nix

@@ -768,7 +768,7 @@ in
     # causes redefinition of _FORTIFY_SOURCE
     hardeningDisable = [ "fortify3" ];
 
-    postBuild = "cd /build/source/build/pcsx2";
+    postBuild = "cd $NIX_BUILD_TOP/source/build/pcsx2";
     meta = {
       description = "Port of PCSX2 to libretro";
       license = lib.licenses.gpl3Plus;

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , makeWrapper
 , mkDerivation
 , substituteAll
@@ -138,6 +139,11 @@ in mkDerivation rec {
       pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
       qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
     })
+    (fetchpatch {
+      name = "qgis-3.28.9-exiv2-0.28.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-geosciences/qgis/files/qgis-3.28.9-exiv2-0.28.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
+      hash = "sha256-mPRo0A7ko4GCHJrfJ2Ls0dUKvkFtDmhKekI2CR9StMw=";
+    })
   ];
 
   cmakeFlags = [

pkgs/applications/gis/qgis/unwrapped.nix

@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , makeWrapper
 , mkDerivation
 , substituteAll
@@ -141,6 +142,11 @@ in mkDerivation rec {
       pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
       qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
     })
+    (fetchpatch {
+      name = "exiv2-0.28.patch";
+      url = "https://github.com/qgis/QGIS/commit/32f5418fc4f7bb2ee986dee1824ff2989c113a94.patch";
+      hash = "sha256-zWyf+kLro4ZyUJLX/nDjY0nLneTaI1DxHvRsvwoWq14=";
+    })
   ];
 
   # Add path to Qt platform plugins

pkgs/applications/graphics/inkscape/default.nix

@@ -10,6 +10,7 @@
 , ghostscript
 , glib
 , glibmm
+, gobject-introspection
 , gsl
 , gspell
 , gtk-mac-integration
@@ -47,6 +48,7 @@ let
       appdirs
       beautifulsoup4
       cachecontrol
+      filelock
       numpy
       lxml
       packaging
@@ -104,6 +106,7 @@ stdenv.mkDerivation rec {
     glib # for setup hook
     gdk-pixbuf # for setup hook
     wrapGAppsHook
+    gobject-introspection
   ] ++ (with perlPackages; [
     perl
     XMLParser

pkgs/applications/graphics/inkscape/extensions.nix

@@ -10,13 +10,13 @@
 
   hexmap = stdenv.mkDerivation {
     pname = "hexmap";
-    version = "unstable-2020-06-06";
+    version = "unstable-2023-01-26";
 
     src = fetchFromGitHub {
       owner = "lifelike";
       repo = "hexmapextension";
-      rev = "11401e23889318bdefb72df6980393050299d8cc";
-      sha256 = "1a4jhva624mbljj2k43wzi6hrxacjz4626jfk9y2fg4r4sga22mm";
+      rev = "241c9512d0113e8193b7cf06b69ef2c4730b0295";
+      hash = "sha256-pSPAupp3xLlbODE2BGu1Xiiiu1Y6D4gG4HhZwccAZ2E=";
     };
 
     preferLocalBuild = true;

pkgs/applications/misc/gallery-dl/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.25.8";
+  version = "1.26.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-6q2F9zSGZp0iZoBvOUIuIEqNs97hbsbzE23XJyTZUDc=";
+    sha256 = "sha256-+g4tfr7RF9rrimQcXhcz3o/Cx9xLNrTDV1Fx7XSxh7I=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/joplin-desktop/default.nix

@@ -3,7 +3,6 @@
 let
   pname = "joplin-desktop";
   version = "2.12.18";
-  name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -24,7 +23,7 @@ let
   };
 
   appimageContents = appimageTools.extractType2 {
-    inherit name src;
+    inherit pname version src;
   };
 
   meta = with lib; {
@@ -43,7 +42,7 @@ let
   };
 
   linux = appimageTools.wrapType2 rec {
-    inherit name src meta;
+    inherit pname version src meta;
 
     profile = ''
       export LC_ALL=C.UTF-8
@@ -52,7 +51,7 @@ let
     multiArch = false; # no 32bit needed
     extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
     extraInstallCommands = ''
-      mv $out/bin/{${name},${pname}}
+      mv $out/bin/{${pname}-${version},${pname}}
       source "${makeWrapper}/nix-support/setup-hook"
       wrapProgram $out/bin/${pname} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}"
@@ -65,7 +64,7 @@ let
   };
 
   darwin = stdenv.mkDerivation {
-    inherit name src meta;
+    inherit pname version src meta;
 
     nativeBuildInputs = [ undmg ];
 

pkgs/applications/misc/nwg-drawer/default.nix

@@ -45,6 +45,7 @@ buildGoModule rec {
     homepage = "https://github.com/nwg-piotr/nwg-drawer";
     license = licenses.mit;
     platforms = platforms.linux;
+    mainProgram = "nwg-drawer";
     maintainers = with maintainers; [ plabadens ];
   };
 }

pkgs/applications/misc/wallust/default.nix

@@ -1,6 +1,7 @@
 { lib
 , fetchFromGitea
 , rustPlatform
+, nix-update-script
 }:
 rustPlatform.buildRustPackage rec {
   pname = "wallust";
@@ -14,7 +15,9 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-WhL2HWM1onRrCqWJPLnAVMd/f/xfLrK3mU8jFSLFjAM=";
   };
 
-  cargoSha256 = "sha256-pR2vdqMGJZ6zvXwwKUIPjb/lWzVgYqQ7C7/sk/+usc4= ";
+  cargoSha256 = "sha256-pR2vdqMGJZ6zvXwwKUIPjb/lWzVgYqQ7C7/sk/+usc4=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "A better pywal";

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -30,11 +30,11 @@
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "118.0b7";
+    version = "119.0b4";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "17dc6dbfe1c3085a7c85d53d7980660471253e64d081a01e59d0273b75c4000476bad31fe155c976a18c561c09c21ae9a95775c81bb99c5a53bea89f79b07cfb";
+      sha512 = "7c067d759602608e527d032f7a3772df827a5b5c4270992c05abda726fcd665f4f2c5380e684623ed108364ace4afaed8b5959f75a4b0540edd5ae30422b0e54";
     };
 
     meta = {
@@ -58,12 +58,12 @@
 
   firefox-devedition = (buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "118.0b7";
+    version = "119.0b4";
     applicationName = "Mozilla Firefox Developer Edition";
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "636df06a41bba9909c50a1c433a6d14d42573cfa8ba28e57b87ed709fb06d81c1fcf4a24a8e1c794b6b7eb894a72e188d5e91bb46ce589a3438c8b75acb6e812";
+      sha512 = "ded00bc1e090bdca5f32160d980cec47590bb952a6c7f1dc8f4df30fa452cad8c47a3c6d20cf3e8345fd5811777b475354d71d704c866fb49396a83c8a795bcb";
     };
 
     meta = {

pkgs/applications/networking/cluster/arkade/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.10.7";
+  version = "0.10.10";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-6KgQR8QIgbrI2XhORhDjcC2PK+XbmDWNBjjjE3qOAhQ=";
+    hash = "sha256-Lu/itKaF7mSG/jwg2sA4wNkbzBWdDY4pfwHB0elI1Bc=";
   };
 
   CGO_ENABLED = 0;

pkgs/applications/networking/cluster/kaniko/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-PNAqdeB/ya3i1hRbagpfmpwS0tNRZbWBm9YIXME1HMc=";
+    hash = "sha256-PTcPlYJ0IHWNQKBJcMiotGp6GPH3qY3f6sJKgUVSTZU=";
   };
 
   vendorHash = null;

pkgs/applications/networking/irc/irssi/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "irssi";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "irssi";
     repo = "irssi";
     rev = version;
-    hash = "sha256-a/+9M2zoywZBdOfXHrA4O6Q9W7HJZNTthB/aseUNefA=";
+    hash = "sha256-D+KMjkweStMqVhoQoiJPFt/G0vdf7x2FjYCvqGS8UqY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/p2p/transmission/4.nix

@@ -141,8 +141,14 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
+  passthru.tests = {
+    apparmor = nixosTests.transmission_4; # starts the service with apparmor enabled
+    smoke-test = nixosTests.bittorrent;
+  };
+
   meta = {
     description = "A fast, easy and free BitTorrent client";
+    mainProgram = if enableQt then "transmission-qt" else if enableGTK3 then "transmission-gtk" else "transmission-cli";
     longDescription = ''
       Transmission is a BitTorrent client which features a simple interface
       on top of a cross-platform back-end.

pkgs/applications/networking/p2p/transmission/default.nix

@@ -129,6 +129,7 @@ in stdenv.mkDerivation {
 
   meta = {
     description = "A fast, easy and free BitTorrent client";
+    mainProgram = if enableQt then "transmission-qt" else if enableGTK3 then "transmission-gtk" else "transmission-cli";
     longDescription = ''
       Transmission is a BitTorrent client which features a simple interface
       on top of a cross-platform back-end.

pkgs/applications/networking/sync/unison/default.nix

@@ -6,7 +6,6 @@
 , copyDesktopItems
 , makeDesktopItem
 , wrapGAppsHook
-, glib
 , gsettings-desktop-schemas
 , zlib
 , enableX11 ? true
@@ -26,10 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ glib wrapGAppsHook ocamlPackages.ocaml ]
-    ++ lib.optional enableX11 copyDesktopItems;
-  buildInputs = [ gsettings-desktop-schemas ncurses zlib ]
-    ++ lib.optional stdenv.isDarwin Cocoa;
+  nativeBuildInputs = [ ocamlPackages.ocaml ]
+    ++ lib.optionals enableX11 [ copyDesktopItems wrapGAppsHook ];
+  buildInputs = [ ncurses zlib ]
+    ++ lib.optionals enableX11 [ gsettings-desktop-schemas ]
+    ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   preBuild = lib.optionalString enableX11 ''
     sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${ocamlPackages.lablgtk3}"/lib/ocaml/*/site-lib/lablgtk3)|" src/Makefile.OCaml

pkgs/applications/office/libreoffice/README.md

@@ -1,9 +0,0 @@
-LibreOffice
-===========
-
-To generate `src-$VARIANT/download.nix`, i.e. list of additional sources that
-the libreoffice build process needs to download:
-
-    nix-shell gen-shell.nix --argstr variant VARIANT --run generate
-
-Where VARIANT is either `still` or `fresh`.

pkgs/applications/office/libreoffice/default.nix

@@ -1,6 +1,5 @@
 { stdenv
 , fetchurl
-, fetchpatch
 , lib
 , substituteAll
 , pam
@@ -100,7 +99,7 @@
 , langs ? [ "ar" "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "tr" "uk" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
-, mkDerivation ? null
+, wrapQtAppsHook ? null
 , qtbase ? null
 , qtx11extras ? null
 , qtwayland ? null
@@ -145,31 +144,33 @@ let
   };
 
   importVariant = f: import (./. + "/src-${variant}/${f}");
-
-  primary-src = importVariant "primary.nix" { inherit fetchurl; };
-
-  inherit (primary-src) major minor version;
-
-  langsSpaces = concatStringsSep " " langs;
-
-  mkDrv = if kdeIntegration then mkDerivation else stdenv.mkDerivation;
-
+  # Update these files with:
+  # nix-shell maintainers/scripts/update.nix --argstr package libreoffice-$VARIANT.unwrapped
+  version = importVariant "version.nix";
+  srcsAttributes = {
+    main = importVariant "main.nix";
+    help = importVariant "help.nix";
+    translations = importVariant "translations.nix";
+    deps = (importVariant "deps.nix") ++ [
+      # TODO: Why is this needed?
+      (rec {
+        name = "unowinreg.dll";
+        url = "https://dev-www.libreoffice.org/extern/${md5name}";
+        sha256 = "1infwvv1p6i21scywrldsxs22f62x85mns4iq8h6vr6vlx3fdzga";
+        md5 = "185d60944ea767075d27247c3162b3bc";
+        md5name = "${md5}-${name}";
+      })
+    ];
+  };
   srcs = {
-    primary = primary-src;
-    third_party =
-      map (x: ((fetchurl { inherit (x) url sha256 name; }) // { inherit (x) md5name md5; }))
-        (importVariant "download.nix" ++ [
-          (rec {
-            name = "unowinreg.dll";
-            url = "https://dev-www.libreoffice.org/extern/${md5name}";
-            sha256 = "1infwvv1p6i21scywrldsxs22f62x85mns4iq8h6vr6vlx3fdzga";
-            md5 = "185d60944ea767075d27247c3162b3bc";
-            md5name = "${md5}-${name}";
-          })
-        ]);
-
-    translations = primary-src.translations;
-    help = primary-src.help;
+    third_party = map (x:
+      (fetchurl {
+        inherit (x) url sha256 name;
+      }) // {
+        inherit (x) md5name md5;
+      }) srcsAttributes.deps;
+    translations = fetchurl srcsAttributes.translations;
+    help = fetchurl srcsAttributes.help;
   };
 
   # See `postPatch` for details
@@ -185,13 +186,12 @@ let
       kwindowsystem
     ]);
   };
+  tarballPath = "external/tarballs";
 
-in
-(mkDrv rec {
+in stdenv.mkDerivation (finalAttrs: {
   pname = "libreoffice";
   inherit version;
-
-  inherit (primary-src) src;
+  src = fetchurl srcsAttributes.main;
 
   env.NIX_CFLAGS_COMPILE = toString ([
     "-I${librdf_rasqal}/include/rasqal" # librdf_redland refers to rasqal.h instead of rasqal/rasqal.h
@@ -200,8 +200,6 @@ in
     "-O2" # https://bugs.gentoo.org/727188
   ]);
 
-  tarballPath = "external/tarballs";
-
   postUnpack = ''
     mkdir -v $sourceRoot/${tarballPath}
   '' + (flip concatMapStrings srcs.third_party (f: ''
@@ -215,18 +213,11 @@ in
     tar -xf ${srcs.translations}
   '';
 
-  # Remove build config to reduce the amount of `-dev` outputs in the
-  # runtime closure. This was introduced in upstream commit
-  # cbfac11330882c7d0a817b6c37a08b2ace2b66f4, so the patch doesn't apply
-  # for 7.4.
-  patches = lib.optionals (lib.versionAtLeast version "7.5") [
+  patches = [
+    # Remove build config to reduce the amount of `-dev` outputs in the
+    # runtime closure. This behavior was introduced by upstream in commit
+    # cbfac11330882c7d0a817b6c37a08b2ace2b66f4
     ./0001-Strip-away-BUILDCONFIG.patch
-  ] ++ [
-    (fetchpatch {
-      name = "fix-curl-8.2.patch";
-      url = "https://github.com/LibreOffice/core/commit/2a68dc02bd19a717d3c86873206fabed1098f228.diff";
-      hash = "sha256-C+kts+oaLR3+GbnX/wrFguF7SzgerNataxP0SPxhyY8=";
-    })
   ];
 
   # libreoffice tries to reference the BUILDCONFIG (e.g. PKG_CONFIG_PATH)
@@ -236,27 +227,9 @@ in
   disallowedRequisites = lib.optionals (!kdeIntegration)
     (lib.concatMap
       (x: lib.optional (x?dev) x.dev)
-      buildInputs);
+      finalAttrs.buildInputs);
 
-  ### QT/KDE
-  #
-  # configure.ac assumes that the first directory that contains headers and
-  # libraries during its checks contains *all* the relevant headers/libs which
-  # obviously doesn't work for us, so we have 2 options:
-  #
-  # 1. patch configure.ac in order to specify the direct paths to various Qt/KDE
-  # dependencies which is ugly and brittle, or
-  #
-  # 2. use symlinkJoin to pull in the relevant dependencies and just patch in
-  # that path which is *also* ugly, but far less likely to break
-  #
-  # The 2nd option is not very Nix'y, but I'll take robust over nice any day.
-  # Additionally, it's much easier to fix if LO breaks on the next upgrade (just
-  # add the missing dependencies to it).
   postPatch = ''
-    substituteInPlace shell/source/unix/exec/shellexec.cxx \
-      --replace xdg-open ${if kdeIntegration then "kde-open5" else "xdg-open"}
-
     # configure checks for header 'gpgme++/gpgmepp_version.h',
     # and if it is found (no matter where) uses a hardcoded path
     # in what presumably is an effort to make it possible to write
@@ -267,6 +240,21 @@ in
       'GPGMEPP_CFLAGS=-I/usr/include/gpgme++' \
       'GPGMEPP_CFLAGS=-I${gpgme.dev}/include/gpgme++'
   '' + optionalString kdeIntegration ''
+    substituteInPlace shell/source/unix/exec/shellexec.cxx \
+      --replace xdg-open kde-open5
+    # configure.ac assumes that the first directory that contains headers and
+    # libraries during its checks contains *all* the relevant headers/libs which
+    # obviously doesn't work for us, so we have 2 options:
+    #
+    # 1. patch configure.ac in order to specify the direct paths to various Qt/KDE
+    # dependencies which is ugly and brittle, or
+    #
+    # 2. use symlinkJoin to pull in the relevant dependencies and just patch in
+    # that path which is *also* ugly, but far less likely to break
+    #
+    # The 2nd option is not very Nix'y, but I'll take robust over nice any day.
+    # Additionally, it's much easier to fix if LO breaks on the next upgrade (just
+    # add the missing dependencies to it).
     substituteInPlace configure.ac \
       --replace '$QT5INC ' '$QT5INC ${kdeDeps}/include ' \
       --replace '$QT5LIB ' '$QT5LIB ${kdeDeps}/lib ' \
@@ -280,7 +268,7 @@ in
   preConfigure = ''
     configureFlagsArray=(
       "--with-parallelism=$NIX_BUILD_CORES"
-      "--with-lang=${langsSpaces}"
+      "--with-lang=${concatStringsSep " " langs}"
     );
 
     chmod a+x ./bin/unpack-sources
@@ -294,102 +282,110 @@ in
     NOCONFIGURE=1 ./autogen.sh
   '';
 
-  postConfigure =
+  postConfigure = ''
     # fetch_Download_item tries to interpret the name as a variable name, let it do so...
-    ''
-      sed -e '1ilibreoffice-translations-${version}.tar.xz=libreoffice-translations-${version}.tar.xz' -i Makefile
-      sed -e '1ilibreoffice-help-${version}.tar.xz=libreoffice-help-${version}.tar.xz' -i Makefile
-    ''
-    # Test fixups
-    # May need to be revisited/pruned, left alone for now.
-    + ''
-      # unit test sd_tiledrendering seems to be fragile
-      # https://nabble.documentfoundation.org/libreoffice-5-0-failure-in-CUT-libreofficekit-tiledrendering-td4150319.html
-      echo > ./sd/CppunitTest_sd_tiledrendering.mk
-      sed -e /CppunitTest_sd_tiledrendering/d -i sd/Module_sd.mk
-      # Pivot chart tests. Fragile.
-      sed -e '/CPPUNIT_TEST(testRoundtrip)/d' -i chart2/qa/extras/PivotChartTest.cxx
-      sed -e '/CPPUNIT_TEST(testPivotTableMedianODS)/d' -i sc/qa/unit/pivottable_filters_test.cxx
-      # one more fragile test?
-      sed -e '/CPPUNIT_TEST(testTdf96536);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
-      # this I actually hate, this should be a data consistency test!
-      sed -e '/CPPUNIT_TEST(testTdf115013);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
-      # rendering-dependent test
-      # tilde expansion in path processing checks the existence of $HOME
-      sed -e 's@OString sSysPath("~/tmp");@& return ; @' -i sal/qa/osl/file/osl_File.cxx
-      # fails on systems using ZFS, see https://github.com/NixOS/nixpkgs/issues/19071
-      sed -e '/CPPUNIT_TEST(getSystemPathFromFileURL_005);/d' -i './sal/qa/osl/file/osl_File.cxx'
-      # rendering-dependent: on my computer the test table actually doesn't fit…
-      # interesting fact: test disabled on macOS by upstream
-      sed -re '/DECLARE_WW8EXPORT_TEST[(]testTableKeep, "tdf91083.odt"[)]/,+5d' -i ./sw/qa/extras/ww8export/ww8export.cxx
-      # Segfault on DB access — maybe temporarily acceptable for a new version of Fresh?
-      sed -e 's/CppunitTest_dbaccess_empty_stdlib_save//' -i ./dbaccess/Module_dbaccess.mk
-      # one more fragile test?
-      sed -e '/CPPUNIT_TEST(testTdf77014);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
-      # rendering-dependent tests
-      sed -e '/CPPUNIT_TEST(testLegacyCellAnchoredRotatedShape)/d' -i sc/qa/unit/filters-test.cxx
-      sed -zre 's/DesktopLOKTest::testGetFontSubset[^{]*[{]/& return; /' -i desktop/qa/desktop_lib/test_desktop_lib.cxx
-      sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]testFlipAndRotateCustomShape,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport7.cxx
-      sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]tdf105490_negativeMargins,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport9.cxx
-      sed -z -r -e 's/DECLARE_OOXMLIMPORT_TEST[(]testTdf112443,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlimport/ooxmlimport.cxx
-      sed -z -r -e 's/DECLARE_RTFIMPORT_TEST[(]testTdf108947,[^)]*[)].[{]/& return;/' -i sw/qa/extras/rtfimport/rtfimport.cxx
-      # not sure about this fragile test
-      sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]testTDF87348,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport7.cxx
-      # bunch of new Fresh failures. Sigh.
-      sed -e '/CPPUNIT_TEST(testDocumentLayout);/d' -i './sd/qa/unit/import-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testErrorBarDataRangeODS);/d' -i './chart2/qa/extras/chart2export.cxx'
-      sed -e '/CPPUNIT_TEST(testLabelStringODS);/d' -i './chart2/qa/extras/chart2export.cxx'
-      sed -e '/CPPUNIT_TEST(testAxisNumberFormatODS);/d' -i './chart2/qa/extras/chart2export.cxx'
-      sed -e '/CPPUNIT_TEST(testBackgroundImage);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testFdo84043);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf97630);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf80020);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf62176);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTransparentBackground);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testEmbeddedPdf);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testEmbeddedText);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf98477);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf50499);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf100926);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testPageWithTransparentBackground);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTextRotation);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf113818);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf119629);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf113822);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf105739);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testPageBitmapWithTransparency);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf115005);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf115005_FallBack_Images_On);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf115005_FallBack_Images_Off);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf44774);/d' -i './sd/qa/unit/misc-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf38225);/d' -i './sd/qa/unit/misc-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
-      sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests.cxx'
-      sed -e '/CPPUNIT_TEST(testFdo85554);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
-      sed -e '/CPPUNIT_TEST(testEmbeddedDataSource);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
-      sed -e '/CPPUNIT_TEST(testTdf96479);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
-      sed -e '/CPPUNIT_TEST(testInconsistentBookmark);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
-      sed -e /CppunitTest_sw_layoutwriter/d -i sw/Module_sw.mk
-      sed -e /CppunitTest_sw_htmlimport/d -i sw/Module_sw.mk
-      sed -e /CppunitTest_sw_core_layout/d -i sw/Module_sw.mk
-      sed -e /CppunitTest_sw_uiwriter6/d -i sw/Module_sw.mk
-      sed -e /CppunitTest_sdext_pdfimport/d -i sdext/Module_sdext.mk
-      sed -e /CppunitTest_vcl_pdfexport/d -i vcl/Module_vcl.mk
-      sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/ooxmlexport/ooxmlexport9.cxx"
-      sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/ooxmlexport/ooxmlencryption.cxx"
-      sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/odfexport/odfexport.cxx"
-      sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/unowriter/unowriter.cxx"
+    sed -e '1ilibreoffice-translations-${version}.tar.xz=libreoffice-translations-${version}.tar.xz' -i Makefile
+    sed -e '1ilibreoffice-help-${version}.tar.xz=libreoffice-help-${version}.tar.xz' -i Makefile
+  '' /* Test fixups. May need to be revisited/pruned, left alone for now. */ + ''
+    # unit test sd_tiledrendering seems to be fragile
+    # https://nabble.documentfoundation.org/libreoffice-5-0-failure-in-CUT-libreofficekit-tiledrendering-td4150319.html
+    echo > ./sd/CppunitTest_sd_tiledrendering.mk
+    sed -e /CppunitTest_sd_tiledrendering/d -i sd/Module_sd.mk
+    # Pivot chart tests. Fragile.
+    sed -e '/CPPUNIT_TEST(testRoundtrip)/d' -i chart2/qa/extras/PivotChartTest.cxx
+    sed -e '/CPPUNIT_TEST(testPivotTableMedianODS)/d' -i sc/qa/unit/pivottable_filters_test.cxx
+    # one more fragile test?
+    sed -e '/CPPUNIT_TEST(testTdf96536);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
+    # this I actually hate, this should be a data consistency test!
+    sed -e '/CPPUNIT_TEST(testTdf115013);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
+    # rendering-dependent test
+    # tilde expansion in path processing checks the existence of $HOME
+    sed -e 's@OString sSysPath("~/tmp");@& return ; @' -i sal/qa/osl/file/osl_File.cxx
+    # fails on systems using ZFS, see https://github.com/NixOS/nixpkgs/issues/19071
+    sed -e '/CPPUNIT_TEST(getSystemPathFromFileURL_005);/d' -i './sal/qa/osl/file/osl_File.cxx'
+    # rendering-dependent: on my computer the test table actually doesn't fit…
+    # interesting fact: test disabled on macOS by upstream
+    sed -re '/DECLARE_WW8EXPORT_TEST[(]testTableKeep, "tdf91083.odt"[)]/,+5d' -i ./sw/qa/extras/ww8export/ww8export.cxx
+    # Segfault on DB access — maybe temporarily acceptable for a new version of Fresh?
+    sed -e 's/CppunitTest_dbaccess_empty_stdlib_save//' -i ./dbaccess/Module_dbaccess.mk
+    # one more fragile test?
+    sed -e '/CPPUNIT_TEST(testTdf77014);/d' -i sw/qa/extras/uiwriter/uiwriter.cxx
+    # rendering-dependent tests
+    sed -e '/CPPUNIT_TEST(testLegacyCellAnchoredRotatedShape)/d' -i sc/qa/unit/filters-test.cxx
+    sed -zre 's/DesktopLOKTest::testGetFontSubset[^{]*[{]/& return; /' -i desktop/qa/desktop_lib/test_desktop_lib.cxx
+    sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]testFlipAndRotateCustomShape,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport7.cxx
+    sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]tdf105490_negativeMargins,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport9.cxx
+    sed -z -r -e 's/DECLARE_OOXMLIMPORT_TEST[(]testTdf112443,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlimport/ooxmlimport.cxx
+    sed -z -r -e 's/DECLARE_RTFIMPORT_TEST[(]testTdf108947,[^)]*[)].[{]/& return;/' -i sw/qa/extras/rtfimport/rtfimport.cxx
+    # not sure about this fragile test
+    sed -z -r -e 's/DECLARE_OOXMLEXPORT_TEST[(]testTDF87348,[^)]*[)].[{]/& return;/' -i sw/qa/extras/ooxmlexport/ooxmlexport7.cxx
+    # bunch of new Fresh failures. Sigh.
+    sed -e '/CPPUNIT_TEST(testDocumentLayout);/d' -i './sd/qa/unit/import-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testErrorBarDataRangeODS);/d' -i './chart2/qa/extras/chart2export.cxx'
+    sed -e '/CPPUNIT_TEST(testLabelStringODS);/d' -i './chart2/qa/extras/chart2export.cxx'
+    sed -e '/CPPUNIT_TEST(testAxisNumberFormatODS);/d' -i './chart2/qa/extras/chart2export.cxx'
+    sed -e '/CPPUNIT_TEST(testBackgroundImage);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testFdo84043);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf97630);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf80020);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf62176);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTransparentBackground);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testEmbeddedPdf);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testEmbeddedText);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf98477);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf50499);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf100926);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testPageWithTransparentBackground);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTextRotation);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf113818);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf119629);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf113822);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf105739);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testPageBitmapWithTransparency);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf115005);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf115005_FallBack_Images_On);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf115005_FallBack_Images_Off);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf44774);/d' -i './sd/qa/unit/misc-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf38225);/d' -i './sd/qa/unit/misc-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests-ooxml2.cxx'
+    sed -e '/CPPUNIT_TEST(testAuthorField);/d' -i './sd/qa/unit/export-tests.cxx'
+    sed -e '/CPPUNIT_TEST(testFdo85554);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
+    sed -e '/CPPUNIT_TEST(testEmbeddedDataSource);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
+    sed -e '/CPPUNIT_TEST(testTdf96479);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
+    sed -e '/CPPUNIT_TEST(testInconsistentBookmark);/d' -i './sw/qa/extras/uiwriter/uiwriter.cxx'
+    sed -e '/CPPUNIT_TEST(Import_Export_Import);/d' -i './sw/qa/inc/swmodeltestbase.hxx'
+    sed -e /CppunitTest_sw_layoutwriter/d -i sw/Module_sw.mk
+    sed -e /CppunitTest_sw_htmlimport/d -i sw/Module_sw.mk
+    sed -e /CppunitTest_sw_core_layout/d -i sw/Module_sw.mk
+    sed -e /CppunitTest_sw_uiwriter6/d -i sw/Module_sw.mk
+    sed -e /CppunitTest_sdext_pdfimport/d -i sdext/Module_sdext.mk
+    sed -e /CppunitTest_vcl_pdfexport/d -i vcl/Module_vcl.mk
+    sed -e /CppunitTest_sc_ucalc_formula/d -i sc/Module_sc.mk
+    sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/ooxmlexport/ooxmlexport9.cxx"
+    sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/ooxmlexport/ooxmlencryption.cxx"
+    sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/odfexport/odfexport.cxx"
+    sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/unowriter/unowriter.cxx"
 
-      # testReqIfTable fails since libxml2: 2.10.3 -> 2.10.4
-      sed -e 's@.*"/html/body/div/table/tr/th".*@//&@' -i sw/qa/extras/htmlexport/htmlexport.cxx
-    ''
-    # This to avoid using /lib:/usr/lib at linking
-    + ''
-      sed -i '/gb_LinkTarget_LDFLAGS/{ n; /rpath-link/d;}' solenv/gbuild/platform/unxgcc.mk
+    sed -e '/CPPUNIT_ASSERT(!bRTL);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(0, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(4, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(11, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(18, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(3, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(9, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(17, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
+    sed -e '/CPPUNIT_ASSERT_EQUAL(22, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
 
-      find -name "*.cmd" -exec sed -i s,/lib:/usr/lib,, {} \;
-    '';
+    # testReqIfTable fails since libxml2: 2.10.3 -> 2.10.4
+    sed -e 's@.*"/html/body/div/table/tr/th".*@//&@' -i sw/qa/extras/htmlexport/htmlexport.cxx
+  '' /* This to avoid using /lib:/usr/lib at linking */ + ''
+    sed -i '/gb_LinkTarget_LDFLAGS/{ n; /rpath-link/d;}' solenv/gbuild/platform/unxgcc.mk
+
+    find -name "*.cmd" -exec sed -i s,/lib:/usr/lib,, {} \;
+  '' + optionalString stdenv.isAarch64 ''
+    sed -e '/CPPUNIT_TEST(testStatisticalFormulasFODS);/d' -i './sc/qa/unit/functions_statistical.cxx'
+  '';
 
   makeFlags = [ "SHELL=${bash}/bin/bash" ];
 
@@ -406,13 +402,6 @@ in
 
     cp -r sysui/desktop/icons  "$out/share"
     sed -re 's@Icon=libreoffice(dev)?[0-9.]*-?@Icon=@' -i "$out/share/applications/"*.desktop
-
-    # Install dolphin templates, like debian does
-    install -D extras/source/shellnew/soffice.* --target-directory="$out/share/templates/.source"
-    cp ${substituteAll {src = ./soffice-template.desktop; app="Writer";  ext="odt"; type="text";        }} $out/share/templates/soffice.odt.desktop
-    cp ${substituteAll {src = ./soffice-template.desktop; app="Calc";    ext="ods"; type="spreadsheet"; }} $out/share/templates/soffice.ods.desktop
-    cp ${substituteAll {src = ./soffice-template.desktop; app="Impress"; ext="odp"; type="presentation";}} $out/share/templates/soffice.odp.desktop
-    cp ${substituteAll {src = ./soffice-template.desktop; app="Draw";    ext="odg"; type="drawing";     }} $out/share/templates/soffice.odg.desktop
   '';
 
   # Wrapping is done in ./wrapper.nix
@@ -475,16 +464,26 @@ in
     "--without-system-libqxp"
     "--without-system-dragonbox"
     "--without-system-libfixmath"
+  # the "still" variant doesn't support Nixpkgs' mdds 2.1, only mdds 2.0
+  ] ++ optionals (variant == "still") [
+    "--without-system-mdds"
+  ] ++ optionals (variant == "fresh") [
     "--with-system-mdds"
+  ] ++ [
     # https://github.com/NixOS/nixpkgs/commit/5c5362427a3fa9aefccfca9e531492a8735d4e6f
     "--without-system-orcus"
     "--without-system-xmlsec"
-    "--without-system-cuckoo"
     "--without-system-zxing"
   ] ++ optionals kdeIntegration [
     "--enable-kf5"
     "--enable-qt5"
     "--enable-gtk3-kde5"
+  ] ++ optionals (variant == "fresh") [
+    "--without-system-dragonbox"
+    "--without-system-libfixmath"
+    # Technically needed only when kdeIntegration is enabled in the "fresh"
+    # variant. Won't hurt to put it here for every "fresh" variant.
+    "--without-system-frozen"
   ];
 
   checkTarget = concatStringsSep " " [
@@ -501,9 +500,11 @@ in
     jdk17
     libtool
     pkg-config
+  ] ++ optionals kdeIntegration [
+    wrapQtAppsHook
   ];
 
-  buildInputs = with xorg; [
+  buildInputs = with xorg; finalAttrs.passthru.gst_packages ++ [
     ArchiveZip
     CoinMP
     IOCompress
@@ -572,6 +573,7 @@ in
     libxshmfence
     libxslt
     libzmf
+    libwebp
     mdds
     mythes
     ncurses
@@ -592,14 +594,23 @@ in
     which
     zip
     zlib
-  ]
-  ++ passthru.gst_packages
-  ++ optionals kdeIntegration [ qtbase qtx11extras kcoreaddons kio ]
-  ++ optionals (lib.versionAtLeast (lib.versions.majorMinor version) "7.4") [ libwebp ];
+  ] ++ optionals kdeIntegration [
+    qtbase
+    qtx11extras
+    kcoreaddons
+    kio
+  ];
 
   passthru = {
     inherit srcs;
     jdk = jre';
+    updateScript = [
+      ./update.sh
+      # Pass it this file name as argument
+      (builtins.unsafeGetAttrPos "pname" finalAttrs.finalPackage).file
+      # And the variant
+      variant
+    ];
     inherit kdeIntegration;
     # For the wrapper.nix
     inherit gtk3;
@@ -656,4 +667,4 @@ in
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
   };
-}).overrideAttrs ((importVariant "override.nix") (args // { inherit kdeIntegration; }))
+})

pkgs/applications/office/libreoffice/download-list-builder.sh

@@ -1,4 +0,0 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
-source $stdenv/setup
-
-tar --extract --file=$src libreoffice-$version/download.lst -O > $out

pkgs/applications/office/libreoffice/gen-shell.nix

@@ -1,29 +0,0 @@
-{ pkgs ? (import <nixpkgs> {}), variant }:
-
-with pkgs;
-
-let
-
-  primary-src = callPackage (./. + "/src-${variant}/primary.nix") {};
-
-in
-
-stdenv.mkDerivation {
-  name = "generate-libreoffice-srcs-shell";
-
-  buildCommand = "exit 1";
-
-  downloadList = stdenv.mkDerivation {
-    name = "libreoffice-${primary-src.version}-download-list";
-    inherit (primary-src) src version;
-    builder = ./download-list-builder.sh;
-  };
-
-  buildInputs = [ python3 ];
-
-  shellHook = ''
-    function generate {
-      python3 generate-libreoffice-srcs.py ${variant} > src-${variant}/download.nix
-    }
-  '';
-}

pkgs/applications/office/libreoffice/gpgme-1.18.patch

@@ -1,10 +0,0 @@
-The way this check mixes C and C++ started to cause issues since gpgme 1.18.0
-But we can confidently skip the function check anyway.
---- a/configure.ac
-+++ b/configure.ac
-@@ -12302,4 +12302 @@
--        # progress_callback is the only func with plain C linkage
--        # checking for it also filters out older, KDE-dependent libgpgmepp versions
--        AC_CHECK_LIB(gpgmepp, progress_callback, [ GPGMEPP_LIBS=-lgpgmepp ],
--            [AC_MSG_ERROR(gpgmepp not found or not functional)], [])
-+        GPGMEPP_LIBS=-lgpgmepp

pkgs/applications/office/libreoffice/poppler-22-04-0.patch

@@ -1,100 +0,0 @@
-Patch from OpenSUSE
-https://build.opensuse.org/package/view_file/LibreOffice:Factory/libreoffice/poppler-22-04-0.patch?expand=1&rev=45e176f964509ebe3560d0dbf1ec8be9
-Index: libreoffice-7.3.3.1/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
-===================================================================
---- libreoffice-7.3.3.1.orig/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
-+++ libreoffice-7.3.3.1/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
-@@ -474,12 +474,21 @@ int PDFOutDev::parseFont( long long nNew
-     {
-         // TODO(P3): Unfortunately, need to read stream twice, since
-         // we must write byte count to stdout before
-+#if POPPLER_CHECK_VERSION(22, 04, 0) // readEmbFontFile signature changed
-+        auto pBuf = gfxFont->readEmbFontFile( m_pDoc->getXRef());
-+        if ( pBuf )
-+        {
-+            aNewFont.isEmbedded = true;
-+            nSize = pBuf->size();
-+        }
-+#else
-         char* pBuf = gfxFont->readEmbFontFile( m_pDoc->getXRef(), &nSize );
-         if( pBuf )
-         {
-             aNewFont.isEmbedded = true;
-             gfree(pBuf);
-         }
-+#endif
-     }
- 
-     m_aFontMap[ nNewId ] = aNewFont;
-@@ -492,21 +501,35 @@ void PDFOutDev::writeFontFile( GfxFont*
-         return;
- 
-     int nSize = 0;
-+#if POPPLER_CHECK_VERSION(22, 04, 0) // readEmbFontFile signature changed
-+    auto pBuf = gfxFont->readEmbFontFile( m_pDoc->getXRef());
-+    if ( !pBuf )
-+        return;
-+    nSize = pBuf->size();
-+#else
-     char* pBuf = gfxFont->readEmbFontFile( m_pDoc->getXRef(), &nSize );
-     if( !pBuf )
-         return;
-+#endif
- 
-     // ---sync point--- see SYNC STREAMS above
-     fflush(stdout);
- 
-+#if POPPLER_CHECK_VERSION(22, 04, 0) // readEmbFontFile signature changed
-+    if( fwrite(pBuf->data(), sizeof(unsigned char), nSize, g_binary_out) != static_cast<size_t>(nSize) )
-+    {
-+#else
-     if( fwrite(pBuf, sizeof(char), nSize, g_binary_out) != static_cast<size_t>(nSize) )
-     {
-         gfree(pBuf);
-+#endif
-         exit(1); // error
-     }
-     // ---sync point--- see SYNC STREAMS above
-     fflush(g_binary_out);
-+#if !POPPLER_CHECK_VERSION(22, 04, 0) // readEmbFontFile signature changed
-     gfree(pBuf);
-+#endif
- }
- 
- #if POPPLER_CHECK_VERSION(0, 83, 0)
-@@ -759,7 +782,11 @@ void PDFOutDev::updateFont(GfxState *sta
- {
-     assert(state);
- 
-+#if POPPLER_CHECK_VERSION(22, 04, 0)
-+    std::shared_ptr<GfxFont> gfxFont = state->getFont();
-+#else
-     GfxFont *gfxFont = state->getFont();
-+#endif
-     if( !gfxFont )
-         return;
- 
-@@ -776,7 +803,11 @@ void PDFOutDev::updateFont(GfxState *sta
-         m_aFontMap.find( fontID );
-     if( it == m_aFontMap.end() )
-     {
-+#if POPPLER_CHECK_VERSION(22, 04, 0)
-+        nEmbedSize = parseFont( fontID, gfxFont.get(), state );
-+#else
-         nEmbedSize = parseFont( fontID, gfxFont, state );
-+#endif
-         it = m_aFontMap.find( fontID );
-     }
- 
-@@ -806,7 +837,11 @@ void PDFOutDev::updateFont(GfxState *sta
- 
-     if (nEmbedSize)
-     {
-+#if POPPLER_CHECK_VERSION(22, 04, 0)
-+        writeFontFile(gfxFont.get());
-+#else
-         writeFontFile(gfxFont);
-+#endif
-     }
- }
- 

pkgs/applications/office/libreoffice/skip-failed-test-with-icu70.patch

@@ -1,29 +0,0 @@
---- a/i18npool/qa/cppunit/test_breakiterator.cxx
-+++ b/i18npool/qa/cppunit/test_breakiterator.cxx
-@@ -35,7 +35,7 @@ public:
-     void testWeak();
-     void testAsian();
-     void testThai();
--#if (U_ICU_VERSION_MAJOR_NUM > 51)
-+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
-     void testLao();
- #ifdef TODO
-     void testNorthernThai();
-@@ -52,7 +52,7 @@ public:
-     CPPUNIT_TEST(testWeak);
-     CPPUNIT_TEST(testAsian);
-     CPPUNIT_TEST(testThai);
--#if (U_ICU_VERSION_MAJOR_NUM > 51)
-+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
-     CPPUNIT_TEST(testLao);
- #ifdef TODO
-     CPPUNIT_TEST(testKhmer);
-@@ -843,7 +843,7 @@ void TestBreakIterator::testAsian()
-     }
- }
- 
--#if (U_ICU_VERSION_MAJOR_NUM > 51)
-+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
- //A test to ensure that our Lao word boundary detection is useful
- void TestBreakIterator::testLao()
- {

pkgs/applications/office/libreoffice/soffice-template.desktop

@@ -1,6 +0,0 @@
-[Desktop Entry]
-Name=LibreOffice @app@...
-Comment=Enter LibreOffice @app@ filename:
-Type=Link
-URL=.source/soffice.@ext@
-Icon=libreoffice-oasis-@type@

pkgs/applications/office/libreoffice/src-fresh/deps.nix

@@ -7,11 +7,11 @@
     md5name = "e763a9dc21c3d2667402d66e202e3f8ef4db51b34b79ef41f56cacb86dcd6eed-libabw-0.1.3.tar.xz";
   }
   {
-    name = "boost_1_79_0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/boost_1_79_0.tar.xz";
-    sha256 = "2058aa88758a0e1aaac1759b3c4bad2526f899c6ecc6eeea79aa5e8fd3ea95dc";
+    name = "boost_1_82_0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/boost_1_82_0.tar.xz";
+    sha256 = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de";
     md5 = "";
-    md5name = "2058aa88758a0e1aaac1759b3c4bad2526f899c6ecc6eeea79aa5e8fd3ea95dc-boost_1_79_0.tar.xz";
+    md5name = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de-boost_1_82_0.tar.xz";
   }
   {
     name = "box2d-2.4.1.tar.gz";
@@ -98,11 +98,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.0.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.0.1.tar.xz";
-    sha256 = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0";
+    name = "curl-8.2.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.2.1.tar.xz";
+    sha256 = "dd322f6bd0a20e6cebdfd388f69e98c3d183bed792cf4713c8a7ef498cba4894";
     md5 = "";
-    md5name = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0-curl-8.0.1.tar.xz";
+    md5name = "dd322f6bd0a20e6cebdfd388f69e98c3d183bed792cf4713c8a7ef498cba4894-curl-8.2.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -154,11 +154,11 @@
     md5name = "acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76-Firebird-3.0.7.33374-0.tar.bz2";
   }
   {
-    name = "fontconfig-2.13.94.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/fontconfig-2.13.94.tar.xz";
-    sha256 = "a5f052cb73fd479ffb7b697980510903b563bbb55b8f7a2b001fcfb94026003c";
+    name = "fontconfig-2.14.2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/fontconfig-2.14.2.tar.xz";
+    sha256 = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b";
     md5 = "";
-    md5name = "a5f052cb73fd479ffb7b697980510903b563bbb55b8f7a2b001fcfb94026003c-fontconfig-2.13.94.tar.xz";
+    md5name = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b-fontconfig-2.14.2.tar.xz";
   }
   {
     name = "crosextrafonts-20130214.tar.gz";
@@ -209,34 +209,6 @@
     md5 = "e7a384790b13c29113e22e596ade9687";
     md5name = "e7a384790b13c29113e22e596ade9687-LinLibertineG-20120116.zip";
   }
-  {
-    name = "source-code-pro-2.030R-ro-1.050R-it.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/907d6e99f241876695c19ff3db0b8923-source-code-pro-2.030R-ro-1.050R-it.tar.gz";
-    sha256 = "09466dce87653333f189acd8358c60c6736dcd95f042dee0b644bdcf65b6ae2f";
-    md5 = "907d6e99f241876695c19ff3db0b8923";
-    md5name = "907d6e99f241876695c19ff3db0b8923-source-code-pro-2.030R-ro-1.050R-it.tar.gz";
-  }
-  {
-    name = "source-sans-pro-2.010R-ro-1.065R-it.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/edc4d741888bc0d38e32dbaa17149596-source-sans-pro-2.010R-ro-1.065R-it.tar.gz";
-    sha256 = "e7bc9a1fec787a529e49f5a26b93dcdcf41506449dfc70f92cdef6d17eb6fb61";
-    md5 = "edc4d741888bc0d38e32dbaa17149596";
-    md5name = "edc4d741888bc0d38e32dbaa17149596-source-sans-pro-2.010R-ro-1.065R-it.tar.gz";
-  }
-  {
-    name = "source-serif-pro-3.000R.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/source-serif-pro-3.000R.tar.gz";
-    sha256 = "826a2b784d5cdb4c2bbc7830eb62871528360a61a52689c102a101623f1928e3";
-    md5 = "";
-    md5name = "826a2b784d5cdb4c2bbc7830eb62871528360a61a52689c102a101623f1928e3-source-serif-pro-3.000R.tar.gz";
-  }
-  {
-    name = "EmojiOneColor-SVGinOT-1.3.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/EmojiOneColor-SVGinOT-1.3.tar.gz";
-    sha256 = "d1a08f7c10589f22740231017694af0a7a270760c8dec33d8d1c038e2be0a0c7";
-    md5 = "";
-    md5name = "d1a08f7c10589f22740231017694af0a7a270760c8dec33d8d1c038e2be0a0c7-EmojiOneColor-SVGinOT-1.3.tar.gz";
-  }
   {
     name = "noto-fonts-20171024.tar.gz";
     url = "https://dev-www.libreoffice.org/src/noto-fonts-20171024.tar.gz";
@@ -266,18 +238,11 @@
     md5name = "b98b67602a2c8880a1770f0b9e37c190f29a7e2ade5616784f0b89fbdb75bf52-alef-1.001.tar.gz";
   }
   {
-    name = "Amiri-0.117.zip";
-    url = "https://dev-www.libreoffice.org/src/Amiri-0.117.zip";
-    sha256 = "9c4e768893e0023a0ad6f488d5c84bd5add6565d3dcadb838ba5b20e75fcc9a7";
+    name = "Amiri-1.000.zip";
+    url = "https://dev-www.libreoffice.org/src/Amiri-1.000.zip";
+    sha256 = "926fe1bd7dfde8e55178281f645258bfced6420c951c6f2fd532fd21691bca30";
     md5 = "";
-    md5name = "9c4e768893e0023a0ad6f488d5c84bd5add6565d3dcadb838ba5b20e75fcc9a7-Amiri-0.117.zip";
-  }
-  {
-    name = "ttf-kacst_2.01+mry.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/ttf-kacst_2.01+mry.tar.gz";
-    sha256 = "dca00f5e655f2f217a766faa73a81f542c5c204aa3a47017c3c2be0b31d00a56";
-    md5 = "";
-    md5name = "dca00f5e655f2f217a766faa73a81f542c5c204aa3a47017c3c2be0b31d00a56-ttf-kacst_2.01+mry.tar.gz";
+    md5name = "926fe1bd7dfde8e55178281f645258bfced6420c951c6f2fd532fd21691bca30-Amiri-1.000.zip";
   }
   {
     name = "ReemKufi-1.2.zip";
@@ -301,11 +266,18 @@
     md5name = "0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac-libfreehand-0.1.2.tar.xz";
   }
   {
-    name = "freetype-2.12.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/freetype-2.12.0.tar.xz";
-    sha256 = "ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4adda9b354399033";
+    name = "freetype-2.13.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/freetype-2.13.0.tar.xz";
+    sha256 = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c";
     md5 = "";
-    md5name = "ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4adda9b354399033-freetype-2.12.0.tar.xz";
+    md5name = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c-freetype-2.13.0.tar.xz";
+  }
+  {
+    name = "frozen-1.1.1.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/frozen-1.1.1.tar.gz";
+    sha256 = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45";
+    md5 = "";
+    md5name = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45-frozen-1.1.1.tar.gz";
   }
   {
     name = "glm-0.9.9.8.zip";
@@ -329,11 +301,11 @@
     md5name = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc-graphite2-minimal-1.3.14.tgz";
   }
   {
-    name = "harfbuzz-7.1.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/harfbuzz-7.1.0.tar.xz";
-    sha256 = "f135a61cd464c9ed6bc9823764c188f276c3850a8dc904628de2a87966b7077b";
+    name = "harfbuzz-8.0.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/harfbuzz-8.0.0.tar.xz";
+    sha256 = "1f98b5e3d06a344fe667d7e8210094ced458791499839bddde98c167ce6a7c79";
     md5 = "";
-    md5name = "f135a61cd464c9ed6bc9823764c188f276c3850a8dc904628de2a87966b7077b-harfbuzz-7.1.0.tar.xz";
+    md5name = "1f98b5e3d06a344fe667d7e8210094ced458791499839bddde98c167ce6a7c79-harfbuzz-8.0.0.tar.xz";
   }
   {
     name = "hsqldb_1_8_0.zip";
@@ -343,11 +315,11 @@
     md5name = "17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip";
   }
   {
-    name = "hunspell-1.7.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/hunspell-1.7.0.tar.gz";
-    sha256 = "57be4e03ae9dd62c3471f667a0d81a14513e314d4d92081292b90435944ff951";
+    name = "hunspell-1.7.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/hunspell-1.7.2.tar.gz";
+    sha256 = "11ddfa39afe28c28539fe65fc4f1592d410c1e9b6dd7d8a91ca25d85e9ec65b8";
     md5 = "";
-    md5name = "57be4e03ae9dd62c3471f667a0d81a14513e314d4d92081292b90435944ff951-hunspell-1.7.0.tar.gz";
+    md5name = "11ddfa39afe28c28539fe65fc4f1592d410c1e9b6dd7d8a91ca25d85e9ec65b8-hunspell-1.7.2.tar.gz";
   }
   {
     name = "hyphen-2.8.8.tar.gz";
@@ -357,18 +329,18 @@
     md5name = "5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz";
   }
   {
-    name = "icu4c-71_1-src.tgz";
-    url = "https://dev-www.libreoffice.org/src/icu4c-71_1-src.tgz";
-    sha256 = "67a7e6e51f61faf1306b6935333e13b2c48abd8da6d2f46ce6adca24b1e21ebf";
+    name = "icu4c-73_2-src.tgz";
+    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-src.tgz";
+    sha256 = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1";
     md5 = "";
-    md5name = "67a7e6e51f61faf1306b6935333e13b2c48abd8da6d2f46ce6adca24b1e21ebf-icu4c-71_1-src.tgz";
+    md5name = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1-icu4c-73_2-src.tgz";
   }
   {
-    name = "icu4c-71_1-data.zip";
-    url = "https://dev-www.libreoffice.org/src/icu4c-71_1-data.zip";
-    sha256 = "e3882b4fece6e5e039f22c3189b7ba224180fd26fdbfa9db284617455b93e804";
+    name = "icu4c-73_2-data.zip";
+    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-data.zip";
+    sha256 = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701";
     md5 = "";
-    md5name = "e3882b4fece6e5e039f22c3189b7ba224180fd26fdbfa9db284617455b93e804-icu4c-71_1-data.zip";
+    md5name = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701-icu4c-73_2-data.zip";
   }
   {
     name = "flow-engine-0.9.4.zip";
@@ -448,18 +420,18 @@
     md5name = "39bb3fcea1514f1369fcfc87542390fd-sacjava-1.3.zip";
   }
   {
-    name = "libjpeg-turbo-2.1.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libjpeg-turbo-2.1.2.tar.gz";
-    sha256 = "09b96cb8cbff9ea556a9c2d173485fd19488844d55276ed4f42240e1e2073ce5";
+    name = "libjpeg-turbo-2.1.5.1.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libjpeg-turbo-2.1.5.1.tar.gz";
+    sha256 = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf";
     md5 = "";
-    md5name = "09b96cb8cbff9ea556a9c2d173485fd19488844d55276ed4f42240e1e2073ce5-libjpeg-turbo-2.1.2.tar.gz";
+    md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2022-08-08.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2022-08-08.tar.bz2";
-    sha256 = "e2d9224e0e50fc8ad12a3cf47396bbcadf45b2515839d4770432653a88972c00";
+    name = "language-subtag-registry-2023-05-11.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2023-05-11.tar.bz2";
+    sha256 = "9042b64cd473bf36073513b474046f13778107b57c2ac47fb2633104120d69da";
     md5 = "";
-    md5name = "e2d9224e0e50fc8ad12a3cf47396bbcadf45b2515839d4770432653a88972c00-language-subtag-registry-2022-08-08.tar.bz2";
+    md5name = "9042b64cd473bf36073513b474046f13778107b57c2ac47fb2633104120d69da-language-subtag-registry-2023-05-11.tar.bz2";
   }
   {
     name = "lcms2-2.12.tar.gz";
@@ -469,11 +441,11 @@
     md5name = "18663985e864100455ac3e507625c438c3710354d85e5cbb7cd4043e11fe10f5-lcms2-2.12.tar.gz";
   }
   {
-    name = "libassuan-2.5.5.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.5.tar.bz2";
-    sha256 = "8e8c2fcc982f9ca67dcbb1d95e2dc746b1739a4668bc20b3a3c5be632edb34e4";
+    name = "libassuan-2.5.6.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.6.tar.bz2";
+    sha256 = "e9fd27218d5394904e4e39788f9b1742711c3e6b41689a31aa3380bd5aa4f426";
     md5 = "";
-    md5name = "8e8c2fcc982f9ca67dcbb1d95e2dc746b1739a4668bc20b3a3c5be632edb34e4-libassuan-2.5.5.tar.bz2";
+    md5name = "e9fd27218d5394904e4e39788f9b1742711c3e6b41689a31aa3380bd5aa4f426-libassuan-2.5.6.tar.bz2";
   }
   {
     name = "libatomic_ops-7.6.8.tar.gz";
@@ -525,39 +497,39 @@
     md5name = "5dcb4db3b2340f81f601ce86d8d76b69e34d70f84f804192c901e4b7f84d5fb0-libnumbertext-1.0.11.tar.xz";
   }
   {
-    name = "ltm-1.0.zip";
-    url = "https://dev-www.libreoffice.org/src/ltm-1.0.zip";
-    sha256 = "083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304f7281f8f7347483";
+    name = "ltm-1.2.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/ltm-1.2.0.tar.xz";
+    sha256 = "b7c75eecf680219484055fcedd686064409254ae44bc31a96c5032843c0e18b1";
     md5 = "";
-    md5name = "083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304f7281f8f7347483-ltm-1.0.zip";
+    md5name = "b7c75eecf680219484055fcedd686064409254ae44bc31a96c5032843c0e18b1-ltm-1.2.0.tar.xz";
   }
   {
-    name = "libwebp-1.2.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libwebp-1.2.4.tar.gz";
-    sha256 = "7bf5a8a28cc69bcfa8cb214f2c3095703c6b73ac5fba4d5480c205331d9494df";
+    name = "libwebp-1.3.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libwebp-1.3.2.tar.gz";
+    sha256 = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4";
     md5 = "";
-    md5name = "7bf5a8a28cc69bcfa8cb214f2c3095703c6b73ac5fba4d5480c205331d9494df-libwebp-1.2.4.tar.gz";
+    md5name = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4-libwebp-1.3.2.tar.gz";
   }
   {
-    name = "xmlsec1-1.2.34.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.2.34.tar.gz";
-    sha256 = "52ced4943f35bd7d0818a38298c1528ca4ac8a54440fd71134a07d2d1370a262";
+    name = "xmlsec1-1.2.37.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.2.37.tar.gz";
+    sha256 = "5f8dfbcb6d1e56bddd0b5ec2e00a3d0ca5342a9f57c24dffde5c796b2be2871c";
     md5 = "";
-    md5name = "52ced4943f35bd7d0818a38298c1528ca4ac8a54440fd71134a07d2d1370a262-xmlsec1-1.2.34.tar.gz";
+    md5name = "5f8dfbcb6d1e56bddd0b5ec2e00a3d0ca5342a9f57c24dffde5c796b2be2871c-xmlsec1-1.2.37.tar.gz";
   }
   {
-    name = "libxml2-2.10.4.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.10.4.tar.xz";
-    sha256 = "ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45";
+    name = "libxml2-2.11.4.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.11.4.tar.xz";
+    sha256 = "737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7";
     md5 = "";
-    md5name = "ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45-libxml2-2.10.4.tar.xz";
+    md5name = "737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7-libxml2-2.11.4.tar.xz";
   }
   {
-    name = "libxslt-1.1.35.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.35.tar.xz";
-    sha256 = "8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79";
+    name = "libxslt-1.1.38.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.38.tar.xz";
+    sha256 = "1f32450425819a09acaff2ab7a5a7f8a2ec7956e505d7beeb45e843d0e1ecab1";
     md5 = "";
-    md5name = "8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79-libxslt-1.1.35.tar.xz";
+    md5name = "1f32450425819a09acaff2ab7a5a7f8a2ec7956e505d7beeb45e843d0e1ecab1-libxslt-1.1.38.tar.xz";
   }
   {
     name = "lp_solve_5.5.tar.gz";
@@ -581,11 +553,11 @@
     md5name = "431434d3926f4bcce2e5c97240609983f60d7ff50df5a72083934759bb863f7b-mariadb-connector-c-3.1.8-src.tar.gz";
   }
   {
-    name = "mdds-2.0.3.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/mdds-2.0.3.tar.bz2";
-    sha256 = "9771fe42e133443c13ca187253763e17c8bc96a1a02aec9e1e8893367ffa9ce5";
+    name = "mdds-2.1.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/mdds-2.1.1.tar.xz";
+    sha256 = "1483d90cefb8aa4563c4d0a85cb7b243aa95217d235d422e9ca6722fd5b97e56";
     md5 = "";
-    md5name = "9771fe42e133443c13ca187253763e17c8bc96a1a02aec9e1e8893367ffa9ce5-mdds-2.0.3.tar.bz2";
+    md5name = "1483d90cefb8aa4563c4d0a85cb7b243aa95217d235d422e9ca6722fd5b97e56-mdds-2.1.1.tar.xz";
   }
   {
     name = "mDNSResponder-878.200.35.tar.gz";
@@ -609,18 +581,18 @@
     md5name = "e8750123a78d61b943cef78b7736c8a7f20bb0a649aa112402124fba794fc21c-libmwaw-0.3.21.tar.xz";
   }
   {
-    name = "mythes-1.2.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz";
-    sha256 = "1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b0e0790a305f";
-    md5 = "a8c2c5b8f09e7ede322d5c602ff6a4b6";
-    md5name = "a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz";
+    name = "mythes-1.2.5.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/mythes-1.2.5.tar.xz";
+    sha256 = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d";
+    md5 = "";
+    md5name = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d-mythes-1.2.5.tar.xz";
   }
   {
-    name = "nss-3.88.1-with-nspr-4.35.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/nss-3.88.1-with-nspr-4.35.tar.gz";
-    sha256 = "fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a";
+    name = "nss-3.90-with-nspr-4.35.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/nss-3.90-with-nspr-4.35.tar.gz";
+    sha256 = "f78ab1d911cae8bbc94758fb3bd0f731df4087423a4ff5db271ba65381f6b739";
     md5 = "";
-    md5name = "fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a-nss-3.88.1-with-nspr-4.35.tar.gz";
+    md5name = "f78ab1d911cae8bbc94758fb3bd0f731df4087423a4ff5db271ba65381f6b739-nss-3.90-with-nspr-4.35.tar.gz";
   }
   {
     name = "libodfgen-0.1.8.tar.xz";
@@ -644,25 +616,25 @@
     md5name = "8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar";
   }
   {
-    name = "openldap-2.4.59.tgz";
-    url = "https://dev-www.libreoffice.org/src/openldap-2.4.59.tgz";
-    sha256 = "99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34";
+    name = "openldap-2.6.6.tgz";
+    url = "https://dev-www.libreoffice.org/src/openldap-2.6.6.tgz";
+    sha256 = "082e998cf542984d43634442dbe11da860759e510907152ea579bdc42fe39ea0";
     md5 = "";
-    md5name = "99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34-openldap-2.4.59.tgz";
+    md5name = "082e998cf542984d43634442dbe11da860759e510907152ea579bdc42fe39ea0-openldap-2.6.6.tgz";
   }
   {
-    name = "openssl-1.1.1t.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/openssl-1.1.1t.tar.gz";
-    sha256 = "8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b";
+    name = "openssl-3.0.10.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/openssl-3.0.10.tar.gz";
+    sha256 = "1761d4f5b13a1028b9b6f3d4b8e17feb0cedc9370f6afe61d7193d2cdce83323";
     md5 = "";
-    md5name = "8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b-openssl-1.1.1t.tar.gz";
+    md5name = "1761d4f5b13a1028b9b6f3d4b8e17feb0cedc9370f6afe61d7193d2cdce83323-openssl-3.0.10.tar.gz";
   }
   {
-    name = "liborcus-0.17.2.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/liborcus-0.17.2.tar.bz2";
-    sha256 = "2a86c405a5929f749b27637509596421d46805753364ab258b035fd01fbde143";
+    name = "liborcus-0.18.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/liborcus-0.18.1.tar.xz";
+    sha256 = "6006b9f1576315e313df715a7e72a17f3e0b17d7b6bd119cfa8a0b608ce971eb";
     md5 = "";
-    md5name = "2a86c405a5929f749b27637509596421d46805753364ab258b035fd01fbde143-liborcus-0.17.2.tar.bz2";
+    md5name = "6006b9f1576315e313df715a7e72a17f3e0b17d7b6bd119cfa8a0b608ce971eb-liborcus-0.18.1.tar.xz";
   }
   {
     name = "libpagemaker-0.0.4.tar.xz";
@@ -672,11 +644,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-5058.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-5058.tar.bz2";
-    sha256 = "eaf4ce9fad32b5d951c524139df23119b66c67720057defb97acab2dfb2582ac";
+    name = "pdfium-5778.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-5778.tar.bz2";
+    sha256 = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06";
     md5 = "";
-    md5name = "eaf4ce9fad32b5d951c524139df23119b66c67720057defb97acab2dfb2582ac-pdfium-5058.tar.bz2";
+    md5name = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06-pdfium-5778.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -686,46 +658,46 @@
     md5name = "ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e-pixman-0.42.2.tar.gz";
   }
   {
-    name = "libpng-1.6.39.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libpng-1.6.39.tar.xz";
-    sha256 = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937";
+    name = "libpng-1.6.40.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libpng-1.6.40.tar.xz";
+    sha256 = "535b479b2467ff231a3ec6d92a525906fb8ef27978be4f66dbe05d3f3a01b3a1";
     md5 = "";
-    md5name = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937-libpng-1.6.39.tar.xz";
+    md5name = "535b479b2467ff231a3ec6d92a525906fb8ef27978be4f66dbe05d3f3a01b3a1-libpng-1.6.40.tar.xz";
   }
   {
-    name = "tiff-4.5.0rc3.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/tiff-4.5.0rc3.tar.xz";
-    sha256 = "dafac979c5e7b6c650025569c5a4e720995ba5f17bc17e6276d1f12427be267c";
+    name = "tiff-4.5.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/tiff-4.5.1.tar.xz";
+    sha256 = "3c080867114c26edab3129644a63b708028a90514b7fe3126e38e11d24f9f88a";
     md5 = "";
-    md5name = "dafac979c5e7b6c650025569c5a4e720995ba5f17bc17e6276d1f12427be267c-tiff-4.5.0rc3.tar.xz";
+    md5name = "3c080867114c26edab3129644a63b708028a90514b7fe3126e38e11d24f9f88a-tiff-4.5.1.tar.xz";
   }
   {
-    name = "poppler-22.12.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-22.12.0.tar.xz";
-    sha256 = "d9aa9cacdfbd0f8e98fc2b3bb008e645597ed480685757c3e7bc74b4278d15c0";
+    name = "poppler-23.06.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-23.06.0.tar.xz";
+    sha256 = "d38c6b2f31c8f6f3727fb60a011a0e6c567ebf56ef1ccad36263ca9ed6448a65";
     md5 = "";
-    md5name = "d9aa9cacdfbd0f8e98fc2b3bb008e645597ed480685757c3e7bc74b4278d15c0-poppler-22.12.0.tar.xz";
+    md5name = "d38c6b2f31c8f6f3727fb60a011a0e6c567ebf56ef1ccad36263ca9ed6448a65-poppler-23.06.0.tar.xz";
   }
   {
-    name = "poppler-data-0.4.11.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/poppler-data-0.4.11.tar.gz";
-    sha256 = "2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb3069bb0874825f08c";
+    name = "poppler-data-0.4.12.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/poppler-data-0.4.12.tar.gz";
+    sha256 = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74";
     md5 = "";
-    md5name = "2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb3069bb0874825f08c-poppler-data-0.4.11.tar.gz";
+    md5name = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74-poppler-data-0.4.12.tar.gz";
   }
   {
-    name = "postgresql-13.10.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-13.10.tar.bz2";
-    sha256 = "5bbcf5a56d85c44f3a8b058fb46862ff49cbc91834d07e295d02e6de3c216df2";
+    name = "postgresql-13.11.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.11.tar.bz2";
+    sha256 = "4992ff647203566b670d4e54dc5317499a26856c93576d0ea951bdf6bee50bfb";
     md5 = "";
-    md5name = "5bbcf5a56d85c44f3a8b058fb46862ff49cbc91834d07e295d02e6de3c216df2-postgresql-13.10.tar.bz2";
+    md5name = "4992ff647203566b670d4e54dc5317499a26856c93576d0ea951bdf6bee50bfb-postgresql-13.11.tar.bz2";
   }
   {
-    name = "Python-3.8.16.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.8.16.tar.xz";
-    sha256 = "d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562";
+    name = "Python-3.8.18.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.8.18.tar.xz";
+    sha256 = "3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f";
     md5 = "";
-    md5name = "d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562-Python-3.8.16.tar.xz";
+    md5name = "3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f-Python-3.8.18.tar.xz";
   }
   {
     name = "libqxp-0.0.2.tar.xz";
@@ -770,11 +742,11 @@
     md5name = "798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
   }
   {
-    name = "skia-m103-b301ff025004c9cd82816c86c547588e6c24b466.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/skia-m103-b301ff025004c9cd82816c86c547588e6c24b466.tar.xz";
-    sha256 = "c094a6247e44104beaaa0d00c825beb6baf1a8e532dc22214747495317a65bd9";
+    name = "skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
+    sha256 = "0d08a99ed46cde43b5ad2672b5d8770c8eb85d0d26cb8f1f85fd9befe1e9ceb9";
     md5 = "";
-    md5name = "c094a6247e44104beaaa0d00c825beb6baf1a8e532dc22214747495317a65bd9-skia-m103-b301ff025004c9cd82816c86c547588e6c24b466.tar.xz";
+    md5name = "0d08a99ed46cde43b5ad2672b5d8770c8eb85d0d26cb8f1f85fd9befe1e9ceb9-skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
   }
   {
     name = "libstaroffice-0.0.7.tar.xz";
@@ -797,13 +769,6 @@
     md5 = "";
     md5name = "82c818be771f242388457aa8c807e4b52aa84dc22b21c6c56184a6b4cbb085e6-twaindsm_2.4.1.orig.tar.gz";
   }
-  {
-    name = "ucpp-1.3.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz";
-    sha256 = "983941d31ee8d366085cadf28db75eb1f5cb03ba1e5853b98f12f7f51c63b776";
-    md5 = "0168229624cfac409e766913506961a8";
-    md5name = "0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz";
-  }
   {
     name = "libvisio-0.1.7.tar.xz";
     url = "https://dev-www.libreoffice.org/src/libvisio-0.1.7.tar.xz";
@@ -819,11 +784,11 @@
     md5name = "2465b0b662fdc5d4e3bebcdc9a79027713fb629ca2bff04a3c9251fdec42dd09-libwpd-0.10.3.tar.xz";
   }
   {
-    name = "libwpg-0.3.3.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libwpg-0.3.3.tar.xz";
-    sha256 = "99b3f7f8832385748582ab8130fbb9e5607bd5179bebf9751ac1d51a53099d1c";
+    name = "libwpg-0.3.4.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libwpg-0.3.4.tar.xz";
+    sha256 = "b55fda9440d1e070630eb2487d8b8697cf412c214a27caee9df69cec7c004de3";
     md5 = "";
-    md5name = "99b3f7f8832385748582ab8130fbb9e5607bd5179bebf9751ac1d51a53099d1c-libwpg-0.3.3.tar.xz";
+    md5name = "b55fda9440d1e070630eb2487d8b8697cf412c214a27caee9df69cec7c004de3-libwpg-0.3.4.tar.xz";
   }
   {
     name = "libwps-0.4.12.tar.xz";
@@ -854,10 +819,10 @@
     md5name = "27051a30cb057fdb5d5de65a1f165c7153dc76e27fe62251cbb86639eb2caf22-libzmf-0.0.2.tar.xz";
   }
   {
-    name = "zxing-cpp-1.2.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/zxing-cpp-1.2.0.tar.gz";
-    sha256 = "653d9e44195d86cf64a36af9ff3a1978ec5599df3882439fefa56e7064f55e8a";
+    name = "zxing-cpp-2.0.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.0.0.tar.gz";
+    sha256 = "12b76b7005c30d34265fc20356d340da179b0b4d43d2c1b35bcca86776069f76";
     md5 = "";
-    md5name = "653d9e44195d86cf64a36af9ff3a1978ec5599df3882439fefa56e7064f55e8a-zxing-cpp-1.2.0.tar.gz";
+    md5name = "12b76b7005c30d34265fc20356d340da179b0b4d43d2c1b35bcca86776069f76-zxing-cpp-2.0.0.tar.gz";
   }
 ]

pkgs/applications/office/libreoffice/src-fresh/help.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "0j6idhdywnbl0qaimf1ahxaqvp9s0y2hfrbcbmw32c30g812gp3b";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.6.2/libreoffice-help-7.6.2.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-fresh/main.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "18lw5gnjihjwzdsk6xql7ax5lasykxxvg5bp40q4rqics0xp7lp5";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.6.2/libreoffice-7.6.2.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-fresh/override.nix

@@ -1,22 +0,0 @@
-{ lib, kdeIntegration, ... }:
-attrs:
-{
-  postConfigure = attrs.postConfigure + ''
-    sed -e '/CPPUNIT_TEST(Import_Export_Import);/d' -i './sw/qa/inc/swmodeltestbase.hxx'
-    sed -e '/CPPUNIT_ASSERT(!bRTL);/d' -i './vcl/qa/cppunit/text.cxx'
-
-    sed -e '/CPPUNIT_ASSERT_EQUAL(0, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(4, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(11, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(18, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-
-    sed -e '/CPPUNIT_ASSERT_EQUAL(3, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(9, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(17, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(22, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-  '';
-  configureFlags = attrs.configureFlags ++ [
-    "--without-system-dragonbox"
-    "--without-system-libfixmath"
-  ];
-}

pkgs/applications/office/libreoffice/src-fresh/primary.nix

@@ -1,36 +0,0 @@
-{ fetchurl }:
-
-rec {
-  fetchSrc = {name, hash}: fetchurl {
-    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${name}-${version}.tar.xz";
-    sha256 = hash;
-  };
-
-  major = "7";
-  minor = "5";
-  patch = "4";
-  tweak = "1";
-
-  subdir = "${major}.${minor}.${patch}";
-
-  version = "${subdir}${if tweak == "" then "" else "."}${tweak}";
-
-  src = fetchurl {
-    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    hash = "sha256-dWE7yXldkiEnsJOxfxyZ9p05eARqexgRRgNV158VVF4=";
-  };
-
-  # FIXME rename
-  translations = fetchSrc {
-    name = "translations";
-    hash = "sha256-dv3L8DtdxZcwmeXnqtTtwIpOvwZg3aH3VvJBiiZzbh0=";
-  };
-
-  # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
-  # it and LibreOffice can use these by pointing DICPATH environment variable at the hunspell directory
-
-  help = fetchSrc {
-    name = "help";
-    hash = "sha256-2CrGEyK5AQEAo1Qz1ACmvMH7BaOubW5BNLWv3fDEdOY=";
-  };
-}

pkgs/applications/office/libreoffice/src-fresh/translations.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "02nnys853na9hwznxnf1h0pm5ymijvpyv9chg45v11vy2ak9y8sv";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.6.2/libreoffice-translations-7.6.2.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-fresh/version.nix

@@ -0,0 +1 @@
+"7.6.2.1"

pkgs/applications/office/libreoffice/src-still/deps.nix

@@ -98,11 +98,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.0.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.0.1.tar.xz";
-    sha256 = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0";
+    name = "curl-8.2.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.2.1.tar.xz";
+    sha256 = "dd322f6bd0a20e6cebdfd388f69e98c3d183bed792cf4713c8a7ef498cba4894";
     md5 = "";
-    md5name = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0-curl-8.0.1.tar.xz";
+    md5name = "dd322f6bd0a20e6cebdfd388f69e98c3d183bed792cf4713c8a7ef498cba4894-curl-8.2.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -273,11 +273,11 @@
     md5name = "0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac-libfreehand-0.1.2.tar.xz";
   }
   {
-    name = "freetype-2.12.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/freetype-2.12.0.tar.xz";
-    sha256 = "ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4adda9b354399033";
+    name = "freetype-2.13.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/freetype-2.13.0.tar.xz";
+    sha256 = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c";
     md5 = "";
-    md5name = "ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4adda9b354399033-freetype-2.12.0.tar.xz";
+    md5name = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c-freetype-2.13.0.tar.xz";
   }
   {
     name = "glm-0.9.9.8.zip";
@@ -427,11 +427,11 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2022-08-08.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2022-08-08.tar.bz2";
-    sha256 = "e2d9224e0e50fc8ad12a3cf47396bbcadf45b2515839d4770432653a88972c00";
+    name = "language-subtag-registry-2023-05-11.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2023-05-11.tar.bz2";
+    sha256 = "9042b64cd473bf36073513b474046f13778107b57c2ac47fb2633104120d69da";
     md5 = "";
-    md5name = "e2d9224e0e50fc8ad12a3cf47396bbcadf45b2515839d4770432653a88972c00-language-subtag-registry-2022-08-08.tar.bz2";
+    md5name = "9042b64cd473bf36073513b474046f13778107b57c2ac47fb2633104120d69da-language-subtag-registry-2023-05-11.tar.bz2";
   }
   {
     name = "lcms2-2.12.tar.gz";
@@ -504,11 +504,11 @@
     md5name = "083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304f7281f8f7347483-ltm-1.0.zip";
   }
   {
-    name = "libwebp-1.3.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libwebp-1.3.0.tar.gz";
-    sha256 = "64ac4614db292ae8c5aa26de0295bf1623dbb3985054cb656c55e67431def17c";
+    name = "libwebp-1.3.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libwebp-1.3.2.tar.gz";
+    sha256 = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4";
     md5 = "";
-    md5name = "64ac4614db292ae8c5aa26de0295bf1623dbb3985054cb656c55e67431def17c-libwebp-1.3.0.tar.gz";
+    md5name = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4-libwebp-1.3.2.tar.gz";
   }
   {
     name = "xmlsec1-1.2.37.tar.gz";
@@ -518,11 +518,11 @@
     md5name = "5f8dfbcb6d1e56bddd0b5ec2e00a3d0ca5342a9f57c24dffde5c796b2be2871c-xmlsec1-1.2.37.tar.gz";
   }
   {
-    name = "libxml2-2.10.4.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.10.4.tar.xz";
-    sha256 = "ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45";
+    name = "libxml2-2.11.4.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.11.4.tar.xz";
+    sha256 = "737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7";
     md5 = "";
-    md5name = "ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45-libxml2-2.10.4.tar.xz";
+    md5name = "737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7-libxml2-2.11.4.tar.xz";
   }
   {
     name = "libxslt-1.1.35.tar.xz";
@@ -588,11 +588,11 @@
     md5name = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d-mythes-1.2.5.tar.xz";
   }
   {
-    name = "nss-3.88.1-with-nspr-4.35.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/nss-3.88.1-with-nspr-4.35.tar.gz";
-    sha256 = "fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a";
+    name = "nss-3.90-with-nspr-4.35.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/nss-3.90-with-nspr-4.35.tar.gz";
+    sha256 = "f78ab1d911cae8bbc94758fb3bd0f731df4087423a4ff5db271ba65381f6b739";
     md5 = "";
-    md5name = "fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a-nss-3.88.1-with-nspr-4.35.tar.gz";
+    md5name = "f78ab1d911cae8bbc94758fb3bd0f731df4087423a4ff5db271ba65381f6b739-nss-3.90-with-nspr-4.35.tar.gz";
   }
   {
     name = "libodfgen-0.1.8.tar.xz";
@@ -623,11 +623,11 @@
     md5name = "99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34-openldap-2.4.59.tgz";
   }
   {
-    name = "openssl-3.0.8.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/openssl-3.0.8.tar.gz";
-    sha256 = "6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e";
+    name = "openssl-3.0.10.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/openssl-3.0.10.tar.gz";
+    sha256 = "1761d4f5b13a1028b9b6f3d4b8e17feb0cedc9370f6afe61d7193d2cdce83323";
     md5 = "";
-    md5name = "6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e-openssl-3.0.8.tar.gz";
+    md5name = "1761d4f5b13a1028b9b6f3d4b8e17feb0cedc9370f6afe61d7193d2cdce83323-openssl-3.0.10.tar.gz";
   }
   {
     name = "liborcus-0.17.2.tar.bz2";
@@ -644,11 +644,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-5408.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-5408.tar.bz2";
-    sha256 = "7db59b1e91f2bc0ab4c5e19d1a4f881e6a47dbb0d3b7e980a7358225b12a0f35";
+    name = "pdfium-5778.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-5778.tar.bz2";
+    sha256 = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06";
     md5 = "";
-    md5name = "7db59b1e91f2bc0ab4c5e19d1a4f881e6a47dbb0d3b7e980a7358225b12a0f35-pdfium-5408.tar.bz2";
+    md5name = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06-pdfium-5778.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -665,11 +665,11 @@
     md5name = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937-libpng-1.6.39.tar.xz";
   }
   {
-    name = "tiff-4.5.0rc3.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/tiff-4.5.0rc3.tar.xz";
-    sha256 = "dafac979c5e7b6c650025569c5a4e720995ba5f17bc17e6276d1f12427be267c";
+    name = "tiff-4.5.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/tiff-4.5.1.tar.xz";
+    sha256 = "3c080867114c26edab3129644a63b708028a90514b7fe3126e38e11d24f9f88a";
     md5 = "";
-    md5name = "dafac979c5e7b6c650025569c5a4e720995ba5f17bc17e6276d1f12427be267c-tiff-4.5.0rc3.tar.xz";
+    md5name = "3c080867114c26edab3129644a63b708028a90514b7fe3126e38e11d24f9f88a-tiff-4.5.1.tar.xz";
   }
   {
     name = "poppler-22.12.0.tar.xz";
@@ -693,11 +693,11 @@
     md5name = "5bbcf5a56d85c44f3a8b058fb46862ff49cbc91834d07e295d02e6de3c216df2-postgresql-13.10.tar.bz2";
   }
   {
-    name = "Python-3.8.16.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.8.16.tar.xz";
-    sha256 = "d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562";
+    name = "Python-3.8.18.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.8.18.tar.xz";
+    sha256 = "3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f";
     md5 = "";
-    md5name = "d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562-Python-3.8.16.tar.xz";
+    md5name = "3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f-Python-3.8.18.tar.xz";
   }
   {
     name = "libqxp-0.0.2.tar.xz";

pkgs/applications/office/libreoffice/src-still/help.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "0lpgcwq03qxvhbl5b9ndaz0cwswd6jin1rfm6hv3kr8q4l52jgb3";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.5.7/libreoffice-help-7.5.7.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-still/main.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "041bs79539w61yqmy971rfpf8qvfs4cl2m2fdjv7n1nqf6a2z4v5";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.5.7/libreoffice-7.5.7.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-still/override.nix

@@ -1,21 +0,0 @@
-{ lib, kdeIntegration, commonsLogging, ... }:
-attrs:
-{
-  postConfigure = attrs.postConfigure + ''
-    sed -e '/CPPUNIT_TEST(Import_Export_Import);/d' -i './sw/qa/inc/swmodeltestbase.hxx'
-    sed -e '/CPPUNIT_ASSERT(!bRTL);/d' -i './vcl/qa/cppunit/text.cxx'
-
-    sed -e '/CPPUNIT_ASSERT_EQUAL(0, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(4, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(11, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(18, nMinRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-
-    sed -e '/CPPUNIT_ASSERT_EQUAL(3, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(9, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(17, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-    sed -e '/CPPUNIT_ASSERT_EQUAL(22, nEndRunPos);/d' -i './vcl/qa/cppunit/text.cxx'
-  '';
-  configureFlags = attrs.configureFlags;
-
-  patches = attrs.patches or [];
-}

pkgs/applications/office/libreoffice/src-still/primary.nix

@@ -1,36 +0,0 @@
-{ fetchurl }:
-
-rec {
-  fetchSrc = {name, hash}: fetchurl {
-    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${name}-${version}.tar.xz";
-    inherit hash;
-  };
-
-  major = "7";
-  minor = "4";
-  patch = "7";
-  tweak = "2";
-
-  subdir = "${major}.${minor}.${patch}";
-
-  version = "${subdir}${if tweak == "" then "" else "."}${tweak}";
-
-  src = fetchurl {
-    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    hash = "sha256-dD2R8qE4png4D6eo7LWyQB2ZSwZ7MwdQ8DrY9SOi+yA=";
-  };
-
-  # FIXME rename
-  translations = fetchSrc {
-    name = "translations";
-    hash = "sha256-7wea0EClmvwcPvgQDGagkOF7eBVvYTZScCEEpirdXnE=";
-  };
-
-  # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
-  # it and LibreOffice can use these by pointing DICPATH environment variable at the hunspell directory
-
-  help = fetchSrc {
-    name = "help";
-    hash = "sha256-vcQWE3mBZx2sBQ9KzTh6zM7277mK9twfvyESTzTiII8=";
-  };
-}

pkgs/applications/office/libreoffice/src-still/translations.nix

@@ -0,0 +1,4 @@
+{
+  sha256 = "1zxhnn8sslrlyb1cyg319slza2kn6mcc4h3li9ssnlfzkrzvxhc4";
+  url = "https://download.documentfoundation.org/libreoffice/src/7.5.7/libreoffice-translations-7.5.7.1.tar.xz";
+}

pkgs/applications/office/libreoffice/src-still/version.nix

@@ -0,0 +1 @@
+"7.5.7.1"

pkgs/applications/office/libreoffice/update.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p python3 pup curl jq nix
+
+set -euo pipefail
+echoerr() { echo "$@" 1>&2; }
+
+fname="$1"
+echoerr got fname $fname
+shift
+
+variant="$1"
+# See comment near version_major variable
+if [[ $variant == fresh ]]; then
+    head_tail=head
+elif [[ $variant == still ]]; then
+    head_tail=tail
+else
+    echoerr got unknown variant $variant
+    exit 3
+fi
+echoerr got variant $variant
+shift
+
+# Not totally needed, but makes it easy to run the update in case tis folder is
+# deleted.
+mkdir -p "$(dirname $fname)/src-$variant"
+cd "$(dirname $fname)/src-$variant"
+
+# The pup command prints both fresh and still versions one after another, and
+# we use either head -1 or tail -1 to get the right version, per the if elif
+# above.
+version_major="$(curl --silent https://www.libreoffice.org/download/download-libreoffice/ |\
+    pup '.dl_version_number text{}' | $head_tail -1)"
+echoerr got from website ${variant}_version $version_major
+baseurl=https://download.documentfoundation.org/libreoffice/src/$version_major
+tarballs=($(curl --silent $baseurl/ |\
+    pup 'table json{}' |\
+    jq --raw-output '.. | .href? | strings' |\
+    grep "$version_major.*.tar.xz$"))
+
+full_version="$(echo ${tarballs[0]} | sed -e 's/^libreoffice-//' -e 's/.tar.xz$//')"
+echoerr full version is $full_version
+echo \"$full_version\" > version.nix
+
+for t in help translations; do
+    echo "{" > $t.nix
+    echo "  sha256 = "\"$(nix-prefetch-url $baseurl/libreoffice-$t-$full_version.tar.xz)'";' >> $t.nix
+    echo "  url = "\"$baseurl/libreoffice-$t-$full_version.tar.xz'";' >> $t.nix
+    echo "}" >> $t.nix
+done
+
+# Out of loop nix-prefetch-url, because there is no $t, and we want the output
+# path as well, to get the download.lst file from there afterwards.
+main_path_hash=($(nix-prefetch-url --print-path $baseurl/libreoffice-$full_version.tar.xz))
+echo "{" > main.nix
+echo "  sha256 = "\"${main_path_hash[0]}'";' >> main.nix
+echo "  url = "\"$baseurl/libreoffice-$full_version.tar.xz'";' >> main.nix
+echo "}" >> main.nix
+echoerr got filename ${main_path_hash[1]}
+
+# Environment variable required by ../generate-libreoffice-srcs.py
+export downloadList=/tmp/nixpkgs-libreoffice-update-download-$full_version.lst
+# Need to extract the file only if it doesn't exist, otherwise spare time be
+# skipping this.
+if [[ ! -f "$downloadList" ]]; then
+    tar --extract \
+        --file=${main_path_hash[1]} \
+        libreoffice-$full_version/download.lst \
+        -O > $downloadList
+else
+    echoerr relying on previously downloaded downloadList file
+fi
+cd ..
+python3 ./generate-libreoffice-srcs.py > src-$variant/deps.nix

pkgs/applications/office/libreoffice/wrapper.nix

@@ -19,7 +19,9 @@
 }:
 
 let
-  inherit (unwrapped.srcs.primary) major minor;
+  inherit (unwrapped) version;
+  major = lib.versions.major version;
+  minor = lib.versions.minor version;
 
   makeWrapperArgs = builtins.concatStringsSep " " ([
     "--set" "GDK_PIXBUF_MODULE_FILE" "${librsvg}/${gdk-pixbuf.moduleDir}.cache"

pkgs/applications/science/logic/cryptominisat/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptominisat";
-  version = "5.11.12";
+  version = "5.11.14";
 
   src = fetchFromGitHub {
     owner = "msoos";
     repo = "cryptominisat";
     rev = version;
-    hash = "sha256-1AJx8gPf+qDpAp0p4cfCObKZDWKDAKdGopllr2ajpHw=";
+    hash = "sha256-p/sVinjEh078PGtJ6JBRA8EmrJVcchBs9L3bRZvCHuo=";
   };
 
   buildInputs = [ python3 boost ];

pkgs/applications/science/math/qalculate-gtk/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, intltool, autoreconfHook, pkg-config, libqalculate, gtk3, curl, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, intltool, autoreconfHook, pkg-config, libqalculate, gtk3, curl, wrapGAppsHook, desktopToDarwinBundle }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-gtk";
@@ -13,7 +13,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
-  nativeBuildInputs = [ intltool pkg-config autoreconfHook wrapGAppsHook ];
+  nativeBuildInputs = [ intltool pkg-config autoreconfHook wrapGAppsHook ]
+    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
   buildInputs = [ libqalculate gtk3 curl ];
   enableParallelBuilding = true;
 

pkgs/applications/system/glances/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonApplication rec {
   pname = "glances";
-  version = "3.4.0.2";
+  version = "3.4.0.3";
   disabled = isPyPy;
 
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-mAhdablRr97DXNmwRk8cA9Q0rS9PsEocVvNc686Gco0=";
+    hash = "sha256-TakQqyHKuiFdBL73JQzflNUMYmBINyY0flqitqoIpmg=";
   };
 
   # On Darwin this package segfaults due to mismatch of pure and impure

pkgs/applications/virtualization/catatonit/default.nix

@@ -1,26 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, glibc, nixosTests }:
+{ stdenv
+, lib
+, autoreconfHook
+, fetchFromGitHub
+, glibc
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "catatonit";
-  version = "0.1.7";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jX4fYC/rpfd3ro2UZ6OEu4kU5wpusOwmEVPWEjxwlW4=";
+    sha256 = "sha256-AqJURf4OrPHfTm5joA3oPXH4McE1k0ouvDXAF3jiwgk=";
   };
 
-  patches = [
-    # Pull the fix pending upstream inclusion to support automake-1.16.5:
-    #  https://github.com/openSUSE/catatonit/pull/18
-    (fetchpatch {
-      name = "automake-1.16.5.patch";
-      url = "https://github.com/openSUSE/catatonit/commit/99bb9048f532257f3a2c3856cfa19fe957ab6cec.patch";
-      sha256 = "sha256-ooxVjtWXJddQiBvO9I5aRyLeL8y3ecxW/Kvtfg/bpRA=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
 
@@ -37,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A container init that is so simple it's effectively brain-dead";
     homepage = "https://github.com/openSUSE/catatonit";
-    license = licenses.gpl3Plus;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ erosennin ] ++ teams.podman.members;
     platforms = platforms.linux;
   };

pkgs/applications/virtualization/nixpacks/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.15.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iZOcpVvhHbf8u2NrnwAIg7jlTN/afeBi2+jbsNYKlz4=";
+    sha256 = "sha256-ulzSxS5yukkLCykdsxl9nNRnakQ1UitJAHlB9CwLhsM=";
   };
 
-  cargoHash = "sha256-cysxQ4qc70zpEOpL5bccMHdEDGbdjzbGftTMb58RrYc=";
+  cargoHash = "sha256-nNnFbvHsew7jtTBpD3eKXgjkc1arzjWMZWwj96Qmgcw=";
 
   # skip test due FHS dependency
   doCheck = false;

pkgs/applications/virtualization/podman/default.nix

@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.6.2";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-Zxzb7ORyugvN9mhxa0s8r0ch16Ndbm3Z1JCsQcwbF6g=";
+    hash = "sha256-xbU2F/QYtTKeZacTmwKDfIGuUg9VStEO/jkpChK0DyU=";
   };
 
   patches = [

pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch

@@ -1,16 +1,19 @@
-diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
-index a118285f7..d775f0099 100644
---- a/pkg/machine/qemu/machine.go
-+++ b/pkg/machine/qemu/machine.go
-@@ -1560,11 +1560,6 @@ func (v *MachineVM) waitAPIAndPrintInfo(forwardState machine.APIForwardingState,
- 			case machine.NotInstalled:
- 				fmt.Printf("\nThe system helper service is not installed; the default Docker API socket\n")
- 				fmt.Printf("address can't be used by podman. ")
--				if helper := findClaimHelper(); len(helper) > 0 {
--					fmt.Printf("If you would like to install it run the\nfollowing commands:\n")
--					fmt.Printf("\n\tsudo %s install\n", helper)
--					fmt.Printf("\tpodman machine stop%s; podman machine start%s\n\n", suffix, suffix)
--				}
- 			case machine.MachineLocal:
+diff --git a/pkg/machine/machine_common.go b/pkg/machine/machine_common.go
+index 649748947..a981d93bf 100644
+--- a/pkg/machine/machine_common.go
++++ b/pkg/machine/machine_common.go
+@@ -127,14 +127,6 @@ address can't be used by podman. `
+ 
+ 				if len(helper) < 1 {
+ 					fmt.Print(fmtString)
+-				} else {
+-					fmtString += `If you would like to install it run the\nfollowing commands:
+-
+-        sudo %s install
+-        podman machine stop%[1]s; podman machine start%[1]s
+-
+-                `
+-					fmt.Printf(fmtString, helper, suffix)
+ 				}
+ 			case MachineLocal:
  				fmt.Printf("\nAnother process was listening on the default Docker API socket address.\n")
- 			case machine.ClaimUnsupported:

pkgs/applications/window-managers/spectrwm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "spectrwm";
-  version = "3.4.1";
+  version = "unstable-2023-05-07";
 
   src = fetchFromGitHub {
     owner = "conformal";
     repo = "spectrwm";
-    rev = "SPECTRWM_3_4_1";
-    sha256 = "0bf0d25yr0craksamczn2mdy6cjp27l88smihlw9bw4p6a2qhi41";
+    rev = "06e3733175969c307a6fd47240a7a37b29d60513";
+    sha256 = "QcEwFg9QTi+cCl2JghKOzEZ19LP/ZFMbZJAMJ0BLH9M=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/build-support/php/hooks/composer-install-hook.sh

@@ -22,13 +22,47 @@ composerInstallConfigureHook() {
     fi
 
     if [[ ! -f "composer.lock" ]]; then
-        echo "No composer.lock file found, consider adding one to your repository to ensure reproducible builds."
+        composer \
+            --no-ansi \
+            --no-install \
+            --no-interaction \
+            ${composerNoDev:+--no-dev} \
+            ${composerNoPlugins:+--no-plugins} \
+            ${composerNoScripts:+--no-scripts} \
+            update
 
-        if [[ -f "${composerRepository}/composer.lock" ]]; then
-            cp ${composerRepository}/composer.lock composer.lock
-        fi
+        mkdir -p $out
+        cp composer.lock $out/
 
-        echo "Using an autogenerated composer.lock file."
+        echo
+        echo 'No composer.lock file found, consider adding one to your repository to ensure reproducible builds.'
+        echo "In the meantime, a composer.lock file has been generated for you in $out/composer.lock"
+        echo
+        echo 'To fix the issue:'
+        echo "1. Copy the composer.lock file from $out/composer.lock to the project's source:"
+        echo "  cp $out/composer.lock <path>"
+        echo '2. Add the composerLock attribute, pointing to the copied composer.lock file:'
+        echo '  composerLock = ./composer.lock;'
+        echo
+
+        exit 1
+    fi
+
+    echo "Validating consistency between composer.lock and ${composerRepository}/composer.lock"
+    if [[! @diff@ composer.lock "${composerRepository}/composer.lock"]]; then
+        echo
+        echo "ERROR: vendorHash is out of date"
+        echo
+        echo "composer.lock is not the same in $composerRepository"
+        echo
+        echo "To fix the issue:"
+        echo '1. Set vendorHash to an empty string: `vendorHash = "";`'
+        echo '2. Build the derivation and wait for it to fail with a hash mismatch'
+        echo '3. Copy the "got: sha256-..." value back into the vendorHash field'
+        echo '   You should have: vendorHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";'
+        echo
+
+        exit 1
     fi
 
     chmod +w composer.json composer.lock

pkgs/build-support/php/hooks/composer-repository-hook.sh

@@ -17,7 +17,6 @@ composerRepositoryConfigureHook() {
     fi
 
     if [[ ! -f "composer.lock" ]]; then
-        echo "No composer.lock file found, consider adding one to your repository to ensure reproducible builds."
         composer \
             --no-ansi \
             --no-install \
@@ -26,7 +25,22 @@ composerRepositoryConfigureHook() {
             ${composerNoPlugins:+--no-plugins} \
             ${composerNoScripts:+--no-scripts} \
             update
-        echo "Using an autogenerated composer.lock file."
+
+        mkdir -p $out
+        cp composer.lock $out/
+
+        echo
+        echo 'No composer.lock file found, consider adding one to your repository to ensure reproducible builds.'
+        echo "In the meantime, a composer.lock file has been generated for you in $out/composer.lock"
+        echo
+        echo 'To fix the issue:'
+        echo "1. Copy the composer.lock file from $out/composer.lock to the project's source:"
+        echo "  cp $out/composer.lock <path>"
+        echo '2. Add the composerLock attribute, pointing to the copied composer.lock file:'
+        echo '  composerLock = ./composer.lock;'
+        echo
+
+        exit 1
     fi
 
     echo "Finished composerRepositoryConfigureHook"
@@ -61,8 +75,8 @@ composerRepositoryInstallHook() {
 
     cp -ar repository/. $out/
 
-    # Copy the composer.lock files to the output directory, in case it has been
-    # autogenerated.
+    # Copy the composer.lock files to the output directory, to be able to validate consistency with
+    # the src composer.lock file where this fixed-output derivation is used
     cp composer.lock $out/
 
     echo "Finished composerRepositoryInstallHook"

pkgs/build-support/php/hooks/default.nix

@@ -1,9 +1,11 @@
-{ makeSetupHook
+{ lib
+, makeSetupHook
 , jq
 , moreutils
 , makeBinaryWrapper
 , php
 , cacert
+, buildPackages
 }:
 
 {
@@ -18,6 +20,10 @@
     {
       name = "composer-install-hook.sh";
       propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php cacert ];
-      substitutions = { };
+      substitutions = {
+        # Specify the stdenv's `diff` by abspath to ensure that the user's build
+        # inputs do not cause us to find the wrong `diff`.
+        diff = "${lib.getBin buildPackages.diffutils}/bin/diff";
+      };
     } ./composer-install-hook.sh;
 }

pkgs/by-name/br/bruno/package.nix

@@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, wrapGAppsHook
+, alsa-lib
+, gtk3
+, mesa
+, nspr
+, nss
+, systemd
+, nix-update-script
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bruno";
+  version = "0.17.0";
+
+  src = fetchurl {
+    url = "https://github.com/usebruno/bruno/releases/download/v${version}/bruno_${version}_amd64_linux.deb";
+    hash = "sha256-4FF9SEgWuIPQSarOBTaEvgdgRTkR1caRYr/bjfFmTLE=";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
+
+  buildInputs = [
+    alsa-lib
+    gtk3
+    mesa
+    nspr
+    nss
+  ];
+
+  runtimeDependencies = [ (lib.getLib systemd) ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/bin"
+    cp -R opt $out
+    cp -R "usr/share" "$out/share"
+    ln -s "$out/opt/Bruno/bruno" "$out/bin/bruno"
+    chmod -R g-w "$out"
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    substituteInPlace "$out/share/applications/bruno.desktop" \
+      --replace "/opt/Bruno/bruno" "$out/bin/bruno"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Open-source IDE For exploring and testing APIs.";
+    homepage = "https://www.usebruno.com";
+    license = licenses.mit;
+    maintainers = with maintainers; [ water-sucks lucasew ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/by-name/co/convco/package.nix

@@ -6,30 +6,30 @@
 , libiconv
 , openssl
 , pkg-config
-, Security
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "convco";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "convco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RNUMLc4lY18tsOr2vmpkYdQ2poVOQxsSVl5PEuhzQxw=";
+    hash = "sha256-qf04mtxBqZy9kpFsqz8lVtyUzNtCYE8cNiVJVQ+sCn0=";
   };
 
-  cargoHash = "sha256-ChB4w9qnSzuOGTPYfpAJS2icy9wi1RjONCsfT+3vlRo=";
+  cargoHash = "sha256-A1z8ccdsaBC9gY4rD/0NnuQHm7x4eVlMPBvkMKGHK54=";
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
 
   meta = with lib; {
     description = "A Conventional commit cli";
     homepage = "https://github.com/convco/convco";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ hoverbear ];
+    maintainers = with maintainers; [ hoverbear cafkafk ];
   };
 }

pkgs/by-name/ic/icewm/package.nix

@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-KgdCgKR3KqDf9GONCBRkLpNLoOycE0y4UXxHxBqNudk=";
+    hash = "sha256-s1gupU5AOQOMqz8YRMIBc2Oe7DMnlGgXitcq7CFWwSE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pd/pdepend/package.nix

@@ -2,15 +2,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "pdepend";
-  version = "2.14.0";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "pdepend";
     repo = "pdepend";
     rev = finalAttrs.version;
-    hash = "sha256-ZmgMuOpUsx5JWTcPRS6qKbTWZvuOrBVOVdPMcvvTV20=";
+    hash = "sha256-tVWOR0rKMnQDeHk3MHhEVOjn+dSpoMx+Ln+AwFRMwYs=";
   };
 
+  composerLock = ./composer.lock;
   vendorHash = "sha256-MWm8urRB9IujqrIl22x+JFFCRR+nINLQqnHUywT2pi0=";
 
   meta = {

pkgs/by-name/tr/trealla/package.nix

@@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.27.48";
+  version = "2.28.1";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6+1mhMEXpKN9DynCBkvKWqP4KihpC2HWa/PA1gnDSRA=";
+    hash = "sha256-Wy4FPvBQY2CvpR9QiFbI1wI2ztUAc1XvaOGaGH7SkKs=";
   };
 
   postPatch = ''

pkgs/by-name/zp/zpaqfranz/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zpaqfranz";
-  version = "58.9";
+  version = "58.10";
 
   src = fetchFromGitHub {
     owner = "fcorbelli";
     repo = "zpaqfranz";
     rev = finalAttrs.version;
-    hash = "sha256-R7LA7gu2q2Kk+FPCLZedwrlICk6OUao/EJHEvxA1+Nc=";
+    hash = "sha256-eBokpah7j3QQChprvjeigt2/sEpkq6ZS4rQhIP5cAYo=";
   };
 
   nativeBuildInputs = [

pkgs/data/fonts/sarasa-gothic/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.42.0";
+  version = "0.42.1";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-BZWOQQhkK+bQhS5MFIJ81unGDevp8WptPA/dOmf12xs=";
+    hash = "sha256-e6ig+boWzYiOzENkIsj/z9FFt2pZc+T0dYoFoeONMFM=";
   };
 
   sourceRoot = ".";

pkgs/desktops/gnome-2/default.nix

@@ -44,7 +44,7 @@ lib.makeScope pkgs.newScope (self: with self; {
 } // lib.optionalAttrs config.allowAliases {
   inherit (pkgs)
     # GTK Libs
-    glib glibmm atk atkmm cairo pango pangomm gdk_pixbuf gtkmm2 libcanberra-gtk2
+    glib glibmm atk atkmm cairo pango pangomm gtkmm2 libcanberra-gtk2
 
     # Included for backwards compatibility
     libsoup libwnck2 gtk-doc gnome-doc-utils

pkgs/development/compilers/intel-graphics-compiler/default.nix

@@ -5,7 +5,7 @@
 , runCommandLocal
 , bison
 , flex
-, llvmPackages_11
+, llvmPackages_14
 , opencl-clang
 , python3
 , spirv-tools
@@ -19,32 +19,29 @@ let
   vc_intrinsics_src = fetchFromGitHub {
     owner = "intel";
     repo = "vc-intrinsics";
-    rev = "v0.11.0";
-    sha256 = "sha256-74JBW7qU8huSqwqgxNbvbGj1DlJJThgGhb3owBYmhvI=";
+    rev = "v0.13.0";
+    hash = "sha256-A9G1PH0WGdxU2u/ODrou53qF9kvrmE0tJSl9cFIOus0=";
   };
 
-  llvmPkgs = llvmPackages_11 // {
-    spirv-llvm-translator = spirv-llvm-translator.override { llvm = llvm; };
-  } // lib.optionalAttrs buildWithPatches opencl-clang;
-
-  inherit (llvmPackages_11) lld llvm;
-  inherit (llvmPkgs) clang libclang spirv-llvm-translator;
+  inherit (llvmPackages_14) lld llvm;
+  inherit (if buildWithPatches then opencl-clang else llvmPackages_14) clang libclang;
+  spirv-llvm-translator' = spirv-llvm-translator.override { inherit llvm; };
 in
 
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "1.0.12812.26";
+  version = "1.0.14828.8";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-graphics-compiler";
     rev = "igc-${version}";
-    sha256 = "sha256-KpaDaDYVp40H7OscDGUpzEMgIOIk397ANi+8sDk4Wow=";
+    hash = "sha256-BGmZVBEw7XlgbQcWgRK+qbJS9U4Sm9G8g9m0GRUhmCI=";
   };
 
-  nativeBuildInputs = [ cmake bison flex python3 ];
+  nativeBuildInputs = [ bison cmake flex python3 ];
 
-  buildInputs = [ spirv-headers spirv-tools spirv-llvm-translator llvm lld ];
+  buildInputs = [ lld llvm spirv-headers spirv-llvm-translator' spirv-tools ];
 
   strictDeps = true;
 
@@ -52,15 +49,6 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   postPatch = ''
-    substituteInPlace external/SPIRV-Tools/CMakeLists.txt \
-      --replace '$'''{SPIRV-Tools_DIR}../../..' \
-                '${spirv-tools}' \
-      --replace 'SPIRV-Headers_INCLUDE_DIR "/usr/include"' \
-                'SPIRV-Headers_INCLUDE_DIR "${spirv-headers}/include"' \
-      --replace 'set_target_properties(SPIRV-Tools' \
-                'set_target_properties(SPIRV-Tools-shared' \
-      --replace 'IGC_BUILD__PROJ__SPIRV-Tools SPIRV-Tools' \
-                'IGC_BUILD__PROJ__SPIRV-Tools SPIRV-Tools-shared'
     substituteInPlace IGC/AdaptorOCL/igc-opencl.pc.in \
       --replace '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \
       --replace '/@CMAKE_INSTALL_LIBDIR@' "/lib"
@@ -71,24 +59,20 @@ stdenv.mkDerivation rec {
   prebuilds = runCommandLocal "igc-cclang-prebuilds" { } ''
     mkdir $out
     ln -s ${clang}/bin/clang $out/
-    ln -s clang $out/clang-${lib.versions.major (lib.getVersion clang)}
     ln -s ${opencl-clang}/lib/* $out/
     ln -s ${lib.getLib libclang}/lib/clang/${lib.getVersion clang}/include/opencl-c.h $out/
     ln -s ${lib.getLib libclang}/lib/clang/${lib.getVersion clang}/include/opencl-c-base.h $out/
   '';
 
   cmakeFlags = [
-    "-Wno-dev"
     "-DVC_INTRINSICS_SRC=${vc_intrinsics_src}"
-    "-DIGC_OPTION__SPIRV_TOOLS_MODE=Prebuilds"
     "-DCCLANG_BUILD_PREBUILDS=ON"
     "-DCCLANG_BUILD_PREBUILDS_DIR=${prebuilds}"
-    "-DIGC_PREFERRED_LLVM_VERSION=${lib.getVersion llvm}"
+    "-DIGC_OPTION__SPIRV_TOOLS_MODE=Prebuilds"
+    "-DIGC_OPTION__VC_INTRINSICS_MODE=Source"
+    "-Wno-dev"
   ];
 
-  # causes redefinition of _FORTIFY_SOURCE
-  hardeningDisable = [ "fortify3" ];
-
   meta = with lib; {
     homepage = "https://github.com/intel/intel-graphics-compiler";
     description = "LLVM-based compiler for OpenCL targeting Intel Gen graphics hardware";

pkgs/development/compilers/mlkit/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlkit";
-  version = "4.7.3";
+  version = "4.7.4";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
     rev = "v${version}";
-    sha256 = "sha256-sJY2w1+hv5KrRunf6Dfwc+eY6X9HYghVyAlWLlHvv+E=";
+    sha256 = "sha256-ASWPINMxR5Rlly1C0yB3llfhju/dDW2HBbHSIF4ecR8=";
   };
 
   nativeBuildInputs = [ autoreconfHook mlton ];

pkgs/development/compilers/purescript/purescript/default.nix

@@ -15,7 +15,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.15.10";
+  version = "0.15.11";
 
   # These hashes can be updated automatically by running the ./update.sh script.
   src =
@@ -25,17 +25,17 @@ in stdenv.mkDerivation rec {
       then
       fetchurl {
         url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos-arm64.tar.gz";
-        sha256 = "1pk6mkjy09qvh8lsygb5gb77i2fqwjzz8jdjkxlyzynp3wpkcjp7";
+        sha256 = "1ffhcwzb4cazxviqdl9zwg0jnbhsisg2pbxkqbk63zj2grjcpg86";
       }
       else
       fetchurl {
         url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-        sha256 = "14yd00v3dsnnwj2f645vy0apnp1843ms9ffd2ccv7bj5p4kxsdzg";
+        sha256 = "0h923269zb9hwlifcv8skz17zlggh8hsxhrgf33h2inl1midvgq5";
       })
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "03p5f2m5xvrqgiacs4yfc2dgz6frlxy90h6z1nm6wan40p2vd41r";
+      sha256 = "0vrbgmgmmwbyxl969k59zkfrq5dxshspnzskx8zmhcy4flamz8av";
     };
 
 

pkgs/development/interpreters/erlang/26.nix

@@ -1,7 +1,7 @@
 { lib, mkDerivation }:
 
 mkDerivation {
-  version = "26.1";
-  sha256 = "sha256-GECxenOxwZ0A7cY5Z/amthNezGVPsmZWB5gHayy78cI=";
+  version = "26.1.1";
+  sha256 = "sha256-Y0sArUFkGxlAAgrgUxn5Rjnd72geG08VO9FBxg/fJAg=";
 }
 

pkgs/development/libraries/elpa/default.nix

@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace '#!/bin/bash' '#!${stdenv.shell}'
   '';
 
+  outputs = [ "out" "doc" "man" "dev" ];
+
   nativeBuildInputs = [ autoreconfHook perl ];
 
   buildInputs = [ mpi blas lapack scalapack ]
@@ -74,6 +76,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.hostPlatform.isx86_64 "--enable-sse-assembly"
     ++ lib.optionals enableCuda [  "--enable-nvidia-gpu" "--with-NVIDIA-GPU-compute-capability=${nvidiaArch}" ];
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   nativeCheckInputs = [ mpiCheckPhaseHook openssh ];

pkgs/development/libraries/mdds/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mdds";
-  version = "2.0.3";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "mdds";
     repo = "mdds";
     rev = finalAttrs.version;
-    hash = "sha256-Y9uBJKM34UTEj/3c1w69QHhvwFcMNlAohEco0O0B+xI=";
+    hash = "sha256-a412LpgDiYM8TMToaUrTlHtblYS1HehzrDOwvIAAxiA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/ngtcp2/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.17.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-vY3RooC8ttezru6vAqbG1MU5uZhD8fLnlEYVYS3pFRk=";
+    hash = "sha256-agiQRy/e5VS+ANxajXYi5huRjQQ2M8eddH/AzmwnHdQ==";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -27,13 +27,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_STATIC_LIB=OFF"
   ];
 
-  preConfigure = ''
-    # https://github.com/ngtcp2/ngtcp2/issues/858
-    # Fix ngtcp2_crypto_openssl remnants.
-    substituteInPlace crypto/includes/CMakeLists.txt \
-      --replace 'ngtcp2/ngtcp2_crypto_openssl.h' 'ngtcp2/ngtcp2_crypto_quictls.h'
-  '';
-
   doCheck = true;
   enableParallelBuilding = true;
 

pkgs/development/libraries/nss/latest.nix

@@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.93";
-  hash = "sha256-FfVLtyBI6xBfjA6TagS4medMPbmhm7weAKzuKvlHaoo=";
+  version = "3.94";
+  hash = "sha256-RjrhgO6eXunjrU9ikyZlfiNngMyGVXKpMKFlIKutndg=";
 }

pkgs/development/libraries/opencl-clang/default.nix

@@ -1,19 +1,16 @@
 { lib
 , stdenv
+, applyPatches
 , fetchFromGitHub
 , fetchpatch
 , cmake
 , git
-, llvmPackages_11
+, llvmPackages_14
 , spirv-llvm-translator
 , buildWithPatches ? true
 }:
 
 let
-  llvmPkgs = llvmPackages_11 // {
-    inherit spirv-llvm-translator;
-  };
-
   addPatches = component: pkg: pkg.overrideAttrs (oldAttrs: {
     postPatch = oldAttrs.postPatch or "" + ''
       for p in ${passthru.patchesOut}/${component}/*; do
@@ -22,8 +19,13 @@ let
     '';
   });
 
+  llvmPkgs = llvmPackages_14;
+  inherit (llvmPkgs) llvm;
+  spirv-llvm-translator' = spirv-llvm-translator.override { inherit llvm; };
+  libclang = if buildWithPatches then passthru.libclang else llvmPkgs.libclang;
+
   passthru = rec {
-    spirv-llvm-translator = llvmPkgs.spirv-llvm-translator.override { llvm = llvmPackages_11.llvm; };
+    spirv-llvm-translator = spirv-llvm-translator';
     llvm = addPatches "llvm" llvmPkgs.llvm;
     libclang = addPatches "clang" llvmPkgs.libclang;
 
@@ -34,7 +36,7 @@ let
 
     patchesOut = stdenv.mkDerivation {
       pname = "opencl-clang-patches";
-      inherit (library) version src patches;
+      inherit version src;
       # Clang patches assume the root is the llvm root dir
       # but clang root in nixpkgs is the clang sub-directory
       postPatch = ''
@@ -52,56 +54,66 @@ let
     };
   };
 
-  library = let
-    inherit (llvmPackages_11) llvm;
-    inherit (if buildWithPatches then passthru else llvmPkgs) libclang spirv-llvm-translator;
-  in
-    stdenv.mkDerivation {
-      pname = "opencl-clang";
-      version = "unstable-2022-03-16";
-
-
-      src = fetchFromGitHub {
-        owner = "intel";
-        repo = "opencl-clang";
-        rev = "bbdd1587f577397a105c900be114b56755d1f7dc";
-        sha256 = "sha256-qEZoQ6h4XAvSnJ7/gLXBb1qrzeYa6Jp6nij9VFo8MwQ=";
-      };
-
-      patches = [
-        # Build script tries to find Clang OpenCL headers under ${llvm}
-        # Work around it by specifying that directory manually.
-        ./opencl-headers-dir.patch
-      ];
-
-      # Uses linker flags that are not supported on Darwin.
-      postPatch = lib.optionalString stdenv.isDarwin ''
-        sed -i -e '/SET_LINUX_EXPORTS_FILE/d' CMakeLists.txt
-        substituteInPlace CMakeLists.txt \
-          --replace '-Wl,--no-undefined' ""
-      '';
-
-      nativeBuildInputs = [ cmake git llvm.dev ];
-
-      buildInputs = [ libclang llvm spirv-llvm-translator ];
-
-      cmakeFlags = [
-        "-DPREFERRED_LLVM_VERSION=${lib.getVersion llvm}"
-        "-DOPENCL_HEADERS_DIR=${libclang.lib}/lib/clang/${lib.getVersion libclang}/include/"
-
-        "-DLLVMSPIRV_INCLUDED_IN_LLVM=OFF"
-        "-DSPIRV_TRANSLATOR_DIR=${spirv-llvm-translator}"
-      ];
-
-      inherit passthru;
-
-      meta = with lib; {
-        homepage    = "https://github.com/intel/opencl-clang/";
-        description = "A clang wrapper library with an OpenCL-oriented API and the ability to compile OpenCL C kernels to SPIR-V modules";
-        license     = licenses.ncsa;
-        platforms   = platforms.all;
-        maintainers = with maintainers; [ ];
-      };
+  version = "unstable-2023-06-12";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "intel";
+      repo = "opencl-clang";
+      # https://github.com/intel/opencl-clang/compare/ocl-open-140
+      rev = "cf95b338d14685e4f3402ab1828bef31d48f1fd6";
+      hash = "sha256-To1RlQX9IJ+1zAwEXaW7ua3VNfjK9mu7pgsRPsfa8g8=";
     };
+
+    patches = [
+      # Build script tries to find Clang OpenCL headers under ${llvm}
+      # Work around it by specifying that directory manually.
+      ./opencl-headers-dir.patch
+
+      # fix CMake throwing errors
+      (fetchpatch {
+        url = "https://github.com/intel/opencl-clang/commit/321e3b99c1a8d54c8475f5ae998452069cc5eb71.patch";
+        hash = "sha256-cATbH+AMVtcabhl3EkzAH7w3wGreUV53hQYHVUUEP4g=";
+      })
+    ];
+
+    postPatch = ''
+      # fix not be able to find clang from PATH
+      substituteInPlace cl_headers/CMakeLists.txt \
+        --replace " NO_DEFAULT_PATH" ""
+    '' + lib.optionalString stdenv.isDarwin ''
+      # Uses linker flags that are not supported on Darwin.
+      sed -i -e '/SET_LINUX_EXPORTS_FILE/d' CMakeLists.txt
+      substituteInPlace CMakeLists.txt \
+        --replace '-Wl,--no-undefined' ""
+    '';
+  };
 in
-  library
+
+stdenv.mkDerivation {
+  pname = "opencl-clang";
+  inherit version src;
+
+  nativeBuildInputs = [ cmake git llvm.dev ];
+
+  buildInputs = [ libclang llvm spirv-llvm-translator' ];
+
+  cmakeFlags = [
+    "-DPREFERRED_LLVM_VERSION=${lib.getVersion llvm}"
+    "-DOPENCL_HEADERS_DIR=${libclang.lib}/lib/clang/${lib.getVersion libclang}/include/"
+
+    "-DLLVMSPIRV_INCLUDED_IN_LLVM=OFF"
+    "-DSPIRV_TRANSLATOR_DIR=${spirv-llvm-translator'}"
+  ];
+
+  inherit passthru;
+
+  meta = with lib; {
+    homepage = "https://github.com/intel/opencl-clang/";
+    description = "A clang wrapper library with an OpenCL-oriented API and the ability to compile OpenCL C kernels to SPIR-V modules";
+    license = licenses.ncsa;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.all;
+    # error: invalid value 'CL3.0' in '-cl-std=CL3.0'
+    broken = stdenv.isDarwin;
+  };
+}

pkgs/development/libraries/pdfhummus/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfhummus";
-  version = "4.5.11";
+  version = "4.5.12";
 
   src = fetchFromGitHub {
     owner = "galkahana";
     repo = "PDF-Writer";
     rev = "v${version}";
-    hash = "sha256-nTLyFGnY07gDoahYe5YqSmU/URzdvRKQ1MsXt3164+c=";
+    hash = "sha256-n5mzzIDU7Lb2V9YImPvceCBUt9Q+ZeF45CHtW52cGpY=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/science/math/scalapack/default.nix

@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     sed -i '/xssep/d;/xsgsep/d;/xssyevr/d' TESTING/CMakeLists.txt
   '';
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cmake ];
   nativeCheckInputs = [ openssh mpiCheckPhaseHook ];
   buildInputs = [ blas lapack ];

pkgs/development/ocaml-modules/containers/data.nix

@@ -1,6 +1,7 @@
 { buildDunePackage, containers
 , dune-configurator
 , gen, iter, qcheck-core
+, mdx
 }:
 
 buildDunePackage {
@@ -8,9 +9,8 @@ buildDunePackage {
 
   inherit (containers) src version doCheck;
 
-  duneVersion = "3";
-
   buildInputs = [ dune-configurator ];
+  nativeCheckInputs = [ mdx.bin ];
   checkInputs = [ gen iter qcheck-core ];
 
   propagatedBuildInputs = [ containers ];

pkgs/development/ocaml-modules/containers/default.nix

@@ -5,16 +5,14 @@
 }:
 
 buildDunePackage rec {
-  version = "3.11";
+  version = "3.12";
   pname = "containers";
 
-  duneVersion = "3";
-
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "ocaml-containers";
     rev = "v${version}";
-    hash = "sha256-tGAsg98/T6VKvG95I4qioabWM3TEKrDKlsrfUJqxCyM=";
+    hash = "sha256-15Wd6k/NvjAvTmxlPlZPClODBtFXM6FG3VxniC66u88=";
   };
 
   buildInputs = [ dune-configurator ];

pkgs/development/ocaml-modules/decompress/default.nix

@@ -6,14 +6,13 @@
 
 buildDunePackage rec {
   pname = "decompress";
-  version = "1.5.2";
+  version = "1.5.3";
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/decompress/releases/download/v${version}/decompress-${version}.tbz";
-    hash = "sha256-qMmmuhMlFNVq02JvvV55EkhEg2AQNQ7hYdQ7spv1di4=";
+    hash = "sha256-+R5peL7/P8thRA0y98mcmfHoZUtPsYQIdB02A1NzrGA=";
   };
 
   buildInputs = [ cmdliner ];

pkgs/development/ocaml-modules/eliom/default.nix

@@ -8,6 +8,7 @@
 , opaline
 , ocamlbuild
 , ppx_deriving
+, ppx_optcomp
 , findlib
 , js_of_ocaml-ocamlbuild
 , js_of_ocaml-ppx
@@ -21,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eliom";
-  version = "9.4.0";
+  version = "10.1.0";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "eliom";
     rev = version;
-    sha256 = "sha256:1yn8mqxv9yz51x81j8wv1jn7l7crm8azp1m2g4zn5nz2s4nmfv6q";
+    hash = "sha256-nzrLl8adaRW6c+IQfJ7s+7KtFT8uU27Umyrv0aWXuxw=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
     js_of_ocaml-ocamlbuild
     js_of_ocaml-ppx_deriving_json
     ocamlnet
+    ppx_optcomp
   ];
 
   propagatedBuildInputs = [

pkgs/development/ocaml-modules/mdx/default.nix

@@ -1,23 +1,22 @@
 { lib, fetchurl, buildDunePackage, ocaml, findlib
 , alcotest
-, astring, cppo, fmt, logs, ocaml-version, odoc-parser, lwt, re, csexp
+, astring, cppo, fmt, logs, ocaml-version, camlp-streams, lwt, re, csexp
 , gitUpdater
 }:
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "2.3.0";
+  version = "2.3.1";
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
-    hash = "sha256-MqCDmBAK/S0ueYi8O0XJtplxJx96twiFHe04Q8lHBmE=";
+    hash = "sha256-mkCkX6p41H4pOSvU/sJg0UAWysGweOSrAW6jrcCXQ/M=";
   };
 
   nativeBuildInputs = [ cppo ];
-  propagatedBuildInputs = [ astring fmt logs csexp ocaml-version odoc-parser re findlib ];
+  propagatedBuildInputs = [ astring fmt logs csexp ocaml-version camlp-streams re findlib ];
   checkInputs = [ alcotest lwt ];
 
   doCheck = true;

pkgs/development/ocaml-modules/ocsigen-server/cohttp-5.patch

@@ -1,31 +0,0 @@
-diff --git a/src/server/ocsigen_cohttp.ml b/src/server/ocsigen_cohttp.ml
-index 4363cff7..b0cc0c53 100644
---- a/src/server/ocsigen_cohttp.ml
-+++ b/src/server/ocsigen_cohttp.ml
-@@ -14,25 +14,13 @@ exception Ext_http_error of
- 
- let _print_request fmt request =
- 
--  let print_list print_data out_ch lst =
--    let rec aux = function
--      | [] -> ()
--      | [ x ] -> print_data out_ch x
--      | x :: r -> print_data out_ch x; aux r
--    in aux lst
--  in
--
-   Format.fprintf fmt "%s [%s/%s]:\n"
-     (Uri.to_string (Cohttp.Request.uri request))
-     Cohttp.(Code.string_of_version (Request.version request))
-     Cohttp.(Code.string_of_method (Request.meth request));
- 
-   Cohttp.Header.iter
--    (fun key values ->
--       (print_list
--          (fun fmt value -> Format.fprintf fmt "\t%s = %s\n" key value)
--          fmt
--          values))
-+    (Format.fprintf fmt "\t%s = %s\n")
-     (Cohttp.Request.headers request)
- 
- let connections = Hashtbl.create 256