From bab1ba485c5c46c964e003fae943e2461d748d9c Mon Sep 17 00:00:00 2001
From: Chuang Zhu <git@chuang.cz>
Date: Wed, 9 Nov 2022 13:36:02 +0800
Subject: [PATCH 01/40] superd: init at 0.7

---
 pkgs/misc/superd/default.nix    | 43 +++++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 45 insertions(+)
 create mode 100644 pkgs/misc/superd/default.nix

diff --git a/pkgs/misc/superd/default.nix b/pkgs/misc/superd/default.nix
new file mode 100644
index 00000000000..105d7278e5b
--- /dev/null
+++ b/pkgs/misc/superd/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildGoModule
+, fetchFromSourcehut
+, installShellFiles
+, scdoc
+}:
+
+buildGoModule rec {
+  pname = "superd";
+  version = "0.7";
+
+  src = fetchFromSourcehut {
+    owner = "~craftyguy";
+    repo = pname;
+    rev = version;
+    hash = "sha256-XSB6qgepWhus15lOP9GzbiNoOCSsy6xLij7ic3LFs1E=";
+  };
+
+  vendorHash = "sha256-Oa99U3THyWLjH+kWMQAHO5QAS2mmtY7M7leej+gnEqo=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    scdoc
+  ];
+
+  postBuild = ''
+    make doc
+  '';
+
+  postInstall = ''
+    installManPage superd.1 superd.service.5 superctl.1
+    installShellCompletion --bash completions/bash/superctl
+    installShellCompletion --zsh completions/zsh/superctl
+  '';
+
+  meta = with lib; {
+    description = "Unprivileged user service supervisor";
+    homepage = "https://sr.ht/~craftyguy/superd/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ chuangzhu wentam ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4c2590bd2bb..4346795b04a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -36962,6 +36962,8 @@ with pkgs;
 
   stork = callPackage ../applications/misc/stork { };
 
+  superd = callPackage ../misc/superd { };
+
   oclgrind = callPackage ../development/tools/analysis/oclgrind { };
 
   opkg = callPackage ../tools/package-management/opkg { };

From 13c891efa5309d1555fda72132ab4806609aff17 Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Mon, 14 Nov 2022 12:07:06 +0100
Subject: [PATCH 02/40] easyeffects: 6.3.0 -> 7.0.0

---
 pkgs/applications/audio/easyeffects/default.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/audio/easyeffects/default.nix b/pkgs/applications/audio/easyeffects/default.nix
index 4e65d79ab21..1d363e4b2c7 100644
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/applications/audio/easyeffects/default.nix
@@ -3,9 +3,11 @@
 , desktop-file-utils
 , fetchFromGitHub
 , calf
+, fftw
 , fftwFloat
-, fmt_8
+, fmt_9
 , glib
+, gsl
 , gtk4
 , itstool
 , libadwaita
@@ -25,6 +27,7 @@
 , pkg-config
 , rnnoise
 , rubberband
+, speex
 , speexdsp
 , tbb
 , wrapGAppsHook4
@@ -34,13 +37,13 @@
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "6.3.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     rev = "v${version}";
-    sha256 = "sha256-OLxuE1jiALuKlC9U9esVlhaMBEaoZyNae8OO8upE4ZM=";
+    sha256 = "sha256-SjhJj5kClPd8DT1vzbSdqJ9AJw0XiX9Q8/R8SDnxGPQ=";
   };
 
   nativeBuildInputs = [
@@ -53,9 +56,11 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    fftw
     fftwFloat
-    fmt_8
+    fmt_9
     glib
+    gsl
     gtk4
     libadwaita
     libbs2b
@@ -69,6 +74,7 @@ stdenv.mkDerivation rec {
     pipewire
     rnnoise
     rubberband
+    speex
     speexdsp
     tbb
     zita-convolver

From a09bb2d5e50093c7f9db03bac558053db6807596 Mon Sep 17 00:00:00 2001
From: Chuang Zhu <git@chuang.cz>
Date: Tue, 15 Nov 2022 20:39:58 +0800
Subject: [PATCH 03/40] headlines: init at 0.7.2

---
 .../networking/headlines/default.nix          | 72 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 74 insertions(+)
 create mode 100644 pkgs/applications/networking/headlines/default.nix

diff --git a/pkgs/applications/networking/headlines/default.nix b/pkgs/applications/networking/headlines/default.nix
new file mode 100644
index 00000000000..ed26c6f60de
--- /dev/null
+++ b/pkgs/applications/networking/headlines/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, cmake
+, pkg-config
+, libmicrohttpd
+, curl
+, openssl
+, jsoncpp
+, libxml2
+, gst_all_1
+, boost
+, websocketpp
+, libadwaita
+, gtkmm4
+, libsecret
+, fetchFromGitLab
+, makeWrapper
+, xdg-utils
+, youtube-dl
+, ffmpeg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "headlines";
+  version = "0.7.2";
+
+  src = fetchFromGitLab {
+    owner = "caveman250";
+    repo = "Headlines";
+    rev = version;
+    sha256 = "sha256-wamow0UozX5ecKbXWOgsWCerInL4J0gK0+Muf+eoO9k=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libmicrohttpd
+    curl
+    openssl
+    jsoncpp
+    libxml2
+    boost
+    websocketpp
+    libadwaita
+    gtkmm4
+    libsecret
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-libav
+    gst-plugins-base
+    (gst-plugins-good.override { gtkSupport = true; })
+    gst-plugins-bad
+  ]);
+
+  postFixup = ''
+    wrapProgram "$out/bin/headlines" \
+      --prefix PATH : "${lib.makeBinPath [ xdg-utils youtube-dl ffmpeg ]}" \
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+  '';
+
+  meta = with lib; {
+    description = "GTK4 / Libadwaita Reddit client written in C++";
+    homepage = "https://gitlab.com/caveman250/Headlines";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ chuangzhu ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 04a672f2e5a..ec4f2552ffc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29097,6 +29097,8 @@ with pkgs;
 
   hdhomerun-config-gui = callPackage ../applications/video/hdhomerun-config-gui { };
 
+  headlines = callPackage ../applications/networking/headlines { };
+
   hedgedoc-cli = callPackage ../tools/admin/hedgedoc-cli { };
 
   heimer = libsForQt5.callPackage ../applications/misc/heimer { };

From 02590ae0639f8f7f17ef2812d191f4b29fb77e87 Mon Sep 17 00:00:00 2001
From: Chuang Zhu <git@chuang.cz>
Date: Sat, 26 Nov 2022 17:54:58 +0800
Subject: [PATCH 04/40] thumbdrives: init at 0.3.1

---
 .../system/thumbdrives/default.nix            | 62 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 64 insertions(+)
 create mode 100644 pkgs/applications/system/thumbdrives/default.nix

diff --git a/pkgs/applications/system/thumbdrives/default.nix b/pkgs/applications/system/thumbdrives/default.nix
new file mode 100644
index 00000000000..d70ea958062
--- /dev/null
+++ b/pkgs/applications/system/thumbdrives/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, python3
+, fetchFromSourcehut
+, gtk3
+, libhandy_0
+, gobject-introspection
+, meson
+, pkg-config
+, ninja
+, gettext
+, glib
+, desktop-file-utils
+, wrapGAppsHook
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "thumbdrives";
+  version = "0.3.1";
+
+  format = "other";
+
+  src = fetchFromSourcehut {
+    owner = "~martijnbraam";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-CPZKswbvsG61A6J512FOCKAntoJ0sUb2s+MKb0rO+Xw=";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux/meson
+  '';
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    gettext
+    glib
+    gtk3
+    desktop-file-utils
+    wrapGAppsHook
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    gtk3
+    libhandy_0
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    pyxdg
+  ];
+
+  meta = with lib; {
+    description = "USB mass storage emulator for Linux handhelds";
+    homepage = "https://sr.ht/~martijnbraam/thumbdrives/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chuangzhu ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ddd3f57f82b..c148229ae98 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12040,6 +12040,8 @@ with pkgs;
 
   threema-desktop = callPackage ../applications/networking/instant-messengers/threema-desktop { };
 
+  thumbdrives = callPackage ../applications/system/thumbdrives { };
+
   tidy-viewer = callPackage ../tools/text/tidy-viewer { };
 
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };

From 33448e2db25955d7a932b430f832103bbaafa380 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Thu, 1 Dec 2022 16:28:18 +0100
Subject: [PATCH 05/40] reuse: 1.0.0 -> 1.1.0

https://github.com/fsfe/reuse-tool/releases/tag/v1.1.0
---
 pkgs/tools/package-management/reuse/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/reuse/default.nix b/pkgs/tools/package-management/reuse/default.nix
index d3fbc6fc37b..9cf592b0a7f 100644
--- a/pkgs/tools/package-management/reuse/default.nix
+++ b/pkgs/tools/package-management/reuse/default.nix
@@ -2,22 +2,26 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "reuse";
-  version = "1.0.0";
+  version = "1.1.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fsfe";
     repo = "reuse-tool";
     rev = "v${version}";
-    sha256 = "0yplsbd5251s8cabazbdqb00jqv8ibbgal7fhj5pfxv5lsz17vkv";
+    hash = "sha256-bjUDImMFwMhRjCa7XzGlqR8h+KfTsyxonrQlRGgApwo=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    poetry-core
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     binaryornot
     boolean-py
     debian
     jinja2
     license-expression
-    requests
     setuptools
     setuptools-scm
   ];

From 531207e37c87f212d0a669b369bbd495834e7730 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Thu, 1 Dec 2022 16:41:01 +0100
Subject: [PATCH 06/40] reuse: add Luflosi as maintainer

---
 pkgs/tools/package-management/reuse/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/package-management/reuse/default.nix b/pkgs/tools/package-management/reuse/default.nix
index 9cf592b0a7f..775b6da1707 100644
--- a/pkgs/tools/package-management/reuse/default.nix
+++ b/pkgs/tools/package-management/reuse/default.nix
@@ -32,6 +32,6 @@ python3Packages.buildPythonApplication rec {
     description = "A tool for compliance with the REUSE Initiative recommendations";
     homepage = "https://github.com/fsfe/reuse-tool";
     license = with licenses; [ asl20 cc-by-sa-40 cc0 gpl3Plus ];
-    maintainers = [ maintainers.FlorianFranzen ];
+    maintainers = with maintainers; [ FlorianFranzen Luflosi ];
   };
 }

From 78746f5621ee65a381b4be1d309c65a79d48c3e6 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sun, 4 Dec 2022 12:49:07 -0800
Subject: [PATCH 07/40] python310Packages.click-command-tree: init at 1.1.0

---
 .../click-command-tree/default.nix            | 49 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 51 insertions(+)
 create mode 100644 pkgs/development/python-modules/click-command-tree/default.nix

diff --git a/pkgs/development/python-modules/click-command-tree/default.nix b/pkgs/development/python-modules/click-command-tree/default.nix
new file mode 100644
index 00000000000..14903853646
--- /dev/null
+++ b/pkgs/development/python-modules/click-command-tree/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, click
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "click-command-tree";
+  version = "1.1.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "whwright";
+    repo = pname;
+    rev = version;
+    hash = "sha256-vFOcn+ibyLZnhU3OQMtnHI04UqAY2/CCvhq4EEU4XFo=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "remove-setup-downloading-flake8.patch";
+      url = "https://github.com/whwright/click-command-tree/commit/1ecfcfa29bf01e1131e6ec712bd7338ac1283dc8.patch";
+      hash = "sha256-u5jsNfEo1+XNlkVGPCM/rsDPnYko6cr2z2si9nq+sLA=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    click
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  pythonImportsCheck = [ "click_command_tree" ];
+
+  meta = with lib; {
+    description = "click plugin to show the command tree of your CLI";
+    homepage = "https://github.com/whwright/click-command-tree";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tjni ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5e26e836eb8..e5b43818eea 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1750,6 +1750,8 @@ self: super: with self; {
 
   clickclick = callPackage ../development/python-modules/clickclick { };
 
+  click-command-tree = callPackage ../development/python-modules/click-command-tree { };
+
   click-completion = callPackage ../development/python-modules/click-completion { };
 
   click-configfile = callPackage ../development/python-modules/click-configfile { };

From 6545a9245d94e71e63982c1c2877ec2bae79702d Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sun, 4 Dec 2022 12:57:04 -0800
Subject: [PATCH 08/40] python310Packages.spsdk: 1.6.3 -> 1.8.0

---
 .../python-modules/spsdk/default.nix          | 35 ++++++-------------
 1 file changed, 10 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index 52dad183fa1..a4683a80727 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , dos2unix
 , pythonRelaxDepsHook
 , asn1crypto
@@ -9,6 +8,7 @@
 , bincopy
 , bitstring
 , click
+, click-command-tree
 , click-option-group
 , cmsis-pack-manager
 , commentjson
@@ -33,42 +33,32 @@
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "1.6.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "NXPmicro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JMhd2XdbjEN6SUzFgcBHd/dStiuYeXXis6pfijSfUso=";
+    hash = "sha256-yCmkOrUe5XqbuHeo7F84j1gmdzpdpCRWdD9V74U64c4=";
   };
 
-  patches = [
-    # https://github.com/NXPmicro/spsdk/pull/43
-    (fetchpatch {
-      name = "cryptography-37-compat.patch";
-      url = "https://github.com/NXPmicro/spsdk/commit/a85b854de1093de593d27fa64de442224ab2e0fd.patch";
-      sha256 = "sha256-4pXV/8RaNuGl7KNdoGD/8YnPQ2ZmUQOjXWA/Yy0Kxu8=";
-    })
-    # https://github.com/NXPmicro/spsdk/pull/41
-    (fetchpatch {
-      name = "blhost-click-8-1-compat.patch";
-      url = "https://github.com/NXPmicro/spsdk/commit/5112b1b69aa681d265035475e73d28ea0c8cb6ab.patch";
-      sha256 = "sha256-Okz6Er6OVuAA5IlB5IabSa/gUSLa+E2Ltd+J3uoIg6o=";
-    })
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [
     "bincopy"
     "bitstring"
     "cmsis-pack-manager"
-    "cryptography"
     "deepmerge"
     "jinja2"
     "pylink-square"
     "pyocd"
   ];
-  pythonRemoveDeps = [ "pyocd-pemicro" ];
+
+  pythonRemoveDeps = [
+    "pyocd-pemicro"
+  ];
 
   propagatedBuildInputs = [
     asn1crypto
@@ -76,6 +66,7 @@ buildPythonPackage rec {
     bincopy
     bitstring
     click
+    click-command-tree
     click-option-group
     cmsis-pack-manager
     commentjson
@@ -101,12 +92,6 @@ buildPythonPackage rec {
     voluptuous
   ];
 
-  disabledTests = [
-    # tests also fail on debian, so presumable they are broken
-    "test_elftosb_mbi_signed"
-    "test_elftosb_sb31"
-  ];
-
   pythonImportsCheck = [ "spsdk" ];
 
   meta = with lib; {

From a899f74775f43761f66667cd6658ec150e383ab5 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Mon, 5 Dec 2022 23:29:03 -0800
Subject: [PATCH 09/40] petsc: reenable stackprotector on aarch64-darwin

---
 pkgs/development/libraries/science/math/petsc/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/libraries/science/math/petsc/default.nix b/pkgs/development/libraries/science/math/petsc/default.nix
index e847d1decd2..ae95fefe0e6 100644
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@@ -67,11 +67,6 @@ stdenv.mkDerivation rec {
 
   configureScript = "python ./configure";
 
-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/158730
-  # see https://github.com/NixOS/nixpkgs/issues/127608 for a similar issue
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
   enableParallelBuilding = true;
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 

From c4ae704be63c52069e97df7adc8b1183005e16a8 Mon Sep 17 00:00:00 2001
From: Zhaofeng Li <hello@zhaofeng.li>
Date: Tue, 6 Dec 2022 18:24:40 -0700
Subject: [PATCH 10/40] nixos/fwupd: Make daemon.conf structured

---
 nixos/modules/services/hardware/fwupd.nix | 68 ++++++++++++++---------
 1 file changed, 42 insertions(+), 26 deletions(-)

diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 98f837bd782..8d7651f97c3 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -7,13 +7,16 @@ with lib;
 let
   cfg = config.services.fwupd;
 
+  format = pkgs.formats.ini {
+    listToValue = l: lib.concatStringsSep ";" (map (s: generators.mkValueStringDefault {} s) l);
+    mkKeyValue = generators.mkKeyValueDefault {} "=";
+  };
+
   customEtc = {
     "fwupd/daemon.conf" = {
-      source = pkgs.writeText "daemon.conf" ''
-        [fwupd]
-        DisabledDevices=${lib.concatStringsSep ";" cfg.disabledDevices}
-        DisabledPlugins=${lib.concatStringsSep ";" cfg.disabledPlugins}
-      '';
+      source = format.generate "daemon.conf" {
+        fwupd = cfg.daemonSettings;
+      };
     };
     "fwupd/uefi_capsule.conf" = {
       source = pkgs.writeText "uefi_capsule.conf" ''
@@ -67,24 +70,6 @@ in {
         '';
       };
 
-      disabledDevices = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ];
-        description = lib.mdDoc ''
-          Allow disabling specific devices by their GUID
-        '';
-      };
-
-      disabledPlugins = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "udev" ];
-        description = lib.mdDoc ''
-          Allow disabling specific plugins
-        '';
-      };
-
       extraTrustedKeys = mkOption {
         type = types.listOf types.path;
         default = [];
@@ -120,18 +105,49 @@ in {
           Which fwupd package to use.
         '';
       };
+
+      daemonSettings = mkOption {
+        type = types.submodule {
+          freeformType = format.type.nestedTypes.elemType;
+          options = {
+            DisabledDevices = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ];
+              description = lib.mdDoc ''
+                List of device GUIDs to be disabled.
+              '';
+            };
+
+            DisabledPlugins = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "udev" ];
+              description = lib.mdDoc ''
+                List of plugins to be disabled.
+              '';
+            };
+          };
+        };
+        default = {};
+        description = lib.mdDoc ''
+          Configurations for the fwupd daemon.
+        '';
+      };
     };
   };
 
   imports = [
-    (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "disabledDevices" ])
-    (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "disabledPlugins" ])
+    (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
+    (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
+    (mkRenamedOptionModule [ "services" "fwupd" "disabledDevices" ] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
+    (mkRenamedOptionModule [ "services" "fwupd" "disabledPlugins" ] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
   ];
 
   ###### implementation
   config = mkIf cfg.enable {
     # Disable test related plug-ins implicitly so that users do not have to care about them.
-    services.fwupd.disabledPlugins = cfg.package.defaultDisabledPlugins;
+    services.fwupd.daemonSettings.DisabledPlugins = cfg.package.defaultDisabledPlugins;
 
     environment.systemPackages = [ cfg.package ];
 

From 48bc7784ab34a517a597dcbee0dec4d0a23a4a7d Mon Sep 17 00:00:00 2001
From: Zhaofeng Li <hello@zhaofeng.li>
Date: Tue, 6 Dec 2022 18:24:40 -0700
Subject: [PATCH 11/40] rl-2305: Mention services.fwupd.daemonSettings

---
 .../doc/manual/from_md/release-notes/rl-2305.section.xml  | 8 ++++++++
 nixos/doc/manual/release-notes/rl-2305.section.md         | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 0fd0382998c..66ad48fba50 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -148,6 +148,14 @@
           the Nix store.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>services.fwupd</literal> module now allows
+          arbitrary daemon settings to be configured in a structured
+          manner
+          (<link linkend="opt-services.fwupd.daemonSettings"><literal>services.fwupd.daemonSettings</literal></link>).
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>unifi-poller</literal> package and corresponding
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 39550d44733..4b19fb4dc99 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -47,4 +47,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
 
+- The `services.fwupd` module now allows arbitrary daemon settings to be configured in a structured manner ([`services.fwupd.daemonSettings`](#opt-services.fwupd.daemonSettings)).
+
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.

From cd11ab58c56a56a97ac86394c261a39b9e5c579d Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 00:59:44 +0100
Subject: [PATCH 12/40] python3Packages.eigenpy: init at 2.8.1

---
 .../python-modules/eigenpy/default.nix        | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/eigenpy/default.nix

diff --git a/pkgs/development/python-modules/eigenpy/default.nix b/pkgs/development/python-modules/eigenpy/default.nix
new file mode 100644
index 00000000000..a13b8e52ed5
--- /dev/null
+++ b/pkgs/development/python-modules/eigenpy/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost
+, eigen
+, numpy
+}:
+
+stdenv.mkDerivation rec {
+  pname = "eigenpy";
+  version = "2.8.1";
+
+  src = fetchFromGitHub {
+    owner = "stack-of-tasks";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-nofB5TDvEArhPcYe/Pb1LQBC+W6MrE3NuapaZmKIO68=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    boost
+  ];
+
+  propagatedBuildInputs = [
+    eigen
+    numpy
+  ];
+
+  meta = with lib; {
+    description = "Bindings between Numpy and Eigen using Boost.Python";
+    homepage = "https://github.com/stack-of-tasks/eigenpy";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1ccfa77283c..adee05f8edf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2885,6 +2885,8 @@ self: super: with self; {
 
   eggdeps = callPackage ../development/python-modules/eggdeps { };
 
+  eigenpy = toPythonModule (callPackage ../development/python-modules/eigenpy { });
+
   einops = callPackage ../development/python-modules/einops { };
 
   eiswarnung = callPackage ../development/python-modules/eiswarnung { };

From 217f72acc3d3c4e9fb18fba74bb65ba02d8b89ba Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 01:00:46 +0100
Subject: [PATCH 13/40] pinocchio, python3Packages.pinocchio: init at 2.6.12

---
 .../libraries/pinocchio/default.nix           | 51 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  5 ++
 3 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/libraries/pinocchio/default.nix

diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
new file mode 100644
index 00000000000..030ec85496d
--- /dev/null
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost
+, eigen
+, urdfdom
+, pythonSupport ? false
+, python3Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pinocchio";
+  version = "2.6.12";
+
+  src = fetchFromGitHub {
+    owner = "stack-of-tasks";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-DJX/njNX8l7ngSl3yCeN7ZoQaH65pQTsZrKwmY7EZ+E=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  propagatedBuildInputs = [
+    urdfdom
+  ] ++ lib.optionals (!pythonSupport) [
+    boost
+    eigen
+  ] ++ lib.optionals pythonSupport [
+    python3Packages.boost
+    python3Packages.eigenpy
+  ];
+
+  cmakeFlags = lib.optionals (!pythonSupport) [
+    "-DBUILD_PYTHON_INTERFACE=OFF"
+  ];
+
+  meta = with lib; {
+    description = "A fast and flexible implementation of Rigid Body Dynamics algorithms and their analytical derivatives";
+    homepage = "https://github.com/stack-of-tasks/pinocchio";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 96d9cb14ea1..80dd4024c6b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22024,6 +22024,8 @@ with pkgs;
 
   pico-sdk = callPackage ../development/libraries/pico-sdk { };
 
+  pinocchio = callPackage ../development/libraries/pinocchio { };
+
   pipelight = callPackage ../tools/misc/pipelight {
     stdenv = stdenv_32bit;
     wine-staging = pkgsi686Linux.wine-staging;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index adee05f8edf..25ac0ad1ab2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6957,6 +6957,11 @@ self: super: with self; {
 
   pinboard = callPackage ../development/python-modules/pinboard { };
 
+  pinocchio = toPythonModule (pkgs.pinocchio.override {
+    pythonSupport = true;
+    python3Packages = self;
+  });
+
   pint = callPackage ../development/python-modules/pint { };
 
   pint-pandas = callPackage ../development/python-modules/pint-pandas { };

From 2192f88c20c2b23a6f22de5ba3cc2589554174f5 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 00:49:47 +0100
Subject: [PATCH 14/40] example-robot-data, python3Packages.example-robot-data:
 init at 4.0.3

---
 .../libraries/example-robot-data/default.nix  | 42 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  5 +++
 3 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/libraries/example-robot-data/default.nix

diff --git a/pkgs/development/libraries/example-robot-data/default.nix b/pkgs/development/libraries/example-robot-data/default.nix
new file mode 100644
index 00000000000..08a650dbca0
--- /dev/null
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pythonSupport ? false
+, python3Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "example-robot-data";
+  version = "4.0.3";
+
+  src = fetchFromGitHub {
+    owner = "Gepetto";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-rxVyka8tcF/CmGTVNyh3FPR1LVa6JOAN+9zjElgqCak=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = lib.optionals pythonSupport [
+    python3Packages.pinocchio
+  ];
+
+  cmakeFlags = lib.optionals (!pythonSupport) [
+    "-DBUILD_PYTHON_INTERFACE=OFF"
+  ];
+
+  meta = with lib; {
+    description = "Set of robot URDFs for benchmarking and developed examples.";
+    homepage = "https://github.com/Gepetto/example-robot-data";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80dd4024c6b..8e19b89830f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18936,6 +18936,8 @@ with pkgs;
 
   liberasurecode = callPackage ../applications/misc/liberasurecode { };
 
+  example-robot-data = callPackage ../development/libraries/example-robot-data { };
+
   exiv2 = callPackage ../development/libraries/exiv2 { };
 
   expat = callPackage ../development/libraries/expat { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 25ac0ad1ab2..b6c075eb6c9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3058,6 +3058,11 @@ self: super: with self; {
 
   ewmh = callPackage ../development/python-modules/ewmh { };
 
+  example-robot-data = toPythonModule (pkgs.example-robot-data.override {
+    pythonSupport = true;
+    python3Packages = self;
+  });
+
   exdown = callPackage ../development/python-modules/exdown { };
 
   exceptiongroup = callPackage ../development/python-modules/exceptiongroup { };

From 561083d21b8599eb966adc91471892eefde5ef3b Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 01:11:44 +0100
Subject: [PATCH 15/40] crocoddyl, python3Packages.crocoddyl: init at 1.9.0

---
 .../libraries/crocoddyl/default.nix           | 49 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  5 ++
 3 files changed, 56 insertions(+)
 create mode 100644 pkgs/development/libraries/crocoddyl/default.nix

diff --git a/pkgs/development/libraries/crocoddyl/default.nix b/pkgs/development/libraries/crocoddyl/default.nix
new file mode 100644
index 00000000000..2a8267f9d6b
--- /dev/null
+++ b/pkgs/development/libraries/crocoddyl/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, example-robot-data
+, pinocchio
+, pythonSupport ? false
+, python3Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "crocoddyl";
+  version = "1.9.0";
+
+  src = fetchFromGitHub {
+    owner = "loco-3d";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-IQ+8ZZXVTTRFa4uGetpylRab4P9MSTU2YtytYA3z6ys=";
+    fetchSubmodules = true;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  propagatedBuildInputs = lib.optionals (!pythonSupport) [
+    example-robot-data
+    pinocchio
+  ] ++ lib.optionals pythonSupport [
+    python3Packages.example-robot-data
+    python3Packages.pinocchio
+  ];
+
+  cmakeFlags = lib.optionals (!pythonSupport) [
+    "-DBUILD_EXAMPLES=OFF"
+    "-DBUILD_PYTHON_INTERFACE=OFF"
+  ];
+
+  meta = with lib; {
+    description = "Crocoddyl optimal control library";
+    homepage = "https://github.com/loco-3d/crocoddyl";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8e19b89830f..04c40e085ce 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18765,6 +18765,8 @@ with pkgs;
 
   croaring = callPackage ../development/libraries/croaring { };
 
+  crocoddyl = callPackage ../development/libraries/crocoddyl { };
+
   crossguid = callPackage ../development/libraries/crossguid { };
 
   cryptopp = callPackage ../development/libraries/crypto++ { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b6c075eb6c9..b1f39f29ce8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2020,6 +2020,11 @@ self: super: with self; {
 
   criticality-score = callPackage ../development/python-modules/criticality-score { };
 
+  crocoddyl = toPythonModule (callPackage ../development/libraries/crocoddyl {
+    pythonSupport = true;
+    python3Packages = self;
+  });
+
   cron-descriptor = callPackage ../development/python-modules/cron-descriptor { };
 
   croniter = callPackage ../development/python-modules/croniter { };

From fedd4d02f5d06d0846c60232ee9fc8bebf846783 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 02:48:18 +0100
Subject: [PATCH 16/40] pinocchio: fix build on x86_64-darwin

---
 pkgs/development/libraries/pinocchio/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
index 030ec85496d..8b48e74476a 100644
--- a/pkgs/development/libraries/pinocchio/default.nix
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -21,6 +21,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-DJX/njNX8l7ngSl3yCeN7ZoQaH65pQTsZrKwmY7EZ+E=";
   };
 
+  # error: use of undeclared identifier '__sincos'
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    substituteInPlace src/math/sincos.hpp \
+      --replace "__APPLE__" "0"
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [

From 73fddfcc38fa5c57f8897b2c7165a818b9bc9dc2 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 8 Dec 2022 19:25:49 +0100
Subject: [PATCH 17/40] dosbox: fix build on darwin

---
 pkgs/applications/emulators/dosbox/default.nix | 4 ++--
 pkgs/top-level/all-packages.nix                | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/dosbox/default.nix b/pkgs/applications/emulators/dosbox/default.nix
index b197742ce27..852586cc698 100644
--- a/pkgs/applications/emulators/dosbox/default.nix
+++ b/pkgs/applications/emulators/dosbox/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , autoreconfHook
-, SDL_compat
+, SDL
 , SDL_net
 , SDL_sound
 , copyDesktopItems
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    SDL_compat
+    SDL
     SDL_net
     SDL_sound
     libGL
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 96d9cb14ea1..1220d704e70 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1961,7 +1961,9 @@ with pkgs;
 
   dlx = callPackage ../applications/emulators/dlx { };
 
-  dosbox = callPackage ../applications/emulators/dosbox { };
+  dosbox = callPackage ../applications/emulators/dosbox {
+    SDL = if stdenv.isDarwin then SDL else SDL_compat;
+  };
 
   dosbox-staging = callPackage ../applications/emulators/dosbox-staging { };
 

From d7c4e4ff63f9f3ee7587d828d50b38d6ce4e639b Mon Sep 17 00:00:00 2001
From: David Morgan <djm_uk@protonmail.com>
Date: Thu, 8 Dec 2022 13:32:03 +0000
Subject: [PATCH 18/40] zsh-forgit: 22.11.0 -> 22.12.0

---
 pkgs/shells/zsh/zsh-forgit/default.nix | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/pkgs/shells/zsh/zsh-forgit/default.nix b/pkgs/shells/zsh/zsh-forgit/default.nix
index 01dc6874cc4..ce99b5e3448 100644
--- a/pkgs/shells/zsh/zsh-forgit/default.nix
+++ b/pkgs/shells/zsh/zsh-forgit/default.nix
@@ -1,28 +1,39 @@
-{ stdenv, lib, fetchFromGitHub, git, fzf }:
+{ stdenv, lib, bash, fetchFromGitHub, makeWrapper, fzf, git }:
 
 stdenv.mkDerivation rec {
   pname = "zsh-forgit";
-  version = "22.11.0";
+  version = "22.12.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    sha256 = "ca7EM/F0Spsdr3MbjIVwbjLVXg6/qWGczBQHLCcpU5A=";
+    sha256 = "0juBNUJW4SU3Cl6ouD+xMYzlCJOL7NAYpueZ6V56/ck=";
   };
 
   strictDeps = true;
 
   postPatch = ''
     substituteInPlace forgit.plugin.zsh \
-      --replace "fzf " "${fzf}/bin/fzf " \
-      --replace "git " "${git}/bin/git "
+      --replace "\$INSTALL_DIR/bin/git-forgit" "$out/bin/git-forgit"
+
+    substituteInPlace bin/git-forgit \
+      --replace "/bin/bash" "${bash}/bin/bash"
   '';
 
   dontBuild = true;
 
+  nativeBuildInputs = [ makeWrapper ];
+
   installPhase = ''
+    runHook preInstall
+
+    install -D bin/git-forgit $out/bin/git-forgit
     install -D forgit.plugin.zsh $out/share/zsh/${pname}/forgit.plugin.zsh
+    wrapProgram $out/bin/git-forgit \
+      --prefix PATH : ${lib.makeBinPath [ fzf git ]}
+
+    runHook postInstall
   '';
 
   meta = with lib; {

From 89df194cbf0f38123bce7f913f1efde54c233568 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Mon, 12 Dec 2022 11:59:29 -0300
Subject: [PATCH 19/40] toml11: init at 3.7.1

---
 pkgs/development/libraries/toml11/default.nix | 47 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/libraries/toml11/default.nix

diff --git a/pkgs/development/libraries/toml11/default.nix b/pkgs/development/libraries/toml11/default.nix
new file mode 100644
index 00000000000..641b72aa1e8
--- /dev/null
+++ b/pkgs/development/libraries/toml11/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "toml11";
+  version = "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "ToruNiina";
+    repo = "toml11";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-HnhXBvIjo1JXhp+hUQvjs83t5IBVbNN6o3ZGhB4WESQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/ToruNiina/toml11";
+    description = "TOML for Modern C++";
+    longDescription = ''
+      toml11 is a C++11 (or later) header-only toml parser/encoder depending
+      only on C++ standard library.
+
+      - It is compatible to the latest version of TOML v1.0.0.
+      - It is one of the most TOML standard compliant libraries, tested with
+        the language agnostic test suite for TOML parsers by BurntSushi.
+      - It shows highly informative error messages.
+      - It has configurable container. You can use any random-access containers
+        and key-value maps as backend containers.
+      - It optionally preserves comments without any overhead.
+      - It has configurable serializer that supports comments, inline tables,
+        literal strings and multiline strings.
+      - It supports user-defined type conversion from/into toml values.
+      - It correctly handles UTF-8 sequences, with or without BOM, both on posix
+        and Windows.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.unix;
+  };
+})
+# TODO [ AndersonTorres ]: tests
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7383aeceae9..05c213035de 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22935,6 +22935,8 @@ with pkgs;
 
   tomlcpp = callPackage ../development/libraries/tomlcpp { };
 
+  toml11 = callPackage ../development/libraries/toml11 { };
+
   tomlplusplus = callPackage ../development/libraries/tomlplusplus { };
 
   tokyocabinet = callPackage ../development/libraries/tokyo-cabinet { };

From 2c8407089b399e0796678d440289eee829298f42 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 12 Dec 2022 16:03:53 +0100
Subject: [PATCH 20/40] sgx-sdk: pin to openssl_1_1

Currently, the sgx-sdk.runTestsHW attribute fails to build due to
linking errors. It looks like OpenSSL versions are mixed up.

And indeed sgx-sdk pulls in OpenSSL 3 while ipp-crypto pulls in
OpenSSL 1.1.

Fix by pinning the OpenSSL version for the SGX SDK to OpenSSL 1.1 as
well.
---
 pkgs/os-specific/linux/sgx/sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 977139406fe..5213dc1e4fd 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -16,7 +16,7 @@
 , nasm
 , ocaml
 , ocamlPackages
-, openssl
+, openssl_1_1
 , perl
 , python3
 , texinfo
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libtool
-    openssl
+    openssl_1_1
   ];
 
   BINUTILS_DIR = "${binutils}/bin";

From 4c9a58643fcf87f36d8ef57604f318aca6bab2be Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 13 Dec 2022 01:16:57 +0100
Subject: [PATCH 21/40] =?UTF-8?q?lib2geom:=201.2=20=E2=86=92=201.2.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/lib2geom/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/lib2geom/default.nix b/pkgs/development/libraries/lib2geom/default.nix
index 72d21ed0d2c..fba331ee67b 100644
--- a/pkgs/development/libraries/lib2geom/default.nix
+++ b/pkgs/development/libraries/lib2geom/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lib2geom";
-  version = "1.2";
+  version = "1.2.2";
 
   outputs = [ "out" "dev" ];
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "inkscape";
     repo = "lib2geom";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-SNo5YT7o29zdxkHLuy9MT88qBg/U1Wwa3BWShF5ACTc=";
+    sha256 = "sha256-xkUxcAk8KJkL482R7pvgmCT+5I8aUMm/q25pvK3ZPuY=";
   };
 
   nativeBuildInputs = [

From 3b3f77b1815388c6a320265ea4262dadb47914ed Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 13 Dec 2022 01:17:12 +0100
Subject: [PATCH 22/40] =?UTF-8?q?inkscape:=201.2.1=20=E2=86=92=201.2.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://inkscape.org/news/2022/12/05/download-inkscape-122/
---
 pkgs/applications/graphics/inkscape/default.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 8a40bac446e..6444537cac2 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -5,7 +5,6 @@
 , cairo
 , cmake
 , fetchurl
-, fetchpatch
 , gettext
 , ghostscript
 , glib
@@ -59,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "inkscape";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "https://media.inkscape.org/dl/resources/file/inkscape-${version}.tar.xz";
-    sha256 = "Rs59oOunykutwdtw6cu2fgrfm7NCaH3G4ItcohuNTBs=";
+    sha256 = "oMf9DQPAohU15kjvMB3PgN18/B81ReUQZfvxuj7opcQ=";
   };
 
   # Inkscape hits the ARGMAX when linking on macOS. It appears to be
@@ -79,12 +78,6 @@ stdenv.mkDerivation rec {
       # e.g., those from the "Effects" menu.
       python3 = "${python3Env}/bin/python";
     })
-
-    # Fix build with Poppler 22.09
-    (fetchpatch {
-      url = "https://github.com/archlinux/svntogit-packages/raw/b2f65dfb60ae0c8cd6cd9affd3d71064082a6201/trunk/inkscape-1.2.1-poppler-22.09.0.patch";
-      sha256 = "pArvsS/qoCTMAisF8yj3agZKrb90zRFZkck1TX0KeGc=";
-    })
   ];
 
   postPatch = ''

From 8fb4a5b389864e657e20214275953fde840f73e5 Mon Sep 17 00:00:00 2001
From: linsui <linsui555@gmail.com>
Date: Tue, 13 Dec 2022 12:15:39 +0800
Subject: [PATCH 23/40] pjsip-jami: patch for CVE

---
 .../networking/instant-messengers/jami/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 92fbe4d45e1..d4a1e8749ec 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -63,13 +63,13 @@ rec {
       patch-src = src + "/daemon/contrib/src/pjproject/";
     in
     rec {
-      version = "513a3f14c44b2c2652f9219ec20dea64b236b713";
+      version = "eae25732568e600d248aa8c226271ff6b81df170";
 
       src = fetchFromGitHub {
         owner = "savoirfairelinux";
         repo = "pjproject";
         rev = version;
-        sha256 = "sha256-93AlJGMnlzJMrJquelpHQQKjhEgfpTFXTMqkBnm87u8=";
+        sha256 = "sha256-N7jn4qen+PgFiVkTFi2HSWhx2QPHwAYMtnrpE/ptDVc=";
       };
 
       patches = (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches));

From 4cb98810baf7960d28576edfc39a7df8aa8ccb18 Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.io>
Date: Tue, 13 Dec 2022 07:13:13 -0500
Subject: [PATCH 24/40] packer: 1.8.4 -> 1.8.5 (#205879)

Diff: https://github.com/hashicorp/packer/compare/v1.8.4...v1.8.5

Changelog: https://github.com/hashicorp/packer/blob/v1.8.5/CHANGELOG.md
---
 pkgs/development/tools/packer/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index 1d3cdf62c08..3204058326a 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "packer";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "sha256-m8PKigVm46PN55hchc5a1OUUuhxoGn3e2sMRqqvkPgs=";
+    sha256 = "sha256-jdJD7AW4IrzVl4BPdsFFrRSdCWX9l4nFM+DWIuxLiJ8=";
   };
 
-  vendorSha256 = "sha256-hSZCYSV7nMGd5KQsV+Z4ig7vk4j8cZnOvsg0DqPiEvg=";
+  vendorSha256 = "sha256-ufvWgusTMbM88F3BkJ61KM2wRSdqPOlMKqDSYf7tZQA=";
 
   subPackages = [ "." ];
 

From ca01321f0572552adc10845dc069cb8dfac0c1d8 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 04:23:08 -0800
Subject: [PATCH 25/40] python310Packages.jupyterlab: 3.5.0 -> 3.5.1 (#205023)

---
 pkgs/development/python-modules/jupyterlab/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 4bc5acb5cc4..afdcf88bde1 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.5.0";
+  version = "3.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4CVWyOobOGljxLRk5GGK7hU8VBawerSBQlyBegMzI6I=";
+    sha256 = "sha256-WaGy151LPr7k2ZfIvtjPRQ9GDHw19GthOpPwt3ErR/w=";
   };
 
   nativeBuildInputs = [

From 7b37acd9bab693262f67d1511fe64abb92527e32 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 12:48:28 +0000
Subject: [PATCH 26/40] jove: 4.17.4.7 -> 4.17.4.8

---
 pkgs/applications/editors/jove/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index 01a428a9fd6..ca494a37fa8 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.7";
+  version = "4.17.4.8";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
     rev = finalAttrs.version;
-    sha256 = "sha256-a8amp8JAI25XIeL8MzvJEAvv6B0oIaQvUOQlAaS3PeI=";
+    sha256 = "sha256-/n/TgVqyG/WeK+/DZqFZCdkQR4SD5+YmljLlzAehMvw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From c913b406e3029ac5597634a6bbe0b3ad5a39fe06 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 03:30:43 +0000
Subject: [PATCH 27/40] gleam: 0.25.0 -> 0.25.1

---
 pkgs/development/compilers/gleam/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index 4df28fd739e..3f314837174 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LLl3T7VvDyyeq47vgZPkQhcPk2yZMRsCta8EqduNvuY=";
+    sha256 = "sha256-PzvFX1ssBPXhHBNGK38y427HYJ9Q40c4w2mqGZ/2rtI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  cargoSha256 = "sha256-vMgU66LhhRrSA9Dx3eyVmUwrYKVtAfE12tQC8WzTimo=";
+  cargoSha256 = "sha256-NeNpT/yOXE70ElawrOGBc4G5bN2ohzYVVUtF4yVCJOo=";
 
   meta = with lib; {
     description = "A statically typed language for the Erlang VM";

From beaf7262e6a1d8276eccc93b3fd9ea2dd2e11470 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 22 Oct 2022 10:28:41 +0200
Subject: [PATCH 28/40] =?UTF-8?q?ocamlPackages.stdcompat:=2018=20=E2=86=92?=
 =?UTF-8?q?=2019?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://github.com/thierry-martinez/stdcompat/releases/tag/v19
---
 .../ocaml-modules/stdcompat/default.nix       | 22 ++++++++-----------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/ocaml-modules/stdcompat/default.nix b/pkgs/development/ocaml-modules/stdcompat/default.nix
index 3630be368e5..b8dcc81bfe7 100644
--- a/pkgs/development/ocaml-modules/stdcompat/default.nix
+++ b/pkgs/development/ocaml-modules/stdcompat/default.nix
@@ -1,29 +1,25 @@
-{ stdenv, lib, fetchurl
-, ocaml, findlib
+{ buildDunePackage
+, lib
+, fetchurl
 }:
 
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-stdcompat";
-  version = "18";
+buildDunePackage rec {
+  pname = "stdcompat";
+  version = "19";
 
   src = fetchurl {
     url = "https://github.com/thierry-martinez/stdcompat/releases/download/v${version}/stdcompat-${version}.tar.gz";
-    sha256 = "sha256:01y67rndjlzfp5zq0gbqpg9skqq2hfbvhbq9lfhhk5xidr98sfj8";
+    sha256 = "sha256-DKQGd4nnIN6SPls6hcA/2Jvc7ivYNpeMU6rYsVc1ClU=";
   };
 
-  nativeBuildInputs = [ ocaml findlib ];
-
   strictDeps = true;
 
-  # build fails otherwise
-  enableParallelBuilding = false;
-
-  configureFlags = [ "--libdir=$(OCAMLFIND_DESTDIR)" ];
+  # Otherwise ./configure script will run and create files conflicting with dune.
+  dontConfigure = true;
 
   meta = {
     homepage = "https://github.com/thierry-martinez/stdcompat";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.vbgl ];
-    inherit (ocaml.meta) platforms;
   };
 }

From 35e2079bd5a3c5a213068c9fae1fa766cf1fb249 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 22 Oct 2022 10:26:42 +0200
Subject: [PATCH 29/40] =?UTF-8?q?ocamlPackages.pyml:=2020220615=20?=
 =?UTF-8?q?=E2=86=92=2020220905?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://github.com/thierry-martinez/pyml/releases/tag/20220905

Aldo switch to dune, which has been available since 2021-09-24.
And remove unneeded dependencies:
- ncurses was needed for Python in the past
- ocaml and findlib are implied by dune
---
 .../ocaml-modules/pyml/default.nix            | 53 +++++++++++--------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/ocaml-modules/pyml/default.nix b/pkgs/development/ocaml-modules/pyml/default.nix
index 97fcf1d5caa..9eba3ab3185 100644
--- a/pkgs/development/ocaml-modules/pyml/default.nix
+++ b/pkgs/development/ocaml-modules/pyml/default.nix
@@ -1,23 +1,37 @@
-{ stdenv, lib, fetchFromGitHub, ocaml, findlib, utop, python3, stdcompat, ncurses }:
+{ buildDunePackage
+, lib
+, fetchFromGitHub
+, fetchpatch
+, utop
+, python3
+, stdcompat
+}:
 
-stdenv.mkDerivation rec {
+buildDunePackage rec {
   pname = "pyml";
-  version = "20220615";
+  version = "20220905";
 
   src = fetchFromGitHub {
-    owner  = "thierry-martinez";
-    repo   = pname;
-    rev    = version;
-    sha256 = "sha256-my/xn9vrYTcHyjXGBNamgqpBz2/6bTyQHuE9ViVGLjw=";
+    owner = "thierry-martinez";
+    repo = "pyml";
+    rev = version;
+    sha256 = "PL4tFIKQLRutSn9Sf84/ImJv0DqkstNnJaNBqWDTKDQ=";
   };
 
-  nativeBuildInputs = [
-    ocaml
-    findlib
+  patches = [
+    # Fixes test crash.
+    # https://github.com/thierry-martinez/pyml/issues/85
+    (fetchpatch {
+      url = "https://github.com/thierry-martinez/pyml/commit/a0bc5aca8632bea273f869d622cad2f55e754a7c.patch";
+      sha256 = "bOqAokm5DE5rlvkBMQZtwMppRmoK9cvjJeGeP6BusnE=";
+      excludes = [
+        "CHANGES.md"
+      ];
+    })
   ];
+
   buildInputs = [
     utop
-    ncurses
   ];
 
   propagatedBuildInputs = [
@@ -25,24 +39,17 @@ stdenv.mkDerivation rec {
     stdcompat
   ];
 
+  checkInputs = [
+    python3.pkgs.numpy
+  ];
+
   strictDeps = true;
 
-  buildPhase = ''
-    make all pymltop pymlutop PREFIX=$out
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mkdir -p $OCAMLFIND_DESTDIR/stublibs
-    make install PREFIX=$out
-    runHook postInstall
-  '';
-
   doCheck = true;
 
   meta = {
     description = "OCaml bindings for Python";
+    homepage = "https://github.com/thierry-martinez/pyml";
     license = lib.licenses.bsd2;
   };
 }

From 2afa2a25ad1540e64565f6a312d417f3d07ae5bf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 13:27:29 +0000
Subject: [PATCH 30/40] python310Packages.graphene: 3.2.0 -> 3.2.1

---
 pkgs/development/python-modules/graphene/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/graphene/default.nix b/pkgs/development/python-modules/graphene/default.nix
index 1d10e9fcdd7..c6508cef7a7 100644
--- a/pkgs/development/python-modules/graphene/default.nix
+++ b/pkgs/development/python-modules/graphene/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "graphene";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "graphql-python";
     repo = "graphene";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2o/IR6XjnS57D4ZjADrcI18acfJ+Q0zdnXeb5ZeCpM4=";
+    hash = "sha256-XnrzgPkkFsTgNE9J+eSkD8f5MokKjtZhbbE/dxNZryk=";
   };
 
   propagatedBuildInputs = [

From 9a70465be7aeed940c6ec2db9de65ec4b288331b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 13:59:44 +0000
Subject: [PATCH 31/40] python310Packages.hahomematic: 2022.12.2 -> 2022.12.3

---
 pkgs/development/python-modules/hahomematic/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index d3846c4efcb..26b050ae998 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2022.12.2";
+  version = "2022.12.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-mU/YOOYlXNQQyzH2t+XZEi2+w8rzcoxIIxrdwAM4C00=";
+    sha256 = "sha256-6xCPkB2QydoJrvwgGGJqmGaw38HCAUs2jPBuXoIBC2Q=";
   };
 
   nativeBuildInputs = [

From 5315838a26b3f5491a4b65d1b107d53ae9d80af7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 13 Dec 2022 17:11:04 +0300
Subject: [PATCH 32/40] wireplumber: 0.4.12 -> 0.4.13

Diff: https://gitlab.freedesktop.org/pipewire/wireplumber/-/compare/0.4.12...0.4.13
---
 pkgs/development/libraries/pipewire/wireplumber.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pipewire/wireplumber.nix b/pkgs/development/libraries/pipewire/wireplumber.nix
index 5770866ebbe..8ea1361c244 100644
--- a/pkgs/development/libraries/pipewire/wireplumber.nix
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@@ -26,7 +26,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wireplumber";
-  version = "0.4.12";
+  version = "0.4.13";
 
   outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "pipewire";
     repo = "wireplumber";
     rev = version;
-    sha256 = "sha256-2qM6sX807v/3DZXTuBvUSGV8+cPB87rWYb+HTDCm3kw=";
+    sha256 = "sha256-Zz8N6OPwZ4Dwaygiy46C3sN9zPGC12+55S/qns+S+h4=";
   };
 
   nativeBuildInputs = [

From 2e943fc060032e3b4e3dc028ba1acbe8f2446afd Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Mon, 12 Dec 2022 18:32:12 +0000
Subject: [PATCH 33/40] resholve: use stripped-down python27

This PR strips down the modified `python27` derivation used by `resholve`. The
idea is to reduce the possible security issues, and also to make it easier to
bootstrap.
---
 .../python/cpython/2.7/default.nix            | 14 ++++++++
 pkgs/development/misc/resholve/default.nix    | 36 ++++++++++++++-----
 2 files changed, 41 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 684088186a0..31798a719ec 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -31,6 +31,10 @@
 , rebuildBytecode ? true
 , reproducibleBuild ? false
 , enableOptimizations ? false
+, strip2to3 ? false
+, stripConfig ? false
+, stripIdlelib ? false
+, stripTests ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
 
@@ -318,6 +322,16 @@ in with passthru; stdenv.mkDerivation ({
     postFixup = ''
       # Include a sitecustomize.py file. Note it causes an error when it's in postInstall with 2.7.
       cp ${../../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+    '' + optionalString strip2to3 ''
+      rm -R $out/bin/2to3 $out/lib/python*/lib2to3
+    '' + optionalString stripConfig ''
+      rm -R $out/bin/python*-config $out/lib/python*/config-*
+    '' + optionalString stripIdlelib ''
+      # Strip IDLE
+      rm -R $out/bin/idle* $out/lib/python*/idlelib
+    '' + optionalString stripTests ''
+      # Strip tests
+      rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
     '';
 
     enableParallelBuilding = true;
diff --git a/pkgs/development/misc/resholve/default.nix b/pkgs/development/misc/resholve/default.nix
index 34dd36a2124..df0573fd884 100644
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@@ -1,19 +1,37 @@
 { lib
-, stdenv
+, pkgs
 , pkgsBuildHost
 , ...
 }:
 
 let
-  pkgs = import ../../../.. {
-    inherit (stdenv.hostPlatform) system;
-    # Allow python27 with known security issues only for resholve,
-    # see issue #201859 for the reasoning
-    # In resholve case this should not be a security issue,
-    # since it will only be used during build, not runtime
-    config.permittedInsecurePackages = [ pkgsBuildHost.python27.name ];
+  python27' = (pkgsBuildHost.python27.overrideAttrs (old:
+    {
+      # Overriding `meta.knownVulnerabilities` here, see #201859 for why it exists
+      # In resholve case this should not be a security issue,
+      # since it will only be used during build, not runtime
+      meta = (old.meta or { }) // { knownVulnerabilities = [ ]; };
+    }
+  )).override {
+    self = python27';
+    pkgsBuildHost = pkgsBuildHost // { python27 = python27'; };
+    # strip down that python version as much as possible
+    openssl = null;
+    bzip2 = null;
+    readline = null;
+    ncurses = null;
+    gdbm = null;
+    sqlite = null;
+    libffi = null;
+    rebuildBytecode = false;
+    stripBytecode = true;
+    strip2to3 = true;
+    stripConfig = true;
+    stripIdlelib = true;
+    stripTests = true;
+    enableOptimizations = false;
   };
-  callPackage = lib.callPackageWith pkgs;
+  callPackage = lib.callPackageWith (pkgs // { python27 = python27'; });
   source = callPackage ./source.nix { };
   deps = callPackage ./deps.nix { };
 in

From 423b8fc89337df4fa4b6af928330c17ef51930e0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 13 Dec 2022 16:01:26 +0100
Subject: [PATCH 34/40] python310Packages.zadnegoale: add changelog to meta

---
 pkgs/development/python-modules/zadnegoale/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/zadnegoale/default.nix b/pkgs/development/python-modules/zadnegoale/default.nix
index 7d47cb347c8..936cc02e9dd 100644
--- a/pkgs/development/python-modules/zadnegoale/default.nix
+++ b/pkgs/development/python-modules/zadnegoale/default.nix
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper for getting allergen concentration data from Żadnego Ale servers";
     homepage = "https://github.com/bieniu/zadnegoale";
+    changelog = "https://github.com/bieniu/zadnegoale/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };

From 46dce1ebc2f6f3dfff9df0346e80e5457745cfd0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 13 Dec 2022 16:02:38 +0100
Subject: [PATCH 35/40] python310Packages.zadnegoale: 0.6.5 -> 0.7.0

Diff: https://github.com/bieniu/zadnegoale/compare/refs/tags/0.6.5...0.7.0

Changelog: https://github.com/bieniu/zadnegoale/releases/tag/0.7.0
---
 pkgs/development/python-modules/zadnegoale/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zadnegoale/default.nix b/pkgs/development/python-modules/zadnegoale/default.nix
index 936cc02e9dd..5b08fa950fa 100644
--- a/pkgs/development/python-modules/zadnegoale/default.nix
+++ b/pkgs/development/python-modules/zadnegoale/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "zadnegoale";
-  version = "0.6.5";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ubBN4jvueNgReNbS+RXNDNHID0MF/rvQnb0+F4/DZaU=";
+    hash = "sha256-ij8xou8LXC4/BUTApIV6xSgb7ethwLyrHNJvBgxSBYM=";
   };
 
   propagatedBuildInputs = [

From 1b299a2e6cfcb6fccccc07dbbd9e1e7bb3e30816 Mon Sep 17 00:00:00 2001
From: David Morgan <djm_uk@protonmail.com>
Date: Tue, 13 Dec 2022 16:23:15 +0000
Subject: [PATCH 36/40] ea: init at 0.2.1 (#204816)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/tools/misc/ea/default.nix  | 31 +++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/tools/misc/ea/default.nix

diff --git a/pkgs/tools/misc/ea/default.nix b/pkgs/tools/misc/ea/default.nix
new file mode 100644
index 00000000000..cbef6caebbb
--- /dev/null
+++ b/pkgs/tools/misc/ea/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, installShellFiles, libiconv }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dduan";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "dduan";
+    repo = "ea";
+    rev = version;
+    sha256 = "VXSSe5d7VO3LfjumzN9a7rrKRedOtOzTdLVQWgV1ED8=";
+  };
+
+  cargoSha256 = "sha256-QNj24qKZFqG4QXG6rIFV2Y/BNPTXt7HaX7smsJRrdzg=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
+
+  postInstall = ''
+    installManPage docs/ea.1
+  '';
+
+  meta = with lib; {
+    description = "Makes file paths from CLI output actionable";
+    homepage = "https://github.com/dduan/ea";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ deejayem ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e3a60c6bae..e57d2585cfe 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -468,6 +468,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  ea = callPackage ../tools/misc/ea { };
+
   each = callPackage ../tools/text/each { };
 
   eclipse-mat = callPackage ../development/tools/eclipse-mat { };

From 93e4170a3e9388afcea73ab2346fcdc37f068587 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 12 Dec 2022 22:15:42 -0800
Subject: [PATCH 37/40] python310Packages.pycodestyle: fix meta.changelog

---
 pkgs/development/python-modules/pycodestyle/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pycodestyle/default.nix b/pkgs/development/python-modules/pycodestyle/default.nix
index de1dea5e066..ed4ac3f5fbf 100644
--- a/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/pkgs/development/python-modules/pycodestyle/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pycodestyle" ];
 
   meta = with lib; {
-    changelog = "https://github.com/PyCQA/pyflakes/blob/${version}/NEWS.rst";
+    changelog = "https://github.com/PyCQA/pycodestyle/blob/${version}/CHANGES.txt";
     description = "Python style guide checker";
     homepage = "https://pycodestyle.pycqa.org/";
     license = licenses.mit;

From 0668224e7fdd032e4058772bb1c7fba83b57cd3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 11 Dec 2022 22:05:33 -0800
Subject: [PATCH 38/40] banking: 0.5.1 -> 0.6.0

---
 pkgs/applications/office/banking/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/office/banking/default.nix b/pkgs/applications/office/banking/default.nix
index d0a08b9373a..1874521cb0c 100644
--- a/pkgs/applications/office/banking/default.nix
+++ b/pkgs/applications/office/banking/default.nix
@@ -18,14 +18,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "banking";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "other";
 
   src = fetchFromGitLab {
     owner = "tabos";
     repo = "banking";
     rev = version;
-    sha256 = "sha256-tZlBpDcwQ/aWroP2sFQBZcvmBD26PiY7q/8xFA8GnVc=";
+    hash = "sha256-x/um40sRD58d5LuuJlyietCV1Rw4H5VSO0I3ZwD5kO8=";
   };
 
   postPatch = ''
@@ -54,8 +54,8 @@ python3.pkgs.buildPythonApplication rec {
     cryptography
     fints
     mt-940
+    onetimepad
     pygobject3
-    pysqlitecipher
     schwifty
   ];
 

From 713b5c27ab0b0de01b779ed24b2ff6fe7172fedb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 09:49:05 +0000
Subject: [PATCH 39/40] hjson-go: 4.2.0 -> 4.3.0

---
 pkgs/development/tools/hjson-go/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/hjson-go/default.nix b/pkgs/development/tools/hjson-go/default.nix
index 7b850917322..a2aae191c9a 100644
--- a/pkgs/development/tools/hjson-go/default.nix
+++ b/pkgs/development/tools/hjson-go/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hjson-go";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "hjson";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bw8dQKwHqEzBpDT+59XjzhxDrA3R0OiEUyIWMULuAQI=";
+    sha256 = "sha256-WR6wLa/Za5MgcH1enHG/74uq/7PdaY/OzvJdgMgDFIk=";
   };
 
   vendorSha256 = null;

From 16875b3e7be8380c29af192cc8ff1debae6d311a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 13 Dec 2022 17:11:41 +0100
Subject: [PATCH 40/40] hjson-go: add changelog to meta

---
 pkgs/development/tools/hjson-go/default.nix | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/hjson-go/default.nix b/pkgs/development/tools/hjson-go/default.nix
index a2aae191c9a..bab12da8eb6 100644
--- a/pkgs/development/tools/hjson-go/default.nix
+++ b/pkgs/development/tools/hjson-go/default.nix
@@ -1,4 +1,7 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "hjson-go";
@@ -8,16 +11,20 @@ buildGoModule rec {
     owner = "hjson";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WR6wLa/Za5MgcH1enHG/74uq/7PdaY/OzvJdgMgDFIk=";
+    hash = "sha256-WR6wLa/Za5MgcH1enHG/74uq/7PdaY/OzvJdgMgDFIk=";
   };
 
   vendorSha256 = null;
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
   meta = with lib; {
     description = "Utility to convert JSON to and from HJSON";
     homepage = "https://hjson.github.io/";
+    changelog = "https://github.com/hjson/hjson-go/releases/tag/v${version}";
     maintainers = with maintainers; [ ehmry ];
     license = licenses.mit;
     mainProgram = "hjson-cli";