about summary refs log tree commit diff
path: root/nixpkgs/pkgs/os-specific
diff options
context:
space:
mode:
authorAlyssa Ross <hi@alyssa.is>2023-06-16 06:56:35 +0000
committerAlyssa Ross <hi@alyssa.is>2023-06-16 06:56:35 +0000
commit99fcaeccb89621dd492203ce1f2d551c06f228ed (patch)
tree41cb730ae07383004789779b0f6e11cb3f4642a3 /nixpkgs/pkgs/os-specific
parent59c5f5ac8682acc13bb22bc29c7cf02f7d75f01f (diff)
parent75a5ebf473cd60148ba9aec0d219f72e5cf52519 (diff)
downloadnixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar.gz
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar.bz2
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar.lz
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar.xz
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.tar.zst
nixlib-99fcaeccb89621dd492203ce1f2d551c06f228ed.zip
Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs
Conflicts:
	nixpkgs/nixos/modules/config/console.nix
	nixpkgs/nixos/modules/services/mail/mailman.nix
	nixpkgs/nixos/modules/services/mail/public-inbox.nix
	nixpkgs/nixos/modules/services/mail/rss2email.nix
	nixpkgs/nixos/modules/services/networking/ssh/sshd.nix
	nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
	nixpkgs/pkgs/applications/networking/irc/weechat/default.nix
	nixpkgs/pkgs/applications/window-managers/sway/default.nix
	nixpkgs/pkgs/build-support/go/module.nix
	nixpkgs/pkgs/build-support/rust/build-rust-package/default.nix
	nixpkgs/pkgs/development/interpreters/python/default.nix
	nixpkgs/pkgs/development/node-packages/overrides.nix
	nixpkgs/pkgs/development/tools/b4/default.nix
	nixpkgs/pkgs/servers/dict/dictd-db.nix
	nixpkgs/pkgs/servers/mail/public-inbox/default.nix
	nixpkgs/pkgs/tools/security/pinentry/default.nix
	nixpkgs/pkgs/tools/text/unoconv/default.nix
	nixpkgs/pkgs/top-level/all-packages.nix
Diffstat (limited to 'nixpkgs/pkgs/os-specific')
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch32
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch42
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh6
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/default.nix901
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix64
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch10
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch32
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch15
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/setup-hook.sh12
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch45
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix99
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/getent.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/locale.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/setup-hook.sh11
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/xargs-j.sh17
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/DarwinTools/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix133
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix148
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix341
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix21
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk/frameworks.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix144
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix2
-rwxr-xr-xnixpkgs/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh20
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix80
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/top/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/asitop/default.nix33
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/binutils/default.nix31
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/apple.nix122
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/cctools-add-missing-vtool-libstuff-dep.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch21
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix104
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/port.nix124
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/darling/default.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/defaultbrowser/default.nix26
-rwxr-xr-xnixpkgs/pkgs/os-specific/darwin/gen-frameworks.py147
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/goku/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix34
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/iproute2mac/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/karabiner-elements/default.nix52
-rwxr-xr-xnixpkgs/pkgs/os-specific/darwin/karabiner-elements/updater.sh13
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/macfuse/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/maloader/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix78
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/noah/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/openwith/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/pam-reattach/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix31
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/plistwatch/go-modules.patch19
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/raycast/default.nix49
-rwxr-xr-xnixpkgs/pkgs/os-specific/darwin/raycast/update.sh20
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix44
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/shortcat/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/sigtool/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/smimesign/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swiftbar/default.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swiftdefaultapps/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/utm/default.nix67
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/xattr/default.nix16
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/xcode/default.nix69
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/yabai/default.nix166
-rw-r--r--nixpkgs/pkgs/os-specific/linux/acpid/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/adcli/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix109
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/amdctl/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/anbox/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/apfs/default.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/apparmor/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/asus-ec-sensors/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/atop/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch35
-rw-r--r--nixpkgs/pkgs/os-specific/linux/audit/default.nix136
-rw-r--r--nixpkgs/pkgs/os-specific/linux/audit/patches/weak-symbols.patch147
-rw-r--r--nixpkgs/pkgs/os-specific/linux/autofs/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bbswitch/default.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bcc/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/below/default.nix41
-rw-r--r--nixpkgs/pkgs/os-specific/linux/blktrace/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bluez/default.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bolt/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix24
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpftools/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix85
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bridge-utils/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/brillo/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/broadcom-sta/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch30
-rw-r--r--nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch83
-rw-r--r--nixpkgs/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/busybox/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/can-utils/default.nix20
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/catfs/Cargo.lock651
-rw-r--r--nixpkgs/pkgs/os-specific/linux/catfs/default.nix24
-rw-r--r--nixpkgs/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ch9344/default.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/checkpolicy/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cifs-utils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conky/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cpuid/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cpustat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/criu/default.nix74
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cryptodev/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch50
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cshatag/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix81
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dbus-broker/paths.patch27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ddcci/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dddvb/default.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/device-tree/default.nix33
-rw-r--r--nixpkgs/pkgs/os-specific/linux/digimend/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/displaylink/default.nix16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dlm/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dpdk-kmods/default.nix16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dpdk/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dracut/default.nix114
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ebtables/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ell/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ena/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/error-inject/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ethq/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/eudev/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/evdi/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/eventstat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/exfat/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fan2go/default.nix31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fanctl/default.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fatrace/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fbterm/default.nix105
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firejail/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix147
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock4125
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/default.nix56
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json1498
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock992
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch74
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix532
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix79
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix41
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix6
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock1551
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fnotifystat/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/forkstat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/freeipa/default.nix171
-rw-r--r--nixpkgs/pkgs/os-specific/linux/freeipa/paths.py13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fscrypt/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fuse/common.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fwts/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fxload/default.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/g15daemon/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/gasket/default.nix35
-rw-r--r--nixpkgs/pkgs/os-specific/linux/gobi_loader/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/greetd/default.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/linux/gtkgreet/default.nix50
-rw-r--r--nixpkgs/pkgs/os-specific/linux/guvcview/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hd-idle/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hdparm/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/health-check/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hostapd/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hwdata/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hyperv-daemons/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/intel-cmt-cat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix42
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iproute/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iproute/mptcp.nix40
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iptables/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix53
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iputils/default.nix57
-rw-r--r--nixpkgs/pkgs/os-specific/linux/irqbalance/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ivsc-driver/default.nix43
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iw/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iwd/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/cli.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/source.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kbd/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix181
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch784
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch86
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/generic.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json64
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix33
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.18.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.19.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rpi.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch283
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix617
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/p9-fixes.patch85
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/patches.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch352
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/perf/default.nix155
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/kernel/update-zen.py29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix54
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/keyutils/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/klibc/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kmod/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kmscon/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix40
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kvdo/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix48
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix34
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libaio/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libbpf/0.x.nix54
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libcap-ng/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libcap/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libcgroup/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libnl-tiny/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libnl/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libnvme/default.nix70
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libratbag/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libselinux/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libsepol/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libsmbios/default.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libzbc/default.nix38
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libzbd/default.nix40
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lightum/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lkrg/default.nix53
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lksctp-tools/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lockdep/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lsb-release/lsb_release.sh2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lsirec/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix40
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/2_02.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/common.nix49
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.patch46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lxc/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/macchanger/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mceinject/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mdevctl/default.nix42
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mdevd/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/microcode/iucode-tool.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix146
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix70
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix117
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix88
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix77
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix60
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch35
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch40
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch58
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix190
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix107
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix64
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix65
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix58
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix97
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch84
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix130
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch43
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch44
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch99
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch322
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h53
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c205
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch73
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h64
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch77
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch141
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch90
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch128
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix238
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh95
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix60
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix34
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix24
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem204
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix88
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix345
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix172
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix104
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix96
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix62
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/molly-guard/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix65
-rw-r--r--nixpkgs/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/musl/default.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mwprocapture/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mxu11x0/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mxu11x0/srcs.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/net-tools/mptcp.nix21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/netatop/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nfs-utils/default.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nftables/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nixos-rebuild/default.nix3
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh38
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nmon/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nsncd/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/numactl/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/numatop/default.nix2
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/nvidia-x11/builder.sh11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix141
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix47
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/open.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/settings.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix33
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ocf-resource-agents/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/odp-dpdk/default.nix48
-rw-r--r--nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix75
-rw-r--r--nixpkgs/pkgs/os-specific/linux/open-isns/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix67
-rw-r--r--nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix126
-rw-r--r--nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix83
-rw-r--r--nixpkgs/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch274
-rw-r--r--nixpkgs/pkgs/os-specific/linux/otpw/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/oxtools/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_mount/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_mysql/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_p11/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_pgsql/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_u2f/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_usb/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_ussh/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_ussh/go.sum22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pcm/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pcmciautils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/piper/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pktgen/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pmount/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/policycoreutils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/power-profiles-daemon/default.nix39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/powercap/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/powerstat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/powertop/default.nix51
-rw-r--r--nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix233
-rw-r--r--nixpkgs/pkgs/os-specific/linux/procps-ng/default.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/projecteur/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pscircle/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/psmisc/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/qc71_laptop/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/qperf/default.nix43
-rw-r--r--nixpkgs/pkgs/os-specific/linux/r8168/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rasdaemon/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/reptyr/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/restool/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/roccat-tools/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8189es/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8189fs/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8723ds/default.nix44
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8814au/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8821ce/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtw88/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtw89/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sasutils/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c174
-rw-r--r--nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/setools/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix93
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/shadow/default.nix113
-rw-r--r--nixpkgs/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sssd/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/switcheroo-control/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysdig/default.nix74
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysfsutils/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysklogd/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/syslinux/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/system76-power/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/system76-scheduler/default.nix43
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch152
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch33
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch41
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/default.nix239
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/targetcli/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tinyalsa/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tiptop/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tpacpi-bat/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tuigreet/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tunctl/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ulogd/default.nix74
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/upower/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbguard-notifier/default.nix44
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbguard/default.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbip/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbrelay/daemon.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbrelay/python.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbrelay/test.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbutils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usermount/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/util-linux/default.nix45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uvcdynctrl/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/v4l2-relayd/default.nix47
-rw-r--r--nixpkgs/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/v4l2loopback/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch55
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vdo/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vmware/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/waydroid/default.nix56
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wireguard/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix84
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wlgreet/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules78
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xf86-input-wacom/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xf86-video-nested/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xone/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xpadneo/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zenpower/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/default.nix244
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/generic.nix234
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/stable.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zsa-udev-rules/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/solo5/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/solo5/fix_paths.patch29
-rw-r--r--nixpkgs/pkgs/os-specific/solo5/test_sleep.patch22
-rw-r--r--nixpkgs/pkgs/os-specific/windows/mingw-w64/default.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/windows/wxMSW-2.8/default.nix2
597 files changed, 24291 insertions, 6749 deletions
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch
new file mode 100644
index 000000000000..3336a2504e58
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch
@@ -0,0 +1,32 @@
+--- a/tools/build/cross-build/include/common/sys/_types.h
++++ b/tools/build/cross-build/include/common/sys/_types.h
+@@ -47,3 +47,6 @@
+  * Neither GLibc nor macOS define __va_list but many FreeBSD headers require it.
+  */
+ typedef __builtin_va_list __va_list;
++
++typedef __UINTPTR_TYPE__ __uintptr_t;
++typedef __INTPTR_TYPE__ __intptr_t;
+--- a/tools/build/cross-build/include/common/sys/types.h
++++ b/tools/build/cross-build/include/common/sys/types.h
+@@ -49,9 +49,6 @@
+ #include <sys/sysmacros.h>
+ #endif
+ 
+-typedef __UINTPTR_TYPE__ __uintptr_t;
+-typedef __INTPTR_TYPE__ __intptr_t;
+-
+ /* needed for gencat */
+ typedef int __nl_item;
+ 
+--- a/tools/build/cross-build/include/linux/sys/types.h
++++ b/tools/build/cross-build/include/linux/sys/types.h
+@@ -39,6 +39,8 @@
+ 
+ #include_next <sys/types.h>
+ 
++#include <sys/_types.h>
++
+ #ifndef __size_t
+ typedef __SIZE_TYPE__ __size_t;
+ #endif
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch
new file mode 100644
index 000000000000..9bb2bea32ee9
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch
@@ -0,0 +1,42 @@
+diff --git a/tools/build/Makefile b/tools/build/Makefile
+index 948a5f9dfdb..592af84eeae 100644
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -327,15 +327,15 @@ host-symlinks:
+ # and cross-tools stages. We do this here using mkdir since mtree may not exist
+ # yet (this happens if we are crossbuilding from Linux/Mac).
+ INSTALLDIR_LIST= \
+-	bin \
+-	lib/casper \
+-	lib/geom \
+-	usr/include/casper \
+-	usr/include/private/ucl \
+-	usr/include/private/zstd \
+-	usr/lib \
+-	usr/libdata/pkgconfig \
+-	usr/libexec
++	${BINDIR} \
++	${LIBDIR}/casper \
++	${LIBDIR}/geom \
++	${INCLUDEDIR}/casper \
++	${INCLUDEDIR}/private/ucl \
++	${INCLUDEDIR}/private/zstd \
++	${LIBDIR} \
++	${LIBDIR}/libdata/pkgconfig \
++	${LIBEXECDIR}
+ 
+ installdirs:
+ 	mkdir -p ${INSTALLDIR_LIST:S,^,${DESTDIR}/,}
+@@ -352,9 +352,9 @@ installdirs:
+ 	    rm -rf "${DESTDIR}/${_dir}"; \
+ 	fi
+ .endfor
+-	ln -sfn bin ${DESTDIR}/sbin
+-	ln -sfn ../bin ${DESTDIR}/usr/bin
+-	ln -sfn ../bin ${DESTDIR}/usr/sbin
++	ln -sfn bin ${DESTDIR}/${SBINDIR}
++	ln -sfn ../bin ${DESTDIR}/${BINDIR}
++	ln -sfn ../bin ${DESTDIR}/${SBINDIR}
+ .for _group in ${INCSGROUPS:NINCS}
+ 	mkdir -p "${DESTDIR}/${${_group}DIR}"
+ .endfor
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh
new file mode 100644
index 000000000000..6c3fda4e95ac
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh
@@ -0,0 +1,6 @@
+# See pkgs/build-support/setup-hooks/role.bash
+getHostRole
+
+export NIX_LDFLAGS${role_post}+=" -legacy"
+export NIX_CFLAGS_COMPILE${role_post}+=" -isystem @out@/0-include"
+export NIX_CFLAGS_COMPILE${role_post}+=" -isystem @out@/1-include"
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/default.nix b/nixpkgs/pkgs/os-specific/bsd/freebsd/default.nix
new file mode 100644
index 000000000000..136c9721c6bb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/default.nix
@@ -0,0 +1,901 @@
+{ stdenv, lib, stdenvNoCC
+, makeScopeWithSplicing, generateSplicesForMkScope
+, buildPackages
+, bsdSetupHook, makeSetupHook
+, fetchgit, fetchzip, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
+, zlib, expat, libmd
+, runCommand, writeShellScript, writeText, symlinkJoin
+}:
+
+let
+  inherit (buildPackages.buildPackages) rsync;
+
+  version = "13.1.0";
+
+  # `BuildPackages.fetchgit` avoids some probably splicing-caused infinite
+  # recursion.
+  freebsdSrc = buildPackages.fetchgit {
+    url = "https://git.FreeBSD.org/src.git";
+    rev = "release/${version}";
+    sha256 = "14nhk0kls83xfb64d5xy14vpi6k8laswjycjg80indq9pkcr2rlv";
+  };
+
+  freebsdSetupHook = makeSetupHook {
+    name = "freebsd-setup-hook";
+  } ./setup-hook.sh;
+
+  mkBsdArch = stdenv':  {
+    x86_64 = "amd64";
+    aarch64 = "arm64";
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  install-wrapper = ''
+    set -eu
+
+    args=()
+    declare -i path_args=0
+
+    while (( $# )); do
+      if (( $# == 1 )); then
+        if (( path_args > 1)) || [[ "$1" = */ ]]; then
+          mkdir -p "$1"
+        else
+          mkdir -p "$(dirname "$1")"
+        fi
+      fi
+      case $1 in
+        -C) ;;
+        -o | -g) shift ;;
+        -s) ;;
+        -m | -l)
+          # handle next arg so not counted as path arg
+          args+=("$1" "$2")
+          shift
+          ;;
+        -*) args+=("$1") ;;
+        *)
+          path_args+=1
+          args+=("$1")
+          ;;
+      esac
+      shift
+    done
+  '';
+
+in makeScopeWithSplicing
+  (generateSplicesForMkScope "freebsd")
+  (_: {})
+  (_: {})
+  (self: let
+    inherit (self) mkDerivation;
+  in {
+  inherit freebsdSrc;
+
+  ports = fetchzip {
+    url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
+    sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
+  };
+
+  # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
+  # See note in ../netbsd/default.nix.
+
+  compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
+
+  mkDerivation = lib.makeOverridable (attrs: let
+    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
+  in stdenv'.mkDerivation (rec {
+    pname = "${attrs.pname or (baseNameOf attrs.path)}-freebsd";
+    inherit version;
+    src = runCommand "${pname}-filtered-src" {
+      nativeBuildInputs = [ rsync ];
+    } ''
+      for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [])}; do
+        set -x
+        path="$out/$p"
+        mkdir -p "$(dirname "$path")"
+        src_path="${freebsdSrc}/$p"
+        if [[ -d "$src_path" ]]; then src_path+=/; fi
+        rsync --chmod="+w" -r "$src_path" "$path"
+        set +x
+      done
+    '';
+
+    extraPaths = [ ];
+
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal
+      install tsort lorder mandoc groff #statHook
+    ];
+    buildInputs = with self; compatIfNeeded;
+
+    HOST_SH = stdenv'.shell;
+
+    # Since STRIP below is the flag
+    STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
+
+    makeFlags = [
+      "STRIP=-s" # flag to install, not command
+    ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+
+    # amd64 not x86_64 for this on unlike NetBSD
+    MACHINE_ARCH = mkBsdArch stdenv';
+
+    MACHINE = mkBsdArch stdenv';
+
+    MACHINE_CPUARCH = MACHINE_ARCH;
+
+    COMPONENT_PATH = attrs.path or null;
+
+    strictDeps = true;
+
+    meta = with lib; {
+      maintainers = with maintainers; [ ericson2314 ];
+      platforms = platforms.unix;
+      license = licenses.bsd2;
+    };
+  } // lib.optionalAttrs stdenv'.hasCC {
+    # TODO should CC wrapper set this?
+    CPP = "${stdenv'.cc.targetPrefix}cpp";
+  } // lib.optionalAttrs stdenv'.isDarwin {
+    MKRELRO = "no";
+  } // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+    HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+  } // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+    HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+  } // lib.optionalAttrs (stdenv'.isx86_32) {
+    USE_SSP = "no";
+  } // lib.optionalAttrs (attrs.headersOnly or false) {
+    installPhase = "includesPhase";
+    dontBuild = true;
+  } // attrs));
+
+  ##
+  ## START BOOTSTRAPPING
+  ##
+  makeMinimal = mkDerivation rec {
+    inherit (self.make) path;
+
+    buildInputs = with self; [];
+    nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook freebsdSetupHook ];
+
+    skipIncludesPhase = true;
+
+    makeFlags = [];
+
+    postPatch = ''
+      patchShebangs configure
+      ${self.make.postPatch}
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      sh ./make-bootstrap.sh
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      install -D bmake "$out/bin/bmake"
+      ln -s "$out/bin/bmake" "$out/bin/make"
+      mkdir -p "$out/share"
+      cp -r "$BSDSRCDIR/share/mk" "$out/share/mk"
+      find "$out/share/mk" -type f -print0 |
+        while IFS= read -r -d "" f; do
+          substituteInPlace "$f" --replace 'usr/' ""
+        done
+      substituteInPlace "$out/share/mk/bsd.symver.mk" \
+        --replace '/share/mk' "$out/share/mk"
+
+      runHook postInstall
+    '';
+
+    postInstall = lib.optionalString (!stdenv.targetPlatform.isFreeBSD) ''
+      boot_mk="$BSDSRCDIR/tools/build/mk"
+      cp "$boot_mk"/Makefile.boot* "$out/share/mk"
+      replaced_mk="$out/share/mk.orig"
+      mkdir "$replaced_mk"
+      mv "$out"/share/mk/bsd.{lib,prog}.mk "$replaced_mk"
+      for m in bsd.{lib,prog}.mk; do
+        cp "$boot_mk/$m" "$out/share/mk"
+        substituteInPlace "$out/share/mk/$m" --replace '../../../share/mk' '../mk.orig'
+      done
+    '';
+
+    extraPaths = with self; make.extraPaths;
+  };
+
+  # Wrap NetBSD's install
+  boot-install = buildPackages.writeShellScriptBin "boot-install" (install-wrapper + ''
+
+    ${buildPackages.netbsd.install}/bin/xinstall "''${args[@]}"
+  '');
+
+  compat = mkDerivation rec {
+    pname = "compat";
+    path = "tools/build";
+    extraPaths = [
+      "lib/libc/db"
+      "lib/libc/stdlib" # getopt
+      "lib/libc/gen" # getcap
+      "lib/libc/locale" # rpmatch
+    ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "lib/libc/string" # strlcpy
+      "lib/libutil"
+    ] ++ [
+      "contrib/libc-pwcache"
+      "contrib/libc-vis"
+      "sys/libkern"
+      "sys/kern/subr_capability.c"
+
+      # Take only individual headers, or else we will clobber native libc, etc.
+
+      "sys/rpc/types.h"
+
+      # Listed in Makekfile as INC
+      "include/mpool.h"
+      "include/ndbm.h"
+      "include/err.h"
+      "include/stringlist.h"
+      "include/a.out.h"
+      "include/nlist.h"
+      "include/db.h"
+      "include/getopt.h"
+      "include/nl_types.h"
+      "include/elf.h"
+      "sys/sys/ctf.h"
+
+      # Listed in Makekfile as SYSINC
+
+      "sys/sys/capsicum.h"
+      "sys/sys/caprights.h"
+      "sys/sys/imgact_aout.h"
+      "sys/sys/nlist_aout.h"
+      "sys/sys/nv.h"
+      "sys/sys/dnv.h"
+      "sys/sys/cnv.h"
+
+      "sys/sys/elf32.h"
+      "sys/sys/elf64.h"
+      "sys/sys/elf_common.h"
+      "sys/sys/elf_generic.h"
+      "sys/${mkBsdArch stdenv}/include"
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+      "sys/x86/include"
+    ] ++ [
+
+      "sys/sys/queue.h"
+      "sys/sys/md5.h"
+      "sys/sys/sbuf.h"
+      "sys/sys/tree.h"
+      "sys/sys/font.h"
+      "sys/sys/consio.h"
+      "sys/sys/fnv_hash.h"
+
+      "sys/crypto/chacha20/_chacha.h"
+      "sys/crypto/chacha20/chacha.h"
+      # included too, despite ".c"
+      "sys/crypto/chacha20/chacha.c"
+
+      "sys/fs"
+      "sys/ufs"
+      "sys/sys/disk"
+
+      "lib/libcapsicum"
+      "lib/libcasper"
+    ];
+
+    patches = [
+      ./compat-install-dirs.patch
+      ./compat-fix-typedefs-locations.patch
+    ];
+
+    preBuild = ''
+      NIX_CFLAGS_COMPILE+=' -I../../include -I../../sys'
+
+      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys
+      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys/${mkBsdArch stdenv}
+    '' + lib.optionalString stdenv.hostPlatform.isx86 ''
+      cp ../../sys/x86/include/elf.h ../../sys/x86
+    '';
+
+    setupHooks = [
+      ../../../build-support/setup-hooks/role.bash
+      ./compat-setup-hook.sh
+    ];
+
+    # This one has an ifdefed `#include_next` that makes it annoying.
+    postInstall = ''
+      rm ''${!outputDev}/0-include/libelf.h
+    '';
+
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal
+      boot-install
+
+      which
+    ];
+    buildInputs = [ expat zlib ];
+
+    makeFlags = [
+      "STRIP=-s" # flag to install, not command
+      "MK_WERROR=no"
+      "HOST_INCLUDE_ROOT=${lib.getDev stdenv.cc.libc}/include"
+      "INSTALL=boot-install"
+    ];
+
+    preIncludes = ''
+      mkdir -p $out/{0,1}-include
+      cp --no-preserve=mode -r cross-build/include/common/* $out/0-include
+    '' + lib.optionalString stdenv.hostPlatform.isLinux ''
+      cp --no-preserve=mode -r cross-build/include/linux/* $out/1-include
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      cp --no-preserve=mode -r cross-build/include/darwin/* $out/1-include
+    '';
+  };
+
+  libnetbsd = mkDerivation {
+    path = "lib/libnetbsd";
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal mandoc groff
+      (if stdenv.hostPlatform == stdenv.buildPlatform
+       then boot-install
+       else install)
+    ];
+    patches = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
+      ./libnetbsd-do-install.patch
+      #./libnetbsd-define-__va_list.patch
+    ];
+    makeFlags = [
+      "STRIP=-s" # flag to install, not command
+      "MK_WERROR=no"
+    ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+    buildInputs = with self; compatIfNeeded;
+  };
+
+  # HACK: to ensure parent directories exist. This emulates GNU
+  # install’s -D option. No alternative seems to exist in BSD install.
+  install = let binstall = writeShellScript "binstall" (install-wrapper + ''
+
+    @out@/bin/xinstall "''${args[@]}"
+  ''); in mkDerivation {
+    path = "usr.bin/xinstall";
+    extraPaths = with self; [ mtree.path ];
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal mandoc groff
+      (if stdenv.hostPlatform == stdenv.buildPlatform
+       then boot-install
+       else install)
+    ];
+    skipIncludesPhase = true;
+    buildInputs = with self; compatIfNeeded ++ [ libmd libnetbsd ];
+    makeFlags = [
+      "STRIP=-s" # flag to install, not command
+      "MK_WERROR=no"
+      "TESTSDIR=${builtins.placeholder "test"}"
+    ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+    postInstall = ''
+      install -D -m 0550 ${binstall} $out/bin/binstall
+      substituteInPlace $out/bin/binstall --subst-var out
+      mv $out/bin/install $out/bin/xinstall
+      ln -s ./binstall $out/bin/install
+    '';
+    outputs = [ "out" "man" "test" ];
+  };
+
+  sed = mkDerivation {
+    path = "usr.bin/sed";
+    TESTSRC = "${freebsdSrc}/contrib/netbsd-tests";
+    MK_TESTS = "no";
+  };
+
+  # Don't add this to nativeBuildInputs directly.  Use statHook instead.
+  stat = mkDerivation {
+    path = "usr.bin/stat";
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+    ];
+  };
+
+  # stat isn't in POSIX, and NetBSD stat supports a completely
+  # different range of flags than GNU stat, so including it in PATH
+  # breaks stdenv.  Work around that with a hook that will point
+  # NetBSD's build system and NetBSD stat without including it in
+  # PATH.
+  statHook = makeSetupHook {
+    name = "netbsd-stat-hook";
+  } (writeText "netbsd-stat-hook-impl" ''
+    makeFlagsArray+=(TOOL_STAT=${self.stat}/bin/stat)
+  '');
+
+  tsort = mkDerivation {
+    path = "usr.bin/tsort";
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+    ];
+  };
+
+  lorder = mkDerivation rec {
+    path = "usr.bin/lorder";
+    noCC = true;
+    dontBuild = true;
+    installPhase = ''
+      mkdir -p "$out/bin" "$man/share/man"
+      mv "lorder.sh" "$out/bin/lorder"
+      chmod +x "$out/bin/lorder"
+      mv "lorder.1" "$man/share/man"
+    '';
+    nativeBuildInputs = [ bsdSetupHook freebsdSetupHook ];
+    buildInputs = [];
+    outputs = [ "out" "man" ];
+  };
+
+  ##
+  ## END BOOTSTRAPPING
+  ##
+
+  ##
+  ## START COMMAND LINE TOOLS
+  ##
+  make = mkDerivation {
+    path = "contrib/bmake";
+    version = "9.2";
+    postPatch = ''
+      # make needs this to pick up our sys make files
+      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+    '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' "" \
+        --replace '-Wl,--warn-shared-textrel' ""
+    '';
+    postInstall = ''
+      make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
+    '';
+    extraPaths = [ "share/mk" ]
+      ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "tools/build/mk";
+  };
+  mtree = mkDerivation {
+    path = "contrib/mtree";
+    extraPaths = with self; [ mknod.path ];
+  };
+
+  mknod = mkDerivation {
+    path = "sbin/mknod";
+  };
+
+  rpcgen = mkDerivation rec {
+    path = "usr.bin/rpcgen";
+    patches = lib.optionals (stdenv.hostPlatform.libc == "glibc") [
+      # `WUNTRACED` is defined privately `bits/waitflags.h` in glibc.
+      # But instead of having a regular header guard, it has some silly
+      # non-modular logic. `stdlib.h` will include it if `sys/wait.h`
+      # hasn't yet been included (for it would first), and vice versa.
+      #
+      # The problem is that with the FreeBSD compat headers, one of
+      # those headers ends up included other headers...which ends up
+      # including the other one, this means by the first time we reach
+      # `#include `<bits/waitflags.h>`, both `_SYS_WAIT_H` and
+      # `_STDLIB_H` are already defined! Thus, we never ned up including
+      # `<bits/waitflags.h>` and defining `WUNTRACED`.
+      #
+      # This hacks around this by manually including `WUNTRACED` until
+      # the problem is fixed properly in glibc.
+      ./rpcgen-glibc-hack.patch
+    ];
+  };
+
+  gencat = mkDerivation {
+    path = "usr.bin/gencat";
+  };
+
+  file2c = mkDerivation {
+    path = "usr.bin/file2c";
+    MK_TESTS = "no";
+  };
+
+  libnv = mkDerivation {
+    path = "lib/libnv";
+    extraPaths = [
+      "sys/contrib/libnv"
+      "sys/sys"
+    ];
+    MK_TESTS = "no";
+  };
+
+  libsbuf = mkDerivation {
+    path = "lib/libsbuf";
+    extraPaths = [
+      "sys/kern"
+    ];
+    MK_TESTS = "no";
+  };
+
+  libelf = mkDerivation {
+    path = "lib/libelf";
+    extraPaths = [
+      "contrib/elftoolchain/libelf"
+      "contrib/elftoolchain/common"
+      "sys/sys/elf32.h"
+      "sys/sys/elf64.h"
+      "sys/sys/elf_common.h"
+    ];
+    BOOTSTRAPPING = !stdenv.isFreeBSD;
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+
+      m4
+    ];
+    MK_TESTS = "no";
+  };
+
+  libdwarf = mkDerivation {
+    path = "lib/libdwarf";
+    extraPaths = [
+      "contrib/elftoolchain/libdwarf"
+      "contrib/elftoolchain/common"
+      "sys/sys/elf32.h"
+      "sys/sys/elf64.h"
+      "sys/sys/elf_common.h"
+    ];
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+
+      m4
+    ];
+    buildInputs = with self; compatIfNeeded ++ [
+      libelf
+    ];
+    MK_TESTS = "no";
+  };
+
+  uudecode = mkDerivation {
+    path = "usr.bin/uudecode";
+    MK_TESTS = "no";
+  };
+
+  config = mkDerivation {
+    path = "usr.sbin/config";
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+
+      flex byacc file2c
+    ];
+    buildInputs = with self; compatIfNeeded ++ [ libnv libsbuf ];
+  };
+  ##
+  ## END COMMAND LINE TOOLS
+  ##
+
+  ##
+  ## START HEADERS
+  ##
+  include = mkDerivation {
+    path = "include";
+
+    extraPaths = [
+      "contrib/libc-vis"
+      "etc/mtree/BSD.include.dist"
+      "sys"
+    ];
+
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal
+      install
+      mandoc groff rsync /*nbperf*/ rpcgen
+
+      # HACK use NetBSD's for now
+      buildPackages.netbsd.mtree
+    ];
+
+    patches = [
+      ./no-perms-BSD.include.dist.patch
+    ];
+
+    # The makefiles define INCSDIR per subdirectory, so we have to set
+    # something else on the command line so those definitions aren't
+    # overridden.
+    postPatch = ''
+      find "$BSDSRCDIR" -name Makefile -exec \
+        sed -i -E \
+          -e 's_/usr/include_''${INCSDIR0}_' \
+          {} \;
+    '';
+
+    makeFlags = [
+      "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp"
+    ];
+
+    # multiple header dirs, see above
+    postConfigure = ''
+      makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
+    '';
+
+    headersOnly = true;
+
+    MK_HESIOD = "yes";
+
+    meta.platforms = lib.platforms.freebsd;
+  };
+
+  ##
+  ## END HEADERS
+  ##
+
+  csu = mkDerivation {
+    path = "lib/csu";
+    extraPaths = with self; [
+      "lib/Makefile.inc"
+      "lib/libc/include/libc_private.h"
+    ];
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal
+      install
+
+      flex byacc gencat
+    ];
+    buildInputs = with self; [ include ];
+    MK_TESTS = "no";
+    meta.platforms = lib.platforms.freebsd;
+  };
+
+  libc = mkDerivation rec {
+    pname = "libc";
+    path = "lib/libc";
+    extraPaths = [
+      "etc/group"
+      "etc/master.passwd"
+      "etc/shells"
+      "lib/libmd"
+      "lib/libutil"
+      "lib/msun"
+      "sys/kern"
+      "sys/libkern"
+      "sys/sys"
+      "sys/crypto/chacha20"
+      "include/rpcsvc"
+      "contrib/jemalloc"
+      "contrib/gdtoa"
+      "contrib/libc-pwcache"
+      "contrib/libc-vis"
+      "contrib/tzcode/stdtime"
+
+      # libthr
+      "lib/libthr"
+      "lib/libthread_db"
+      "libexec/rtld-elf"
+
+      # librpcsvc
+      "lib/librpcsvc"
+
+      # librt
+      "lib/librt"
+
+      # libcrypt
+      "lib/libcrypt"
+      "lib/libmd"
+      "sys/crypto/sha2"
+    ];
+
+    patches = [
+      # Hack around broken propogating MAKEFLAGS to submake, just inline logic
+      ./libc-msun-arch-subdir.patch
+
+      # Don't force -lcompiler-rt, we don't actually call it that
+      ./libc-no-force--lcompiler-rt.patch
+
+      # Fix extra include dir to get rpcsvc headers.
+      ./librpcsvc-include-subdir.patch
+    ];
+
+    postPatch = ''
+      substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
+    '';
+
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal
+      install
+
+      flex byacc gencat rpcgen
+    ];
+    buildInputs = with self; [ include csu ];
+    env.NIX_CFLAGS_COMPILE = "-B${self.csu}/lib";
+
+    makeFlags = [
+      "STRIP=-s" # flag to install, not command
+      # lib/libc/gen/getgrent.c has sketchy cast from `void *` to enum
+      "MK_WERROR=no"
+    ];
+
+    MK_SYMVER = "yes";
+    MK_SSP = "yes";
+    MK_NLS = "yes";
+    MK_ICONV = "no"; # TODO make srctop
+    MK_NS_CACHING = "yes";
+    MK_INET6_SUPPORT = "yes";
+    MK_HESIOD = "yes";
+    MK_NIS = "yes";
+    MK_HYPERV = "yes";
+    MK_FP_LIBC = "yes";
+
+    MK_TCSH = "no";
+    MK_MALLOC_PRODUCTION = "yes";
+
+    MK_TESTS = "no";
+
+    postInstall = ''
+      pushd ${self.include}
+      find . -type d -exec mkdir -p $out/\{} \;
+      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+      popd
+
+      pushd ${self.csu}
+      find . -type d -exec mkdir -p $out/\{} \;
+      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+      popd
+
+      sed -i -e 's| [^ ]*/libc_nonshared.a||' $out/lib/libc.so
+
+      $CC -nodefaultlibs -lgcc -shared -o $out/lib/libgcc_s.so
+
+      NIX_CFLAGS_COMPILE+=" -B$out/lib"
+      NIX_CFLAGS_COMPILE+=" -I$out/include"
+      NIX_LDFLAGS+=" -L$out/lib"
+
+      make -C $BSDSRCDIR/lib/libthr $makeFlags
+      make -C $BSDSRCDIR/lib/libthr $makeFlags install
+
+      make -C $BSDSRCDIR/lib/msun $makeFlags
+      make -C $BSDSRCDIR/lib/msun $makeFlags install
+
+      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+
+      make -C $BSDSRCDIR/lib/libutil $makeFlags
+      make -C $BSDSRCDIR/lib/libutil $makeFlags install
+
+      make -C $BSDSRCDIR/lib/librt $makeFlags
+      make -C $BSDSRCDIR/lib/librt $makeFlags install
+
+      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
+      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+    '';
+
+    meta.platforms = lib.platforms.freebsd;
+  };
+
+  ##
+  ## Kernel
+  ##
+
+  libspl = mkDerivation {
+    path = "cddl/lib/libspl";
+    extraPaths = [
+      "sys/contrib/openzfs/lib/libspl"
+      "sys/contrib/openzfs/include"
+
+      "cddl/compat/opensolaris/include"
+      "sys/contrib/openzfs/module/icp/include"
+      "sys/modules/zfs"
+    ];
+    # nativeBuildInputs = with buildPackages.freebsd; [
+    #   bsdSetupHook freebsdSetupHook
+    #   makeMinimal install mandoc groff
+
+    #   flex byacc file2c
+    # ];
+    # buildInputs = with self; compatIfNeeded ++ [ libnv libsbuf ];
+    meta.license = lib.licenses.cddl;
+  };
+
+  ctfconvert = mkDerivation {
+    path = "cddl/usr.bin/ctfconvert";
+    extraPaths = [
+      "cddl/compat/opensolaris"
+      "cddl/contrib/opensolaris"
+      "sys/cddl/compat/opensolaris"
+      "sys/cddl/contrib/opensolaris"
+      "sys/contrib/openzfs"
+    ];
+    OPENSOLARIS_USR_DISTDIR = "$(SRCTOP)/cddl/contrib/opensolaris";
+    OPENSOLARIS_SYS_DISTDIR = "$(SRCTOP)/sys/cddl/contrib/opensolaris";
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+
+      # flex byacc file2c
+    ];
+    buildInputs = with self; compatIfNeeded ++ [
+      libelf libdwarf zlib libspl
+    ];
+    meta.license = lib.licenses.cddl;
+  };
+
+  xargs-j = substituteAll {
+    name = "xargs-j";
+    shell = runtimeShell;
+    src = ../xargs-j.sh;
+    dir = "bin";
+    isExecutable = true;
+  };
+
+  sys = mkDerivation (let
+    cfg = "MINIMAL";
+  in rec {
+    path = "sys";
+
+    nativeBuildInputs = with buildPackages.freebsd; [
+      bsdSetupHook freebsdSetupHook
+      makeMinimal install mandoc groff
+
+      config rpcgen file2c gawk uudecode xargs-j
+      #ctfconvert
+    ];
+
+    patches = [
+      ./sys-gnu-date.patch
+      ./sys-no-explicit-intrinsics-dep.patch
+    ];
+
+    # --dynamic-linker /red/herring is used when building the kernel.
+    NIX_ENFORCE_PURITY = 0;
+
+    AWK = "${buildPackages.gawk}/bin/awk";
+
+    CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
+
+    MK_CTF = "no";
+
+    KODIR = "${builtins.placeholder "out"}/kernel";
+    KMODDIR = "${builtins.placeholder "out"}/kernel";
+    DTBDIR = "${builtins.placeholder"out"}/dbt";
+
+    KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
+    KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
+    KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+
+    skipIncludesPhase = true;
+
+    configurePhase = ''
+      runHook preConfigure
+
+      for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
+        substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
+      done
+
+      for f in conf/*.mk; do
+        substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
+      done
+
+      cd ${mkBsdArch stdenv}/conf
+      sed -i ${cfg} \
+        -e 's/WITH_CTF=1/WITH_CTF=0/' \
+        -e '/KDTRACE/d'
+      config ${cfg}
+
+      runHook postConfigure
+    '';
+    preBuild = ''
+      cd ../compile/${cfg}
+    '';
+  });
+
+})
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
new file mode 100644
index 000000000000..3c3dcb6d5d67
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -0,0 +1,64 @@
+{ lib, stdenv, linuxHeaders, freebsd, runCommandCC, buildPackages }:
+
+stdenv.mkDerivation {
+  pname = "evdev-proto";
+  inherit (linuxHeaders) version;
+
+  src = freebsd.ports;
+
+  sourceRoot = "source/devel/evdev-proto";
+
+  useTempPrefix = true;
+
+  nativeBuildInputs = [ freebsd.makeMinimal ];
+
+  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+  OPSYS = "FreeBSD";
+  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+
+  AWK = "awk";
+  CHMOD = "chmod";
+  FIND = "find";
+  MKDIR = "mkdir -p";
+  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+  RM = "rm -f";
+  SED = "${buildPackages.freebsd.sed}/bin/sed";
+  SETENV = "env";
+  SH = "sh";
+  TOUCH = "touch";
+  XARGS = "xargs";
+
+  ABI_FILE = runCommandCC "abifile" {} "$CC -shared -o $out";
+  CLEAN_FETCH_ENV = true;
+  INSTALL_AS_USER = true;
+  NO_CHECKSUM = true;
+  NO_MTREE = true;
+  SRC_BASE = freebsd.freebsdSrc;
+
+  preUnpack = ''
+    export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
+
+    export DISTDIR="$PWD/distfiles"
+    export PKG_DBDIR="$PWD/pkg"
+    export PREFIX="$prefix"
+
+    mkdir -p "$DISTDIR/evdev-proto"
+    tar -C "$DISTDIR/evdev-proto" \
+        -xf ${linuxHeaders.src} \
+        --strip-components 4 \
+        linux-${linuxHeaders.version}/include/uapi/linux
+  '';
+
+  makeFlags = [ "DIST_SUBDIR=evdev-proto" ];
+
+  postInstall = ''
+    mv $prefix $out
+  '';
+
+  meta = with lib; {
+    description = "Input event device header files for FreeBSD";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.freebsd;
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch
new file mode 100644
index 000000000000..4a69e85a986a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch
@@ -0,0 +1,11 @@
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -194,7 +194,7 @@ SUBDIR.${MK_TESTS}+= tests
+ # recording a build dependency
+ CFLAGS+= -I${SRCTOP}/lib/libutil
+ # Same issue with libm
+-MSUN_ARCH_SUBDIR != ${MAKE} -B -C ${SRCTOP}/lib/msun -V ARCH_SUBDIR
++MSUN_ARCH_SUBDIR = ${MACHINE_CPUARCH:S/i386/i387/}
+ # unfortunately msun/src contains both private and public headers
+ CFLAGS+= -I${SRCTOP}/lib/msun/${MSUN_ARCH_SUBDIR}
+ .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64"
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch
new file mode 100644
index 000000000000..60176fb73cf7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch
@@ -0,0 +1,10 @@
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -58,7 +58,6 @@ CFLAGS+=${CANCELPOINTS_CFLAGS}
+ # Link with static libcompiler_rt.a.
+ #
+ LDFLAGS+= -nodefaultlibs
+-LIBADD+=	compiler_rt
+ 
+ .if ${MK_SSP} != "no" && \
+     (${LIBC_ARCH} == "i386" || ${MACHINE_ARCH:Mpower*} != "")
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch
new file mode 100644
index 000000000000..a7bd032d2be5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch
@@ -0,0 +1,32 @@
+diff --git a/Makefile b/Makefile
+index 22710f3d933..22effc848cf 100644
+--- a/lib/libnetbsd/Makefile
++++ b/lib/libnetbsd/Makefile
+@@ -9,6 +9,26 @@ CFLAGS+=	-I${.CURDIR}
+ 
+ SRCS+=	efun.c sockaddr_snprintf.c strsuftoll.c util.c util.h
+ 
+-INTERNALLIB=
++INCSGROUPS= INCS SYSINCS NETINETINCS
++
++INCS+= \
++	glob.h \
++	pthread.h \
++	rmd160.h \
++	sha1.h \
++	sha2.h \
++	stdlib.h \
++	util.h
++
++SYSINCSDIR= ${INCLUDEDIR}/sys
++SYSINCS+= \
++	sys/cdefs.h \
++	sys/event.h \
++	sys/types.h \
++	sys/wait.h
++
++NETINETINCSDIR= ${INCLUDEDIR}/netinet
++NETINETINCS+= \
++	netinet/in.h
+ 
+ .include <bsd.lib.mk>
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch
new file mode 100644
index 000000000000..38e06682869f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch
@@ -0,0 +1,11 @@
+--- a/lib/librpcsvc/Makefile
++++ b/lib/librpcsvc/Makefile
+@@ -20,7 +20,7 @@ OTHERSRCS+= yp_passwd.c yp_update.c
+ 
+ RPCCOM=	RPCGEN_CPP=${CPP:Q} rpcgen -C
+ 
+-INCDIRS= -I${SYSROOT:U${DESTDIR}}/usr/include/rpcsvc
++INCDIRS= -I${INCLUDEDIR}/rpcsvc
+ 
+ CFLAGS+= -DYP ${INCDIRS}
+ 
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch
new file mode 100644
index 000000000000..985617ee0f45
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch
@@ -0,0 +1,11 @@
+--- a/etc/mtree/BSD.include.dist
++++ b/etc/mtree/BSD.include.dist
+@@ -3,7 +3,7 @@
+ # Please see the file src/etc/mtree/README before making changes to this file.
+ #
+ 
+-/set type=dir uname=root gname=wheel mode=0755
++/set type=dir
+ .
+     arpa
+     ..
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch
new file mode 100644
index 000000000000..3dde1a010651
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch
@@ -0,0 +1,15 @@
+--- a/usr.bin/rpcgen/rpc_scan.c
++++ b/usr.bin/rpcgen/rpc_scan.c
+@@ -43,8 +43,12 @@ __FBSDID("$FreeBSD$");
+  */
+ 
+ #include <sys/types.h>
+ 
++// glibc + compat is broken from silly indirect header guard
++#define _SYS_WAIT_H
++# include <bits/waitflags.h>
++#undef _SYS_WAIT_H
+ #include <sys/wait.h>
+ #include <stdio.h>
+ #include <ctype.h>
+ #include <string.h>
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/setup-hook.sh b/nixpkgs/pkgs/os-specific/bsd/freebsd/setup-hook.sh
new file mode 100644
index 000000000000..929782954ba7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/setup-hook.sh
@@ -0,0 +1,12 @@
+setFreeBSDSrcTop() {
+  makeFlags="SRCTOP=$BSDSRCDIR $makeFlags"
+}
+
+addFreeBSDMakeFlags() {
+  makeFlags="SBINDIR=${!outputBin}/bin $makeFlags"
+  makeFlags="LIBEXECDIR=${!outputLib}/libexec $makeFlags"
+  makeFlags="INCLUDEDIR=${!outputDev}/include $makeFlags"
+}
+
+postUnpackHooks+=(setFreeBSDSrcTop)
+preConfigureHooks+=(addFreeBSDMakeFlags)
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch
new file mode 100644
index 000000000000..2356446baf85
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch
@@ -0,0 +1,13 @@
+diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
+index c594724d814..d5287c7b992 100644
+--- a/sys/conf/newvers.sh
++++ b/sys/conf/newvers.sh
+@@ -177,7 +177,7 @@ u=${USER:-root}
+ d=$(pwd)
+ h=${HOSTNAME:-$(hostname)}
+ if [ -n "$SOURCE_DATE_EPOCH" ]; then
+-	if ! t=$(date -r $SOURCE_DATE_EPOCH 2>/dev/null); then
++	if ! t=$(date -d @$SOURCE_DATE_EPOCH 2>/dev/null); then
+ 		echo "Invalid SOURCE_DATE_EPOCH" >&2
+ 		exit 1
+ 	fi
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch b/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch
new file mode 100644
index 000000000000..edf44de5bb0d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch
@@ -0,0 +1,45 @@
+diff --git a/sys/modules/aesni/Makefile b/sys/modules/aesni/Makefile
+index cb8c744adde..1c327331890 100644
+--- a/sys/modules/aesni/Makefile
++++ b/sys/modules/aesni/Makefile
+@@ -1,7 +1,6 @@
+ # $FreeBSD$
+ 
+ .PATH: ${SRCTOP}/sys/crypto/aesni
+-.PATH: ${SRCTOP}/contrib/llvm-project/clang/lib/Headers
+ 
+ KMOD=	aesni
+ SRCS=	aesni.c
+@@ -40,8 +39,8 @@ intel_sha256.o: intel_sha256.c
+ aesni_ghash.o: aesni.h
+ aesni_wrap.o: aesni.h
+ aesni_ccm.o: aesni.h
+-intel_sha1.o: sha_sse.h immintrin.h shaintrin.h tmmintrin.h xmmintrin.h
+-intel_sha256.o: sha_sse.h immintrin.h shaintrin.h tmmintrin.h xmmintrin.h
++intel_sha1.o: sha_sse.h
++intel_sha256.o: sha_sse.h
+ 
+ .include <bsd.kmod.mk>
+ 
+diff --git a/sys/modules/blake2/Makefile b/sys/modules/blake2/Makefile
+index e4b3fb9f126..5bfd9c2ae02 100644
+--- a/sys/modules/blake2/Makefile
++++ b/sys/modules/blake2/Makefile
+@@ -3,7 +3,6 @@
+ .PATH:	${SRCTOP}/sys/contrib/libb2
+ .PATH:	${SRCTOP}/sys/crypto/blake2
+ .PATH:	${SRCTOP}/sys/opencrypto
+-.PATH:	${SRCTOP}/contrib/llvm-project/clang/lib/Headers
+ 
+ KMOD	= blake2
+ 
+@@ -64,8 +63,7 @@ ${src:S/.c/.o/}: ${src}
+ 	    -D_MM_MALLOC_H_INCLUDED -Wno-unused-function ${.IMPSRC}
+ 	${CTFCONVERT_CMD}
+ 
+-${src:S/.c/.o/}: intrin.h emmintrin.h tmmintrin.h smmintrin.h immintrin.h \
+-    x86intrin.h ${SRCS:M*.h}
++${src:S/.c/.o/}: ${SRCS:M*.h}
+ .endfor
+ 
+ # FreeBSD-specific sources:
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch
index f67ca2e50791..2aaa90b76146 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch
@@ -1,6 +1,6 @@
 diff -u -r1.35.2.1 nbtool_config.h.in
---- a/nbtool_config.h.in	22 Apr 2015 07:18:58 -0000	1.35.2.1
-+++ b/nbtool_config.h.in	31 May 2018 01:46:53 -0000
+--- a/tools/compat/nbtool_config.h.in	22 Apr 2015 07:18:58 -0000	1.35.2.1
++++ b/tools/compat/nbtool_config.h.in	31 May 2018 01:46:53 -0000
 @@ -680,5 +680,14 @@
  /* Define if you have u_int8_t, but not uint8_t. */
  #undef uint8_t
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch
index 1a69e73e255f..2758e256a616 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch
@@ -6,8 +6,8 @@ Date:   Wed Sep 1 15:38:56 2021 +0000
 
 diff --git a/Makefile b/Makefile
 index b5adb8a5f2e9..1a914ef16739 100644
---- a/Makefile
-+++ b/Makefile
+--- a/tools/compat/Makefile
++++ b/tools/compat/Makefile
 @@ -76,11 +76,6 @@ _CURDIR:=	${.CURDIR}
  
  SRCS:=		${SRCS:M*.c}
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch
index cd442d95f412..117fb7e04298 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch
@@ -8,8 +8,8 @@ Date:   Wed Sep 1 15:38:56 2021 +0000
 
 diff --git a/Makefile b/Makefile
 index 4bcf227f0e75..9ed1d6eea6ff 100644
---- a/Makefile
-+++ b/Makefile
+--- a/tools/compat/Makefile
++++ b/tools/compat/Makefile
 @@ -1,6 +1,6 @@
  #	$NetBSD: Makefile,v 1.87 2019/05/08 02:25:50 thorpej Exp $
  
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
index 25ac9ce451cc..6bf884d38284 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,9 +1,9 @@
 { stdenv, lib, stdenvNoCC
-, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget, pkgsHostHost, pkgsTargetTarget
-, buildPackages, splicePackages, newScope
+, makeScopeWithSplicing, generateSplicesForMkScope
+, buildPackages
 , bsdSetupHook, makeSetupHook, fetchcvs, groff, mandoc, byacc, flex
 , zlib
-, writeText, symlinkJoin
+, writeShellScript, writeText, runtimeShell, symlinkJoin
 }:
 
 let
@@ -20,24 +20,14 @@ let
     name = "netbsd-setup-hook";
   } ./setup-hook.sh;
 
-  otherSplices = {
-    selfBuildBuild = pkgsBuildBuild.netbsd;
-    selfBuildHost = pkgsBuildHost.netbsd;
-    selfBuildTarget = pkgsBuildTarget.netbsd;
-    selfHostHost = pkgsHostHost.netbsd;
-    selfTargetTarget = pkgsTargetTarget.netbsd or {}; # might be missing
-  };
-
   defaultMakeFlags = [
     "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
       then "yes"
       else "no"}"
   ];
 
-in lib.makeScopeWithSplicing
-  splicePackages
-  newScope
-  otherSplices
+in makeScopeWithSplicing
+  (generateSplicesForMkScope "netbsd")
   (_: {})
   (_: {})
   (self: let
@@ -46,7 +36,7 @@ in lib.makeScopeWithSplicing
 
   # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
   #
-  # We use `lib.makeScopeWithSplicing` because this should be used for all
+  # We use `makeScopeWithSplicing` because this should be used for all
   # nested package sets which support cross, so the inner `callPackage` works
   # correctly. But for the inline packages we don't bother to use
   # `callPackage`.
@@ -64,7 +54,8 @@ in lib.makeScopeWithSplicing
   mkDerivation = lib.makeOverridable (attrs: let
     stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
   in stdenv'.mkDerivation ({
-    name = "${attrs.pname or (baseNameOf attrs.path)}-netbsd-${attrs.version}";
+    pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
+    inherit (attrs) version;
     src = fetchNetBSD attrs.path attrs.version attrs.sha256;
 
     extraPaths = [ ];
@@ -94,7 +85,7 @@ in lib.makeScopeWithSplicing
     }.${stdenv'.hostPlatform.parsed.cpu.name}
       or stdenv'.hostPlatform.parsed.cpu.name;
 
-    BSD_PATH = attrs.path;
+    COMPONENT_PATH = attrs.path;
 
     makeFlags = defaultMakeFlags;
 
@@ -121,12 +112,12 @@ in lib.makeScopeWithSplicing
     installPhase = "includesPhase";
     dontBuild = true;
   } // attrs // {
+    # Files that use NetBSD-specific macros need to have nbtool_config.h
+    # included ahead of them on non-NetBSD platforms.
     postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
-      # Files that use NetBSD-specific macros need to have nbtool_config.h
-      # included ahead of them on non-NetBSD platforms.
       set +e
       grep -Zlr "^__RCSID
-      ^__BEGIN_DECLS" | xargs -0r grep -FLZ nbtool_config.h |
+      ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
           xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
       set -e
     '' + attrs.postPatch or "";
@@ -146,7 +137,7 @@ in lib.makeScopeWithSplicing
     skipIncludesPhase = true;
 
     postPatch = ''
-      patchShebangs configure
+      patchShebangs $COMPONENT_PATH/configure
       ${self.make.postPatch}
     '';
 
@@ -281,11 +272,11 @@ in lib.makeScopeWithSplicing
 
   # HACK: to ensure parent directories exist. This emulates GNU
   # install’s -D option. No alternative seems to exist in BSD install.
-  install = let binstall = writeText "binstall" ''
-    #!${stdenv.shell}
-    for last in $@; do true; done
+  install = let binstall = writeShellScript "binstall" ''
+    set -eu
+    for last in "$@"; do true; done
     mkdir -p $(dirname $last)
-    xinstall "$@"
+    @out@/bin/xinstall "$@"
   ''; in mkDerivation {
     path = "usr.bin/xinstall";
     version = "9.2";
@@ -297,13 +288,18 @@ in lib.makeScopeWithSplicing
       mandoc groff rsync
     ];
     skipIncludesPhase = true;
-    buildInputs = with self; compatIfNeeded ++ [ fts ];
+    buildInputs = with self; compatIfNeeded
+      # fts header is needed. glibc already has this header, but musl doesn't,
+      # so make sure pkgsMusl.netbsd.install still builds in case you want to
+      # remove it!
+      ++ [ fts ];
     installPhase = ''
       runHook preInstall
 
       install -D install.1 $out/share/man/man1/install.1
       install -D xinstall $out/bin/xinstall
       install -D -m 0550 ${binstall} $out/bin/binstall
+      substituteInPlace $out/bin/binstall --subst-var out
       ln -s $out/bin/binstall $out/bin/install
 
       runHook postInstall
@@ -391,6 +387,7 @@ in lib.makeScopeWithSplicing
       install mandoc groff rsync
     ];
   };
+
   ##
   ## END BOOTSTRAPPING
   ##
@@ -488,7 +485,7 @@ in lib.makeScopeWithSplicing
     version = "9.2";
     sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
     patches = [ ./locale.patch ];
-    NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
+    env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
   };
 
   rpcgen = mkDerivation {
@@ -538,7 +535,8 @@ in lib.makeScopeWithSplicing
     path = "usr.bin/uudecode";
     version = "9.2";
     sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
-    NIX_CFLAGS_COMPILE = lib.optional stdenv.isLinux "-DNO_BASE64";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
+    NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
   };
 
   cksum = mkDerivation {
@@ -552,7 +550,7 @@ in lib.makeScopeWithSplicing
     path = "usr.bin/config";
     version = "9.2";
     sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
-    NIX_CFLAGS_COMPILE = [ "-DMAKE_BOOTSTRAP" ];
+    env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook netbsdSetupHook
       makeMinimal install mandoc byacc flex rsync
@@ -638,7 +636,7 @@ in lib.makeScopeWithSplicing
     makeFlags = defaultMakeFlags ++ [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
     hardeningDisable = [ "pic" ];
     MKKMOD = "no";
-    NIX_CFLAGS_COMPILE = [ "-Wa,--no-warn" ];
+    env.NIX_CFLAGS_COMPILE = toString [ "-Wa,--no-warn" ];
 
     postBuild = ''
       make -C arch/$MACHINE/compile/$CONFIG $makeFlags
@@ -682,6 +680,13 @@ in lib.makeScopeWithSplicing
   ##
   ## START LIBRARIES
   ##
+  libarch = mkDerivation {
+    path = "lib/libarch";
+    version = "9.2";
+    sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
+    meta.platforms = lib.platforms.netbsd;
+  };
+
   libutil = mkDerivation {
     path = "lib/libutil";
     version = "9.2";
@@ -705,12 +710,12 @@ in lib.makeScopeWithSplicing
     SHLIBINSTALLDIR = "$(out)/lib";
     makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
     postPatch = ''
-      sed -i '1i #undef bool_t' el.h
-      substituteInPlace config.h \
+      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
+      substituteInPlace $COMPONENT_PATH/config.h \
         --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
-      substituteInPlace readline/Makefile --replace /usr/include "$out/include"
+      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
     '';
-    NIX_CFLAGS_COMPILE = [
+    env.NIX_CFLAGS_COMPILE = toString [
       "-D__noinline="
       "-D__scanflike(a,b)="
       "-D__va_list=va_list"
@@ -728,8 +733,8 @@ in lib.makeScopeWithSplicing
     buildInputs = with self; compatIfNeeded;
     SHLIBINSTALLDIR = "$(out)/lib";
     postPatch = ''
-      substituteInPlace term.c --replace /usr/share $out/share
-      substituteInPlace setupterm.c \
+      substituteInPlace $COMPONENT_PATH/term.c --replace /usr/share $out/share
+      substituteInPlace $COMPONENT_PATH/setupterm.c \
         --replace '#include <curses.h>' 'void use_env(bool);'
     '';
     postBuild = ''
@@ -748,7 +753,7 @@ in lib.makeScopeWithSplicing
     version = "9.2";
     sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
     buildInputs = with self; [ libterminfo ];
-    NIX_CFLAGS_COMPILE = [
+    env.NIX_CFLAGS_COMPILE = toString [
       "-D__scanflike(a,b)="
       "-D__va_list=va_list"
       "-D__warn_references(a,b)="
@@ -757,10 +762,10 @@ in lib.makeScopeWithSplicing
     MKDOC = "no"; # missing vfontedpr
     makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
     postPatch = lib.optionalString (!stdenv.isDarwin) ''
-      substituteInPlace printw.c \
+      substituteInPlace $COMPONENT_PATH/printw.c \
         --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
         --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
-      substituteInPlace scanw.c \
+      substituteInPlace $COMPONENT_PATH/scanw.c \
         --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
     '';
   };
@@ -811,6 +816,16 @@ in lib.makeScopeWithSplicing
     meta.platforms = lib.platforms.netbsd;
   };
 
+  libpci = mkDerivation {
+    pname = "libpci";
+    path = "lib/libpci";
+    version = "9.2";
+    sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
+    env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
+    meta.platforms = lib.platforms.netbsd;
+    extraPaths = with self; [ sys.src ];
+  };
+
   libpthread-headers = mkDerivation {
     pname = "libpthread-headers";
     path = "lib/libpthread";
@@ -907,7 +922,7 @@ in lib.makeScopeWithSplicing
       byacc genassym gencat lorder tsort statHook rsync rpcgen
     ];
     buildInputs = with self; [ headers csu ];
-    NIX_CFLAGS_COMPILE = "-B${self.csu}/lib";
+    env.NIX_CFLAGS_COMPILE = "-B${self.csu}/lib -fcommon";
     meta.platforms = lib.platforms.netbsd;
     SHLIBINSTALLDIR = "$(out)/lib";
     MKPICINSTALL = "yes";
@@ -985,7 +1000,7 @@ in lib.makeScopeWithSplicing
     # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
     # so we can avoid the dependency on ghostscript
     postPatch = ''
-      substituteInPlace man0/Makefile --replace "ps2pdf" "echo noop "
+      substituteInPlace $COMPONENT_PATH/man0/Makefile --replace "ps2pdf" "echo noop "
     '';
     makeFlags = defaultMakeFlags ++ [
       "FILESDIR=$(out)/share"
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/getent.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/getent.patch
index e9e34d19a315..18258b648618 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/getent.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/getent.patch
@@ -1,8 +1,8 @@
 Author: Matthew Bauer
 Description: Remove unavailable getent databases
 Version: 7.1.2
---- a/getent.c	2018-04-16 13:33:49.000000000 -0500
-+++ b/getent.c	2018-04-16 13:29:30.000000000 -0500
+--- a/usr.bin/getent/getent.c	2018-04-16 13:33:49.000000000 -0500
++++ b/usr.bin/getent/getent.c	2018-04-16 13:29:30.000000000 -0500
 @@ -42,7 +42,6 @@
  #include <grp.h>
  #include <limits.h>
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/locale.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/locale.patch
index 1df9eb385625..4b7f47855287 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/locale.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/locale.patch
@@ -1,5 +1,5 @@
---- a/locale.c	2018-06-11 14:39:06.449762000 -0400
-+++ b/locale.c	2018-06-11 14:42:28.461122899 -0400
+--- a/usr.bin/locale/locale.c	2018-06-11 14:39:06.449762000 -0400
++++ b/usr.bin/locale/locale.c	2018-06-11 14:42:28.461122899 -0400
 @@ -56,14 +56,8 @@
  #include <stringlist.h>
  #include <unistd.h>
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
index 5a2b9092a5c5..b3e9f3c88a13 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
@@ -4,8 +4,8 @@ rcsdiff: /ftp/cvs/cvsroot/src/sys/arch/i386/stand/efiboot/Makefile.efiboot,v: wa
 retrieving revision 1.16
 retrieving revision 1.17
 diff -u -p -r1.16 -r1.17
---- sys/arch/i386/stand/efiboot/Makefile.efiboot	2019/09/13 02:19:45	1.16
-+++ sys/arch/i386/stand/efiboot/Makefile.efiboot	2020/04/04 15:30:46	1.17
+--- a/sys/arch/i386/stand/efiboot/Makefile.efiboot	2019/09/13 02:19:45	1.16
++++ b/sys/arch/i386/stand/efiboot/Makefile.efiboot	2020/04/04 15:30:46	1.17
 @@ -41,6 +41,7 @@ BINMODE=444
  .PATH:	${.CURDIR}/../../libsa
  
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch b/nixpkgs/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch
index ed85f8ea5b0c..5cfb2a54c8db 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch
@@ -1,7 +1,7 @@
 diff --git a/Makefile b/Makefile
 index 3f1e18dc659d..163362b82f94 100644
---- a/Makefile
-+++ b/Makefile
+--- a/sys/Makefile
++++ b/sys/Makefile
 @@ -2,6 +2,8 @@
  
  .include <bsd.own.mk>
diff --git a/nixpkgs/pkgs/os-specific/bsd/setup-hook.sh b/nixpkgs/pkgs/os-specific/bsd/setup-hook.sh
index 4bdfde68b62e..e0afefcd73f7 100644
--- a/nixpkgs/pkgs/os-specific/bsd/setup-hook.sh
+++ b/nixpkgs/pkgs/os-specific/bsd/setup-hook.sh
@@ -48,6 +48,7 @@ addMakeFlags() {
   makeFlags="BINDIR=${!outputBin}/bin $makeFlags"
   makeFlags="LIBDIR=${!outputLib}/lib $makeFlags"
   makeFlags="SHLIBDIR=${!outputLib}/lib $makeFlags"
+  makeFlags="SHAREDIR=${!outputLib}/share $makeFlags"
   makeFlags="MANDIR=${!outputMan}/share/man $makeFlags"
   makeFlags="INFODIR=${!outputInfo}/share/info $makeFlags"
   makeFlags="DOCDIR=${!outputDoc}/share/doc $makeFlags"
@@ -61,10 +62,13 @@ setBSDSourceDir() {
   sourceRoot=$PWD/$sourceRoot
   export BSDSRCDIR=$sourceRoot
   export _SRC_TOP_=$BSDSRCDIR
-
   cd $sourceRoot
-  if [ -d "$BSD_PATH" ]
-    then sourceRoot=$sourceRoot/$BSD_PATH
+}
+
+cdBSDPath() {
+  if [ -d "$COMPONENT_PATH" ]
+    then sourceRoot=$sourceRoot/$COMPONENT_PATH
+    cd $COMPONENT_PATH
   fi
 }
 
@@ -104,6 +108,7 @@ moveUsrDir() {
 }
 
 postUnpackHooks+=(setBSDSourceDir)
+postPatchHooks+=(cdBSDPath)
 preConfigureHooks+=(addMakeFlags)
 preInstallHooks+=(includesPhase)
 fixupOutputHooks+=(moveUsrDir)
diff --git a/nixpkgs/pkgs/os-specific/bsd/xargs-j.sh b/nixpkgs/pkgs/os-specific/bsd/xargs-j.sh
new file mode 100644
index 000000000000..3dd27c2cd2cd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/bsd/xargs-j.sh
@@ -0,0 +1,17 @@
+#! @shell@
+
+declare -a args=()
+
+token=$1
+shift
+
+while (( $# )); do
+    if [[ "$1" = "$token" ]]; then
+        mapfile -t -O $(("${#args[@]}" + 1)) args
+    else
+        args+=("$1")
+    fi
+    shift
+done
+
+exec "${args[@]}"
diff --git a/nixpkgs/pkgs/os-specific/darwin/DarwinTools/default.nix b/nixpkgs/pkgs/os-specific/darwin/DarwinTools/default.nix
index f648435eed27..72a375028453 100644
--- a/nixpkgs/pkgs/os-specific/darwin/DarwinTools/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/DarwinTools/default.nix
@@ -5,8 +5,8 @@ stdenv.mkDerivation rec {
   version = "1";
 
   src = fetchurl {
-    url = "https://opensource.apple.com/tarballs/DarwinTools/DarwinTools-${version}.tar.gz";
-    sha256 = "0hh4jl590jv3v830p77r3jcrnpndy7p2b8ajai3ldpnx2913jfhp";
+    url = "https://web.archive.org/web/20180408044816/https://opensource.apple.com/tarballs/DarwinTools/DarwinTools-${version}.tar.gz";
+    hash = "sha256-Fzo5QhLd3kZHVFKhJe7xzV6bmRz5nAsG2mNLkAqVBEI=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 05340642f8d0..ca23af43229c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -45,12 +45,20 @@ let
 
         cp -r ${MacOSX-SDK}${standardFrameworkPath name private} $out/Library/Frameworks
 
+        if [[ -d ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule ]]; then
+          mkdir -p $out/lib/swift
+          cp -r -t $out/lib/swift \
+            ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule \
+            ${MacOSX-SDK}/usr/lib/swift/libswift${name}.tbd
+        fi
+
         # Fix and check tbd re-export references
         chmod u+w -R $out
         find $out -name '*.tbd' -type f | while read tbd; do
           echo "Fixing re-exports in $tbd"
           rewrite-tbd \
             -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+            -p /usr/lib/swift/:$out/lib/swift/ \
             ${mkDepsRewrites deps} \
             -r ${builtins.storeDir} \
             "$tbd"
@@ -152,30 +160,109 @@ in rec {
     };
   };
 
-  overrides = super: {
-    CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
-      setupHook = ./cf-setup-hook.sh;
-    });
+  frameworks = let
+    # Dependency map created by gen-frameworks.py.
+    generatedDeps = import ./frameworks.nix {
+      inherit frameworks libs;
+    };
 
-    # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
-    # there are references to it in nixpkgs.
-    QuickTime = throw "QuickTime framework not available";
+    # Additional dependencies that are not picked up by gen-frameworks.py.
+    # Some of these are simply private frameworks the generator does not see.
+    extraDeps = with libs; with frameworks; let
+      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
+      libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
+    in {
+      # Below this comment are entries migrated from before the generator was
+      # added. If, for a given framework, you are able to reverify the extra
+      # deps are really necessary on top of the generator deps, move it above
+      # this comment (and maybe document your findings).
+      AVFoundation            = { inherit ApplicationServices AVFCapture AVFCore; };
+      Accelerate              = { inherit CoreWLAN IOBluetooth; };
+      AddressBook             = { inherit AddressBookCore ContactsPersistence libobjc; };
+      AppKit                  = { inherit AudioToolbox AudioUnit UIFoundation; };
+      AudioToolbox            = { inherit AudioToolboxCore; };
+      AudioUnit               = { inherit Carbon CoreAudio; };
+      Carbon                  = { inherit IOKit QuartzCore libobjc; };
+      CoreAudio               = { inherit IOKit; };
+      CoreFoundation          = { inherit libobjc; };
+      CoreGraphics            = { inherit SystemConfiguration; };
+      CoreMIDIServer          = { inherit CoreMIDI; };
+      CoreMedia               = { inherit ApplicationServices AudioToolbox AudioUnit; };
+      CoreServices            = { inherit CoreAudio NetFS ServiceManagement; };
+      CoreWLAN                = { inherit SecurityFoundation; };
+      DiscRecording           = { inherit IOKit libobjc; };
+      Foundation              = { inherit SystemConfiguration libobjc; };
+      GameKit                 = { inherit GameCenterFoundation GameCenterUI GameCenterUICore ReplayKit; };
+      ICADevices              = { inherit Carbon libobjc; };
+      IOBluetooth             = { inherit CoreBluetooth; };
+      JavaScriptCore          = { inherit libobjc; };
+      Kernel                  = { inherit IOKit; };
+      LinkPresentation        = { inherit URLFormatting; };
+      MediaToolbox            = { inherit AudioUnit; };
+      MetricKit               = { inherit SignpostMetrics; };
+      Network                 = { inherit libnetwork; };
+      PCSC                    = { inherit CoreData; };
+      PassKit                 = { inherit PassKitCore; };
+      QTKit                   = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
+      Quartz                  = { inherit QTKit; };
+      QuartzCore              = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
+      Security                = { inherit IOKit libDER; };
+      TWAIN                   = { inherit Carbon; };
+      VideoDecodeAcceleration = { inherit CoreVideo; };
+      WebKit                  = { inherit ApplicationServices Carbon libobjc; };
+    };
 
-    # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
-    JavaVM = super.JavaNativeFoundation;
-  };
+    # Overrides for framework derivations.
+    overrides = super: {
+      CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
+        setupHook = ./cf-setup-hook.sh;
+      });
+
+      # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
+      # there are references to it in nixpkgs.
+      QuickTime = throw "QuickTime framework not available";
+
+      # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
+      JavaVM = super.JavaNativeFoundation;
+
+      CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
+        installPhase = drv.installPhase + ''
+          # When used as a module, complains about a missing import for
+          # Darwin.C.stdint. Apparently fixed in later SDKs.
+          awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
+            $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
+        '';
+      });
+
+      System = lib.overrideDerivation super.System (drv: {
+        installPhase = drv.installPhase + ''
+          # Contrarily to the other frameworks, System framework's TBD file
+          # is a symlink pointing to ${MacOSX-SDK}/usr/lib/libSystem.B.tbd.
+          # This produces an error when installing the framework as:
+          #   1. The original file is not copied into the output directory
+          #   2. Even if it was copied, the relative path wouldn't match
+          # Thus, it is easier to replace the file than to fix the symlink.
+          cp --remove-destination ${MacOSX-SDK}/usr/lib/libSystem.B.tbd \
+            $out/Library/Frameworks/System.framework/Versions/B/System.tbd
+        '';
+      });
+    };
 
-  bareFrameworks = (
-    lib.mapAttrs framework (import ./frameworks.nix {
-      inherit frameworks libs;
-      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork Libsystem;
-      libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
-    })
-  ) // (
-    lib.mapAttrs privateFramework (import ./private-frameworks.nix {
-      inherit frameworks;
-    })
-  );
-
-  frameworks = bareFrameworks // overrides bareFrameworks;
+    # Merge extraDeps into generatedDeps.
+    deps = generatedDeps // (
+      lib.mapAttrs
+        (name: deps: generatedDeps.${name} // deps)
+        extraDeps
+    );
+
+    # Create derivations, and add private frameworks.
+    bareFrameworks = (lib.mapAttrs framework deps) // (
+      lib.mapAttrs privateFramework (import ./private-frameworks.nix {
+        inherit frameworks;
+        libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
+      })
+    );
+  in
+    # Apply derivation overrides.
+    bareFrameworks // overrides bareFrameworks;
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index b29a36177a82..741c1a82f347 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -3,16 +3,7 @@
 , xar, cpio, python3, pbzx }:
 
 let
-  MacOSX-SDK = stdenvNoCC.mkDerivation rec {
-    pname = "MacOSX-SDK";
-    version = "11.0.0";
-
-    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
-    src = fetchurl {
-      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
-      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
-    };
-
+  mkSusDerivation = args: stdenvNoCC.mkDerivation (args // {
     dontBuild = true;
     darwinDontCodeSign = true;
 
@@ -24,66 +15,127 @@ let
       pbzx $src | cpio -idm
     '';
 
-    installPhase = ''
-      cd Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk
+    passthru = {
+      inherit (args) version;
+    };
+  });
 
-      mkdir $out
-      cp -r System usr $out/
+  MacOSX-SDK = mkSusDerivation {
+    pname = "MacOSX-SDK";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
+      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
+    };
+
+    installPhase = ''
+      mv Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk $out
     '';
+  };
 
-    passthru = {
-      inherit version;
+  CLTools_Executables = mkSusDerivation {
+    pname = "CLTools_Executables";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_Executables.pkg";
+      sha256 = "0nvb1qx7l81l2wcl8wvgbpsg5rcn51ylhivqmlfr2hrrv3zrrpl0";
     };
+
+    installPhase = ''
+      mv Library/Developer/CommandLineTools $out
+    '';
   };
 
+  mkCc = cc:
+    if stdenv.isAarch64 then cc
+    else
+      cc.override {
+        bintools = stdenv.cc.bintools.override { libc = packages.Libsystem; };
+        libc = packages.Libsystem;
+      };
+
+  mkStdenv = stdenv:
+    if stdenv.isAarch64 then stdenv
+    else
+      (overrideCC stdenv (mkCc stdenv.cc)).override {
+        targetPlatform = stdenv.targetPlatform // {
+          darwinMinVersion = "10.12";
+          darwinSdkVersion = "11.0";
+        };
+      };
+
+  stdenvs = {
+    stdenv = mkStdenv stdenv;
+  } // builtins.listToAttrs (map
+    (v: {
+      name = "llvmPackages_${v}";
+      value = pkgs."llvmPackages_${v}" // {
+        stdenv = mkStdenv pkgs."llvmPackages_${v}".stdenv;
+      };
+    })
+    [ "12" "13" "14" "15" "16" ]
+  );
+
   callPackage = newScope (packages // pkgs.darwin // { inherit MacOSX-SDK; });
 
-  packages = {
-    inherit (callPackage ./apple_sdk.nix {}) frameworks libs;
+  packages = stdenvs // {
+    inherit (callPackage ./apple_sdk.nix { }) frameworks libs;
 
     # TODO: this is nice to be private. is it worth the callPackage above?
     # Probably, I don't think that callPackage costs much at all.
-    inherit MacOSX-SDK;
+    inherit MacOSX-SDK CLTools_Executables;
 
-    Libsystem = callPackage ./libSystem.nix {};
+    Libsystem = callPackage ./libSystem.nix { };
     LibsystemCross = pkgs.darwin.Libsystem;
-    libcharset = callPackage ./libcharset.nix {};
-    libunwind = callPackage ./libunwind.nix {};
-    libnetwork = callPackage ./libnetwork.nix {};
-    objc4 = callPackage ./libobjc.nix {};
+    libcharset = callPackage ./libcharset.nix { };
+    libunwind = callPackage ./libunwind.nix { };
+    libnetwork = callPackage ./libnetwork.nix { };
+    libpm = callPackage ./libpm.nix { };
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = stdenv.objc4 or (callPackage ./libobjc.nix { });
 
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
-    IOKit = pkgs.darwin.apple_sdk.frameworks.IOKit;
+    inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
+
+    xcodebuild = pkgs.xcbuild.override {
+      inherit (pkgs.darwin.apple_sdk_11_0) stdenv;
+      inherit (pkgs.darwin.apple_sdk_11_0.frameworks) CoreServices CoreGraphics ImageIO;
+    };
 
-    callPackage = newScope (lib.optionalAttrs stdenv.isDarwin rec {
+    rustPlatform = pkgs.makeRustPlatform {
       inherit (pkgs.darwin.apple_sdk_11_0) stdenv;
+      inherit (pkgs) rustc cargo;
+    } // {
+      inherit (pkgs.callPackage ../../../build-support/rust/hooks {
+        inherit (pkgs.darwin.apple_sdk_11_0) stdenv;
+        inherit (pkgs) cargo rustc;
+        clang = mkCc pkgs.clang;
+      }) bindgenHook;
+    };
+
+    callPackage = newScope (lib.optionalAttrs stdenv.isDarwin (stdenvs // rec {
+      inherit (pkgs.darwin.apple_sdk_11_0) xcodebuild rustPlatform;
       darwin = pkgs.darwin.overrideScope (_: prev: {
-        inherit (prev.darwin.apple_sdk_11_0) Libsystem LibsystemCross libcharset libunwind objc4 configd IOKit Security;
+        inherit (prev.darwin.apple_sdk_11_0)
+          IOKit
+          Libsystem
+          LibsystemCross
+          Security
+          configd
+          libcharset
+          libunwind
+          objc4
+          ;
         apple_sdk = prev.darwin.apple_sdk_11_0;
         CF = prev.darwin.apple_sdk_11_0.CoreFoundation;
       });
-      xcodebuild = pkgs.xcbuild.override {
-        inherit (pkgs.darwin.apple_sdk_11_0.frameworks) CoreServices CoreGraphics ImageIO;
-        inherit stdenv;
-      };
       xcbuild = xcodebuild;
-    });
-
-    stdenv =
-      let
-        clang = stdenv.cc.override {
-          bintools = stdenv.cc.bintools.override { libc = packages.Libsystem; };
-          libc = packages.Libsystem;
-        };
-      in
-      if stdenv.isAarch64 then stdenv
-      else
-        (overrideCC stdenv clang).override {
-          targetPlatform = stdenv.targetPlatform // {
-            darwinMinVersion = "10.12";
-            darwinSdkVersion = "11.0";
-          };
-        };
+    }));
   };
 in packages
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index e9121b021164..fa6945f76718 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,195 +1,196 @@
-{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
 {
   AGL                              = { inherit Carbon OpenGL; };
-  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
-  AVKit                            = {};
-  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
-  Accessibility                    = {};
-  Accounts                         = {};
-  AdSupport                        = {};
-  AddressBook                      = { inherit AddressBookCore Carbon ContactsPersistence libobjc; };
-  AppKit                           = { inherit ApplicationServices AudioToolbox AudioUnit Foundation QuartzCore UIFoundation; };
-  AppTrackingTransparency          = {};
+  AVFoundation                     = { inherit AudioToolbox CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia CoreVideo Foundation IOKit ImageIO MediaToolbox Metal QuartzCore UniformTypeIdentifiers simd; };
+  AVKit                            = { inherit AVFoundation AppKit Cocoa Foundation; };
+  Accelerate                       = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  Accessibility                    = { inherit CoreGraphics Foundation; };
+  Accounts                         = { inherit Foundation; };
+  AdServices                       = { inherit Foundation; };
+  AdSupport                        = { inherit Foundation; };
+  AddressBook                      = { inherit Carbon Cocoa CoreFoundation Foundation; };
+  AppKit                           = { inherit ApplicationServices CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal OpenGL QuartzCore; };
+  AppTrackingTransparency          = { inherit Foundation; };
   AppleScriptKit                   = {};
-  AppleScriptObjC                  = {};
-  ApplicationServices              = { inherit ColorSync CoreGraphics CoreServices CoreText ImageIO; };
-  AudioToolbox                     = { inherit AudioToolboxCore CoreAudio CoreMIDI; };
-  AudioUnit                        = { inherit AudioToolbox Carbon CoreAudio; };
-  AudioVideoBridging               = { inherit Foundation; };
-  AuthenticationServices           = {};
-  AutomaticAssessmentConfiguration = {};
-  Automator                        = {};
-  BackgroundTasks                  = {};
-  BusinessChat                     = {};
-  CFNetwork                        = {};
+  AppleScriptObjC                  = { inherit Foundation; };
+  ApplicationServices              = { inherit ColorSync CoreFoundation CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit Carbon CoreAudio CoreAudioTypes CoreFoundation CoreMIDI Foundation; };
+  AudioUnit                        = { inherit AudioToolbox; };
+  AudioVideoBridging               = { inherit Foundation IOKit; };
+  AuthenticationServices           = { inherit AppKit Foundation; };
+  AutomaticAssessmentConfiguration = { inherit Foundation; };
+  Automator                        = { inherit AppKit Cocoa Foundation OSAKit; };
+  BackgroundTasks                  = { inherit Foundation; };
+  BusinessChat                     = { inherit Cocoa Foundation; };
+  CFNetwork                        = { inherit CoreFoundation; };
   CalendarStore                    = {};
-  CallKit                          = {};
-  Carbon                           = { inherit ApplicationServices CoreServices Foundation IOKit QuartzCore Security libobjc; };
-  ClassKit                         = {};
-  CloudKit                         = { inherit CoreLocation; };
-  Cocoa                            = { inherit AppKit CoreData; };
-  Collaboration                    = {};
-  ColorSync                        = {};
+  CallKit                          = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation Security; };
+  ClassKit                         = { inherit CoreGraphics Foundation; };
+  CloudKit                         = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  Cocoa                            = { inherit AppKit CoreData Foundation; };
+  Collaboration                    = { inherit AppKit CoreServices Foundation; };
+  ColorSync                        = { inherit CoreFoundation; };
   Combine                          = {};
-  Contacts                         = {};
-  ContactsUI                       = {};
-  CoreAudio                        = { inherit IOKit CoreAudioTypes; };
-  CoreAudioKit                     = { inherit AudioUnit; };
-  CoreAudioTypes                   = {};
-  CoreBluetooth                    = {};
-  CoreData                         = { inherit CloudKit; };
+  Contacts                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ContactsUI                       = { inherit AppKit; };
+  CoreAudio                        = { inherit CoreAudioTypes CoreFoundation; };
+  CoreAudioKit                     = { inherit AppKit AudioUnit Cocoa Foundation; };
+  CoreAudioTypes                   = { inherit CoreFoundation; };
+  CoreBluetooth                    = { inherit Foundation; };
+  CoreData                         = { inherit CloudKit Combine CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
   CoreDisplay                      = {};
-  CoreFoundation                   = { inherit libobjc; };
-  CoreGraphics                     = { inherit Accelerate IOKit IOSurface SystemConfiguration; };
-  CoreHaptics                      = {};
-  CoreImage                        = {};
-  CoreLocation                     = {};
-  CoreMIDI                         = {};
-  CoreMIDIServer                   = { inherit CoreMIDI; };
-  CoreML                           = {};
-  CoreMedia                        = { inherit ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo; };
-  CoreMediaIO                      = { inherit CoreMedia; };
-  CoreMotion                       = {};
-  CoreServices                     = { inherit CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration NetFS OpenDirectory Security ServiceManagement; };
-  CoreSpotlight                    = {};
+  CoreFoundation                   = {};
+  CoreGraphics                     = { inherit CoreFoundation IOKit; };
+  CoreHaptics                      = { inherit Foundation; };
+  CoreImage                        = { inherit ApplicationServices CoreFoundation CoreGraphics CoreVideo Foundation IOKit IOSurface ImageIO Metal OpenGL; };
+  CoreLocation                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDI                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDIServer                   = {};
+  CoreML                           = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit ImageIO Metal; };
+  CoreMedia                        = { inherit CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  CoreMediaIO                      = { inherit CoreFoundation CoreMedia; };
+  CoreMotion                       = { inherit Foundation; };
+  CoreServices                     = { inherit CFNetwork CoreFoundation DiskArbitration Security; };
+  CoreSpotlight                    = { inherit Foundation UniformTypeIdentifiers; };
   CoreTelephony                    = {};
-  CoreText                         = { inherit CoreGraphics; };
-  CoreVideo                        = { inherit ApplicationServices CoreGraphics IOSurface OpenGL; };
-  CoreWLAN                         = { inherit SecurityFoundation; };
-  CryptoKit                        = {};
-  CryptoTokenKit                   = {};
-  DVDPlayback                      = {};
-  DeveloperToolsSupport            = {};
-  DeviceCheck                      = {};
-  DirectoryService                 = {};
-  DiscRecording                    = { inherit CoreServices IOKit libobjc; };
-  DiscRecordingUI                  = {};
-  DiskArbitration                  = { inherit IOKit; };
+  CoreText                         = { inherit CoreFoundation CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreFoundation CoreGraphics IOSurface Metal OpenGL; };
+  CoreWLAN                         = { inherit Foundation IOKit; };
+  CryptoKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit LocalAuthentication Security; };
+  CryptoTokenKit                   = { inherit CoreFoundation CoreGraphics Foundation IOKit Security; };
+  DVDPlayback                      = { inherit ApplicationServices CoreFoundation Security; };
+  DeveloperToolsSupport            = { inherit Foundation; };
+  DeviceCheck                      = { inherit Foundation; };
+  DirectoryService                 = { inherit CoreFoundation; };
+  DiscRecording                    = { inherit CoreServices Foundation; };
+  DiscRecordingUI                  = { inherit Carbon Cocoa DiscRecording; };
+  DiskArbitration                  = { inherit CoreFoundation IOKit; };
   DriverKit                        = {};
-  EventKit                         = {};
-  ExceptionHandling                = {};
-  ExecutionPolicy                  = {};
-  ExternalAccessory                = {};
-  FWAUserLib                       = {};
-  FileProvider                     = {};
-  FileProviderUI                   = {};
-  FinderSync                       = {};
-  ForceFeedback                    = { inherit IOKit; };
-  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration libobjc; };
-  GLKit                            = {};
+  EventKit                         = { inherit CoreGraphics CoreLocation Foundation; };
+  ExceptionHandling                = { inherit Foundation; };
+  ExecutionPolicy                  = { inherit Foundation; };
+  ExternalAccessory                = { inherit Foundation; };
+  FWAUserLib                       = { inherit IOKit; };
+  FileProvider                     = { inherit CoreGraphics Foundation; };
+  FileProviderUI                   = { inherit AppKit FileProvider Foundation; };
+  FinderSync                       = { inherit AppKit Foundation; };
+  ForceFeedback                    = { inherit CoreFoundation IOKit; };
+  Foundation                       = { inherit ApplicationServices Combine CoreFoundation CoreGraphics CoreServices IOKit Security; };
+  GLKit                            = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO OpenGL QuartzCore simd; };
   GLUT                             = { inherit OpenGL; };
-  GSS                              = {};
-  GameController                   = {};
-  GameKit                          = { inherit Cocoa Foundation GameCenterFoundation GameCenterUI GameCenterUICore GameController GameplayKit Metal MetalKit ModelIO ReplayKit SceneKit SpriteKit; };
-  GameplayKit                      = {};
-  HIDDriverKit                     = {};
+  GSS                              = { inherit CoreFoundation; };
+  GameController                   = { inherit AppKit Foundation IOKit; };
+  GameKit                          = { inherit AppKit Cocoa Contacts CoreGraphics Foundation GameController GameplayKit Metal MetalKit ModelIO SceneKit SpriteKit simd; };
+  GameplayKit                      = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore SceneKit SpriteKit simd; };
+  HIDDriverKit                     = { inherit IOKit USBDriverKit; };
   Hypervisor                       = {};
-  ICADevices                       = { inherit Carbon IOBluetooth libobjc; };
-  IMServicePlugIn                  = {};
-  IOBluetooth                      = { inherit CoreBluetooth IOKit; };
-  IOBluetoothUI                    = { inherit IOBluetooth; };
-  IOKit                            = {};
-  # `IOSurface` should depend on `Libsystem` (in place of `xpc`) but this currently causes build
-  # issues due to incompatibility issues between `Libsystem` and `libcxx`.
-  IOSurface                        = { inherit IOKit xpc; };
-  IOUSBHost                        = {};
-  IdentityLookup                   = {};
-  ImageCaptureCore                 = {};
-  ImageIO                          = { inherit CoreGraphics; };
-  InputMethodKit                   = { inherit Carbon; };
+  ICADevices                       = { inherit CoreFoundation CoreGraphics CoreServices IOBluetooth; };
+  IMServicePlugIn                  = { inherit Foundation; };
+  IOBluetooth                      = { inherit CoreAudio CoreFoundation CoreServices Foundation IOKit; };
+  IOBluetoothUI                    = { inherit Cocoa IOBluetooth; };
+  IOKit                            = { inherit CoreFoundation; };
+  IOSurface                        = { inherit CoreFoundation Foundation IOKit; };
+  IOUSBHost                        = { inherit Foundation IOKit; };
+  IdentityLookup                   = { inherit Foundation; };
+  ImageCaptureCore                 = { inherit Cocoa CoreGraphics Foundation; };
+  ImageIO                          = { inherit CoreFoundation CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon Cocoa Foundation; };
   InstallerPlugins                 = {};
   InstantMessage                   = {};
-  Intents                          = {};
-  JavaNativeFoundation             = {};
-  JavaRuntimeSupport               = {};
-  JavaScriptCore                   = { inherit libobjc; };
+  Intents                          = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  JavaNativeFoundation             = { inherit Foundation; };
+  JavaRuntimeSupport               = { inherit ApplicationServices Cocoa Foundation QuartzCore; };
+  JavaScriptCore                   = { inherit CoreFoundation CoreGraphics Foundation; };
   Kerberos                         = {};
-  Kernel                           = { inherit IOKit; };
-  KernelManagement                 = {};
+  Kernel                           = {};
+  KernelManagement                 = { inherit Foundation; };
   LDAP                             = {};
-  LatentSemanticMapping            = { inherit Carbon; };
-  LinkPresentation                 = { inherit URLFormatting; };
-  LocalAuthentication              = {};
-  MLCompute                        = {};
-  MapKit                           = {};
-  MediaAccessibility               = { inherit CoreGraphics CoreText QuartzCore; };
-  MediaLibrary                     = {};
-  MediaPlayer                      = {};
-  MediaToolbox                     = { inherit AudioToolbox AudioUnit CoreMedia; };
+  LatentSemanticMapping            = { inherit Carbon CoreFoundation; };
+  LinkPresentation                 = { inherit AppKit Foundation; };
+  LocalAuthentication              = { inherit Foundation; };
+  MLCompute                        = { inherit CoreFoundation CoreGraphics Foundation IOKit Metal; };
+  MapKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  MediaAccessibility               = { inherit CoreFoundation CoreGraphics CoreText QuartzCore; };
+  MediaLibrary                     = { inherit Foundation; };
+  MediaPlayer                      = { inherit AVFoundation CoreGraphics Foundation; };
+  MediaToolbox                     = { inherit AudioToolbox CoreFoundation CoreMedia; };
   Message                          = {};
-  Metal                            = {};
-  MetalKit                         = { inherit Metal ModelIO; };
-  MetalPerformanceShaders          = {};
-  MetalPerformanceShadersGraph     = {};
-  MetricKit                        = { inherit SignpostMetrics; };
-  ModelIO                          = {};
-  MultipeerConnectivity            = {};
-  NaturalLanguage                  = {};
-  NearbyInteraction                = {};
-  NetFS                            = {};
-  Network                          = { inherit libnetwork; };
-  NetworkExtension                 = { inherit Network; };
+  Metal                            = { inherit CoreFoundation CoreGraphics Foundation IOKit IOSurface; };
+  MetalKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO QuartzCore simd; };
+  MetalPerformanceShaders          = { inherit CoreGraphics Foundation Metal simd; };
+  MetalPerformanceShadersGraph     = { inherit Foundation MetalPerformanceShaders; };
+  MetricKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ModelIO                          = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  MultipeerConnectivity            = { inherit Cocoa Foundation; };
+  NaturalLanguage                  = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  NearbyInteraction                = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  NetFS                            = { inherit CoreFoundation; };
+  Network                          = { inherit CoreFoundation Foundation Security; };
+  NetworkExtension                 = { inherit Foundation Network Security; };
   NetworkingDriverKit              = {};
-  NotificationCenter               = {};
-  OSAKit                           = { inherit Carbon; };
-  OSLog                            = {};
+  NotificationCenter               = { inherit AppKit Foundation; };
+  OSAKit                           = { inherit Carbon Cocoa; };
+  OSLog                            = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
   OpenAL                           = {};
-  OpenCL                           = { inherit IOSurface OpenGL; };
-  OpenDirectory                    = {};
+  OpenCL                           = { inherit OpenGL; };
+  OpenDirectory                    = { inherit CoreFoundation Foundation; };
   OpenGL                           = {};
-  PCIDriverKit                     = {};
-  PCSC                             = { inherit CoreData; };
-  PDFKit                           = {};
-  ParavirtualizedGraphics          = {};
-  PassKit                          = { inherit PassKitCore; };
-  PencilKit                        = {};
-  Photos                           = {};
-  PhotosUI                         = {};
-  PreferencePanes                  = {};
-  PushKit                          = {};
-  Python                           = {};
-  QTKit                            = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
-  Quartz                           = { inherit QTKit QuartzCore QuickLook PDFKit; };
-  QuartzCore                       = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
-  QuickLook                        = { inherit ApplicationServices; };
-  QuickLookThumbnailing            = {};
-  RealityKit                       = {};
-  ReplayKit                        = {};
+  PCIDriverKit                     = { inherit IOKit; };
+  PCSC                             = {};
+  PDFKit                           = { inherit AppKit Cocoa; };
+  ParavirtualizedGraphics          = { inherit AppKit CoreVideo Foundation IOSurface Metal; };
+  PassKit                          = { inherit AppKit Contacts CoreGraphics Foundation; };
+  PencilKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  Photos                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreMedia Foundation IOKit ImageIO Metal QuartzCore UniformTypeIdentifiers simd; };
+  PhotosUI                         = { inherit AppKit Foundation MapKit Photos; };
+  PreferencePanes                  = { inherit Cocoa; };
+  PushKit                          = { inherit Foundation; };
+  Python                           = { inherit Carbon; };
+  QTKit                            = {};
+  Quartz                           = { inherit AppKit ApplicationServices Cocoa Foundation ImageCaptureCore OpenGL PDFKit QuartzCore QuickLook; };
+  QuartzCore                       = { inherit CoreFoundation CoreGraphics CoreImage CoreVideo Foundation IOKit Metal OpenGL; };
+  QuickLook                        = { inherit ApplicationServices CoreFoundation; };
+  QuickLookThumbnailing            = { inherit CoreGraphics Foundation UniformTypeIdentifiers; };
+  RealityKit                       = { inherit AVFoundation AppKit AudioToolbox CloudKit Combine CoreAudio CoreData CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreText Foundation IOKit Metal MultipeerConnectivity QuartzCore simd; };
+  ReplayKit                        = { inherit AVFoundation AppKit Foundation; };
   Ruby                             = {};
-  SafariServices                   = {};
-  SceneKit                         = {};
-  ScreenSaver                      = {};
-  ScreenTime                       = {};
-  ScriptingBridge                  = {};
-  Security                         = { inherit IOKit libDER; };
-  SecurityFoundation               = { inherit Security; };
-  SecurityInterface                = { inherit Security SecurityFoundation; };
-  SensorKit                        = {};
-  ServiceManagement                = { inherit Security; };
-  Social                           = {};
-  SoundAnalysis                    = {};
-  Speech                           = {};
-  SpriteKit                        = {};
-  StoreKit                         = {};
-  SwiftUI                          = {};
+  SafariServices                   = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  SceneKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  ScreenSaver                      = { inherit AppKit Foundation; };
+  ScreenTime                       = { inherit AppKit Foundation; };
+  ScriptingBridge                  = { inherit ApplicationServices CoreServices Foundation; };
+  Security                         = { inherit CoreFoundation; };
+  SecurityFoundation               = { inherit Foundation Security; };
+  SecurityInterface                = { inherit AppKit Cocoa Security SecurityFoundation; };
+  SensorKit                        = { inherit CoreFoundation CoreLocation Foundation; };
+  ServiceManagement                = { inherit CoreFoundation Security; };
+  Social                           = { inherit AppKit Foundation; };
+  SoundAnalysis                    = { inherit AVFoundation CoreML CoreMedia Foundation; };
+  Speech                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  SpriteKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  StoreKit                         = { inherit AppKit CoreGraphics Foundation; };
+  SwiftUI                          = { inherit AppKit CloudKit Combine CoreData CoreFoundation CoreGraphics CoreImage CoreLocation DeveloperToolsSupport Foundation IOKit Metal QuartzCore UniformTypeIdentifiers; };
   SyncServices                     = {};
   System                           = {};
-  SystemConfiguration              = { inherit Security; };
-  SystemExtensions                 = {};
-  TWAIN                            = { inherit Carbon; };
+  SystemConfiguration              = { inherit CoreFoundation Security; };
+  SystemExtensions                 = { inherit Foundation; };
+  TWAIN                            = {};
   Tcl                              = {};
   Tk                               = {};
-  USBDriverKit                     = {};
-  UniformTypeIdentifiers           = {};
-  UserNotifications                = {};
-  UserNotificationsUI              = {};
-  VideoDecodeAcceleration          = { inherit CoreVideo; };
-  VideoSubscriberAccount           = {};
-  VideoToolbox                     = { inherit CoreMedia CoreVideo; };
-  Virtualization                   = {};
-  Vision                           = {};
-  WebKit                           = { inherit ApplicationServices Carbon JavaScriptCore OpenGL libobjc; };
-  WidgetKit                        = {};
-  iTunesLibrary                    = {};
+  USBDriverKit                     = { inherit IOKit; };
+  UniformTypeIdentifiers           = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  UserNotifications                = { inherit Foundation; };
+  UserNotificationsUI              = { inherit AppKit; };
+  VideoDecodeAcceleration          = {};
+  VideoSubscriberAccount           = { inherit Foundation; };
+  VideoToolbox                     = { inherit CoreFoundation CoreGraphics CoreMedia CoreVideo; };
+  Virtualization                   = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Vision                           = { inherit CoreAudio CoreFoundation CoreGraphics CoreML CoreMedia CoreVideo Foundation IOKit ImageIO Metal simd; };
+  WebKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit JavaScriptCore Metal OpenGL QuartzCore; };
+  WidgetKit                        = { inherit Combine CoreFoundation CoreGraphics CoreVideo Foundation IOKit Intents Metal SwiftUI; };
+  iTunesLibrary                    = { inherit Foundation; };
   vmnet                            = {};
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
index f04b964f755f..7be670425d7a 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation {
   ];
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
 
     for dir in $includeDirs; do
       from=${MacOSX-SDK}/usr/include/$dir
@@ -39,6 +39,7 @@ stdenvNoCC.mkDerivation {
 
     cp -d \
       ${MacOSX-SDK}/usr/include/*.h \
+      ${MacOSX-SDK}/usr/include/*.modulemap \
       $out/include
 
     rm $out/include/tk*.h $out/include/tcl*.h
@@ -56,6 +57,13 @@ stdenvNoCC.mkDerivation {
         $out/lib
     done
 
+    for name in os Dispatch; do
+      cp -dr \
+        ${MacOSX-SDK}/usr/lib/swift/$name.swiftmodule \
+        ${MacOSX-SDK}/usr/lib/swift/libswift$name.tbd \
+        $out/lib/swift
+    done
+
     for f in $csu; do
       from=${MacOSX-SDK}/usr/lib/$f
       if [ -e "$from" ]; then
@@ -70,6 +78,7 @@ stdenvNoCC.mkDerivation {
       rewrite-tbd \
         -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
         -p /usr/lib/system/:$out/lib/system/ \
+        -p /usr/lib/swift/:$out/lib/swift/ \
         -r ${builtins.storeDir} \
         "$tbd"
     done
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
index 63ef2a1c263e..9288097ef369 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
@@ -8,14 +8,17 @@ let self = stdenvNoCC.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
     cp -r ${MacOSX-SDK}/usr/include/objc $out/include
     cp ${MacOSX-SDK}/usr/lib/libobjc* $out/lib
+    cp -r ${MacOSX-SDK}/usr/lib/swift/ObjectiveC.swiftmodule $out/lib/swift
+    cp ${MacOSX-SDK}/usr/lib/swift/libswiftObjectiveC.tbd $out/lib/swift
   '';
 
   passthru = {
     tbdRewrites = {
       const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+      const."/usr/lib/swift/libswiftObjectiveC.dylib" = "${self}/lib/swift/libswiftObjectiveC.dylib";
     };
   };
 }; in self
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix
new file mode 100644
index 000000000000..995f2b20ce70
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix
@@ -0,0 +1,23 @@
+{ stdenvNoCC, MacOSX-SDK, checkReexportsHook }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libpm";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${MacOSX-SDK}/usr/lib/libpm* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libpmenergy.dylib" = "${placeholder "out"}/lib/libpmenergy.dylib";
+      const."/usr/lib/libpmsample.dylib" = "${placeholder "out"}/lib/libpmsample.dylib";
+    };
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index b8786ec92f6d..27749dde100a 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -1,4 +1,4 @@
-{ frameworks }: with frameworks;
+{ frameworks, libobjc }: with frameworks;
 # generated by hand to avoid exposing all private frameworks
 # frameworks here are only the necessary ones used by public frameworks.
 {
@@ -18,4 +18,13 @@
 
   # Also expose CoreSymbolication; used by `root` package.
   CoreSymbolication = {};
+
+  # Also expose DebugSymbols; used by `llvmPackages_8.lldb` package.
+  DebugSymbols = {};
+
+  # Also expose DisplayServices; used by `sketchybar` package.
+  DisplayServices = { inherit libobjc; };
+
+  # Also expose MultitouchSupport; used by `chuck` package.
+  MultitouchSupport = {};
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
index 0cf95cbe9c56..48c423c98929 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -320,13 +320,32 @@ in rec {
       '';
     });
 
+    System = lib.overrideDerivation super.System (drv: {
+      installPhase = ''
+        mkdir -p $out/Library/Frameworks/System.framework/Versions/B
+        ln -s $out/Library/Frameworks/System.framework/Versions/{B,Current}
+        ln -s ${pkgs.darwin.Libsystem}/lib/libSystem.B.tbd $out/Library/Frameworks/System.framework/Versions/B/System.tbd
+        ln -s $out/Library/Frameworks/System.framework/{Versions/Current/,}System.tbd
+      '';
+    });
+
     WebKit = lib.overrideDerivation super.WebKit (drv: {
       extraTBDFiles = [
         "Versions/A/Frameworks/WebCore.framework/Versions/A/WebCore.tbd"
         "Versions/A/Frameworks/WebKitLegacy.framework/Versions/A/WebKitLegacy.tbd"
       ];
     });
-  } // lib.genAttrs [ "ContactsPersistence" "CoreSymbolication" "GameCenter" "SkyLight" "UIFoundation" ] (x: tbdOnlyFramework x {});
+  } // lib.genAttrs [
+    "ContactsPersistence"
+    "CoreSymbolication"
+    "DebugSymbols"
+    "DisplayServices"
+    "GameCenter"
+    "MultitouchSupport"
+    "SkyLight"
+    "UIFoundation"
+  ]
+    (x: tbdOnlyFramework x {});
 
   bareFrameworks = lib.mapAttrs framework (import ./frameworks.nix {
     inherit frameworks libs;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index 0c70d9bc258f..a9fbcc066a3c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -104,6 +104,7 @@ with frameworks; with libs; {
   SpriteKit               = {};
   StoreKit                = {};
   SyncServices            = {};
+  System                  = {};
   SystemConfiguration     = { inherit Security; };
   TWAIN                   = { inherit Carbon; };
   Tcl                     = {};
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
index ac09a282f512..cc73c0ac9415 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -18,6 +18,7 @@ appleDerivation' stdenv {
   '';
 
   installFlags = [ "DSTROOT=$(out)" ];
+  enableParallelInstalling = false; # cp: cannot create regular file '$out/lib/crt1.10.6.o'
 
   meta = with lib; {
     description = "Apple's common startup stubs for darwin";
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
index cdebfe6d2f72..ed5e998714af 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
@@ -13,7 +13,7 @@ in
 appleDerivation {
   nativeBuildInputs = [ python3 ];
 
-  depsBuildBuild = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [ buildPackages.stdenv.cc ];
+  depsBuildBuild = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ buildPackages.stdenv.cc ];
 
   postPatch = ''
     substituteInPlace makefile \
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index b413744677d2..aeeb5c06b34c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -5,8 +5,6 @@ appleDerivation' stdenv {
   srcs = lib.attrValues IOKitSrcs;
   sourceRoot = ".";
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/IOKit.framework/IOKit"
     "/System/Library/Frameworks/IOKit.framework/Resources"
@@ -174,10 +172,10 @@ appleDerivation' stdenv {
     # stream: missing altogether
 
     # usb: complete
-    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/IOUSBLib.h            $dest/usb
-    cp IOUSBFamily-630.4.5/IOUSBUserClient/Headers/IOUSBUserClient.h $dest/usb
-    cp IOUSBFamily-560.4.2/IOUSBFamily/Headers/USB.h                 $dest/usb # This file is empty in 630.4.5!
-    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/USBSpec.h             $dest/usb
+    cp IOUSBFamily*-630.4.5/IOUSBFamily/Headers/IOUSBLib.h            $dest/usb
+    cp IOUSBFamily*-630.4.5/IOUSBUserClient/Headers/IOUSBUserClient.h $dest/usb
+    cp IOUSBFamily*-560.4.2/IOUSBFamily/Headers/USB.h                 $dest/usb # This file is empty in 630.4.5!
+    cp IOUSBFamily*-630.4.5/IOUSBFamily/Headers/USBSpec.h             $dest/usb
 
     # video: missing altogether
   '';
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 6f8124dbac4c..aa93a32c5621 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,12 +1,36 @@
-{ lib, stdenv, buildPackages
+{ lib, stdenv, buildPackages, fetchzip
 , appleDerivation', xnu, Libc, Libm, libdispatch, Libinfo
 , dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
 , copyfile, removefile, libresolvHeaders, libresolv, Libnotify, libplatform, libpthread
-, mDNSResponder, launchd, libutilHeaders, hfsHeaders, darling, darwin-stubs
+, mDNSResponder, launchd, libutilHeaders, hfsHeaders, darwin-stubs
 , headersOnly ? false
 , withLibresolv ? !headersOnly
 }:
 
+let
+  darling.src = fetchzip {
+    url = "https://github.com/darlinghq/darling/archive/d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b.tar.gz";
+    sha256 = "11b51fw47nl505h63bgx5kqiyhf3glhp1q6jkpb6nqfislnzzkrf";
+    postFetch = ''
+      # The archive contains both `src/opendirectory` and `src/OpenDirectory`,
+      # pre-create the directory to choose the canonical case on
+      # case-insensitive filesystems.
+      mkdir -p $out/src/OpenDirectory
+
+      cd $out
+      tar -xzf $downloadedFile --strip-components=1
+      rm -r $out/src/libm
+
+      # If `src/opendirectory` and `src/OpenDirectory` refer to different
+      # things, then combine them into `src/OpenDirectory` to match the result
+      # on case-insensitive filesystems.
+      if [ "$(stat -c %i src/opendirectory)" != "$(stat -c %i src/OpenDirectory)" ]; then
+        mv src/opendirectory/* src/OpenDirectory/
+        rmdir src/opendirectory
+      fi
+    '';
+  };
+in
 appleDerivation' stdenv {
   dontBuild = true;
   dontFixup = true;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
index bb09adce252e..f4fe65b8066c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
@@ -1,8 +1,6 @@
 { appleDerivation', stdenv, darwin-stubs }:
 
 appleDerivation' stdenv {
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/Security.framework/Security"
     "/System/Library/Frameworks/Security.framework/Resources"
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
index f1b5e19feb22..984910b34c93 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -7,7 +7,7 @@ appleDerivation {
 
   xcbuildFlags = [ "-target" "Security_frameworks_osx" ];
 
-  # NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
+  # env.NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
 
   preBuild = ''
     dtrace -h -C -s OSX/libsecurity_utilities/lib/security_utilities.d -o OSX/libsecurity_utilities/lib/utilities_dtrace.h
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
index 2ca2d061591a..7d1066a25915 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, appleDerivation, fetchzip, bsdmake, perl, flex, bison
+{ lib, stdenv, buildPackages, appleDerivation, fetchFromGitHub, bsdmake, perl, flex, bison
 }:
 
 # this derivation sucks
@@ -10,9 +10,11 @@
 #
 # the more recent adv_cmds release is used for everything else in this package
 
-let recentAdvCmds = fetchzip {
-  url = "https://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
-  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
+let recentAdvCmds = fetchFromGitHub {
+  owner = "apple-oss-distributions";
+  repo = "adv_cmds";
+  rev = "adv_cmds-158";
+  hash = "sha256-1qL69pGHIaefooJJ8eT83XGz9+bW7Yg3k+X9fNkMCHw=";
 };
 
 in appleDerivation {
@@ -30,6 +32,9 @@ in appleDerivation {
 
     substituteInPlace Makefile --replace perl true
 
+    substituteInPlace colldef.tproj/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
       substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
         --replace /usr/share/locale "" \
@@ -40,6 +45,10 @@ in appleDerivation {
 
   preBuild = ''
     cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     pushd colldef
     mv locale/collate.h .
     flex -t -8 -i scan.l > scan.c
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 6e659df4d620..e44241171c60 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,4 +1,4 @@
-{ lib, appleDerivation, xcbuild, ncurses, libutil }:
+{ lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
 
 appleDerivation {
   # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
@@ -6,6 +6,8 @@ appleDerivation {
   patchPhase = ''
     substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
       --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
   '';
 
   # pkill requires special private headers that are unavailable in
@@ -42,7 +44,7 @@ appleDerivation {
   '';
 
   nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil ];
+  buildInputs = [ ncurses libutil Libc ];
 
   meta = {
     platforms = lib.platforms.darwin;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
index df47d53514ab..ba0e5b3b78b9 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchzip, pkgs }:
+{ lib, stdenv, fetchurl, fetchFromGitHub, pkgs }:
 
 let
   # This attrset can in theory be computed automatically, but for that to work nicely we need
@@ -146,7 +146,7 @@ let
       then stdenv.fetchurlBoot
       else fetchurl;
   in fetch {
-    url = "http://www.opensource.apple.com/tarballs/${pname}/${pname}-${version}.tar.gz";
+    url = "https://github.com/apple-oss-distributions/${pname}/archive/refs/tags/${pname}-${version}.tar.gz";
     inherit sha256;
   };
 
@@ -188,24 +188,24 @@ let
   });
 
   IOKitSpecs = {
-    IOAudioFamily                        = fetchApple "osx-10.10.5" "0ggq7za3iq8g02j16rj67prqhrw828jsw3ah3bxq8a1cvr55aqnq";
-    IOFireWireFamily                     = fetchApple "osx-10.10.5" "059qa1m668kwvchl90cqcx35b31zaqdg61zi11y1imn5s389y2g1";
-    IOFWDVComponents                     = fetchApple "osx-10.10.5" "1brr0yn6mxgapw3bvlhyissfksifzj2mqsvj9vmps6zwcsxjfw7m";
-    IOFireWireAVC                        = fetchApple "osx-10.10.5" "194an37gbqs9s5s891lmw6prvd1m2362602s8lj5m89fp9h8mbal";
-    IOFireWireSBP2                       = fetchApple "osx-10.10.5" "1mym158kp46y1vfiq625b15ihh4jjbpimfm7d56wlw6l2syajqvi";
-    IOFireWireSerialBusProtocolTransport = fetchApple "osx-10.10.5" "09kiq907qpk94zbij1mrcfcnyyc5ncvlxavxjrj4v5braxm78lhi";
-    IOGraphics                           = fetchApple "osx-10.10.5" "1z0x3yrv0p8pfdqnvwf8rvrf9wip593lhm9q6yzbclz3fn53ad0p";
-    IOHIDFamily                          = fetchApple "osx-10.10.5" "0yibagwk74imp3j3skjycm703s5ybdqw0qlsmnml6zwjpbrz5894";
-    IONetworkingFamily                   = fetchApple "osx-10.10.5" "04as1hc8avncijf61mp9dmplz8vb1inhirkd1g74gah08lgrfs9j";
-    IOSerialFamily                       = fetchApple "osx-10.10.5" "0jh12aanxcigqi9w6wqzbwjdin9m48zwrhdj3n4ki0h41sg89y91";
-    IOStorageFamily                      = fetchApple "osx-10.9.5"  "0w5yr8ppl82anwph2zba0ppjji6ipf5x410zhcm1drzwn4bbkxrj";
-    IOBDStorageFamily                    = fetchApple "osx-10.10.5" "1rbvmh311n853j5qb6hfda94vym9wkws5w736w2r7dwbrjyppc1q";
-    IOCDStorageFamily                    = fetchApple "osx-10.10.5" "1905sxwmpxdcnm6yggklc5zimx1558ygm3ycj6b34f9h48xfxzgy";
-    IODVDStorageFamily                   = fetchApple "osx-10.10.5" "1fv82rn199mi998l41c0qpnlp3irhqp2rb7v53pxbx7cra4zx3i6";
+    IOAudioFamily                        = fetchApple "osx-10.10.5" "sha256-frs2pm2OpGUOz68ZXsjktlyHlgn5oXM+ltbmAf//Cio=";
+    IOFireWireFamily                     = fetchApple "osx-10.10.5" "sha256-V9fNeo/Wj9dm1/XM4hkOInnMk01M6c9QSjJs5zJKB60=";
+    IOFWDVComponents                     = fetchApple "osx-10.10.5" "sha256-KenCX9C/Z2ErUK8tpKpm65gEmhn2NsXFxlzK7NKomaI=";
+    IOFireWireAVC                        = fetchApple "osx-10.10.5" "sha256-Gd8+PK/mk+xEXgF8dGAx+3jsXv4NX1GiBFyjyrf6sTo=";
+    IOFireWireSBP2                       = fetchApple "osx-10.10.5" "sha256-Z3nP8pX1YG4Fbt7MrnqO06ihE9aYOex5Eib/rqOpoPk=";
+    IOFireWireSerialBusProtocolTransport = fetchApple "osx-10.10.5" "sha256-zdYE0UCKiVhDRGdWaH8L51ArbYTnsQOmcN/OMmpNdFA=";
+    IOGraphics                           = fetchApple "osx-10.10.5" "sha256-lXoW4sx3pyl5fg5Qde3sQi2i8rTLnpeCdDaTHjbfaMI=";
+    IOHIDFamily                          = fetchApple "osx-10.10.5" "sha256-b+S1p3p5d8olYE18VrBns4euerVINaQSFEp34sko5rM=";
+    IONetworkingFamily                   = fetchApple "osx-10.10.5" "sha256-NOpFOBKS6iwFj9DJxduZYZfZJuhDyBQw2QMKHbu7j40=";
+    IOSerialFamily                       = fetchApple "osx-10.10.5" "sha256-hpYrgXsuTul4CYoYIjQjerfvQRqISM2tCcfVXlnjbZo=";
+    IOStorageFamily                      = fetchApple "osx-10.9.5"  "sha256-CeA4rHUrBKHsDeJU9ssIY9LQwDw09a+vQUyruosaLKA=";
+    IOBDStorageFamily                    = fetchApple "osx-10.10.5" "sha256-gD52RKXGKWGga/QGlutxsgsPNSN6gcRfFQRT8v51N3E=";
+    IOCDStorageFamily                    = fetchApple "osx-10.10.5" "sha256-+nyqH6lMPmIkDLYXNVSeR4vBYS165oyJx+DkCkKOGRg=";
+    IODVDStorageFamily                   = fetchApple "osx-10.10.5" "sha256-Jy3UuRzdd0bBdhJgI/f8vLXh2GdGs1RVN3G2iEs86kQ=";
     # There should be an IOStreamFamily project here, but they haven't released it :(
-    IOUSBFamily                          = fetchApple "osx-10.8.5"  "1znqb6frxgab9mkyv7csa08c26p9p0ip6hqb4wm9c7j85kf71f4j"; # This is from 10.8 :(
-    IOUSBFamily_older                    = fetchApple "osx-10.8.4"  "113lmpz8n6sibd27p42h8bl7a6c3myc6zngwri7gnvf8qlajzyml" "IOUSBFamily"; # This is even older :(
-    IOKitUser                            = fetchApple "osx-10.10.5" "1jzndziv97bhjxmla8nib5fpcswbvsxr04447g251ls81rw313lb";
+    IOUSBFamily                          = fetchApple "osx-10.8.5"  "sha256-FwgGoP97Sj47VGXMxbY0oUugKf7jtxAL1RzL6+315cU="; # This is from 10.8 :(
+    IOUSBFamily_older                    = fetchApple "osx-10.8.4"  "sha256-5apCsqtHK0EC8x1uPTTll43x69eal/nsokfS80qLlxs=" "IOUSBFamily"; # This is even older :(
+    IOKitUser                            = fetchApple "osx-10.10.5" "sha256-3UHM3g91v4RugmONbM+SAPr1SfoUPY3QPcTwTpt+zuY=";
     # There should be an IOVideo here, but they haven't released it :(
   };
 
@@ -234,7 +234,7 @@ let
   in applePackage' namePath version sdkName sha256;
 
   # Only used for bootstrapping. It’s convenient because it was the last version to come with a real makefile.
-  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
+  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "sha256-/OJLNpATyS31W5nWfJgSVO5itp8j55TRwG57/QLT5Fg=" {};
 
 in
 
@@ -242,70 +242,72 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     # TODO: shorten this list, we should cut down to a minimum set of bootstrap or necessary packages here.
 
     inherit (adv_cmds-boot) ps locale;
-    architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
-    bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "11a9kkhz5bfgi1i8kpdkis78lhc6b5vxmhd598fcdgra1jw4iac2" {};
-    CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "1zam29847cxr6y9rnl76zqmkbac53nx0szmqm9w5p469a6wzjqar" {};
-    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "0sgsqjcxbdm2g2zfpc50mzmk4b4ldyw7xvvkwiayhpczg1fga4ff" {};
-    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
-      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    architecture    = applePackage "architecture"      "osx-10.11.6"     "sha256-cUKeMx6mOAxBSRHIdfzsrR65Qv86m7+20XvpKqVfwVI=" {};
+    bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "sha256-CW8zP5QZMhWTGp+rhrm8oHE/vSLsRlv1VRAGe1OUDmI=" {};
+    CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "sha256-UNaHvxzYzEBnYYuoMLqWUVprZa6Wqn/3XleoSCco050=" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "sha256-FLgODBrfv+XsGaAjddncYAm/BIJJYw6LcwX/z7ncKFM=" {};
+    configd         = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
+      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "sha256-7qr0IamjCXCobIJ6V9KtvbMBkJDfRCy4C5eqpHJlQLI=" {};
     };
-    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "0a70bvzndkava1a946cdq42lnjhg7i7b5alpii3lap6r5fkvas0n" {};
-    Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "0hpd6348av463yqf70n3xkygwmf1i5zza8kps4zys52sviqz3a0l" {};
-    dyld            = applePackage "dyld"              "osx-10.12.6"     "0q4jmk78b5ajn33blh4agyq6v2a63lpb3fln78az0dy12bnp1qqk" {};
-    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
-    IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
-    launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
-    libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
-    Libc            = applePackage "Libc"              "osx-10.12.6"     "183wcy1nlj2wkpfsx3k3lyv917mk8r2p72qw8lb89mbjsw3yw0xx" {
-      Libc_10-9 = fetchzip {
-        url    = "http://www.opensource.apple.com/tarballs/Libc/Libc-997.90.3.tar.gz";
-        sha256 = "1xchgxkxg5288r2b9yfrqji2gsgdap92k4wx2dbjwslixws12pq7";
+    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "sha256-uHqLFOIpXK+n0RHyOZzVsP2DDZcFDivKCnqHBaXvHns=" {};
+    Csu             = applePackage "Csu"               "osx-10.11.6"     "sha256-h6a/sQMEVeFxKNWAPgKBXjWhyL2L2nvX9BQUMaTQ6sY=" {};
+    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "sha256-Icr22ozixHquI0kRB2XZ+LlxD6V46sJHsHy4L/tDXZg=" {};
+    dyld            = applePackage "dyld"              "osx-10.12.6"     "sha256-JmKnOZtBPf96zEx7vhYHLBSTOPyKN71IdYE3R0IeJww=" {};
+    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "sha256-54P3+YhVhOanoZQoqswDnr/GbR/AdEERse135nyuIQo=" {};
+    IOKit           = applePackage "IOKit"             "osx-10.11.6"     "" { inherit IOKitSrcs; };
+    launchd         = applePackage "launchd"           "osx-10.9.5"      "sha256-dmV0UK7hG9wvTr+F4Z47nCFXcVZCV+cQ46WbE0DBtJs=" {};
+    libauto         = applePackage "libauto"           "osx-10.9.5"      "sha256-GnRcKq8jRbEsI/PSDphwUjWtpEIEcnLlQL9yxYLgSsU=" {};
+    Libc            = applePackage "Libc"              "osx-10.12.6"     "sha256-LSsL7S3KFgGU9qjK4atu/4wBh8ftgfsk6JOvg+ZTZOY=" {
+      Libc_10-9 = fetchFromGitHub {
+        owner  = "apple-oss-distributions";
+        repo   = "Libc";
+        rev    = "Libc-997.90.3";
+        hash   = "sha256-B18RNO+Rai5XE52TKdJV7eknosTZ+bRERkiU12d/kPU=";
       };
-      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
+      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "sha256-JvPSY7FzraGpqF/jYLfhU2o/2195NuKrXsryYfVtx3s=" {};
     };
-    libclosure      = applePackage "libclosure"        "osx-10.11.6"     "1zqy1zvra46cmqv6vsf1mcsz3a76r9bky145phfwh4ab6y15vjpq" {};
-    libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "0jsfbzp87lwk9snlby0hd4zvj7j894p5q3cw0wdx9ny1mcp3kdcj" {};
-    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "1gg5h6z8sk851bhv87vyxzs54jmqz6lh57ny8j4s51j7srja0nly" {};
-    Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
-    Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "0p5qhvalf6j1w6n8xwywhn6dvbpzv74q5wqrgs8rwfpf74wg6s9z" {};
-    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
-    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
-    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {};
-    libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
-    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
-    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
-    objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
-    ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
-    removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
+    libclosure      = applePackage "libclosure"        "osx-10.11.6"     "sha256-L5rQ+UBpf3B+W1U+gZKk7fXulslHsc8lxnCsplV+nr0=" {};
+    libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "sha256-jfAEk0OLrJa9AIZVikIoHomd+l+4rCfc320Xh50qK5M=" {};
+    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "sha256-ZzPFkchK3EU95UQUVVrR0t8iilhi/VnIkjjtP6KT2oI=" {};
+    Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
+    Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
+    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {};
+    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
+    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "sha256-FtvwjJKSFX6j9APYPC8WLXVOjbHLZa1Gcoc8yxLy8qE=" {};
+    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "sha256-zvRdCP//TjKCGAqm/5nJXPppshU1cv2fg/L/yK/olGQ=" {};
+    libutil         = applePackage "libutil"           "osx-10.12.6"     "sha256-4PFuk+CTLwvd/Ll9GLBkiIM0Sh/CVaiKwh5m1noheRs=" {};
+    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "sha256-CC0sndP/mKYe3dZu3v7fjuDASV4V4w7dAcnWMvpoquE=" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "sha256-ddZr6tropkpdMJhq/kUlm3OwO8b0yxtkrMpwec8R4FY=" {};
+    objc4           = applePackage "objc4"             "osx-10.12.6"     "sha256-ZsxRpdsfv3Dxs7yBBCkjbKXKR6aXwkEpxc1XYXz7ueM=" {};
+    ppp             = applePackage "ppp"               "osx-10.12.6"     "sha256-M1zoEjjeKIDUEP6ACbpUJk3OXjobw4g/qzUmxGdX1J0=" {};
+    removefile      = applePackage "removefile"        "osx-10.12.6"     "sha256-UpNk27kGXnZss1ZXWVJU9jLz/NW63ZAZEDLhyCYoi9M=" {};
     xnu             = if stdenv.isx86_64 then
-    applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {
+    applePackage "xnu"               "osx-10.12.6"     "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {
       python3 = pkgs.buildPackages.buildPackages.python3; # TODO(@Ericson2314) this shouldn't be needed.
     }
     else macosPackages_11_0_1.xnu;
-    hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
-    Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
-    basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
-    developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
-    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {
+    hfs             = applePackage "hfs"               "osx-10.12.6"     "sha256-eGi18HQFJrU5UHoBOE0LqO5gQ0xOf8+OJuAWQljfKE4=" {};
+    Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "sha256-YHbGws901xONzAbo6sB5zSea4Wp0sgYUJ8YgwVfWxnE=" {};
+    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"     "sha256-Ztp8ALWcviEpthoiY8ttWzGI8OcsLzsULjlqe8GIzw8=" {};
+    basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "sha256-BYPPTg4/7x6RPs0WwwQlkNiZxxArV+7EVe6bM+a/I6Q=" {};
+    developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "sha256-h0wMVlS6QdRvKOVJ74W9ziHYGApjvnk77AIR6ukYBRo=" {};
+    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "sha256-VX+hcZ7JhOA8EhwLloPlM3Yx79RXp9OYHV9Mi10uw3Q=" {
       macosPackages_11_0_1 = macosPackages_11_0_1;
     };
     network_cmds    = if stdenv.isx86_64 then
-      applePackage "network_cmds" "osx-10.11.6" "0lhi9wz84qr1r2ab3fb4nvmdg9gxn817n5ldg7zw9gnf3wwn42kw" {}
+      applePackage "network_cmds" "osx-10.11.6" "sha256-I89CLIswGheewOjiNZwQTgWvWbhm0qtB5+KUqzxnQ5M=" {}
     else macosPackages_11_0_1.network_cmds;
-    file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "1zfxbmasps529pnfdjvc13p7ws2cfx8pidkplypkswyff0nff4wp" {};
-    shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
-    system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "1h46j2c5v02pkv5d9fyv6cpgyg0lczvwicrx6r9s210cl03l77jl" {};
-    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "1f93m7dd0ghqb2hwh905mjhzblyfr7dwffw98xhgmv1mfdnigxg0" {};
-    top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
-    PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
+    file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "sha256-JYy6HwmultKeZtLfaysbsyLoWg+OaTh7eJu54JkJC0Q=" {};
+    shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "sha256-kmEOprkiJGMVcl7yHkGX8ymk/5KjE99gWuF8j2hK5hY=" {};
+    system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "sha256-KBdGlHeXo2PwgRQOOeElJ1RBqCY1Tdhn5KD42CMhdzI=" {};
+    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "sha256-KSebU7ZyUsPeqn51nzuGNaNxs9pvmlIQQdkWXIVzDxw=" {};
+    top             = applePackage "top"               "osx-10.11.6"     "sha256-jbz64ODogtpNyLpXGSZj1jCBdFPVXcVcBkL1vc7g5qQ=" {};
+    PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "sha256-bYGtYnBOcE5W03AZzfVTJXPZ6GgryGAMt/LgLPxFkVk=" {};
 
     # `configdHeaders` can’t use an override because `pkgs.darwin.configd` on aarch64-darwin will
     # be replaced by SystemConfiguration.framework from the macOS SDK.
-    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
+    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
       headersOnly = true;
       Security    = null;
     };
@@ -315,5 +317,5 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
 
     # TODO(matthewbauer):
     # To be removed, once I figure out how to build a newer Security version.
-    Security        = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    Security        = applePackage "Security/boot.nix" "osx-10.9.5"      "sha256-7qr0IamjCXCobIJ6V9KtvbMBkJDfRCy4C5eqpHJlQLI=" {};
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
index f57d224615f4..7eeafec34655 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
@@ -3,6 +3,6 @@
 { applePackage' }:
 
 {
-bootstrap_cmds = applePackage' "bootstrap_cmds" "116" "developer-tools-11.3.1" "148xpqkf5xzpslqxch5l8h6vsz7sys8sdzk4ghbg9mkcivp8qa03" {};
-developer_cmds = applePackage' "developer_cmds" "66" "developer-tools-11.3.1" "0q08m4cxxwph7gxqravmx13l418p1i050bd46zwksn9j9zpw9mlr" {};
+bootstrap_cmds = applePackage' "bootstrap_cmds" "116" "developer-tools-11.3.1" "06nw99ajkd264vdi6n2zv252ppxp3wx3120hqf3jqdh6c1wavy0b" {};
+developer_cmds = applePackage' "developer_cmds" "66" "developer-tools-11.3.1" "0f7vphpscjcypq49gjckbs20xhm7yjalr4nnbphqcqp8v1al56dc" {};
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 18233cfc5227..23a5ae006712 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -18,7 +18,7 @@ appleDerivation {
 
   # Workaround build failure on -fno-common toolchains:
   #   duplicate symbol '_btype_2' in:args.o pr_comment.o
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index ec252dca41c2..30d123ab804c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -8,7 +8,7 @@ in appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ libutil ];
 
-  NIX_CFLAGS_COMPILE = "-I.";
+  env.NIX_CFLAGS_COMPILE = "-I.";
   NIX_LDFLAGS = "-lutil";
   patchPhase = ''
     # ugly hacks for missing headers
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 1f13cbef9fc9..afff7897488e 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -1,12 +1,12 @@
-{ appleDerivation, xcbuildHook, CoreSymbolication
-, xnu, bison, flex, darling, stdenv, fixDarwinDylibNames }:
+{ appleDerivation, xcbuildHook, CoreSymbolication, apple_sdk
+, xnu, bison, flex, stdenv, fixDarwinDylibNames }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
-  buildInputs = [ CoreSymbolication darling xnu ];
+  buildInputs = [ CoreSymbolication apple_sdk.frameworks.CoreSymbolication xnu ];
   # -fcommon: workaround build failure on -fno-common toolchains:
   #   duplicate symbol '_kCSRegionMachHeaderName' in: libproc.o dt_module_apple.o
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration -fcommon";
+  env.NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration -fcommon";
   NIX_LDFLAGS = "-L./Products/Release";
   xcbuildFlags = [ "-target" "dtrace_frameworks" "-target" "dtrace" ];
 
@@ -21,6 +21,8 @@ appleDerivation {
       --replace /usr/bin/ld ${stdenv.cc.bintools.bintools}/bin/ld \
       --replace /usr/lib/dtrace/dt_cpp.h $out/include/dt_cpp.h \
       --replace /usr/lib/dtrace $out/lib/dtrace
+    substituteInPlace libproc/libproc.c \
+      --replace "#include <sandbox/rootless.h>" ""
   '';
 
   # hack to handle xcbuild's broken lex handling
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index cfa66d2c3536..8d44cc86194f 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -19,7 +19,7 @@ appleDerivation {
 
   # Workaround build failure on -fno-common toolchains:
   #   duplicate symbol '_chdname' in: ar_io.o tty_subs.o
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
index d7c3fc89c525..418a1d625d6a 100755
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
@@ -1,8 +1,16 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl
+#!nix-shell -i bash -p curl jq
 
-# usage:
-#   generate-sdk-packages.sh macos 11.0.1
+usage() {
+    cat <<EOF
+usage: $0 macos 11.0.1
+EOF
+}
+
+if [ "$#" != 2 ]; then
+    usage
+    exit 1
+fi
 
 cd $(dirname "$0")
 
@@ -16,14 +24,14 @@ outfile="$sdkName.nix"
 {"
 
 parse_line() {
-    readarray -t -d$'\t' package <<<$2
+    readarray -t -d$'-' package < <(printf "%s" $2)
     local pname=${package[0]} version=${package[1]}
 
     if [ -d $pname ]; then
-        sha256=$(nix-prefetch-url "https://opensource.apple.com/tarballs/$pname/$pname-$version.tar.gz")
+        sha256=$(nix-prefetch-url "https://github.com/apple-oss-distributions/$pname/archive/refs/tags/$pname-$version.tar.gz")
         >>$outfile echo "$pname = applePackage' \"$pname\" \"$version\" \"$sdkName\" \"$sha256\" {};"
     fi
 }
-readarray -s1 -c1 -C parse_line < <(curl -sS "https://opensource.apple.com/text/${sdkName//./}.txt")
+readarray -s1 -c1 -C parse_line < <(curl -sSL "https://github.com/apple-oss-distributions/distribution-${1//-/_}/raw/${sdkName//./}/release.json" | jq -r ".projects[].tag")
 
 >>$outfile echo '}'
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
index 64de728805fd..4082f5b760cf 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
@@ -1,8 +1,7 @@
 { appleDerivation', stdenvNoCC }:
 
 appleDerivation' stdenvNoCC {
-  phases = [ "unpackPhase" "installPhase" ];
-
+  dontBuild = true;
   installPhase = ''
     mkdir -p $out/include
     cp mDNSShared/dns_sd.h $out/include
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
index 517f53e9435d..1637ed783895 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
@@ -3,44 +3,44 @@
 { applePackage' }:
 
 {
-adv_cmds = applePackage' "adv_cmds" "176" "macos-11.0.1" "0x8c25rh6fnzndbc26vcb65vcxilvqyfvm2klfyci1wr4bh3ixgk" {};
-architecture = applePackage' "architecture" "279" "macos-11.0.1" "1cgp33ywa30max6cyp69kvii299hx2vgwvmy3ms8n4gaq2mkpaky" {};
-basic_cmds = applePackage' "basic_cmds" "55" "macos-11.0.1" "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
-bootstrap_cmds = applePackage' "bootstrap_cmds" "121" "macos-11.0.1" "09bwclws6adxb1ky9q35f4ikddk4mbalmgds0cmqaf7j23qxl3fv" {};
-CommonCrypto = applePackage' "CommonCrypto" "60178.40.2" "macos-11.0.1" "0r3b1mlfmbdzpwn6pbsbfaga3k63gpwcwbhkbi4r09aq82skl02v" {};
-configd = applePackage' "configd" "1109.40.9" "macos-11.0.1" "173i55wfzli9pg2x2rw437hs68h6l4ngss5jfgf18g26zjkjzv5v" {};
-copyfile = applePackage' "copyfile" "173.40.2" "macos-11.0.1" "0qyp15qj3fdb7yx033n57l7s61d70mv17f43yiwcbhx09mmlrp07" {};
-Csu = applePackage' "Csu" "88" "macos-11.0.1" "029lgcyj0i16036h2lcx6fd6r1yf1bkj5dnvz905rh6ncl8skgdr" {};
-diskdev_cmds = applePackage' "diskdev_cmds" "667.40.1" "macos-11.0.1" "1bqwkwkwd556rba5000ap77xrhaf4xnmy83mszd7a0yvl2xlma7j" {};
-dtrace = applePackage' "dtrace" "370.40.1" "macos-11.0.1" "1941yczmn94ng5zlnhf0i5mjw2f4g7znisgvhkhn5f86gxmd98wl" {};
-dyld = applePackage' "dyld" "832.7.1" "macos-11.0.1" "1s77ca6jg20z91qlph59da8j61m97y23vrw48xs4rywdzh4915n0" {};
-eap8021x = applePackage' "eap8021x" "304.40.1" "macos-11.0.1" "1ph3kcpf527s0jqsi60j2sgg3m8h128spf292d8kyc08siz9mf9c" {};
-file_cmds = applePackage' "file_cmds" "321.40.3" "macos-11.0.1" "04789vn1wghclfr3ma3ncg716xdsxfj66hrcxi5h3h1ryag2ycfz" {};
-hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "1rhkmn2yj5p4wmi4aajy5hj2h0gxk63s8j4qz4ziy4g4bjpdgwmy" {};
-ICU = applePackage' "ICU" "66108" "macos-11.0.1" "1d76cyyqpwkzjlxfajm4nsglxmfrcafbnjwnjxc3j5w3nw67pqhx" {};
-Libc = applePackage' "Libc" "1439.40.11" "macos-11.0.1" "0d5xlnks4lc9391wg31c9126vflb40lc5ffkgxmf2kpyglac1280" {};
-libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "089i2bl4agpnfplrg23xbzma1674g0w05988nxdps6ghxl4kz66f" {};
-libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "0z7r42zfb8y48f0nrw0qw7fanfvimycimgnrg3jig101kjvjar98" {};
-libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0hqbsqggjrr0sv6h70lcr3gabgk9inyc8aq1b30wibgjm6crjwpp" {};
-Libinfo = applePackage' "Libinfo" "542.40.3" "macos-11.0.1" "0y5x6wxd3mwn6my1jdp8qrak3y7x7sgjdmwyw9cvvbn3kg9v6z1p" {};
-Libnotify = applePackage' "Libnotify" "279.40.4" "macos-11.0.1" "0aswflxki877izp6sacv35sydn6a3639cflv3zhs3i7vkfbsvbf5" {};
-libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1mhi8n66864y98dr3n0pkqad3aqim800kn9bxzp6h5jf2jni3aql" {};
-libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "18rb4dqjdf3krzi4hdj5i310gy49ipf01klbkp9g51i02a55gphq" {};
-libresolv = applePackage' "libresolv" "68" "macos-11.0.1" "1ysvg6d28xyaky9sn7giglnsflhjsbj17h3h3i6knlzxnzznpkql" {};
-Librpcsvc = applePackage' "Librpcsvc" "26" "macos-11.0.1" "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-Libsystem = applePackage' "Libsystem" "1292.50.1" "macos-11.0.1" "0w16zaigq18jfsnw15pfyz2mkfqdkn0cc16q617kmgw2khld8j7j" {};
-libunwind = applePackage' "libunwind" "200.10" "macos-11.0.1" "1pmymcqpfk7lfxh6zqch429vfpvmd2m1dlg898170pkx5zhxisl2" {};
-libutil = applePackage' "libutil" "58.40.2" "macos-11.0.1" "1hhgashfj9g4vjv02070c5pn818a5n0bh5l81l2pflmvb2rrqs3f" {};
-mDNSResponder = applePackage' "mDNSResponder" "1310.40.42" "macos-11.0.1" "0d0b9wwah9rg7rwrr29dxd6iy0y4rlmss3wcz2wcqmnd2qb9x8my" {};
-network_cmds = applePackage' "network_cmds" "606.40.2" "macos-11.0.1" "1dlslk67npvmxx5m50385kmn3ysxih2iv220hhzkin11f8abdjv7" {};
-objc4 = applePackage' "objc4" "818.2" "macos-11.0.1" "177gmh9m9ajy6mvcd2sf7gqydgljy44n3iih0yqsn1b13j784azx" {};
-PowerManagement = applePackage' "PowerManagement" "1132.50.3" "macos-11.0.1" "1n5yn6sc8w67g8iism6ilkyl33j46gcnlqcaq6k16zkngx6lprba" {};
-ppp = applePackage' "ppp" "877.40.2" "macos-11.0.1" "1z506z8ndvb1lfr4pypfy2bnig6qimhmq3yhjvqwfnliv91965iq" {};
-removefile = applePackage' "removefile" "49.40.3" "macos-11.0.1" "1fhp47awi15f02385r25qgw1ag5z0kr1v3kvgqm3r8i8yysfqvwp" {};
-Security = applePackage' "Security" "59754.41.1" "macos-11.0.1" "00kqgg7k80ba70ar2c02f0q9yrdgqcb56nb9z5g0bxwkvi40ryph" {};
-shell_cmds = applePackage' "shell_cmds" "216.40.4" "macos-11.0.1" "1mvp1fp34kkm4mi85fdn3i0l0gig4c0w09zg2mvkpxcf68cq2f69" {};
-system_cmds = applePackage' "system_cmds" "880.40.5" "macos-11.0.1" "1kys4vwfz4559sspdsfhmxc238nd8qgylqypza3zdzaqhfh7lx2x" {};
-text_cmds = applePackage' "text_cmds" "106" "macos-11.0.1" "0cpnfpllwpx20hbxzg5i5488gcjyi9adnbac1sd5hpv3bq6z1hs5" {};
-top = applePackage' "top" "129" "macos-11.0.1" "1nyz5mvq7js3zhsi3dwxl5fslg6m7nhlgc6p2hr889xgyl5prw8f" {};
-xnu = applePackage' "xnu" "7195.50.7.100.1" "macos-11.0.1" "14wqkqp3lcxgpm1sjnsysybrc4ppzkghwv3mb5nr5v8ml37prkib" {};
+CommonCrypto = applePackage' "CommonCrypto" "60178.40.2" "macos-11.0.1" "129gsxhhcxqycg0zjrdrz2ay4dv2ih1ckafqh33qrc499z8dam2p" {};
+Csu = applePackage' "Csu" "88" "macos-11.0.1" "1lzp9x8iv60c2h12q2s89nf49b5hvpqq4a9li44zr2fxszn8lqxh" {};
+ICU = applePackage' "ICU" "66108" "macos-11.0.1" "0mclizp99daihghqy2sgzjkid8i93dsn5pi8q9p7b3156chrhw57" {};
+Libc = applePackage' "Libc" "1439.40.11" "macos-11.0.1" "12k5sbz2k1pl839w2lk9iw414zzl50zdjzgq2x6bm20yjbfj69qm" {};
+Libinfo = applePackage' "Libinfo" "542.40.3" "macos-11.0.1" "18jvl7cdg64x6clhsfv5pbzxis2aldddpca5r81xqakrmi9mck80" {};
+Libnotify = applePackage' "Libnotify" "279.40.4" "macos-11.0.1" "1vr11s0c42ssjs29shy1m8rj008np7aswdzjpimsfzyav47jb6y7" {};
+Librpcsvc = applePackage' "Librpcsvc" "26" "macos-11.0.1" "0wf6srbw28664wa0dckldbhrl9ydg70fms06rj6i7mvlrz1ccxk0" {};
+Libsystem = applePackage' "Libsystem" "1292.50.1" "macos-11.0.1" "0d3flh1p4kskic8ypi8wia4kinfbprx9fvyfqc3mcq0710i0gy77" {};
+PowerManagement = applePackage' "PowerManagement" "1132.50.3" "macos-11.0.1" "1sb2nz92vdf6v3h17ry0vgw0z9zsva82lhdrhsf3k60jhfw1fi2v" {};
+Security = applePackage' "Security" "59754.41.1" "macos-11.0.1" "0jq70mnwkvrrhws64ipx0i68pi3n0sk95jlhacxxikdj9f4hpbsw" {};
+adv_cmds = applePackage' "adv_cmds" "176" "macos-11.0.1" "0sskwl3jc7llbrlyd1i7qlb03yhm1xkbxd1k9xhh7f9wqhlzq31j" {};
+architecture = applePackage' "architecture" "279" "macos-11.0.1" "19s93rqr9r98qh0rlndf7kv3v4n1ifh9i539mbpsx6kbixcx8vvp" {};
+basic_cmds = applePackage' "basic_cmds" "55" "macos-11.0.1" "1913pzk376zfap2fwmrb233rkn4h4l2c65nd7s8ixvrz1r7cz0q5" {};
+bootstrap_cmds = applePackage' "bootstrap_cmds" "121" "macos-11.0.1" "0qgbgwijv7xqmm9gn74jibyw2dh516xpj7h1grj2j1i80m3b16bl" {};
+configd = applePackage' "configd" "1109.40.9" "macos-11.0.1" "024ny63lpwzgnm8g28hh8dldvmmislmrl298n721rm0blqjhahz5" {};
+copyfile = applePackage' "copyfile" "173.40.2" "macos-11.0.1" "1j20909inn2iw8n51b8vk551wznfi3bhfziy8nbv08qj5lk50m04" {};
+diskdev_cmds = applePackage' "diskdev_cmds" "667.40.1" "macos-11.0.1" "0wr60vyvgkbc4wyldnsqas0xss2k1fgmbdk3vnhj6v6jqa98l1ny" {};
+dtrace = applePackage' "dtrace" "370.40.1" "macos-11.0.1" "1qj74mix1x3drffr1qpafm57aby42bc61kynba5q0ppbcf0lrbp1" {};
+dyld = applePackage' "dyld" "832.7.1" "macos-11.0.1" "01q7fsibr6xp94l3w22sh8qfjgwzzf1v82mhgq39ivkxwwc4jdy0" {};
+eap8021x = applePackage' "eap8021x" "304.40.1" "macos-11.0.1" "1aihyklri64w380d1mvi830n5cnzs9gd38z8i9ccd37n48gmz88p" {};
+file_cmds = applePackage' "file_cmds" "321.40.3" "macos-11.0.1" "0p077lnbcy8266m03a0fssj4214bjxh88y3qkspnzcvi0g84k43q" {};
+hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "0a0s6b12b0q07wslfifna0bj51dml9v098i4crr2m1vivnx4xj75" {};
+libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "0vf9n0k3m8dbprv1bf45zqg0g43bidy2i5z1v9a826bsf8lv7am7" {};
+libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "1ck5srcjapg18vqb8wl08gacs7ndc6xr067qjn3ngx39q1jdcywz" {};
+libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0lwa4brdwm4lvrdnxylzsn1yph4m7csgri2zkc4xb4xiisz32pwp" {};
+libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1qf3ri0yd8b1xjln1j1gyx7ks6k3a2jhd63blyvfby75y9s7flky" {};
+libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "0zljbw8mpb80n1if65hhi9lkgwbgjr8vc9wvf7q1nl3mzyl35f8p" {};
+libresolv = applePackage' "libresolv" "68" "macos-11.0.1" "045ahh8nvaam9whryc2f5g5xagwp7d187r80kcff82snp5p66aq1" {};
+libunwind = applePackage' "libunwind" "200.10" "macos-11.0.1" "0wa4ssr7skn5j0ncm1rigd56qmbs982zvwr3qpjn28krwp8wvigd" {};
+libutil = applePackage' "libutil" "58.40.2" "macos-11.0.1" "11s0vizk7bg0k0yjx21j8vaji4j4vk57131qbp07i9lpksb3bcy4" {};
+mDNSResponder = applePackage' "mDNSResponder" "1310.40.42" "macos-11.0.1" "0xxrqqbqsf0pagfs1yzwfbwf7lhr0sns97k18y7kh4ri0p09h44c" {};
+network_cmds = applePackage' "network_cmds" "606.40.2" "macos-11.0.1" "1jsy13nraarafq6wmgh3wyir8wrwfra148xsjns7cw7q5xn40a1w" {};
+objc4 = applePackage' "objc4" "818.2" "macos-11.0.1" "0m8mk1qd18wqjfn2jsq2lx6fxvllhmadmvz11jzg8vjw8pq91nw2" {};
+ppp = applePackage' "ppp" "877.40.2" "macos-11.0.1" "06xznc77j45zzi12m4cmr3jj853qlc8dbmynbg1z6m9qf5phdbgk" {};
+removefile = applePackage' "removefile" "49.40.3" "macos-11.0.1" "0870ihxpmvj8ggaycwlismbgbw9768lz7w6mc9vxf8l6nlc43z4f" {};
+shell_cmds = applePackage' "shell_cmds" "216.40.4" "macos-11.0.1" "0wbysc9lwf1xgl686r3yn95rndcmqlp17zc1ig9gsl5fxyy5bghh" {};
+system_cmds = applePackage' "system_cmds" "880.40.5" "macos-11.0.1" "064yqf84ny0cjpqmzmnhz05faay6axb2r4i6knnyc8n21yiip5dc" {};
+text_cmds = applePackage' "text_cmds" "106" "macos-11.0.1" "17fn35m6i866zjrf8da6cq6crydp6vp4zq0aaab243rv1fx303yy" {};
+top = applePackage' "top" "129" "macos-11.0.1" "0d9pqmv3mwkfcv7c05hfvnvnn4rbsl92plr5hsazp854pshzqw2k" {};
+xnu = applePackage' "xnu" "7195.50.7.100.1" "macos-11.0.1" "11zjmpw11rcc6a0xlbwramra1rsr65s4ypnxwpajgbr2c657lipl" {};
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 9a95eb04e6ef..600571f22256 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -1,26 +1,24 @@
 { lib, appleDerivation, xcbuildHook, stdenv
-, libressl_3_4, Librpcsvc, xnu, libpcap, developer_cmds }:
+, Librpcsvc, xnu, libpcap, developer_cmds }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ libressl_3_4 xnu Librpcsvc libpcap developer_cmds ];
+  buildInputs = [ xnu Librpcsvc libpcap developer_cmds ];
 
   # Work around error from <stdio.h> on aarch64-darwin:
   #     error: 'TARGET_OS_IPHONE' is not defined, evaluates to 0 [-Werror,-Wundef-prefix=TARGET_OS_]
-  NIX_CFLAGS_COMPILE = "-Wno-error=undef-prefix -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=undef-prefix -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
 
   # "spray" requires some files that aren't compiling correctly in xcbuild.
   # "rtadvd" seems to fail with some missing constants.
   # "traceroute6" and "ping6" require ipsec which doesn't build correctly
+  # "unbound" doesn’t build against supported versions of OpenSSL or LibreSSL
   patchPhase = ''
     substituteInPlace network_cmds.xcodeproj/project.pbxproj \
       --replace "7294F0EA0EE8BAC80052EC88 /* PBXTargetDependency */," "" \
       --replace "7216D34D0EE89FEC00AE70E4 /* PBXTargetDependency */," "" \
       --replace "72CD1D9C0EE8C47C005F825D /* PBXTargetDependency */," "" \
-      --replace "7216D2C20EE89ADF00AE70E4 /* PBXTargetDependency */," ""
-  '' + lib.optionalString stdenv.isAarch64 ''
-    # "unbound" does not build on aarch64
-    substituteInPlace network_cmds.xcodeproj/project.pbxproj \
+      --replace "7216D2C20EE89ADF00AE70E4 /* PBXTargetDependency */," "" \
       --replace "71D958C51A9455A000C9B286 /* PBXTargetDependency */," ""
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
index 2fc4afa77d9f..315f0fb06219 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
@@ -1,8 +1,6 @@
 { appleDerivation, darwin-stubs }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
   # Not strictly necessary, since libSystem depends on it, but it's nice to be explicit so we
   # can easily find out what's impure.
   __propagatedImpureHostDeps = [
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index d42d142ef6ee..0c40bc3b1868 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -9,10 +9,10 @@ appleDerivation {
 
   buildInputs = [ libutil Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
                   apple_sdk.frameworks.IOKit openbsm ];
-  # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
+  # env.NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
   #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
-  NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
+  env.NIX_CFLAGS_COMPILE = toString ([ "-DDAEMON_UID=1"
                          "-DDAEMON_GID=1"
                          "-DDEFAULT_AT_QUEUE='a'"
                          "-DDEFAULT_BATCH_QUEUE='b'"
@@ -28,7 +28,7 @@ appleDerivation {
                          "-DAHZV1=64 "
                          "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
                          "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
-                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
 
   patchPhase = ''
     substituteInPlace login.tproj/login.c \
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 672bb443242b..c99523d6c861 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -20,7 +20,7 @@ appleDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE=[ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
 
   meta = {
     platforms = lib.platforms.darwin;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index ef766f7bd7f1..2a47de021dc6 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -5,7 +5,7 @@ appleDerivation {
   buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
   # Workaround build failure on -fno-common toolchains:
   #   duplicate symbol '_tsamp' in: main.o top.o
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
   NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 8b0d2054d58a..62003a6e4a6c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -12,7 +12,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
 
   nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
 
-  patches = lib.optional stdenv.isx86_64 [ ./python3.patch ];
+  patches = lib.optionals stdenv.isx86_64 [ ./python3.patch ];
 
   postPatch = ''
     substituteInPlace Makefile \
@@ -34,7 +34,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace "-Werror " ""
 
     substituteInPlace SETUP/kextsymboltool/Makefile \
-      --replace "-lstdc++" "-lc++"
+      --replace "-lstdc++" "-lc++ -lc++abi"
 
     substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
       --replace "/usr/include" "/include" \
@@ -75,7 +75,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
   ARCHS = arch;
   ARCH_CONFIGS = arch;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preBuild = let macosVersion =
     "10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11" +
diff --git a/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix b/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix
new file mode 100644
index 000000000000..071b6324df3e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, python3
+, fetchPypi
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "asitop";
+  version = "0.0.23";
+  format = "setuptools";
+
+  disabled = python3.pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-BNncgQRNAd6Pgur5D1xVQi3LSsijSAYIYvhsuiVyi9Q=";
+  };
+
+  # has no tests
+  doCheck = false;
+
+  propagatedBuildInputs = with python3.pkgs; [
+    dashing
+    psutil
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/tlkh/asitop";
+    description = "Perf monitoring CLI tool for Apple Silicon";
+    platforms = platforms.darwin;
+    license = licenses.mit;
+    maintainers = with maintainers; [ juliusrickert ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/binutils/default.nix b/nixpkgs/pkgs/os-specific/darwin/binutils/default.nix
index c5bc50cafd71..d7bdac6ceea3 100644
--- a/nixpkgs/pkgs/os-specific/darwin/binutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, makeWrapper, binutils-unwrapped, cctools, llvm, clang-unwrapped }:
+{ lib, stdenv, makeWrapper, binutils-unwrapped, cctools, llvm, clang-unwrapped, dualAs ? false }:
 
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same targetPrefix.
@@ -15,7 +15,7 @@ in
 
 # TODO: loop over targetPrefixed binaries too
 stdenv.mkDerivation {
-  pname = "${targetPrefix}cctools-binutils-darwin";
+  pname = "${targetPrefix}cctools-binutils-darwin" + lib.optionalString dualAs "-dualas";
   inherit (cctools) version;
   outputs = [ "out" "man" ];
   buildCommand = ''
@@ -59,12 +59,37 @@ stdenv.mkDerivation {
     rm $out/bin/${targetPrefix}as
     makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
       --add-flags "-x assembler -integrated-as -c"
+  ''
+  # x86-64 Darwin gnat-bootstrap emits assembly
+  # with MOVQ as the mnemonic for quadword interunit moves
+  # such as `movq %rbp, %xmm0`.
+  # The clang integrated assembler recognises this as valid,
+  # but unfortunately the cctools-port GNU assembler does not;
+  # it instead uses MOVD as the mnemonic.
+  # The assembly that a GCC build emits is determined at build time
+  # and cannot be changed afterwards.
+  #
+  # To build GNAT on x86-64 Darwin, therefore,
+  # we need both the clang _and_ the cctools-port assemblers to be available:
+  # the former to build at least the stage1 compiler,
+  # and the latter at least to be detectable
+  # as the target for the final compiler.
+  #
+  # We choose to match the Aarch64 case above,
+  # wrapping the clang integrated assembler as `as`.
+  # It then seems sensible to wrap the cctools GNU assembler as `gas`.
+  #
+  + lib.optionalString (stdenv.isx86_64 && dualAs) ''
+    mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
+    makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+      --add-flags "-x assembler -integrated-as -c"
   '';
 
-  nativeBuildInputs = lib.optionals stdenv.isAarch64 [ makeWrapper ];
+  nativeBuildInputs = lib.optionals (stdenv.isAarch64 || dualAs) [ makeWrapper ];
 
   passthru = {
     inherit targetPrefix;
+    isCCTools = true;
   };
 
   meta = {
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/apple.nix b/nixpkgs/pkgs/os-specific/darwin/cctools/apple.nix
new file mode 100644
index 000000000000..7adcfa9539a2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/apple.nix
@@ -0,0 +1,122 @@
+{ lib, stdenv, fetchFromGitHub, symlinkJoin, xcbuildHook, tcsh, libobjc, libtapi, libunwind, llvm, memstreamHook, xar }:
+
+let
+
+cctools = stdenv.mkDerivation rec {
+  pname = "cctools";
+  version = "973.0.1";
+
+  src = fetchFromGitHub {
+    owner = "apple-oss-distributions";
+    repo = "cctools";
+    rev = "${pname}-${version}";
+    hash = "sha256-0NlDqy3zeg4D0MbDipx0sMYDfzYa63Jxfsckzz/928o=";
+  };
+
+  patches = [
+    ./cctools-add-missing-vtool-libstuff-dep.patch
+  ];
+
+  postPatch = ''
+    for file in libstuff/writeout.c misc/libtool.c misc/lipo.c; do
+      substituteInPlace "$file" \
+        --replace '__builtin_available(macOS 10.12, *)' '0'
+    done
+    substituteInPlace libmacho/swap.c \
+      --replace '#ifndef RLD' '#if 1'
+  '';
+
+  nativeBuildInputs = [ xcbuildHook memstreamHook ];
+  buildInputs = [ libobjc llvm ];
+
+  xcbuildFlags = [
+    "MACOSX_DEPLOYMENT_TARGET=10.12"
+  ];
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    Products/Release/libstuff_test
+    rm Products/Release/libstuff_test
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf "$out/usr"
+    mkdir -p "$out/bin"
+    find Products/Release -maxdepth 1 -type f -perm 755 -exec cp {} "$out/bin/" \;
+    cp -r include "$out/"
+
+    ln -s ./nm-classic "$out"/bin/nm
+    ln -s ./otool-classic "$out"/bin/otool
+
+    runHook postInstall
+  '';
+};
+
+ld64 = stdenv.mkDerivation rec {
+  pname = "ld64";
+  version = "609";
+
+  src = fetchFromGitHub {
+    owner = "apple-oss-distributions";
+    repo = "ld64";
+    rev = "${pname}-${version}";
+    hash = "sha256-WAaphem6NS4eCHL/pISlDXnO1CDYTgSrVGzcothh4/Q=";
+  };
+
+  postPatch = ''
+    substituteInPlace ld64.xcodeproj/project.pbxproj \
+      --replace "/bin/csh" "${tcsh}/bin/tcsh" \
+      --replace 'F9E8D4BE07FCAF2A00FD5801 /* PBXBuildRule */,' "" \
+      --replace 'F9E8D4BD07FCAF2000FD5801 /* PBXBuildRule */,' ""
+
+    sed -i src/ld/Options.cpp -e '1iconst char ldVersionString[] = "${version}";'
+  '';
+
+  nativeBuildInputs = [ xcbuildHook ];
+  buildInputs = [
+    libtapi
+    libunwind
+    llvm
+    xar
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    find Products/Release-assert -maxdepth 1 -type f -perm 755 -exec cp {} "$out/bin/" \;
+
+    runHook postInstall
+  '';
+};
+
+in
+
+symlinkJoin rec {
+  name = "cctools-${version}";
+  version = "${cctools.version}-${ld64.version}";
+
+  paths = [
+    cctools
+    ld64
+  ];
+
+  # workaround for the fetch-tarballs script
+  passthru = {
+    inherit (cctools) src;
+    ld64_src = ld64.src;
+  };
+
+  meta = with lib; {
+    description = "MacOS Compiler Tools";
+    homepage = "http://www.opensource.apple.com/source/cctools/";
+    license = licenses.apsl20;
+    platforms = platforms.darwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/cctools-add-missing-vtool-libstuff-dep.patch b/nixpkgs/pkgs/os-specific/darwin/cctools/cctools-add-missing-vtool-libstuff-dep.patch
new file mode 100644
index 000000000000..1cd65ec6bcf1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/cctools-add-missing-vtool-libstuff-dep.patch
@@ -0,0 +1,11 @@
+diff -ru a/cctools.xcodeproj/project.pbxproj b/cctools.xcodeproj/project.pbxproj
+--- a/cctools.xcodeproj/project.pbxproj	2021-02-24 20:30:55.000000000 -0500
++++ b/cctools.xcodeproj/project.pbxproj	2022-01-31 20:01:09.000000000 -0500
+@@ -2558,6 +2558,7 @@
+ 			isa = PBXFrameworksBuildPhase;
+ 			buildActionMask = 2147483647;
+ 			files = (
++				DE97E92421F3B86100C7947D /* libstuff.a in Frameworks */,
+ 			);
+ 			runOnlyForDeploymentPostprocessing = 0;
+ 		};
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch b/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch
new file mode 100644
index 000000000000..bb8a4ad68f3b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch
@@ -0,0 +1,21 @@
+MacOS SDKs before 10.13 don't support open_memstream. This is already replaced
+by a runtime check in cctools-port, but because we build with SDK 10.12 by
+default, linking still fails for us. Disable it entirely here.
+
+--- a/cctools/include/stuff/diagnostics.h
++++ b/cctools/include/stuff/diagnostics.h
+@@ -60,13 +60,6 @@ void diagnostics_log_msg(enum diagnostic_level level, const char* message);
+  */
+ void diagnostics_write(void);
+ 
+-#if defined(__APPLE__ ) && defined(__has_builtin)
+-#  if __has_builtin(__builtin_available)
+-#    define HAVE_OPENMEMSTREAM_RUNTIME __builtin_available(macOS 10.13, *)
+-#  endif
+-#endif
+-#ifndef HAVE_OPENMEMSTREAM_RUNTIME
+-#  define HAVE_OPENMEMSTREAM_RUNTIME 1
+-#endif
++#define HAVE_OPENMEMSTREAM_RUNTIME 0
+ 
+ #endif /* diagnostics_h */
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix b/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix
new file mode 100644
index 000000000000..11ec2b4d04fa
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix
@@ -0,0 +1,104 @@
+# Create a cctools-compatible bintools that uses equivalent tools from LLVM in place of the ones
+# from cctools when possible.
+
+{ lib, stdenv, makeWrapper, cctools-port, llvmPackages, enableManpages ? true }:
+
+let
+  cctoolsVersion = lib.getVersion cctools-port;
+  llvmVersion = llvmPackages.release_version;
+
+  # `bitcode_strip` is not available until LLVM 12.
+  useLLVMBitcodeStrip = lib.versionAtLeast llvmVersion "12";
+
+  # A compatible implementation of `otool` was not added until LLVM 13.
+  useLLVMOtool = lib.versionAtLeast llvmVersion "13";
+
+  # Older versions of `strip` cause problems for the version of `codesign_allocate` available in
+  # the version of cctools in nixpkgs. The version of `codesign_allocate` in cctools-1005.2 does
+  # not appear to have issues, but the source is not available yet (as of June 2023).
+  useLLVMStrip = lib.versionAtLeast llvmVersion "15" || lib.versionAtLeast cctoolsVersion "1005.2";
+
+  llvm_bins = [
+    "dwarfdump"
+    "nm"
+    "objdump"
+    "size"
+    "strings"
+  ]
+  ++ lib.optional useLLVMBitcodeStrip "bitcode-strip"
+  ++ lib.optional useLLVMOtool "otool"
+  ++ lib.optional useLLVMStrip "strip";
+
+  # Only include the tools that LLVM doesn’t provide and that are present normally on Darwin.
+  # The only exceptions are the following tools, which should be reevaluated when LLVM is bumped.
+  # - install_name_tool (llvm-objcopy): unrecognized linker commands when building open source CF;
+  # - libtool (llvm-libtool-darwin): not fully compatible when used with xcbuild; and
+  # - lipo (llvm-lipo): crashes when running the LLVM test suite.
+  cctools_bins = [
+    "cmpdylib"
+    "codesign_allocate"
+    "ctf_insert"
+    "install_name_tool"
+    "ld"
+    "libtool"
+    "lipo"
+    "nmedit"
+    "pagestuff"
+    "ranlib"
+    "segedit"
+    "vtool"
+  ]
+  ++ lib.optional (!useLLVMBitcodeStrip) "bitcode_strip"
+  ++ lib.optional (!useLLVMOtool) "otool"
+  ++ lib.optional (!useLLVMStrip) "strip";
+
+  inherit (stdenv.cc) targetPrefix;
+
+  linkManPages = pkg: source: target: lib.optionalString enableManpages ''
+    sourcePath=${pkg}/share/man/man1/${source}.1.gz
+    targetPath=$man/share/man/man1/${target}.1.gz
+
+    if [ -f "$sourcePath" ]; then
+      mkdir -p "$(dirname "$targetPath")"
+      ln -s "$sourcePath" "$targetPath"
+    fi
+  '';
+in
+stdenv.mkDerivation {
+  pname = "cctools-llvm";
+  version = "${llvmVersion}-${cctoolsVersion}";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # The `man` output has to be included unconditionally because darwin.binutils expects it.
+  outputs = [ "out" "dev" "man" ];
+
+  buildCommand = ''
+    mkdir -p "$out/bin" "$man"
+    ln -s ${lib.getDev cctools-port} "$dev"
+
+    # Use the clang-integrated assembler instead of using `as` from cctools.
+    makeWrapper "${lib.getBin llvmPackages.clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+      --add-flags "-x assembler -integrated-as -c"
+
+    ln -s "${lib.getBin llvmPackages.bintools-unwrapped}/bin/llvm-ar" "$out/bin/${targetPrefix}ar"
+    ${linkManPages llvmPackages.llvm-manpages "llvm-ar" "ar"}
+
+    for tool in ${toString llvm_bins}; do
+      cctoolsTool=''${tool/-/_}
+      ln -s "${lib.getBin llvmPackages.llvm}/bin/llvm-$tool" "$out/bin/${targetPrefix}$cctoolsTool"
+      ${linkManPages llvmPackages.llvm-manpages "llvm-$tool" "$cctoolsTool"}
+    done
+
+    for tool in ${toString cctools_bins}; do
+      ln -s "${lib.getBin cctools-port}/bin/${targetPrefix}$tool" "$out/bin/${targetPrefix}$tool"
+      ${linkManPages (lib.getMan cctools-port) "$tool" "$tool"}
+    done
+
+    ${linkManPages (lib.getMan cctools-port) "ld64" "ld64"}
+    ${lib.optionalString (!useLLVMOtool)  # The actual man page for otool in cctools is llvm-otool
+      linkManPages (lib.getMan cctools-port) "llvm-otool" "llvm-otool"}
+  '';
+
+  passthru = { inherit targetPrefix; };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix b/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
index bace6f0689d9..4d8079977513 100644
--- a/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
@@ -3,6 +3,7 @@
 , libuuid
 , libobjc ? null, maloader ? null
 , enableTapiSupport ? true, libtapi
+, fetchpatch
 }:
 
 let
@@ -19,13 +20,17 @@ assert (!stdenv.hostPlatform.isDarwin) -> maloader != null;
 
 stdenv.mkDerivation {
   pname = "${targetPrefix}cctools-port";
-  version = "949.0.1";
+  version = "973.0.1";
 
   src = fetchFromGitHub {
     owner  = "tpoechtrager";
     repo   = "cctools-port";
-    rev    = "43f32a4c61b5ba7fde011e816136c550b1b3146f";
-    sha256 = "10yc5smiczzm62q6ijqccc58bwmfhc897f3bwa5i9j98csqsjj0k";
+    # This is the commit before: https://github.com/tpoechtrager/cctools-port/pull/114
+    # That specific change causes trouble for us (see the PR discussion), but
+    # is also currently the last commit on master at the time of writing, so we
+    # can just go back one step.
+    rev    = "457dc6ddf5244ebf94f28e924e3a971f1566bd66";
+    sha256 = "0ns12q7vg9yand4dmdsps1917cavfbw67yl5q7bm6kb4ia5kkx13";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -35,7 +40,19 @@ stdenv.mkDerivation {
     ++ lib.optionals stdenv.isDarwin [ libobjc ]
     ++ lib.optional enableTapiSupport libtapi;
 
-  patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];
+  patches = [
+    ./ld-ignore-rpath-link.patch
+    ./ld-rpath-nonfinal.patch
+    (fetchpatch {
+      url = "https://github.com/tpoechtrager/cctools-port/commit/4a734070cd2838e49658464003de5b92271d8b9e.patch";
+      hash = "sha256-72KaJyu7CHXxJJ1GNq/fz+kW1RslO3UaKI91LhBtiXA=";
+    })
+    (fetchpatch {
+      url = "https://github.com/MercuryTechnologies/cctools-port/commit/025899b7b3593dedb0c681e689e57c0e7bbd9b80.patch";
+      hash = "sha256-SWVUzFaJHH2fu9y8RcU3Nx/QKx60hPE5zFx0odYDeQs=";
+    })
+  ]
+    ++ lib.optional stdenv.isDarwin ./darwin-no-memstream.patch;
 
   __propagatedImpureHostDeps = [
     # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
@@ -64,32 +81,99 @@ stdenv.mkDerivation {
       --replace "-isystem /usr/local/include -isystem /usr/pkg/include" "" \
       --replace "-L/usr/local/lib" "" \
 
-    substituteInPlace cctools/include/Makefile \
-      --replace "/bin/" ""
+    # Appears to use new libdispatch API not available in macOS SDK 10.12.
+    substituteInPlace cctools/ld64/src/ld/libcodedirectory.c \
+      --replace "#define LIBCD_PARALLEL 1" ""
 
     patchShebangs tools
     sed -i -e 's/which/type -P/' tools/*.sh
 
-    # Workaround for https://www.sourceware.org/bugzilla/show_bug.cgi?id=11157
-    cat > cctools/include/unistd.h <<EOF
-    #ifdef __block
-    #  undef __block
-    #  include_next "unistd.h"
-    #  define __block __attribute__((__blocks__(byref)))
-    #else
-    #  include_next "unistd.h"
-    #endif
-    EOF
-
     cd cctools
   '';
 
   preInstall = ''
-    pushd include
-    make DSTROOT=$out/include RC_OS=common install
+    installManPage ar/ar.{1,5}
+
+    # The makefile rules for installing headers are missing in 973.0.1.
+    # The below is derived from 949.0.1.
+    mkdir -p $dev/include/mach-o/i386
+    mkdir -p $dev/include/mach-o/ppc
+    mkdir -p $dev/include/mach-o/x86_64
+    mkdir -p $dev/include/mach-o/arm
+    mkdir -p $dev/include/mach-o/arm64
+    mkdir -p $dev/include/mach-o/m68k
+    mkdir -p $dev/include/mach-o/sparc
+    mkdir -p $dev/include/mach-o/hppa
+    mkdir -p $dev/include/mach-o/i860
+    mkdir -p $dev/include/mach-o/m88k
+    mkdir -p $dev/include/dyld
+    mkdir -p $dev/include/cbt
+
+    pushd include/mach-o
+    install -c -m 444  arch.h ldsyms.h reloc.h \
+      stab.h loader.h fat.h swap.h getsect.h nlist.h \
+      ranlib.h $dev/include/mach-o
     popd
 
-    installManPage ar/ar.{1,5}
+    pushd include/mach-o/i386
+    install -c -m 444  swap.h \
+      $dev/include/mach-o/i386
+    popd
+
+    pushd include/mach-o/ppc
+    install -c -m 444  reloc.h swap.h \
+      $dev/include/mach-o/ppc
+    popd
+
+    pushd include/mach-o/x86_64
+    install -c -m 444  reloc.h \
+      $dev/include/mach-o/x86_64
+    popd
+
+    pushd include/mach-o/arm
+    install -c -m 444  reloc.h \
+      $dev/include/mach-o/arm
+    popd
+
+    pushd include/mach-o/arm64
+    install -c -m 444  reloc.h \
+      $dev/include/mach-o/arm64
+    popd
+
+    pushd include/mach-o/m68k
+    install -c -m 444  swap.h \
+      $dev/include/mach-o/m68k
+    popd
+
+    pushd include/mach-o/sparc
+    install -c -m 444  reloc.h swap.h \
+      $dev/include/mach-o/sparc
+    popd
+
+    pushd include/mach-o/hppa
+    install -c -m 444  reloc.h swap.h \
+      $dev/include/mach-o/hppa
+    popd
+
+    pushd include/mach-o/i860
+    install -c -m 444  reloc.h swap.h \
+      $dev/include/mach-o/i860
+    popd
+
+    pushd include/mach-o/m88k
+    install -c -m 444  reloc.h swap.h \
+      $dev/include/mach-o/m88k
+    popd
+
+    pushd include/stuff
+    install -c -m 444  bool.h \
+      $dev/include/dyld
+    popd
+
+    pushd include/cbt
+    install -c -m 444  libsyminfo.h \
+      $dev/include/cbt
+    popd
   '';
 
   passthru = {
diff --git a/nixpkgs/pkgs/os-specific/darwin/darling/default.nix b/nixpkgs/pkgs/os-specific/darwin/darling/default.nix
deleted file mode 100644
index 22fb6d3b07c6..000000000000
--- a/nixpkgs/pkgs/os-specific/darwin/darling/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{stdenv, lib, fetchzip}:
-
-stdenv.mkDerivation rec {
-  pname = "darling";
-  name = pname;
-
-  src = fetchzip {
-    url = "https://github.com/darlinghq/darling/archive/d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b.tar.gz";
-    sha256 = "11b51fw47nl505h63bgx5kqiyhf3glhp1q6jkpb6nqfislnzzkrf";
-    postFetch = ''
-      # The archive contains both `src/opendirectory` and `src/OpenDirectory`,
-      # pre-create the directory to choose the canonical case on
-      # case-insensitive filesystems.
-      mkdir -p $out/src/OpenDirectory
-
-      cd $out
-      tar -xzf $downloadedFile --strip-components=1
-      rm -r $out/src/libm
-
-      # If `src/opendirectory` and `src/OpenDirectory` refer to different
-      # things, then combine them into `src/OpenDirectory` to match the result
-      # on case-insensitive filesystems.
-      if [ "$(stat -c %i src/opendirectory)" != "$(stat -c %i src/OpenDirectory)" ]; then
-        mv src/opendirectory/* src/OpenDirectory/
-        rmdir src/opendirectory
-      fi
-    '';
-  };
-
-  # only packaging sandbox for now
-  buildPhase = ''
-    cc -c src/sandbox/sandbox.c -o src/sandbox/sandbox.o
-    cc -dynamiclib -flat_namespace src/sandbox/sandbox.o -o libsystem_sandbox.dylib
-  '';
-
-  installPhase = ''
-    mkdir -p $out/lib
-    cp -rL src/sandbox/include/ $out/
-    cp libsystem_sandbox.dylib $out/lib/
-
-    mkdir -p $out/include
-    cp src/libaks/include/* $out/include
-  '';
-
-  meta = with lib; {
-    maintainers = with maintainers; [ matthewbauer ];
-    license = licenses.gpl3;
-    description = "Darwin/macOS emulation layer for Linux";
-    platforms = platforms.darwin;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/darwin/defaultbrowser/default.nix b/nixpkgs/pkgs/os-specific/darwin/defaultbrowser/default.nix
new file mode 100644
index 000000000000..be3dcd417731
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/defaultbrowser/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, Foundation }:
+
+stdenv.mkDerivation rec {
+  pname = "defaultbrowser";
+  version = "unstable-2020-07-23";
+
+  src = fetchFromGitHub {
+    owner = "kerma";
+    repo = pname;
+    rev = "d2860c00dd7fbb5d615232cc819d7d492a6a6ddb";
+    sha256 = "sha256-SelUQXoKtShcDjq8uKg3wM0kG2opREa2DGQCDd6IsOQ=";
+  };
+
+  makeFlags = [ "CC=cc" "PREFIX=$(out)" ];
+
+  buildInputs = [ Foundation ];
+
+  meta = with lib; {
+    mainProgram = "defaultbrowser";
+    description = "Command line tool for getting and setting a default browser (HTTP handler) in Mac OS X";
+    homepage = "https://github.com/kerma/defaultbrowser";
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ Enzime ];
+    license = licenses.mit;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/gen-frameworks.py b/nixpkgs/pkgs/os-specific/darwin/gen-frameworks.py
new file mode 100755
index 000000000000..ec2a6c7c16ec
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/gen-frameworks.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 swiftPackages.swift-unwrapped
+
+"""
+Generate a frameworks.nix for a macOS SDK.
+
+You may point this tool at an Xcode bundled SDK, but more ideal is using the
+SDK from Nixpkgs. For example:
+
+SDK_PATH="$(nix-build --no-link -A darwin.apple_sdk_11_0.MacOSX-SDK)"
+./gen-frameworks.py "$SDK_PATH" > ./new-frameworks.nix
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+ALLOWED_LIBS = ["simd"]
+
+HEADER = """\
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
+{
+"""
+
+FOOTER = """\
+}
+"""
+
+
+def eprint(*args):
+    print(*args, file=sys.stderr)
+
+
+def name_from_ident(ident):
+    return ident.get("swift", ident.get("clang"))
+
+
+def scan_sdk(sdk):
+    # Find frameworks by scanning the SDK frameworks directory.
+    frameworks = [
+        framework.removesuffix(".framework")
+        for framework in os.listdir(f"{sdk}/System/Library/Frameworks")
+        if not framework.startswith("_")
+    ]
+    frameworks.sort()
+
+    # Determine the longest name for padding output.
+    width = len(max(frameworks, key=len))
+
+    output = HEADER
+
+    for framework in frameworks:
+        deps = []
+
+        # Use Swift to scan dependencies, because a module may have both Clang
+        # and Swift parts. Using Clang only imports the Clang module, whereas
+        # using Swift will usually import both Clang + Swift overlay.
+        #
+        # TODO: The above is an assumption. Not sure if it's possible a Swift
+        # module completely shadows a Clang module. (Seems unlikely)
+        #
+        # TODO: Handle "module 'Foobar' is incompatible with feature 'swift'"
+        #
+        # If there were a similar Clang invocation for scanning, we could fix
+        # the above todos, but that doesn't appear to exist.
+        eprint(f"# scanning {framework}")
+        result = subprocess.run(
+            [
+                "swiftc",
+                "-scan-dependencies",
+                # We provide a source snippet via stdin.
+                "-",
+                # Use the provided SDK.
+                "-sdk",
+                sdk,
+                # This search path is normally added automatically by the
+                # compiler based on the SDK, but we have a patch in place that
+                # removes that for SDKs in /nix/store, because our xcbuild stub
+                # SDK doesn't have the directory.
+                # (swift-prevent-sdk-dirs-warning.patch)
+                "-I",
+                f"{sdk}/usr/lib/swift",
+                # For some reason, 'lib/swift/shims' from both the SDK and
+                # Swift compiler are picked up, causing redefinition errors.
+                # This eliminates the latter.
+                "-resource-dir",
+                f"{sdk}/usr/lib/swift",
+            ],
+            input=f"import {framework}".encode(),
+            stdout=subprocess.PIPE,
+        )
+        if result.returncode != 0:
+            eprint(f"# Scanning {framework} failed (exit code {result.returncode})")
+            result.stdout = b""
+
+        # Parse JSON output.
+        if len(result.stdout) != 0:
+            data = json.loads(result.stdout)
+
+            # Entries in the modules list come in pairs. The first is an
+            # identifier (`{ swift: "foobar" }` or `{ clang: "foobar" }`), and
+            # the second metadata for that module. Here we look for the pair
+            # that matches the framework we're scanning (and ignore the rest).
+            modules = data["modules"]
+            for i in range(0, len(modules), 2):
+                ident, meta = modules[i : i + 2]
+
+                # NOTE: We may match twice, for a Swift module _and_ for a
+                # Clang module. So matching here doesn't break from the loop,
+                # and deps is appended to.
+                if name_from_ident(ident) == framework:
+                    dep_idents = meta["directDependencies"]
+                    deps += [name_from_ident(ident) for ident in dep_idents]
+                    # List unfiltered deps in progress output.
+                    eprint(ident, "->", dep_idents)
+
+        # Filter out modules that are not separate derivations.
+        # Also filter out duplicates (when a Swift overlay imports the Clang module)
+        allowed = frameworks + ALLOWED_LIBS
+        deps = set([dep for dep in deps if dep in allowed])
+
+        # Filter out self-references. (Swift overlay importing Clang module.)
+        if framework in deps:
+            deps.remove(framework)
+
+        # Generate a Nix attribute line.
+        if len(deps) != 0:
+            deps = list(deps)
+            deps.sort()
+            deps = " ".join(deps)
+            output += f"  {framework.ljust(width)} = {{ inherit {deps}; }};\n"
+        else:
+            output += f"  {framework.ljust(width)} = {{}};\n"
+
+    output += FOOTER
+    sys.stdout.write(output)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        eprint(f"Usage: {sys.argv[0]} <path to MacOSX.sdk>")
+        sys.exit(64)
+
+    scan_sdk(sys.argv[1])
diff --git a/nixpkgs/pkgs/os-specific/darwin/goku/default.nix b/nixpkgs/pkgs/os-specific/darwin/goku/default.nix
index af70aaccc464..13aadfce2404 100644
--- a/nixpkgs/pkgs/os-specific/darwin/goku/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/goku/default.nix
@@ -2,22 +2,32 @@
 , stdenv
 , fetchurl
 , unzip
+, joker
 }:
 
 stdenv.mkDerivation rec {
   pname = "goku";
-  version = "0.5.2";
+  version = "0.6.0";
 
-  src = fetchurl {
-    url = "https://github.com/yqrashawn/GokuRakuJoudo/releases/download/v${version}/goku.zip";
-    sha256 = "506eccdabedc68c112778b13ded65099327267c2e3fd488916e3a340bc312954";
-  };
+  src = if stdenv.isAarch64 then
+    fetchurl {
+      url = "https://github.com/yqrashawn/GokuRakuJoudo/releases/download/v${version}/goku-arm.zip";
+      hash = "sha256-TIoda2kDckK1FBLAmKudsDs3LXO4J0KWiAD2JlFb4rk=";
+    }
+    else fetchurl {
+      url = "https://github.com/yqrashawn/GokuRakuJoudo/releases/download/v${version}/goku.zip";
+      hash = "sha256-8HdIwtpzR6O2WCbMYIJ6PHcM27Xmb+4Tc5Fmjl0dABQ=";
+    };
 
   nativeBuildInputs = [
     unzip
   ];
 
-  sourceRoot = ".";
+  buildInputs = [
+    joker
+  ];
+
+  sourceRoot = if stdenv.isAarch64 then "goku" else ".";
 
   installPhase = ''
     chmod +x goku
diff --git a/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix b/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix
new file mode 100644
index 000000000000..a1156c7cb873
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, lib, fetchurl, undmg, ... }:
+
+stdenv.mkDerivation rec {
+  version = "3.0.1";
+  pname = "grandperspective";
+
+  src = fetchurl {
+    inherit version;
+    url = "mirror://sourceforge/grandperspectiv/GrandPerspective-${builtins.replaceStrings [ "." ] [ "_" ] version}.dmg";
+    sha256 = "sha256-ZPqrlN9aw5q7656GmmxCnTRBw3lu9n952rIyun8MsiI=";
+  };
+
+  sourceRoot = "GrandPerspective.app";
+  buildInputs = [ undmg ];
+  installPhase = ''
+    mkdir -p "$out/Applications/GrandPerspective.app";
+    cp -R . "$out/Applications/GrandPerspective.app";
+  '';
+
+  meta = with lib; {
+    description = "Open-source macOS application to analyze disk usage";
+    longDescription = ''
+      GrandPerspective is a small utility application for macOS that graphically shows the disk usage within a file
+      system. It can help you to manage your disk, as you can easily spot which files and folders take up the most
+      space. It uses a so called tree map for visualisation. Each file is shown as a rectangle with an area proportional to
+      the file's size. Files in the same folder appear together, but their placement is otherwise arbitrary.
+    '';
+    homepage = "https://grandperspectiv.sourceforge.net";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ eliandoran ];
+    platforms = [ "x86_64-darwin" ];
+  };
+
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/iproute2mac/default.nix b/nixpkgs/pkgs/os-specific/darwin/iproute2mac/default.nix
index f542f2c5221b..a7f1f0b773d8 100644
--- a/nixpkgs/pkgs/os-specific/darwin/iproute2mac/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/iproute2mac/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, darwin, python3 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0";
+  version = "1.4.1";
   pname = "iproute2mac";
 
   src = fetchFromGitHub {
     owner = "brona";
     repo = "iproute2mac";
     rev = "v${version}";
-    sha256 = "sha256-xakCNjmZpdVY7MMxk38EZatrakgkEeDhvljhl+aMmGg=";
+    sha256 = "sha256-MaL8eb9UOZ71BL4Jvc6Od+EJ+F6j96n9a+vRnHeveIU=";
   };
 
   buildInputs = [ python3 ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/default.nix b/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/default.nix
new file mode 100644
index 000000000000..03a9938bb205
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/default.nix
@@ -0,0 +1,52 @@
+{ lib, stdenv, fetchurl, cpio, xar, undmg }:
+
+stdenv.mkDerivation rec {
+  pname = "karabiner-elements";
+  version = "14.11.0";
+
+  src = fetchurl {
+    url = "https://github.com/pqrs-org/Karabiner-Elements/releases/download/v${version}/Karabiner-Elements-${version}.dmg";
+    sha256 = "sha256-InuSfXbaSYsncq8jVO15LbQmDTguRHlOiE/Pj5EfX5c=";
+  };
+
+  outputs = [ "out" "driver" ];
+
+  nativeBuildInputs = [ cpio xar undmg ];
+
+  unpackPhase = ''
+    undmg $src
+    xar -xf Karabiner-Elements.pkg
+    cd Installer.pkg
+    zcat Payload | cpio -i
+    cd ../Karabiner-DriverKit-VirtualHIDDevice.pkg
+    zcat Payload | cpio -i
+    cd ..
+  '';
+
+  sourceRoot = ".";
+
+  postPatch = ''
+    for f in *.pkg/Library/Launch{Agents,Daemons}/*.plist; do
+      substituteInPlace $f \
+        --replace "/Library/" "$out/Library/"
+    done
+  '';
+
+  installPhase = ''
+    mkdir -p $out $driver
+    cp -R Installer.pkg/Applications Installer.pkg/Library $out
+    cp -R Karabiner-DriverKit-VirtualHIDDevice.pkg/Applications Karabiner-DriverKit-VirtualHIDDevice.pkg/Library $driver
+
+    cp "$out/Library/Application Support/org.pqrs/Karabiner-Elements/package-version" "$out/Library/Application Support/org.pqrs/Karabiner-Elements/version"
+  '';
+
+  passthru.updateScript = ./updater.sh;
+
+  meta = with lib; {
+    description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later.";
+    homepage = "https://karabiner-elements.pqrs.org/";
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ Enzime ];
+    license = licenses.unlicense;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/updater.sh b/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/updater.sh
new file mode 100755
index 000000000000..eb0dd7b9ce5c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/karabiner-elements/updater.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts
+set -eo pipefail
+
+new_version="$(curl -s  "https://api.github.com/repos/pqrs-org/Karabiner-Elements/releases/latest" | jq -r '.tag_name | ltrimstr("v")')"
+old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+
+if [[ "$new_version" == "$old_version" ]]; then
+  echo "Already up to date!"
+  exit 0
+fi
+
+update-source-version karabiner-elements "${new_version}"
diff --git a/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix b/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
index da0710740973..d109e0edcbd8 100644
--- a/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   # Also means we don't have to manually fix the result with install_name_tool.
   patches = [
     ./disable-rpath.patch
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # TODO: make unconditional and rebuild the world
     # TODO: send upstream
     ./native-clang-tblgen.patch
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   buildInputs = [ ncurses ];
 
   cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ]
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) [
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
       "-DCMAKE_CROSSCOMPILING=True"
       # This package could probably have a llvm_6 llvm-tblgen and clang-tblgen
       # provided to reduce some building. This package seems intended to
@@ -40,12 +40,15 @@ stdenv.mkDerivation {
         let
           nativeCC = pkgsBuildBuild.stdenv.cc;
           nativeBintools = nativeCC.bintools.bintools;
+          nativeLibcxxabi = lib.getLib pkgsBuildBuild.libcxxabi;
           nativeToolchainFlags = [
             "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
             "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
             "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
             "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
             "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+            "-DCMAKE_EXE_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
+            "-DCMAKE_SHARED_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
           ];
         in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
       )
diff --git a/nixpkgs/pkgs/os-specific/darwin/macfuse/default.nix b/nixpkgs/pkgs/os-specific/darwin/macfuse/default.nix
index 4fd92a15562c..c63b536f248b 100644
--- a/nixpkgs/pkgs/os-specific/darwin/macfuse/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/macfuse/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "macfuse-stubs";
-  version = "4.1.0";
+  version = "4.4.1";
 
   src = fetchurl {
     url = "https://github.com/osxfuse/osxfuse/releases/download/macfuse-${version}/macfuse-${version}.dmg";
-    sha256 = "118hg64w5wb95lbxw6w1hbqxrx3plcbxfjhvxx86q0zx0saa9diw";
+    sha256 = "2a2d0f37ec5fcff547c5efa7d08539103a0b46bc16080c2b41a7e749f6e65c61";
   };
 
   nativeBuildInputs = [ cpio xar undmg libtapi ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/maloader/default.nix b/nixpkgs/pkgs/os-specific/darwin/maloader/default.nix
index 1313c1897043..c59f854b8475 100644
--- a/nixpkgs/pkgs/os-specific/darwin/maloader/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/maloader/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
       ld-mac.cc
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
   buildInputs = [ clang libcxx ];
   buildFlags = [ "USE_LIBCXX=1" "release" ];
 
diff --git a/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix b/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
index 1d8f89deff19..4d247fa58363 100644
--- a/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -23,67 +23,30 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.1.10";
-
-  buildInputs = [ AppKit Foundation Metal QuartzCore cereal ]
-    ++ lib.attrValues finalAttrs.passthru;
+  version = "1.2.3";
+
+  buildInputs = [
+    AppKit
+    Foundation
+    Metal
+    QuartzCore
+    cereal
+    glslang
+    spirv-cross
+    spirv-headers
+    spirv-tools
+    vulkan-headers
+  ];
 
   nativeBuildInputs = [ cctools sigtool xcbuild ];
 
   outputs = [ "out" "bin" "dev" ];
 
-  # MoltenVK requires specific versions of its dependencies.
-  # Pin them here except for cereal, which is four years old and has several CVEs.
-  passthru = {
-    glslang = (glslang.overrideAttrs (old: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "glslang";
-        rev = "adbf0d3106b26daa237b10b9bf72b1af7c31092d";
-        hash = "sha256-sjidkiPtRADhyOEKDb2cHCBXnFjLwk2F5Lppv5/fwNQ=";
-      };
-    })).override { inherit (finalAttrs.passthru) spirv-headers spirv-tools; };
-    spirv-cross = spirv-cross.overrideAttrs (old: {
-      cmakeFlags = (old.cmakeFlags or [ ])
-        ++ [ "-DSPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross" ];
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "SPIRV-Cross";
-        rev = "50b4d5389b6a06f86fb63a2848e1a7da6d9755ca";
-        hash = "sha256-SsupPHJ3VHxJhEAUl3EeQwN4texYhdDjxTnGD+bkNAw=";
-      };
-    });
-    spirv-headers = spirv-headers.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "spirv-headers";
-        rev = "5a121866927a16ab9d49bed4788b532c7fcea766";
-        hash = "sha256-X4GuFesX015mrzutguhZLrIGlllCgAZ+DUBGSADt8xU=";
-      };
-    });
-    spirv-tools = (spirv-tools.overrideAttrs (old: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "spirv-tools";
-        rev = "b930e734ea198b7aabbbf04ee1562cf6f57962f0";
-        hash = "sha256-NWpFSRoxtYWi+hLUt9gpw0YScM3shcUwv9yUmbivRb0=";
-      };
-    })).override { inherit (finalAttrs.passthru) spirv-headers; };
-    vulkan-headers = vulkan-headers.overrideAttrs (old: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "Vulkan-Headers";
-        rev = "3ef4c97fd6ea001d75a8e9da408ee473c180e456";
-        hash = "sha256-jHzW3m9smuzEGbZrSyBI74K9rFozxiG3M5Xql/WOw7U=";
-      };
-    });
-  };
-
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LZvCCP2yelTaWcNt+WvG+RZnVLHRgMDTlNWwRIey7ZM=";
+    hash = "sha256-GPOF2lyo1eDf1GrPjcj0y1OuUHI/c80L9gSQM+4wEp0=";
   };
 
   patches = [
@@ -97,6 +60,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace Scripts/gen_moltenvk_rev_hdr.sh \
       --replace '$'''{BUILT_PRODUCTS_DIR}' "$NIX_BUILD_TOP/$sourceRoot/build/include" \
       --replace '$(git rev-parse HEAD)' ${finalAttrs.src.rev}
+    # Use the SPIRV-Cross packaged in nixpkgs instead of one built specifically for MoltenVK.
+    substituteInPlace MoltenVK/MoltenVK.xcodeproj/project.pbxproj \
+      --replace SPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross SPIRV_CROSS_NAMESPACE_OVERRIDE=spirv_cross
+    substituteInPlace MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj \
+      --replace SPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross SPIRV_CROSS_NAMESPACE_OVERRIDE=spirv_cross
     # Adding all of `usr/include` from the SDK results in header conflicts with `libcxx.dev`.
     # Work around it by symlinking just the SIMD stuff needed by MoltenVK.
     mkdir -p build/include
@@ -105,10 +73,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontConfigure = true;
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-isystem ${lib.getDev libcxx}/include/c++/v1"
-    "-I${finalAttrs.passthru.spirv-cross}/include/spirv_cross"
-    "-I${finalAttrs.passthru.spirv-headers}/include/spirv/unified1/"
+    "-I${lib.getDev spirv-cross}/include/spirv_cross"
+    "-I${lib.getDev spirv-headers}/include/spirv/unified1/"
   ];
 
   buildPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/darwin/noah/default.nix b/nixpkgs/pkgs/os-specific/darwin/noah/default.nix
index f4d8a4b21a87..b8cb1424cdda 100644
--- a/nixpkgs/pkgs/os-specific/darwin/noah/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/noah/default.nix
@@ -20,5 +20,7 @@ stdenv.mkDerivation rec {
     license = [ licenses.mit licenses.gpl2 ];
     maintainers = [ maintainers.marsam ];
     platforms = platforms.darwin;
+    # never built on aarch64-darwin since first introduction in nixpkgs
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/openwith/default.nix b/nixpkgs/pkgs/os-specific/darwin/openwith/default.nix
new file mode 100644
index 000000000000..eb78f7a1344c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/openwith/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, swift, AppKit, Foundation, UniformTypeIdentifiers }:
+
+let
+  arch = if stdenv.isAarch64 then "arm64" else "x86_64";
+in
+stdenv.mkDerivation rec {
+  pname = "openwith";
+  version = "unstable-2022-10-28";
+
+  src = fetchFromGitHub {
+    owner = "jdek";
+    repo = "openwith";
+    rev = "a8a99ba0d1cabee7cb470994a1e2507385c30b6e";
+    hash = "sha256-lysleg3qM2MndXeKjNk+Y9Tkk40urXA2ZdxY5KZNANo=";
+  };
+
+  nativeBuildInputs = [ swift ];
+
+  buildInputs = [ AppKit Foundation UniformTypeIdentifiers ];
+
+  makeFlags = [ "openwith_${arch}" ];
+
+  installPhase = ''
+    runHook preInstall
+    install openwith_${arch} -D $out/bin/openwith
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Utility to specify which application bundle should open specific file extensions";
+    homepage = "https://github.com/jdek/openwith";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ zowoq ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+    broken = stdenv.isx86_64; # https://hydra.nixos.org/build/219354133/nixlog/3
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/pam-reattach/default.nix b/nixpkgs/pkgs/os-specific/darwin/pam-reattach/default.nix
new file mode 100644
index 000000000000..4350865080f0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/pam-reattach/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openpam, darwin }:
+
+stdenv.mkDerivation rec {
+  pname = "pam_reattach";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "fabianishere";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1k77kxqszdwgrb50w7algj22pb4fy5b9649cjb08zq9fqrzxcbz7";
+  };
+
+  cmakeFlags = [
+    "-DCMAKE_OSX_ARCHITECTURES=${
+      if stdenv.hostPlatform.system == "x86_64-darwin" then
+        "x86_64"
+      else
+        "arm64"
+    }"
+    "-DENABLE_CLI=ON"
+  ] ++ lib.optional (!stdenv.isAarch64) "-DCMAKE_LIBRARY_PATH=${darwin.apple_sdk.sdk}/usr/lib";
+
+  buildInputs = [ openpam ]
+    ++ lib.optional (!stdenv.isAarch64) darwin.apple_sdk.sdk;
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    homepage = "https://github.com/fabianishere/pam_reattach";
+    description = "Reattach to the user's GUI session on macOS during authentication (for Touch ID support in tmux)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lockejan ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix b/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix
new file mode 100644
index 000000000000..852c9c23aa9b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "plistwatch";
+  version = "unstable-2020-12-22";
+
+  src = fetchFromGitHub {
+    owner = "catilac";
+    repo = "plistwatch";
+    rev = "c3a9afd8d3e5ffa8dcc379770bc4216bae88a671";
+    sha256 = "0a5rfmpy6h06p02z9gdilh7vr3h9cc6n6zzygpjk6zvnqs3mm3vx";
+  };
+
+  vendorSha256 = "sha256-Layg1axFN86OFgxEyNFtIlm6Jtx317jZb/KH6IjJ8e4=";
+
+  #add missing dependencies and hashes
+  patches = [ ./go-modules.patch ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Monitors and prints changes to MacOS plists in real time";
+    homepage = "https://github.com/catilac/plistwatch";
+    maintainers = with maintainers; [ gdinh ];
+    license = licenses.mit;
+    platforms = platforms.darwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/plistwatch/go-modules.patch b/nixpkgs/pkgs/os-specific/darwin/plistwatch/go-modules.patch
new file mode 100644
index 000000000000..94d7cc01e24e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/plistwatch/go-modules.patch
@@ -0,0 +1,19 @@
+--- a/go.mod
++++ b/go.mod
+@@ -3,1 +3,6 @@
+  go 1.14
++ require(
++   github.com/jessevdk/go-flags v1.5.0
++   howett.net/plist v0.0.0-20200419221736-3b63eb3a43b5
++   gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 // indirect
++ )
+--- a/go.sum
++++ b/go.sum
+@@ -9,1 +9,7 @@
+  howett.net/plist v0.0.0-20200419221736-3b63eb3a43b5/go.mod h1:vMygbs4qMhSZSc4lCUl2OEE+rDiIIJAIdR4m7MiMcm0=
++ gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 h1:POO/ycCATvegFmVuPpQzZFJ+pGZeX22Ufu6fibxDVjU=
++ gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
++ github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
++ github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
++ golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4 h1:EZ2mChiOa8udjfp6rRmswTbtZN/QzUQp4ptM4rnjHvc=
++ golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
new file mode 100644
index 000000000000..796d3912f977
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "raycast";
+  version = "1.53.0";
+
+  src = fetchurl {
+    # https://github.com/NixOS/nixpkgs/pull/223495
+    # official download API: https://api.raycast.app/v2/download
+    # this returns an AWS CloudFront signed URL with expiration timestamp and signature
+    # the returned URL will always be the latest Raycast which might result in an impure derivation
+    # the package maintainer created a repo (https://github.com/stepbrobd/raycast-overlay)
+    # to host GitHub Actions to periodically check for updates
+    # and re-release the `.dmg` file to Internet Archive (https://archive.org/details/raycast)
+    url = "https://archive.org/download/raycast/raycast-${version}.dmg";
+    sha256 = "sha256-IkLbfuzkgO/E8U8PjZ6NQ28WEVeBumKYbbKpK/LPwNY=";
+  };
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = "Raycast.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/Raycast.app
+    cp -R . $out/Applications/Raycast.app
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Control your tools with a few keystrokes";
+    homepage = "https://raycast.app/";
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ lovesegfault stepbrobd ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh b/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh
new file mode 100755
index 000000000000..d8f4e109da21
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=../../../../. -i bash -p common-updater-scripts internetarchive
+
+set -eo pipefail
+
+new_version="$(ia list raycast | grep -Eo '^raycast-.*\.dmg$' | sort -r | head -n1 | sed -E 's/^raycast-([0-9]+\.[0-9]+\.[0-9]+)\.dmg$/\1/')"
+old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+
+if [[ "$new_version" == "$old_version" ]]; then
+    echo "Already up to date."
+    exit 0
+else
+    echo "raycast: $old_version -> $new_version"
+    sed -Ei.bak '/ *version = "/s/".+"/"'"$new_version"'"/' ./default.nix
+    rm ./default.nix.bak
+fi
+
+hash="$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://archive.org/download/raycast/raycast-$new_version.dmg" | jq -r '.hash')"
+sed -Ei.bak '/ *sha256 = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
+rm ./default.nix.bak
diff --git a/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix b/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix
new file mode 100644
index 000000000000..dcdbdde1fae1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "rectangle";
+  version = "0.68";
+
+  src = fetchurl {
+    url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
+    hash = "sha256-N1zSMmRo6ux/b16K4Og68A5bfht2WWi7S40Yys3QkTY=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    mv Rectangle.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/rxhanson/Rectangle";
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Move and resize windows in macOS using keyboard shortcuts or snap areas";
+    homepage = "https://rectangleapp.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ Enzime ];
+    license = licenses.mit;
+  };
+}
+
diff --git a/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index e5ef118e514c..5cf63754dfbb 100644
--- a/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libyaml }:
+{ stdenv, lib, fetchFromGitHub, libyaml }:
 
 stdenv.mkDerivation {
   pname = "rewrite-tbd";
@@ -11,9 +11,17 @@ stdenv.mkDerivation {
     sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
+  postPatch = ''
+    substituteInPlace Makefile.boot \
+      --replace '$(shell pkg-config --cflags yaml-0.1)' "" \
+      --replace '$(shell pkg-config --libs yaml-0.1)' "-lyaml"
+  '';
+
   buildInputs = [ libyaml ];
 
+  makeFlags = [ "-f" "Makefile.boot" "PREFIX=${placeholder "out"}"];
+
   meta = with lib; {
     homepage = "https://github.com/thefloweringash/rewrite-tbd/";
     description = "Rewrite filepath in .tbd to Nix applicable format";
diff --git a/nixpkgs/pkgs/os-specific/darwin/shortcat/default.nix b/nixpkgs/pkgs/os-specific/darwin/shortcat/default.nix
new file mode 100644
index 000000000000..dcf32a4fd9e3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/shortcat/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchurl, unzip, ... }:
+
+stdenv.mkDerivation rec {
+  pname = "shortcat";
+  version = "0.11.0";
+
+  src = fetchurl {
+    url = "https://files.shortcat.app/releases/v${version}/Shortcat.zip";
+    sha256 = "sha256-P8NQy9odWOD8wRHBTmaNH7OCXXvgQsMiI169KfsAABU=";
+  };
+
+  sourceRoot = "Shortcat.app";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out/Applications/Shortcat.app
+    cp -R . $out/Applications/Shortcat.app
+  '';
+
+  meta = with lib; {
+    description = "Manipulate macOS masterfully, minus the mouse";
+    homepage = "https://shortcat.app/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ Enzime ];
+    license = licenses.unfreeRedistributable;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh b/nixpkgs/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
index cca65661f8a9..6a254cd82123 100644
--- a/nixpkgs/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
+++ b/nixpkgs/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
@@ -25,7 +25,7 @@ signDarwinBinariesIn() {
 signDarwinBinariesInAllOutputs() {
   local output
 
-  for output in $outputs; do
+  for output in $(getAllOutputNames); do
      signDarwinBinariesIn "${!output}"
   done
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/sigtool/default.nix b/nixpkgs/pkgs/os-specific/darwin/sigtool/default.nix
index 4c573af95be1..eb323a899d19 100644
--- a/nixpkgs/pkgs/os-specific/darwin/sigtool/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/sigtool/default.nix
@@ -2,17 +2,24 @@
 
 stdenv.mkDerivation rec {
   pname = "sigtool";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "thefloweringash";
     repo = "sigtool";
     rev = "v${version}";
-    sha256 = "sha256-v4udqW37vwcqBdqfvfwHnoyXpuLFt188ekVCPCPsTPM";
+    sha256 = "sha256-K3VSFaqcZEomF7kROJz+AwxdW1MmxxEFDaRnWnzcw54=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
 
   installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "A tool for working with embedded signatures in Mach-O files";
+    homepage = "https://github.com/thefloweringash/sigtool";
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
index 4f089c7be3e1..6d478d8ab334 100644
--- a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, memstreamHook, Carbon, Cocoa, SkyLight }:
+{ lib, stdenv, fetchFromGitHub, Carbon, Cocoa, CoreWLAN, DisplayServices, SkyLight }:
 
 let
   inherit (stdenv.hostPlatform) system;
@@ -10,17 +10,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sketchybar";
-  version = "2.8.2";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${version}";
-    sha256 = "sha256-GmM+0h6xxUzW2kpTDZWAiqJAXoQgdsJRlNbvsuxKmZ8=";
+    hash = "sha256-0jCVDaFc7ZvA8apeHRoQvPhAlaGlBHzqUkS9or88PcM=";
   };
 
-  buildInputs = [ Carbon Cocoa SkyLight ]
-    ++ lib.optionals (stdenv.system == "x86_64-darwin") [ memstreamHook ];
+  buildInputs = [ Carbon Cocoa CoreWLAN DisplayServices SkyLight ];
 
   makeFlags = [
     target
diff --git a/nixpkgs/pkgs/os-specific/darwin/smimesign/default.nix b/nixpkgs/pkgs/os-specific/darwin/smimesign/default.nix
index d50e00f984e5..48164d387fa9 100644
--- a/nixpkgs/pkgs/os-specific/darwin/smimesign/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/smimesign/default.nix
@@ -2,18 +2,21 @@
 
 buildGoModule rec {
   pname = "smimesign";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "smimesign";
     rev = "v${version}";
-    sha256 = "12f8vprp4v78l9ifrlql0mvpyw5qa8nlrh5ajq5js8wljzpx7wsv";
+    hash = "sha256-W9Hj/+snx+X6l95Gt9d8DiLnBPV9npKydc/zMN9G0vQ=";
   };
 
-  vendorSha256 = "1cldxykm9qj5rvyfafam45y5xj4f19700s2f9w7ndhxgfp9vahvz";
+  vendorHash = "sha256-wLqYUICL+gdvRCLNrA0ZNcFI4oV3Oik762q7xF115Lw=";
 
-  ldflags = [ "-X main.versionString=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.versionString=v${version}" ];
+
+  # Fails in sandbox
+  doCheck = false;
 
   meta = with lib; {
     description = "An S/MIME signing utility for macOS and Windows that is compatible with Git";
diff --git a/nixpkgs/pkgs/os-specific/darwin/swiftbar/default.nix b/nixpkgs/pkgs/os-specific/darwin/swiftbar/default.nix
new file mode 100644
index 000000000000..f2cd30fd6f16
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swiftbar/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, fetchzip
+, stdenvNoCC
+, makeWrapper
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "swiftbar";
+  version = "1.4.3";
+
+  src = fetchzip {
+    url = "https://github.com/swiftbar/SwiftBar/releases/download/v${version}/SwiftBar.zip";
+    sha256 = "sha256-Ut+lr1E7bMp8Uz1aL7EV0ZsfdTh9t7zUjDU/DScRpHY=";
+    stripRoot = false;
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{Applications,bin}
+    cp -r ./SwiftBar.app $out/Applications
+
+    # Symlinking doesnt work; The auto-updater will fail to start which renders the app useless
+    makeWrapper $out/Applications/SwiftBar.app/Contents/MacOS/SwiftBar $out/bin/SwiftBar
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Powerful macOS menu bar customization tool";
+    homepage = "https://swiftbar.app";
+    changelog = "https://github.com/swiftbar/SwiftBar/releases/tag/v${version}";
+    mainProgram = "SwiftBar";
+    license = licenses.mit;
+    platforms = platforms.darwin;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ ivar ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/swiftdefaultapps/default.nix b/nixpkgs/pkgs/os-specific/darwin/swiftdefaultapps/default.nix
new file mode 100644
index 000000000000..44a40e8c8a70
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swiftdefaultapps/default.nix
@@ -0,0 +1,29 @@
+{ fetchzip, lib, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "swiftdefaultapps";
+  version = "2.0.1";
+
+  # Fetch the release which includes the prebuild binary since this is a Swift project and nixpkgs
+  # doesn't currently have the ability to build Swift projects.
+  src = fetchzip {
+    url = "https://github.com/Lord-Kamina/SwiftDefaultApps/releases/download/v${version}/SwiftDefaultApps-v${version}.zip";
+    stripRoot = false;
+    sha256 = "sha256-0HsHjZBPUzmdvHy7E9EdZj6zwaXjSX2u5aj8pij0u3E=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D './swda' "$out/bin/swda"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "View and change the default application for url schemes and UTIs";
+    homepage = "https://github.com/Lord-Kamina/SwiftDefaultApps";
+    license = licenses.beerware;
+    maintainers = [ maintainers.malo ];
+    platforms = platforms.darwin;
+    mainProgram = "swda";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/utm/default.nix b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
new file mode 100644
index 000000000000..d763414f97c0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, undmg
+, makeWrapper
+, fetchurl
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "utm";
+  version = "4.2.5";
+
+  src = fetchurl {
+    url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
+    hash = "sha256-T3TA+CwddNtUL80xASRCSczGA2LLTwPEA2+jnc9m6jY=";
+  };
+
+  nativeBuildInputs = [ undmg makeWrapper ];
+
+  sourceRoot = ".";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    mkdir -p $out/bin
+    for bin in $out/Applications/UTM.app/Contents/MacOS/*; do
+      # Symlinking `UTM` doesn't work; seems to look for files in the wrong
+      # place
+      makeWrapper $bin "$out/bin/$(basename $bin)"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Full featured system emulator and virtual machine host for iOS and macOS";
+    longDescription = ''
+      UTM is a full featured system emulator and virtual machine host for iOS
+      and macOS. It is based off of QEMU. In short, it allows you to run
+      Windows, Linux, and more on your Mac, iPhone, and iPad.
+
+      Features:
+        - Full system emulation (MMU, devices, etc) using QEMU
+        - 30+ processors supported including x86_64, ARM64, and RISC-V
+        - VGA graphics mode using SPICE and QXL
+        - Text terminal mode
+        - USB devices
+        - JIT based acceleration using QEMU TCG
+        - Frontend designed from scratch for macOS 11 and iOS 11+ using the
+          latest and greatest APIs
+        - Create, manage, run VMs directly from your device
+        - Hardware accelerated virtualization using Hypervisor.framework and
+          QEMU
+        - Boot macOS guests with Virtualization.framework on macOS 12+
+
+      See https://docs.getutm.app/ for more information.
+    '';
+    homepage = "https://mac.getutm.app/";
+    changelog = "https://github.com/utmapp/${pname}/releases/tag/v${version}";
+    mainProgram = "UTM";
+    license = licenses.apsl20;
+    platforms = platforms.darwin; # 11.3 is the minimum supported version as of UTM 4.
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ rrbutani ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/xattr/default.nix b/nixpkgs/pkgs/os-specific/darwin/xattr/default.nix
index 1aa8b49e88aa..7fe0f84606ce 100644
--- a/nixpkgs/pkgs/os-specific/darwin/xattr/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/xattr/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchzip
+, fetchFromGitHub
 , buildPythonPackage
 , python
 , ed
@@ -11,9 +11,11 @@ buildPythonPackage rec {
   pname = "xattr";
   version = "61.60.1";
 
-  src = fetchzip rec {
-    url = "https://opensource.apple.com/tarballs/python_modules/python_modules-${version}.tar.gz";
-    sha256 = "19kydl7w4vpdi7zmfd5z9vjkq24jfk2cv4j0pppw69j06czhdwwi";
+  src = fetchFromGitHub {
+    owner = "apple-oss-distributions";
+    repo = "python_modules";
+    rev = "python_modules-${version}";
+    hash = "sha256-kfMGPzNAJsPvvUCSzcR0kgg85U6/NFf/ie1uwg9tfqY=";
   };
 
   sourceRoot = "${src.name}/Modules/xattr-0.6.4";
@@ -22,6 +24,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     ed
     unifdef
+    python.pkgs.setuptools
   ];
 
   makeFlags = [
@@ -60,7 +63,10 @@ buildPythonPackage rec {
   '';
 
   makeWrapperArgs = [
-    "--prefix" "PYTHONPATH" ":" "${placeholder "python"}/${python.sitePackages}"
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    "${placeholder "python"}/${python.sitePackages}"
   ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/darwin/xcode/default.nix b/nixpkgs/pkgs/os-specific/darwin/xcode/default.nix
index 2ce607896b5e..ec98a0b1cfb6 100644
--- a/nixpkgs/pkgs/os-specific/darwin/xcode/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/xcode/default.nix
@@ -1,10 +1,10 @@
-{ buildPlatform, requireFile, targetPlatform, lib }:
+{ stdenv, requireFile, lib }:
 
 let requireXcode = version: sha256:
   let
     xip = "Xcode_" + version +  ".xip";
     # TODO(alexfmpe): Find out how to validate the .xip signature in Linux
-    unxip = if buildPlatform.isDarwin
+    unxip = if stdenv.buildPlatform.isDarwin
             then ''
               open -W ${xip}
               rm -rf ${xip}
@@ -41,31 +41,44 @@ let requireXcode = version: sha256:
   in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });
 
 in lib.makeExtensible (self: {
-  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-  xcode_9_3 = requireXcode "9.3" "12m9kb4759s2ky42b1vf7y38qqxn2j99s99adzc6ljnmy26ii12w";
-  xcode_9_4 = requireXcode "9.4" "00az1cf9pm8zmvzs6yq04prdmxp8xi3ymxw94jjh4mh7hlbkhcb7";
-  xcode_9_4_1 = requireXcode "9.4.1" "0y9kphj86c14jl6aibv57sd7ln0w06vdhzm8ysp0s98rfgyq2lbw";
-  xcode_10_1 = requireXcode "10.1" "1ssdbg4v8r11fjf4jl38pwyry2aia1qihbxyxapz0v0n5gfnp05v";
-  xcode_10_2 = requireXcode "10.2" "1xzybl1gvb3q5qwlwchanzpws4sb70i3plf0vrzvlfdp2hsb3pg7";
-  xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
-  xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
-  xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode_11_1 = requireXcode "11.1" "1c2gzc4jhhx5a7ncg19sh1r99izhipybaqxl1ll52x5y8689awc1";
-  xcode_11_2 = requireXcode "11.2" "1lm3q8zpvm184246h5j9mw4c1y9kk9sxnr3j98kfm0312n0l98gj";
-  xcode_11_3 = requireXcode "11.3" "04rv6xlywy8xqfx9ma8ygsdw4yhckk2mq0qnklxnfly899iw4wza";
-  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
-  xcode_11_4 = requireXcode "11.4" "065rpb3rdk19nv3rwyf9bk32ccbd0lld12gj12l89cyg65mhpyy7";
-  xcode_11_5 = requireXcode "11.5" "1dizazq9nz1vjkc5gy7dd4x760mkfjiifk1hf6d9mscchdq8rfkw";
-  xcode_11_6 = requireXcode "11.6" "1y4fhw1kiphzxdb4wpv697z5r0algvaldwq5iqv266797rnfql4x";
-  xcode_11_7 = requireXcode "11.7" "0422rdc4j5qwyk59anbybxyfv0p26x0xryszm0wd8i44g66smlmj";
-  xcode_12 = requireXcode "12" "1w3xm268pyn5m04wv22invd5kr2k4jqllgrzapv6n1sxxynxrh8z";
-  xcode_12_0_1 = requireXcode "12.0.1" "1p6vd5ai0hh3cq6aflh4h21ar0shxnz8wlkaxwq7liwsdmkwzbl0";
-  xcode_12_1 = requireXcode "12.1" "1widy74dk43wx8iqgd7arzf6q4kzdmaz8pfwymzs8chnq9dqr3wp";
-  xcode_12_2 = requireXcode "12.2" "17i0wf4pwrxwfgjw7rpw9mcd59nkmys1k5h2rqsw81snzyxy9j0v";
-  xcode_12_3 = requireXcode "12.3" "0kwf1y4llysf1p0nsbqyzccn7d77my0ldagr5fi3by4k0xy3d189";
-  xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (targetPlatform ? xcodeVer) then targetPlatform.xcodeVer else "12.3")}";
+  xcode_8_1 = requireXcode "8.1" "sha256-VuAovU/b4rcLh+xMtcsZmbTWwTk35VGfMSp+fqPbsqM=";
+  xcode_8_2 = requireXcode "8.2" "sha256-ohqgGD7JEEmXEvmfn/N9Ga2lM8jNwhIuh+ky7PQPzY4=";
+  xcode_9_1 = requireXcode "9.1" "sha256-LG7pVMh1rNh5uP/bASvV9sKvGDrSGWH90J4gzwcgYSk=";
+  xcode_9_2 = requireXcode "9.2" "sha256-jMiG2G2zoGw4m00CjkGE+2cn0qeOdSUcXosZI2577q0=";
+  xcode_9_3 = requireXcode "9.3" "sha256-XIQYjfDVSmrYbyolnZIUtmOMhj9uhyWIn0KncsiaqYo=";
+  xcode_9_4 = requireXcode "9.4" "sha256-ZzE4F4UHVgKlJIn36kfs6Pba8iUAe6P/rh/VmxwLXwE=";
+  xcode_9_4_1 = requireXcode "9.4.1" "sha256-fFGB/XMZJQ2u9qh+2LYBHFh6mj5lr6gMlSQwgyS8M3k=";
+  xcode_10_1 = requireXcode "10.1" "sha256-u4Br3SsWbPCv6r4vGHFQUQmfPb9oUEmcdCFktMlbTes=";
+  xcode_10_2 = requireXcode "10.2" "sha256-592xNBS3Obp/3sDROyI4SxPN77cKMk45Lnis/QJd/vc=";
+  xcode_10_2_1 = requireXcode "10.2.1" "sha256-r65DbLDpiFJ78VH2hvfp7ZVpehoI44PSnaeDbElZTYc=";
+  xcode_10_3 = requireXcode "10.3" "sha256-61lDed7/Wi6uVBaj6/fUELISvmH3j69dQE19Y91GwsQ=";
+  xcode_11 = requireXcode "11" "sha256-EDM5tjuzGTzlVUg6MJKup/Q2OBrFXjzFdXSRO+eQA+Q=";
+  xcode_11_1 = requireXcode "11.1" "sha256-gXGVkEG+dFEoDbRjtfyN8MeUcoA6hcfsUaVDKAn7T7A=";
+  xcode_11_2 = requireXcode "11.2" "sha256-8qFEgRVhgOomSnJk23WaM/nACK9JFmiIICjUfT/Co9I=";
+  xcode_11_3 = requireXcode "11.3" "sha256-6nPCY0rIU2c7nRYDXMWcDHrCm34eqZq6wx157mk3OxM=";
+  xcode_11_3_1 = requireXcode "11.3.1" "sha256-BI8Olfqyxh51jyNpydiRkPwTQ4OK+ZpHUybPkCSL1tw=";
+  xcode_11_4 = requireXcode "11.4" "sha256-x/sLazHPs4SoCPKJ0CgFbTEmxlzJeZ7HtinMlse6uRg=";
+  xcode_11_5 = requireXcode "11.5" "sha256-fLqMcIOM6ZqacTBMF6N0swJzOmnt+FfYlDt8m/BXP7Y=";
+  xcode_11_6 = requireXcode "11.6" "sha256-nVDsbD7pGCM2jgXzRtV+VIFc/klmX05W6x/eOAOHjvg=";
+  xcode_11_7 = requireXcode "11.7" "sha256-stKqjXmERNQ4qF/73EE34oLtfF9+WZXK9BwXSVjLQhA=";
+  xcode_12 = requireXcode "12" "sha256-H8Hcre9dB2v2VT8/SrEkU+RZ2rZRiM0JqMX6i4yoffA=";
+  xcode_12_0_1 = requireXcode "12.0.1" "sha256-gK7PZ22aR3ow72pSjr7tUIOsgoAEUqcMZgNCEFVp29w=";
+  xcode_12_1 = requireXcode "12.1" "sha256-l4+MW8IWMqR/9dxd9FVtfxJs3M/qtIcj6nyQ2cjxLfI=";
+  xcode_12_2 = requireXcode "12.2" "sha256-G8jku/9WB8Q1zgKWGbSv06bSWE385sPlc7xnfonjIJ4=";
+  xcode_12_3 = requireXcode "12.3" "sha256-CYU2fAeT+DWiK/mpRoGv57RjGfseL23BDU57SokPjk8=";
+  xcode_12_4 = requireXcode "12.4" "sha256-Qw4j+XFry85/AviHQVhjjjKLAfmRNNwMGN5G8FheJwQ=";
+  xcode_12_5 = requireXcode "12.5" "sha256-xiGffnV0P9Ojd6IrJSXILUX4oznPif7zm00WAksn3qU=";
+  xcode_12_5_1 = requireXcode "12.5.1" "sha256-zL0kS86ZzBkIrKLPKvWguDvXj9Tqbr7uR/VZaT/uZ9A=";
+  xcode_13 = requireXcode "13" "sha256-uTY6d5DBu4OOQLkxs3ExDfLXh50rE2LLlqtCbk3Qn6E=";
+  xcode_13_1 = requireXcode "13.1" "sha256-vd+4eFVaAyvXsdaExcfbDZSXOwkpt+rEbkBYSMjdUEA=";
+  xcode_13_2 = requireXcode "13.2" "sha256-guJXm/QnMfvUZwAcJwoy0QeO+DpDcUhs8AxVKvm9tYQ=";
+  xcode_13_2_1 = requireXcode "13.2.1" "sha256-r832Uu+Q8utK4zN0CtwiMCvMYT5HstWInyq4cNIaZJM=";
+  xcode_13_3 = requireXcode "13.3" "sha256-p2zaWMpmUeNHQtYOOaVdhCt3cgapvzL3l73/J+UwzCE=";
+  xcode_13_3_1 = requireXcode "13.3.1" "sha256-j71vpJVJpyj/IOlL+4+5lYgOlhf/zn+7ExIHbxL51cQ=";
+  xcode_13_4 = requireXcode "13.4" "sha256-IY1coss90GlBeJg/HQPMU8v2rOOxsqlY5q+2Qxe8nnY=";
+  xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
+  xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
+  xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
+  xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
 
diff --git a/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix b/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
index 0512d9dd46a1..50eb50ea6b78 100644
--- a/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
@@ -1,4 +1,4 @@
-{ targetPlatform
+{ stdenv
 , clang-unwrapped
 , binutils-unwrapped
 , runCommand
@@ -12,7 +12,7 @@
 
 let
 
-minSdkVersion = targetPlatform.minSdkVersion or "9.0";
+minSdkVersion = stdenv.targetPlatform.minSdkVersion or "9.0";
 
 in
 
@@ -22,8 +22,8 @@ rec {
     type = "derivation";
     outPath = xcode + "/Contents/Developer/Platforms/${platform}.platform/Developer/SDKs/${platform}${version}.sdk";
 
-    platform = targetPlatform.xcodePlatform;
-    version = targetPlatform.sdkVer;
+    platform = stdenv.targetPlatform.xcodePlatform;
+    version = stdenv.targetPlatform.sdkVer;
   };
 
   binutils = wrapBintoolsWith {
@@ -39,7 +39,7 @@ rec {
     extraBuildCommands = ''
       tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
       mv cc-cflags.tmp $out/nix-support/cc-cflags
-      echo "-target ${targetPlatform.config}" >> $out/nix-support/cc-cflags
+      echo "-target ${stdenv.targetPlatform.config}" >> $out/nix-support/cc-cflags
       echo "-isystem ${sdk}/usr/include${lib.optionalString (lib.versionAtLeast "10" sdk.version) " -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++"}" >> $out/nix-support/cc-cflags
       ${lib.optionalString (lib.versionAtLeast sdk.version "14") "echo -isystem ${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1 >> $out/nix-support/cc-cflags"}
     '';
diff --git a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
index 5a3daed9fff8..34cc787b9ed8 100644
--- a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
@@ -1,39 +1,145 @@
-{ lib, stdenv, fetchFromGitHub, darwin, xxd }:
+{ lib
+, stdenv
+, stdenvNoCC
+, fetchFromGitHub
+, fetchzip
+, writeShellScript
+, installShellFiles
+, testers
+, yabai
+, xxd
+, xcodebuild
+  # These all need to be from SDK 11.0 or later starting with yabai 5.0.0
+, Carbon
+, Cocoa
+, ScriptingBridge
+, SkyLight
+}:
 
-stdenv.mkDerivation rec {
+let
   pname = "yabai";
-  version = "3.3.10";
+  version = "5.0.4";
 
-  src = fetchFromGitHub {
-    owner = "koekeishiya";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-8O6//T894C32Pba3F2Z84Z6VWeCXlwml3xsXoIZGqL0=";
+  test-version = testers.testVersion {
+    package = yabai;
+    version = "yabai-v${version}";
   };
 
-  nativeBuildInputs = [ xxd ];
-
-  buildInputs = with darwin.apple_sdk.frameworks; [
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/man/man1/
-    cp ./bin/yabai $out/bin/yabai
-    cp ./doc/yabai.1 $out/share/man/man1/yabai.1
-  '';
-
-  meta = with lib; {
-    description = ''
-      A tiling window manager for macOS based on binary space partitioning
+  _meta = with lib; {
+    description = "A tiling window manager for macOS based on binary space partitioning";
+    longDescription = ''
+      yabai is a window management utility that is designed to work as an extension to the built-in
+      window manager of macOS. yabai allows you to control your windows, spaces and displays freely
+      using an intuitive command line interface and optionally set user-defined keyboard shortcuts
+      using skhd and other third-party software.
     '';
     homepage = "https://github.com/koekeishiya/yabai";
-    platforms = platforms.darwin;
-    maintainers = with maintainers; [ cmacrae shardy ];
+    changelog = "https://github.com/koekeishiya/yabai/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [
+      cmacrae
+      shardy
+      ivar
+    ];
+  };
+in
+{
+  # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
+  # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
+  aarch64-darwin = stdenvNoCC.mkDerivation {
+    inherit pname version;
+
+    src = fetchzip {
+      url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
+      sha256 = "sha256-2PH3Hi9x0323MjKHPybNmFddvNNlsaDb1LdiVcZTNJc=";
+    };
+
+    nativeBuildInputs = [
+      installShellFiles
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r ./bin $out
+      installManPage ./doc/yabai.1
+
+      runHook postInstall
+    '';
+
+    passthru.tests.version = test-version;
+
+    meta = _meta // {
+      sourceProvenance = with lib.sourceTypes; [
+        binaryNativeCode
+      ];
+    };
+  };
+
+  x86_64-darwin = stdenv.mkDerivation {
+    inherit pname version;
+
+    src = fetchFromGitHub {
+      owner = "koekeishiya";
+      repo = "yabai";
+      rev = "v${version}";
+      sha256 = "sha256-TCY0EvP0+2+U1k9kYIi8jMt4mj3ZRaQPsb1wtU3Z2U4=";
+    };
+
+    nativeBuildInputs = [
+      installShellFiles
+      xcodebuild
+      xxd
+    ];
+
+    buildInputs = [
+      Carbon
+      Cocoa
+      ScriptingBridge
+      SkyLight
+    ];
+
+    dontConfigure = true;
+    enableParallelBuilding = true;
+
+    postPatch = ''
+      # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
+      # Since multilib doesnt work on darwin i dont know of a better way of handling this.
+      substituteInPlace makefile \
+        --replace "-arch arm64e" "" \
+        --replace "-arch arm64" "" \
+        --replace "clang" "${stdenv.cc.targetPrefix}clang"
+
+      # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
+      # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
+      # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
+      substituteInPlace src/workspace.m \
+        --replace 'return screen.safeAreaInsets.top;' 'return 0;'
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
+
+      cp ./bin/yabai $out/bin/yabai
+      cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg
+      installManPage ./doc/yabai.1
+
+      runHook postInstall
+    '';
+
+    passthru.tests.version = test-version;
+
+    meta = _meta // {
+      sourceProvenance = with lib.sourceTypes; [
+        fromSource
+      ];
+    };
   };
-}
+}.${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}")
diff --git a/nixpkgs/pkgs/os-specific/linux/acpid/default.nix b/nixpkgs/pkgs/os-specific/linux/acpid/default.nix
index b766739aaafa..8f981ec401bc 100644
--- a/nixpkgs/pkgs/os-specific/linux/acpid/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/acpid/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "acpid";
-  version = "2.0.33";
+  version = "2.0.34";
 
   src = fetchurl {
     url = "mirror://sourceforge/acpid2/acpid-${version}.tar.xz";
-    sha256 = "sha256-CFb3Gz6zShtmPQqOY2Pfy8UZ5j2EczBJiJhljily2+g=";
+    sha256 = "sha256-LQlcjPy8hHyux0bWLNyNC/8ewbxy73xnTHIeBNpqszM=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/nixpkgs/pkgs/os-specific/linux/adcli/default.nix b/nixpkgs/pkgs/os-specific/linux/adcli/default.nix
index 977c1d09dbae..66e017437f9d 100644
--- a/nixpkgs/pkgs/os-specific/linux/adcli/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/adcli/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , openldap
 , libkrb5
 , libxslt
@@ -16,25 +15,33 @@
 
 stdenv.mkDerivation rec {
   pname = "adcli";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "realmd";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Zzt4qgLiJNuSrbtDWuxJEfGL7sWSbqN301q3qXZpn9c=";
+    sha256 = "sha256-dipNKlIdc1DpXLg/YJjUxZlNoMFy+rt8Y/+AfWFA4dE=";
   };
 
-  # https://bugs.gentoo.org/820224
-  # Without this it produces some weird missing symbol error in glibc
-  patches = [
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-crypt/adcli/files/adcli-0.9.1-glibc-2.34-resolv.patch?id=01db544de893262e857685e11b33c2a74210181f";
-      sha256 = "sha256-dZ6dkzxd+0XjY/X9/2IWMan3syvCDGFHiMbxFxMHGFA=";
-    })
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    docbook_xsl
+    util-linux
+    xmlto
   ];
 
+  buildInputs = [
+    openldap
+    libkrb5
+    libxslt
+    cyrus_sasl
+  ];
+
+  configureFlags = [ "--disable-debug" ];
+
   postPatch = ''
     substituteInPlace tools/Makefile.am \
       --replace 'sbin_PROGRAMS' 'bin_PROGRAMS'
@@ -43,7 +50,7 @@ stdenv.mkDerivation rec {
         --replace 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl' \
                   '${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl'
 
-    function patch_docbook(){
+    function patch_docbook() {
       substituteInPlace $1 \
         --replace "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" \
                   "${docbook_xml_dtd_43}/xml/dtd/docbook/docbookx.dtd"
@@ -52,17 +59,12 @@ stdenv.mkDerivation rec {
     patch_docbook doc/adcli-devel.xml
     patch_docbook doc/adcli-docs.xml
   '';
-  nativeBuildInputs = [ autoreconfHook pkg-config docbook_xsl ];
-
-  buildInputs = [ openldap libkrb5 libxslt cyrus_sasl util-linux xmlto docbook_xsl ];
-
-  configureFlags = [ "--disable-debug" ];
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
     description = "A helper library and tools for Active Directory client operations.";
     license = licenses.lgpl21Only;
-    maintainers = with maintainers; [ SohamG ];
+    maintainers = with maintainers; [ SohamG anthonyroussel ];
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
index 8ddc97890e92..06b6ef47d430 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPackages, stdenvNoCC, autoreconfHook, fetchurl }:
+{ lib, buildPackages, stdenvNoCC, autoreconfHook, fetchurl, fetchpatch }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "alsa-firmware";
@@ -9,6 +9,14 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-tnttfQi8/CR+9v8KuIqZwYgwWjz1euLf0LzZpbNs1bs=";
   };
 
+  patches = [
+    # fixes some includes / missing types on musl libc; should not make a difference for other platforms
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/ae690000017d5fd355ab397c49202426e3a01c11/srcpkgs/alsa-firmware/patches/musl.patch";
+      sha256 = "sha256-4A+TBBvpz14NwMNewLc2LQL51hnz4EZlZ44rhnx5dnc=";
+    })
+  ];
+
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index db8ede6feb81..f0eb34906073 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -3,15 +3,16 @@
 , fetchurl
 , alsa-topology-conf
 , alsa-ucm-conf
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.7.2";
+  version = "1.2.9";
 
   src = fetchurl {
-    url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-ijW3IY5Q8qLHk0LQ3pje2BQ5zhnhKAk4Xsm+lZbefC8=";
+    url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-3JxkP9xMz9BXLMaFhY3UHgivtYPzBGCzF+QYgnX2FbI=";
   };
 
   patches = [
@@ -31,6 +32,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "http://www.alsa-project.org/";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
@@ -41,7 +44,8 @@ stdenv.mkDerivation rec {
     '';
 
     license = licenses.lgpl21Plus;
+    pkgConfigModules = [ "alsa" "alsa-topology" ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ l-as ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix
index 8b9abb74036b..10f7f2e64d04 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix
@@ -1,54 +1,101 @@
-{ lib, stdenv, fetchurl, alsa-lib, pkg-config, gtk2, gtk3, fltk13 }:
-# Comes from upstream as as bundle of several tools,
-# some use gtk2, some gtk3 (and some even fltk13).
+{ lib
+, stdenv
+, fetchurl
+, alsa-lib
+, fltk13
+, gtk2
+, gtk3
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-tools";
   version = "1.2.5";
 
   src = fetchurl {
-    url = "mirror://alsa/tools/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-NacQJ6AfTX3kci4iNSDpQN5os8VwtsZxaRVnrij5iT4=";
+    url = "mirror://alsa/tools/alsa-tools-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-NacQJ6AfTX3kci4iNSDpQN5os8VwtsZxaRVnrij5iT4=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ alsa-lib gtk2 gtk3 fltk13 ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  patchPhase = ''
-    export tools="as10k1 hda-verb hdspmixer echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
-    # export tools="as10k1 hda-verb hdspmixer qlo10k1 seq usx2yloader echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
-  '';
+  buildInputs = [
+    alsa-lib
+    fltk13
+    gtk2
+    gtk3
+  ];
+
+  env.TOOLSET = lib.concatStringsSep " " [
+    "as10k1"
+    "echomixer"
+    "envy24control"
+    "hda-verb"
+    "hdajackretask"
+    "hdajacksensetest"
+    "hdspconf"
+    "hdsploader"
+    "hdspmixer"
+    # "hwmixvolume" # Requires old, unmaintained, abandoned EOL Python 2
+    "ld10k1"
+    # "qlo10k1" # needs Qt
+    "mixartloader"
+    "pcxhrloader"
+    "rmedigicontrol"
+    "sb16_csp"
+    # "seq" # mysterious configure error
+    "sscape_ctl"
+    "us428control"
+    # "usx2yloader" # tries to create /etc/hotplug/usb
+    "vxloader"
+  ];
 
   configurePhase = ''
-    for tool in $tools; do
-      echo "Tool: $tool:"
-      cd "$tool"; ./configure --prefix="$out"; cd -
+    runHook preConfigure
+
+    for tool in $TOOLSET; do
+      echo "Configuring $tool:"
+      pushd "$tool"
+      ./configure --prefix="$out"
+      popd
     done
+
+    runHook postConfigure
   '';
 
   buildPhase = ''
-    for tool in $tools; do
-      cd "$tool"; make; cd -
+    runHook preBuild
+
+    for tool in $TOOLSET; do
+      echo "Building $tool:"
+      pushd "$tool"
+      make
+      popd
     done
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    for tool in $tools; do
-      cd "$tool"; make install; cd -
+    runHook preInstall
+
+    for tool in $TOOLSET; do
+      echo "Installing $tool:"
+      pushd "$tool"
+      make install
+      popd
     done
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://www.alsa-project.org/";
-    description = "ALSA, the Advanced Linux Sound Architecture tools";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.fps ];
+    description = "ALSA Tools";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index 512fe605b6e5..75ec2932c890 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
-  version = "1.2.7.1";
+  version = "1.2.9";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-rFsqEnV4Pv8H4cs0w2xsWYd0JnmjQAN1B8BKncHSLKw=";
+    hash = "sha256-N09oM7/XfQpGdeSqK/t53v6FDlpGpdRUKkWWL0ueJyo=";
   };
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
index e8c6a2ae566f..07705f568a1d 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
-  version = "1.2.7";
+  version = "1.2.9";
 
   src = fetchurl {
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-6Qa/JAT/BMRI6qPSJtKDpiuaKD8S5P2EV/skusJ05ng=";
+    sha256 = "sha256-52I9RSVZX5LhHOJe6al/IEChTG5NzQJ6qW4Gy854F70=";
   };
 
   nativeBuildInputs = [ gettext makeWrapper ];
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/default.nix
new file mode 100644
index 000000000000..15077cc8d77a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/default.nix
@@ -0,0 +1,13 @@
+{ lib, pkgs }:
+
+lib.makeScope pkgs.newScope (self: {
+  alsa-firmware = self.callPackage ./alsa-firmware { };
+  alsa-lib = self.callPackage ./alsa-lib { };
+  alsa-oss = self.callPackage ./alsa-oss { };
+  alsa-plugins = self.callPackage ./alsa-plugins { };
+  alsa-plugins-wrapper = self.callPackage ./alsa-plugins/wrapper.nix { };
+  alsa-tools = self.callPackage ./alsa-tools { };
+  alsa-topology-conf = self.callPackage ./alsa-topology-conf { };
+  alsa-ucm-conf = self.callPackage ./alsa-ucm-conf { };
+  alsa-utils = self.callPackage ./alsa-utils { fftw = pkgs.fftwFloat; };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/amdctl/default.nix b/nixpkgs/pkgs/os-specific/linux/amdctl/default.nix
new file mode 100644
index 000000000000..1fcd8fc93402
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/amdctl/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "amdctl";
+  version = "0.11";
+
+  src = fetchFromGitHub {
+    owner = "kevinlekiller";
+    repo = "amdctl";
+    rev = "v${version}";
+    hash = "sha256-2wBk/9aAD7ARMGbcVxk+CzEvUf8U4RS4ZwTCj8cHNNo=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 amdctl $out/bin/amdctl
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux.";
+    homepage = "https://github.com/kevinlekiller/amdctl";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/anbox/default.nix b/nixpkgs/pkgs/os-specific/linux/anbox/default.nix
index 2a98aa82ebbd..7329dc7df2ce 100644
--- a/nixpkgs/pkgs/os-specific/linux/anbox/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/anbox/default.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  # Flag needed by GCC 12 but unrecognized by GCC 9 (aarch64-linux default now)
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (with stdenv; cc.isGNU && lib.versionAtLeast cc.version "12") [
+    "-Wno-error=mismatched-new-delete"
+  ]);
+
   patchPhase = ''
     patchShebangs scripts
 
diff --git a/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
index 530292fe8629..5575ece33149 100644
--- a/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20220102";
+  version = "20230303";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "sha256-D2dPFvuFcZtosfTfsW0lmK5y8zqHdIxJBlvmP/R91CE=";
+    sha256 = "sha256-ddalOVt0gLuTcwk322fNNn6WNZx1Ubsa4MgaG0Lmn2k=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
index bcc53e82b9aa..70c344903f54 100644
--- a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
@@ -2,17 +2,21 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nixosTests
 }:
 
+let
+  tag = "0.3.3";
+in
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2022-07-24-${kernel.version}";
+  version = "${tag}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "925d86b7be3ccf21b17734cfececf40e43c4598e";
-    sha256 = "sha256-N5lGJu4c03cVDk3WTcegzZHBDmguPEX8dCedJS2TMSI=";
+    rev = "v${tag}";
+    hash = "sha256-dxbpJ9Jdn8u16yD001zCZxrr/nPbxdpF7JvU+oD+hTw=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -24,12 +28,23 @@ stdenv.mkDerivation {
     "INSTALL_MOD_PATH=$(out)"
   ];
 
+  passthru.tests.test = nixosTests.apfs;
+
   meta = with lib; {
     description = "APFS module for linux";
+    longDescription = ''
+      The Apple File System (APFS) is the copy-on-write filesystem currently
+      used on all Apple devices. This module provides a degree of experimental
+      support on Linux.
+      If you make use of the write support, expect data corruption.
+      Read-only support is somewhat more complete, with sealed volumes,
+      snapshots, and all the missing compression algorithms recently added.
+      Encryption is still not in the works though.
+    '';
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.9" || kernel.kernelAtLeast "5.19";
+    broken = kernel.kernelOlder "4.9";
     maintainers = with maintainers; [ Luflosi ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
index f7a2c0c52a95..33cdc0fb8450 100644
--- a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
@@ -18,16 +18,17 @@
 , writeShellScript
 , closureInfo
 , runCommand
+, libxcrypt
 }:
 
 let
-  apparmor-version = "3.0.4";
+  apparmor-version = "3.1.4";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
     description = "A mandatory access control system - ${component}";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ joachifm julm thoughtpolice ];
+    maintainers = with maintainers; [ julm thoughtpolice ];
     platforms = platforms.linux;
   };
 
@@ -35,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    sha256 = "1a217j28rgfq4lsmpn0wv1xgmdr9ba8iysv9i6q477kj6z77zrb9";
+    hash = "sha256-YWPdIUd+2x74tqiW+YX8NKh3jxSKhD+5zdiDMjhPzpE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -93,7 +94,8 @@ let
       perl
     ] ++ lib.optional withPython python;
 
-    buildInputs = lib.optional withPerl perl
+    buildInputs = [ libxcrypt ]
+      ++ lib.optional withPerl perl
       ++ lib.optional withPython python;
 
     # required to build apparmor-parser
@@ -212,7 +214,7 @@ let
   };
 
   apparmor-parser = stdenv.mkDerivation {
-    name = "apparmor-parser";
+    pname = "apparmor-parser";
     version = apparmor-version;
 
     src = apparmor-sources;
diff --git a/nixpkgs/pkgs/os-specific/linux/asus-ec-sensors/default.nix b/nixpkgs/pkgs/os-specific/linux/asus-ec-sensors/default.nix
index f046ec206ab6..c80f18a78ece 100644
--- a/nixpkgs/pkgs/os-specific/linux/asus-ec-sensors/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/asus-ec-sensors/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "asus-ec-sensors-${version}-${kernel.version}";
-  version = "unstable-2021-12-16";
+  version = "unstable-2022-07-10";
 
   src = fetchFromGitHub {
     owner = "zeule";
     repo = "asus-ec-sensors";
-    rev = "3621741c4ecb93216d546942707a9c413e971787";
-    sha256 = "0akdga2854q3w0pyi0jywa6cxr32541ifz0ka1hgn6j4czk39kyn";
+    rev = "5fbdd1461dc88fc952e02717b8120438ce5558b3";
+    sha256 = "sha256-kBGl8i7HzdItMoM7L91OfX6y+bqDfd22WICRg0n25pI=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ nickhu ];
+    broken = kernel.kernelOlder "5.11";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/atop/default.nix b/nixpkgs/pkgs/os-specific/linux/atop/default.nix
index 47f76649dea9..808d1bc42376 100644
--- a/nixpkgs/pkgs/os-specific/linux/atop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/atop/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atop";
-  version = "2.7.1";
+  version = "2.8.1";
 
   src = fetchurl {
     url = "https://www.atoptool.nl/download/atop-${version}.tar.gz";
-    sha256 = "sha256-ykjS8X4HHe6tXm6cyeOIv2oycNaV5hl2s3lNTZJ7XE4=";
+    sha256 = "sha256-lwBYoZt5w0RPlx+FRXKg5jiR3C1fcDf/g3VwhUzg2h4=";
   };
 
   nativeBuildInputs = lib.optionals withAtopgpu [
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff b/nixpkgs/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff
new file mode 100644
index 000000000000..ce76fc3b87a5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff
@@ -0,0 +1,12 @@
+--- a/auparse/auparse.h
++++ b/auparse/auparse.h
+@@ -32,6 +32,9 @@
+ # define __attr_dealloc(dealloc, argno)
+ # define __attr_dealloc_free
+ #endif
++#ifndef __attribute_malloc__
++# define __attribute_malloc__ __attribute__ ((__malloc__))
++#endif
+ 
+ #ifdef __cplusplus
+ extern "C" {
\ No newline at end of file
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch b/nixpkgs/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch
new file mode 100644
index 000000000000..e072cc942cfb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch
@@ -0,0 +1,35 @@
+From beed138222421a2eb4212d83cb889404bd7efc49 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyich@gmail.com>
+Date: Wed, 23 Mar 2022 07:27:05 +0000
+Subject: [PATCH] auditswig.i: avoid setter generation for audit_rule_data::buf
+
+As it's a flexible array generated code was never safe to use.
+With kernel's https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed98ea2128b6fd83bce13716edf8f5fe6c47f574
+change it's a build failure now:
+
+    audit> audit_wrap.c:5010:15: error: invalid use of flexible array member
+    audit>  5010 |     arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size));
+    audit>       |               ^
+
+Let's avoid setter generation entirely.
+
+Closes: https://github.com/linux-audit/audit-userspace/issues/252
+---
+ bindings/swig/src/auditswig.i | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/bindings/swig/src/auditswig.i b/bindings/swig/src/auditswig.i
+index 21aafca31..9a2c5661d 100644
+--- a/bindings/swig/src/auditswig.i
++++ b/bindings/swig/src/auditswig.i
+@@ -39,6 +39,10 @@ signed
+ #define __attribute(X) /*nothing*/
+ typedef unsigned __u32;
+ typedef unsigned uid_t;
++/* Sidestep SWIG's limitation of handling c99 Flexible arrays by not:
++ * generating setters against them: https://github.com/swig/swig/issues/1699
++ */
++%ignore audit_rule_data::buf;
+ %include "/usr/include/linux/audit.h"
+ #define __extension__ /*nothing*/
+ %include <stdint.i>
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/default.nix b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
index bda8d8ab30c5..0fd96892013d 100644
--- a/nixpkgs/pkgs/os-specific/linux/audit/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
@@ -1,103 +1,79 @@
-{
-  lib, stdenv, buildPackages, fetchurl, fetchpatch,
-  runCommand,
-  autoreconfHook,
-  autoconf, automake, libtool, bash,
-  # Enabling python support while cross compiling would be possible, but
-  # the configure script tries executing python to gather info instead of
-  # relying on python3-config exclusively
-  enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, python3, swig,
-  linuxHeaders ? stdenv.cc.libc.linuxHeaders
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, bash
+, buildPackages
+, libtool
+, linuxHeaders
+, python3
+, swig
+
+# Enabling python support while cross compiling would be possible, but the
+# configure script tries executing python to gather info instead of relying on
+# python3-config exclusively
+, enablePython ? stdenv.hostPlatform == stdenv.buildPlatform,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "2.8.5"; # at the next release, remove the patches below!
+  version = "3.1.1";
 
   src = fetchurl {
-    url = "https://people.redhat.com/sgrubb/audit/audit-${version}.tar.gz";
-    sha256 = "1dzcwb2q78q7x41shcachn7f4aksxbxd470yk38zh03fch1l2p8f";
+    url = "https://people.redhat.com/sgrubb/audit/audit-${finalAttrs.version}.tar.gz";
+    hash = "sha256-RuRrN2I8zgnm7hNOeNZor8NPThyHDIU+8S5BkweM/oc=";
   };
 
+  patches = [
+    ./000-fix-static-attribute-malloc.diff
+    ./001-ignore-flexible-array.patch
+  ];
+
+  postPatch = ''
+    sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
+    substituteInPlace bindings/swig/src/auditswig.i \
+      --replace "/usr/include/linux/audit.h" \
+                "${linuxHeaders}/include/linux/audit.h"
+  '';
+
   outputs = [ "bin" "dev" "out" "man" ];
 
   strictDeps = true;
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook ]
-    ++ lib.optionals enablePython [ python3 swig ];
-  buildInputs = [ bash ];
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ]
+  ++ lib.optionals enablePython [
+    python3
+    swig
+  ];
+
+  buildInputs = [
+    bash
+  ];
 
   configureFlags = [
-    # z/OS plugin is not useful on Linux,
-    # and pulls in an extra openldap dependency otherwise
+    # z/OS plugin is not useful on Linux, and pulls in an extra openldap
+    # dependency otherwise
     "--disable-zos-remote"
-    (if enablePython then "--with-python" else "--without-python")
     "--with-arm"
     "--with-aarch64"
+    (if enablePython then "--with-python" else "--without-python")
   ];
 
   enableParallelBuilding = true;
 
-  # TODO: Remove the musl patches when
-  #         https://github.com/linux-audit/audit-userspace/pull/25
-  #       is available with the next release.
-  patches = [
-    ./patches/weak-symbols.patch
-    (fetchpatch {
-      # upstream build fix against -fno-common compilers like >=gcc-10
-      url = "https://github.com/linux-audit/audit-userspace/commit/017e6c6ab95df55f34e339d2139def83e5dada1f.patch";
-      sha256 = "100xa1rzkv0mvhjbfgpfm72f7c4p68syflvgc3xm6pxgrqqmfq8h";
-    })
-
-    (
-      let patch = fetchpatch {
-            url = "https://github.com/linux-audit/audit-userspace/commit/d579a08bb1cde71f939c13ac6b2261052ae9f77e.patch";
-            name = "Add-substitue-functions-for-strndupa-rawmemchr.patch";
-            sha256 = "015bvzflg1s1k5viap30nznlpjj44a66khyc8yq0waa68qwvdlsd";
-          };
-      in
-        runCommand "Add-substitue-functions-for-strndupa-rawmemchr.patch-fix-copyright-merge-conflict" {} ''
-          cp ${patch} $out
-          substituteInPlace $out --replace \
-              '-* Copyright (c) 2007-09,2011-16,2018 Red Hat Inc., Durham, North Carolina.' \
-              '-* Copyright (c) 2007-09,2011-16 Red Hat Inc., Durham, North Carolina.'
-        ''
-    )
-
-    # upstream fix for linux-headers-5.15 which removed ipx.h
-    (fetchpatch {
-      name = "no-ipx.patch";
-      url = "https://github.com/linux-audit/audit-userspace/commit/6b09724c69d91668418ddb3af00da6db6755208c.patch";
-      sha256 = "0qjq41ridyamajz9v9nyplgq7f8nn3fxw375s9sa5a0igsrx9pm0";
-      excludes = [ "ChangeLog" ];
-    })
-    # Fix pending upstream inclusion for linux-headers-5.17 support:
-    #  https://github.com/linux-audit/audit-userspace/pull/253
-    (fetchpatch {
-      name = "ignore-flexible-array.patch";
-      url = "https://github.com/linux-audit/audit-userspace/commit/beed138222421a2eb4212d83cb889404bd7efc49.patch";
-      sha256 = "1hf02zaxv6x0wmn4ca9fj48y2shks7vfna43i1zz58xw9jq7sza0";
-    })
-  ];
-
-  postPatch = ''
-    sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
-    substituteInPlace bindings/swig/src/auditswig.i \
-      --replace "/usr/include/linux/audit.h" \
-                "${linuxHeaders}/include/linux/audit.h"
-  ''
-  # According to https://stackoverflow.com/questions/13089166
-  # --whole-archive linker flag is required to be sure that linker
-  # correctly chooses strong version of symbol regardless of order of
-  # object files at command line.
-  + lib.optionalString stdenv.hostPlatform.isStatic ''
-    export LDFLAGS=-Wl,--whole-archive
-  '';
   meta = {
-    description = "Audit Library";
     homepage = "https://people.redhat.com/sgrubb/audit/";
-    license = lib.licenses.gpl2;
+    description = "Audit Library";
+    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/patches/weak-symbols.patch b/nixpkgs/pkgs/os-specific/linux/audit/patches/weak-symbols.patch
deleted file mode 100644
index 301ea9a5476c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/audit/patches/weak-symbols.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-Executables in src/ directory are built from source files in src/
-and are linked to libauparse, with both src/auditd-config.c and
-auparse/auditd-config.c defining "free_config" function.
-
-It is known (although obscure) behaviour of shared libraries that
-symbol defined in binary itself overrides symbol in shared library;
-with static linkage it expectedly results in multiple definition
-error.
-
-This set of fixes explicitly marks libauparse versions of
-conflicting functions as weak to have behaviour coherent with
-dynamic linkage version -- definitions in src/ overriding definition
-in auparse/.
-
-Still, this architecture is very strange and confusing.
-
-diff -r -U5 audit-2.8.5-orig/auparse/auditd-config.c audit-2.8.5/auparse/auditd-config.c
---- audit-2.8.5-orig/auparse/auditd-config.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/auparse/auditd-config.c	2021-01-13 11:36:12.716226498 +0000
-@@ -68,10 +68,11 @@
- };
- 
- /*
-  * Set everything to its default value
- */
-+#pragma weak clear_config
- void clear_config(struct daemon_conf *config)
- {
- 	config->local_events = 1;
- 	config->qos = QOS_NON_BLOCKING;
- 	config->sender_uid = 0;
-@@ -322,10 +323,11 @@
- 	if (config->log_file == NULL)
- 		return 1;
- 	return 0;
- }
- 
-+#pragma weak free_config
- void free_config(struct daemon_conf *config)
- {
- 	free((void*)config->log_file);
- }
- 
-diff -r -U5 audit-2.8.5-orig/auparse/interpret.c audit-2.8.5/auparse/interpret.c
---- audit-2.8.5-orig/auparse/interpret.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/auparse/interpret.c	2021-01-13 11:39:42.107217224 +0000
-@@ -545,10 +545,11 @@
- 	else
- 		snprintf(buf, size, "unknown(%d)", uid);
- 	return buf;
- }
- 
-+#pragma weak aulookup_destroy_uid_list
- void aulookup_destroy_uid_list(void)
- {
- 	if (uid_cache_created == 0)
- 		return;
- 
-@@ -2810,10 +2811,11 @@
- 
- /*
-  * This is the main entry point for the auparse library. Call chain is:
-  * auparse_interpret_field -> nvlist_interp_cur_val -> interpret
-  */
-+#pragma weak interpret
- const char *interpret(const rnode *r, auparse_esc_t escape_mode)
- {
- 	const nvlist *nv = &r->nv;
- 	int type;
- 	idata id;
-diff -r -U5 audit-2.8.5-orig/auparse/nvlist.c audit-2.8.5/auparse/nvlist.c
---- audit-2.8.5-orig/auparse/nvlist.c	2019-02-04 14:26:52.000000000 +0000
-+++ audit-2.8.5/auparse/nvlist.c	2021-01-13 11:37:37.190222757 +0000
-@@ -27,10 +27,11 @@
- #include "nvlist.h"
- #include "interpret.h"
- #include "auparse-idata.h"
- 
- 
-+#pragma weak nvlist_create
- void nvlist_create(nvlist *l)
- {
- 	l->head = NULL;
- 	l->cur = NULL;
- 	l->cnt = 0;
-@@ -47,17 +48,19 @@
- 	while (node->next)
- 		node = node->next;
- 	l->cur = node;
- }
- 
-+#pragma weak nvlist_next
- nvnode *nvlist_next(nvlist *l)
- {
- 	if (l->cur)
- 		l->cur = l->cur->next;
- 	return l->cur;
- }
- 
-+#pragma weak nvlist_append
- void nvlist_append(nvlist *l, nvnode *node)
- {
- 	nvnode* newnode = malloc(sizeof(nvnode));
- 
- 	newnode->name = node->name;
-@@ -141,10 +144,11 @@
- 	if (l->cur->interp_val)
- 		return l->cur->interp_val;
- 	return interpret(r, escape_mode);
- }
- 
-+#pragma weak nvlist_clear
- void nvlist_clear(nvlist* l)
- {
- 	nvnode* nextnode;
- 	register nvnode* current;
- 
-diff -r -U5 audit-2.8.5-orig/auparse/strsplit.c audit-2.8.5/auparse/strsplit.c
---- audit-2.8.5-orig/auparse/strsplit.c	2019-03-01 21:15:30.000000000 +0000
-+++ audit-2.8.5/auparse/strsplit.c	2021-01-13 11:38:04.306221556 +0000
-@@ -54,10 +54,11 @@
- 			return NULL;
- 		return s;
- 	}
- }
- 
-+#pragma weak audit_strsplit
- char *audit_strsplit(char *s)
- {
- 	static char *str = NULL;
- 	char *ptr;
- 
-diff -r -U5 audit-2.8.5-orig/lib/strsplit.c audit-2.8.5/lib/strsplit.c
---- audit-2.8.5-orig/lib/strsplit.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/lib/strsplit.c	2021-01-13 11:38:29.444220443 +0000
-@@ -23,10 +23,11 @@
- 
- #include <string.h>
- #include "libaudit.h"
- #include "private.h"
- 
-+#pragma weak audit_strsplit_r
- char *audit_strsplit_r(char *s, char **savedpp)
- {
- 	char *ptr;
- 
- 	if (s)
diff --git a/nixpkgs/pkgs/os-specific/linux/autofs/default.nix b/nixpkgs/pkgs/os-specific/linux/autofs/default.nix
index 5e552301fe48..48d12abcf2f5 100644
--- a/nixpkgs/pkgs/os-specific/linux/autofs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/autofs/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   '';
 
   # configure script is not finding the right path
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
 
   installPhase = ''
     make install SUBDIRS="lib daemon modules man" # all but samples
diff --git a/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
index ba3460938920..e0a4b9a0860d 100644
--- a/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "autosuspend";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "languitar";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-aIWqE422xfAzAyF+4hARYOcomZHraTrtxtw2YfAxJ1M=";
+    sha256 = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
   };
 
   postPatch = ''
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     dbus-python
   ];
 
-  checkInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
     python-dbusmock
     pytest-httpserver
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix b/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
index 9167b4e5f89d..91999c0113c6 100644
--- a/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
@@ -1,15 +1,37 @@
-{ kernel, stdenv, kmod, lib, fetchzip }:
-stdenv.mkDerivation
-{
+{ kernel, stdenv, kmod, lib, fetchzip, dos2unix }:
+
+stdenv.mkDerivation {
   pname = "ax99100";
   version = "1.8.0";
-  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  nativeBuildInputs = [ dos2unix kmod ] ++ kernel.moduleBuildDependencies;
+
   src = fetchzip {
     url = "https://www.asix.com.tw/en/support/download/file/1229";
     sha256 = "1rbp1m01qr6b3nbr72vpbw89pjh8mddc60im78z2yjd951xkbcjh";
     extension = "tar.bz2";
   };
 
+  prePatch = ''
+    # The sources come with Windows file endings and that makes
+    # applying patches hard without first fixing the line endings.
+    dos2unix *.c *.h
+  '';
+
+  # The patches are adapted from: https://aur.archlinux.org/packages/asix-ax99100
+  #
+  # We included them here instead of fetching them, because of line
+  # ending issues that are easier to fix manually. Also the
+  # set_termios patch needs to be applied for 6.1 not for 6.0.
+  patches = [
+    ./kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
+    ./kernel-6.1-set_termios-const-ktermios.patch
+  ] ++ lib.optionals (lib.versionAtLeast kernel.version "6.2") [
+    ./kernel-6.2-fix-pointer-type.patch
+  ];
+
+  patchFlags = [ "-p0" ];
+
   makeFlags = [ "KDIR='${kernel.dev}/lib/modules/${kernel.modDirVersion}/build'" ];
 
   installPhase = ''
@@ -18,12 +40,13 @@ stdenv.mkDerivation
   '';
 
   meta = {
-    description = "ASIX AX99100 Serial and Parralel Port driver";
+    description = "ASIX AX99100 Serial and Parallel Port driver";
     homepage = "https://www.asix.com.tw/en/product/Interface/PCIe_Bridge/AX99100";
     # According to the source code in the tarball, the license is gpl2.
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
-    # currently, the build fails with kernels newer than 5.17
-    broken = lib.versionAtLeast kernel.version "5.18.0";
+
+    # Older Linux versions need more patches to work.
+    broken = lib.versionOlder kernel.version "5.4.0";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
new file mode 100644
index 000000000000..05ec0cfad222
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
@@ -0,0 +1,14 @@
+diff -pNaru5 a/ax99100_sp.h b/ax99100_sp.h
+--- ax99100_sp.h	2022-06-07 16:55:26.621034945 -0400
++++ ax99100_sp.h	2022-06-07 16:58:32.488989767 -0400
+@@ -255,5 +255,10 @@ struct custom_eeprom {
+ #define _INLINE_
+ #endif
+ 
+ #define DEFAULT99100_BAUD 115200
+ #endif
++
++/* #if LINUX_VERSION_CODE >= KERNEL_VERSION(5,18,0) */
++#define pci_alloc_consistent(hwdev,size,dma_handle) dma_alloc_coherent(&hwdev->dev, size, dma_handle, GFP_ATOMIC)
++#define pci_free_consistent(hwdev,size,vaddr,dma_handle) dma_free_coherent(&hwdev->dev, size, vaddr, dma_handle)
++/* #endif */
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
new file mode 100644
index 000000000000..8d75ad454cfe
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
@@ -0,0 +1,18 @@
+diff -pNaru5 a/ax99100_sp.c b/ax99100_sp.c
+--- ax99100_sp.c	2023-01-02 23:44:46.707423858 -0500
++++ ax99100_sp.c	2023-01-02 23:44:27.171293092 -0500
+@@ -1915,11 +1915,13 @@ static unsigned int serial99100_get_divi
+ 	DEBUG("In %s quot=%u----baud=%u-----------------------------END\n",__FUNCTION__,quot,baud);
+ 	return quot;	
+ }
+ 
+ //This is a port ops function to set the terminal settings.
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
++static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, const struct ktermios *old)
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+ static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, struct ktermios *old)
+ #else
+ static void serial99100_set_termios(struct uart_port *port, struct termios *termios, struct termios *old)
+ #endif
+ {
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
new file mode 100644
index 000000000000..39071f2f4798
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
@@ -0,0 +1,11 @@
+--- ax99100_spi.c
++++ ax99100_spi.c
+@@ -76,7 +76,7 @@ int spi_suspend_count;
+ static unsigned int spi_major = 241;
+ static unsigned int spi_min_count = 0;
+ /* device Class */
+-static char *ax_devnode(struct device *dev, umode_t *mode)
++static char *ax_devnode(const struct device *dev, umode_t *mode)
+ {
+ 	return kasprintf(GFP_KERNEL, "%s", dev_name(dev));
+ }
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
index dd2227874501..371d41b1c570 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,9 +1,9 @@
 {
-  version = "2022.1";
+  version = "2023.0";
 
   sha256 = {
-    batman-adv = "sha256-bQQdNTCr1LJJq/Wpb8Ki4kFDG/lEO1R/2yWi2P0ymkA=";
-    alfred = "sha256-OgrCuybgyz8nMtSHNmmgoi6YJej5qOerrJhjY/J1CX8=";
-    batctl = "sha256-h+iak4lxuGJCJoG7NBBOmytLZRLR0WXelTYw3zjWGmg=";
+    batman-adv = "sha256-LOTsBAYyUue/7DorP6KmGztCx7BNaYumATK/qx1gpc0=";
+    alfred = "sha256-xeytzlDoIoqRK0iUVnrUXW/x0ro5kcl4RW5L75t9utE=";
+    batctl = "sha256-EQcewCth4B4F74Awt72o/xXlxwspSmQgRZLFtssx7SI=";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/bbswitch/default.nix b/nixpkgs/pkgs/os-specific/linux/bbswitch/default.nix
index 886bf3e6fee8..8312d64acddc 100644
--- a/nixpkgs/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bbswitch/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation {
 
   preBuild = ''
     substituteInPlace Makefile \
-      --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
       --replace "/lib/modules" "${kernel.dev}/lib/modules"
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
index ab3e2232852b..65aef6940383 100644
--- a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
@@ -7,7 +7,7 @@
 
 python.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.24.0";
+  version = "0.26.0";
 
   disabled = !stdenv.isLinux;
 
@@ -15,7 +15,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    sha256 = "sha256-5Nq6LmphiyiiIyru/P2rCCmA25cwJIWn08oK1+eM3cQ=";
+    sha256 = "sha256-zx38tPwuuGU6px9pRNN5JtvBysK9fStOvoqe7cLo7LM=";
   };
   format = "other";
 
@@ -40,6 +40,7 @@ python.pkgs.buildPythonApplication rec {
     "-DENABLE_USDT=ON"
     "-DENABLE_CPP_API=ON"
     "-DCMAKE_USE_LIBBPF_PACKAGE=ON"
+    "-DENABLE_LIBDEBUGINFOD=OFF"
   ];
 
   # to replace this executable path:
@@ -52,6 +53,10 @@ python.pkgs.buildPythonApplication rec {
 
     substituteAll ${./absolute-ausyscall.patch} ./absolute-ausyscall.patch
     patch -p1 < absolute-ausyscall.patch
+
+    # https://github.com/iovisor/bcc/issues/3996
+    substituteInPlace src/cc/libbcc.pc.in \
+      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
   '';
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/below/default.nix b/nixpkgs/pkgs/os-specific/linux/below/default.nix
new file mode 100644
index 000000000000..53791e1a59ad
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/below/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, clang
+, pkg-config
+, elfutils
+, rustfmt
+, zlib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "below";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "facebookincubator";
+    repo = "below";
+    rev = "v${version}";
+    sha256 = "sha256-d5a/M2XEw2E2iydopzedqZ/XfQU7KQyTC5NrPTeeNLg=";
+  };
+
+  cargoSha256 = "sha256-EoRCmEe9SAySZCm+QhaR4ngik4Arnm4SZjgDM5fSRmk=";
+
+  # bpf code compilation
+  hardeningDisable = [ "stackprotector" ];
+
+  nativeBuildInputs = [ clang pkg-config rustfmt ];
+  buildInputs = [ elfutils zlib ];
+
+  # needs /sys/fs/cgroup
+  doCheck = false;
+
+  meta = with lib; {
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ globin ];
+    description = "A time traveling resource monitor for modern Linux systems";
+    license = licenses.asl20;
+    homepage = "https://github.com/facebookincubator/below";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix b/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
index e44f90a36367..8ff4b16a1a53 100644
--- a/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.3.0";
 
   # Official source
-  # "git://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git"
+  # "https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git"
   src = fetchurl {
     url = "https://brick.kernel.dk/snaps/blktrace-${version}.tar.bz2";
     sha256 = "sha256-1t7aA4Yt4r0bG5+6cpu7hi2bynleaqf3yoa2VoEacNY=";
diff --git a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
index d09ef77fb0d8..303eb801478c 100644
--- a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
@@ -23,13 +23,21 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.64";
+  version = "5.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-rkN+ZbazBwwZi8WwEJ/pzeueqjhzgOIHL53mX+ih3jQ=";
+    sha256 = "sha256-Of6mS1kMlJKYSgwnqJ/CA+HNx0hmCG77j0aYZ3qytXQ=";
   };
 
+  patches = [
+    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
+      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
+    })
+  ];
+
   buildInputs = [
     alsa-lib
     dbus
@@ -50,17 +58,6 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "test" ];
 
-  patches = [
-    # https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5
-    # which fixes https://github.com/bluez/bluez/issues/329
-    # and is already merged upstream and not yet in a release.
-    (fetchpatch {
-      name = "StateDirectory_and_ConfigurationDirectory.patch";
-      url = "https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5.patch";
-      sha256 = "sha256-MI6yPTiDLHsSTjLvNqtWnuy2xUMYpSat1WhMbeoedSM=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
@@ -133,6 +130,10 @@ in stdenv.mkDerivation rec {
     mkdir $out/etc/bluetooth
     ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
 
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
     # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
     for files in `find tools/ -type f -perm -755`; do
       filename=$(basename $files)
diff --git a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
index d424f89fdfb3..2765b6647a7f 100644
--- a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "bolt";
-  version = "0.9.2";
+  version = "0.9.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "bolt";
     repo = "bolt";
     rev = version;
-    sha256 = "eXjj7oD5HOW/AG2uxDa0tSleKmbouFd2fwlL2HHFiMA=";
+    sha256 = "sha256-j1UO8lkVoS56hwPQXH8aIr1UegM6PdtaBXKZn50GP60=";
   };
 
   patches = [
@@ -44,6 +44,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     asciidoc
     docbook_xml_dtd_45
@@ -53,25 +57,26 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
+    glib
   ] ++ lib.optional (!doCheck) python3;
 
   buildInputs = [
-    glib
     polkit
     systemd
   ];
 
-  doCheck = true;
+  # https://gitlab.freedesktop.org/bolt/bolt/-/issues/181
+  doCheck = false;
 
   preCheck = ''
     export LD_LIBRARY_PATH=${umockdev.out}/lib/
   '';
 
-  checkInputs = [
+  nativeCheckInputs = [
     dbus
     gobject-introspection
     umockdev
-    (python3.withPackages
+    (python3.pythonForBuild.withPackages
       (p: [ p.pygobject3 p.dbus-python p.python-dbusmock ]))
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix b/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix
index 32781d365491..c75b9375e3b1 100644
--- a/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix
@@ -1,22 +1,34 @@
-{ stdenv, fetchFromGitHub, lib, libpcap, yascreen }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, libpcap
+, yascreen
+}:
 
 stdenv.mkDerivation rec {
   pname = "bpfmon";
-  version = "2.50";
+  version = "2.51";
 
   src = fetchFromGitHub {
     owner = "bbonev";
     repo = "bpfmon";
-    rev = "v${version}";
-    sha256 = "sha256-x4EuGZBtg45bD9q1B/6KwjDRXXeRsdFmRllREsech+E=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-EGRxWq94BWceYXunzcOpMQv4g7cMjVCEWMR0ULGN2Jg=";
   };
 
-  buildInputs = [ libpcap yascreen ];
-  makeFlags = [ "PREFIX=$(out)" ];
+  buildInputs = [
+    libpcap
+    yascreen
+  ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
 
   meta = with lib; {
     description = "BPF based visual packet rate monitor";
     homepage = "https://github.com/bbonev/bpfmon";
+    changelog = "https://github.com/bbonev/bpfmon/releases/tag/v${version}";
     maintainers = with maintainers; [ arezvov ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftools/default.nix b/nixpkgs/pkgs/os-specific/linux/bpftools/default.nix
index b4621feeb31f..a23c4eb7b9e6 100644
--- a/nixpkgs/pkgs/os-specific/linux/bpftools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bpftools/default.nix
@@ -1,15 +1,28 @@
-{ lib, stdenv
-, libopcodes, libbfd, elfutils, readline
-, linuxPackages_latest, zlib
+{ lib, stdenv, linuxHeaders
+, libopcodes, libopcodes_2_38
+, libbfd, libbfd_2_38
+, elfutils, readline
+, zlib
 , python3, bison, flex
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "bpftools";
-  inherit (linuxPackages_latest.kernel) version src;
+
+  inherit (linuxHeaders) version src;
+
+  separateDebugInfo = true;
+
+  patches = [
+    # fix unknown type name '__vector128' on ppc64le
+    ./include-asm-types-for-ppc64le.patch
+  ];
 
   nativeBuildInputs = [ python3 bison flex ];
-  buildInputs = [ libopcodes libbfd elfutils zlib readline ];
+  buildInputs = (if (lib.versionAtLeast version "5.20")
+                 then [ libopcodes libbfd ]
+                 else [ libopcodes_2_38 libbfd_2_38 ])
+    ++ [ elfutils zlib readline ];
 
   preConfigure = ''
     patchShebangs scripts/bpf_doc.py
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch b/nixpkgs/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
new file mode 100644
index 000000000000..47c8f8077a5a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+index 91fa51a9c31d..bfbd9b47277f 100644
+--- a/tools/include/uapi/linux/types.h
++++ b/tools/include/uapi/linux/types.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
++#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix b/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
index 6cc9e40bdbf7..7dca9eee7a0e 100644
--- a/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
@@ -1,74 +1,61 @@
-{ lib, stdenv, fetchFromGitHub
-, cmake, pkg-config, flex, bison
-, llvmPackages, elfutils
-, libbfd, libbpf, libopcodes, bcc
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, llvmPackages, elfutils, bcc
+, libbpf, libbfd, libopcodes
 , cereal, asciidoctor
-, nixosTests
+, cmake, pkg-config, flex, bison
 , util-linux
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.15.0";
-
-  # Cherry-picked from merged PR, remove this hook on next update
-  # https://github.com/iovisor/bpftrace/pull/2242
-  # Cannot `fetchpatch` such pure renaming diff since
-  # https://github.com/iovisor/bpftrace/commit/2df807dbae4037aa8bf0afc03f52fb3f6321c62a.patch
-  # does not contain any diff in unified format but just this instead:
-  #   ...
-  #   man/man8/{bashreadline.8 => bashreadline.bt.8}     | 0
-  #   ...
-  #   35 files changed, 0 insertions(+), 0 deletions(-)
-  #   rename man/man8/{bashreadline.8 => bashreadline.bt.8} (100%)
-  #   ...
-  # on witch `fetchpatch` fails with
-  #   error: Normalized patch '/build/patch' is empty (while the fetched file was not)!
-  #   Did you maybe fetch a HTML representation of a patch instead of a raw patch?
-  postUnpack = ''
-    rename .8 .bt.8 "$sourceRoot"/man/man8/*.8
-  '';
+  version = "0.18.0";
 
   src = fetchFromGitHub {
-    owner  = "iovisor";
-    repo   = "bpftrace";
-    rev    = "v${version}";
-    sha256 = "sha256-9adZAKSn00W2yNwVDbVB1/O5Y+10c4EkVJGCHyd4Tgg=";
+    owner = "iovisor";
+    repo  = "bpftrace";
+    rev   = "v${version}";
+    hash  = "sha256-+SBLcMyOf1gZN8dG5xkNLsqIcK1eVlswjY1GRXepFVg=";
   };
 
-  buildInputs = with llvmPackages;
-    [ llvm libclang
-      elfutils bcc
-      libbpf libbfd libopcodes
-      cereal asciidoctor
-    ];
+  patches = [
+    # fails to build - https://github.com/iovisor/bpftrace/issues/2598
+    (fetchpatch {
+      name = "link-binaries-against-zlib";
+      url = "https://github.com/iovisor/bpftrace/commit/a60b171eb288250c3f1d6f065b05d8a87aff3cdd.patch";
+      hash = "sha256-b/0pKDjolo2RQ/UGjEfmWdG0tnIiFX8PJHhRCXvzyxA=";
+    })
+  ];
+
+  buildInputs = with llvmPackages; [
+    llvm libclang
+    elfutils bcc
+    libbpf libbfd libopcodes
+    cereal asciidoctor
+  ];
 
-  nativeBuildInputs = [ cmake pkg-config flex bison llvmPackages.llvm.dev util-linux ];
+  nativeBuildInputs = [
+    cmake pkg-config flex bison
+    llvmPackages.llvm.dev
+    util-linux
+  ];
 
   # tests aren't built, due to gtest shenanigans. see:
   #
   #     https://github.com/iovisor/bpftrace/issues/161#issuecomment-453606728
   #     https://github.com/iovisor/bpftrace/pull/363
   #
-  cmakeFlags =
-    [ "-DBUILD_TESTING=FALSE"
-      "-DLIBBCC_INCLUDE_DIRS=${bcc}/include"
-    ];
+  cmakeFlags = [
+    "-DBUILD_TESTING=FALSE"
+    "-DLIBBCC_INCLUDE_DIRS=${bcc}/include"
+    "-DINSTALL_TOOL_DOCS=OFF"
+    "-DUSE_SYSTEM_BPF_BCC=ON"
+  ];
 
-  # nuke the example/reference output .txt files, for the included tools,
-  # stuffed inside $out. we don't need them at all.
-  # (see "Allow skipping examples" for a potential option
-  #  https://github.com/iovisor/bpftrace/pull/2256)
-  #
   # Pull BPF scripts into $PATH (next to their bcc program equivalents), but do
   # not move them to keep `${pkgs.bpftrace}/share/bpftrace/tools/...` working.
-  # (remove `chmod` once a new release "Add executable permission to tools"
-  #  https://github.com/iovisor/bpftrace/commit/77e524e6d276216ed6a6e1984cf204418db07c78)
   postInstall = ''
-    rm -rf $out/share/bpftrace/tools/doc
-
     ln -s $out/share/bpftrace/tools/*.bt $out/bin/
-    chmod +x $out/bin/*.bt
   '';
 
   outputs = [ "out" "man" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/bridge-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/bridge-utils/default.nix
index cbbf77c67c8a..a03cb12727ce 100644
--- a/nixpkgs/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook }:
+{ lib, stdenv, fetchurl, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "bridge-utils";
@@ -9,7 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ph2L5PGhQFxgyO841UTwwYwFszubB+W0sxAzU2Fl5g4=";
   };
 
-  patches = [ ./autoconf-ar.patch ];
+  patches = [
+    ./autoconf-ar.patch
+
+    (fetchpatch {
+      name = "musl-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/bridge-utils/fix-PATH_MAX-on-ppc64le.patch?id=12c9046eee3a0a35665dc4e280c1f5ae2af5845d";
+      sha256 = "sha256-uY1tgJhcm1DFctg9scmC8e+mgowgz4f/oF0+k+x+jqw=";
+    })
+  ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/brillo/default.nix b/nixpkgs/pkgs/os-specific/linux/brillo/default.nix
index 246aa471c2a9..4446ed005028 100644
--- a/nixpkgs/pkgs/os-specific/linux/brillo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/brillo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brillo";
-  version = "1.4.10";
+  version = "1.4.12";
 
   src = fetchFromGitLab {
     owner= "cameronnemo";
     repo= "brillo";
     rev= "v${version}";
-    sha256 = "sha256-x8K6CMkOyR+kWRlqa/BmJogZo41LvsL1kfz6CZ5PaUI=";
+    sha256 = "sha256-dKGNioWGVAFuB4kySO+QGTnstyAD0bt4/6FBVwuRxJo=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/default.nix b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/default.nix
index d7acf94e39a1..6b7d8b912fa2 100644
--- a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -43,6 +43,10 @@ stdenv.mkDerivation {
     ./linux-5.17.patch
     # source: https://github.com/archlinux/svntogit-community/blob/2e1fd240f9ce06f500feeaa3e4a9675e65e6b967/trunk/013-linux518.patch
     ./linux-5.18.patch
+    # source: https://gist.github.com/joanbm/207210d74637870c01ef5a3c262a597d
+    ./linux-6.0.patch
+    # source: https://gist.github.com/joanbm/94323ea99eff1e1d1c51241b5b651549
+    ./linux-6.1.patch
     ./pedantic-fix.patch
     ./null-pointer-fix.patch
     ./gcc.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch
new file mode 100644
index 000000000000..dcb5515264d3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch
@@ -0,0 +1,30 @@
+From dbee29df729e543a89b3f95c1436e982eb0047c1 Mon Sep 17 00:00:00 2001
+From: Joan Bruguera <joanbrugueram@gmail.com>
+Date: Thu, 30 Jun 2022 02:15:35 +0200
+Subject: [PATCH] Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 6.0-rc1
+
+Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-33 on Arch Linux.
+---
+ src/wl/sys/wl_cfg80211_hybrid.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index d815b33..7faa735 100644
+--- a/src/wl/sys/wl_cfg80211_hybrid.c
++++ b/src/wl/sys/wl_cfg80211_hybrid.c
+@@ -2381,7 +2381,12 @@ wl_bss_roaming_done(struct wl_cfg80211_priv *wl, struct net_device *ndev,
+ 	bss = cfg80211_get_bss(wl_to_wiphy(wl), NULL, (s8 *)&wl->bssid,
+ 	ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+ 	struct cfg80211_roam_info roam_info = {
++// Rel. commit "cfg80211: Indicate MLO connection info in connect and roam callbacks" (Veerendranath Jakkam, Wed Jun 8)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
+ 		.bss = bss,
++#else
++		.links[0].bss = bss,
++#endif
+ 		.req_ie = conn_info->req_ie,
+ 		.req_ie_len = conn_info->req_ie_len,
+ 		.resp_ie = conn_info->resp_ie,
+-- 
+2.37.0
+
diff --git a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch
new file mode 100644
index 000000000000..5ececd487d74
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch
@@ -0,0 +1,83 @@
+From a63a5f70e5cf05f6bce4cda2e0dd67462e1d76a5 Mon Sep 17 00:00:00 2001
+From: Joan Bruguera <joanbrugueram@gmail.com>
+Date: Mon, 29 Aug 2022 00:06:53 +0200
+Subject: [PATCH] Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 6.1-rc1
+
+Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-35 on Arch Linux
+---
+ src/wl/sys/wl_cfg80211_hybrid.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index 4fef22a..50d1e34 100644
+--- a/src/wl/sys/wl_cfg80211_hybrid.c
++++ b/src/wl/sys/wl_cfg80211_hybrid.c
+@@ -105,20 +105,25 @@ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wd
+ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+ #endif
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
++#define MAYBE_INT_LINK_ID int link_id,
++#else
++#define MAYBE_INT_LINK_ID
++#endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+ static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+-           struct net_device *dev, u8 key_idx, bool unicast, bool multicast);
++           struct net_device *dev, MAYBE_INT_LINK_ID u8 key_idx, bool unicast, bool multicast);
+ #else
+ static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+            struct net_device *dev, u8 key_idx);
+ #endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params);
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params);
+ static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr);
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr);
+ static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr,
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr,
+            void *cookie, void (*callback) (void *cookie, struct key_params *params));
+ #else
+ static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1165,7 +1170,7 @@ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+ static s32
+ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+-	struct net_device *dev, u8 key_idx, bool unicast, bool multicast)
++	struct net_device *dev, MAYBE_INT_LINK_ID u8 key_idx, bool unicast, bool multicast)
+ #else
+ static s32
+ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+@@ -1190,7 +1195,7 @@ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params)
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params)
+ #else
+ static s32
+ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1311,7 +1316,7 @@ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr)
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr)
+ #else
+ static s32
+ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1354,7 +1359,7 @@ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+                     void (*callback) (void *cookie, struct key_params * params))
+ #else
+ static s32
+-- 
+2.37.2
+
diff --git a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch
index f97709fef904..3d190b9d1f82 100644
--- a/nixpkgs/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch
+++ b/nixpkgs/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch
@@ -1,4 +1,4 @@
-diff --git a/src/shared/linux_osl.c b/shared/linux_osl.c
+diff --git a/src/shared/linux_osl.c b/src/shared/linux_osl.c
 index 711b771..5a2636a 100644
 --- a/src/shared/linux_osl.c
 +++ b/src/shared/linux_osl.c
@@ -11,8 +11,8 @@ index 711b771..5a2636a 100644
  	if (rdlen > 0)
  		fp->f_pos += rdlen;
  
-diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/wl/sys/wl_cfg80211_hybrid.c
-index 41c16d8..d39d9de 100644
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index 2b3c290..093dce6 100644
 --- a/src/wl/sys/wl_cfg80211_hybrid.c
 +++ b/src/wl/sys/wl_cfg80211_hybrid.c
 @@ -790,6 +790,7 @@ wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
@@ -23,7 +23,7 @@ index 41c16d8..d39d9de 100644
  	default:
  		val = 2;
  		WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
-@@ -2347,21 +2348,20 @@ wl_bss_roaming_done(struct wl_cfg80211_priv *wl, struct net_device *ndev,
+@@ -2347,26 +2348,24 @@ wl_bss_roaming_done(struct wl_cfg80211_priv *wl, struct net_device *ndev,
                      const wl_event_msg_t *e, void *data)
  {
  	struct wl_cfg80211_connect_info *conn_info = wl_to_conn(wl);
@@ -36,23 +36,28 @@ index 41c16d8..d39d9de 100644
  	bss = cfg80211_get_bss(wl_to_wiphy(wl), NULL, (s8 *)&wl->bssid,
  	ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 -	struct cfg80211_roam_info roam_info = {
+ // Rel. commit "cfg80211: Indicate MLO connection info in connect and roam callbacks" (Veerendranath Jakkam, Wed Jun 8)
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
 -		.bss = bss,
++	roam_info.bss = bss;
+ #else
+-		.links[0].bss = bss,
++	roam_info.links[0].bss = bss;
+ #endif
 -		.req_ie = conn_info->req_ie,
 -		.req_ie_len = conn_info->req_ie_len,
 -		.resp_ie = conn_info->resp_ie,
 -		.resp_ie_len = conn_info->resp_ie_len,
 -	};
-+	roam_info.bss = bss;
 +	roam_info.req_ie = conn_info->req_ie;
 +	roam_info.req_ie_len = conn_info->req_ie_len;
 +	roam_info.resp_ie = conn_info->resp_ie;
-+	roam_info.resp_ie_len = conn_info->resp_ie_len;
  #endif
 -	s32 err = 0;
  
  	wl_get_assoc_ies(wl);
  	memcpy(wl->profile->bssid, &e->addr, ETHER_ADDR_LEN);
-diff --git a/src/wl/sys/wl_iw.h b/wl/sys/wl_iw.h
+diff --git a/src/wl/sys/wl_iw.h b/src/wl/sys/wl_iw.h
 index 3ab084f..471d11f 100644
 --- a/src/wl/sys/wl_iw.h
 +++ b/src/wl/sys/wl_iw.h
@@ -64,7 +69,7 @@ index 3ab084f..471d11f 100644
  #define WL_IW_SET_ACTIVE_SCAN	(SIOCIWFIRSTPRIV+1)
  #define WL_IW_GET_RSSI			(SIOCIWFIRSTPRIV+3)
  #define WL_IW_SET_PASSIVE_SCAN	(SIOCIWFIRSTPRIV+5)
-diff --git a/src/wl/sys/wl_linux.c b/wl/sys/wl_linux.c
+diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
 index d13fb98..97ae2a6 100644
 --- a/src/wl/sys/wl_linux.c
 +++ b/src/wl/sys/wl_linux.c
diff --git a/nixpkgs/pkgs/os-specific/linux/busybox/default.nix b/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
index 3feb590eb5d6..c72be801aeea 100644
--- a/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
@@ -50,14 +50,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.35.0";
+  version = "1.36.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+u6yRMNaNIozT0pZ5EYm7ocPsHtohNaMEK6LwZ+DppQ=";
+    sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -75,11 +75,6 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
       sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
     })
-    (fetchurl {
-      name = "CVE-2022-30065.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2022-30065.patch?id=4ffd996b3f8298c7dd424b912c245864c816e354";
-      sha256 = "sha256-+WSYxI6eF8S0tya/S62f9Nc6jVMnHO0q1OyM69GlNTY=";
-    })
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
   separateDebugInfo = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/can-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/can-utils/default.nix
index 90261e829048..6d5b7e0d6506 100644
--- a/nixpkgs/pkgs/os-specific/linux/can-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/can-utils/default.nix
@@ -1,31 +1,23 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "can-utils";
-  # There are no releases (source archives or git tags), so use the date of the
-  # latest commit in git master as version number.
-  version = "20170830";
+  version = "2023.03";
 
   src = fetchFromGitHub {
     owner = "linux-can";
     repo = "can-utils";
-    rev = "5b518a0a5fa56856f804372a6b99b518dedb5386";
-    sha256 = "1ygzp8rjr8f1gs48mb1pz7psdgbfhlvr6kjdnmzbsqcml06zvrpr";
+    rev = "v${version}";
+    hash = "sha256-FaopviBJOmO0lXoJcdKNdtsoaJ8JrFEJGyO1aNBv+Pg=";
   };
 
-  # Fixup build with newer Linux headers.
-  postPatch = ''
-    sed '1i#include <linux/sockios.h>' -i \
-      slcanpty.c cansniffer.c canlogserver.c isotpdump.c isotpsniffer.c isotpperf.c
-  '';
-
-  preConfigure = ''makeFlagsArray+=(PREFIX="$out")'';
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "CAN userspace utilities and tools (for use with Linux SocketCAN)";
     homepage = "https://github.com/linux-can/can-utils";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor Luflosi ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix b/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix
new file mode 100644
index 000000000000..fb7ad90259be
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cannelloni";
+  version = "1.1.0";
+  src = fetchFromGitHub {
+    owner = "mguentner";
+    repo = "cannelloni";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pAXHo9NCXMFKYcIJogytBiPkQE0nK6chU5TKiDNCKA8=";
+  };
+  buildInputs = [ cmake ] ++ lib.optionals sctpSupport [ lksctp-tools ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DSCTP_SUPPORT=${lib.boolToString sctpSupport}"
+  ];
+
+  meta = with lib; {
+    description = "A SocketCAN over Ethernet tunnel";
+    homepage = "https://github.com/mguentner/cannelloni";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.samw ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/catfs/Cargo.lock b/nixpkgs/pkgs/os-specific/linux/catfs/Cargo.lock
new file mode 100644
index 000000000000..d79e0a9e168d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/catfs/Cargo.lock
@@ -0,0 +1,651 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b6a2d3371669ab3ca9797670853d61402b03d0b4b9ebf33d677dfa720203072"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
+
+[[package]]
+name = "aho-corasick"
+version = "0.6.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81ce3d38065e618af2d7b77e10c5ad9a069859b4be3c2250f674af3840d9c8a5"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ansi_term"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+
+[[package]]
+name = "backtrace"
+version = "0.3.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec1931848a574faa8f7c71a12ea00453ff5effbb5f51afe7f77d7a48cace6ac1"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9bf6104718e80d7b26a68fdbacff3481cfc05df670821affc7e9cbc1884400c"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b4ff8b16e6076c3e14220b39fbc1fabb6737522281a388998046859400895f"
+
+[[package]]
+name = "bitflags"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+
+[[package]]
+name = "block-buffer"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1339a1042f5d9f295737ad4d9a6ab6bf81c84a933dba110b9200cd6d1448b814"
+dependencies = [
+ "byte-tools",
+ "generic-array",
+]
+
+[[package]]
+name = "byte-tools"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "560c32574a12a89ecd91f5e742165893f86e3ab98d21f8ea548658eb9eef5f40"
+
+[[package]]
+name = "catfs"
+version = "0.9.0"
+dependencies = [
+ "backtrace",
+ "chan-signal",
+ "clap",
+ "daemonize",
+ "env_logger",
+ "fd",
+ "fuse",
+ "generic-array",
+ "itertools",
+ "libc",
+ "log 0.3.9",
+ "rand 0.3.23",
+ "sha2",
+ "syslog",
+ "threadpool",
+ "time",
+ "twox-hash",
+ "xattr",
+]
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "chan"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d14956a3dae065ffaa0d92ece848ab4ced88d32361e7fdfbfd653a5c454a1ed8"
+dependencies = [
+ "rand 0.3.23",
+]
+
+[[package]]
+name = "chan-signal"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3bb6c3bc387004ad914f0c5b7f33ace8bf7604bbec35f228b1a017f52cd3a0"
+dependencies = [
+ "bit-set",
+ "chan",
+ "lazy_static 0.2.11",
+ "libc",
+]
+
+[[package]]
+name = "clap"
+version = "2.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "daemonize"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0239832c1b4ca406d5ec73728cf4c7336d25cf85dd32db9e047e9e706ee0e935"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "digest"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5b29bf156f3f4b3c4f610a25ff69370616ae6e0657d416de22645483e72af0a"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "either"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+
+[[package]]
+name = "env_logger"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ddf21e73e016298f5cb37d6ef8e8da8e39f91f9ec8b0df44b7deb16a9f8cd5b"
+dependencies = [
+ "log 0.3.9",
+ "regex",
+]
+
+[[package]]
+name = "fake-simd"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e88a8acf291dafb59c2d96e8f59828f3838bb1a70398823ade51a84de6a6deed"
+
+[[package]]
+name = "fd"
+version = "0.2.3"
+source = "git+https://github.com/stemjail/fd-rs.git?rev=3bc3e3587f8904cce8bf29163a2021c2f5906557#3bc3e3587f8904cce8bf29163a2021c2f5906557"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "fuse"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80e57070510966bfef93662a81cb8aa2b1c7db0964354fa9921434f04b9e8660"
+dependencies = [
+ "libc",
+ "log 0.3.9",
+ "pkg-config",
+ "thread-scoped",
+ "time",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fceb69994e330afed50c93524be68c42fa898c2d9fd4ee8da03bd7363acd26f2"
+dependencies = [
+ "nodrop",
+ "typenum",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "gimli"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf91faf136cb47367fa430cd46e37a788775e7fa104f8b4bcb3861dc389b724"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c30f6d0bc6b00693347368a67d41b58f2fb851215ff1da49e90fe2c5c667151"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "itertools"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3f2be4da1690a039e9ae5fd575f706a63ad5a2120f161b1d653c9da3930dd21"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "lazy_static"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76f033c7ad61445c5b347c7382dd1237847eb1bce590fe50365dcb33d546be73"
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa7087f49d294270db4e1928fc110c976cd4b9e5a16348e0a1df09afa99e6c98"
+
+[[package]]
+name = "log"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
+dependencies = [
+ "log 0.4.11",
+]
+
+[[package]]
+name = "log"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c60c0dfe32c10b43a144bad8fc83538c52f58302c92300ea7ec7bf7b38d5a7b9"
+dependencies = [
+ "adler",
+ "autocfg",
+]
+
+[[package]]
+name = "nodrop"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
+
+[[package]]
+name = "num_cpus"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c36fa947111f5c62a733b652544dd0016a43ce89619538a8ef92724a6f501a20"
+
+[[package]]
+name = "rand"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ac302d8f83c0c1974bf758f6b041c6c8ada916fbb44a609158ca8b064cc76c"
+dependencies = [
+ "libc",
+ "rand 0.4.6",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "regex"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9329abc99e39129fcceabd24cf5d85b4671ef7c29c50e972bc5afe32438ec384"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+ "thread_local",
+ "utf8-ranges",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d707a4fa2637f2dca2ef9fd02225ec7661fe01a53623c1e6515b6916511f7a7"
+dependencies = [
+ "ucd-util",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
+
+[[package]]
+name = "sha2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d963c78ce367df26d7ea8b8cc655c651b42e8a1e584e869c1e17dae3ccb116a"
+dependencies = [
+ "block-buffer",
+ "byte-tools",
+ "digest",
+ "fake-simd",
+ "generic-array",
+]
+
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
+[[package]]
+name = "syslog"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc9b0acde4f7c05fdc1cfb05239b8a53a66815dd86c67fee5aa9bfac5b4ed42"
+dependencies = [
+ "libc",
+ "log 0.3.9",
+ "time",
+ "unix_socket",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "thread-scoped"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcbb6aa301e5d3b0b5ef639c9a9c7e2f1c944f177b460c04dc24c69b1fa2bd99"
+
+[[package]]
+name = "thread_local"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6b53e329000edc2b34dbe8545fd20e55a333362d0a321909685a19bd28c3f1b"
+dependencies = [
+ "lazy_static 1.4.0",
+]
+
+[[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
+name = "time"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "twox-hash"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bfd5b7557925ce778ff9b9ef90e3ade34c524b5ff10e239c69a42d546d2af56"
+dependencies = [
+ "rand 0.7.3",
+]
+
+[[package]]
+name = "typenum"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
+
+[[package]]
+name = "ucd-util"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c85f514e095d348c279b1e5cd76795082cf15bd59b93207832abe0b1d8fed236"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+
+[[package]]
+name = "unix_socket"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aa2700417c405c38f5e6902d699345241c28c0b7ade4abaad71e35a87eb1564"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "utf8-ranges"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ae116fef2b7fea257ed6440d3cfcff7f190865f170cdad00bb6465bf18ecba"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "xattr"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "244c3741f4240ef46274860397c7c74e50eb23624996930e484c16679633a54c"
+dependencies = [
+ "libc",
+]
diff --git a/nixpkgs/pkgs/os-specific/linux/catfs/default.nix b/nixpkgs/pkgs/os-specific/linux/catfs/default.nix
index dbb525e0e298..fb4d21820755 100644
--- a/nixpkgs/pkgs/os-specific/linux/catfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/catfs/default.nix
@@ -6,25 +6,27 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "catfs";
-  version = "unstable-2020-03-21";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "kahing";
     repo = pname;
-    rev = "daa2b85798fa8ca38306242d51cbc39ed122e271";
-    sha256 = "0zca0c4n2p9s5kn8c9f9lyxdf3df88a63nmhprpgflj86bh8wgf5";
+    rev = "v${version}";
+    hash = "sha256-OvmtU2jpewP5EqPwEFAf67t8UCI1WuzUO2QQj4cH1Ak=";
   };
 
-  cargoSha256 = "1agcwq409s40kyij487wjrp8mj7942r9l2nqwks4xqlfb0bvaimf";
-
-  cargoPatches = [
-    # update cargo lock
-    (fetchpatch {
-      url = "https://github.com/kahing/catfs/commit/f838c1cf862cec3f1d862492e5be82b6dbe16ac5.patch";
-      sha256 = "1r1p0vbr3j9xyj9r1ahipg4acii3m4ni4m9mp3avbi1rfgzhblhw";
-    })
+  patches = [
+    # monitor https://github.com/kahing/catfs/issues/71
+    ./fix-for-rust-1.65.diff
   ];
 
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "fd-0.2.3" = "sha256-Xps5s30urCZ8FZYce41nOZGUAk7eRyvObUS/mMx6Tfg=";
+    };
+  };
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ fuse ];
diff --git a/nixpkgs/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff b/nixpkgs/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
new file mode 100644
index 000000000000..4208c362ebcd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
@@ -0,0 +1,13 @@
+diff --git a/src/catfs/file.rs b/src/catfs/file.rs
+index 6e781eb..92fdd80 100644
+--- a/src/catfs/file.rs
++++ b/src/catfs/file.rs
+@@ -569,7 +569,7 @@ impl Handle {
+         path: &dyn AsRef<Path>,
+         create: bool,
+     ) -> error::Result<()> {
+-        let _ = self.page_in_res.0.lock().unwrap();
++        drop(self.page_in_res.0.lock().unwrap());
+ 
+         let mut buf = [0u8; 0];
+         let mut flags = rlibc::O_RDWR;
diff --git a/nixpkgs/pkgs/os-specific/linux/ch9344/default.nix b/nixpkgs/pkgs/os-specific/linux/ch9344/default.nix
new file mode 100644
index 000000000000..8f258d227bb1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ch9344/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, lib, fetchzip, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "ch9344";
+  version = "1.9";
+
+  src = fetchzip {
+    name = "CH9344SER_LINUX.zip";
+    url = "https://www.wch.cn/downloads/file/386.html#CH9344SER_LINUX.zip";
+    hash = "sha256-g55ftAfjKKlUFzGhI1a/O7Eqbz6rkGf1vWuEJjBZxBE=";
+  };
+
+  patches = lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.1") [
+    # https://github.com/torvalds/linux/commit/a8c11c1520347be74b02312d10ef686b01b525f1
+    ./fix-incompatible-pointer-types.patch
+  ] ++ lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.3") [
+    # https://github.com/torvalds/linux/commit/5d420399073770134d2b03e004b2c0201c7fa26f
+    ./fix-incompatible-pointer-types_6_3.patch
+  ];
+
+  sourceRoot = "${src.name}/driver";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
+  '';
+
+  makeFlags = [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D ch9344.ko $out/lib/modules/${kernel.modDirVersion}/usb/serial/ch9344.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.wch-ic.com/";
+    downloadPage = "https://www.wch.cn/downloads/CH9344SER_LINUX_ZIP.html";
+    description = "WCH CH9344/CH348 UART driver";
+    longDescription = ''
+      A kernel module for WinChipHead CH9344/CH348 USB To Multi Serial Ports controller.
+    '';
+    # Archive contains no license.
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ MakiseKurisu ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch b/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
new file mode 100644
index 000000000000..31088538733e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
@@ -0,0 +1,22 @@
+diff --git a/ch9344.c b/ch9344.c
+index 1e37293..a16af82 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -79,7 +79,7 @@ static DEFINE_IDR(ch9344_minors);
+ static DEFINE_MUTEX(ch9344_minors_lock);
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old);
++                                   const struct ktermios *termios_old);
+ 
+ static int ch9344_get_portnum(int index);
+ 
+@@ -1597,7 +1597,7 @@ u8 cal_recv_tmt(__le32 bd)
+ }
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old)
++                                   const struct ktermios *termios_old)
+ {
+     struct ch9344 *ch9344 = tty->driver_data;
+     struct ktermios *termios = &tty->termios;
diff --git a/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch b/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch
new file mode 100644
index 000000000000..b4cf265daac9
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch
@@ -0,0 +1,13 @@
+diff --git a/ch9344.c b/ch9344.c
+index a16af82..8922ed9 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -774,7 +774,7 @@ static inline void *tty_get_portdata(struct ch9344_ttyport *port)
+     return (port->portdata);
+ }
+ 
+-static void ch9344_port_dtr_rts(struct tty_port *port, int raise)
++static void ch9344_port_dtr_rts(struct tty_port *port, bool raise)
+ {
+     struct ch9344_ttyport *ttyport = container_of(port, struct ch9344_ttyport, port);
+     struct ch9344 *ch9344 = tty_get_portdata(ttyport);
diff --git a/nixpkgs/pkgs/os-specific/linux/checkpolicy/default.nix b/nixpkgs/pkgs/os-specific/linux/checkpolicy/default.nix
index 52cf0a3ec037..5b08739667d5 100644
--- a/nixpkgs/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "3.3";
+  version = "3.5";
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
-    sha256 = "118l8c2vvnnckbd269saslr7adv6rdavr5rv0z5vh2m1lgglxj15";
+    sha256 = "sha256-eqSKsiIqC5iBER1tf3DDAU09kziCfZ4C3xBaaMDfXbw=";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/nixpkgs/pkgs/os-specific/linux/cifs-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/cifs-utils/default.nix
index ba790f2eaca4..cae7901386d1 100644
--- a/nixpkgs/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cifs-utils";
-  version = "6.15";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://samba/pub/linux-cifs/cifs-utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-p7aUDpMlDBZ2pvpmturZG3jNQ6X+6ZzEYkWci5zx5vQ=";
+    sha256 = "sha256-De+quFvT6kb/xFq0H7DQrVTQWuLPqn5QPehtTxK8gWE=";
   };
 
   nativeBuildInputs = [ autoreconfHook docutils pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/conky/default.nix b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
index 87f5bb052f48..a5fbc2817db0 100644
--- a/nixpkgs/pkgs/os-specific/linux/conky/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
@@ -15,7 +15,7 @@
                             , docbook_xsl ? null , docbook_xml_dtd_44 ? null
 
 , ncursesSupport      ? true      , ncurses       ? null
-, x11Support          ? true      , xlibsWrapper           ? null
+, x11Support          ? true      , freetype, xorg
 , xdamageSupport      ? x11Support, libXdamage    ? null
 , doubleBufferSupport ? x11Support
 , imlib2Support       ? x11Support, imlib2        ? null
@@ -43,7 +43,6 @@ assert docsSupport         -> docbook2x != null && libxslt != null
 
 assert ncursesSupport      -> ncurses != null;
 
-assert x11Support          -> xlibsWrapper != null;
 assert xdamageSupport      -> x11Support && libXdamage != null;
 assert imlib2Support       -> x11Support && imlib2     != null;
 assert luaSupport          -> lua != null;
@@ -68,13 +67,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "conky";
-  version = "1.12.2";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "sha256-x6bR5E5LIvKWiVM15IEoUgGas/hcRp3F/O4MTOhVPb8=";
+    sha256 = "sha256-3eCRzjfHGFiKuxmRHvnzqAg/+ApUKnHhsumWnio/Qxg=";
   };
 
   postPatch = ''
@@ -95,7 +94,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ glib libXinerama ]
     ++ optionals docsSupport        [ docbook2x docbook_xsl docbook_xml_dtd_44 libxslt man less ]
     ++ optional  ncursesSupport     ncurses
-    ++ optional  x11Support         xlibsWrapper
+    ++ optionals x11Support         [ freetype xorg.libICE xorg.libX11 xorg.libXext xorg.libXft xorg.libSM ]
     ++ optional  xdamageSupport     libXdamage
     ++ optional  imlib2Support      imlib2
     ++ optional  luaSupport         lua
@@ -138,7 +137,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with lib; {
-    homepage = "http://conky.sourceforge.net/";
+    homepage = "https://conky.sourceforge.net/";
     description = "Advanced, highly configurable system monitor based on torsmo";
     maintainers = [ maintainers.guibert ];
     license = licenses.gpl3Plus;
diff --git a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
index 0b14398e58f6..a5416648a7c0 100644
--- a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "conntrack-tools";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchurl {
     url = "https://www.netfilter.org/projects/conntrack-tools/files/${pname}-${version}.tar.bz2";
-    sha256 = "0psx41bclqrh4514yzq03rvs3cq3scfpd1v4kkyxnic2hk65j22r";
+    sha256 = "sha256-CZ3rz1foFpDO1X9Ra0k1iKc1GPSMFNZW+COym0/CS10=";
   };
 
   buildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix b/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
index abe6f44f31a9..381576492af4 100644
--- a/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20220812";
+  version = "20230505";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-O/aPuX2UcU+QdjzK2BDfjcX3/pwfmjZSQ2SR/XVBWr8=";
+    sha256 = "sha256-VdMEAM1rq5rPNZft/JpSeiWOOntcQMzJuLMrENPimzA=";
   };
 
   # For pod2man during the build process.
diff --git a/nixpkgs/pkgs/os-specific/linux/cpustat/default.nix b/nixpkgs/pkgs/os-specific/linux/cpustat/default.nix
index c37c191d8c5f..e5bbd388081e 100644
--- a/nixpkgs/pkgs/os-specific/linux/cpustat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cpustat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpustat";
-  version = "0.02.17";
+  version = "0.02.19";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-4HDXRtklzQSsywCGCTKdz6AtZta9R1mx7qkT7skX6Kc=";
+    hash = "sha256-MujdgA+rFLrRc/N9yN7udnarA1TCzX//95hoXTUHG8Q=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/nixpkgs/pkgs/os-specific/linux/criu/default.nix b/nixpkgs/pkgs/os-specific/linux/criu/default.nix
index 5475a565b09b..7940ce060e4d 100644
--- a/nixpkgs/pkgs/os-specific/linux/criu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/criu/default.nix
@@ -1,6 +1,8 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, protobuf, protobufc, asciidoc, iptables
-, xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2
-, which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd }:
+, xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2, gzip
+, which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd, gnutar
+, buildPackages
+}:
 
 stdenv.mkDerivation rec {
   pname = "criu";
@@ -19,12 +21,47 @@ stdenv.mkDerivation rec {
       url = "https://github.com/checkpoint-restore/criu/commit/1e6e826ffb7ac05f33fa123051c2fc2ddf0f68ea.patch";
       hash = "sha256-LJjk0jQ5v5wqeprvBMpxhjLXn7v+lSPldEGgazGUM44=";
     })
+
+    # compat fixes for glibc-2.36
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/8cd5fccd6cf3d03afb5abe463134d31f54d42258.patch";
+      sha256 = "sha256-b65DdLmyIuZik0dNRuWJKUPcDFA6CKq0bi4Vd26zgS4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/517c0947050e63aac72f63a3bf373d76264723b9.patch";
+      sha256 = "sha256-MPZ6oILVoZ7BQEZFjUlp3RuMC7iKTKXAtrUDFqbN4T8=";
+    })
   ];
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ pkg-config docbook_xsl which makeWrapper docbook_xml_dtd_45 python3 python3.pkgs.wrapPython perl ];
-  buildInputs = [ protobuf asciidoc xmlto libpaper libnl libcap libnet nftables libbsd ];
-  propagatedBuildInputs = [ protobufc ] ++ (with python3.pkgs; [ python python3.pkgs.protobuf ]);
+  depsBuildBuild = [ protobufc buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+    xmlto
+    libpaper
+    docbook_xsl
+    which
+    makeWrapper
+    docbook_xml_dtd_45
+    python3
+    python3.pkgs.wrapPython
+    perl
+  ];
+  buildInputs = [
+    protobuf
+    libnl
+    libcap
+    libnet
+    nftables
+    libbsd
+  ];
+  propagatedBuildInputs = [
+    protobufc
+  ] ++ (with python3.pkgs; [
+    python
+    python3.pkgs.protobuf
+  ]);
 
   postPatch = ''
     substituteInPlace ./Documentation/Makefile \
@@ -34,7 +71,27 @@ stdenv.mkDerivation rec {
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
   '';
 
-  makeFlags = [ "PREFIX=$(out)" "ASCIIDOC=${asciidoc}/bin/asciidoc" "XMLTO=${xmlto}/bin/xmlto" ];
+  makeFlags = let
+    # criu's Makefile infrastructure expects to be passed a target architecture
+    # which neither matches the config-tuple's first part, nor the
+    # targetPlatform.linuxArch attribute. Thus we take the latter and map it
+    # onto the expected string:
+    linuxArchMapping = {
+      "x86_64" = "x86";
+      "arm" = "arm";
+      "arm64" = "aarch64";
+      "powerpc" = "ppc64";
+      "s390" = "s390";
+      "mips" = "mips";
+    };
+  in [
+    "PREFIX=$(out)"
+    "ASCIIDOC=${buildPackages.asciidoc}/bin/asciidoc"
+    "XMLTO=${buildPackages.xmlto}/bin/xmlto"
+  ] ++ (lib.optionals (stdenv.buildPlatform != stdenv.targetPlatform) [
+    "ARCH=${linuxArchMapping."${stdenv.targetPlatform.linuxArch}"}"
+    "CROSS_COMPILE=${stdenv.targetPlatform.config}-"
+  ]);
 
   outputs = [ "out" "dev" "man" ];
 
@@ -50,7 +107,8 @@ stdenv.mkDerivation rec {
   postFixup = ''
     wrapProgram $out/bin/criu \
       --set-default CR_IPTABLES ${iptables}/bin/iptables \
-      --set-default CR_IP_TOOL ${iproute2}/bin/ip
+      --set-default CR_IP_TOOL ${iproute2}/bin/ip \
+      --prefix PATH : ${lib.makeBinPath [ gnutar gzip ]}
     wrapPythonPrograms
   '';
 
@@ -58,7 +116,7 @@ stdenv.mkDerivation rec {
     description = "Userspace checkpoint/restore for Linux";
     homepage    = "https://criu.org";
     license     = licenses.gpl2;
-    platforms   = [ "x86_64-linux" "aarch64-linux" ];
+    platforms   = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
     maintainers = [ maintainers.thoughtpolice ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/cryptodev/default.nix b/nixpkgs/pkgs/os-specific/linux/cryptodev/default.nix
index cc3a1d81109e..296e4b79b3e0 100644
--- a/nixpkgs/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cryptodev/default.nix
@@ -1,22 +1,24 @@
 { fetchFromGitHub, lib, stdenv, kernel ? false }:
 
 stdenv.mkDerivation rec {
-  pname = "cryptodev-linux-1.12";
+  pname = "cryptodev-linux-1.13";
   name = "${pname}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "cryptodev-linux";
     repo = "cryptodev-linux";
     rev = pname;
-    sha256 = "sha256-vJQ10rG5FGbeEOqCUmH/pZ0P77kAW/MtUarywbtIyHw=";
+    hash = "sha256-EzTPoKYa+XWOAa/Dk7ru02JmlymHeXVX7RMmEoJ1OT0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
-  KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
-  prefix = "\${out}";
+  makeFlags = kernel.makeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+    "prefix=$(out)"
+  ];
 
   meta = {
     description = "Device that allows access to Linux kernel cryptographic drivers";
diff --git a/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix b/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
index be819802394e..0e7988f4d99a 100644
--- a/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,20 +1,29 @@
-{ lib, stdenv, fetchurl, lvm2, json_c
-, openssl, libuuid, pkg-config, popt }:
+{ lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
+, openssl, libuuid, pkg-config, popt, nixosTests
+
+  # The release tarballs contain precomputed manpage files, so we don't need
+  # to run asciidoctor on the man sources. By avoiding asciidoctor, we make
+  # the bare NixOS build hash independent of changes to the ruby ecosystem,
+  # saving mass-rebuilds.
+, rebuildMan ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.4.3";
+  version = "2.6.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v2.4/${pname}-${version}.tar.xz";
-    sha256 = "sha256-/A35RRiBciZOxb8dC9oIJk+tyKP4VtR+upHzH+NUtQc=";
+    url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    hash = "sha256-QQ3tZaEHKrnI5Brd7Te5cpwIf+9NLbArtO9SmtbaRpM=";
   };
 
-  # Disable 4 test cases that fail in a sandbox
-  patches = [ ./disable-failing-tests.patch ];
+  patches = [
+    # Allow reading tokens from a relative path, see #167994
+    ./relative-token-path.patch
+  ];
 
   postPatch = ''
     patchShebangs tests
@@ -31,6 +40,8 @@ stdenv.mkDerivation rec {
     "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
     "--disable-ssh-token"
+  ] ++ lib.optionals (!rebuildMan) [
+    "--disable-asciidoc"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "--disable-external-tokens"
     # We have to override this even though we're removing token
@@ -39,14 +50,31 @@ stdenv.mkDerivation rec {
     "--with-luks2-external-tokens-path=/"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
   buildInputs = [ lvm2 json_c openssl libuuid popt ];
 
-  doCheck = true;
+  # The test [7] header backup in compat-test fails with a mysterious
+  # "out of memory" error, even though tons of memory is available.
+  # Issue filed upstream: https://gitlab.com/cryptsetup/cryptsetup/-/issues/763
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  passthru = {
+    tests = {
+      nixos =
+        lib.optionalAttrs stdenv.hostPlatform.isLinux (
+          lib.recurseIntoAttrs (
+            lib.filterAttrs
+              (name: _value: lib.hasPrefix "luks" name)
+              nixosTests.installer
+          )
+        );
+    };
+  };
 
   meta = {
     homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
     description = "LUKS for dm-crypt";
+    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ ];
     platforms = with lib.platforms; linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch b/nixpkgs/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
deleted file mode 100644
index 1504bf3e1511..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -ur a/tests/blockwise-compat b/tests/blockwise-compat
---- a/tests/blockwise-compat	2018-09-08 12:23:11.706555098 +0200
-+++ b/tests/blockwise-compat	2018-09-08 12:24:24.444393460 +0200
-@@ -148,15 +148,11 @@
- 	# device/file fn_name length
- 	RUN "P" $1 read_buffer $BSIZE
- 	RUN "P" $1 read_buffer $((2*BSIZE))
--	RUN "F" $1 read_buffer $((BSIZE-1))
--	RUN "F" $1 read_buffer $((BSIZE+1))
- 	RUN "P" $1 read_buffer 0
- 
- 	RUN "P" $1 write_buffer $BSIZE
- 	RUN "P" $1 write_buffer $((2*BSIZE))
- 
--	RUN "F" $1 write_buffer $((BSIZE-1))
--	RUN "F" $1 write_buffer $((BSIZE+1))
- 	RUN "F" $1 write_buffer 0
- 
- 	# basic blockwise functions
diff --git a/nixpkgs/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch b/nixpkgs/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch
new file mode 100644
index 000000000000..dffd0ba3bb52
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch
@@ -0,0 +1,50 @@
+From 4f95ab1f8110a8ab9d7b0e192731ce467f6e5c26 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
+Date: Sun, 4 Sep 2022 11:15:02 -0600
+Subject: [PATCH] Allow loading token handlers from the default search path
+
+Since [1] landed in cryptsetup, token handlers (libcryptsetup-token-*.so)
+are loaded from a fixed path defined at compile-time. This is
+problematic with NixOS since it introduces a dependency cycle
+between cryptsetup and systemd.
+
+This downstream patch [2] allows loading token plugins from the
+default library search path. This approach is not accepted upstream [3]
+due to security concerns, but the potential attack vectors require
+root access and they are sufficiently addressed:
+
+* cryptsetup could be used as a setuid binary (not used in NixOS).
+  In this case, LD_LIBRARY_PATH is ignored because of secure-execution
+  mode.
+* cryptsetup running as root could lead to a malicious token handler
+  being loaded through LD_LIBRARY_PATH. However, fixing the path
+  doesn't prevent the same malicious .so being loaded through LD_PRELOAD.
+
+[1] https://gitlab.com/cryptsetup/cryptsetup/-/commit/5b9e98f94178d3cd179d9f6e2a0a68c7d9eb6507
+[2] https://github.com/NixOS/nixpkgs/issues/167994#issuecomment-1094249369
+[3] https://gitlab.com/cryptsetup/cryptsetup/-/issues/733
+---
+ lib/luks2/luks2_token.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c
+index 26467253..6f8329f0 100644
+--- a/lib/luks2/luks2_token.c
++++ b/lib/luks2/luks2_token.c
+@@ -151,12 +151,10 @@ crypt_token_load_external(struct crypt_device *cd, const char *name, struct cryp
+ 
+ 	token = &ret->u.v2;
+ 
+-	r = snprintf(buf, sizeof(buf), "%s/libcryptsetup-token-%s.so", crypt_token_external_path(), name);
++	r = snprintf(buf, sizeof(buf), "libcryptsetup-token-%s.so", name);
+ 	if (r < 0 || (size_t)r >= sizeof(buf))
+ 		return -EINVAL;
+ 
+-	assert(*buf == '/');
+-
+ 	log_dbg(cd, "Trying to load %s.", buf);
+ 
+ 	h = dlopen(buf, RTLD_LAZY);
+-- 
+2.37.2
+
diff --git a/nixpkgs/pkgs/os-specific/linux/cshatag/default.nix b/nixpkgs/pkgs/os-specific/linux/cshatag/default.nix
index dc210b017a68..64fb6f4f88ff 100644
--- a/nixpkgs/pkgs/os-specific/linux/cshatag/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cshatag/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cshatag";
-  version = "2.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jSRMNLS+JnA3coZf9zkOL/buxZubhbftXnxDJx0nwuU=";
+    sha256 = "sha256-Ez8zGVX10A7xuggkh3n7w/qzda8f4t6EgSc9l6SPEZQ=";
   };
 
-  vendorSha256 = "sha256-BX7jbYhs3+yeOUvPvz08aV2p14bXNGTag4QYkCHr5DQ=";
+  vendorSha256 = "sha256-QTnwltsoyUbH4vob5go1KBrb9gwxaaPNW3S4sxVls3k=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
index b7e0a6b61586..c8c437a968a4 100644
--- a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -1,30 +1,83 @@
-{ lib, stdenv, fetchFromGitHub, docutils, meson, ninja, pkg-config
-, dbus, linuxHeaders, systemd }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, docutils
+, meson
+, ninja
+, pkg-config
+, dbus
+, linuxHeaders
+, systemd
+}:
 
+let
+  dep = { pname, version, hash, rev ? "v${version}", buildInputs ? [ ] }:
+    stdenv.mkDerivation {
+      inherit pname version;
+      src = fetchFromGitHub {
+        owner = "c-util";
+        repo = pname;
+        inherit hash rev;
+      };
+      nativeBuildInputs = [ meson ninja pkg-config ];
+      inherit buildInputs;
+    };
+
+  # These libraries are not used outside of dbus-broker.
+  #
+  # If that changes, we can always break them out, but they are essentially
+  # part of the dbus-broker project, just in separate repositories.
+  c-dvar = dep { pname = "c-dvar"; version = "1.0.0"; hash = "sha256-P7y7gUHXQn2eyS6IcV7m7yGy4VGtQ2orgBkS7Y729ZY="; buildInputs = [ c-stdaux c-utf8 ]; };
+  c-ini = dep { pname = "c-ini"; version = "1.0.0"; hash = "sha256-VKxoGexMcquakMmiH5IJt0382TjkV1FLncTSyEqf4X0="; buildInputs = [ c-list c-rbtree c-stdaux c-utf8 ]; };
+  c-list = dep { pname = "c-list"; version = "3.1.0"; hash = "sha256-fp3EAqcbFCLaT2EstLSzwP2X13pi2EFpFAullhoCtpw="; };
+  # TODO: Fetch c-rbtree from a tag after its next release
+  c-rbtree = dep { pname = "c-rbtree"; version = "unstable-2022-07-07"; rev = "431a4746705223673e43940ca1ad9b5f52473a4b"; hash = "sha256-ExSPgNqhTjSwRgYfZOAyoaehOpFNHKFqPYkcCfptkrs="; buildInputs = [ c-stdaux ]; };
+  c-shquote = dep { pname = "c-shquote"; version = "1.0.0"; hash = "sha256-Ze1enX0VJ6Xi5e4EhWzaiHc7PnuaifrUP+JuJnauv5c="; buildInputs = [ c-stdaux ]; };
+  c-stdaux = dep { pname = "c-stdaux"; version = "1.2.0"; hash = "sha256-/D+IFdqn1XHDfdOsDnLMO5IHQ5B4P4ELyMpRcPBg/4s="; };
+  c-utf8 = dep { pname = "c-utf8"; version = "1.0.0"; hash = "sha256-QEnjmfQ6kxJdsHfyRgXAlP+oGrKLYQ0m9r+D2L+pizI="; buildInputs = [ c-stdaux ]; };
+
+in
 stdenv.mkDerivation rec {
   pname = "dbus-broker";
-  version = "29";
+  version = "32";
 
   src = fetchFromGitHub {
-    owner  = "bus1";
-    repo   = "dbus-broker";
-    rev    = "v${version}";
-    sha256 = "1abbi8c0mgdqjidlp2wnmy0a88xv173hq88sh5m966c5r1h6alkq";
-    fetchSubmodules = true;
+    owner = "bus1";
+    repo = "dbus-broker";
+    rev = "v${version}";
+    hash = "sha256-PVdRyg/t6D3HjSHeap5L8AiEm39iSO5qXohLw2UAUYY=";
   };
 
+  patches = [ ./paths.patch ];
+
   nativeBuildInputs = [ docutils meson ninja pkg-config ];
 
-  buildInputs = [ dbus linuxHeaders systemd ];
+  buildInputs = [
+    c-dvar
+    c-ini
+    c-list
+    c-rbtree
+    c-shquote
+    c-stdaux
+    c-utf8
+    dbus
+    linuxHeaders
+    systemd
+  ];
 
-  mesonFlags = [ "-D=system-console-users=gdm,sddm,lightdm" ];
+  mesonFlags = [
+    # while we technically support 4.9 and 4.14, the NixOS module will throw an
+    # error when using a kernel that's too old
+    "-D=linux-4-17=true"
+    "-D=system-console-users=gdm,sddm,lightdm"
+  ];
 
   PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
   PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
   PKG_CONFIG_SYSTEMD_CATALOGDIR = "${placeholder "out"}/lib/systemd/catalog";
 
   postInstall = ''
-    install -Dm644 $src/README.md $out/share/doc/dbus-broker/README
+    install -Dm444 $src/README.md $out/share/doc/dbus-broker/README
 
     sed -i $out/lib/systemd/{system,user}/dbus-broker.service \
       -e 's,^ExecReload.*busctl,ExecReload=${systemd}/bin/busctl,'
@@ -34,9 +87,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux D-Bus Message Broker";
-    homepage    = "https://github.com/bus1/dbus-broker/wiki";
-    license     = licenses.asl20;
-    platforms   = platforms.linux;
+    homepage = "https://github.com/bus1/dbus-broker/wiki";
+    license = licenses.asl20;
     maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dbus-broker/paths.patch b/nixpkgs/pkgs/os-specific/linux/dbus-broker/paths.patch
new file mode 100644
index 000000000000..577270d30dce
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/dbus-broker/paths.patch
@@ -0,0 +1,27 @@
+diff --git a/src/launch/launcher.c b/src/launch/launcher.c
+index 5bf5cf5..06ce7f4 100644
+--- a/src/launch/launcher.c
++++ b/src/launch/launcher.c
+@@ -924,9 +924,7 @@ static int launcher_load_standard_session_services(Launcher *launcher, NSSCache
+ 
+ static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *nss_cache) {
+         static const char *default_data_dirs[] = {
+-                "/usr/local/share",
+-                "/usr/share",
+-                "/lib",
++                "/run/current-system/sw/share",
+                 NULL,
+         };
+         const char *suffix = "dbus-1/system-services";
+@@ -1012,9 +1010,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
+         if (launcher->configfile)
+                 configfile = launcher->configfile;
+         else if (launcher->user_scope)
+-                configfile = "/usr/share/dbus-1/session.conf";
++                configfile = "/etc/dbus-1/session.conf";
+         else
+-                configfile = "/usr/share/dbus-1/system.conf";
++                configfile = "/etc/dbus-1/system.conf";
+ 
+         config_parser_init(&parser);
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/ddcci/default.nix b/nixpkgs/pkgs/os-specific/linux/ddcci/default.nix
index fe16d283ffc8..f9a71fece748 100644
--- a/nixpkgs/pkgs/os-specific/linux/ddcci/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ddcci/default.nix
@@ -1,17 +1,26 @@
-{ lib, stdenv, fetchFromGitLab, kernel }:
+{ lib, stdenv, fetchFromGitLab, kernel, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ddcci-driver";
-  version = "0.4.2";
+  version = "0.4.3";
   name = "${pname}-${kernel.version}-${version}";
 
   src = fetchFromGitLab {
     owner = "${pname}-linux";
     repo = "${pname}-linux";
     rev = "v${version}";
-    sha256 = "sSmL8PqxqHHQiume62si/Kc9El58/b4wkB93iG0dnNM=";
+    hash = "sha256-1Z6V/AorD4aslLKaaCZpmkD2OiQnmpu3iroOPlNPtLE=";
   };
 
+  patches = [
+    # https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/merge_requests/12
+    (fetchpatch {
+      name = "kernel-6.2-6.3.patch";
+      url = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/commit/1ef6079679acc455f75057dd7097b5b494a241dc.patch";
+      hash = "sha256-2C2leS20egGY3J2tq96gsUQXYw13wBJ3ZWrdIXxmEYs=";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/dddvb/default.nix b/nixpkgs/pkgs/os-specific/linux/dddvb/default.nix
index ea69ecd7513c..809010be2a72 100644
--- a/nixpkgs/pkgs/os-specific/linux/dddvb/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dddvb/default.nix
@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ hexa ];
     platforms = platforms.linux;
+    broken = lib.versionAtLeast kernel.version "6.2";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix b/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
index 88791a1fb1d4..fb8e92f23306 100644
--- a/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
@@ -8,21 +8,32 @@ with lib; {
       overlays = toList overlays';
     in ''
       mkdir -p $out
-      cd ${base}
+      cd "${base}"
       find . -type f -name '*.dtb' -print0 \
-        | xargs -0 cp -v --no-preserve=mode --target-directory $out --parents
+        | xargs -0 cp -v --no-preserve=mode --target-directory "$out" --parents
 
-      for dtb in $(find $out -type f -name '*.dtb'); do
-        dtbCompat="$( fdtget -t s $dtb / compatible )"
+      for dtb in $(find "$out" -type f -name '*.dtb'); do
+        dtbCompat=$(fdtget -t s "$dtb" / compatible 2>/dev/null || true)
+        # skip files without `compatible` string
+        test -z "$dtbCompat" && continue
 
         ${flip (concatMapStringsSep "\n") overlays (o: ''
-        overlayCompat="$( fdtget -t s ${o.dtboFile} / compatible )"
-        # overlayCompat in dtbCompat
-        if [[ "$dtbCompat" =~ "$overlayCompat" ]]; then
-          echo "Applying overlay ${o.name} to $( basename $dtb )"
-          mv $dtb{,.in}
-          fdtoverlay -o "$dtb" -i "$dtb.in" ${o.dtboFile};
-          rm $dtb.in
+        overlayCompat="$(fdtget -t s "${o.dtboFile}" / compatible)"
+
+        # skip incompatible and non-matching overlays
+        if [[ ! "$dtbCompat" =~ "$overlayCompat" ]]; then
+          echo "Skipping overlay ${o.name}: incompatible with $(basename "$dtb")"
+        elif ${if (o.filter == null) then "false" else ''
+          [[ "''${dtb//${o.filter}/}" ==  "$dtb" ]]
+        ''}
+        then
+          echo "Skipping overlay ${o.name}: filter does not match $(basename "$dtb")"
+        else
+          echo -n "Applying overlay ${o.name} to $(basename "$dtb")... "
+          mv "$dtb"{,.in}
+          fdtoverlay -o "$dtb" -i "$dtb.in" "${o.dtboFile}"
+          echo "ok"
+          rm "$dtb.in"
         fi
         '')}
 
diff --git a/nixpkgs/pkgs/os-specific/linux/digimend/default.nix b/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
index 70fc58232ab4..8a4a852a4732 100644
--- a/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Fix build on Linux kernel >= 5.18
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-fallthrough" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
index d920e44d425a..e8d1ff829e90 100644
--- a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
@@ -20,22 +20,22 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "5.6.0-59.176";
+  version = "5.6.1-59.184";
 
   src = requireFile rec {
-    name = "displaylink-56.zip";
-    sha256 = "1v9s4ksr4mnl629n24si14g762b7knr00sqacz60mxcmy4mch5fa";
+    name = "displaylink-561.zip";
+    sha256 = "1hihsz35ccydzx04r8r9kz0hvqwj5fgr8zpzvwyhfxp2m549f9w9";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.6
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.6.1
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.6-EXE.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.6.1-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };
@@ -67,12 +67,12 @@ stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 
-
   meta = with lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
+    homepage = "https://www.displaylink.com/";
+    license = licenses.unfree;
     maintainers = with maintainers; [ abbradar peterhoeg eyjhb ];
     platforms = [ "x86_64-linux" "i686-linux" ];
-    license = licenses.unfree;
-    homepage = "https://www.displaylink.com/";
+    hydraPlatforms = [];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dlm/default.nix b/nixpkgs/pkgs/os-specific/linux/dlm/default.nix
deleted file mode 100644
index 3b6f4773a29c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/dlm/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromSourcehut
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "dlm";
-  version = "2020-01-07";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = "6b0e11c4f453b1a4d7a32019227539a980b7ce66";
-    sha256 = "1r3w7my0g3v2ya317qnvjx8wnagjahpj7yx72a65hf2pjbf5x42p";
-  };
-
-  cargoSha256 = "01a8k60qnx2pgxb2adgw30c2hjb60w6230khm5hyqgmp7z4rm8k8";
-
-  meta = with lib; {
-    description = "A stupid simple graphical login manager";
-    homepage = "https://git.sr.ht/~kennylevinsen/dlm";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix b/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
index a8c263144208..f09dec758f74 100644
--- a/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dmidecode";
-  version = "3.4";
+  version = "3.5";
 
   src = fetchurl {
     url = "mirror://savannah/dmidecode/dmidecode-${version}.tar.xz";
-    sha256 = "sha256-Q8uoUdhGfJl5zNvqsZLrZjjH06aX66Xdt3naiDdUIhI=";
+    sha256 = "sha256-eddnNe6OJRluKnIpZM+Wg/WglYFQNTeISyVrATicwHM=";
   };
 
   makeFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/dpdk-kmods/default.nix b/nixpkgs/pkgs/os-specific/linux/dpdk-kmods/default.nix
index cdd643a40b66..a3e4f6663860 100644
--- a/nixpkgs/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -1,14 +1,21 @@
-{ lib, stdenv, fetchzip, kernel }:
+{ lib, stdenv, fetchzip, fetchpatch, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "dpdk-kmods";
-  version = "2021-04-21";
+  version = "2022-08-29";
 
   src = fetchzip {
-    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-e13d7af77a1bf98757f85c3c4083f6ee6d0d2372.tar.xz";
-    sha256 = "sha256-8ysWT3X3rIyUAo4/QbkX7cQq5iFeU18/BPsmmWugcIc=";
+    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-4a589f7bed00fc7009c93d430bd214ac7ad2bb6b.tar.xz";
+    sha256 = "sha256-l9asJuw2nl63I1BxK6udy2pNunRiMJxyoXeg9V5+WgI=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://git.launchpad.net/ubuntu/+source/dpdk-kmods/plain/debian/patches/0001-support-linux-5.18.patch?id=9d628c02c169d8190bc2cb6afd81e4d364c382cd";
+      sha256 = "sha256-j4kpx1DOnmf5lFxOhaVFNT7prEy1jrJERX2NFaybTPU=";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
   makeFlags = kernel.makeFlags ++ [
@@ -32,6 +39,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = [ maintainers.mic92 ];
     platforms = platforms.linux;
-    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix b/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
index d9f446f7a2dc..78acb45bb3c7 100644
--- a/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
@@ -5,18 +5,24 @@
 , libbsd, numactl, libbpf, zlib, libelf, jansson, openssl, libpcap, rdma-core
 , doxygen, python3, pciutils
 , withExamples ? []
-, shared ? false }:
+, shared ? false
+, machine ? (
+    if stdenv.isx86_64 then "nehalem"
+    else if stdenv.isAarch64 then "generic"
+    else null
+  )
+}:
 
 let
   mod = kernel != null;
-  dpdkVersion = "22.03";
+  dpdkVersion = "22.11.1";
 in stdenv.mkDerivation rec {
   pname = "dpdk";
   version = "${dpdkVersion}" + lib.optionalString mod "-${kernel.version}";
 
   src = fetchurl {
     url = "https://fast.dpdk.org/rel/dpdk-${dpdkVersion}.tar.xz";
-    sha256 = "sha256-st5fCLzVcz+Q1NfmwDJRWQja2PyNJnrGolNELZuDp8U=";
+    sha256 = "sha256-3gdkZfcXSg1ScUuQcuSDenJrqsgtj+fcZEytXIz3TUw=";
   };
 
   nativeBuildInputs = [
@@ -63,8 +69,7 @@ in stdenv.mkDerivation rec {
   # kni kernel driver is currently not compatble with 5.11
   ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni"
   ++ lib.optional (!shared) "-Ddefault_library=static"
-  ++ lib.optional stdenv.isx86_64 "-Dmachine=nehalem"
-  ++ lib.optional stdenv.isAarch64 "-Dmachine=generic"
+  ++ lib.optional (machine != null) "-Dmachine=${machine}"
   ++ lib.optional mod "-Dkernel_dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ++ lib.optional (withExamples != []) "-Dexamples=${builtins.concatStringsSep "," withExamples}";
 
@@ -91,6 +96,6 @@ in stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21 gpl2 bsd2 ];
     platforms =  platforms.linux;
     maintainers = with maintainers; [ magenbluten orivej mic92 zhaofengli ];
-    broken = mod && kernel.kernelAtLeast "5.18";
+    broken = mod && kernel.isHardened;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dracut/default.nix b/nixpkgs/pkgs/os-specific/linux/dracut/default.nix
new file mode 100644
index 000000000000..c6bf684f7fc8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/dracut/default.nix
@@ -0,0 +1,114 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gitUpdater
+, makeBinaryWrapper
+, pkg-config
+, asciidoc
+, libxslt
+, docbook_xsl
+, bash
+, kmod
+, binutils
+, bzip2
+, coreutils
+, cpio
+, findutils
+, gnugrep
+, gnused
+, gnutar
+, gzip
+, lz4
+, lzop
+, squashfsTools
+, util-linux
+, xz
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dracut";
+  version = "059";
+
+  src = fetchFromGitHub {
+    owner = "dracutdevs";
+    repo = "dracut";
+    rev = version;
+    hash = "sha256-zSyC2SnSQkmS/mDpBXG2DtVVanRRI9COKQJqYZZCPJM=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [
+    bash
+    kmod
+  ];
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    asciidoc
+    libxslt
+    docbook_xsl
+  ];
+
+  postPatch = ''
+    substituteInPlace dracut.sh \
+      --replace 'dracutbasedir="$dracutsysrootdir"/usr/lib/dracut' 'dracutbasedir="$dracutsysrootdir"'"$out/lib/dracut"
+    substituteInPlace lsinitrd.sh \
+      --replace 'dracutbasedir=/usr/lib/dracut' "dracutbasedir=$out/lib/dracut"
+
+    echo 'DRACUT_VERSION=${version}' >dracut-version.sh
+  '';
+
+  preConfigure = ''
+    patchShebangs ./configure
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
+      coreutils
+      util-linux
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
+      bash
+      binutils
+      coreutils
+      findutils
+      gnugrep
+      gnused
+      gnutar
+      stdenv.cc.libc  # for ldd command
+      util-linux
+    ]}
+    wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
+      coreutils
+      cpio
+      findutils
+      gzip
+    ]}
+    wrapProgram $out/bin/lsinitrd --set PATH ${lib.makeBinPath [
+      binutils
+      bzip2
+      coreutils
+      cpio
+      gnused
+      gzip
+      lz4
+      lzop
+      squashfsTools
+      util-linux
+      xz
+      zstd
+    ]}
+  '';
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    homepage = "https://github.com/dracutdevs/dracut/wiki";
+    description = "An event driven initramfs infrastructure";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ lilyinstarlight ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/ebtables/default.nix b/nixpkgs/pkgs/os-specific/linux/ebtables/default.nix
index bca24d9c9050..31a5dbd68f9d 100644
--- a/nixpkgs/pkgs/os-specific/linux/ebtables/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ebtables/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     "LOCALSTATEDIR=/var"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preInstall = "mkdir -p $out/etc/sysconfig";
 
diff --git a/nixpkgs/pkgs/os-specific/linux/ell/default.nix b/nixpkgs/pkgs/os-specific/linux/ell/default.nix
index 67d8f107ce38..bde39a41b525 100644
--- a/nixpkgs/pkgs/os-specific/linux/ell/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.52";
+  version = "0.57";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
+    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
   };
 
   nativeBuildInputs = [
@@ -22,13 +22,14 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     dbus
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  # tests sporadically fail on musl
+  doCheck = !stdenv.hostPlatform.isMusl;
 
   meta = with lib; {
     homepage = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
diff --git a/nixpkgs/pkgs/os-specific/linux/ena/default.nix b/nixpkgs/pkgs/os-specific/linux/ena/default.nix
index b8128c83c0c6..abc116efdcb2 100644
--- a/nixpkgs/pkgs/os-specific/linux/ena/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ena/default.nix
@@ -1,27 +1,45 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.7.1";
+  version = "2.8.6";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "sha256-JkGzmmsAmLvL9e+bg58H79GNHgsqydK/79VoWEq5/Mc=";
+    hash = "sha256-clRu+ecK/Je0kvlAAm6qCJqMyvZv0C88YIGDImhRhKA=";
   };
 
+  patches =
+    [ # https://github.com/amzn/amzn-drivers/issues/269#issuecomment-1552483792
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11504862/phc_kernel_6_2_fix.patch";
+        hash = "sha256-/EBkISwXMd7t4WZjsG9KVP6vncFwcZq1QBsxQLXyWsY=";
+      })
+      # https://github.com/amzn/amzn-drivers/issues/270#issuecomment-1561924754
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11559312/devlink_6_2_fix.patch";
+        hash = "sha256-Nc71u91G0dL+ld6ovqjHaE6X2TxduWeQYr5K0KdoA3Q=";
+      })
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11559314/devlink_6_3_fix.patch";
+        hash = "sha256-aEQTbwHC1DcDrtj188eoGzi3GU9MXnwIxuJW4L7qb/I=";
+      })
+    ];
+
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
   makeFlags = kernel.makeFlags;
 
   # linux 3.12
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   configurePhase = ''
     runHook preConfigure
     cd kernel/linux/ena
+    export ENA_PHC_INCLUDE=1
     substituteInPlace Makefile --replace '/lib/modules/$(BUILD_KERNEL)' ${kernel.dev}/lib/modules/${kernel.modDirVersion}
     runHook postConfigure
   '';
@@ -40,8 +58,7 @@ stdenv.mkDerivation rec {
     description = "Amazon Elastic Network Adapter (ENA) driver for Linux";
     homepage = "https://github.com/amzn/amzn-drivers";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.eelco ];
+    maintainers = with maintainers; [ eelco sielicki ];
     platforms = platforms.linux;
-    broken = kernel.kernelAtLeast "5.17";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
index 547e6cc651ab..d84edfc56d95 100644
--- a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
@@ -1,15 +1,14 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, fuse, libuuid, lz4 }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, libuuid, lz4 }:
 
 stdenv.mkDerivation rec {
   pname = "erofs-utils";
-  version = "1.5";
+  version = "1.6";
   outputs = [ "out" "man" ];
 
-  src = fetchgit {
+  src = fetchurl {
     url =
-      "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git";
-    rev = "v" + version;
-    sha256 = "sha256-vMWAmGMJp0XDuc4sbo6Y7gfCQVAo4rETea0Tkdbg82U=";
+      "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${version}.tar.gz";
+    sha256 = "sha256-2/Gtrv8buFMrKacsip4ZGTjJOJlGdw3HY9PFnm8yBXE=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
@@ -19,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Userspace utilities for linux-erofs file system";
-    license = with licenses; [ gpl2 ];
+    license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ ehmry ];
     platforms = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/error-inject/default.nix b/nixpkgs/pkgs/os-specific/linux/error-inject/default.nix
index 87a40580deb7..f4a544172176 100644
--- a/nixpkgs/pkgs/os-specific/linux/error-inject/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/error-inject/default.nix
@@ -10,7 +10,7 @@
     version = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
 
     src = fetchgit {
-      url = "git://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git";
+      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git";
       rev = version;
       sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
     };
@@ -40,7 +40,7 @@
     version = "9bd5e2c7886fca72f139cd8402488a2235957d41";
 
     src = fetchgit {
-      url = "git://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git";
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git";
       rev = version;
       sha256 = "0bh6mzpk2mr4xidkammmkfk21b4dbq793qjg25ryyxd1qv0c6cg4";
     };
diff --git a/nixpkgs/pkgs/os-specific/linux/ethq/default.nix b/nixpkgs/pkgs/os-specific/linux/ethq/default.nix
new file mode 100644
index 000000000000..f966e285471e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ethq/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "ethq";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "isc-projects";
+    repo = "ethq";
+    rev = "refs/tags/v${builtins.replaceStrings ["."] ["_"] version}";
+    hash = "sha256-luvvNdH4kERAMy242kLCqlnGmfPjSjvoHa6J2J7BFi4=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -m0755 ethq $out/bin/ethq
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Ethernet NIC Queue stats viewer";
+    homepage = "https://github.com/isc-projects/ethq";
+    license = licenses.mpl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix b/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
index 7807f475e9b1..4d3c9e785229 100644
--- a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
-, glib
 , gperf
 , kmod
 , pkg-config
@@ -11,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eudev";
-  version = "3.2.11";
+  version = "3.2.12";
 
   src = fetchFromGitHub {
     owner = "eudev-project";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-W5nL4hicQ4fxz5rqoP+hhkE1tVn8lJZjMq4UaiXH6jc=";
+    hash = "sha256-x9l+W8zuFYwG0m9JOIDbEf1x6yeBW36HnJws/buc7HI=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +26,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    glib
     kmod
     util-linux
   ];
diff --git a/nixpkgs/pkgs/os-specific/linux/evdi/default.nix b/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
index b94f4351ff52..f8f4f400ade2 100644
--- a/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "evdi";
-  version = "1.12.0";
+  version = "unstable-2022-10-13";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-JZKZ7+1OMbBtUA7pAZ41TzeDDyiD0h7yTXJINJ5FjN4=";
+    rev = "bdc258b25df4d00f222fde0e3c5003bf88ef17b5";
+    hash = "sha256-mt+vEp9FFf7smmE2PzuH/3EYl7h89RBN1zTVvv2qJ/o=";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix b/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
index 9a2c20ca38aa..88ac5add34a7 100644
--- a/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eventstat";
-  version = "0.04.13";
+  version = "0.05.01";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-psamt9omhakiO3Kx2EzofPL2VAsva7XKQTZmn6zKefA=";
+    hash = "sha256-raODDA1EKtZThFg0NV6EfrWj5mSQNaiekywfOfAvYXI=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/nixpkgs/pkgs/os-specific/linux/exfat/default.nix b/nixpkgs/pkgs/os-specific/linux/exfat/default.nix
index d459d2408442..3d2445df4980 100644
--- a/nixpkgs/pkgs/os-specific/linux/exfat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/exfat/default.nix
@@ -1,11 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, kernel }:
 
 stdenv.mkDerivation rec {
-  # linux kernel above 5.7 comes with its own exfat implementation https://github.com/arter97/exfat-linux/issues/27
-  # Assertion moved here due to some tests unintenionally triggering it,
-  # e.g. nixosTests.kernel-latest; it's unclear how/why so far.
-  assertion = assert lib.versionOlder kernel.version "5.8"; null;
-
   name = "exfat-nofuse-${version}-${kernel.version}";
   version = "2020-04-15";
 
@@ -23,7 +18,7 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/fan2go/default.nix b/nixpkgs/pkgs/os-specific/linux/fan2go/default.nix
new file mode 100644
index 000000000000..e7ad27741062
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/fan2go/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule, fetchFromGitHub, lib, lm_sensors }:
+
+buildGoModule rec {
+  pname = "fan2go";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "markusressel";
+    repo = pname;
+    rev = version;
+    sha256 = "3pnJaLD+FEQWAAwIiTkcs9VgqO0JwRaK7JLdIygeChY=";
+  };
+
+  vendorSha256 = "9EeiYPNTUEFHxTdvVb2JLU6Qi0oazH+n9MB8Dg+RLJ4=";
+
+  postConfigure = ''
+    substituteInPlace vendor/github.com/md14454/gosensors/gosensors.go \
+      --replace '"/etc/sensors3.conf"' '"${lm_sensors}/etc/sensors3.conf"'
+  '';
+
+  CGO_CFLAGS = "-I ${lm_sensors}/include";
+  CGO_LDFLAGS = "-L ${lm_sensors}/lib";
+
+  meta = with lib; {
+    description = "A simple daemon providing dynamic fan speed control based on temperature sensors";
+    homepage = "https://github.com/markusressel/fan2go";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ mtoohey ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/fanctl/default.nix b/nixpkgs/pkgs/os-specific/linux/fanctl/default.nix
new file mode 100644
index 000000000000..d8769b0f04de
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/fanctl/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitLab, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  version = "0.6.4";
+  pname = "fanctl";
+
+  src = fetchFromGitLab {
+    owner = "mcoffin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-XmawybmqRJ9Lj6ii8TZBFwqdQZVp0pOLN4xiSLkU/bw=";
+  };
+
+  cargoSha256 = "sha256-tj00DXQEqC/8+3uzTMWcph+1fNTTVZLSJbV/5lLFkFs=";
+
+  meta = with lib; {
+    description = "Replacement for fancontrol with more fine-grained control interface in its config file";
+    homepage = "https://gitlab.com/mcoffin/fanctl";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ icewind1991 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/fatrace/default.nix b/nixpkgs/pkgs/os-specific/linux/fatrace/default.nix
index 2ae8bb2dca24..487ad533668f 100644
--- a/nixpkgs/pkgs/os-specific/linux/fatrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fatrace/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fatrace";
-  version = "0.16.3";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "martinpitt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-w7leZPdmiTc+avihP203e6GLvbRzbCtNOJdF8MM2v68=";
+    sha256 = "sha256-MRHM+hyuRevK4L3u6dGw1S3O7w+BJBsprJVcSz6Q9xg=";
   };
 
   buildInputs = [ python3 which ];
diff --git a/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix b/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
index cbea00ae184d..9e89ad555317 100644
--- a/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
@@ -1,52 +1,99 @@
-{ stdenv, lib, fetchurl, gpm, freetype, fontconfig, pkg-config, ncurses, libx86 }:
+{ stdenv
+, autoreconfHook
+, fetchFromGitLab
+, fetchpatch
+, fetchurl
+, fontconfig
+, freetype
+, gpm
+, lib
+, ncurses
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.7.0";
+  version = "1.7-2";
   pname = "fbterm";
 
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/fbterm/fbterm-${version}.tar.gz";
-    sha256 = "0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "debian";
+    repo = pname;
+    rev = "debian/${version}";
+    hash = "sha256-vRUZgFpA1IkzkLzl7ImT+Yff5XqjFbUlkHmj/hd7XDE=";
   };
 
-  nativeBuildInputs = [ pkg-config ncurses ];
-  buildInputs = [ gpm freetype fontconfig ncurses ]
-    ++ lib.optional stdenv.hostPlatform.isx86 libx86;
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    ncurses
+  ];
+  buildInputs = [
+    gpm
+    freetype
+    fontconfig
+    ncurses
+  ];
 
-  preConfigure = ''
-    sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
-    sed -e '/install-exec-hook:/,/^[^\t]/{d}; /.NOEXPORT/iinstall-exec-hook:\
-    ' -i src/Makefile.in
-    export HOME=$PWD;
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lfreetype"
+  # preConfigure = ''
+  #   sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
+  #   sed -e '/install-exec-hook:/,/^[^\t]/{d}; /.NOEXPORT/iinstall-exec-hook:\
+  #   ' -i src/Makefile.in
+  #   export HOME=$PWD;
+  #   export NIX_LDFLAGS="$NIX_LDFLAGS -lfreetype"
+  # '';
+
+  preInstall = ''
+    export HOME=$PWD
   '';
-  preBuild = ''
+
+  postInstall =
+  let
+    fbtermrc = fetchurl {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbtermrc?h=fbterm";
+      hash = "sha256-zNIfi2ZjEGc5PLdOIirKGTXESb5Wm5XBAI1sfHa31LY=";
+    };
+  in
+  ''
     mkdir -p "$out/share/terminfo"
     tic -a -v2 -o"$out/share/terminfo" terminfo/fbterm
-    makeFlagsArray+=("AR=$AR")
+
+    mkdir -p "$out/etc/fbterm"
+    cp "${fbtermrc}" "$out/etc/fbterm"
   '';
 
+  # Patches from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=fbterm
   patches = [
-    # fixes from Arch Linux package
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/gcc-6-build-fixes.patch";
-      sha256 = "1kl9fjnrri6pamjdl4jpkqxk5wxcf6jcchv5801xz8vxp4542m40";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbconfig.patch?h=fbterm";
+      hash = "sha256-skCdUqyMkkqxS1YUI7cofsfnNNo3SL/qe4WEIXlhm/s=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/color_palette.patch?h=fbterm";
+      hash = "sha256-SkWxzfapyBTtMpTXkiFHRAw8/uXw7cAWwg5Q3TqWlk8=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbterm.patch?h=fbterm";
+      hash = "sha256-XNHBTGQGeaQPip2XgcKlr123VDwils2pnyiGqkBGhzU=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-Fix-build-with-gcc-6.patch?h=fbterm";
+      hash = "sha256-3d3zBvr5upICVVkd6tn63IhuB0sF67f62aKnf8KvOwg=";
     })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/insertmode-fix.patch";
-      sha256 = "1bad9mqcfpqb94lpx23lsamlhplil73ahzin2xjva0gl3gr1038l";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_ftbfs_crosscompile.patch?h=fbterm";
+      hash = "sha256-jv/FSG6dHR0jKjPXQIfqsvpiT/XYzwv/VwuV+qUSovM=";
     })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/miscoloring-fix.patch";
-      sha256 = "1mjszji0jgs2jsagjp671fv0d1983wmxv009ff1jfhi9pbay6jd0";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_ftbfs_epoll.patch?h=fbterm";
+      hash = "sha256-wkhfG0uY/5ZApcXTERkaKqz5IDpnilxUEcxull4645A=";
     })
-    ./select.patch
   ];
 
   meta = with lib; {
     description = "Framebuffer terminal emulator";
-    homepage = "https://code.google.com/archive/p/fbterm/";
-    maintainers = with maintainers; [ raskin ];
+    homepage = "https://salsa.debian.org/debian/fbterm";
+    maintainers = with maintainers; [ lovesegfault raskin ];
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/ffado/default.nix b/nixpkgs/pkgs/os-specific/linux/ffado/default.nix
index 8f58f1c2d045..3d44ad813a69 100644
--- a/nixpkgs/pkgs/os-specific/linux/ffado/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ffado/default.nix
@@ -24,11 +24,11 @@ let
 in
 mkDerivation rec {
   pname = "ffado";
-  version = "2.4.3";
+  version = "2.4.7";
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    sha256 = "08bygzv1k6ai0572gv66h7gfir5zxd9klfy74z2pxqp6s5hms58r";
+    sha256 = "0vsn3y52g6f77lqh9qfkd7dslmb7bbgy46cv5idynx4frqscc23s";
   };
 
   prePatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/firejail/default.nix b/nixpkgs/pkgs/os-specific/linux/firejail/default.nix
index 7b7abdb8441c..64607c5653eb 100644
--- a/nixpkgs/pkgs/os-specific/linux/firejail/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firejail/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "firejail";
-  version = "0.9.70";
+  version = "0.9.72";
 
   src = fetchFromGitHub {
     owner = "netblue30";
     repo = "firejail";
     rev = version;
-    sha256 = "sha256-x1txt0uER66bZN6BD6c/31Zu6fPPwC9kl/3bxEE6Ce8=";
+    sha256 = "sha256-XAlb6SSyY2S1iWDaulIlghQ16OGvT/wBCog95/nxkog=";
   };
 
   nativeBuildInputs = [
@@ -47,6 +47,12 @@ stdenv.mkDerivation rec {
     # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
     substituteInPlace src/include/common.h \
       --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
+
+    # Workaround for regression introduced in 0.9.72 preventing usage of
+    # end-of-options indicator "--"
+    # See https://github.com/netblue30/firejail/issues/5659
+    substituteInPlace src/firejail/sandbox.c \
+      --replace " && !arg_doubledash" ""
   '';
 
   preConfigure = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix
new file mode 100644
index 000000000000..28da48c31cd7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -0,0 +1,147 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, m4
+, cmake
+, perl
+, writeScript
+, enableUnstable ? false
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ath9k-htc-blobless-firmware";
+  version = if enableUnstable then "unstable-2022-05-22" else "1.4.0";
+
+  src = fetchFromGitHub ({
+    owner = "qca";
+    repo = "open-ath9k-htc-firmware";
+  } // (if enableUnstable then {
+    rev = "d856466a068afe4069335257c0d28295ff777d92";
+    hash = "sha256-9OE6qYGABeXjf1r/Depd+811EJ2e8I0Ni5ePHSOh9G4=";
+  } else {
+    rev = finalAttrs.version;
+    hash = "sha256-Q/A0ryIC5E1pt2Sh7o79gxHbe4OgdlrwflOWtxWSS5o=";
+  }));
+
+  postPatch = ''
+    patchShebangs target_firmware/firmware-crc.pl
+  '';
+
+  nativeBuildInputs = [ m4 cmake perl ];
+
+  env.NIX_CFLAGS_COMPILE = "-w";  # old libiberty emits fatal warnings
+
+  dontUseCmakeConfigure = true;
+  enableParallelBuilding = true;
+
+  # The firmware repository builds its own toolchain, with patches
+  # applied to the xtensa support in both gcc and binutils.
+  preBuild =
+    let
+      inherit (lib) toUpper splitString last listToAttrs pipe;
+      inherit (builtins) map;
+      urls-and-hashes = import (./. + "/urls-and-hashes-${finalAttrs.version}.nix");
+      make-links = pipe
+        [ "gcc" "binutils" "gmp" "mpfr" "mpc" ]
+        [ (map (vname: fetchurl rec {
+            url = urls-and-hashes."${(toUpper vname) + "_URL"}";
+            sha256 = urls-and-hashes."${(toUpper vname) + "_SUM"}" or "";
+            name = last (splitString "/" url);
+          }))
+          (map (v: "ln -sT ${v} toolchain/dl/${v.name}"))
+          (lib.concatStringsSep "\n")
+        ];
+    in ''
+      mkdir -p toolchain/dl
+      ${make-links}
+    '';
+
+  makeTargets = [ "toolchain" "firmware" ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/lib/firmware/ath9k_htc/ target_firmware/*.fw
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit (finalAttrs) src;
+    updateScript = writeScript "${finalAttrs.pname}-${finalAttrs.version}-updateScript" ''
+      nix-shell '<nixpkgs>' -A ${finalAttrs.pname}${lib.optionalString enableUnstable "-unstable"}.passthru.update \
+      > pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-${finalAttrs.version}.nix
+    '';
+    update = stdenv.mkDerivation {
+      name = "${finalAttrs.pname}-${finalAttrs.version}-update";
+      shellHook = ''
+        echo 'rec {'
+        echo '  BASEDIR="$NIX_BUILD_TOP";'
+        make --dry-run --print-data-base -f ${finalAttrs.src}/Makefile download \
+          | egrep    '^[A-Z]+_(VER|URL|SUM|DIR) = ' \
+          | sed 's_\([^ ]*\) = \(.*\)_\1 = "\2\";_' \
+          | tr \( \{ \
+          | tr \) \}
+      ''
+      # sha256 checksums were not added to upstream's Makefile until
+      # after the 1.4.0 release.  The following line is needed for
+      # the `enableUnstable==false` build but not for the
+      # `enableUnstable==true` build.  We can remove the lines below
+      # as soon as `enableUnstable==false` points to a version
+      # greater than 1.4.0.
+      + lib.optionalString (finalAttrs.version == "1.4.0") ''
+        echo 'GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";'
+        echo 'MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";'
+        echo 'MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";'
+        echo 'GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";'
+        echo 'BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";'
+      '' + ''
+        echo '}'
+        exit
+      '';
+    };
+  };
+
+  meta = {
+    description = "Blobless, open source wifi firmware for ath9k_htc.ko";
+    longDescription = ''
+      Firmware for Qualcomm Atheros cards which use the ath9k_htc.ko
+      Linux driver, supporting 802.11 abgn on both 2.4ghz and 5ghz
+      bands, 3x3-antenna MIMO, up to 600mbit/sec.
+
+      Most devices which use this driver are based on the Qualcomm
+      Atheros AR9271 chip, which is a PCIe device.  If your device
+      is connected via USB, it will also include a Qualcomm Atheros
+      AR7010, which bridges from a USB gadget interface to a PCIe
+      host interface.  This repository includes the firmware for
+      both chips.
+
+      This firmware is completely open source with no blobs, which
+      is quite rare in the wifi world.  Wifi chips have their own
+      dedicated general-purpose CPUs.  This source code allows you
+      to see what those CPUs are doing and modify their behavior.
+    '';
+    license = with lib.licenses; [ # see NOTICE.txt for details
+      bsd3                # almost everything; "the ClearBSD licence"
+      gpl2ClasspathPlus   # **/*cmnos_printf.c, only three files
+      mit                 # **/xtos, **/xtensa
+    ];
+
+    # release 1.4.0 vendors a GMP which uses an ancient version of
+    # autotools that does not work on aarch64 or powerpc.
+    # However, enableUnstable (unreleased upstream) works.
+    /*
+    # disabled until #195294 is merged
+    badPlatforms =
+      with lib.systems.inspect.patterns;
+      lib.optionals (!enableUnstable && lib.versionOlder finalAttrs.version "1.4.1") [
+        isAarch64
+        isPower64
+      ];
+    */
+
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    homepage = "http://lists.infradead.org/mailman/listinfo/ath9k_htc_fw";
+    downloadPage = "https://github.com/qca/open-ath9k-htc-firmware";
+    changelog = "https://github.com/qca/open-ath9k-htc-firmware/tags";
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
new file mode 100644
index 000000000000..d67669c93b33
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR="$NIX_BUILD_TOP";
+BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+DL_DIR = "${TOOLCHAIN_DIR}/dl";
+GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.bz2";
+BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+GCC_VER = "4.7.4";
+MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+MPC_VER = "1.0.1";
+GMP_DIR = "gmp-${GMP_VER}";
+MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+GCC_DIR = "gcc-${GCC_VER}";
+MPFR_DIR = "mpfr-${MPFR_VER}";
+MPC_DIR = "mpc-${MPC_VER}";
+MPFR_VER = "3.1.1";
+GMP_VER = "5.0.5";
+BINUTILS_VER = "2.23.1";
+BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";
+MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";
+MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";
+GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";
+BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
new file mode 100644
index 000000000000..4234f91ef978
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR="$NIX_BUILD_TOP";
+BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+DL_DIR = "${TOOLCHAIN_DIR}/dl";
+GMP_SUM = "f51c99cb114deb21a60075ffb494c1a210eb9d7cb729ed042ddb7de9534451ea";
+GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.gz";
+BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+GCC_VER = "10.2.0";
+MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+MPC_VER = "1.1.0";
+GMP_DIR = "gmp-${GMP_VER}";
+MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+GCC_DIR = "gcc-${GCC_VER}";
+MPC_SUM = "6985c538143c1208dcb1ac42cedad6ff52e267b47e5f970183a3e75125b43c2e";
+GCC_SUM = "27e879dccc639cd7b0cc08ed575c1669492579529b53c9ff27b0b96265fa867d";
+BINUTILS_SUM = "7d24660f87093670738e58bcc7b7b06f121c0fcb0ca8fc44368d675a5ef9cff7";
+MPFR_DIR = "mpfr-${MPFR_VER}";
+MPC_DIR = "mpc-${MPC_VER}";
+MPFR_VER = "4.1.0";
+GMP_VER = "6.2.0";
+BINUTILS_VER = "2.35";
+BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+MPFR_SUM = "feced2d430dd5a97805fa289fed3fc8ff2b094c02d05287fd6133e7f1f0ec926";
+TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock
new file mode 100644
index 000000000000..db5008fda79b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock
@@ -0,0 +1,4125 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a76fd60b23679b7d19bd066031410fb7e458ccc5e958eb5c325888ce4baedc97"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "aho-corasick"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67fc08ce920c31afb70f013dcce1bfc3a3195de6a228474e45e1f145b36f8d04"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is-terminal",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41ed9a86bf92ae6580e0a31281f65a1b1d867c0cc68d5346e2ae128dddfa6a7d"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e765fd216e48e067936442276d1d57399e37bce53c264d6fefbe298080cb57ee"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
+
+[[package]]
+name = "apply"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f47b57fc4521e3cae26a4d45b5227f8fadee4c345be0fefd8d5d1711afb8aeb9"
+
+[[package]]
+name = "arc-swap"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bddcadddf5e9015d310179a59bb28c4d4b9920ad0f11e8e14dbadf654890c9a6"
+
+[[package]]
+name = "async-broadcast"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c48ccdbf6ca6b121e0f586cbc0e73ae440e56c67c30fa0873b4e110d9c26d2b"
+dependencies = [
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-channel"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf46fee83e5ccffc220104713af3292ff9bc7c64c7de289f66dae8e38d826833"
+dependencies = [
+ "concurrent-queue",
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fa3dc5f2a8564f07759c008b9109dc0d39de92a88d5588b8a5036d286383afb"
+dependencies = [
+ "async-lock",
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-fs"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "279cf904654eeebfa37ac9bb1598880884924aab82e290aa65c9e77a0e142e06"
+dependencies = [
+ "async-lock",
+ "autocfg",
+ "blocking",
+ "futures-lite",
+]
+
+[[package]]
+name = "async-io"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
+dependencies = [
+ "async-lock",
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-lite",
+ "log",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "socket2",
+ "waker-fn",
+]
+
+[[package]]
+name = "async-lock"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa24f727524730b077666307f2734b4a1a1c57acb79193127dcc8914d5242dd7"
+dependencies = [
+ "event-listener",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e97ce7de6cf12de5d7226c73f5ba9811622f4db3a5b91b55c53e987e5f91cba"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "async-task"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc7ab41815b3c653ccd2978ec3255c81349336702dfdf62ee6f7069b12a3aae"
+
+[[package]]
+name = "async-trait"
+version = "0.1.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "atk"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3d816ce6f0e2909a96830d6911c2aff044370b1ef92d7f267b43bae5addedd"
+dependencies = [
+ "atk-sys",
+ "bitflags",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58aeb089fb698e06db8089971c7ee317ab9644bade33383f63631437b03aafb6"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1181e1e0d1fce796a03db1ae795d67167da795f9cf4a39c37589e85ef57f26d3"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "backtrace"
+version = "0.3.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233d376d6d185f2a3093e58f283f60f880315b6c60075b01f36b3b85154564ca"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide 0.6.2",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
+
+[[package]]
+name = "better-panic"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fa9e1d11a268684cbd90ed36370d7577afb6c62d912ddff5c15fc34343e5036"
+dependencies = [
+ "backtrace",
+ "console",
+]
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blocking"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77231a1c8f801696fc0123ec6150ce92cffb8e164a02afb9c8ddee0e9b65ad65"
+dependencies = [
+ "async-channel",
+ "async-lock",
+ "async-task",
+ "atomic-waker",
+ "fastrand",
+ "futures-lite",
+ "log",
+]
+
+[[package]]
+name = "buildchain"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e4ba006f08f732ddc25f629c349fbb89c67e6c90a4764ce04534d32a1940b0"
+dependencies = [
+ "base32",
+ "clap 3.2.25",
+ "lxd",
+ "plain",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.10.6",
+ "sodalite",
+ "tempdir",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b1ce199063694f33ffb7dd4e0ee620741495c32833cde5aa08f02a0bf96f0c8"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+
+[[package]]
+name = "cairo-rs"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c76ee391b03d35510d9fa917357c7f1855bd9a6659c95a1b392e33f49b3369bc"
+dependencies = [
+ "bitflags",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "thiserror",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c55d429bef56ac9172d25fecb85dc8068307d17acd74b377866b7a1ef25d3c8"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "cascade"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d499b43edbf784dd81e16f0395f5b4350a35b477da8a074251087adefc11cb52"
+
+[[package]]
+name = "cc"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+
+[[package]]
+name = "cdylib-link-lines"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a317db7ea5b455731e51d7f632762716fa5c0b1098dcaa6221e55e2386d170f2"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8790cf1286da485c72cf5fc7aeba308438800036ec67d89425924c4807268c9"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex 0.2.4",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap"
+version = "4.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a1f23fa97e1d1641371b51f35535cb26959b8e27ab50d167a8b996b5bada819"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fdc5d93c358224b4d6867ef1356d740de2303e9892edc06c5340daeccd96bab"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "bitflags",
+ "clap_lex 0.4.1",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a2dd5a6fe8c6e3502f568a6353e5273bbb15193ad9a89e457b9970798efbea1"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+
+[[package]]
+name = "combine"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "commoncrypto"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d056a8586ba25a1e4d61cb090900e495952c7886786fc55f909ab2f819b69007"
+dependencies = [
+ "commoncrypto-sys",
+]
+
+[[package]]
+name = "commoncrypto-sys"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fed34f46747aa73dfaa578069fd8279d2818ade2b55f38f22a9401c7f4083e2"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62ec6771ecfa0762d24683ee5a32ad78487a3d3afdc0fb8cae19d2c5deb50b7c"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "console"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d79fbe8970a77e3e34151cc13d3b3e248aa0faaecb9f6091fa07ebefe5ad60"
+dependencies = [
+ "encode_unicode",
+ "lazy_static",
+ "libc",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-hash"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a77162240fd97248d19a564a565eb563a3f592b386e4136fb300909e67dddca"
+dependencies = [
+ "commoncrypto",
+ "hex 0.3.2",
+ "openssl",
+ "winapi",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+dependencies = [
+ "cfg-if",
+ "hashbrown",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "dbus"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48b5f0f36f1eebe901b0e6bee369a77ed3396334bf3f09abd46454a576f71819"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bb21987b9fb1613058ba3843121dd18b163b254d8a6e797e144cbac14d96d1b"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "dbus-crossroads"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a816e8ae3382c7b1bccfa6f2778346ee5b13f80e0eccf80cf8f2912af73995a"
+dependencies = [
+ "dbus 0.9.7",
+]
+
+[[package]]
+name = "derivative"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf95dc3f046b9da4f2d51833c0d3547d8564ef6910f5c1ed130306a75b92886"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "ecflash"
+version = "0.1.0"
+source = "git+https://github.com/system76/ecflash.git?branch=stable#ee9d69d4edf3bee6b2fb6dddb021bb58ee3bbbbb"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "either"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+
+[[package]]
+name = "encode_unicode"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "enum_derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "406ac2a8c9eedf8af9ee1489bee9e50029278a6456c740f7454cf8a158abc816"
+
+[[package]]
+name = "enumflags2"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c041f5090df68b32bcd905365fd51769c8b9d553fe87fde0b683534f10c01bd2"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e9a1f9f7d83e59740248a6e14ecf93929ade55027844dfcea78beafccc15745"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "failure"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
+dependencies = [
+ "backtrace",
+ "failure_derive",
+]
+
+[[package]]
+name = "failure_derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "synstructure",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fern"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9f0c14694cbd524c8720dd69b0e3179344f04ebb5f90f2e4a440c6ea3b2f1ee"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "field-offset"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3cf3a800ff6e860c863ca6d4b16fd999db8b752819c1606884047b73e468535"
+dependencies = [
+ "memoffset 0.8.0",
+ "rustc_version",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cbc844cecaee9d4443931972e1289c8ff485cb4cc2767cb03ca139ed6885153"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.2.16",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "find-crate"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59a98bbaacea1c0eb6a0876280051b892eb73594fd90cf3b20e9c817029c57d2"
+dependencies = [
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "firmware-manager"
+version = "0.1.5"
+dependencies = [
+ "apply",
+ "better-panic",
+ "dashmap",
+ "futures",
+ "fwupd-dbus",
+ "human-sort",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "log",
+ "once_cell",
+ "rust-embed",
+ "shrinkwraprs",
+ "slotmap",
+ "system76-firmware-daemon",
+ "thiserror",
+ "tokio",
+ "tokio-udev",
+ "users",
+ "xdg",
+]
+
+[[package]]
+name = "firmware-manager-gtk"
+version = "0.1.5"
+dependencies = [
+ "better-panic",
+ "cascade",
+ "clap 4.2.5",
+ "fern",
+ "firmware-manager",
+ "gdk",
+ "gio",
+ "glib",
+ "gtk",
+ "html2md",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "log",
+ "once_cell",
+ "rust-embed",
+ "shrinkwraprs",
+ "slotmap",
+ "upower_dbus",
+ "yansi",
+]
+
+[[package]]
+name = "firmware-manager-gtk-ffi"
+version = "0.1.5"
+dependencies = [
+ "cdylib-link-lines",
+ "firmware-manager-gtk",
+ "glib",
+ "gtk",
+ "gtk-sys",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "once_cell",
+ "rust-embed",
+]
+
+[[package]]
+name = "firmware-manager-notify"
+version = "0.1.5"
+dependencies = [
+ "firmware-manager",
+ "fomat-macros",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "notify-rust",
+ "once_cell",
+ "rust-embed",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.7.1",
+]
+
+[[package]]
+name = "fluent"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61f69378194459db76abd2ce3952b790db103ceb003008d3d50d97c41ff847a7"
+dependencies = [
+ "fluent-bundle",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-bundle"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e242c601dec9711505f6d5bbff5bedd4b61b2469f2e8bb8e57ee7c9747a87ffd"
+dependencies = [
+ "fluent-langneg",
+ "fluent-syntax",
+ "intl-memoizer",
+ "intl_pluralrules",
+ "rustc-hash",
+ "self_cell",
+ "smallvec",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-langneg"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ad0989667548f06ccd0e306ed56b61bd4d35458d54df5ec7587c0e8ed5e94"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-syntax"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0abed97648395c902868fee9026de96483933faa54ea3b40d652f7dfe61ca78"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "fomat-macros"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f722aa875298d34a0ebb6004699f6f4ea830d36dec8ac2effdbbc840248a096"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "freedesktop-desktop-entry"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f6c340bead95f07434f2432ab52ce048f290d93e42e3c63f416a364801e4bf"
+dependencies = [
+ "markup",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+
+[[package]]
+name = "futures-task"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+
+[[package]]
+name = "futures-util"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "fwupd-dbus"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "740e23cb282f6e8e1aaa26b04553cdf04dbe9c6c18b94a8bdd7da0cc75c4c225"
+dependencies = [
+ "base64 0.13.1",
+ "bitflags",
+ "cascade",
+ "crypto-hash",
+ "dbus 0.9.7",
+ "hex-view",
+ "log",
+ "shrinkwraprs",
+ "thiserror",
+ "ureq",
+ "url",
+ "xdg",
+ "zbus",
+]
+
+[[package]]
+name = "gdk"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6e05c1f572ab0e1f15be94217f0dc29088c248b14f792a5ff0af0d84bcda9e8"
+dependencies = [
+ "bitflags",
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.15.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad38dd9cc8b099cceecdf41375bb6d481b1b5a7cd5cd603e10a69a9383f8619a"
+dependencies = [
+ "bitflags",
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140b2f5378256527150350a8346dbdb08fadc13453a7a2d73aecd5fab3c402a7"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk-sys"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e7a08c1e8f06f4177fb7e51a777b8c1689f743a7bc11ea91d44d2226073a88"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "gimli"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0a93d233ebf96623465aad4046a8d3aa4da22d4f4beba5388838c8a434bbb4"
+
+[[package]]
+name = "gio"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68fdbc90312d462781a395f7a16d96a2b379bb6ef8cd6310a2df272771c4283b"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32157a475271e2c4a023382e9cab31c4584ee30a97da41d3c4e9fdd605abcf8d"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edb0306fbad0ab5428b0ca674a23893db909a98582969c9b537be4ced78c505d"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "once_cell",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.15.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10c6ae9f6fa26f4fb2ac16b528d138d971ead56141de489f8111e259b9df3c4a"
+dependencies = [
+ "anyhow",
+ "heck 0.4.1",
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef4b192f8e65e9cf76cbf4ea71fa8e3be4a0e18ffe3d68b8da6836974cc5bad4"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gobject-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d57ce44246becd17153bd035ab4d32cfee096a657fc01f2231c9278378d1e0a"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e3004a2d5d6d8b5057d2b57b3712c9529b62e82c77f25c1fecde1fd5c23bd0"
+dependencies = [
+ "atk",
+ "bitflags",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "once_cell",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.15.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5bc2f0587cba247f60246a0ca11fe25fb733eabc3de12d1965fc07efab87c84"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.15.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "684c0456c086e8e7e9af73ec5b84e35938df394712054550e81558d21c44ab0d"
+dependencies = [
+ "anyhow",
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17f8a914c2987b688368b5138aa05321db91f4090cf26118185672ad588bce21"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+
+[[package]]
+name = "hex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "805026a5d0141ffc30abb3be3173848ad46a1b1664fe632428479619a3644d77"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hex-view"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494e16c9fe4dd02a88f3fe9ec0f27e38045691ea0ceb11603670f220ff5ca97f"
+
+[[package]]
+name = "home"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "html2md"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be92446e11d68f5d71367d571c229d09ced1f24ab6d08ea0bff329d5f6c0b2a3"
+dependencies = [
+ "html5ever",
+ "jni",
+ "lazy_static",
+ "markup5ever_rcdom",
+ "percent-encoding",
+ "regex",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bea68cab48b8459f17cf1c944c67ddc572d272d9f2b274140f223ecb1da4a3b7"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "http"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+dependencies = [
+ "bytes",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+
+[[package]]
+name = "human-sort"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140a09c9305e6d5e557e2ed7cbc68e05765a7d4213975b87cb04920689cc6219"
+
+[[package]]
+name = "hyper"
+version = "0.14.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab302d72a6f11a3b910431ff93aae7e773078c769f0a3ef15fb9ec692ed147d4"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "i18n-config"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d9f93ceee6543011739bc81699b5e0cf1f23f3a80364649b6d80de8636bc8df"
+dependencies = [
+ "log",
+ "serde",
+ "serde_derive",
+ "thiserror",
+ "toml 0.5.11",
+ "unic-langid",
+]
+
+[[package]]
+name = "i18n-embed"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2653dd1a8be0726315603f1c180b29f90e5b2a58f8b943d949d5170d9ad81101"
+dependencies = [
+ "arc-swap",
+ "fluent",
+ "fluent-langneg",
+ "fluent-syntax",
+ "i18n-embed-impl",
+ "intl-memoizer",
+ "lazy_static",
+ "locale_config",
+ "log",
+ "parking_lot",
+ "rust-embed",
+ "thiserror",
+ "unic-langid",
+ "walkdir",
+]
+
+[[package]]
+name = "i18n-embed-fl"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b5809e2295beeb55013705c3b947cbbe83b8cadf3c73a1e6dca06381927212a"
+dependencies = [
+ "dashmap",
+ "find-crate",
+ "fluent",
+ "fluent-syntax",
+ "i18n-config",
+ "i18n-embed",
+ "lazy_static",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "strsim",
+ "syn 1.0.109",
+ "unic-langid",
+]
+
+[[package]]
+name = "i18n-embed-impl"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0db2330e035808eb064afb67e6743ddce353763af3e0f2bdfc2476e00ce76136"
+dependencies = [
+ "find-crate",
+ "i18n-config",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "index-fixed"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161ceaf2f41b6cd3f6502f5da085d4ad4393a51e0c70ed2fce1d5698d798fae"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "intl-memoizer"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c310433e4a310918d6ed9243542a6b83ec1183df95dff8f23f87bb88a264a66f"
+dependencies = [
+ "type-map",
+ "unic-langid",
+]
+
+[[package]]
+name = "intl_pluralrules"
+version = "7.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078ea7b7c29a2b4df841a7f6ac8775ff6074020c6776d48491ce2268e068f972"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "io-lifetimes"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c66c74d2ae7e79a5a8f7ac924adbe38ee42a859c6539ad869eb51f0b52dc220"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12b6ee2129af8d4fb011108c73d99a1b83a85977f23b82460c0ae2e25bb4b57f"
+
+[[package]]
+name = "is-terminal"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "io-lifetimes",
+ "rustix",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "itertools"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f56a2d0bc861f9165be4eb3442afd3c236d8a98afd426f65d92324ae1091a484"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+
+[[package]]
+name = "jni"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+dependencies = [
+ "cesu8",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
+[[package]]
+name = "js-sys"
+version = "0.3.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445dde2150c55e483f3d8416706b97ec8e8237c307e5b7b4b8dd15e6af2a0730"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.142"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06085512b750d640299b79be4bad3d2fa90a9c00b1fd9e1b46364f66f0485c72"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libudev-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c8469b4a23b962c1396b9b451dda50ef5b283e8dd309d69033475fa9b334324"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b64f40e5e03e0d54f03845c8197d0291253cdbedfb1cb46b13c2c117554a9f4c"
+
+[[package]]
+name = "locale_config"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d2c35b16f4483f6c26f0e4e9550717a2f6575bcd6f12a53ff0c490a94a6934"
+dependencies = [
+ "lazy_static",
+ "objc",
+ "objc-foundation",
+ "regex",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lxd"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918a314b8eb7d4e19c3d154b4069b12aa37c25a68bae4f2c2a69f50bf47c7c5a"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "mac-notification-sys"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e72d50edb17756489e79d52eb146927bec8eba9dd48faadf9ef08bca3791ad5"
+dependencies = [
+ "cc",
+ "dirs-next",
+ "objc-foundation",
+ "objc_id",
+ "time",
+]
+
+[[package]]
+name = "malloc_buf"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "markup"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "360ec4d83ae8c3150530220fd89e0c5dba54cfc8d7675695f1fdc3581880dce9"
+dependencies = [
+ "markup-proc-macro",
+]
+
+[[package]]
+name = "markup-proc-macro"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba9c3711ed5187a843aaa960eb78db98f64d76ea22a47c204ca2affb3904bb92"
+dependencies = [
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "syn 0.15.44",
+]
+
+[[package]]
+name = "markup5ever"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2629bb1404f3d34c2e921f21fd34ba00b206124c81f65c50b43b6aaefeb016"
+dependencies = [
+ "log",
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "markup5ever_rcdom"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9521dd6750f8e80ee6c53d65e2e4656d7de37064f3a7a5d2d11d05df93839c2"
+dependencies = [
+ "html5ever",
+ "markup5ever",
+ "tendril",
+ "xml5ever",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "mio"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8067b404fe97c70829f082dec8bcf4f71225d7eaea1d8645349cb76fa06205cc"
+dependencies = [
+ "libc",
+ "log",
+ "miow",
+ "ntapi",
+ "winapi",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b9d9a46eff5b4ff64b45a9e316a6d1e0bc719ef429cbec4dc630684212bfdf9"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "miow"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9f1c5b025cda876f66ef43a113f91ebc9f4ccef34843000e0adf6ebbab84e21"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+
+[[package]]
+name = "nix"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "static_assertions",
+]
+
+[[package]]
+name = "notify-rust"
+version = "4.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfa211d18e360f08e36c364308f394b5eb23a6629150690e109a916dc6f610e"
+dependencies = [
+ "dbus 0.9.7",
+ "log",
+ "mac-notification-sys",
+ "tauri-winrt-notification",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28774a7fd2fbb4f0babd8237ce554b73af68021b5f695a3cebd6c59bac0980f"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi 0.2.6",
+ "libc",
+]
+
+[[package]]
+name = "objc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
+dependencies = [
+ "malloc_buf",
+]
+
+[[package]]
+name = "objc-foundation"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1add1b659e36c9607c7aab864a76c7a4c2760cd0cd2e120f3fb8b952c7e22bf9"
+dependencies = [
+ "block",
+ "objc",
+ "objc_id",
+]
+
+[[package]]
+name = "objc_id"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92d4ddb4bd7b50d730c215ff871754d0da6b2178849f8a2a2ab69712d0c073b"
+dependencies = [
+ "objc",
+]
+
+[[package]]
+name = "object"
+version = "0.30.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea86265d3d3dcb6a27fc51bd29a4bf387fae9d2986b823079d4986af253eb439"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "openssl"
+version = "0.10.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01b8574602df80f7b85fdfc5392fa884a4e3b3f4f35402c070ab34c3d3f78d56"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e17f59264b2809d77ae94f0e1ebabc434773f370d6ca667bd223ea10e06cc7e"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ceedf44fb00f2d1984b0bc98102627ce622e083e49a5bacdb3e514fa4238e267"
+
+[[package]]
+name = "pango"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e4045548659aee5313bde6c582b0d83a627b7904dd20dc2d9ef0895d414e4f"
+dependencies = [
+ "bitflags",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2a00081cde4661982ed91d80ef437c20eacaf6aa1a5962c0279ae194662c3aa"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14f2252c834a40ed9bb5422029649578e63aa341ac401f74e719dd1afda8394e"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.2.16",
+ "smallvec",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb1c3a8bc4dd4e5cfce29b44ffc14bedd2ee294559a294e2a4d4c9e9a6a13cd"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "polling"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b2d323e8ca7996b3e23126511a523f7e62924d93ecd5ae73b333815b0eb3dce"
+dependencies = [
+ "autocfg",
+ "bitflags",
+ "cfg-if",
+ "concurrent-queue",
+ "libc",
+ "log",
+ "pin-project-lite",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
+dependencies = [
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b63bdb0cd06f1f4dedf69b254734f9b45af66e4a031e42a7480257d9898b435"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11bafc859c6815fbaffbbbf4229ecb767ac913fecb27f9ad4343662e9ef099ea"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
+dependencies = [
+ "proc-macro2 0.4.30",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
+dependencies = [
+ "proc-macro2 1.0.56",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+dependencies = [
+ "getrandom",
+ "redox_syscall 0.2.16",
+ "thiserror",
+]
+
+[[package]]
+name = "regex"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af83e617f331cc6ae2da5443c602dfa5af81e517212d9d611a5b3ba1777b5370"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5996294f19bd3aae0453a862ad728f60e6600695733dd5df01da90c54363a3c"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13293b639a097af28fc8a90f22add145a9c954e49d77da06263d58cf44d5fb91"
+dependencies = [
+ "base64 0.21.0",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-tls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "winreg",
+]
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rust-embed"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b68543d5527e158213414a92832d2aab11a84d2571a5eb021ebe22c43aab066"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "6.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4e0f0ced47ded9a68374ac145edd65a6c1fa13a96447b873660b2a568a0fd7"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "rust-embed-utils",
+ "syn 1.0.109",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "7.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512b0ab6853f7e14e3c8754acb43d6f748bb9ced66aa5915a6553ac8213f7731"
+dependencies = [
+ "sha2 0.10.6",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-lzma"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "895dc04daeaeee338bb96e229797902ed3f0675bfc59d5b42e0f0b0c13ac54da"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.37.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bbfc1d1c7c40c01715f47d71444744a81669ca84e8b63e25a55e169b1f86433"
+dependencies = [
+ "bitflags",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.20.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fff78fc74d175294f4e83b28343315ffcfb114b156f0185e9741cb5570f50e2f"
+dependencies = [
+ "log",
+ "ring",
+ "sct",
+ "webpki",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
+dependencies = [
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "self_cell"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ef965a420fe14fdac7dd018862966a4c14094f900e1650bbc71ddd7d580c8af"
+
+[[package]]
+name = "semver"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
+
+[[package]]
+name = "serde"
+version = "1.0.160"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.160"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.96"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "057d394a50403bcac12672b2b18fb387ab6d289d957dab67dd201875391e52f1"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0efd8caf556a6cebd3b285caf480045fcc1ac04f6bd786b09a6f11af30c4fcf4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "shrinkwraprs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e63e6744142336dfb606fe2b068afa2e1cca1ee6a5d8377277a92945d81fa331"
+dependencies = [
+ "bitflags",
+ "itertools",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bd3e3206899af3f8b12af284fafc038cc1dc2b41d1b89dd17297221c5d225de"
+
+[[package]]
+name = "slab"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "slotmap"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1e08e261d0e8f5c43123b7adf3e4ca1690d655377ac93a03b2c9d3e98de1342"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+
+[[package]]
+name = "socket2"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "sodalite"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41784a359d15c58bba298cccb7f30a847a1a42d0620c9bdaa0aa42fdb3c280e0"
+dependencies = [
+ "index-fixed",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb30289b722be4ff74a408c3cc27edeaad656e06cb1fe8fa9231fa59c728988"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "strum"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
+dependencies = [
+ "heck 0.3.3",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "syn"
+version = "0.15.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
+dependencies = [
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a34fcf3e8b60f57e6a14301a2e916d323af98b0ea63c599441eec8558660c822"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "unicode-xid 0.2.4",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0fe581ad25d11420b873cf9aedaca0419c2b411487b134d4d21065f3d092055"
+dependencies = [
+ "cfg-expr",
+ "heck 0.4.1",
+ "pkg-config",
+ "toml 0.7.3",
+ "version-compare",
+]
+
+[[package]]
+name = "system76-firmware"
+version = "1.0.51"
+source = "git+https://github.com/pop-os/system76-firmware#c3d5323647a0853c4d28e4f7148a4a96f63dbb3a"
+dependencies = [
+ "anyhow",
+ "bincode",
+ "buildchain",
+ "clap 3.2.25",
+ "ecflash",
+ "libc",
+ "plain",
+ "rust-lzma",
+ "serde",
+ "serde_json",
+ "sha2 0.9.9",
+ "system76_ectool",
+ "tar",
+ "tempdir",
+ "uuid",
+]
+
+[[package]]
+name = "system76-firmware-daemon"
+version = "0.1.0"
+source = "git+https://github.com/pop-os/system76-firmware#c3d5323647a0853c4d28e4f7148a4a96f63dbb3a"
+dependencies = [
+ "dbus 0.9.7",
+ "dbus-crossroads",
+ "enum_derive",
+ "libc",
+ "serde",
+ "serde_json",
+ "shrinkwraprs",
+ "system76-firmware",
+ "thiserror",
+]
+
+[[package]]
+name = "system76_ectool"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c957fdd329e017031dbd261ff48fad01296660a9c237942c226cff064bd0610a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d779dc6aeff029314570f666ec83f19df7280bb36ef338442cfa8c604021b80"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd1ba337640d60c3e96bc6f0638a939b9c9a7f2c316a1598c279828b3d1dc8c5"
+
+[[package]]
+name = "tauri-winrt-notification"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c58de036c4d2e20717024de2a3c4bf56c301f07b21bc8ef9b57189fce06f1f3b"
+dependencies = [
+ "quick-xml",
+ "strum",
+ "windows",
+]
+
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9fbec84f381d5795b08656e4912bec604d162bff9291d6189a78f4c8ab87998"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "redox_syscall 0.3.5",
+ "rustix",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "time"
+version = "0.3.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+dependencies = [
+ "serde",
+ "time-core",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+
+[[package]]
+name = "tinystr"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ac3f5b6856e931e15e07b478e98c8045239829a65f9156d4fa7e7788197a5ef"
+dependencies = [
+ "displaydoc",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c786bf8134e5a3a166db9b29ab8f48134739014a3eca7bc6bfa95d673b136f"
+dependencies = [
+ "autocfg",
+ "bytes",
+ "libc",
+ "mio 0.8.6",
+ "num_cpus",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-udev"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "246ffebae60acd93eb0056bac967cad807c7aa09916fabceac50479ad1f53e64"
+dependencies = [
+ "futures-core",
+ "mio 0.7.14",
+ "tokio",
+ "udev",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b403acf6f2bb0859c93c7f0d967cb4a75a7ac552100f9322faf64dc047669b21"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab8ed2edee10b50132aed5f331333428b011c99402b5a534154ed15746f9622"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239410c8609e8125456927e6707163a3b1fdb40561e4b803bc041f466ccfdc13"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tools"
+version = "0.1.0"
+dependencies = [
+ "clap 4.2.5",
+ "freedesktop-desktop-entry",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f57e3ca2a01450b1a921183a9c9cbfda207fd822cef4ccb00a65402cbba7a74"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+
+[[package]]
+name = "type-map"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d3364c5e96cb2ad1603037ab253ddd34d7fb72a58bdddf4b7350760fc69a46"
+dependencies = [
+ "rustc-hash",
+]
+
+[[package]]
+name = "typenum"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+
+[[package]]
+name = "udev"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c960764f7e816eed851a96c364745d37f9fe71a2e7dba79fbd40104530b5dd0"
+dependencies = [
+ "libc",
+ "libudev-sys",
+ "mio 0.8.6",
+ "pkg-config",
+]
+
+[[package]]
+name = "uds_windows"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce65604324d3cce9b966701489fbd0cf318cb1f7bd9dd07ac9a4ee6fb791930d"
+dependencies = [
+ "tempfile",
+ "winapi",
+]
+
+[[package]]
+name = "unic-langid"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "398f9ad7239db44fd0f80fe068d12ff22d78354080332a5077dc6f52f14dcf2f"
+dependencies = [
+ "unic-langid-impl",
+]
+
+[[package]]
+name = "unic-langid-impl"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35bfd2f2b8796545b55d7d3fd3e89a0613f68a0d1c8bc28cb7ff96b411a35ff"
+dependencies = [
+ "serde",
+ "tinystr",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+
+[[package]]
+name = "unicode-xid"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "upower_dbus"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8121b555fe6fd748fb4bb147f7b31b5ea17d006633183447e0d89e19d9aa9b7"
+dependencies = [
+ "dbus 0.6.5",
+ "failure",
+ "failure_derive",
+]
+
+[[package]]
+name = "ureq"
+version = "2.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338b31dd1314f68f3aabf3ed57ab922df95ffcd902476ca7ba3c4ce7b908c46d"
+dependencies = [
+ "base64 0.13.1",
+ "flate2",
+ "log",
+ "once_cell",
+ "rustls",
+ "url",
+ "webpki",
+ "webpki-roots",
+]
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "users"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
+dependencies = [
+ "libc",
+ "log",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version-compare"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "579a42fc0b8e0c63b76519a339be31bed574929511fa53c1a3acae26eb258f29"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "waker-fn"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d5b2c62b4012a3e1eca5a7e077d13b3bf498c4073e33ccd58626607748ceeca"
+
+[[package]]
+name = "walkdir"
+version = "2.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36df944cda56c7d8d8b7496af378e6b16de9284591917d307c9b4d313c44e698"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+dependencies = [
+ "log",
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31f8dcbc21f30d9b8f2ea926ecb58f6b91192c17e9d33594b3df58b2007ca53b"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95ce90fd5bcc06af55a641a86428ee4229e44e07033963a2290a8e241607ccb9"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f219e0d211ba40266969f6dbdd90636da12f75bee4fc9d6c23d1260dadb51454"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c21f77c0bedc37fd5dc21f897894a5ca01e7bb159884559461862ae90c0b4c5"
+dependencies = [
+ "quote 1.0.26",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
+
+[[package]]
+name = "web-sys"
+version = "0.3.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e33b99f4b23ba3eec1a53ac264e35a755f00e966e0065077d6027c0f575b0b97"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
+dependencies = [
+ "webpki",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1c4bd0a50ac6020f65184721f758dba47bb9fbc2133df715ec74a237b26794a"
+dependencies = [
+ "windows_aarch64_msvc 0.39.0",
+ "windows_i686_gnu 0.39.0",
+ "windows_i686_msvc 0.39.0",
+ "windows_x86_64_gnu 0.39.0",
+ "windows_x86_64_msvc 0.39.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.0",
+ "windows_aarch64_msvc 0.48.0",
+ "windows_i686_gnu 0.48.0",
+ "windows_i686_msvc 0.48.0",
+ "windows_x86_64_gnu 0.48.0",
+ "windows_x86_64_gnullvm 0.48.0",
+ "windows_x86_64_msvc 0.48.0",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7711666096bd4096ffa835238905bb33fb87267910e154b18b44eaabb340f2"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763fc57100a5f7042e3057e7e8d9bdd7860d330070251a73d003563a3bb49e1b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bc7cbfe58828921e10a9f446fcaaf649204dcfe6c1ddd712c5eebae6bda1106"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6868c165637d653ae1e8dc4d82c25d4f97dd6605eaa8d784b5c6e0ab2a252b65"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4d40883ae9cae962787ca76ba76390ffa29214667a111db9e0a1ad8377e809"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+
+[[package]]
+name = "winnow"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61de7bac303dc551fe038e2b3cef0f571087a47571ea6e79a87692ac99b99699"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "xattr"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "xdg"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "688597db5a750e9cad4511cb94729a078e274308099a0382b5b8203bbc767fee"
+dependencies = [
+ "home",
+]
+
+[[package]]
+name = "xdg-home"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2769203cd13a0c6015d515be729c526d041e9cf2c0cc478d57faee85f40c6dcd"
+dependencies = [
+ "nix",
+ "winapi",
+]
+
+[[package]]
+name = "xml5ever"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4034e1d05af98b51ad7214527730626f019682d797ba38b51689212118d8e650"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+]
+
+[[package]]
+name = "yansi"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
+
+[[package]]
+name = "zbus"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29242fa5ec5693629ae74d6eb1f69622a9511f600986d6d9779bccf36ac316e3"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-fs",
+ "async-io",
+ "async-lock",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "byteorder",
+ "derivative",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hex 0.4.3",
+ "nix",
+ "once_cell",
+ "ordered-stream",
+ "rand 0.8.5",
+ "serde",
+ "serde_repr",
+ "sha1",
+ "static_assertions",
+ "tracing",
+ "uds_windows",
+ "winapi",
+ "xdg-home",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "537793e26e9af85f774801dc52c6f6292352b2b517c5cf0449ffd3735732a53a"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "regex",
+ "syn 1.0.109",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f34f314916bd89bdb9934154627fab152f4f28acdda03e7c4c68181b214fe7e3"
+dependencies = [
+ "serde",
+ "static_assertions",
+ "zvariant",
+]
+
+[[package]]
+name = "zvariant"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46fe4914a985446d6fd287019b5fceccce38303d71407d9e6e711d44954a05d8"
+dependencies = [
+ "byteorder",
+ "enumflags2",
+ "libc",
+ "serde",
+ "static_assertions",
+ "zvariant_derive",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34c20260af4b28b3275d6676c7e2a6be0d4332e8e0aba4616d34007fd84e462a"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b22993dbc4d128a17a3b6c92f1c63872dd67198537ee728d8b5d7c40640a8b"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index ee36ab574426..af455e7ef61f 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -1,32 +1,54 @@
-{ rustPlatform, lib, fetchFromGitHub, xz, pkg-config, openssl, dbus, glib, udev, cairo, pango, atk, gdk-pixbuf, gtk3, wrapGAppsHook }:
-rustPlatform.buildRustPackage rec {
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, cargo
+, pkg-config
+, rustc
+, openssl
+, udev
+, gtk3
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
   pname = "firmware-manager";
-  version = "0.1.2";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-aKatdjHa/k7j48upkR1O6PFxCUfJYE3KhhzZ9Ohe0Jc=";
+    hash = "sha256-Q+LJJ4xK583fAcwuOFykt6GKT0rVJgmTt+zUX4o4Tm4=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-
-  buildInputs = [ xz openssl dbus glib udev cairo pango atk gdk-pixbuf gtk3 ];
-
-  depsExtraArgs.postPatch = "make prefix='$(out)' toml-gen";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "ecflash-0.1.0" = "sha256-W613wbW54R65/rs6oiPAH/qov2OVEjMMszpUJdX4TxI=";
+      "system76-firmware-1.0.51" = "sha256-+GPz7uKygGnFUptQEGYWkEdHgxBc65kLZqpwZqtwets=";
+    };
+  };
 
   postPatch = ''
-    sed -i 's|etc|$(prefix)/etc|' Makefile
+    substituteInPlace Makefile --replace '$(DESTDIR)/etc' '$(DESTDIR)$(prefix)/etc'
   '';
 
-  buildPhase = "make prefix='$(out)'";
-
-  installPhase = "make prefix='$(out)' install";
-
-  cargoSha256 = "sha256-BUo77ERHvuc8IkDdU3Z/gZZicNHT26IbAgEBnVM3O4U=";
-
-  doCheck = false;
+  nativeBuildInputs = [
+    cargo
+    rustc
+    pkg-config
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    openssl
+    gtk3
+    udev
+  ];
+
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = {
     description = "Graphical frontend for firmware management";
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index fb9d3a9a36c4..54b370415bc0 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -1,19 +1,21 @@
 { lib
-, flutter
+, flutter37
 , fetchFromGitHub
 }:
 
-flutter.mkFlutterApp {
+flutter37.buildFlutterApplication {
   pname = "firmware-updater";
-  version = "unstable";
+  version = "unstable-2023-04-30";
 
-  vendorHash = "sha256-3wVA9BLCnMijC0gOmskz+Hv7NQIGu/jhBDbWjmoq1Tc=";
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-cdMO+tr6kYiN5xKXa+uTMAcFf2C75F3wVPrn21G4QPQ=";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "firmware-updater";
-    rev = "a51817a2551e29895352618a91df9cf93d944af1";
-    sha256 = "6uhks6a9JcyIC5o0VssqfBlE4pqKiQ7d3KOb6feNTvU=";
+    rev = "6e7dbdb64e344633ea62874b54ff3990bd3b8440";
+    sha256 = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
     fetchSubmodules = true;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
new file mode 100644
index 000000000000..a4ab4fa8652f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
@@ -0,0 +1,1498 @@
+[
+  {
+    "name": "firmware_updater",
+    "version": "0.0.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "collection",
+      "dbus",
+      "dio",
+      "file",
+      "flutter",
+      "flutter_html",
+      "flutter_localizations",
+      "freezed_annotation",
+      "fwupd",
+      "gtk",
+      "handy_window",
+      "meta",
+      "path",
+      "provider",
+      "safe_change_notifier",
+      "ubuntu_logger",
+      "ubuntu_service",
+      "ubuntu_session",
+      "upower",
+      "yaru",
+      "yaru_colors",
+      "yaru_icons",
+      "yaru_widgets",
+      "build_runner",
+      "flutter_lints",
+      "flutter_test",
+      "freezed",
+      "integration_test",
+      "melos",
+      "mockito"
+    ]
+  },
+  {
+    "name": "mockito",
+    "version": "5.4.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "build",
+      "code_builder",
+      "collection",
+      "dart_style",
+      "matcher",
+      "meta",
+      "path",
+      "source_gen",
+      "test_api"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.4.16",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph",
+      "matcher"
+    ]
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.13",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "meta",
+    "version": "1.8.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.9.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "collection",
+    "version": "1.17.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "source_gen",
+    "version": "1.2.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "dart_style",
+      "glob",
+      "path",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "6.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "dart_style",
+    "version": "2.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "path",
+      "pub_semver",
+      "source_span"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.11.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "59.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "build",
+    "version": "2.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "convert",
+      "crypto",
+      "glob",
+      "logging",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "code_builder",
+    "version": "4.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "collection",
+      "matcher",
+      "meta"
+    ]
+  },
+  {
+    "name": "built_value",
+    "version": "8.4.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "built_collection",
+    "version": "5.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "melos",
+    "version": "3.0.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "ansi_styles",
+      "args",
+      "cli_launcher",
+      "cli_util",
+      "collection",
+      "conventional_commit",
+      "file",
+      "glob",
+      "graphs",
+      "http",
+      "meta",
+      "mustache_template",
+      "path",
+      "platform",
+      "pool",
+      "prompts",
+      "pub_semver",
+      "pub_updater",
+      "pubspec",
+      "string_scanner",
+      "yaml",
+      "yaml_edit"
+    ]
+  },
+  {
+    "name": "yaml_edit",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec",
+    "version": "2.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "pub_semver",
+      "yaml",
+      "uri"
+    ]
+  },
+  {
+    "name": "uri",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "quiver"
+    ]
+  },
+  {
+    "name": "quiver",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher"
+    ]
+  },
+  {
+    "name": "pub_updater",
+    "version": "0.2.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "http",
+      "json_annotation",
+      "process"
+    ]
+  },
+  {
+    "name": "process",
+    "version": "4.2.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "platform",
+    "version": "3.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.8.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "0.13.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "prompts",
+    "version": "2.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "charcode",
+      "io"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "charcode",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "mustache_template",
+    "version": "2.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "graphs",
+    "version": "2.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "conventional_commit",
+    "version": "0.6.0+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "cli_util",
+    "version": "0.3.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "cli_launcher",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "yaml"
+    ]
+  },
+  {
+    "name": "ansi_styles",
+    "version": "0.3.2+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "integration_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "flutter_driver",
+      "flutter_test",
+      "path",
+      "vm_service",
+      "archive",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "crypto",
+      "fake_async",
+      "file",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "typed_data",
+      "vector_math",
+      "webdriver"
+    ]
+  },
+  {
+    "name": "webdriver",
+    "version": "3.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "archive",
+      "matcher",
+      "path",
+      "stack_trace",
+      "sync_http"
+    ]
+  },
+  {
+    "name": "sync_http",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "archive",
+    "version": "3.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "crypto",
+      "path"
+    ]
+  },
+  {
+    "name": "vector_math",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "material_color_utilities",
+    "version": "0.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "js",
+    "version": "0.6.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "fake_async",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "clock",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "characters",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "vm_service",
+    "version": "9.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "test_api",
+      "path",
+      "fake_async",
+      "clock",
+      "stack_trace",
+      "vector_math",
+      "async",
+      "boolean_selector",
+      "characters",
+      "collection",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "flutter",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "characters",
+      "collection",
+      "js",
+      "material_color_utilities",
+      "meta",
+      "vector_math",
+      "sky_engine"
+    ]
+  },
+  {
+    "name": "sky_engine",
+    "version": "0.0.99",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_driver",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "file",
+      "flutter",
+      "flutter_test",
+      "fuchsia_remote_debug_protocol",
+      "path",
+      "meta",
+      "vm_service",
+      "webdriver",
+      "archive",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "crypto",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "platform",
+      "process",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "typed_data",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "fuchsia_remote_debug_protocol",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "process",
+      "vm_service",
+      "file",
+      "meta",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "freezed",
+    "version": "2.3.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "build",
+      "build_config",
+      "collection",
+      "meta",
+      "source_gen",
+      "freezed_annotation",
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "freezed_annotation",
+    "version": "2.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "json_annotation",
+      "meta"
+    ]
+  },
+  {
+    "name": "build_config",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "json_annotation",
+      "path",
+      "pubspec_parse",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "flutter_lints",
+    "version": "2.0.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "build_runner",
+    "version": "2.3.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "async",
+      "analyzer",
+      "build",
+      "build_config",
+      "build_daemon",
+      "build_resolvers",
+      "build_runner_core",
+      "code_builder",
+      "collection",
+      "crypto",
+      "dart_style",
+      "frontend_server_client",
+      "glob",
+      "graphs",
+      "http_multi_server",
+      "io",
+      "js",
+      "logging",
+      "meta",
+      "mime",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "pubspec_parse",
+      "shelf",
+      "shelf_web_socket",
+      "stack_trace",
+      "stream_transform",
+      "timing",
+      "watcher",
+      "web_socket_channel",
+      "yaml"
+    ]
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "timing",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "stream_transform",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "build_runner_core",
+    "version": "7.2.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "build",
+      "build_config",
+      "build_resolvers",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "graphs",
+      "json_annotation",
+      "logging",
+      "meta",
+      "path",
+      "package_config",
+      "pool",
+      "timing",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_resolvers",
+    "version": "2.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "collection",
+      "crypto",
+      "graphs",
+      "logging",
+      "path",
+      "package_config",
+      "pool",
+      "pub_semver",
+      "stream_transform",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_daemon",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "http_multi_server",
+      "logging",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_web_socket",
+      "stream_transform",
+      "watcher",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "yaru_widgets",
+    "version": "2.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "yaru",
+      "yaru_colors",
+      "yaru_icons",
+      "yaru_window"
+    ]
+  },
+  {
+    "name": "yaru_window",
+    "version": "0.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "yaru_window_linux",
+      "yaru_window_manager",
+      "yaru_window_platform_interface",
+      "yaru_window_web"
+    ]
+  },
+  {
+    "name": "yaru_window_web",
+    "version": "0.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "yaru_window_platform_interface"
+    ]
+  },
+  {
+    "name": "yaru_window_platform_interface",
+    "version": "0.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "plugin_platform_interface",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "flutter_web_plugins",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "js",
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "yaru_window_manager",
+    "version": "0.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "window_manager",
+      "yaru_window_platform_interface"
+    ]
+  },
+  {
+    "name": "window_manager",
+    "version": "0.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "path",
+      "screen_retriever"
+    ]
+  },
+  {
+    "name": "screen_retriever",
+    "version": "0.1.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru_window_linux",
+    "version": "0.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "yaru_icons",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru_colors",
+    "version": "0.1.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "meta",
+      "yaru_color_generator"
+    ]
+  },
+  {
+    "name": "yaru_color_generator",
+    "version": "0.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "yaru",
+    "version": "0.6.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "gtk",
+      "platform",
+      "yaru_colors"
+    ]
+  },
+  {
+    "name": "gtk",
+    "version": "2.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "ffi",
+      "flutter",
+      "meta"
+    ]
+  },
+  {
+    "name": "ffi",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "upower",
+    "version": "0.7.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "dbus"
+    ]
+  },
+  {
+    "name": "dbus",
+    "version": "0.7.8",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "ffi",
+      "meta",
+      "xml"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "6.2.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "petitparser",
+    "version": "5.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "ubuntu_session",
+    "version": "0.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "dbus",
+      "meta"
+    ]
+  },
+  {
+    "name": "ubuntu_service",
+    "version": "0.2.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "get_it",
+      "meta"
+    ]
+  },
+  {
+    "name": "get_it",
+    "version": "7.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection"
+    ]
+  },
+  {
+    "name": "ubuntu_logger",
+    "version": "0.0.1",
+    "kind": "direct",
+    "source": "git",
+    "dependencies": [
+      "collection",
+      "logging",
+      "logging_appenders",
+      "path"
+    ]
+  },
+  {
+    "name": "logging_appenders",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "logging",
+      "dio",
+      "intl",
+      "clock"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.17.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "path"
+    ]
+  },
+  {
+    "name": "dio",
+    "version": "4.0.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http_parser",
+      "path"
+    ]
+  },
+  {
+    "name": "safe_change_notifier",
+    "version": "0.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "provider",
+    "version": "6.0.5",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "nested"
+    ]
+  },
+  {
+    "name": "nested",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "handy_window",
+    "version": "0.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "fwupd",
+    "version": "0.2.2",
+    "kind": "direct",
+    "source": "git",
+    "dependencies": [
+      "collection",
+      "dbus",
+      "meta"
+    ]
+  },
+  {
+    "name": "flutter_localizations",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "intl",
+      "characters",
+      "clock",
+      "collection",
+      "js",
+      "material_color_utilities",
+      "meta",
+      "path",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "flutter_html",
+    "version": "3.0.0-alpha.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "html",
+      "csslib",
+      "collection",
+      "numerus",
+      "flutter"
+    ]
+  },
+  {
+    "name": "numerus",
+    "version": "2.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "characters"
+    ]
+  },
+  {
+    "name": "csslib",
+    "version": "0.17.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  }
+]
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
new file mode 100644
index 000000000000..641ab9fd9778
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
@@ -0,0 +1,992 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  _fe_analyzer_shared:
+    dependency: transitive
+    description:
+      name: _fe_analyzer_shared
+      sha256: "8880b4cfe7b5b17d57c052a5a3a8cc1d4f546261c7cc8fbd717bd53f48db0568"
+      url: "https://pub.dev"
+    source: hosted
+    version: "59.0.0"
+  analyzer:
+    dependency: transitive
+    description:
+      name: analyzer
+      sha256: a89627f49b0e70e068130a36571409726b04dab12da7e5625941d2c8ec278b96
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.11.1"
+  ansi_styles:
+    dependency: transitive
+    description:
+      name: ansi_styles
+      sha256: "9c656cc12b3c27b17dd982b2cc5c0cfdfbdabd7bc8f3ae5e8542d9867b47ce8a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.2+1"
+  archive:
+    dependency: transitive
+    description:
+      name: archive
+      sha256: "80e5141fafcb3361653ce308776cfd7d45e6e9fbb429e14eec571382c0c5fecb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.3.2"
+  args:
+    dependency: transitive
+    description:
+      name: args
+      sha256: "4cab82a83ffef80b262ddedf47a0a8e56ee6fbf7fe21e6e768b02792034dd440"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
+  async:
+    dependency: transitive
+    description:
+      name: async
+      sha256: bfe67ef28df125b7dddcea62755991f807aa39a2492a23e1550161692950bbe0
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.10.0"
+  boolean_selector:
+    dependency: transitive
+    description:
+      name: boolean_selector
+      sha256: "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  build:
+    dependency: transitive
+    description:
+      name: build
+      sha256: "3fbda25365741f8251b39f3917fb3c8e286a96fd068a5a242e11c2012d495777"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.1"
+  build_config:
+    dependency: transitive
+    description:
+      name: build_config
+      sha256: bf80fcfb46a29945b423bd9aad884590fb1dc69b330a4d4700cac476af1708d1
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  build_daemon:
+    dependency: transitive
+    description:
+      name: build_daemon
+      sha256: "757153e5d9cd88253cb13f28c2fb55a537dc31fefd98137549895b5beb7c6169"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  build_resolvers:
+    dependency: transitive
+    description:
+      name: build_resolvers
+      sha256: db49b8609ef8c81cca2b310618c3017c00f03a92af44c04d310b907b2d692d95
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.0"
+  build_runner:
+    dependency: "direct dev"
+    description:
+      name: build_runner
+      sha256: b0a8a7b8a76c493e85f1b84bffa0588859a06197863dba8c9036b15581fd9727
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.3"
+  build_runner_core:
+    dependency: transitive
+    description:
+      name: build_runner_core
+      sha256: "14febe0f5bac5ae474117a36099b4de6f1dbc52df6c5e55534b3da9591bf4292"
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.2.7"
+  built_collection:
+    dependency: transitive
+    description:
+      name: built_collection
+      sha256: "376e3dd27b51ea877c28d525560790aee2e6fbb5f20e2f85d5081027d94e2100"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.1.1"
+  built_value:
+    dependency: transitive
+    description:
+      name: built_value
+      sha256: "31b7c748fd4b9adf8d25d72a4c4a59ef119f12876cf414f94f8af5131d5fa2b0"
+      url: "https://pub.dev"
+    source: hosted
+    version: "8.4.4"
+  characters:
+    dependency: transitive
+    description:
+      name: characters
+      sha256: e6a326c8af69605aec75ed6c187d06b349707a27fbff8222ca9cc2cff167975c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  charcode:
+    dependency: transitive
+    description:
+      name: charcode
+      sha256: fb98c0f6d12c920a02ee2d998da788bca066ca5f148492b7085ee23372b12306
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  checked_yaml:
+    dependency: transitive
+    description:
+      name: checked_yaml
+      sha256: "3d1505d91afa809d177efd4eed5bb0eb65805097a1463abdd2add076effae311"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.2"
+  cli_launcher:
+    dependency: transitive
+    description:
+      name: cli_launcher
+      sha256: "5e7e0282b79e8642edd6510ee468ae2976d847a0a29b3916e85f5fa1bfe24005"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  cli_util:
+    dependency: transitive
+    description:
+      name: cli_util
+      sha256: "66f86e916d285c1a93d3b79587d94bd71984a66aac4ff74e524cfa7877f1395c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.5"
+  clock:
+    dependency: transitive
+    description:
+      name: clock
+      sha256: cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  code_builder:
+    dependency: transitive
+    description:
+      name: code_builder
+      sha256: "0d43dd1288fd145de1ecc9a3948ad4a6d5a82f0a14c4fdd0892260787d975cbe"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.4.0"
+  collection:
+    dependency: "direct main"
+    description:
+      name: collection
+      sha256: cfc915e6923fe5ce6e153b0723c753045de46de1b4d63771530504004a45fae0
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.17.0"
+  conventional_commit:
+    dependency: transitive
+    description:
+      name: conventional_commit
+      sha256: dec15ad1118f029c618651a4359eb9135d8b88f761aa24e4016d061cd45948f2
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.0+1"
+  convert:
+    dependency: transitive
+    description:
+      name: convert
+      sha256: "0f08b14755d163f6e2134cb58222dd25ea2a2ee8a195e53983d57c075324d592"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  crypto:
+    dependency: transitive
+    description:
+      name: crypto
+      sha256: aa274aa7774f8964e4f4f38cc994db7b6158dd36e9187aaceaddc994b35c6c67
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  csslib:
+    dependency: transitive
+    description:
+      name: csslib
+      sha256: b36c7f7e24c0bdf1bf9a3da461c837d1de64b9f8beb190c9011d8c72a3dfd745
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.17.2"
+  dart_style:
+    dependency: transitive
+    description:
+      name: dart_style
+      sha256: "6d691edde054969f0e0f26abb1b30834b5138b963793e56f69d3a9a4435e6352"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.0"
+  dbus:
+    dependency: "direct main"
+    description:
+      name: dbus
+      sha256: "6f07cba3f7b3448d42d015bfd3d53fe12e5b36da2423f23838efc1d5fb31a263"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.8"
+  dio:
+    dependency: "direct main"
+    description:
+      name: dio
+      sha256: "7d328c4d898a61efc3cd93655a0955858e29a0aa647f0f9e02d59b3bb275e2e8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.6"
+  fake_async:
+    dependency: transitive
+    description:
+      name: fake_async
+      sha256: "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  ffi:
+    dependency: transitive
+    description:
+      name: ffi
+      sha256: a38574032c5f1dd06c4aee541789906c12ccaab8ba01446e800d9c5b79c4a978
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.1"
+  file:
+    dependency: "direct main"
+    description:
+      name: file
+      sha256: "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.1.4"
+  fixnum:
+    dependency: transitive
+    description:
+      name: fixnum
+      sha256: "25517a4deb0c03aa0f32fd12db525856438902d9c16536311e76cdc57b31d7d1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_driver:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_html:
+    dependency: "direct main"
+    description:
+      name: flutter_html
+      sha256: "342c7908f0a67bcec62b6e0f7cf23e23bafe7f64693665dd35be98d5e783bdfd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.0-alpha.6"
+  flutter_lints:
+    dependency: "direct dev"
+    description:
+      name: flutter_lints
+      sha256: aeb0b80a8b3709709c9cc496cdc027c5b3216796bc0af0ce1007eaf24464fd4c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.1"
+  flutter_localizations:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_web_plugins:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  freezed:
+    dependency: "direct dev"
+    description:
+      name: freezed
+      sha256: e819441678f1679b719008ff2ff0ef045d66eed9f9ec81166ca0d9b02a187454
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.2"
+  freezed_annotation:
+    dependency: "direct main"
+    description:
+      name: freezed_annotation
+      sha256: aeac15850ef1b38ee368d4c53ba9a847e900bb2c53a4db3f6881cbb3cb684338
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.0"
+  frontend_server_client:
+    dependency: transitive
+    description:
+      name: frontend_server_client
+      sha256: "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.0"
+  fuchsia_remote_debug_protocol:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  fwupd:
+    dependency: "direct main"
+    description:
+      path: "."
+      ref: refresh-property-cache
+      resolved-ref: "22f96d558fb3b72b682758a7b55f39002cd217c2"
+      url: "https://github.com/d-loose/fwupd.dart"
+    source: git
+    version: "0.2.2"
+  get_it:
+    dependency: transitive
+    description:
+      name: get_it
+      sha256: f9982979e3d2f286a957c04d2c3a98f55b0f0a06ffd6c5c4abbb96f06937f463
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.3.0"
+  glob:
+    dependency: transitive
+    description:
+      name: glob
+      sha256: "4515b5b6ddb505ebdd242a5f2cc5d22d3d6a80013789debfbda7777f47ea308c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  graphs:
+    dependency: transitive
+    description:
+      name: graphs
+      sha256: f9e130f3259f52d26f0cfc0e964513796dafed572fa52e45d2f8d6ca14db39b2
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.0"
+  gtk:
+    dependency: "direct main"
+    description:
+      name: gtk
+      sha256: "517560d6ec625c114cbdcde9223e5ee6418d30860377347ee1b0513399e7a3f5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  handy_window:
+    dependency: "direct main"
+    description:
+      name: handy_window
+      sha256: "458a9f7d4ae23816e8f33c76596f943a04e7eff13d864e0867f3b40f1647d63d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  html:
+    dependency: transitive
+    description:
+      name: html
+      sha256: "79d498e6d6761925a34ee5ea8fa6dfef38607781d2fa91e37523474282af55cb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.15.2"
+  http:
+    dependency: transitive
+    description:
+      name: http
+      sha256: "6aa2946395183537c8b880962d935877325d6a09a2867c3970c05c0fed6ac482"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.13.5"
+  http_multi_server:
+    dependency: transitive
+    description:
+      name: http_multi_server
+      sha256: "97486f20f9c2f7be8f514851703d0119c3596d14ea63227af6f7a481ef2b2f8b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  http_parser:
+    dependency: transitive
+    description:
+      name: http_parser
+      sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.2"
+  integration_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  intl:
+    dependency: transitive
+    description:
+      name: intl
+      sha256: "910f85bce16fb5c6f614e117efa303e85a1731bb0081edf3604a2ae6e9a3cc91"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.17.0"
+  io:
+    dependency: transitive
+    description:
+      name: io
+      sha256: "2ec25704aba361659e10e3e5f5d672068d332fc8ac516421d483a11e5cbd061e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  js:
+    dependency: transitive
+    description:
+      name: js
+      sha256: "5528c2f391ededb7775ec1daa69e65a2d61276f7552de2b5f7b8d34ee9fd4ab7"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.5"
+  json_annotation:
+    dependency: transitive
+    description:
+      name: json_annotation
+      sha256: c33da08e136c3df0190bd5bbe51ae1df4a7d96e7954d1d7249fea2968a72d317
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.8.0"
+  lints:
+    dependency: transitive
+    description:
+      name: lints
+      sha256: "5e4a9cd06d447758280a8ac2405101e0e2094d2a1dbdd3756aec3fe7775ba593"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.1"
+  logging:
+    dependency: transitive
+    description:
+      name: logging
+      sha256: "04094f2eb032cbb06c6f6e8d3607edcfcb0455e2bb6cbc010cb01171dcb64e6d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  logging_appenders:
+    dependency: transitive
+    description:
+      name: logging_appenders
+      sha256: c2ea00fb779a81e995943f1e3e6e6969d463de3882d134d78ad58e76f2b6f1b1
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
+  matcher:
+    dependency: transitive
+    description:
+      name: matcher
+      sha256: "16db949ceee371e9b99d22f88fa3a73c4e59fd0afed0bd25fc336eb76c198b72"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.12.13"
+  material_color_utilities:
+    dependency: transitive
+    description:
+      name: material_color_utilities
+      sha256: d92141dc6fe1dad30722f9aa826c7fbc896d021d792f80678280601aff8cf724
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.0"
+  melos:
+    dependency: "direct dev"
+    description:
+      name: melos
+      sha256: "993ac467e7a36bd832a6cdabbe18a0487c30bc52b5cca14e476a824679ebdce0"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.1"
+  meta:
+    dependency: "direct main"
+    description:
+      name: meta
+      sha256: "6c268b42ed578a53088d834796959e4a1814b5e9e164f147f580a386e5decf42"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.0"
+  mime:
+    dependency: transitive
+    description:
+      name: mime
+      sha256: e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  mockito:
+    dependency: "direct dev"
+    description:
+      name: mockito
+      sha256: dd61809f04da1838a680926de50a9e87385c1de91c6579629c3d1723946e8059
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.4.0"
+  mustache_template:
+    dependency: transitive
+    description:
+      name: mustache_template
+      sha256: a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  nested:
+    dependency: transitive
+    description:
+      name: nested
+      sha256: "03bac4c528c64c95c722ec99280375a6f2fc708eec17c7b3f07253b626cd2a20"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  numerus:
+    dependency: transitive
+    description:
+      name: numerus
+      sha256: "436759d84f233b40107d0cc31cfa92d24e0960afeb2e506be70926d4cddffd9e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  package_config:
+    dependency: transitive
+    description:
+      name: package_config
+      sha256: "1c5b77ccc91e4823a5af61ee74e6b972db1ef98c2ff5a18d3161c982a55448bd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  path:
+    dependency: "direct main"
+    description:
+      name: path
+      sha256: db9d4f58c908a4ba5953fcee2ae317c94889433e5024c27ce74a37f94267945b
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.2"
+  petitparser:
+    dependency: transitive
+    description:
+      name: petitparser
+      sha256: "49392a45ced973e8d94a85fdb21293fbb40ba805fc49f2965101ae748a3683b4"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.1.0"
+  platform:
+    dependency: transitive
+    description:
+      name: platform
+      sha256: "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.0"
+  plugin_platform_interface:
+    dependency: transitive
+    description:
+      name: plugin_platform_interface
+      sha256: "6a2128648c854906c53fa8e33986fc0247a1116122f9534dd20e3ab9e16a32bc"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  pool:
+    dependency: transitive
+    description:
+      name: pool
+      sha256: "20fe868b6314b322ea036ba325e6fc0711a22948856475e2c2b6306e8ab39c2a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.1"
+  process:
+    dependency: transitive
+    description:
+      name: process
+      sha256: "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.4"
+  prompts:
+    dependency: transitive
+    description:
+      name: prompts
+      sha256: "3773b845e85a849f01e793c4fc18a45d52d7783b4cb6c0569fad19f9d0a774a1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  provider:
+    dependency: "direct main"
+    description:
+      name: provider
+      sha256: cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.0.5"
+  pub_semver:
+    dependency: transitive
+    description:
+      name: pub_semver
+      sha256: "307de764d305289ff24ad257ad5c5793ce56d04947599ad68b3baa124105fc17"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.3"
+  pub_updater:
+    dependency: transitive
+    description:
+      name: pub_updater
+      sha256: "42890302ab2672adf567dc2b20e55b4ecc29d7e19c63b6b98143ab68dd717d3a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.4"
+  pubspec:
+    dependency: transitive
+    description:
+      name: pubspec
+      sha256: f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.0"
+  pubspec_parse:
+    dependency: transitive
+    description:
+      name: pubspec_parse
+      sha256: ec85d7d55339d85f44ec2b682a82fea340071e8978257e5a43e69f79e98ef50c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.2"
+  quiver:
+    dependency: transitive
+    description:
+      name: quiver
+      sha256: b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  safe_change_notifier:
+    dependency: "direct main"
+    description:
+      name: safe_change_notifier
+      sha256: e69034655ea33aa7dce3c5bb33cf12fc7c07a0ce7d59b7291fd030b70d059570
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.0"
+  screen_retriever:
+    dependency: transitive
+    description:
+      name: screen_retriever
+      sha256: "4931f226ca158123ccd765325e9fbf360bfed0af9b460a10f960f9bb13d58323"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.6"
+  shelf:
+    dependency: transitive
+    description:
+      name: shelf
+      sha256: c24a96135a2ccd62c64b69315a14adc5c3419df63b4d7c05832a346fdb73682c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.0"
+  shelf_web_socket:
+    dependency: transitive
+    description:
+      name: shelf_web_socket
+      sha256: a988c0e8d8ffbdb8a28aa7ec8e449c260f3deb808781fe1284d22c5bba7156e8
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.3"
+  sky_engine:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.99"
+  source_gen:
+    dependency: transitive
+    description:
+      name: source_gen
+      sha256: c2bea18c95cfa0276a366270afaa2850b09b4a76db95d546f3d003dcc7011298
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.7"
+  source_span:
+    dependency: transitive
+    description:
+      name: source_span
+      sha256: dd904f795d4b4f3b870833847c461801f6750a9fa8e61ea5ac53f9422b31f250
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.9.1"
+  stack_trace:
+    dependency: transitive
+    description:
+      name: stack_trace
+      sha256: c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.11.0"
+  stream_channel:
+    dependency: transitive
+    description:
+      name: stream_channel
+      sha256: "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  stream_transform:
+    dependency: transitive
+    description:
+      name: stream_transform
+      sha256: "14a00e794c7c11aa145a170587321aedce29769c08d7f58b1d141da75e3b1c6f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  string_scanner:
+    dependency: transitive
+    description:
+      name: string_scanner
+      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  sync_http:
+    dependency: transitive
+    description:
+      name: sync_http
+      sha256: "7f0cd72eca000d2e026bcd6f990b81d0ca06022ef4e32fb257b30d3d1014a961"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  term_glyph:
+    dependency: transitive
+    description:
+      name: term_glyph
+      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  test_api:
+    dependency: transitive
+    description:
+      name: test_api
+      sha256: ad540f65f92caa91bf21dfc8ffb8c589d6e4dc0c2267818b4cc2792857706206
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.4.16"
+  timing:
+    dependency: transitive
+    description:
+      name: timing
+      sha256: "70a3b636575d4163c477e6de42f247a23b315ae20e86442bebe32d3cabf61c32"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  typed_data:
+    dependency: transitive
+    description:
+      name: typed_data
+      sha256: "26f87ade979c47a150c9eaab93ccd2bebe70a27dc0b4b29517f2904f04eb11a5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  ubuntu_logger:
+    dependency: "direct main"
+    description:
+      path: "packages/ubuntu_logger"
+      ref: HEAD
+      resolved-ref: f4ea41813779aff3b4dfb6a1b6c1382d2fb3ce81
+      url: "https://github.com/canonical/ubuntu-flutter-plugins.git"
+    source: git
+    version: "0.0.1"
+  ubuntu_service:
+    dependency: "direct main"
+    description:
+      name: ubuntu_service
+      sha256: "79b81c146c9fb1aedefa4a6f63724405de3aba0f525afe39b72c513df04a8c13"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.2"
+  ubuntu_session:
+    dependency: "direct main"
+    description:
+      name: ubuntu_session
+      sha256: ce79fdd31faf7982b061b2e4a1cdd0815baf3b6b976e9c16c72609749511f3a1
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.4"
+  upower:
+    dependency: "direct main"
+    description:
+      name: upower
+      sha256: cf042403154751180affa1d15614db7fa50234bc2373cd21c3db666c38543ebf
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.0"
+  uri:
+    dependency: transitive
+    description:
+      name: uri
+      sha256: "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  vector_math:
+    dependency: transitive
+    description:
+      name: vector_math
+      sha256: "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  vm_service:
+    dependency: transitive
+    description:
+      name: vm_service
+      sha256: e7fb6c2282f7631712b69c19d1bff82f3767eea33a2321c14fa59ad67ea391c7
+      url: "https://pub.dev"
+    source: hosted
+    version: "9.4.0"
+  watcher:
+    dependency: transitive
+    description:
+      name: watcher
+      sha256: "6a7f46926b01ce81bfc339da6a7f20afbe7733eff9846f6d6a5466aa4c6667c0"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
+  web_socket_channel:
+    dependency: transitive
+    description:
+      name: web_socket_channel
+      sha256: d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
+  webdriver:
+    dependency: transitive
+    description:
+      name: webdriver
+      sha256: ef67178f0cc7e32c1494645b11639dd1335f1d18814aa8435113a92e9ef9d841
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.1"
+  window_manager:
+    dependency: transitive
+    description:
+      name: window_manager
+      sha256: "2b2572442b2a5178642730442dc625ac088244f5827b1f0811371b1b7485eb62"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.2"
+  xml:
+    dependency: transitive
+    description:
+      name: xml
+      sha256: "979ee37d622dec6365e2efa4d906c37470995871fe9ae080d967e192d88286b5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.2.2"
+  yaml:
+    dependency: transitive
+    description:
+      name: yaml
+      sha256: "23812a9b125b48d4007117254bca50abb6c712352927eece9e155207b1db2370"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  yaml_edit:
+    dependency: transitive
+    description:
+      name: yaml_edit
+      sha256: "0b968021754d8fbd3e9c83563b538ee417d88b2cc587606da5615546b7ee033b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  yaru:
+    dependency: "direct main"
+    description:
+      name: yaru
+      sha256: "1d1fb60359a92f91cc7e6a76fd3046474b9734d2fb97b7a7189bb1e2ca66929f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.2"
+  yaru_color_generator:
+    dependency: transitive
+    description:
+      name: yaru_color_generator
+      sha256: "78b96cefc4eef763e4786f891ce336cdd55ef8edc55494c4bea2bc9d10ef9c96"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0"
+  yaru_colors:
+    dependency: "direct main"
+    description:
+      name: yaru_colors
+      sha256: "42814cafa3c4a6876962559ae9d8b9ff088a59635e649e4eae86d35905496063"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.7"
+  yaru_icons:
+    dependency: "direct main"
+    description:
+      name: yaru_icons
+      sha256: "8ddd40522c882de898a493094f2f41687f7a0faaf3434b9c854a7605a53a2477"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  yaru_widgets:
+    dependency: "direct main"
+    description:
+      name: yaru_widgets
+      sha256: "2fd284afe8c8c8104ea18b963d5db68f780ec65048be7ac0624d0dbb7176c55f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.1"
+  yaru_window:
+    dependency: transitive
+    description:
+      name: yaru_window
+      sha256: "18b3df2922a068e5480048335e2585c134e29ac77baec19b26fa32851910bf2f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.1"
+  yaru_window_linux:
+    dependency: transitive
+    description:
+      name: yaru_window_linux
+      sha256: "356903ebcb70c34f732dbb66ac8b504adb8e92289cdd89da86bed8957f43de38"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.1"
+  yaru_window_manager:
+    dependency: transitive
+    description:
+      name: yaru_window_manager
+      sha256: a5ea9db86cbca6306fdf139245fcd84f0df1fed0aead3450d34a9fe7be4d3020
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0"
+  yaru_window_platform_interface:
+    dependency: transitive
+    description:
+      name: yaru_window_platform_interface
+      sha256: "1a0256fc59cc46ad05de5840f01d548184ff900698c19dc24e6326c7911b0177"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0"
+  yaru_window_web:
+    dependency: transitive
+    description:
+      name: yaru_window_web
+      sha256: "77dacaaade6c2b5f94cf45b80f60c69876d62db02490e50dd025ce297cfc09ed"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.2"
+sdks:
+  dart: ">=2.19.0 <3.0.0"
+  flutter: ">=3.7.0"
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index c136f935e03e..cb33eb1c214c 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,5 +1,16 @@
+diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
+index b0ff5b106..13ac380d0 100644
+--- a/data/bios-settings.d/meson.build
++++ b/data/bios-settings.d/meson.build
+@@ -1,5 +1,5 @@
+ if build_standalone and host_machine.system() == 'linux'
+ install_data('README.md',
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
++  install_dir: join_paths(sysconfdir_install, 'fwupd', 'bios-settings.d')
+ )
+ endif
 diff --git a/data/meson.build b/data/meson.build
-index d8494020d..7c896fa0d 100644
+index 865b20e26..ff1c2657b 100644
 --- a/data/meson.build
 +++ b/data/meson.build
 @@ -26,7 +26,7 @@ endif
@@ -9,8 +20,8 @@ index d8494020d..7c896fa0d 100644
 -    install_dir: join_paths(sysconfdir, 'fwupd')
 +    install_dir: join_paths(sysconfdir_install, 'fwupd')
    )
-   plugin_quirks += join_paths(meson.current_source_dir(), 'power.quirk')
-   plugin_quirks += join_paths(meson.current_source_dir(), 'cfi.quirk')
+   plugin_quirks += files([
+     'power.quirk',
 diff --git a/data/pki/meson.build b/data/pki/meson.build
 index 3649fecea..c3462744b 100644
 --- a/data/pki/meson.build
@@ -46,28 +57,27 @@ index 3649fecea..c3462744b 100644
  )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 1d1698a7e..5469d00a6 100644
+index c20a1a05e..87b1fa930 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
-@@ -2,7 +2,7 @@ if build_standalone and get_option('lvfs') != 'false'
-   install_data([
-       'lvfs-testing.conf',
-     ],
--    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d')
-+    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d')
-   )
-   con3 = configuration_data()
-   if get_option('lvfs') == 'disabled'
-@@ -15,7 +15,7 @@ if build_standalone and get_option('lvfs') != 'false'
+@@ -15,14 +15,14 @@ if build_standalone and get_option('lvfs') != 'false'
      output: 'lvfs.conf',
      configuration: con3,
      install: true,
 -    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
    )
+   configure_file(
+     input: 'lvfs-testing.conf',
+     output: 'lvfs-testing.conf',
+     configuration: con3,
+     install: true,
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
++    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
+   )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -49,12 +49,12 @@ configure_file(
+@@ -54,12 +54,12 @@ configure_file(
    output: 'vendor.conf',
    configuration: con2,
    install: true,
@@ -83,10 +93,10 @@ index 1d1698a7e..5469d00a6 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index e6b717078..f8a7a7455 100644
+index d3e08af43..30011f548 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -195,6 +195,12 @@ endif
+@@ -193,6 +193,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -100,7 +110,7 @@ index e6b717078..f8a7a7455 100644
  gio = dependency('gio-2.0', version: '>= 2.45.8')
  giounix = dependency('gio-unix-2.0', version: '>= 2.45.8', required: false)
 diff --git a/meson_options.txt b/meson_options.txt
-index 06d242371..d9e517fc0 100644
+index 204690640..6fc7e8437 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -1,3 +1,4 @@
@@ -109,10 +119,10 @@ index 06d242371..d9e517fc0 100644
  option('consolekit', type : 'feature', description : 'ConsoleKit support', deprecated: {'true': 'enabled', 'false': 'disabled'})
  option('static_analysis', type : 'boolean', value : false, description : 'enable GCC static analysis support')
 diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
-index 67bd3b9d9..ad04a91b6 100644
+index 88c039f85..62a7691f3 100644
 --- a/plugins/dell-esrt/meson.build
 +++ b/plugins/dell-esrt/meson.build
-@@ -38,6 +38,6 @@ configure_file(
+@@ -27,6 +27,6 @@ configure_file(
    output: 'dell-esrt.conf',
    configuration: con2,
    install: true,
@@ -121,7 +131,7 @@ index 67bd3b9d9..ad04a91b6 100644
  )
  endif
 diff --git a/plugins/msr/meson.build b/plugins/msr/meson.build
-index 13f03ccd4..9235ebe33 100644
+index 23ec5ec82..b03826fc0 100644
 --- a/plugins/msr/meson.build
 +++ b/plugins/msr/meson.build
 @@ -10,7 +10,7 @@ install_data(['fwupd-msr.conf'],
@@ -131,27 +141,27 @@ index 13f03ccd4..9235ebe33 100644
 -  install_dir: join_paths(sysconfdir, 'fwupd')
 +  install_dir: join_paths(sysconfdir_install, 'fwupd')
  )
- shared_module('fu_plugin_msr',
-   fu_hash,
+ plugin_builtins += static_library('fu_plugin_msr',
+   sources: [
 diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index 95606e478..e5355e520 100644
+index 1e35b6ce9..33ca1447f 100644
 --- a/plugins/redfish/meson.build
 +++ b/plugins/redfish/meson.build
-@@ -43,7 +43,7 @@ shared_module('fu_plugin_redfish',
- )
+@@ -35,7 +35,7 @@ plugin_builtin_redfish = static_library('fu_plugin_redfish',
+ plugin_builtins += plugin_builtin_redfish
  
  install_data(['redfish.conf'],
 -  install_dir: join_paths(sysconfdir, 'fwupd'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd'),
+   install_mode: 'rw-r-----',
  )
  
- if get_option('tests')
 diff --git a/plugins/thunderbolt/meson.build b/plugins/thunderbolt/meson.build
-index 5f8ffbf90..9ba323e75 100644
+index 71d930e62..399fb5781 100644
 --- a/plugins/thunderbolt/meson.build
 +++ b/plugins/thunderbolt/meson.build
-@@ -32,7 +32,7 @@ fu_plugin_thunderbolt = shared_module('fu_plugin_thunderbolt',
- )
+@@ -19,7 +19,7 @@ plugin_builtin_thunderbolt = static_library('fu_plugin_thunderbolt',
+ plugin_builtins += plugin_builtin_thunderbolt
  
  install_data(['thunderbolt.conf'],
 -  install_dir: join_paths(sysconfdir, 'fwupd')
@@ -160,7 +170,7 @@ index 5f8ffbf90..9ba323e75 100644
  # we use functions from 2.52 in the tests
  if get_option('tests') and run_sanitize_unsafe_tests and umockdev.found() and gio.version().version_compare('>= 2.52')
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index ef38dc03e..78ff65e1d 100644
+index b4b038313..9c5407c3f 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
 @@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
@@ -172,7 +182,7 @@ index ef38dc03e..78ff65e1d 100644
    )
  elif host_machine.system() == 'freebsd'
    backend_srcs += 'fu-uefi-backend-freebsd.c'
-@@ -110,7 +110,7 @@ if get_option('compat_cli') and get_option('man')
+@@ -87,7 +87,7 @@ if get_option('compat_cli') and get_option('man')
  endif
  
  install_data(['uefi_capsule.conf'],
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 541bef93a8a3..6ad4928cd8d0 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -2,7 +2,6 @@
 
 { stdenv
 , lib
-, fetchurl
 , fetchFromGitHub
 , gi-docgen
 , pkg-config
@@ -15,6 +14,7 @@
 , gusb
 , sqlite
 , libarchive
+, libredirect
 , curl
 , libjcat
 , elfutils
@@ -30,6 +30,7 @@
 , protobufc
 , python3
 , wrapGAppsNoGuiHook
+, ensureNewerSourcesForZipFilesHook
 , json-glib
 , bash-completion
 , shared-mime-info
@@ -52,6 +53,7 @@
 , libmbim
 , libcbor
 , xz
+, enableFlashrom ? false
 }:
 
 let
@@ -74,24 +76,31 @@ let
   # # Currently broken on Aarch64
   # haveFlashrom = isx86;
   # Experimental
-  haveFlashrom = false;
-
-  runPythonCommand = name: buildCommandPython: runCommand name {
-    nativeBuildInputs = [ python3 ];
-      inherit buildCommandPython;
-  } ''
-    exec python3 -c "$buildCommandPython"
-  '';
+  haveFlashrom = isx86 && enableFlashrom;
+
+  runPythonCommand =
+    name:
+    buildCommandPython:
+
+    runCommand
+      name
+      {
+        nativeBuildInputs = [ python3 ];
+        inherit buildCommandPython;
+      }
+      ''
+        exec python3 -c "$buildCommandPython"
+      '';
 
   test-firmware =
     let
-      version = "unstable-2021-11-02";
+      version = "unstable-2022-04-02";
       src = fetchFromGitHub {
         name = "fwupd-test-firmware-${version}";
         owner = "fwupd";
         repo = "fwupd-test-firmware";
-        rev = "aaa2f9fd68a40684c256dd85b86093cba38ffd9d";
-        sha256 = "Slk7CNfkmvmOh3WtIBkPs3NYT96co6i8PwqcbpeVFgA=";
+        rev = "39954e434d63e20e85870dd1074818f48a0c08b7";
+        hash = "sha256-d4qG3fKyxkfN91AplRYqARFz+aRr+R37BpE450bPxi0=";
         passthru = {
           inherit src version; # For update script
           updateScript = unstableGitUpdater {
@@ -100,203 +109,208 @@ let
         };
       };
     in
-      src // {
-        meta = src.meta // {
-          # For update script
-          position =
-            let
-              pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
-            in
-            pos.file + ":" + toString pos.line;
-        };
+    src // {
+      meta = src.meta // {
+        # For update script
+        position =
+          let
+            pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
+          in
+          pos.file + ":" + toString pos.line;
       };
-
-
-  self = stdenv.mkDerivation rec {
-    pname = "fwupd";
-    version = "1.8.3";
-
-    # libfwupd goes to lib
-    # daemon, plug-ins and libfwupdplugin go to out
-    # CLI programs go to out
-    outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
-
-    src = fetchurl {
-      url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      sha256 = "sha256-ciIpd86KhmJRH/o8CIFWb2xFjsjWHSUNlGYRfWEiOOw=";
     };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fwupd";
+  version = "1.8.15";
+
+  # libfwupd goes to lib
+  # daemon, plug-ins and libfwupdplugin go to out
+  # CLI programs go to out
+  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
+
+  src = fetchFromGitHub {
+    owner = "fwupd";
+    repo = "fwupd";
+    rev = finalAttrs.version;
+    hash = "sha256-M7uCT8xJ6ym0X6iAgT3rM2ki0T6QgLJWlFU39aC64o4=";
+  };
 
-    patches = [
-      # Since /etc is the domain of NixOS, not Nix,
-      # we cannot install files there.
-      # Let’s install the files to $prefix/etc
-      # while still reading them from /etc.
-      # NixOS module for fwupd will take take care of copying the files appropriately.
-      ./add-option-for-installation-sysconfdir.patch
-
-      # Install plug-ins and libfwupdplugin to $out output,
-      # they are not really part of the library.
-      ./install-fwupdplugin-to-out.patch
-
-      # Installed tests are installed to different output
-      # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-      ./installed-tests-path.patch
-
-      # EFI capsule is located in fwupd-efi now.
-      ./efi-app-path.patch
-    ];
-
-    nativeBuildInputs = [
-      meson
-      ninja
-      gi-docgen
-      pkg-config
-      gobject-introspection
-      gettext
-      shared-mime-info
-      valgrind
-      gcab
-      gnutls
-      protobufc # for protoc
-      python
-      wrapGAppsNoGuiHook
-      vala
-    ];
-
-    buildInputs = [
-      polkit
-      libxmlb
-      gusb
-      sqlite
-      libarchive
-      curl
-      elfutils
-      libgudev
-      colord
-      libjcat
-      libuuid
-      json-glib
-      umockdev
-      bash-completion
-      pango
-      tpm2-tss
-      efivar
-      fwupd-efi
-      protobufc
-      modemmanager
-      libmbim
-      libcbor
-      libqmi
-      xz # for liblzma.
-    ] ++ lib.optionals haveDell [
-      libsmbios
-    ] ++ lib.optionals haveFlashrom [
-      flashrom
-    ];
-
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dplugin_dummy=true"
-      # We are building the official releases.
-      "-Dsupported_build=enabled"
-      # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
-      # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
-      "-Dsoup_session_compat=false"
-      "-Dudevdir=lib/udev"
-      "-Dsystemd_root_prefix=${placeholder "out"}"
-      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "--localstatedir=/var"
-      "--sysconfdir=/etc"
-      "-Dsysconfdir_install=${placeholder "out"}/etc"
-      "-Defi_os_dir=nixos"
-      "-Dplugin_modem_manager=enabled"
-      # Requires Meson 0.63
-      "-Dgresource_quirks=disabled"
-
-      # We do not want to place the daemon into lib (cyclic reference)
-      "--libexecdir=${placeholder "out"}/libexec"
-      # Our builder only adds $lib/lib to rpath but some things link
-      # against libfwupdplugin which is in $out/lib.
-      "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
-    ] ++ lib.optionals (!haveDell) [
-      "-Dplugin_dell=disabled"
-      "-Dplugin_synaptics_mst=disabled"
-    ] ++ lib.optionals (!haveRedfish) [
-      "-Dplugin_redfish=disabled"
-    ] ++ lib.optionals (!haveFlashrom) [
-      "-Dplugin_flashrom=disabled"
-    ] ++ lib.optionals (!haveMSR) [
-      "-Dplugin_msr=disabled"
-    ];
-
-    # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
-    dontWrapGApps = true;
-
-    # /etc/os-release not available in sandbox
-    # doCheck = true;
-
-    # Environment variables
-
-    # Fontconfig error: Cannot load default config file
-    FONTCONFIG_FILE =
-      let
-        fontsConf = makeFontsConf {
-          fontDirectories = [ freefont_ttf ];
-        };
-      in fontsConf;
-
-    # error: “PolicyKit files are missing”
-    # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-    PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
-
-    # Phase hooks
-
-    postPatch = ''
-      patchShebangs \
-        contrib/generate-version-script.py \
-        meson_post_install.sh \
-        po/test-deps
-
-      # This checks a version of a dependency of gi-docgen but gi-docgen is self-contained in Nixpkgs.
-      echo "Clearing docs/test-deps.py"
-      test -f docs/test-deps.py
-      echo > docs/test-deps.py
-
-      substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
-        --replace "gdbus" ${glib.bin}/bin/gdbus
-    '';
+  patches = [
+    # Since /etc is the domain of NixOS, not Nix,
+    # we cannot install files there.
+    # Let’s install the files to $prefix/etc
+    # while still reading them from /etc.
+    # NixOS module for fwupd will take take care of copying the files appropriately.
+    ./add-option-for-installation-sysconfdir.patch
+
+    # Install plug-ins and libfwupdplugin to $out output,
+    # they are not really part of the library.
+    ./install-fwupdplugin-to-out.patch
+
+    # Installed tests are installed to different output
+    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
+    ./installed-tests-path.patch
+
+    # EFI capsule is located in fwupd-efi now.
+    ./efi-app-path.patch
+  ];
+
+  nativeBuildInputs = [
+    # required for firmware zipping
+    ensureNewerSourcesForZipFilesHook
+    meson
+    ninja
+    gi-docgen
+    pkg-config
+    gobject-introspection
+    gettext
+    shared-mime-info
+    valgrind
+    gcab
+    gnutls
+    protobufc # for protoc
+    python
+    wrapGAppsNoGuiHook
+    vala
+  ];
+
+  buildInputs = [
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    curl
+    elfutils
+    libgudev
+    colord
+    libjcat
+    libuuid
+    json-glib
+    umockdev
+    bash-completion
+    pango
+    tpm2-tss
+    efivar
+    fwupd-efi
+    protobufc
+    modemmanager
+    libmbim
+    libcbor
+    libqmi
+    xz # for liblzma
+  ] ++ lib.optionals haveDell [
+    libsmbios
+  ] ++ lib.optionals haveFlashrom [
+    flashrom
+  ];
+
+  mesonFlags = [
+    "-Ddocs=enabled"
+    "-Dplugin_dummy=true"
+    # We are building the official releases.
+    "-Dsupported_build=enabled"
+    # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
+    # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
+    "-Dsoup_session_compat=false"
+    "-Dudevdir=lib/udev"
+    "-Dsystemd_root_prefix=${placeholder "out"}"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "-Dsysconfdir_install=${placeholder "out"}/etc"
+    "-Defi_os_dir=nixos"
+    "-Dplugin_modem_manager=enabled"
+
+    # We do not want to place the daemon into lib (cyclic reference)
+    "--libexecdir=${placeholder "out"}/libexec"
+  ] ++ lib.optionals (!haveDell) [
+    "-Dplugin_dell=disabled"
+    "-Dplugin_synaptics_mst=disabled"
+  ] ++ lib.optionals (!haveRedfish) [
+    "-Dplugin_redfish=disabled"
+  ] ++ lib.optionals (!haveFlashrom) [
+    "-Dplugin_flashrom=disabled"
+  ] ++ lib.optionals (!haveMSR) [
+    "-Dplugin_msr=disabled"
+  ];
+
+  # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
+  dontWrapGApps = true;
+
+  doCheck = true;
+
+  # Environment variables
+
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE =
+    let
+      fontsConf = makeFontsConf {
+        fontDirectories = [ freefont_ttf ];
+      };
+    in
+    fontsConf;
+
+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
+  # Phase hooks
+
+  postPatch = ''
+    patchShebangs \
+      contrib/generate-version-script.py \
+      po/test-deps
+
+    substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
+      --replace "gdbus" ${glib.bin}/bin/gdbus
+
+    # tests fail with: Failed to load SMBIOS: neither SMBIOS or DT found
+    sed -i 's/test(.*)//' plugins/lenovo-thinklmi/meson.build
+    sed -i 's/test(.*)//' plugins/mtd/meson.build
+    # fails on amd cpu
+    sed -i 's/test(.*)//' libfwupdplugin/meson.build
+    # in nixos test tries to chmod 0777 $out/share/installed-tests/fwupd/tests/redfish.conf
+    sed -i "s/get_option('tests')/false/" plugins/redfish/meson.build
+
+    # Device tests use device emulation and need to download emulation data from
+    # the internet, which does not work on our test VMs.
+    # It's probably better to disable these tests for NixOS by setting
+    # the device-tests directory to /dev/null.
+    # For more info on device emulation, see:
+    #   https://github.com/fwupd/fwupd/blob/eeeac4e9ba8a6513428b456a551bffd95d533e50/docs/device-emulation.md
+    substituteInPlace data/installed-tests/meson.build \
+      --replace "join_paths(datadir, 'fwupd', 'device-tests')" "'/dev/null'"
+  '';
 
-    preBuild = ''
-      # jcat-tool at buildtime requires a home directory
-      export HOME="$(mktemp -d)"
-    '';
+  preBuild = ''
+    # jcat-tool at buildtime requires a home directory
+    export HOME="$(mktemp -d)"
+  '';
 
-    preCheck = ''
-      addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
-    '';
+  preCheck = ''
+    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
 
-    preInstall = ''
-      # We have pkexec on PATH so Meson will try to use it when installation fails
-      # due to being unable to write to e.g. /etc.
-      # Let’s pretend we already ran pkexec –
-      # the pkexec on PATH would complain it lacks setuid bit,
-      # obscuring the underlying error.
-      # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
-      export PKEXEC_UID=-1
-    '';
+    echo "12345678901234567890123456789012" > machine-id
+    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
+    LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
 
-    postInstall = ''
-      # These files have weird licenses so they are shipped separately.
-      cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
-    '';
+  postInstall = ''
+    # These files have weird licenses so they are shipped separately.
+    cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
+  '';
 
-    preFixup = let
+  preFixup =
+    let
       binPath = [
         efibootmgr
         bubblewrap
         tpm2-tools
       ];
-    in ''
+    in
+    ''
       gappsWrapperArgs+=(
         --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
         # See programs reached with fu_common_find_program_in_path in source
@@ -304,59 +318,65 @@ let
       )
     '';
 
-    postFixup = ''
-      # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
-      find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-        | while IFS= read -r -d ''' file; do
-        if [[ "$file" != *.efi ]]; then
-          echo "Wrapping program $file"
-          wrapGApp "$file"
-        fi
-      done
-
-      # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-      moveToOutput "share/doc" "$devdoc"
-    '';
+  postFixup = ''
+    # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
+    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
+      | while IFS= read -r -d ''' file; do
+      if [[ "$file" != *.efi ]]; then
+        echo "Wrapping program $file"
+        wrapGApp "$file"
+      fi
+    done
+
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
 
-    separateDebugInfo = true;
-
-    passthru = {
-      filesInstalledToEtc = [
-        "fwupd/daemon.conf"
-        "fwupd/remotes.d/lvfs-testing.conf"
-        "fwupd/remotes.d/lvfs.conf"
-        "fwupd/remotes.d/vendor.conf"
-        "fwupd/remotes.d/vendor-directory.conf"
-        "fwupd/thunderbolt.conf"
-        "fwupd/uefi_capsule.conf"
-        "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-        "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd/LVFS-CA.pem"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd-metadata/LVFS-CA.pem"
-        "grub.d/35_fwupd"
-      ] ++ lib.optionals haveDell [
-        "fwupd/remotes.d/dell-esrt.conf"
-      ] ++ lib.optionals haveRedfish [
-        "fwupd/redfish.conf"
-      ] ++ lib.optionals haveMSR [
-        "fwupd/msr.conf"
-      ];
+  separateDebugInfo = true;
+
+  passthru = {
+    filesInstalledToEtc = [
+      "fwupd/bios-settings.d/README.md"
+      "fwupd/daemon.conf"
+      "fwupd/remotes.d/lvfs-testing.conf"
+      "fwupd/remotes.d/lvfs.conf"
+      "fwupd/remotes.d/vendor.conf"
+      "fwupd/remotes.d/vendor-directory.conf"
+      "fwupd/uefi_capsule.conf"
+      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
+      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA.pem"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA.pem"
+      "grub.d/35_fwupd"
+    ] ++ lib.optionals haveDell [
+      "fwupd/remotes.d/dell-esrt.conf"
+    ] ++ lib.optionals haveRedfish [
+      "fwupd/redfish.conf"
+    ] ++ lib.optionals haveMSR [
+      "fwupd/msr.conf"
+    ] ++ lib.optionals isx86 [
+      "fwupd/thunderbolt.conf"
+    ];
 
-      # DisabledPlugins key in fwupd/daemon.conf
-      defaultDisabledPlugins = [
-        "test"
-        "test_ble"
-        "invalid"
-      ];
+    # DisabledPlugins key in fwupd/daemon.conf
+    defaultDisabledPlugins = [
+      "test"
+      "test_ble"
+    ];
+
+    # For updating.
+    inherit test-firmware;
 
-      # For updating.
-      inherit test-firmware;
+    # For downstream consumers that need the fwupd-efi this was built with.
+    inherit fwupd-efi;
 
-      tests = let
+    tests =
+      let
         listToPy = list: "[${lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
-      in {
+      in
+      {
         installedTests = nixosTests.installed-tests.fwupd;
 
         passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
@@ -365,29 +385,27 @@ let
           import os
           import pathlib
 
-          etc = '${self}/etc'
+          etc = '${finalAttrs.finalPackage}/etc'
           package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
-          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          passthru_etc = set(${listToPy finalAttrs.passthru.filesInstalledToEtc})
           assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
           assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
 
           config = configparser.RawConfigParser()
-          config.read('${self}/etc/fwupd/daemon.conf')
+          config.read('${finalAttrs.finalPackage}/etc/fwupd/daemon.conf')
           package_disabled_plugins = config.get('fwupd', 'DisabledPlugins').rstrip(';').split(';')
-          passthru_disabled_plugins = ${listToPy passthru.defaultDisabledPlugins}
+          passthru_disabled_plugins = ${listToPy finalAttrs.passthru.defaultDisabledPlugins}
           assert package_disabled_plugins == passthru_disabled_plugins, f'Default disabled plug-ins in the package {package_disabled_plugins} do not match those listed in passthru.defaultDisabledPlugins {passthru_disabled_plugins}'
 
           pathlib.Path(os.getenv('out')).touch()
         '';
       };
-    };
-
-    meta = with lib; {
-      homepage = "https://fwupd.org/";
-      maintainers = with maintainers; [ jtojnar ];
-      license = licenses.lgpl21Plus;
-      platforms = platforms.linux;
-    };
   };
 
-in self
+  meta = with lib; {
+    homepage = "https://fwupd.org/";
+    maintainers = with maintainers; [ ];
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
index afee6d9f61ea..a91adc1a69b9 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
@@ -1,13 +1,13 @@
 diff --git a/meson.build b/meson.build
-index b91dd037..01d70a61 100644
+index 7ac8c937a..5a23d0c80 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -413,7 +413,7 @@ if build_standalone and efiboot.found() and efivar.found()
+@@ -419,7 +419,7 @@ if build_standalone and efiboot.found() and efivar.found()
      conf.set('HAVE_EFI_TIME_T', '1')
    endif
  
 -  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
-+  efi_app_location = join_paths(dependency('fwupd-efi').get_pkgconfig_variable('prefix'), 'libexec', 'fwupd', 'efi')
++  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
    conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
  
    if host_cpu == 'x86'
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
index f3369b6e1333..e6269ae840bb 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
@@ -1,37 +1,14 @@
-diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
-index 1afa28e1..3da81d30 100644
---- a/libfwupdplugin/meson.build
-+++ b/libfwupdplugin/meson.build
-@@ -220,7 +220,8 @@ fwupdplugin = library(
-   ],
-   link_args: cc.get_supported_link_arguments([vflag]),
-   link_depends: fwupdplugin_mapfile,
--  install: true
-+  install: true,
-+  install_dir: bindir / '..' / 'lib',
- )
- 
- fwupdplugin_pkgg = import('pkgconfig')
-@@ -280,7 +281,8 @@ if introspection.allowed()
-       girtargets,
-       fwupd_gir[0],
-     ],
--    install: true
-+    install: true,
-+    install_dir_typelib: bindir / '..' / 'lib' / 'girepository-1.0',
-   )
- 
-   # Verify the map file is correct -- note we can't actually use the generated
 diff --git a/meson.build b/meson.build
-index b91dd037..f97b4c26 100644
+index 9ae278b66..7cddf1a0d 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -504,7 +504,7 @@ if build_standalone
+@@ -507,7 +507,7 @@ if build_standalone
  if host_machine.system() == 'windows'
-   plugin_dir = 'fwupd-plugins-@0@'.format(libfwupdplugin_lt_current)
+   libdir_pkg = 'fwupd-@0@'.format(fwupd_version)
  else
--  plugin_dir = join_paths(libdir, 'fwupd-plugins-@0@'.format(libfwupdplugin_lt_current))
-+  plugin_dir = join_paths(bindir, '..', 'lib', 'fwupd-plugins-@0@'.format(libfwupdplugin_lt_current))
+-  libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
++  libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
  endif
- conf.set_quoted('FWUPD_PLUGINDIR', plugin_dir)
+ conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
  endif
+
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
index 49bca65d9c60..a914f56c66db 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
@@ -1,19 +1,19 @@
 diff --git a/data/installed-tests/meson.build b/data/installed-tests/meson.build
-index b8ec916f..38209b36 100644
+index be3d5c6d9..14d45dcaf 100644
 --- a/data/installed-tests/meson.build
 +++ b/data/installed-tests/meson.build
 @@ -83,5 +83,5 @@ configure_file(
-   output : 'fwupd-tests.conf',
-   configuration : con2,
+   output: 'fwupd-tests.conf',
+   configuration: con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index b91dd037..d7e20b18 100644
+index 30011f548..7ac8c937a 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -188,8 +188,8 @@ else
+@@ -186,8 +186,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -24,7 +24,7 @@ index b91dd037..d7e20b18 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -492,6 +492,7 @@ gnome = import('gnome')
+@@ -498,6 +498,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -33,10 +33,10 @@ index b91dd037..d7e20b18 100644
  conf.set_quoted('FWUPD_LIBDIR', libdir)
  conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index d00038db..be1c45b4 100644
+index 6fc7e8437..29832fd08 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -56,6 +56,7 @@ option('systemd', type : 'feature', description : 'systemd support', deprecated:
+@@ -57,6 +57,7 @@ option('systemd', type : 'feature', description : 'systemd support', deprecated:
  option('systemd_unit_user', type : 'string', description : 'User account to use for fwupd-refresh.service (empty for DynamicUser)')
  option('systemd_root_prefix', type: 'string', value: '', description: 'Directory to base systemd’s installation directories on')
  option('elogind', type : 'feature', description : 'elogind support', deprecated: {'true': 'enabled', 'false': 'disabled'})
@@ -44,16 +44,3 @@ index d00038db..be1c45b4 100644
  option('tests', type : 'boolean', value : true, description : 'enable tests')
  option('soup_session_compat', type : 'boolean', value : true, description : 'enable SoupSession runtime compatibility support')
  option('curl', type : 'feature', description : 'libcurl support', deprecated: {'true': 'enabled', 'false': 'disabled'})
-diff --git a/plugins/redfish/fu-self-test.c b/plugins/redfish/fu-self-test.c
-index 4d19e560..91cfaa61 100644
---- a/plugins/redfish/fu-self-test.c
-+++ b/plugins/redfish/fu-self-test.c
-@@ -27,7 +27,7 @@ fu_test_is_installed_test(void)
- 	const gchar *builddir = g_getenv("G_TEST_BUILDDIR");
- 	if (builddir == NULL)
- 		return FALSE;
--	return g_str_has_prefix(builddir, FWUPD_PREFIX);
-+	return g_str_has_prefix(builddir, FWUPD_INSTALLED_TEST_PREFIX);
- }
- 
- static void
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
index 716c5e4d8288..af9a44b92f46 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation rec {
 
   meta = with lib; {
     description = "Firmware for Intel 2200BG cards";
-    homepage = "http://ipw2200.sourceforge.net/firmware.php";
+    homepage = "https://ipw2200.sourceforge.net/firmware.php";
     license = licenses.unfreeRedistributableFirmware;
     maintainers = with maintainers; [ sternenseemann ];
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
new file mode 100644
index 000000000000..7e0fb379107d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoPatchelfHook
+, expat
+, zlib
+
+# Pick one of
+# - ipu6 (Tiger Lake)
+# - ipu6ep (Alder Lake)
+, ipuVersion ? "ipu6"
+}:
+
+stdenv.mkDerivation {
+  pname = "${ipuVersion}-camera-bin";
+  version = "unstable-2023-02-08";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipu6-camera-bins";
+    rev = "276859fc6de83918a32727d676985ec40f31af2b";
+    hash = "sha256-QnedM2UBbGyd2wIF762Mi+VkDZYtC6MifK4XGGxlUzw=";
+  };
+
+  sourceRoot = "source/${ipuVersion}";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    stdenv.cc.cc.lib
+    expat
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp --no-preserve=mode --recursive \
+      lib \
+      include \
+      $out/
+
+    install -m 0644 -D ../LICENSE $out/share/doc/LICENSE
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    for pcfile in $out/lib/pkgconfig/*.pc; do
+      substituteInPlace $pcfile \
+        --replace 'exec_prefix=/usr' 'exec_prefix=''${prefix}' \
+        --replace 'prefix=/usr' "prefix=$out" \
+        --replace 'libdir=/usr/lib' 'libdir=''${prefix}/lib' \
+        --replace 'includedir=/usr/include' 'includedir=''${prefix}/include'
+    done
+  '';
+
+  passthru = {
+    inherit ipuVersion;
+  };
+
+  meta = let
+    generation = {
+      ipu6 = "Tiger Lake";
+      ipu6ep = "Alder Lake";
+    }.${ipuVersion};
+  in with lib; {
+    description = "${generation} IPU firmware and proprietary image processing libraries";
+    homepage = "https://github.com/intel/ipu6-camera-bins";
+    license = licenses.issl;
+    sourceProvenance = with sourceTypes; [
+      binaryFirmware
+    ];
+    maintainers = with maintainers; [
+      hexa
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
new file mode 100644
index 000000000000..fb2f940ddce6
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "ivsc-firmware";
+  version = "unstable-2022-11-02";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ivsc-firmware";
+    rev = "29c5eff4cdaf83e90ef2dcd2035a9cdff6343430";
+    hash = "sha256-GuD1oTnDEs0HslJjXx26DkVQIe0eS+js4UoaTDa77ME=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/firmware/vsc
+    cp --no-preserve=mode --recursive ./firmware/* $out/lib/firmware/vsc/
+    install -D ./LICENSE $out/share/doc
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Firmware binaries for the Intel Vision Sensing Controller";
+    homepage = "https://github.com/intel/ivsc-firmware";
+    license = licenses.issl;
+    sourceProvenance = with sourceTypes; [
+      binaryFirmware
+    ];
+    maintainers = with maintainers; [
+      hexa
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index 20058e7bc821..a2229a0a60ce 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -1,12 +1,18 @@
-{ stdenvNoCC, fetchzip, lib }:
+let
+  source = import ./source.nix;
+in {
+  stdenvNoCC,
+  fetchzip,
+  lib,
+}:
 
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20220815";
+  version = source.version;
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
-    sha256 = "sha256-StPlnwn4KOvOf4fRblDzJQqyI8iIz8e9fo/BsTyCKjI=";
+    hash = source.sourceHash;
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -16,7 +22,7 @@ stdenvNoCC.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-VTRrOOkdWepUCKAkziO/0egb3oaQEOJCtsuDEgs/W78=";
+  outputHash = source.outputHash;
 
   meta = with lib; {
     description = "Binary firmware collection packaged by kernel.org";
@@ -27,5 +33,8 @@ stdenvNoCC.mkDerivation rec {
     priority = 6; # give precedence to kernel firmware
   };
 
-  passthru = { inherit version; };
+  passthru = {
+    inherit version;
+    updateScript = ./update.sh;
+  };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
new file mode 100644
index 000000000000..e1d77a03200f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -0,0 +1,6 @@
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "20230515";
+  sourceHash = "sha256-VcA873r9jVYqDqEcvz/PVGfCAhLXr0sMXQincWNLEIs=";
+  outputHash = "sha256-h3KDK3KiD88dvTvLlLL2XczY1ZeEVnYEzh9sqbo1dZ8=";
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
new file mode 100755
index 000000000000..1fccc03e86be
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$(readlink -f "$0")")" || exit
+
+repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
+
+# step 1: figure out the latest version from the tags
+if [ -z "$1" ]; then
+  version="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+else
+  version=$1
+fi
+
+# step 2: prefetch the source tarball
+snapshotUrl="$repo/snapshot/linux-firmware-$version.tar.gz"
+hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
+sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
+
+# step 3: rebuild as a non-FO derivation to get the right hash
+cat > source.nix << EOF
+{
+  version = "$version";
+  sourceHash = "$sriHash";
+  outputHash = null;
+}
+EOF
+
+outPath="$(nix --experimental-features "nix-command flakes" build ".#linux-firmware" --no-link --print-out-paths)"
+outHash="$(nix --experimental-features nix-command hash path "$outPath")"
+
+# step 4: generate the final file
+cat > source.nix << EOF
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "$version";
+  sourceHash = "$sriHash";
+  outputHash = "$outHash";
+}
+EOF
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 730e839bd457..126fd3dfc23c 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -2,22 +2,22 @@
 
 stdenvNoCC.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
-  version = "2021-12-06";
+  version = "unstable-2023-05-04";
 
   srcs = [
     (fetchFromGitHub {
       name = "bluez-firmware";
       owner = "RPi-Distro";
       repo = "bluez-firmware";
-      rev = "e7fd166981ab4bb9a36c2d1500205a078a35714d";
-      hash = "sha256-6xBdXwAGA1N42k1KKYrEgtsxtFAtrwhKdIrYY39Fb7Y=";
+      rev = "9556b08ace2a1735127894642cc8ea6529c04c90";
+      hash = "sha256-gKGK0XzNrws5REkKg/JP6SZx3KsJduu53SfH3Dichkc=";
     })
     (fetchFromGitHub {
       name = "firmware-nonfree";
       owner = "RPi-Distro";
       repo = "firmware-nonfree";
-      rev = "99d5c588e95ec9c9b86d7e88d3cf85b4f729d2bc";
-      hash = "sha256-xg6fYQvg7t2ikyLI8/XfpiNaNTf7CNFQlAzpTldTz10=";
+      rev = "2b465a10b04555b7f45b3acb85959c594922a3ce";
+      hash = "sha256-9UgB8f2AaxG7S5Px46jOP9wUeO1VXKB0uJiPWh32oDI=";
     })
   ];
 
@@ -37,10 +37,9 @@ stdenvNoCC.mkDerivation {
     # Bluetooth firmware
     cp -rv "$NIX_BUILD_TOP/bluez-firmware/broadcom/." "$out/lib/firmware/brcm"
 
-    # CM4 symlink must be added since it's missing from upstream
-    pushd $out/lib/firmware/brcm &>/dev/null
-    ln -s "./brcmfmac43455-sdio.txt" "$out/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module.txt"
-    popd &>/dev/null
+    # brcmfmac43455-stdio.bin is a symlink to the non-existent path: ../cypress/cyfmac43455-stdio.bin.
+    # See https://github.com/RPi-Distro/firmware-nonfree/issues/26
+    ln -s "./cyfmac43455-sdio-standard.bin" "$out/lib/firmware/cypress/cyfmac43455-sdio.bin"
 
     runHook postInstall
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
index 7143d0b55a27..72c6f6235548 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
@@ -5,16 +5,16 @@ let
 in
 stdenv.mkDerivation {
   pname = "raspberrypi-armstubs";
-  version = "2021-11-01";
+  version = "unstable-2022-07-11";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "tools";
-    rev = "13474ee775d0c5ec8a7da4fb0a9fa84187abfc87";
-    sha256 = "s/RPMIpQSznoQfchAP9gpO7I2uuTsOV0Ep4vVz7i2o4=";
+    rev = "439b6198a9b340de5998dd14a26a0d9d38a6bcac";
+    hash = "sha512-KMHgj73eXHT++IE8DbCsFeJ87ngc9R3XxMUJy4Z3s4/MtMeB9zblADHkyJqz9oyeugeJTrDtuVETPBRo7M4Y8A==";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-march=armv8-a+crc"
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index 9181a94dcb66..46f05c4029b7 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -3,13 +3,13 @@
 stdenvNoCC.mkDerivation rec {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-firmware";
-  version = "1.20220331";
+  version = "1.20230405";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    hash = "sha256-TxlpHPEJAtVJTtDghuJpx2mLjEPiKkcAr7S9Cd/cocE=";
+    hash = "sha256-UtUd1MbsrDFxd/1C3eOAMDKPZMx+kSMFYOJP+Kc6IU8=";
   };
 
   installPhase = ''
@@ -26,6 +26,8 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/raspberrypi/firmware";
     license = licenses.unfreeRedistributableFirmware; # See https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
     maintainers = with maintainers; [ dezgeg ];
-    broken = stdenvNoCC.isDarwin; # Hash mismatch on source, mystery.
+    # Hash mismatch on source, mystery.
+    # Maybe due to https://github.com/NixOS/nix/issues/847
+    broken = stdenvNoCC.isDarwin;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix
deleted file mode 100644
index 8e71770df9ce..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenvNoCC, lib, linuxPackages }:
-
-stdenvNoCC.mkDerivation {
-  pname = "rtw89-firmware";
-  inherit (linuxPackages.rtw89) version src;
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/lib/firmware/rtw89
-    cp *.bin $out/lib/firmware/rtw89
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Driver for Realtek 8852AE, an 802.11ax device";
-    homepage = "https://github.com/lwfinger/rtw89";
-    license = licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ tvorog ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index b15f4c4949de..60fa6dea9ecd 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,35 +1,34 @@
 { lib
+, fetchurl
 , stdenvNoCC
-, fetchFromGitHub
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2";
+  version = "2.2.5";
 
-  src = fetchFromGitHub {
-    owner = "thesofproject";
-    repo = "sof-bin";
-    rev = "v${version}";
-    sha256 = "sha256-/gjGTDOXJ0vz/MH2hlistS3X3Euqf8T6TLnD1A2SBYo=";
+  src = fetchurl {
+    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
+    sha256 = "sha256-V39FCHW9gzr5uLcW42jYc6rJE6Nd2ZbHqg9Srd3vku4=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
 
   installPhase = ''
     runHook preInstall
-    cd "v${lib.versions.majorMinor version}.x"
-    mkdir -p $out/lib/firmware/intel/
-    cp -a sof-v${version} $out/lib/firmware/intel/sof
-    cp -a sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    mkdir -p $out/lib/firmware/intel
+    cp -av sof-v${version} $out/lib/firmware/intel/sof
+    cp -av sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
     runHook postInstall
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/thesofproject/sof-bin/releases/tag/v${version}";
     description = "Sound Open Firmware";
     homepage = "https://www.sofproject.org/";
     license = with licenses; [ bsd3 isc ];
     maintainers = with maintainers; [ lblasc evenbrenden hmenke ];
     platforms = with platforms; linux;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock
new file mode 100644
index 000000000000..3ac385d816eb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock
@@ -0,0 +1,1551 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "anyhow"
+version = "1.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cb2f989d18dd141ab8ae82f64d1a8cdd37e0840f73a406896cf5e99502fab61"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "buildchain"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e4ba006f08f732ddc25f629c349fbb89c67e6c90a4764ce04534d32a1940b0"
+dependencies = [
+ "base32",
+ "clap",
+ "lxd",
+ "plain",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.10.6",
+ "sodalite",
+ "tempdir",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
+
+[[package]]
+name = "bytes"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+
+[[package]]
+name = "cc"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bb21987b9fb1613058ba3843121dd18b163b254d8a6e797e144cbac14d96d1b"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "dbus-crossroads"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a816e8ae3382c7b1bccfa6f2778346ee5b13f80e0eccf80cf8f2912af73995a"
+dependencies = [
+ "dbus",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+dependencies = [
+ "block-buffer 0.10.3",
+ "crypto-common",
+]
+
+[[package]]
+name = "ecflash"
+version = "0.1.0"
+source = "git+https://github.com/system76/ecflash.git?branch=stable#ee9d69d4edf3bee6b2fb6dddb021bb58ee3bbbbb"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "either"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "enum_derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "406ac2a8c9eedf8af9ee1489bee9e50029278a6456c740f7454cf8a158abc816"
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e884668cd0c7480504233e951174ddc3b382f7c2666e3b7310b5c4e7b0c37f9"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "windows-sys",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+
+[[package]]
+name = "futures-io"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+
+[[package]]
+name = "futures-task"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+
+[[package]]
+name = "futures-util"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "http"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+dependencies = [
+ "bytes",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+
+[[package]]
+name = "hyper"
+version = "0.14.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "index-fixed"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161ceaf2f41b6cd3f6502f5da085d4ad4393a51e0c70ed2fce1d5698d798fae"
+
+[[package]]
+name = "indexmap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30e22bd8629359895450b59ea7a776c850561b96a3b1d31321c1949d9e6c9146"
+
+[[package]]
+name = "itertools"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f56a2d0bc861f9165be4eb3442afd3c236d8a98afd426f65d92324ae1091a484"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fad582f4b9e86b6caa621cabeb0963332d92eea04729ab12892c2533951e6440"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2264f9d90a9b4e60a2dc722ad899ea0374f03c2e96e755fe22a8f551d4d5fb3c"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lxd"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918a314b8eb7d4e19c3d154b4069b12aa37c25a68bae4f2c2a69f50bf47c7c5a"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "mime"
+version = "0.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
+
+[[package]]
+name = "mio"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d732bc30207a6423068df043e3d02e0735b155ad7ce1a6f76fe2baa5b158de"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi 0.2.6",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "openssl"
+version = "0.10.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b102428fd03bc5edf97f62620f7298614c45cedf287c271e7ed450bbaf83f2e1"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23bbbf7854cd45b83958ebe919f0e8e516793727652e27fda10a8384cfc790b7"
+dependencies = [
+ "autocfg",
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef7d57beacfaf2d8aee5937dab7b7f28de3cb8b1828479bb5de2a7106f2bae2"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21eed90ec8570952d53b772ecf8f206aa1ec9a3d76b2521c56c42973f2d91ee9"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-tls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "winreg",
+]
+
+[[package]]
+name = "rust-lzma"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "895dc04daeaeee338bb96e229797902ed3f0675bfc59d5b42e0f0b0c13ac54da"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4b9743ed687d4b4bcedf9ff5eaa7398495ae14e61cba0a295704edbc7decde"
+
+[[package]]
+name = "schannel"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.152"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.152"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "shrinkwraprs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e63e6744142336dfb606fe2b068afa2e1cca1ee6a5d8377277a92945d81fa331"
+dependencies = [
+ "bitflags",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "socket2"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "sodalite"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41784a359d15c58bba298cccb7f30a847a1a42d0620c9bdaa0aa42fdb3c280e0"
+dependencies = [
+ "index-fixed",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "syn"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f4064b5b16e03ae50984a5a8ed5d4f8803e6bc1fd170a3cda91a1be4b18e3f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "system76-firmware"
+version = "1.0.50"
+dependencies = [
+ "anyhow",
+ "bincode",
+ "buildchain",
+ "clap",
+ "ecflash",
+ "libc",
+ "plain",
+ "rust-lzma",
+ "serde",
+ "serde_json",
+ "sha2 0.9.9",
+ "system76_ectool",
+ "tar",
+ "tempdir",
+ "uuid",
+]
+
+[[package]]
+name = "system76-firmware-daemon"
+version = "0.1.0"
+dependencies = [
+ "dbus",
+ "dbus-crossroads",
+ "enum_derive",
+ "libc",
+ "serde",
+ "serde_json",
+ "shrinkwraprs",
+ "system76-firmware",
+ "thiserror",
+]
+
+[[package]]
+name = "system76_ectool"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c957fdd329e017031dbd261ff48fad01296660a9c237942c226cff064bd0610a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d779dc6aeff029314570f666ec83f19df7280bb36ef338442cfa8c604021b80"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a9cd18aa97d5c45c6603caea1da6628790b37f7a34b6ca89522331c5180fed0"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+
+[[package]]
+name = "tokio"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8e00990ebabbe4c14c08aca901caed183ecd5c09562a12c824bb53d3c3fd3af"
+dependencies = [
+ "autocfg",
+ "bytes",
+ "libc",
+ "memchr",
+ "mio",
+ "num_cpus",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7d995660bd2b7f8c1568414c1126076c13fbb725c40112dc0120b78eb9b717b"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+
+[[package]]
+name = "typenum"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d54675592c1dbefd78cbd98db9bacd89886e1ca50692a0692baefffdeb92dd58"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "want"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+dependencies = [
+ "log",
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "xattr"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
+dependencies = [
+ "libc",
+]
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index a019a6f79321..d28372a465d9 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -2,13 +2,13 @@
 rustPlatform.buildRustPackage rec {
   pname = "system76-firmware";
   # Check Makefile when updating, make sure postInstall matches make install
-  version = "1.0.39";
+  version = "1.0.50";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nPHBL73hmvW9z5SQjmfu+ozMXxUEajNQxNtE/V9QwZ0=";
+    sha256 = "sha256-nLbDhs+FxIcoVK66bwUAxAubikic5NT8yOA/mH/irgQ=";
   };
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
@@ -17,7 +17,12 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoSha256 = "sha256-BrzicLj7FbUqRG1BgQIRqh801tRQpRZkHSiX3ekAYqc=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "ecflash-0.1.0" = "sha256-W613wbW54R65/rs6oiPAH/qov2OVEjMMszpUJdX4TxI=";
+    };
+  };
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/fnotifystat/default.nix b/nixpkgs/pkgs/os-specific/linux/fnotifystat/default.nix
index e600e163ad73..fabfd47bca12 100644
--- a/nixpkgs/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -1,13 +1,17 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
 
 stdenv.mkDerivation rec {
   pname = "fnotifystat";
-  version = "0.02.07";
+  version = "0.02.10";
+
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    sha256 = "sha256-5oYM1t+vmWywYRbgXI2RGQlOuNJluj2gwCMf3pTpDC0=";
+    hash = "sha256-bcb1kSpNZV7eTcEIcaoiqxB68kTc0TGFMIr1Aehy/Rc=";
   };
 
   installFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/forkstat/default.nix b/nixpkgs/pkgs/os-specific/linux/forkstat/default.nix
index 1c3f3342e081..c8a3276f5d81 100644
--- a/nixpkgs/pkgs/os-specific/linux/forkstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/forkstat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "forkstat";
-  version = "0.02.17";
+  version = "0.03.01";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-Rw1Xwst0+seksTLL+v3IUEojGjwCERwF89xkk70npUU=";
+    hash = "sha256-T7O+PIWmFC4wi4nnmNsAH8H0SazixBoCx5ZdBV2wL+E=";
   };
 
   installFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
new file mode 100644
index 000000000000..63e11c2950d3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
@@ -0,0 +1,171 @@
+{ stdenv
+, lib
+, fetchurl
+, pkg-config
+, autoconf
+, automake
+, kerberos
+, openldap
+, popt
+, sasl
+, curl
+, xmlrpc_c
+, ding-libs
+, p11-kit
+, gettext
+, nspr
+, nss
+, _389-ds-base
+, svrcore
+, libuuid
+, talloc
+, tevent
+, samba
+, libunistring
+, libverto
+, libpwquality
+, systemd
+, python3
+, bind
+, sssd
+, jre
+, rhino
+, lesscpy
+, jansson
+, runtimeShell
+}:
+
+let
+  pathsPy = ./paths.py;
+
+  pythonInputs = with python3.pkgs; [
+    six
+    python-ldap
+    dnspython
+    netaddr
+    netifaces
+    gssapi
+    dogtag-pki
+    pyasn1
+    sssd
+    cffi
+    lxml
+    dbus-python
+    cryptography
+    python-memcached
+    qrcode
+    pyusb
+    yubico
+    setuptools
+    jinja2
+    augeas
+    samba
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "freeipa";
+  version = "4.10.1";
+
+  src = fetchurl {
+    url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
+    sha256 = "sha256-q2rQzcBl1tI4/7+hxEwOY9ND86hObe7O7Y9EEH7cUoA=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.wrapPython
+    jre
+    rhino
+    lesscpy
+    automake
+    autoconf
+    gettext
+    pkg-config
+  ];
+
+  buildInputs = [
+    kerberos
+    openldap
+    popt
+    sasl
+    curl
+    xmlrpc_c
+    ding-libs
+    p11-kit
+    python3
+    nspr
+    nss
+    _389-ds-base
+    svrcore
+    libuuid
+    talloc
+    tevent
+    samba
+    libunistring
+    libverto
+    systemd
+    bind
+    libpwquality
+    jansson
+  ] ++ pythonInputs;
+
+  postPatch = ''
+    patchShebangs makeapi makeaci install/ui/util
+
+    substituteInPlace ipaplatform/setup.py \
+      --replace 'ipaplatform.debian' 'ipaplatform.nixos'
+
+    substituteInPlace ipasetup.py.in \
+      --replace 'int(v)' 'int(v.replace("post", ""))'
+
+    substituteInPlace client/ipa-join.c \
+      --replace /usr/sbin/ipa-getkeytab $out/bin/ipa-getkeytab
+
+    cp -r ipaplatform/{fedora,nixos}
+    substitute ${pathsPy} ipaplatform/nixos/paths.py \
+      --subst-var out \
+      --subst-var-by bind ${bind.dnsutils} \
+      --subst-var-by curl ${curl} \
+      --subst-var-by kerberos ${kerberos}
+  '';
+
+  NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
+  pythonPath = pythonInputs;
+
+  # Building and installing the server fails with silent Rhino errors, skipping
+  # for now. Need a newer Rhino version.
+  #buildFlags = [ "client" "server" ]
+
+  configureFlags = [
+    "--with-systemdsystemunitdir=$out/lib/systemd/system"
+    "--with-ipaplatform=nixos"
+    "--disable-server"
+  ];
+
+  postInstall = ''
+    echo "
+     #!${runtimeShell}
+     echo 'ipa-client-install is not available on NixOS. Please see security.ipa, instead.'
+     exit 1
+    " > $out/sbin/ipa-client-install
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+    rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
+  '';
+
+  meta = with lib; {
+    description = "Identity, Policy and Audit system";
+    longDescription = ''
+      IPA is an integrated solution to provide centrally managed Identity (users,
+      hosts, services), Authentication (SSO, 2FA), and Authorization
+      (host access control, SELinux user roles, services). The solution provides
+      features for further integration with Linux based clients (SUDO, automount)
+      and integration with Active Directory based infrastructures (Trusts).
+    '';
+    homepage = "https://www.freeipa.org/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.s1341 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/freeipa/paths.py b/nixpkgs/pkgs/os-specific/linux/freeipa/paths.py
new file mode 100644
index 000000000000..36c0cc0c7403
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/freeipa/paths.py
@@ -0,0 +1,13 @@
+from ipaplatform.fedora.paths import FedoraPathNamespace
+
+class NixOSPathNamespace(FedoraPathNamespace):
+    SBIN_IPA_JOIN = "@out@/bin/ipa-join"
+    IPA_GETCERT = "@out@/bin/ipa-getcert"
+    IPA_RMKEYTAB = "@out@/bin/ipa-rmkeytab"
+    IPA_GETKEYTAB = "@out@/bin/ipa-getkeytab"
+    NSUPDATE = "@bind@/bin/nsupdate"
+    BIN_CURL = "@curl@/bin/curl"
+    KINIT = "@kerberos@/bin/kinit"
+    KDESTROY = "@kerberos@/bin/kdestroy"
+
+paths = NixOSPathNamespace()
diff --git a/nixpkgs/pkgs/os-specific/linux/fscrypt/default.nix b/nixpkgs/pkgs/os-specific/linux/fscrypt/default.nix
index e967dea1c3e1..fd925ab654fa 100644
--- a/nixpkgs/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    hash = "sha256-kkcZuX8tB7N8l9O3X6H92EqEqdAcqSbX+pwr7GrcRFY=";
+    hash = "sha256-4Im3YWhLs5Q+o4DtpSuSMuKtKqXaICL9/EB0q5um6mQ=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
       --replace "/usr/local" "$out"
   '';
 
-  vendorSha256 = "sha256-6zcHz7ePJFSxxfIlhVK2VEf6+soBoUInT9ZsZK/Ag78=";
+  vendorHash = "sha256-APW0XM6fTQOCw4tE1NA5VNN3fBUmsvn99NqqJnB3Q0s=";
 
   doCheck = false;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/fuse/common.nix b/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
index ac4deb19f51c..bbd871a1b9ae 100644
--- a/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
 
   patches =
     lib.optional
-      (!isFuse3 && stdenv.isAarch64)
+      (!isFuse3 && (stdenv.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
         sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
       ./makeconf.sh
     '');
 
-  checkInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
+  nativeCheckInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
 
   checkPhase = ''
     python3 -m pytest test/
diff --git a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
index 585347caac0f..27c600c47149 100644
--- a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
@@ -1,17 +1,18 @@
-{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, glib, pcre
+{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, gnumake42, glib, pcre
 , json_c, flex, bison, dtc, pciutils, dmidecode, acpica-tools, libbsd }:
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "21.07.00";
+  version = "23.03.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-cTm8R7sUJk5aTjXvsxfBXX0J/ehVoqo43ILZ6VqaPTI=";
+    sha256 = "sha256-loBlNQwsgv3n5qqvcT6w22Z/AshwIS7vQrBjLCL4z/Q=";
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  # fails with make 4.4
+  nativeBuildInputs = [ autoreconfHook pkg-config gnumake42 ];
   buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode acpica-tools libbsd ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/fxload/default.nix b/nixpkgs/pkgs/os-specific/linux/fxload/default.nix
index 8c1a778ec8bf..e8b9d0648bd8 100644
--- a/nixpkgs/pkgs/os-specific/linux/fxload/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fxload/default.nix
@@ -1,37 +1,31 @@
-{lib, stdenv, fetchurl}:
+{ lib
+, stdenv
+, libusb1
+}:
 
 stdenv.mkDerivation rec {
   pname = "fxload";
-  version = "2002.04.11";
+  version = libusb1.version;
+  dontUnpack = true;
+  dontBuild = true;
+  dontConfigure = true;
+  dontInstall = true;
+  dontPatch = true;
+  dontPatchELF = true;
 
-  src = fetchurl {
-    url = "mirror://sourceforge/linux-hotplug/fxload-${lib.replaceStrings ["."] ["_"] version}.tar.gz";
-    sha256 = "1hql93bp3dxrv1p67nc63xsbqwljyynm997ysldrc3n9ifi6s48m";
-  };
-
-  patches = [
-    # Will be needed after linux-headers is updated to >= 2.6.21.
-    (fetchurl {
-      url = "http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/sys-apps/fxload/files/fxload-20020411-linux-headers-2.6.21.patch?rev=1.1";
-      sha256 = "0ij0c8nr1rbyl5wmyv1cklhkxglvsqz32h21cjw4bjm151kgmk7p";
-    })
-  ];
-
-  preBuild = ''
-    substituteInPlace Makefile --replace /usr /
-    makeFlagsArray=(INSTALL=install prefix=$out)
+  # fxload binary exist inside the `examples/bin` directory of `libusb1`
+  postFixup = ''
+    mkdir -p $out/bin
+    ln -s ${passthru.libusb}/examples/bin/fxload $out/bin/fxload
   '';
 
-  preInstall = ''
-    mkdir -p $out/sbin
-    mkdir -p $out/share/man/man8
-    mkdir -p $out/share/usb
-  '';
+  passthru.libusb = libusb1.override { withExamples = true; };
 
   meta = with lib; {
-    homepage = "http://linux-hotplug.sourceforge.net/?selected=usb";
-    description = "Tool to upload firmware to Cypress EZ-USB microcontrollers";
-    license = licenses.gpl2;
+    homepage = "https://github.com/libusb/libusb";
+    description = "Tool to upload firmware to into an21, fx, fx2, fx2lp and fx3 ez-usb devices";
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ realsnick ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/g15daemon/default.nix b/nixpkgs/pkgs/os-specific/linux/g15daemon/default.nix
index d20fb662ff55..823f523db242 100644
--- a/nixpkgs/pkgs/os-specific/linux/g15daemon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/g15daemon/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream gcc-10:
   #  ld: g15_plugins.o:/build/g15daemon-1.9.5.3/g15daemon/./g15daemon.h:218:
   #   multiple definition of `lcdlist_mutex'; utility_funcs.o:g15daemon.h:218: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/gasket/default.nix b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
new file mode 100644
index 000000000000..1f9d60ad7b60
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "gasket";
+  version = "1.0-18";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "gasket-driver";
+    rev = "97aeba584efd18983850c36dcf7384b0185284b3";
+    sha256 = "pJwrrI7jVKFts4+bl2xmPIAD01VKFta2SRuElerQnTo=";
+  };
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)"
+  ];
+  buildFlags = [ "modules" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  sourceRoot = "source/src";
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = with lib; {
+    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
+    homepage = "https://github.com/google/gasket-driver";
+    license = licenses.gpl2;
+    maintainers = [ lib.maintainers.kylehendricks ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/gobi_loader/default.nix b/nixpkgs/pkgs/os-specific/linux/gobi_loader/default.nix
index b7972007719c..2b251242119c 100644
--- a/nixpkgs/pkgs/os-specific/linux/gobi_loader/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/gobi_loader/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace 60-gobi.rules --replace "/lib/firmware" "/run/current-system/firmware"
   '';
 
-  makeFlags = "prefix=${placeholder "out"}";
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Firmware loader for Qualcomm Gobi USB chipsets";
diff --git a/nixpkgs/pkgs/os-specific/linux/greetd/default.nix b/nixpkgs/pkgs/os-specific/linux/greetd/default.nix
deleted file mode 100644
index 744b43f6f8aa..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/greetd/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ rustPlatform
-, lib
-, fetchFromSourcehut
-, pam
-, scdoc
-, installShellFiles
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "greetd";
-  version = "0.8.0";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-20D6HanUeAc0S9czkNJFmhsrfEqodpafkHsmwKccrHQ=";
-  };
-
-  cargoHash = "sha256-8nMQ81Y0DnPs9WmxNASlcjTEVw5lh+nZtZ7vmmBCu2g=";
-
-  nativeBuildInputs = [
-    scdoc
-    installShellFiles
-  ];
-
-  buildInputs = [
-    pam
-  ];
-
-  postInstall = ''
-    for f in man/*; do
-      scdoc < "$f" > "$(sed 's/-\([0-9]\)\.scd$/.\1/' <<< "$f")"
-      rm "$f"
-    done
-    installManPage man/*
-  '';
-
-  meta = with lib; {
-    description = "Minimal and flexible login manager daemon";
-    longDescription = ''
-      greetd is a minimal and flexible login manager daemon
-      that makes no assumptions about what you want to launch.
-      Comes with agreety, a simple, text-based greeter.
-    '';
-    homepage = "https://sr.ht/~kennylevinsen/greetd/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/gtkgreet/default.nix b/nixpkgs/pkgs/os-specific/linux/gtkgreet/default.nix
deleted file mode 100644
index 7ab7c01475bd..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/gtkgreet/default.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ stdenv
-, lib
-, fetchFromSourcehut
-, pkg-config
-, cmake
-, meson
-, ninja
-, gtk3
-, gtk-layer-shell
-, json_c
-, scdoc
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gtkgreet";
-  version = "0.7";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = version;
-    sha256 = "ms+2FdtzzNlmlzNxFhu4cpX5H+5H+9ZOtZ0p8uVA3lo=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    meson
-    ninja
-    cmake
-  ];
-
-  buildInputs = [
-    gtk3
-    gtk-layer-shell
-    json_c
-    scdoc
-  ];
-
-  mesonFlags = [
-    "-Dlayershell=enabled"
-  ];
-
-  meta = with lib; {
-    description = "GTK based greeter for greetd, to be run under cage or similar";
-    homepage = "https://git.sr.ht/~kennylevinsen/gtkgreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/guvcview/default.nix b/nixpkgs/pkgs/os-specific/linux/guvcview/default.nix
index 04eccaf02435..6e073662c4e6 100644
--- a/nixpkgs/pkgs/os-specific/linux/guvcview/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/guvcview/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , portaudio
 , SDL2
-, ffmpeg
+, ffmpeg_4
 , udev
 , libusb1
 , libv4l
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     SDL2
     alsa-lib
-    ffmpeg
+    ffmpeg_4
     libusb1
     libv4l
     portaudio
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A simple interface for devices supported by the linux UVC driver";
-    homepage = "http://guvcview.sourceforge.net";
+    homepage = "https://guvcview.sourceforge.net";
     maintainers = [ maintainers.coconnor ];
     license = licenses.gpl3;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/hd-idle/default.nix b/nixpkgs/pkgs/os-specific/linux/hd-idle/default.nix
index b9256158549a..77caa1315984 100644
--- a/nixpkgs/pkgs/os-specific/linux/hd-idle/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hd-idle/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hd-idle";
-  version = "1.17";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "adelolmo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BHUjKvhUDeD/Xm0KKbkLH2XWn1W77E7Pm3OSPARF6Xw=";
+    sha256 = "sha256-7EXfI3E83ltpjq2M/qZX2P/bNtQQBWZRBCD7i5uit0I=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix b/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
index 1dd0fa6a2089..12938dbac89a 100644
--- a/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hdparm";
-  version = "9.64";
+  version = "9.65";
 
   src = fetchurl {
     url = "mirror://sourceforge/hdparm/hdparm-${version}.tar.gz";
-    sha256 = "sha256-MVuVaVHD/qAnKH3iBDgVNCF8C9Dze0k1h3/i2wyrhZo=";
+    sha256 = "sha256-0Ukp+RDQYJMucX6TgkJdR8LnFEI1pTcT1VqU995TWks=";
   };
 
   preBuild = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/health-check/default.nix b/nixpkgs/pkgs/os-specific/linux/health-check/default.nix
index e876808b461a..9e85281ea4c0 100644
--- a/nixpkgs/pkgs/os-specific/linux/health-check/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/health-check/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "health-check";
-  version = "0.03.10";
+  version = "0.03.11";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-1dm7tl7DHv1CzuLe1/UewDSUOanO0hN+STkPrAHcZmI=";
+    hash = "sha256-QLa/7kA0juefzOba7ELopDmOVfiGJReo4LCfhnxW1tk=";
   };
 
   buildInputs = [ json_c libbsd ];
diff --git a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix b/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
index 7d01120b2f3f..7b8c73fc0ccd 100644
--- a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
@@ -1,14 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hid-nintendo";
   version = "3.2";
 
   src = fetchFromGitHub {
     owner = "nicman23";
     repo = "dkms-hid-nintendo";
-    rev = version;
-    sha256 = "1c262xarslicn9ildndl66sf97i5pzwzra54zh2rp11j7kkvvbyr";
+    rev = finalAttrs.version;
+    hash = "sha256-2a+95zwyhJsF/KSo/Pm/JZ7ktDG02UZjsixSnVUXRrA=";
   };
 
   setSourceRoot = ''
@@ -27,12 +31,12 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
-  meta = with lib; {
-    description = "A Nintendo HID kernel module";
+  meta = {
     homepage = "https://github.com/nicman23/dkms-hid-nintendo";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.rencire ];
-    platforms = platforms.linux;
-    broken = versionOlder kernel.version "4.14";
+    description = "A Nintendo HID kernel module";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+    broken = lib.versionOlder kernel.version "4.14";
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix b/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
index 3fdbaa9149a6..f1cd6b67165b 100644
--- a/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://hostap.epitest.fi";
+    homepage = "https://w1.fi/hostapd/";
     description = "A user space daemon for access point and authentication servers";
     license = licenses.gpl2;
     maintainers = with maintainers; [ ninjatrappeur hexa ];
diff --git a/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix b/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
index fe789d51dbb5..59f9d368f2fd 100644
--- a/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.360";
+  version = "0.370";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-dF1Yeb3xH4keQzcydZ3h3kyuSZ1knW/2YAJ8xvFSoMo=";
+    sha256 = "sha256-fqhYPKqtuI+7h/SgdWI4i7jBTgluy/hI8Q6pq4LKtY4=";
   };
 
   postPatch = ''
@@ -19,13 +19,11 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
-  outputHashMode = "recursive";
-  outputHash = "sha256-gkgnHy1XwP87qpQiAm31AIAkxgGm5JYxMBr60kvd+gE=";
-
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
     license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ pedrohlc ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/hyperv-daemons/default.nix b/nixpkgs/pkgs/os-specific/linux/hyperv-daemons/default.nix
index a659908a7a09..12033063c165 100644
--- a/nixpkgs/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -73,9 +73,9 @@ in stdenv.mkDerivation {
   buildCommand = ''
     system=$lib/lib/systemd/system
 
-    install -Dm444 ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
-    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
-    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service
+    install -Dm444 ${service "fcopy" "file copy (FCOPY)"        "hv_fcopy" } $system/hv-fcopy.service
+    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     "hv_kvp"   } $system/hv-kvp.service
+    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" "hv_vss"   } $system/hv-vss.service
 
     cat > $system/hyperv-daemons.target <<EOF
     [Unit]
diff --git a/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index 5f44622c5122..d2dd66056017 100644
--- a/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Proxy for sending IIO sensor data to D-Bus";
-    homepage = "https://github.com/hadess/iio-sensor-proxy";
+    homepage = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy";
     license = licenses.gpl3 ;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
index aeafd68e7080..23a58ae65e0c 100644
--- a/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "ima-evm-utils";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchgit {
     url = "git://git.code.sf.net/p/linux-ima/ima-evm-utils";
     rev = "v${version}";
-    sha256 = "1zmyv82232lzqk52m0s7fap9zb9hb1x6nsi5gznk0cbsnq2m67pc";
+    sha256 = "sha256-WPBG7v29JHZ+ZGeLgA2gtLzZmaG0Xdvpq+BZ6NriY+A=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/intel-cmt-cat/default.nix b/nixpkgs/pkgs/os-specific/linux/intel-cmt-cat/default.nix
index dd96e518300e..e110d201a2db 100644
--- a/nixpkgs/pkgs/os-specific/linux/intel-cmt-cat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/intel-cmt-cat/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "4.4.1";
+  version = "4.6.0";
   pname = "intel-cmt-cat";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-cmt-cat";
     rev = "v${version}";
-    sha256 = "sha256-6v9MRIW9Wqojia6GZNM75AvoYJGJ9C/k+ShwQKOjiL8=";
+    sha256 = "sha256-Bw/WY30ytvwBo+OZ27WG2aY3YN9xczdjs4jcHR/Tv/w=";
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 5c38e05fbfe4..fe1bb139a10b 100644
--- a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -1,42 +1,46 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , patchelf
 , cmake
 , pkg-config
-
 , intel-gmmlib
 , intel-graphics-compiler
+, level-zero
 , libva
 }:
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "22.32.23937";
+  version = "23.17.26241.15";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-W+0EbrbF+jPtsf9QCMmSEX7HFDlfiRtD/kjeMJVqCoY=";
+    sha256 = "sha256-A0gtSM6e+VcfcGG/6zReV2LIXq6tGbWIwDQFlQ2TW28=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ intel-gmmlib intel-graphics-compiler libva ];
+  buildInputs = [ intel-gmmlib intel-graphics-compiler libva level-zero ];
 
   cmakeFlags = [
     "-DSKIP_UNIT_TESTS=1"
-
     "-DIGC_DIR=${intel-graphics-compiler}"
     "-DOCL_ICD_VENDORDIR=${placeholder "out"}/etc/OpenCL/vendors"
-
     # The install script assumes this path is relative to CMAKE_INSTALL_PREFIX
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  outputs = [ "out" "drivers" ];
+
   postInstall = ''
     # Avoid clash with intel-ocl
     mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
+
+    mkdir -p $drivers/lib
+    mv -t $drivers/lib $out/lib/libze_intel*
   '';
 
   postFixup = ''
@@ -45,10 +49,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage    = "https://github.com/intel/compute-runtime";
+    homepage = "https://github.com/intel/compute-runtime";
     description = "Intel Graphics Compute Runtime for OpenCL. Replaces Beignet for Gen8 (Broadwell) and beyond";
-    license     = licenses.mit;
-    platforms   = platforms.linux;
-    maintainers = with maintainers; [ gloaming ];
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix b/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
index 4ed45a99ce25..2917ace349fb 100644
--- a/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.21";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-Zzm0EV6baQvKPOC762mnieYe1JM7ZfNovKqFQt20jQ8=";
+    sha256 = "sha256-4DTYtUltmZ+nkm4ZLac+6JbBW3z+qby7sP33LwEXtcQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix b/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix
new file mode 100644
index 000000000000..0e79b89cfa34
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -0,0 +1,42 @@
+{ buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
+buildGoModule rec {
+  pname = "ipp-usb";
+  version = "0.9.23";
+
+  src = fetchFromGitHub {
+    owner = "openprinting";
+    repo = "ipp-usb";
+    rev = version;
+    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+  };
+
+  postPatch = ''
+    # rebuild with patched paths
+    rm ipp-usb.8
+    substituteInPlace Makefile --replace "install: all" "install: man"
+    substituteInPlace systemd-udev/ipp-usb.service --replace "/sbin" "$out/bin"
+    for i in Makefile paths.go ipp-usb.8.md; do
+      substituteInPlace $i --replace "/usr" "$out"
+      substituteInPlace $i --replace "/var/ipp-usb" "/var/lib/ipp-usb"
+    done
+  '';
+
+  nativeBuildInputs = [ pkg-config ronn ];
+  buildInputs = [ libusb1 avahi ];
+
+  vendorSha256 = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+
+  postInstall = ''
+    # to accomodate the makefile
+    cp $out/bin/ipp-usb .
+    make install DESTDIR=$out
+  '';
+
+  meta = {
+    description = "Daemon to use the IPP everywhere protocol with USB printers";
+    homepage = "https://github.com/OpenPrinting/ipp-usb";
+    maintainers = [ lib.maintainers.symphorien ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
index 4d06e82fcaef..18b314067961 100644
--- a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.18.0";
+  version = "6.3.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "W6PUZNUcjCg1UNUH/6w9EPeuxYe3xmsMy2lQZDZGOJ4=";
+    sha256 = "sha256-37KpjbluemU8/8ZpMzWhpGbimjS2rFKL5I814dJ2ZzI=";
   };
 
   patches = [
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
       url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/patch/?id=a3272b93725a406bc98b67373da67a4bdf6fcdb0";
       sha256 = "0hyagh2lf6rrfss4z7ca8q3ydya6gg7vfhh25slhpgcn6lnk0xbv";
     })
+
+    # fix build on musl. applied anywhere to prevent patchrot.
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/min.patch?id=4b78dbe29d18151402052c56af43cc12d04b1a69";
+      sha256 = "sha256-0ROZQAN3mUPPgggictr23jyA4JDG7m9vmBUhgRp4ExY=";
+    })
   ];
 
   preConfigure = ''
@@ -33,6 +39,10 @@ stdenv.mkDerivation rec {
     "SBINDIR=$(out)/sbin"
     "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "SHARED_LIBS=n"
+    # all build .so plugins:
+    "TC_CONFIG_NO_XT=y"
   ];
 
   buildFlags = [
@@ -50,7 +60,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {
-    inherit pname version;
     # No nicer place to find latest release.
     url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git";
     rev-prefix = "v";
diff --git a/nixpkgs/pkgs/os-specific/linux/iproute/mptcp.nix b/nixpkgs/pkgs/os-specific/linux/iproute/mptcp.nix
deleted file mode 100644
index e43af52bb349..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/iproute/mptcp.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, iproute2, fetchFromGitHub, fetchpatch }:
-
-iproute2.overrideAttrs (oa: rec {
-  pname = "iproute_mptcp";
-  version = "0.95";
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "iproute-mptcp";
-    rev = "mptcp_v${version}";
-    sha256 = "07fihvwlaj0ng8s8sxqhd0a9h1narcnp4ibk88km9cpsd32xv4q3";
-  };
-
-  preConfigure = oa.preConfigure + ''
-    patchShebangs configure
-  '';
-
-  patches = [
-    # We override "patches" to never apply any iproute2 patches:
-  ] ++ [
-    # iproute-mptcp patches:
-
-    # Pull upstream fix for -fno-common toolchain support:
-    #   https://github.com/multipath-tcp/iproute-mptcp/pull/8
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/multipath-tcp/iproute-mptcp/commit/7aebfde8624c978f6f73b03142892f802d21cc0b.patch";
-      sha256 = "098402sjdm10r9xggz6naygnfjs74d9k3s2wc2aczx0d2zayhff8";
-    })
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/multipath-tcp/iproute-mptcp";
-    description = "IP-Route extensions for MultiPath TCP";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ teto ];
-    priority = 2;
-  };
-})
diff --git a/nixpkgs/pkgs/os-specific/linux/ipset/default.nix b/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
index a116aef7920a..6aa369e4eb4a 100644
--- a/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ipset";
-  version = "7.15";
+  version = "7.17";
 
   src = fetchurl {
     url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ClVFqq22QBQsH4iNNmp43fhyR5mWf6IGhqcAU71iF1E=";
+    sha256 = "sha256-vknJ/0id1mEMrWVB50PDOE6slunyRwfaezkp2PKsZNg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/iptables/default.nix b/nixpkgs/pkgs/os-specific/linux/iptables/default.nix
index 0704860c961f..9d2848556eaf 100644
--- a/nixpkgs/pkgs/os-specific/linux/iptables/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iptables/default.nix
@@ -1,39 +1,37 @@
-{ lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
+{ lib, stdenv, fetchurl
+, autoreconfHook, pkg-config, pruneLibtoolFiles, flex, bison
 , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
 , nftablesCompat ? true
 , fetchpatch
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.8";
+  version = "1.8.9";
   pname = "iptables";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ccdYidxxBnZjFVPrFRHaAXe7qvG1USZbkS0jbD9RhZ8=";
+    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    sha256 = "72Y5pDvoMlpPjqaBI/+sI2y2lujHhQG2ToEGr7AIyH8=";
   };
 
   patches = [
-    # xshared: Fix build for -Werror=format-security
     (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=b72eb12ea5a61df0655ad99d5048994e916be83a";
-      sha256 = "sha256-pnamqOagwNWoiwlxPnKCqSc2N7MP/eZlT7JiE09c8OE=";
+      name = "format-security.patch";
+      url = "https://git.netfilter.org/iptables/patch/?id=ed4082a7405a5838c205a34c1559e289949200cc";
+      sha256 = "OdytFmHk+3Awu+sDQpGTl5/qip4doRblmW2vQzfNZiU=";
     })
-    # treewide: use uint* instead of u_int*
-    (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=f319389525b066b7dc6d389c88f16a0df3b8f189";
-      sha256 = "sha256-rOxCEWZoI8Ac5fQDp286YHAwvreUAoDVAbomboKrGyM=";
-    })
-    # fix Musl build
-    (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=0e7cf0ad306cdf95dc3c28d15a254532206a888e";
-      sha256 = "18mnvqfxzd7ifq3zjb4vyifcyadpxdi8iqcj8wsjgw23n49lgrbj";
+    (fetchurl {
+      name = "static.patch";
+      url = "https://lore.kernel.org/netfilter-devel/20230402232939.1060151-1-hi@alyssa.is/raw";
+      sha256 = "PkH+1HbJjBb3//ffBe0XUQok1lBwgj/STL8Ppu/28f4=";
     })
   ];
 
   outputs = [ "out" "dev" "man" ];
 
-  nativeBuildInputs = [ pkg-config pruneLibtoolFiles flex bison ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config pruneLibtoolFiles flex bison
+  ];
 
   buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix b/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix
new file mode 100644
index 000000000000..04ddb0749279
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ivsc-driver
+, kernel
+}:
+
+stdenv.mkDerivation {
+  pname = "ipu6-drivers";
+  version = "unstable-2023-05-19";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipu6-drivers";
+    rev = "8c02a846d1afe0e108964a2d3db4acb175712da9";
+    hash = "sha256-f2EuxVkCvEPyH0XbLCv5t/Mi0jdk7BOh1QluG/TxZr0=";
+  };
+
+  postPatch = ''
+    cp --no-preserve=mode --recursive --verbose \
+      ${ivsc-driver.src}/backport-include \
+      ${ivsc-driver.src}/drivers \
+      ${ivsc-driver.src}/include \
+      .
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ipu6-drivers";
+    description = "IPU6 kernel driver";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = [ "x86_64-linux" ];
+    # requires 6.1.7 https://github.com/intel/ipu6-drivers/pull/84
+    broken = kernel.kernelOlder "6.1.7";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/iputils/default.nix b/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
index 0ca6d8aa187f..8396fd5e3d33 100644
--- a/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
@@ -1,47 +1,48 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, gettext, libxslt, docbook_xsl_ns
-, libcap, libidn2
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gettext
+, libxslt
+, docbook_xsl_ns
+, libcap
+, libidn2
 , iproute2
 , apparmorRulesFromClosure
 }:
 
-let
-  version = "20211215";
-  sunAsIsLicense = {
-    fullName = "AS-IS, SUN MICROSYSTEMS license";
-    url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "iputils";
-  inherit version;
+  version = "20221126";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1vzdch1xi2x2j8mvnsr4wwwh7kdkgf926xafw5kkb74yy1wac5qv";
+    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
   };
 
-  outputs = ["out" "apparmor"];
+  outputs = [ "out" "apparmor" ];
 
   # We don't have the required permissions inside the build sandbox:
   # /build/source/build/ping/ping: socket: Operation not permitted
   doCheck = false;
 
   mesonFlags = [
-    "-DBUILD_RARPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
     "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
-    # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
-    ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+  # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+  ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkg-config gettext libxslt.bin docbook_xsl_ns ];
   buildInputs = [ libcap ]
     ++ lib.optional (!stdenv.hostPlatform.isMusl) libidn2;
-  checkInputs = [ iproute2 ];
+  nativeCheckInputs = [ iproute2 ];
 
   postInstall = ''
     mkdir $apparmor
@@ -65,23 +66,19 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/iputils/iputils";
+    changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
     description = "A set of small useful utilities for Linux networking";
-    inherit (src.meta) homepage;
-    changelog = "https://github.com/iputils/iputils/releases/tag/s${version}";
-    license = with licenses; [ gpl2Plus bsd3 sunAsIsLicense ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos lheckemann ];
-
     longDescription = ''
       A set of small useful utilities for Linux networking including:
 
-      arping
-      clockdiff
-      ninfod
-      ping
-      rarpd
-      rdisc
-      tracepath
+      - arping: send ARP REQUEST to a neighbour host
+      - clockdiff: measure clock difference between hosts
+      - ping: send ICMP ECHO_REQUEST to network hosts
+      - tracepath: traces path to a network host discovering MTU along this path
     '';
+    license = with licenses; [ gpl2Plus bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos lheckemann ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/irqbalance/default.nix b/nixpkgs/pkgs/os-specific/linux/irqbalance/default.nix
index d09b5f38f916..585c1661b8af 100644
--- a/nixpkgs/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/irqbalance/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "irqbalance";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
     rev = "v${version}";
-    sha256 = "sha256-OifGlOUT/zFz5gussEmLL24w4AovGeyNfbg/yCfzerw=";
+    sha256 = "sha256-dk5gdDCXNELTlbZ34gUOVwPHvXF3N07v/ZqeNVfGTGw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/ivsc-driver/default.nix b/nixpkgs/pkgs/os-specific/linux/ivsc-driver/default.nix
new file mode 100644
index 000000000000..0491b1d548b4
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+stdenv.mkDerivation {
+  pname = "ivsc-driver";
+  version = "unstable-2023-03-10";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ivsc-driver";
+    rev = "c8db12b907e2e455d4d5586e5812d1ae0eebd571";
+    hash = "sha256-OM9PljvaMKrk72BFeSCqaABFeAws+tOdd3oC2jyNreE=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ivsc-driver";
+    description = "Intel Vision Sensing Controller kernel driver";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = [ "x86_64-linux" ];
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/iw/default.nix b/nixpkgs/pkgs/os-specific/linux/iw/default.nix
index ac8efbb7969f..bf7cb025bc1c 100644
--- a/nixpkgs/pkgs/os-specific/linux/iw/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iw/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iw";
-  version = "5.16";
+  version = "5.19";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TETkJ2L5A/kJS6WlmJmMgAqXpir9b9MeweCnmeMIZZw=";
+    sha256 = "sha256-8We76UfdU7uevAwdzvXbatc6wdYITyxvk3bFw2DMTU4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
index dfd5f5724ef8..358cfb1c67ba 100644
--- a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.29";
+  version = "2.4";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
+    sha256 = "sha256-X7jPheVePOaLY2kaAdpBwi5b/YrRZVqswOBu2RzsuHc=";
   };
 
   outputs = [ "out" "man" "doc" ]
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     readline
   ];
 
-  checkInputs = [ openssl ];
+  nativeCheckInputs = [ openssl ];
 
   # wrapPython wraps the scripts in $test. They pull in gobject-introspection,
   # which doesn't cross-compile.
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/cli.nix b/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
index 4c18f478798e..67e1575ff7e9 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libnl, iptables }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, libnl, iptables }:
 
 let
   sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
@@ -10,6 +10,16 @@ stdenv.mkDerivation {
 
   src = sourceAttrs.src;
 
+  patches = [ (fetchpatch {
+    url = "https://github.com/NICMx/Jool/commit/490ddb0933061cab3c2a7952dffc61789deed565.patch";
+    hash = "sha256-1dpMth0ocPHujlk+96St1a63RipcWiL/CdmSz4O87Lg=";
+  }) ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libnl iptables ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/default.nix b/nixpkgs/pkgs/os-specific/linux/jool/default.nix
index 9246ca679a65..2d1a44790814 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel }:
 
 let
   sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
@@ -12,6 +12,13 @@ stdenv.mkDerivation {
   nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://git.launchpad.net/ubuntu/+source/jool/plain/debian/patches/0001-Linux-6.2.patch?id=3708a5b6c492b7d8e9f78596e61ae8f74ec9640f";
+      hash = "sha256-GkyDY6tcJp7Xd28mrDorEJHxsEowZBJP7BRAdPpsyF8=";
+    })
+  ];
+
   prePatch = ''
     sed -e 's@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@' -i src/mod/*/Makefile
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/source.nix b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
index 87e36fe5a9eb..b221598c0e74 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/source.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.7";
+  version = "4.1.9";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
-    rev = "v${version}";
-    sha256 = "08z23mi6xkr6zzp0hzh1cppvl2y0177s0lnpxqbpy8jiii5fxw8f";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sKrjn/XQANiXfkjNiFfvAkmONyQjVigFBKgcGkuIPs0=";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kbd/default.nix b/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
index 4d08a38dbe85..f4290352c93d 100644
--- a/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
@@ -16,13 +16,15 @@
 
 stdenv.mkDerivation rec {
   pname = "kbd";
-  version = "2.4.0";
+  version = "2.5.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    sha256 = "17wvrqz2kk0w87idinhyvd31ih1dp7ldfl2yfx7ailygb0279w2m";
+    sha256 = "sha256-zN9FI4emOAlz0pJzY+nLuTn6IGiRWm+Tf/nSRSICRoM=";
   };
 
+  outputs = [ "out" "dev" ];
+
   configureFlags = [
     "--enable-optional-progs"
     "--enable-libkeymap"
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
index daa8c1ae2019..83ad463239a1 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -1,11 +1,34 @@
 { stdenvNoCC, lib, buildPackages, fetchurl, perl, elf-header
-, bison ? null, flex ? null, python ? null, rsync ? null
+, bison, flex, rsync
+, writeTextFile
 }:
 
-assert stdenvNoCC.hostPlatform.isAndroid ->
-  (flex != null && bison != null && python != null && rsync != null);
-
 let
+
+  # As part of building a hostPlatform=mips kernel, Linux creates and runs a
+  # tiny utility `arch/mips/boot/tools/relocs_main.c` for the buildPlatform.
+  # This utility references a glibc-specific header `byteswap.h`.  There is a
+  # compatibility header in gnulib for most BSDs, but not for Darwin, so we
+  # synthesize one here.
+  darwin-endian-h = writeTextFile {
+    name = "endian-h";
+    text = ''
+      #include <byteswap.h>
+    '';
+    destination = "/include/endian.h";
+  };
+  darwin-byteswap-h = writeTextFile {
+    name = "byteswap-h";
+    text = ''
+      #pragma once
+      #include <libkern/OSByteOrder.h>
+      #define bswap_16 OSSwapInt16
+      #define bswap_32 OSSwapInt32
+      #define bswap_64 OSSwapInt64
+    '';
+    destination = "/include/byteswap.h";
+  };
+
   makeLinuxHeaders = { src, version, patches ? [] }: stdenvNoCC.mkDerivation {
     inherit src;
 
@@ -24,10 +47,14 @@ let
     nativeBuildInputs = [
       perl elf-header
     ] ++ lib.optionals stdenvNoCC.hostPlatform.isAndroid [
-      flex bison python rsync
+      bison flex rsync
+    ] ++ lib.optionals (stdenvNoCC.buildPlatform.isDarwin &&
+                        stdenvNoCC.hostPlatform.isMips) [
+      darwin-endian-h
+      darwin-byteswap-h
     ];
 
-    extraIncludeDirs = lib.optional (with stdenvNoCC.hostPlatform; isPower && is32bit && isBigEndian) ["ppc"];
+    extraIncludeDirs = lib.optionals (with stdenvNoCC.hostPlatform; isPower && is32bit && isBigEndian) ["ppc"];
 
     inherit patches;
 
@@ -84,12 +111,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.19"; in
+  linuxHeaders = let version = "6.3"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
-        url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "1a05a3hw4w3k530mxhns96xw7hag743xw5w967yazqcykdbhq97z";
+        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+        hash = "sha256-ujSR9e1r0nCjcMRAQ049aQhfzdUoki+gHnPXZX23Ox4=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index a859d7eea4f1..44997740aea3 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -36,10 +36,7 @@ let
 
     debug = {
       # Necessary for BTF
-      DEBUG_INFO                = mkMerge [
-        (whenOlder "5.2" (if (features.debug or false) then yes else no))
-        (whenBetween "5.2" "5.18" yes)
-      ];
+      DEBUG_INFO                = yes;
       DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
       # Reduced debug info conflict with BTF and have been enabled in
       # aarch64 defconfig since 5.13
@@ -53,10 +50,7 @@ let
       DEBUG_KERNEL              = yes;
       DEBUG_DEVRES              = no;
       DYNAMIC_DEBUG             = yes;
-      TIMER_STATS               = whenOlder "4.11" yes;
-      DEBUG_NX_TEST             = whenOlder "4.11" no;
       DEBUG_STACK_USAGE         = no;
-      DEBUG_STACKOVERFLOW       = option no;
       RCU_TORTURE_TEST          = no;
       SCHEDSTATS                = no;
       DETECT_HUNG_TASK          = yes;
@@ -65,6 +59,8 @@ let
       SUNRPC_DEBUG              = yes;
       # Provide access to tunables like sched_migration_cost_ns
       SCHED_DEBUG               = yes;
+
+      GDB_SCRIPTS               = yes;
     };
 
     power-management = {
@@ -73,11 +69,29 @@ let
       PM_ADVANCED_DEBUG                = yes;
       PM_WAKELOCKS                     = yes;
       POWERCAP                         = yes;
+      # ACPI Firmware Performance Data Table Support
+      ACPI_FPDT                        = whenAtLeast "5.12" (option yes);
+      # ACPI Heterogeneous Memory Attribute Table Support
+      ACPI_HMAT                        = whenAtLeast "5.2" (option yes);
+      # ACPI Platform Error Interface
+      ACPI_APEI                        = (option yes);
+      # APEI Generic Hardware Error Source
+      ACPI_APEI_GHES                   = (option yes);
+
+      # Enable lazy RCUs for power savings:
+      # https://lore.kernel.org/rcu/20221019225138.GA2499943@paulmck-ThinkPad-P17-Gen-1/
+      # RCU_LAZY depends on RCU_NOCB_CPU depends on NO_HZ_FULL
+      # depends on HAVE_VIRT_CPU_ACCOUNTING_GEN depends on 64BIT,
+      # so we can't force-enable this
+      RCU_LAZY                         = whenAtLeast "6.2" (option yes);
     } // optionalAttrs (stdenv.hostPlatform.isx86) {
       INTEL_IDLE                       = yes;
       INTEL_RAPL                       = whenAtLeast "5.3" module;
       X86_INTEL_LPSS                   = yes;
       X86_INTEL_PSTATE                 = yes;
+      X86_AMD_PSTATE                   = whenAtLeast "5.17" yes;
+      # Intel DPTF (Dynamic Platform and Thermal Framework) Support
+      ACPI_DPTF                        = whenAtLeast "5.10" yes;
     };
 
     external-firmware = {
@@ -108,10 +122,17 @@ let
       BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes;
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
-      MQ_IOSCHED_DEADLINE = whenAtLeast "4.11" yes;
-      BFQ_GROUP_IOSCHED = whenAtLeast "4.12" yes;
-      MQ_IOSCHED_KYBER = whenAtLeast "4.12" yes;
-      IOSCHED_BFQ = whenAtLeast "4.12" module;
+      MQ_IOSCHED_DEADLINE = yes;
+      BFQ_GROUP_IOSCHED = yes;
+      MQ_IOSCHED_KYBER = yes;
+      IOSCHED_BFQ = module;
+    };
+
+
+    timer = {
+      # Enable Full Dynticks System.
+      # NO_HZ_FULL depends on HAVE_VIRT_CPU_ACCOUNTING_GEN depends on 64BIT
+      NO_HZ_FULL = mkIf stdenv.is64bit yes;
     };
 
     # Enable NUMA.
@@ -157,8 +178,8 @@ let
       IPV6_MROUTE_MULTIPLE_TABLES = yes;
       IPV6_PIMSM_V2               = yes;
       IPV6_FOU_TUNNEL             = module;
-      IPV6_SEG6_LWTUNNEL          = whenAtLeast "4.10" yes;
-      IPV6_SEG6_HMAC              = whenAtLeast "4.10" yes;
+      IPV6_SEG6_LWTUNNEL          = yes;
+      IPV6_SEG6_HMAC              = yes;
       IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
       NET_CLS_BPF                 = module;
       NET_ACT_BPF                 = module;
@@ -215,7 +236,7 @@ let
       INET_DIAG         = mkDefault module;
       INET_TCP_DIAG     = mkDefault module;
       INET_UDP_DIAG     = mkDefault module;
-      INET_RAW_DIAG     = whenAtLeast "4.14" (mkDefault module);
+      INET_RAW_DIAG     = mkDefault module;
       INET_DIAG_DESTROY = mkDefault yes;
 
       # enable multipath-tcp
@@ -224,7 +245,7 @@ let
       INET_MPTCP_DIAG = whenAtLeast "5.9" (mkDefault module);
 
       # Kernel TLS
-      TLS         = whenAtLeast "4.13" module;
+      TLS         = module;
       TLS_DEVICE  = whenAtLeast "4.18" yes;
 
       # infiniband
@@ -269,14 +290,26 @@ let
       DRM_SIMPLEDRM = whenAtLeast "5.14" no;
     };
 
+    fonts = {
+      FONTS = yes;
+      # Default fonts enabled if FONTS is not set
+      FONT_8x8 = yes;
+      FONT_8x16 = yes;
+      # High DPI font
+      FONT_TER16x32 = whenAtLeast "5.0" yes;
+    };
+
     video = {
+      DRM_LEGACY = no;
+      NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
+
       # Allow specifying custom EDID on the kernel command line
       DRM_LOAD_EDID_FIRMWARE = yes;
       VGA_SWITCHEROO         = yes; # Hybrid graphics support
       DRM_GMA500             = whenAtLeast "5.12" module;
       DRM_GMA600             = whenOlder "5.13" yes;
       DRM_GMA3600            = whenOlder "5.12" yes;
-      DRM_VMWGFX_FBCON       = yes;
+      DRM_VMWGFX_FBCON       = whenOlder "6.2" yes;
       # (experimental) amdgpu support for verde and newer chipsets
       DRM_AMDGPU_SI = yes;
       # (stable) amdgpu support for bonaire and newer chipsets
@@ -289,16 +322,19 @@ let
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
-      DRM_AMD_DC_DCN = whenAtLeast "5.11" yes;
-      DRM_AMD_DC_HDCP = whenAtLeast "5.5" yes;
+      DRM_AMD_DC_DCN = whenBetween "5.11" "6.4" yes;
+      DRM_AMD_DC_FP = whenAtLeast "6.4" yes;
+      DRM_AMD_DC_HDCP = whenBetween "5.5" "6.4" yes;
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
       DRM_I915_GVT = whenAtLeast "4.16" yes;
       DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module;
+      # Enable Hyper-V Synthetic DRM Driver
+      DRM_HYPERV = whenAtLeast "5.14" module;
     } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
       # enable HDMI-CEC on RPi boards
-      DRM_VC4_HDMI_CEC = whenAtLeast "4.14" yes;
+      DRM_VC4_HDMI_CEC = yes;
     };
 
     sound = {
@@ -311,8 +347,6 @@ let
       SND_HDA_CODEC_CA0132_DSP = whenOlder "5.7" yes; # Enable DSP firmware loading on Creative Soundblaster Z/Zx/ZxR/Recon
       SND_OSSEMUL         = yes;
       SND_USB_CAIAQ_INPUT = yes;
-      # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
-      PSS_MIXER           = whenOlder "4.12" yes;
     # Enable Sound Open Firmware support
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" &&
                         versionAtLeast version "5.5") {
@@ -378,10 +412,12 @@ let
     # Filesystem options - in particular, enable extended attributes and
     # ACLs for all filesystems that support them.
     filesystem = {
-      FANOTIFY        = yes;
+      FANOTIFY                    = yes;
+      FANOTIFY_ACCESS_PERMISSIONS = yes;
+
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else option module;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -392,7 +428,11 @@ let
 
       EXT4_FS_POSIX_ACL = yes;
       EXT4_FS_SECURITY  = yes;
-      EXT4_ENCRYPTION   = option yes;
+      EXT4_ENCRYPTION   = whenOlder "5.1" yes;
+
+      NTFS_FS            = whenAtLeast "5.15" no;
+      NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
+      NTFS3_FS_POSIX_ACL = whenAtLeast "5.15" yes;
 
       REISERFS_FS_XATTR     = option yes;
       REISERFS_FS_POSIX_ACL = option yes;
@@ -404,6 +444,7 @@ let
       XFS_QUOTA     = option yes;
       XFS_POSIX_ACL = option yes;
       XFS_RT        = option yes; # XFS Realtime subvolume support
+      XFS_ONLINE_SCRUB = option yes;
 
       OCFS2_DEBUG_MASKLOG = option no;
 
@@ -413,11 +454,11 @@ let
 
       F2FS_FS             = module;
       F2FS_FS_SECURITY    = option yes;
-      F2FS_FS_ENCRYPTION  = option yes;
+      F2FS_FS_ENCRYPTION  = whenOlder "5.1" yes;
       F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
       UDF_FS              = module;
 
-      NFSD_V2_ACL            = yes;
+      NFSD_V2_ACL            = whenOlder "6.2" yes;
       NFSD_V3                = whenOlder "5.18" yes;
       NFSD_V3_ACL            = yes;
       NFSD_V4                = yes;
@@ -438,19 +479,18 @@ let
       CIFS_UPCALL       = yes;
       CIFS_ACL          = whenOlder "5.3" yes;
       CIFS_DFS_UPCALL   = yes;
-      CIFS_SMB2         = whenOlder "4.13" yes;
 
       CEPH_FSCACHE      = yes;
       CEPH_FS_POSIX_ACL = yes;
 
       SQUASHFS_FILE_DIRECT         = yes;
-      SQUASHFS_DECOMP_MULTI_PERCPU = yes;
+      SQUASHFS_DECOMP_MULTI_PERCPU = whenOlder "6.2" yes;
       SQUASHFS_XATTR               = yes;
       SQUASHFS_ZLIB                = yes;
       SQUASHFS_LZO                 = yes;
       SQUASHFS_XZ                  = yes;
       SQUASHFS_LZ4                 = yes;
-      SQUASHFS_ZSTD                = whenAtLeast "4.14" yes;
+      SQUASHFS_ZSTD                = yes;
 
       # Native Language Support modules, needed by some filesystems
       NLS              = yes;
@@ -468,12 +508,11 @@ let
     };
 
     security = {
-      FORTIFY_SOURCE                   = whenAtLeast "4.13" (option yes);
+      FORTIFY_SOURCE                   = option yes;
 
       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
       DEBUG_LIST                       = yes;
-      # Detect writes to read-only module pages
-      DEBUG_SET_MODULE_RONX            = whenOlder "4.11" (option yes);
+      HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
@@ -490,13 +529,18 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
-      RANDOM_TRUST_CPU                 = whenAtLeast "4.19" yes; # allow RDRAND to seed the RNG
-      RANDOM_TRUST_BOOTLOADER          = whenAtLeast "5.4" yes; # allow the bootloader to seed the RNG
+      RANDOM_TRUST_CPU                 = whenOlder "6.2" (whenAtLeast "4.19" yes); # allow RDRAND to seed the RNG
+      RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
       # Depends on MODULE_SIG and only really helps when you sign your modules
       # and enforce signatures which we don't do by default.
-      SECURITY_LOCKDOWN_LSM = option no;
+      SECURITY_LOCKDOWN_LSM = whenAtLeast "5.4" no;
+
+      # provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis
+      PERSISTENT_KEYRINGS              = yes;
+      # enable temporary caching of the last request_key() result
+      KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
     } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
 
       # Detect buffer overflows on the stack
@@ -506,13 +550,21 @@ let
       X86_SGX     = whenAtLeast "5.11" yes;
       # Allow KVM guests to load SGX enclaves
       X86_SGX_KVM = whenAtLeast "5.13" yes;
+
+      # AMD Cryptographic Coprocessor (CCP)
+      CRYPTO_DEV_CCP  = yes;
+      # AMD SME
+      AMD_MEM_ENCRYPT = yes;
+      # AMD SEV and AMD SEV-SE
+      KVM_AMD_SEV     = whenAtLeast "4.16" yes;
+      # AMD SEV-SNP
+      SEV_GUEST       = whenAtLeast "5.19" module;
     };
 
     microcode = {
       MICROCODE       = yes;
       MICROCODE_INTEL = yes;
       MICROCODE_AMD   = yes;
-    } // optionalAttrs (versionAtLeast version "4.10") {
       # Write Back Throttling
       # https://lwn.net/Articles/682582/
       # https://bugzilla.kernel.org/show_bug.cgi?id=12309#c655
@@ -527,10 +579,10 @@ let
       CGROUP_DEVICE  = yes;
       CGROUP_HUGETLB = yes;
       CGROUP_PERF    = yes;
-      CGROUP_RDMA    = whenAtLeast "4.11" yes;
+      CGROUP_RDMA    = yes;
 
       MEMCG                    = yes;
-      MEMCG_SWAP               = yes;
+      MEMCG_SWAP               = whenOlder "6.1" yes;
 
       BLK_DEV_THROTTLING        = yes;
       CFQ_GROUP_IOSCHED         = whenOlder "5.0" yes; # Removed in 5.0-RC1
@@ -557,8 +609,7 @@ let
       FTRACE_SYSCALLS       = yes;
       SCHED_TRACER          = yes;
       STACK_TRACER          = yes;
-      UPROBE_EVENT          = { optional = true; tristate = whenOlder "4.11" "y";};
-      UPROBE_EVENTS         = { optional = true; tristate = whenAtLeast "4.11" "y";};
+      UPROBE_EVENTS         = option yes;
       BPF_SYSCALL           = yes;
       BPF_UNPRIV_DEFAULT_OFF = whenBetween "5.10" "5.16" yes;
       BPF_EVENTS            = yes;
@@ -573,8 +624,6 @@ let
       PARAVIRT_SPINLOCKS  = option yes;
 
       KVM_ASYNC_PF                      = yes;
-      KVM_COMPAT                        = whenOlder "4.12" (option yes);
-      KVM_DEVICE_ASSIGNMENT             = whenOlder "4.12" (option yes);
       KVM_GENERIC_DIRTYLOG_READ_PROTECT = yes;
       KVM_GUEST                         = yes;
       KVM_MMIO                          = yes;
@@ -608,22 +657,21 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SCRUB_PAGES             = option yes;
-      XEN_SELFBALLOONING          = option yes;
-      XEN_STUB                    = option yes;
-      XEN_TMEM                    = option yes;
+      XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
+      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
+
+      # Enable device detection on virtio-mmio hypervisors
+      VIRTIO_MMIO_CMDLINE_DEVICES = yes;
     };
 
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
       MEDIA_CAMERA_SUPPORT     = yes;
-      MEDIA_RC_SUPPORT         = whenOlder "4.14" yes;
       MEDIA_CONTROLLER         = yes;
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
       MEDIA_ANALOG_TV_SUPPORT  = yes;
       VIDEO_STK1160_COMMON     = module;
-      VIDEO_STK1160_AC97       = whenOlder "4.11" yes;
     };
 
     "9p" = {
@@ -639,10 +687,11 @@ let
     };
 
     zram = {
-      ZRAM     = module;
-      ZSWAP    = option yes;
-      ZBUD     = option yes;
-      ZSMALLOC = module;
+      ZRAM           = module;
+      ZRAM_WRITEBACK = option yes;
+      ZSWAP          = option yes;
+      ZBUD           = option yes;
+      ZSMALLOC       = module;
     };
 
     brcmfmac = {
@@ -698,7 +747,8 @@ let
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST            = option no;
+      RCU_PERF_TEST            = whenOlder "5.9" no;
+      RCU_SCALE_TEST           = whenAtLeast "5.10" no;
       RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
       WW_MUTEX_SELFTEST        = option no;
@@ -739,7 +789,7 @@ let
       DRAGONRISE_FF      = yes;
       GREENASIA_FF       = yes;
       HOLTEK_FF          = yes;
-      JOYSTICK_PSXPAD_SPI_FF = whenAtLeast "4.14" yes;
+      JOYSTICK_PSXPAD_SPI_FF = yes;
       LOGIG940_FF        = yes;
       NINTENDO_FF        = whenAtLeast "5.16" yes;
       PLAYSTATION_FF     = whenAtLeast "5.12" yes;
@@ -785,16 +835,16 @@ let
 
       BLK_DEV_INTEGRITY       = yes;
 
-      BLK_SED_OPAL = whenAtLeast "4.14" yes;
+      BLK_SED_OPAL = yes;
 
       BSD_PROCESS_ACCT_V3 = yes;
 
-      SERIAL_DEV_BUS = whenAtLeast "4.11" yes; # enables support for serial devices
-      SERIAL_DEV_CTRL_TTYPORT = whenAtLeast "4.11" yes; # enables support for TTY serial devices
+      SERIAL_DEV_BUS = yes; # enables support for serial devices
+      SERIAL_DEV_CTRL_TTYPORT = yes; # enables support for TTY serial devices
 
       BT_HCIBTUSB_MTK = whenAtLeast "5.3" yes; # MediaTek protocol support
       BT_HCIUART_QCA = yes; # Qualcomm Atheros protocol support
-      BT_HCIUART_SERDEV = whenAtLeast "4.12" yes; # required by BT_HCIUART_QCA
+      BT_HCIUART_SERDEV = yes; # required by BT_HCIUART_QCA
       BT_HCIUART = module; # required for BT devices with serial port interface (QCA6390)
       BT_HCIUART_BCSP = option yes;
       BT_HCIUART_H4   = option yes; # UART (H4) protocol support
@@ -811,7 +861,7 @@ let
 
       EFI_STUB            = yes; # EFI bootloader in the bzImage itself
       EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER =
-          whenAtLeast "5.8" yes; # initrd kernel parameter for EFI
+          whenOlder "6.2" (whenAtLeast "5.8" yes); # initrd kernel parameter for EFI
       CGROUPS             = yes; # used by systemd
       FHANDLE             = yes; # used by systemd
       SECCOMP             = yes; # used by systemd >= 231
@@ -864,6 +914,7 @@ let
 
       REGULATOR  = yes; # Voltage and Current Regulator Support
       RC_DEVICES = option yes; # Enable IR devices
+      RC_DECODERS = option yes; # Required for IR devices to work
 
       RT2800USB_RT53XX = yes;
       RT2800USB_RT55XX = yes;
@@ -874,6 +925,9 @@ let
       SCSI_LOGGING = yes; # SCSI logging facility
       SERIAL_8250  = yes; # 8250/16550 and compatible serial support
 
+      SLAB_FREELIST_HARDENED = yes;
+      SLAB_FREELIST_RANDOM   = yes;
+
       SLIP_COMPRESSED = yes; # CSLIP compressed headers
       SLIP_SMART      = yes;
 
@@ -917,10 +971,13 @@ let
 
       SCHED_CORE = whenAtLeast "5.14" yes;
 
+      LRU_GEN = whenAtLeast "6.1"  yes;
+      LRU_GEN_ENABLED =  whenAtLeast "6.1" yes;
+
       FSL_MC_UAPI_SUPPORT = mkIf (stdenv.hostPlatform.system == "aarch64-linux") (whenAtLeast "5.12" yes);
 
       ASHMEM =                 { optional = true; tristate = whenBetween "5.0" "5.18" "y";};
-      ANDROID =                { optional = true; tristate = whenAtLeast "5.0" "y";};
+      ANDROID =                { optional = true; tristate = whenBetween "5.0" "5.19" "y";};
       ANDROID_BINDER_IPC =     { optional = true; tristate = whenAtLeast "5.0" "y";};
       ANDROID_BINDERFS =       { optional = true; tristate = whenAtLeast "5.0" "y";};
       ANDROID_BINDER_DEVICES = { optional = true; freeform = whenAtLeast "5.0" "binder,hwbinder,vndbinder";};
@@ -948,7 +1005,7 @@ let
       NR_CPUS = freeform "384";
     } // optionalAttrs (stdenv.hostPlatform.system == "armv7l-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enables support for the Allwinner Display Engine 2.0
-      SUN8I_DE2_CCU = whenAtLeast "4.13" yes;
+      SUN8I_DE2_CCU = yes;
 
       # See comments on https://github.com/NixOS/nixpkgs/commit/9b67ea9106102d882f53d62890468071900b9647
       CRYPTO_AEGIS128_SIMD = whenAtLeast "5.4" no;
@@ -977,6 +1034,8 @@ let
       CROS_EC_ISHTP = module;
 
       CROS_KBD_LED_BACKLIGHT = module;
+
+      TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
     } // optionalAttrs (versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
       CHROMEOS_LAPTOP = module;
       CHROMEOS_PSTORE = module;
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch b/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch
deleted file mode 100644
index 596718b83c43..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch
+++ /dev/null
@@ -1,784 +0,0 @@
-commit 280858b0bb3384b9ec06b455e196b453888bd6b8
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Misc preps for cgroup unified hierarchy interface
-    
-    Make the following changes in preparation for the cpu controller
-    interface implementation for the unified hierarchy.  This patch
-    doesn't cause any functional differences.
-    
-    * s/cpu_stats_show()/cpu_cfs_stats_show()/
-    
-    * s/cpu_files/cpu_legacy_files/
-    
-    * Separate out cpuacct_stats_read() from cpuacct_stats_show().  While
-      at it, make the @val array u64 for consistency.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 154fd689fe02..57472485b79c 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8705,7 +8705,7 @@ static int __cfs_schedulable(struct task_group *tg, u64 period, u64 quota)
- 	return ret;
- }
- 
--static int cpu_stats_show(struct seq_file *sf, void *v)
-+static int cpu_cfs_stats_show(struct seq_file *sf, void *v)
- {
- 	struct task_group *tg = css_tg(seq_css(sf));
- 	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-@@ -8745,7 +8745,7 @@ static u64 cpu_rt_period_read_uint(struct cgroup_subsys_state *css,
- }
- #endif /* CONFIG_RT_GROUP_SCHED */
- 
--static struct cftype cpu_files[] = {
-+static struct cftype cpu_legacy_files[] = {
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	{
- 		.name = "shares",
-@@ -8766,7 +8766,7 @@ static struct cftype cpu_files[] = {
- 	},
- 	{
- 		.name = "stat",
--		.seq_show = cpu_stats_show,
-+		.seq_show = cpu_cfs_stats_show,
- 	},
- #endif
- #ifdef CONFIG_RT_GROUP_SCHED
-@@ -8791,7 +8791,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.fork		= cpu_cgroup_fork,
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
--	.legacy_cftypes	= cpu_files,
-+	.legacy_cftypes	= cpu_legacy_files,
- 	.early_init	= true,
- };
- 
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index bc0b309c3f19..d1e5dd0b3a64 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -276,26 +276,33 @@ static int cpuacct_all_seq_show(struct seq_file *m, void *V)
- 	return 0;
- }
- 
--static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+static void cpuacct_stats_read(struct cpuacct *ca,
-+			       u64 (*val)[CPUACCT_STAT_NSTATS])
- {
--	struct cpuacct *ca = css_ca(seq_css(sf));
--	s64 val[CPUACCT_STAT_NSTATS];
- 	int cpu;
--	int stat;
- 
--	memset(val, 0, sizeof(val));
-+	memset(val, 0, sizeof(*val));
-+
- 	for_each_possible_cpu(cpu) {
- 		u64 *cpustat = per_cpu_ptr(ca->cpustat, cpu)->cpustat;
- 
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
- 	}
-+}
-+
-+static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+{
-+	u64 val[CPUACCT_STAT_NSTATS];
-+	int stat;
-+
-+	cpuacct_stats_read(css_ca(seq_css(sf)), &val);
- 
- 	for (stat = 0; stat < CPUACCT_STAT_NSTATS; stat++) {
--		seq_printf(sf, "%s %lld\n",
-+		seq_printf(sf, "%s %llu\n",
- 			   cpuacct_stat_desc[stat],
- 			   cputime64_to_clock_t(val[stat]));
- 	}
-
-commit 015cbdcb90034fd566d00de9d3d405613da3cd26
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Implement interface for cgroup unified hierarchy
-    
-    While the cpu controller doesn't have any functional problems, there
-    are a couple interface issues which can be addressed in the v2
-    interface.
-    
-    * cpuacct being a separate controller.  This separation is artificial
-      and rather pointless as demonstrated by most use cases co-mounting
-      the two controllers.  It also forces certain information to be
-      accounted twice.
-    
-    * Use of different time units.  Writable control knobs use
-      microseconds, some stat fields use nanoseconds while other cpuacct
-      stat fields use centiseconds.
-    
-    * Control knobs which can't be used in the root cgroup still show up
-      in the root.
-    
-    * Control knob names and semantics aren't consistent with other
-      controllers.
-    
-    This patchset implements cpu controller's interface on the unified
-    hierarchy which adheres to the controller file conventions described
-    in Documentation/cgroups/unified-hierarchy.txt.  Overall, the
-    following changes are made.
-    
-    * cpuacct is implictly enabled and disabled by cpu and its information
-      is reported through "cpu.stat" which now uses microseconds for all
-      time durations.  All time duration fields now have "_usec" appended
-      to them for clarity.  While this doesn't solve the double accounting
-      immediately, once majority of users switch to v2, cpu can directly
-      account and report the relevant stats and cpuacct can be disabled on
-      the unified hierarchy.
-    
-      Note that cpuacct.usage_percpu is currently not included in
-      "cpu.stat".  If this information is actually called for, it can be
-      added later.
-    
-    * "cpu.shares" is replaced with "cpu.weight" and operates on the
-      standard scale defined by CGROUP_WEIGHT_MIN/DFL/MAX (1, 100, 10000).
-      The weight is scaled to scheduler weight so that 100 maps to 1024
-      and the ratio relationship is preserved - if weight is W and its
-      scaled value is S, W / 100 == S / 1024.  While the mapped range is a
-      bit smaller than the orignal scheduler weight range, the dead zones
-      on both sides are relatively small and covers wider range than the
-      nice value mappings.  This file doesn't make sense in the root
-      cgroup and isn't create on root.
-    
-    * "cpu.cfs_quota_us" and "cpu.cfs_period_us" are replaced by "cpu.max"
-      which contains both quota and period.
-    
-    * "cpu.rt_runtime_us" and "cpu.rt_period_us" are replaced by
-      "cpu.rt.max" which contains both runtime and period.
-    
-    v2: cpu_stats_show() was incorrectly using CONFIG_FAIR_GROUP_SCHED for
-        CFS bandwidth stats and also using raw division for u64.  Use
-        CONFIG_CFS_BANDWITH and do_div() instead.
-    
-        The semantics of "cpu.rt.max" is not fully decided yet.  Dropped
-        for now.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 57472485b79c..c0ae869f51c4 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8784,6 +8784,139 @@ static struct cftype cpu_legacy_files[] = {
- 	{ }	/* terminate */
- };
- 
-+static int cpu_stats_show(struct seq_file *sf, void *v)
-+{
-+	cpuacct_cpu_stats_show(sf);
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		struct task_group *tg = css_tg(seq_css(sf));
-+		struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-+		u64 throttled_usec;
-+
-+		throttled_usec = cfs_b->throttled_time;
-+		do_div(throttled_usec, NSEC_PER_USEC);
-+
-+		seq_printf(sf, "nr_periods %d\n"
-+			   "nr_throttled %d\n"
-+			   "throttled_usec %llu\n",
-+			   cfs_b->nr_periods, cfs_b->nr_throttled,
-+			   throttled_usec);
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+static u64 cpu_weight_read_u64(struct cgroup_subsys_state *css,
-+			       struct cftype *cft)
-+{
-+	struct task_group *tg = css_tg(css);
-+	u64 weight = scale_load_down(tg->shares);
-+
-+	return DIV_ROUND_CLOSEST_ULL(weight * CGROUP_WEIGHT_DFL, 1024);
-+}
-+
-+static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
-+				struct cftype *cftype, u64 weight)
-+{
-+	/*
-+	 * cgroup weight knobs should use the common MIN, DFL and MAX
-+	 * values which are 1, 100 and 10000 respectively.  While it loses
-+	 * a bit of range on both ends, it maps pretty well onto the shares
-+	 * value used by scheduler and the round-trip conversions preserve
-+	 * the original value over the entire range.
-+	 */
-+	if (weight < CGROUP_WEIGHT_MIN || weight > CGROUP_WEIGHT_MAX)
-+		return -ERANGE;
-+
-+	weight = DIV_ROUND_CLOSEST_ULL(weight * 1024, CGROUP_WEIGHT_DFL);
-+
-+	return sched_group_set_shares(css_tg(css), scale_load(weight));
-+}
-+#endif
-+
-+static void __maybe_unused cpu_period_quota_print(struct seq_file *sf,
-+						  long period, long quota)
-+{
-+	if (quota < 0)
-+		seq_puts(sf, "max");
-+	else
-+		seq_printf(sf, "%ld", quota);
-+
-+	seq_printf(sf, " %ld\n", period);
-+}
-+
-+/* caller should put the current value in *@periodp before calling */
-+static int __maybe_unused cpu_period_quota_parse(char *buf,
-+						 u64 *periodp, u64 *quotap)
-+{
-+	char tok[21];	/* U64_MAX */
-+
-+	if (!sscanf(buf, "%s %llu", tok, periodp))
-+		return -EINVAL;
-+
-+	*periodp *= NSEC_PER_USEC;
-+
-+	if (sscanf(tok, "%llu", quotap))
-+		*quotap *= NSEC_PER_USEC;
-+	else if (!strcmp(tok, "max"))
-+		*quotap = RUNTIME_INF;
-+	else
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+static int cpu_max_show(struct seq_file *sf, void *v)
-+{
-+	struct task_group *tg = css_tg(seq_css(sf));
-+
-+	cpu_period_quota_print(sf, tg_get_cfs_period(tg), tg_get_cfs_quota(tg));
-+	return 0;
-+}
-+
-+static ssize_t cpu_max_write(struct kernfs_open_file *of,
-+			     char *buf, size_t nbytes, loff_t off)
-+{
-+	struct task_group *tg = css_tg(of_css(of));
-+	u64 period = tg_get_cfs_period(tg);
-+	u64 quota;
-+	int ret;
-+
-+	ret = cpu_period_quota_parse(buf, &period, &quota);
-+	if (!ret)
-+		ret = tg_set_cfs_bandwidth(tg, period, quota);
-+	return ret ?: nbytes;
-+}
-+#endif
-+
-+static struct cftype cpu_files[] = {
-+	{
-+		.name = "stat",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_stats_show,
-+	},
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+	{
-+		.name = "weight",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.read_u64 = cpu_weight_read_u64,
-+		.write_u64 = cpu_weight_write_u64,
-+	},
-+#endif
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		.name = "max",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_max_show,
-+		.write = cpu_max_write,
-+	},
-+#endif
-+	{ }	/* terminate */
-+};
-+
- struct cgroup_subsys cpu_cgrp_subsys = {
- 	.css_alloc	= cpu_cgroup_css_alloc,
- 	.css_released	= cpu_cgroup_css_released,
-@@ -8792,7 +8925,15 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
- 	.legacy_cftypes	= cpu_legacy_files,
-+	.dfl_cftypes	= cpu_files,
- 	.early_init	= true,
-+#ifdef CONFIG_CGROUP_CPUACCT
-+	/*
-+	 * cpuacct is enabled together with cpu on the unified hierarchy
-+	 * and its stats are reported through "cpu.stat".
-+	 */
-+	.depends_on	= 1 << cpuacct_cgrp_id,
-+#endif
- };
- 
- #endif	/* CONFIG_CGROUP_SCHED */
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index d1e5dd0b3a64..57f390514c39 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -347,6 +347,31 @@ static struct cftype files[] = {
- 	{ }	/* terminate */
- };
- 
-+/* used to print cpuacct stats in cpu.stat on the unified hierarchy */
-+void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+	struct cgroup_subsys_state *css;
-+	u64 usage, val[CPUACCT_STAT_NSTATS];
-+
-+	css = cgroup_get_e_css(seq_css(sf)->cgroup, &cpuacct_cgrp_subsys);
-+
-+	usage = cpuusage_read(css, seq_cft(sf));
-+	cpuacct_stats_read(css_ca(css), &val);
-+
-+	val[CPUACCT_STAT_USER] *= TICK_NSEC;
-+	val[CPUACCT_STAT_SYSTEM] *= TICK_NSEC;
-+	do_div(usage, NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_USER], NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_SYSTEM], NSEC_PER_USEC);
-+
-+	seq_printf(sf, "usage_usec %llu\n"
-+		   "user_usec %llu\n"
-+		   "system_usec %llu\n",
-+		   usage, val[CPUACCT_STAT_USER], val[CPUACCT_STAT_SYSTEM]);
-+
-+	css_put(css);
-+}
-+
- /*
-  * charge this task's execution time to its accounting group.
-  *
-diff --git a/kernel/sched/cpuacct.h b/kernel/sched/cpuacct.h
-index ba72807c73d4..ddf7af466d35 100644
---- a/kernel/sched/cpuacct.h
-+++ b/kernel/sched/cpuacct.h
-@@ -2,6 +2,7 @@
- 
- extern void cpuacct_charge(struct task_struct *tsk, u64 cputime);
- extern void cpuacct_account_field(struct task_struct *tsk, int index, u64 val);
-+extern void cpuacct_cpu_stats_show(struct seq_file *sf);
- 
- #else
- 
-@@ -14,4 +15,8 @@ cpuacct_account_field(struct task_struct *tsk, int index, u64 val)
- {
- }
- 
-+static inline void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+}
-+
- #endif
-
-commit 5019fe3d7ec456b58d451ef06fe1f81d7d9f28a9
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Aug 5 12:41:01 2016 -0400
-
-    cgroup: add documentation regarding CPU controller cgroup v2 support
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-
-diff --git a/Documentation/cgroup-v2-cpu.txt b/Documentation/cgroup-v2-cpu.txt
-new file mode 100644
-index 000000000000..1ed7032d4472
---- /dev/null
-+++ b/Documentation/cgroup-v2-cpu.txt
-@@ -0,0 +1,368 @@
-+
-+
-+CPU Controller on Control Group v2
-+
-+August, 2016		Tejun Heo <tj@kernel.org>
-+
-+
-+While most controllers have support for cgroup v2 now, the CPU
-+controller support is not upstream yet due to objections from the
-+scheduler maintainers on the basic designs of cgroup v2.  This
-+document explains the current situation as well as an interim
-+solution, and details the disagreements and arguments.  The latest
-+version of this document can be found at the following URL.
-+
-+ https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
-+
-+This document was posted to the linux-kernel and cgroup mailing lists.
-+Unfortunately, no consensus was reached as of Oct, 2016.  The thread
-+can be found at the following URL.
-+
-+ http://lkml.kernel.org/r/20160805170752.GK2542@mtj.duckdns.org
-+
-+
-+CONTENTS
-+
-+1. Current Situation and Interim Solution
-+2. Disagreements and Arguments
-+  2-1. Contentious Restrictions
-+    2-1-1. Process Granularity
-+    2-1-2. No Internal Process Constraint
-+  2-2. Impact on CPU Controller
-+    2-2-1. Impact of Process Granularity
-+    2-2-2. Impact of No Internal Process Constraint
-+  2-3. Arguments for cgroup v2
-+3. Way Forward
-+4. References
-+
-+
-+1. Current Situation and Interim Solution
-+
-+All objections from the scheduler maintainers apply to cgroup v2 core
-+design, and there are no known objections to the specifics of the CPU
-+controller cgroup v2 interface.  The only blocked part is changes to
-+expose the CPU controller interface on cgroup v2, which comprises the
-+following two patches:
-+
-+ [1] sched: Misc preps for cgroup unified hierarchy interface
-+ [2] sched: Implement interface for cgroup unified hierarchy
-+
-+The necessary changes are superficial and implement the interface
-+files on cgroup v2.  The combined diffstat is as follows.
-+
-+ kernel/sched/core.c    |  149 +++++++++++++++++++++++++++++++++++++++++++++++--
-+ kernel/sched/cpuacct.c |   57 ++++++++++++------
-+ kernel/sched/cpuacct.h |    5 +
-+ 3 files changed, 189 insertions(+), 22 deletions(-)
-+
-+The patches are easy to apply and forward-port.  The following git
-+branch will always carry the two patches on top of the latest release
-+of the upstream kernel.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu
-+
-+There also are versioned branches going back to v4.4.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu-$KERNEL_VER
-+
-+While it's difficult to tell whether the CPU controller support will
-+be merged, there are crucial resource control features in cgroup v2
-+that are only possible due to the design choices that are being
-+objected to, and every effort will be made to ease enabling the CPU
-+controller cgroup v2 support out-of-tree for parties which choose to.
-+
-+
-+2. Disagreements and Arguments
-+
-+There have been several lengthy discussion threads [3][4] on LKML
-+around the structural constraints of cgroup v2.  The two that affect
-+the CPU controller are process granularity and no internal process
-+constraint.  Both arise primarily from the need for common resource
-+domain definition across different resources.
-+
-+The common resource domain is a powerful concept in cgroup v2 that
-+allows controllers to make basic assumptions about the structural
-+organization of processes and controllers inside the cgroup hierarchy,
-+and thus solve problems spanning multiple types of resources.  The
-+prime example for this is page cache writeback: dirty page cache is
-+regulated through throttling buffered writers based on memory
-+availability, and initiating batched write outs to the disk based on
-+IO capacity.  Tracking and controlling writeback inside a cgroup thus
-+requires the direct cooperation of the memory and the IO controller.
-+
-+This easily extends to other areas, such as CPU cycles consumed while
-+performing memory reclaim or IO encryption.
-+
-+
-+2-1. Contentious Restrictions
-+
-+For controllers of different resources to work together, they must
-+agree on a common organization.  This uniform model across controllers
-+imposes two contentious restrictions on the CPU controller: process
-+granularity and the no-internal-process constraint.
-+
-+
-+  2-1-1. Process Granularity
-+
-+  For memory, because an address space is shared between all threads
-+  of a process, the terminal consumer is a process, not a thread.
-+  Separating the threads of a single process into different memory
-+  control domains doesn't make semantical sense.  cgroup v2 ensures
-+  that all controller can agree on the same organization by requiring
-+  that threads of the same process belong to the same cgroup.
-+
-+  There are other reasons to enforce process granularity.  One
-+  important one is isolating system-level management operations from
-+  in-process application operations.  The cgroup interface, being a
-+  virtual filesystem, is very unfit for multiple independent
-+  operations taking place at the same time as most operations have to
-+  be multi-step and there is no way to synchronize multiple accessors.
-+  See also [5] Documentation/cgroup-v2.txt, "R-2. Thread Granularity"
-+
-+
-+  2-1-2. No Internal Process Constraint
-+
-+  cgroup v2 does not allow processes to belong to any cgroup which has
-+  child cgroups when resource controllers are enabled on it (the
-+  notable exception being the root cgroup itself).  This is because,
-+  for some resources, a resource domain (cgroup) is not directly
-+  comparable to the terminal consumer (process/task) of said resource,
-+  and so putting the two into a sibling relationship isn't meaningful.
-+
-+  - Differing Control Parameters and Capabilities
-+
-+    A cgroup controller has different resource control parameters and
-+    capabilities from a terminal consumer, be that a task or process.
-+    There are a couple cases where a cgroup control knob can be mapped
-+    to a per-task or per-process API but they are exceptions and the
-+    mappings aren't obvious even in those cases.
-+
-+    For example, task priorities (also known as nice values) set
-+    through setpriority(2) are mapped to the CPU controller
-+    "cpu.shares" values.  However, how exactly the two ranges map and
-+    even the fact that they map to each other at all are not obvious.
-+
-+    The situation gets further muddled when considering other resource
-+    types and control knobs.  IO priorities set through ioprio_set(2)
-+    cannot be mapped to IO controller weights and most cgroup resource
-+    control knobs including the bandwidth control knobs of the CPU
-+    controller don't have counterparts in the terminal consumers.
-+
-+  - Anonymous Resource Consumption
-+
-+    For CPU, every time slice consumed from inside a cgroup, which
-+    comprises most but not all of consumed CPU time for the cgroup,
-+    can be clearly attributed to a specific task or process.  Because
-+    these two types of entities are directly comparable as consumers
-+    of CPU time, it's theoretically possible to mix tasks and cgroups
-+    on the same tree levels and let them directly compete for the time
-+    quota available to their common ancestor.
-+
-+    However, the same can't be said for resource types like memory or
-+    IO: the memory consumed by the page cache, for example, can be
-+    tracked on a per-cgroup level, but due to mismatches in lifetimes
-+    of involved objects (page cache can persist long after processes
-+    are gone), shared usages and the implementation overhead of
-+    tracking persistent state, it can no longer be attributed to
-+    individual processes after instantiation.  Consequently, any IO
-+    incurred by page cache writeback can be attributed to a cgroup,
-+    but not to the individual consumers inside the cgroup.
-+
-+  For memory and IO, this makes a resource domain (cgroup) an object
-+  of a fundamentally different type than a terminal consumer
-+  (process).  A process can't be a first class object in the resource
-+  distribution graph as its total resource consumption can't be
-+  described without the containing resource domain.
-+
-+  Disallowing processes in internal cgroups avoids competition between
-+  cgroups and processes which cannot be meaningfully defined for these
-+  resources.  All resource control takes place among cgroups and a
-+  terminal consumer interacts with the containing cgroup the same way
-+  it would with the system without cgroup.
-+
-+  Root cgroup is exempt from this constraint, which is in line with
-+  how root cgroup is handled in general - it's excluded from cgroup
-+  resource accounting and control.
-+
-+
-+Enforcing process granularity and no internal process constraint
-+allows all controllers to be on the same footing in terms of resource
-+distribution hierarchy.
-+
-+
-+2-2. Impact on CPU Controller
-+
-+As indicated earlier, the CPU controller's resource distribution graph
-+is the simplest.  Every schedulable resource consumption can be
-+attributed to a specific task.  In addition, for weight based control,
-+the per-task priority set through setpriority(2) can be translated to
-+and from a per-cgroup weight.  As such, the CPU controller can treat a
-+task and a cgroup symmetrically, allowing support for any tree layout
-+of cgroups and tasks.  Both process granularity and the no internal
-+process constraint restrict how the CPU controller can be used.
-+
-+
-+  2-2-1. Impact of Process Granularity
-+
-+  Process granularity prevents tasks belonging to the same process to
-+  be assigned to different cgroups.  It was pointed out [6] that this
-+  excludes the valid use case of hierarchical CPU distribution within
-+  processes.
-+
-+  To address this issue, the rgroup (resource group) [7][8][9]
-+  interface, an extension of the existing setpriority(2) API, was
-+  proposed, which is in line with other programmable priority
-+  mechanisms and eliminates the risk of in-application configuration
-+  and system configuration stepping on each other's toes.
-+  Unfortunately, the proposal quickly turned into discussions around
-+  cgroup v2 design decisions [4] and no consensus could be reached.
-+
-+
-+  2-2-2. Impact of No Internal Process Constraint
-+
-+  The no internal process constraint disallows tasks from competing
-+  directly against cgroups.  Here is an excerpt from Peter Zijlstra
-+  pointing out the issue [10] - R, L and A are cgroups; t1, t2, t3 and
-+  t4 are tasks:
-+
-+
-+          R
-+        / | \
-+       t1 t2 A
-+           /   \
-+          t3   t4
-+
-+
-+    Is fundamentally different from:
-+
-+
-+               R
-+             /   \
-+           L       A
-+         /   \   /   \
-+        t1  t2  t3   t4
-+
-+
-+    Because if in the first hierarchy you add a task (t5) to R, all of
-+    its A will run at 1/4th of total bandwidth where before it had
-+    1/3rd, whereas with the second example, if you add our t5 to L, A
-+    doesn't get any less bandwidth.
-+
-+
-+  It is true that the trees are semantically different from each other
-+  and the symmetric handling of tasks and cgroups is aesthetically
-+  pleasing.  However, it isn't clear what the practical usefulness of
-+  a layout with direct competition between tasks and cgroups would be,
-+  considering that number and behavior of tasks are controlled by each
-+  application, and cgroups primarily deal with system level resource
-+  distribution; changes in the number of active threads would directly
-+  impact resource distribution.  Real world use cases of such layouts
-+  could not be established during the discussions.
-+
-+
-+2-3. Arguments for cgroup v2
-+
-+There are strong demands for comprehensive hierarchical resource
-+control across all major resources, and establishing a common resource
-+hierarchy is an essential step.  As with most engineering decisions,
-+common resource hierarchy definition comes with its trade-offs.  With
-+cgroup v2, the trade-offs are in the form of structural constraints
-+which, among others, restrict the CPU controller's space of possible
-+configurations.
-+
-+However, even with the restrictions, cgroup v2, in combination with
-+rgroup, covers most of identified real world use cases while enabling
-+new important use cases of resource control across multiple resource
-+types that were fundamentally broken previously.
-+
-+Furthermore, for resource control, treating resource domains as
-+objects of a different type from terminal consumers has important
-+advantages - it can account for resource consumptions which are not
-+tied to any specific terminal consumer, be that a task or process, and
-+allows decoupling resource distribution controls from in-application
-+APIs.  Even the CPU controller may benefit from it as the kernel can
-+consume significant amount of CPU cycles in interrupt context or tasks
-+shared across multiple resource domains (e.g. softirq).
-+
-+Finally, it's important to note that enabling cgroup v2 support for
-+the CPU controller doesn't block use cases which require the features
-+which are not available on cgroup v2.  Unlikely, but should anybody
-+actually rely on the CPU controller's symmetric handling of tasks and
-+cgroups, backward compatibility is and will be maintained by being
-+able to disconnect the controller from the cgroup v2 hierarchy and use
-+it standalone.  This also holds for cpuset which is often used in
-+highly customized configurations which might be a poor fit for common
-+resource domains.
-+
-+The required changes are minimal, the benefits for the target use
-+cases are critical and obvious, and use cases which have to use v1 can
-+continue to do so.
-+
-+
-+3. Way Forward
-+
-+cgroup v2 primarily aims to solve the problem of comprehensive
-+hierarchical resource control across all major computing resources,
-+which is one of the core problems of modern server infrastructure
-+engineering.  The trade-offs that cgroup v2 took are results of
-+pursuing that goal and gaining a better understanding of the nature of
-+resource control in the process.
-+
-+I believe that real world usages will prove cgroup v2's model right,
-+considering the crucial pieces of comprehensive resource control that
-+cannot be implemented without common resource domains.  This is not to
-+say that cgroup v2 is fixed in stone and can't be updated; if there is
-+an approach which better serves both comprehensive resource control
-+and the CPU controller's flexibility, we will surely move towards
-+that.  It goes without saying that discussions around such approach
-+should consider practical aspects of resource control as a whole
-+rather than absolutely focusing on a particular controller.
-+
-+Until such consensus can be reached, the CPU controller cgroup v2
-+support will be maintained out of the mainline kernel in an easily
-+accessible form.  If there is anything cgroup developers can do to
-+ease the pain, please feel free to contact us on the cgroup mailing
-+list at cgroups@vger.kernel.org.
-+
-+
-+4. References
-+
-+[1]  http://lkml.kernel.org/r/20160105164834.GE5995@mtj.duckdns.org
-+     [PATCH 1/2] sched: Misc preps for cgroup unified hierarchy interface
-+     Tejun Heo <tj@kernel.org>
-+
-+[2]  http://lkml.kernel.org/r/20160105164852.GF5995@mtj.duckdns.org
-+     [PATCH 2/2] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[3]  http://lkml.kernel.org/r/1438641689-14655-4-git-send-email-tj@kernel.org
-+     [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[4]  http://lkml.kernel.org/r/20160407064549.GH3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Peter Zijlstra <peterz@infradead.org>
-+
-+[5]  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/cgroup-v2.txt
-+     Control Group v2
-+     Tejun Heo <tj@kernel.org>
-+
-+[6]  http://lkml.kernel.org/r/CAPM31RJNy3jgG=DYe6GO=wyL4BPPxwUm1f2S6YXacQmo7viFZA@mail.gmail.com
-+     Re: [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Paul Turner <pjt@google.com>
-+
-+[7]  http://lkml.kernel.org/r/20160105154503.GC5995@mtj.duckdns.org
-+     [RFD] cgroup: thread granularity support for cpu controller
-+     Tejun Heo <tj@kernel.org>
-+
-+[8]  http://lkml.kernel.org/r/1457710888-31182-1-git-send-email-tj@kernel.org
-+     [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[9]  http://lkml.kernel.org/r/20160311160522.GA24046@htj.duckdns.org
-+     Example program for PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[10] http://lkml.kernel.org/r/20160407082810.GN3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource
-+     Peter Zijlstra <peterz@infradead.org>
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch b/nixpkgs/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
deleted file mode 100644
index 0639f8b4e8fb..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 2cc99c9cdc8fde5e92e34f9655829449cebd3e00 Mon Sep 17 00:00:00 2001
-From: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
-Date: Fri, 4 Oct 2019 10:40:07 +0000
-Subject: kheaders: make headers archive reproducible
-
-In commit 43d8ce9d65a5 ("Provide in-kernel headers to make
-extending kernel easier") a new mechanism was introduced, for kernels
->=5.2, which embeds the kernel headers in the kernel image or a module
-and exposes them in procfs for use by userland tools.
-
-The archive containing the header files has nondeterminism caused by
-header files metadata. This patch normalizes the metadata and utilizes
-KBUILD_BUILD_TIMESTAMP if provided and otherwise falls back to the
-default behaviour.
-
-In commit f7b101d33046 ("kheaders: Move from proc to sysfs") it was
-modified to use sysfs and the script for generation of the archive was
-renamed to what is being patched.
-
-Signed-off-by: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
-Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
-Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
-
----
-
-nixos note: This patch is from
-https://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git/commit/?h=fixes&id=2cc99c9cdc8fde5e92e34f9655829449cebd3e00
-I commented out the documentation part here, so that it easily applies
-to linux 5.2 and 5.3, which does not ship with the reproducible build
-documentation yet, which only was introduced recently.
-
----
- Documentation/kbuild/reproducible-builds.rst | 13 +++++++++----
- kernel/gen_kheaders.sh                       |  5 ++++-
- 2 files changed, 13 insertions(+), 5 deletions(-)
-
-#diff --git a/Documentation/kbuild/reproducible-builds.rst b/Documentation/kbuild/reproducible-builds.rst
-#index ab92e98c89c8..503393854e2e 100644
-# --- a/Documentation/kbuild/reproducible-builds.rst
-#+++ b/Documentation/kbuild/reproducible-builds.rst
-#@@ -16,16 +16,21 @@ the kernel may be unreproducible, and how to avoid them.
-# Timestamps
-# ----------
-#
-#-The kernel embeds a timestamp in two places:
-#+The kernel embeds timestamps in three places:
-#
-# * The version string exposed by ``uname()`` and included in
-#   ``/proc/version``
-#
-# * File timestamps in the embedded initramfs
-#
-#-By default the timestamp is the current time.  This must be overridden
-#-using the `KBUILD_BUILD_TIMESTAMP`_ variable.  If you are building
-#-from a git commit, you could use its commit date.
-#+* If enabled via ``CONFIG_IKHEADERS``, file timestamps of kernel
-#+  headers embedded in the kernel or respective module,
-#+  exposed via ``/sys/kernel/kheaders.tar.xz``
-#+
-#+By default the timestamp is the current time and in the case of
-#+``kheaders`` the various files' modification times. This must
-#+be overridden using the `KBUILD_BUILD_TIMESTAMP`_ variable.
-#+If you are building from a git commit, you could use its commit date.
-#
-# The kernel does *not* use the ``__DATE__`` and ``__TIME__`` macros,
-# and enables warnings if they are used.  If you incorporate external
-diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
-index 9ff449888d9c..aff79e461fc9 100755
---- a/kernel/gen_kheaders.sh
-+++ b/kernel/gen_kheaders.sh
-@@ -71,7 +71,10 @@ done | cpio --quiet -pd $cpio_dir >/dev/null 2>&1
- find $cpio_dir -type f -print0 |
- 	xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;'
-
--tar -Jcf $tarfile -C $cpio_dir/ . > /dev/null
-+# Create archive and try to normalize metadata for reproducibility
-+tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
-+    --owner=0 --group=0 --sort=name --numeric-owner \
-+    -Jcf $tarfile -C $cpio_dir/ . > /dev/null
-
- echo "$src_files_md5" >  kernel/kheaders.md5
- echo "$obj_files_md5" >> kernel/kheaders.md5
---
-cgit 1.2-0.3.lf.el7
-
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix b/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
index 056544014f42..04f6cfc70ad3 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
@@ -29,7 +29,8 @@
  structuredExtraConfig ? {}
 
 , # The version number used for the module directory
-  modDirVersion ? version
+  # If unspecified, this is determined automatically from the version.
+  modDirVersion ? null
 
 , # An attribute set whose attributes express the availability of
   # certain features in this kernel.  E.g. `{iwlwifi = true;}'
@@ -46,8 +47,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc" ||
-                       stdenv.hostPlatform != stdenv.buildPlatform
+, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name or "" != "pc"
 , extraMeta ? {}
 
 , isZen      ? false
@@ -55,7 +55,7 @@
 , isHardened ? false
 
 # easy overrides to stdenv.hostPlatform.linux-kernel members
-, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules
+, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
@@ -128,16 +128,15 @@ let
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
 
-    platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
-    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
+    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
     # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
 
-    prePatch = kernel.prePatch + ''
+    postPatch = kernel.postPatch + ''
       # Patch kconfig to print "###" after every question so that
       # generate-config.pl from the generic builder can answer them.
       sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
@@ -194,17 +193,26 @@ let
     };
   }; # end of configfile derivation
 
-  kernel = (callPackage ./manual-config.nix { inherit buildPackages;  }) (basicArgs // {
-    inherit modDirVersion kernelPatches randstructSeed lib stdenv extraMakeFlags extraMeta configfile;
+  kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
+    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
     pos = builtins.unsafeGetAttrPos "version" args;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-  });
+  } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
 
   passthru = basicArgs // {
     features = kernelFeatures;
-    inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre modDirVersion;
+    inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre;
     isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
+
+    # Adds dependencies needed to edit the config:
+    # nix-shell '<nixpkgs>' -A linux.configEnv --command 'make nconfig'
+    configEnv = kernel.overrideAttrs (old: {
+      nativeBuildInputs = old.nativeBuildInputs or [] ++ (with buildPackages; [
+        pkg-config ncurses
+      ]);
+    });
+
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
     tests = let
       overridableKernel = finalKernel // {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch b/nixpkgs/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch
deleted file mode 100644
index 47ae77a5a54d..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c
-index 88632df..ba6cfa9 100644
---- a/scripts/genksyms/genksyms.c
-+++ b/scripts/genksyms/genksyms.c
-@@ -233,11 +233,11 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type,
- 		free_list(last_enum_expr, NULL);
- 		last_enum_expr = NULL;
- 		enum_counter = 0;
--		if (!name)
--			/* Anonymous enum definition, nothing more to do */
--			return NULL;
- 	}
- 
-+	if (!name)
-+		return NULL;
-+
- 	h = crc32(name) % HASH_BUCKETS;
- 	for (sym = symtab[h]; sym; sym = sym->hash_next) {
- 		if (map_to_ns(sym->type) == map_to_ns(type) &&
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
index 3e3cd149c4d9..5a1a710ba3b7 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -8,7 +8,7 @@
 #
 # See also <nixos/modules/profiles/hardened.nix>
 
-{ lib, version }:
+{ stdenv, lib, version }:
 
 with lib;
 with lib.kernel;
@@ -20,10 +20,6 @@ assert (versionAtLeast version "4.9");
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  # Safer page access permissions (wrt. code injection).  Default on >=4.11.
-  DEBUG_RODATA          = whenOlder "4.11" yes;
-  DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -32,10 +28,10 @@ assert (versionAtLeast version "4.9");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
-  SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
+  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
+  STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
@@ -45,7 +41,7 @@ assert (versionAtLeast version "4.9");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.5" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
@@ -68,11 +64,15 @@ assert (versionAtLeast version "4.9");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
-  GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
-  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
+  GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
+
+  # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
+  RANDSTRUCT = whenAtLeast "5.19" yes;
+  RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
 
   # Disable various dangerous settings
   ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
index 35ef199c9d6a..ceec23139f94 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,61 +2,61 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.290-hardened1.patch",
-            "sha256": "14bnps4y5k2aa0fd2g4bdbiir1w7xfrvgsqd3cfzni8zhf4xrw0l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.290-hardened1/linux-hardened-4.14.290-hardened1.patch"
+            "name": "linux-hardened-4.14.316-hardened1.patch",
+            "sha256": "1j0yx7i742mgbdn0lqq4mvcywk9jlm5k3zp40fdarsa0kscijxn0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.316-hardened1/linux-hardened-4.14.316-hardened1.patch"
         },
-        "sha256": "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4",
-        "version": "4.14.290"
+        "sha256": "0xlg93va7dbz2w428kiw7vr2sds3542fqq57rwyf51ykq7qii0xc",
+        "version": "4.14.316"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.255-hardened1.patch",
-            "sha256": "1pi0na6gr0l56479dzny8fvb3yzvxvjbvwn7c6kxf0gdhdqjzsc9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.255-hardened1/linux-hardened-4.19.255-hardened1.patch"
+            "name": "linux-hardened-4.19.284-hardened1.patch",
+            "sha256": "0xqdhbsckkyg007x4247da0zza1sqq1y5a6li4z11y3xjf71dlxn",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.284-hardened1/linux-hardened-4.19.284-hardened1.patch"
         },
-        "sha256": "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp",
-        "version": "4.19.255"
+        "sha256": "0gnhgxcpx9s96wa3dqgxmdjb7x12i94yh0gmv7k9nbz5qwhfxfbz",
+        "version": "4.19.284"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.136-hardened1.patch",
-            "sha256": "1mw30dy0xk2l12gds0kf7mjxbfamjxdwshkwc4kcics9rf57mgx6",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.136-hardened1/linux-hardened-5.10.136-hardened1.patch"
+            "name": "linux-hardened-5.10.182-hardened1.patch",
+            "sha256": "1230wh6wjvmv3mv2sylwcqvqbz83b4vwwpbn7zikd7mmz2619k5w",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.182-hardened1/linux-hardened-5.10.182-hardened1.patch"
         },
-        "sha256": "0naiwihlj6aswnqwdz3xzmga98xpj5lf2iy9vxqzdng7b46rs28w",
-        "version": "5.10.136"
+        "sha256": "1xp9bxk2vyw29bq3z854ly4cj94z8i52yl5hq4a3l3j6564wb3ny",
+        "version": "5.10.182"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.60-hardened1.patch",
-            "sha256": "1w93qgwycicwjp3aiklm6c6yvg0gq674pxcxvbsdd0c1p0b4y8dk",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.60-hardened1/linux-hardened-5.15.60-hardened1.patch"
+            "name": "linux-hardened-5.15.115-hardened1.patch",
+            "sha256": "1gkmhhfv86vnja37xfrnl65n6hzq429lc5zlxjvjmrpagl2x1pfc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.115-hardened1/linux-hardened-5.15.115-hardened1.patch"
         },
-        "sha256": "0yi3bvqz4qn8nvgr910ic09zvpisafwi282j0y2gvbvgr7vlb59d",
-        "version": "5.15.60"
+        "sha256": "050j9z0wg5glgxwbmzfq4l8lv8y7g3nc2rz8342yjdcjfxh6h1qv",
+        "version": "5.15.115"
     },
-    "5.18": {
+    "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.18.17-hardened1.patch",
-            "sha256": "0vic9y72d3vfw66y32yrgh7q2wgjk902780ik2viylwr3f5xq1yq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.17-hardened1/linux-hardened-5.18.17-hardened1.patch"
+            "name": "linux-hardened-5.4.245-hardened1.patch",
+            "sha256": "0n5ifykd1gq8yiw3snw6lhpz2hhydj3nk9k2f80b9svmza2h4vi6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.245-hardened1/linux-hardened-5.4.245-hardened1.patch"
         },
-        "sha256": "0i7yms65b8kxjm92ahic0787vb9h7xblbwp1v6cq8zpns3ivv0ih",
-        "version": "5.18.17"
+        "sha256": "195ixy9l18mhwvzj7v63fkyifb9mysq950afxh6ixlpvg0c8h1wn",
+        "version": "5.4.245"
     },
-    "5.4": {
+    "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.210-hardened1.patch",
-            "sha256": "0qbz9h97m0lxa45j85sv2lhhmrlx9nv5z0bf5vdhyq6g0h7d2mm9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.210-hardened1/linux-hardened-5.4.210-hardened1.patch"
+            "name": "linux-hardened-6.1.32-hardened1.patch",
+            "sha256": "00sg3zmvvnyvc4j82lcj4r7yw5hwvc253w0g2fr1hqqvh4fhinhw",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.32-hardened1/linux-hardened-6.1.32-hardened1.patch"
         },
-        "sha256": "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl",
-        "version": "5.4.210"
+        "sha256": "0v0saai735jzaj3dbpgp6sbdi95n3lmv78pbg1xy9fd2kfhbg23w",
+        "version": "6.1.32"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
index d0f8c77c783f..5d6a2eba966a 100755
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p "python38.withPackages (ps: [ps.PyGithub])" git gnupg
+#! nix-shell -i python -p "python3.withPackages (ps: [ps.pygithub])" git gnupg
 
 # This is automatically called by ../update.sh.
 
@@ -138,7 +138,7 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
     if not sig_ok:
         return None
 
-    kernel_ver = release_info.release.tag_name.replace("-hardened1", "")
+    kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
     major = kernel_ver.split('.')[0]
     sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
 
@@ -201,7 +201,7 @@ for filename in os.listdir(NIXPKGS_KERNEL_PATH):
             (callPackage {NIXPKGS_KERNEL_PATH / filename} {{}}).version
         """
         kernel_version_json = run(
-            "nix-instantiate", "--eval", "--json", "--expr", nix_version_expr,
+            "nix-instantiate", "--eval", "--system", "x86_64-linux", "--json", "--expr", nix_version_expr,
         ).stdout
         kernel_version = parse_version(json.loads(kernel_version_json))
         if kernel_version < MIN_KERNEL_VERSION:
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix b/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
index 4e42288aff8d..ef2abefb377b 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -10,35 +10,6 @@
 , which
 }:
 
-let
-  py = python3.override {
-    packageOverrides = final: prev: rec {
-      docutils_old = prev.docutils.overridePythonAttrs (oldAttrs: rec {
-        version = "0.16";
-        src = final.fetchPypi {
-          pname = "docutils";
-          inherit version;
-          sha256 = "sha256-wt46YOnn0Hvia38rAMoDCcIH4GwQD5zCqUkx/HWkePw=";
-        };
-      });
-
-      sphinx = (prev.sphinx.override rec {
-        alabaster = prev.alabaster.override { inherit pygments; };
-        docutils = docutils_old;
-        pygments = prev.pygments.override { docutils = docutils_old; };
-      }).overridePythonAttrs {
-        # fails due to duplicated packages
-        doCheck = false;
-      };
-
-      sphinx-rtd-theme = prev.sphinx-rtd-theme.override {
-        inherit sphinx;
-        docutils = docutils_old;
-      };
-    };
-  };
-in
-
 stdenv.mkDerivation {
   pname = "linux-kernel-latest-htmldocs";
 
@@ -58,8 +29,8 @@ stdenv.mkDerivation {
     graphviz
     imagemagick
     perl
-    py.pkgs.sphinx
-    py.pkgs.sphinx-rtd-theme
+    python3.pkgs.sphinx
+    python3.pkgs.sphinx-rtd-theme
     which
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 018ec0e8a927..f164d2a5ae86 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -1,18 +1,18 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.290";
+  version = "4.14.317";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4";
+    sha256 = "0c1wy0m0jnjpc6scrw1y97wsg2d18vb1bi31i1qzlxvgmrd8zwlc";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 0981efb66a77..e12b9c20c67f 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -1,18 +1,18 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.255";
+  version = "4.19.285";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp";
+    sha256 = "05nwivdk4w939vrrbn5p2yai1rz7kxqa4bl5f3n6d867b59pg8da";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
deleted file mode 100644
index 3fb588d3cb93..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.9.325";
-  extraMeta.branch = "4.9";
-  extraMeta.broken = stdenv.isAarch64;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04msx0x0d8v93zjr3jj0qqkgg7m4hb7rj6hk5vzrzasmgbjmb3dl";
-  };
-} // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
index a9fde05e0ca5..4c01e8b9a743 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -1,18 +1,18 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.136";
+  version = "5.10.183";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0naiwihlj6aswnqwdz3xzmga98xpj5lf2iy9vxqzdng7b46rs28w";
+    sha256 = "06b1nlwaqs7g3323zxp1bxfilqpbj700x591vqa9dx6a6p39g520";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 4bf8303b2a41..fb654f7f2f5a 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -1,18 +1,18 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.61";
+  version = "5.15.116";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0hpx0ziz162lc41jwi2ybj3qgidinjcsp71lchvmp6h0vyiddj9v";
+    sha256 = "16hpdqlkz2g2pjcml7j55yfym6nbp0zg8f2r969wq9jkpg8wj5zn";
   };
 } // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.18.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.18.nix
deleted file mode 100644
index 096f197a1a1c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.18.18";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0as0cslwz6zdiwd5wzcjggw3qpa9hzvfmxlhy72jdhn5vk47dhy1";
-  };
-} // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.19.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.19.nix
deleted file mode 100644
index 09e226ba3410..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.19.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.19.2";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0gg63y078k886clgfq4k5n7nh2r0359ksvf8wd06rv01alghmr28";
-  };
-} // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 3018d83840e3..93f48fdbebcc 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -1,18 +1,18 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.210";
+  version = "5.4.246";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl";
+    sha256 = "1snrgvpqpmc0d4aphq8flsmlcjjx9kgknymjlrmazl4ghl57jf09";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix
new file mode 100644
index 000000000000..636e5725207f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -0,0 +1,18 @@
+{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
+
+with lib;
+
+buildLinux (args // rec {
+  version = "6.1.33";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = versions.pad 3 version;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
+    sha256 = "1kfj7mi3n2lfaw4spz5cbvcl1md038figabyg80fha3kxal6nzdq";
+  };
+} // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix
new file mode 100644
index 000000000000..5cbb872b6a41
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix
@@ -0,0 +1,18 @@
+{ lib, fetchurl, buildLinux, ... } @ args:
+
+with lib;
+
+buildLinux (args // rec {
+  version = "6.3.7";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = versions.pad 3 version;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
+    sha256 = "1acpbddgxna1g8xzsil5r1fbsiw8z3wdr69y8xxjllkck51rfdpy";
+  };
+} // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
index 389bae733587..04b8d56c57c2 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18837";
-    sha256 = "0645lkbh5bi9a8nhdyh21h7rrw8x8pmb7la08zn7gpkmwvk3wnwx";
+    rev = "19308";
+    sha256 = "1rhg43z4fyyac12c1z9h83xlh7ar0k2lfzrs40q061jlmx8mkpbb";
   }
 , ...
 }:
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix
deleted file mode 100644
index a6a8d4936d4f..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, buildPackages, fetchFromGitHub, perl, buildLinux, structuredExtraConfig ? {}, ... } @ args:
-let
-  mptcpVersion = "0.95.1";
-  modDirVersion = "4.19.126";
-in
-buildLinux ({
-  version = "${modDirVersion}-mptcp_v${mptcpVersion}";
-  inherit modDirVersion;
-
-  extraMeta = {
-    branch = "4.19";
-    maintainers = with lib.maintainers; [ teto layus ];
-  };
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "mptcp";
-    rev = "v${mptcpVersion}";
-    sha256 = "sha256-J9UXhkI49cq83EtojLHieRtp8fT3LXTJNIqb+mUwZdM=";
-  };
-
-  structuredExtraConfig = lib.mkMerge [
-    (import ./mptcp-config.nix { inherit lib; })
-    structuredExtraConfig
-  ];
-
-} // args)
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rpi.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 8654bc432ceb..1bea61975297 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -2,8 +2,8 @@
 
 let
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
-  modDirVersion = "5.15.32";
-  tag = "1.20220331";
+  modDirVersion = "6.1.21";
+  tag = "1.20230405";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -13,7 +13,7 @@ lib.overrideDerivation (buildLinux (args // {
     owner = "raspberrypi";
     repo = "linux";
     rev = tag;
-    hash = "sha256-dJtOXe4yvZz/iu0Ly5F9/E/2GbpTJF/9ZMU3rC1nKMw=";
+    hash = "sha256-ILwecHZ1BN6GhZAUB6/UwiN/rZ8gHndKON6DUhidtxI=";
   };
 
   defconfig = {
@@ -27,24 +27,11 @@ lib.overrideDerivation (buildLinux (args // {
     efiBootStub = false;
   } // (args.features or {});
 
-  extraConfig = ''
-    # ../drivers/gpu/drm/ast/ast_mode.c:851:18: error: initialization of 'void (*)(struct drm_crtc *, struct drm_atomic_state *)' from incompatible pointer type 'void (*)(struct drm_crtc *, struct drm_crtc_state *)' [-Werror=incompatible-pointer-types]
-    #   851 |  .atomic_flush = ast_crtc_helper_atomic_flush,
-    #       |                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
-    # ../drivers/gpu/drm/ast/ast_mode.c:851:18: note: (near initialization for 'ast_crtc_helper_funcs.atomic_flush')
-    DRM_AST n
-    # ../drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c: In function 'amdgpu_dm_atomic_commit_tail':
-    # ../drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:7757:4: error: implicit declaration of function 'is_hdr_metadata_different' [-Werror=implicit-function-declaration]
-    #  7757 |    is_hdr_metadata_different(old_con_state, new_con_state);
-    #       |    ^~~~~~~~~~~~~~~~~~~~~~~~~
-    DRM_AMDGPU n
-  '';
-
   extraMeta = if (rpiVersion < 3) then {
-    platforms = with lib.platforms; [ arm ];
+    platforms = with lib.platforms; arm;
     hydraPlatforms = [];
   } else {
-    platforms = with lib.platforms; [ arm aarch64 ];
+    platforms = with lib.platforms; arm ++ aarch64;
     hydraPlatforms = [ "aarch64-linux" ];
   };
 } // (args.argsOverride or {}))) (oldAttrs: {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 58be2be6e9d2..cd8ed2a17572 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,26 +6,25 @@
 , ... } @ args:
 
 let
-  version = "5.10.131-rt72"; # updated by ./update-rt.sh
+  version = "5.10.78-rt55"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
-  modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
-    else lib.replaceStrings ["-"] [".0-"] version;
+  modDirVersion = lib.versions.pad 3 version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1ki11mvl3dky7iih90znr47vr66dxnlwrqwg2jkk1hqn5i243i4b";
+    sha256 = "03q5lrv8gr9hnm7984pxi9kwsvxrn21qwykj60amisi2wac6r05y";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0ag000h9m7phvgrqa4jcmd94x0rk8z8bh7qhqqlywbiz2b1b91qa";
+      sha256 = "1wcw682r238qi5jgn5zk9m6j2506p9ypfax13bzhjfyjzz3h98kp";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
new file mode 100644
index 000000000000..53f9426904ac
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -0,0 +1,45 @@
+{ lib, buildLinux, fetchurl
+, kernelPatches ? [ ]
+, structuredExtraConfig ? {}
+, extraMeta ? {}
+, argsOverride ? {}
+, ... } @ args:
+
+let
+  version = "5.15.113-rt64"; # updated by ./update-rt.sh
+  branch = lib.versions.majorMinor version;
+  kversion = builtins.elemAt (lib.splitString "-" version) 0;
+in buildLinux (args // {
+  inherit version;
+
+  # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
+  modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
+    else lib.replaceStrings ["-"] [".0-"] version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
+    sha256 = "1jmrnd0ri75gl0k80g93zqyg00lbf1gqai3dga383ms92799hkja";
+  };
+
+  kernelPatches = let rt-patch = {
+    name = "rt";
+    patch = fetchurl {
+      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
+      sha256 = "0nxnviivsshs20zh8px657mr31wfsjdy70z793f56bf9s2m4kl31";
+    };
+  }; in [ rt-patch ] ++ kernelPatches;
+
+  structuredExtraConfig = with lib.kernel; {
+    PREEMPT_RT = yes;
+    # Fix error: unused option: PREEMPT_RT.
+    EXPERT = yes; # PREEMPT_RT depends on it (in kernel/Kconfig.preempt)
+    # Fix error: option not set correctly: PREEMPT_VOLUNTARY (wanted 'y', got 'n').
+    PREEMPT_VOLUNTARY = lib.mkForce no; # PREEMPT_RT deselects it.
+    # Fix error: unused option: RT_GROUP_SCHED.
+    RT_GROUP_SCHED = lib.mkForce (option no); # Removed by sched-disable-rt-group-sched-on-rt.patch.
+  } // structuredExtraConfig;
+
+  extraMeta = extraMeta // {
+    inherit branch;
+  };
+} // argsOverride)
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 898bd1d18ad1..821e11802e50 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.209-rt77"; # updated by ./update-rt.sh
+  version = "5.4.242-rt81"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1kdnz99k7zspzaxqaxahbf6hncigy4cvjlb79jsy7a95qxxr31qf";
+    sha256 = "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1wh5m7ychgnn33yg7gg9nlwcmmm72dixvdf77m764hs90xl8c9ig";
+      sha256 = "1wszhzw9ic018x3jiz8x1ffxxg30wpy4db7hja44b661p9fjm1dc";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
new file mode 100644
index 000000000000..0a5b10e56484
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -0,0 +1,45 @@
+{ lib, buildLinux, fetchurl
+, kernelPatches ? [ ]
+, structuredExtraConfig ? {}
+, extraMeta ? {}
+, argsOverride ? {}
+, ... } @ args:
+
+let
+  version = "6.1.28-rt10"; # updated by ./update-rt.sh
+  branch = lib.versions.majorMinor version;
+  kversion = builtins.elemAt (lib.splitString "-" version) 0;
+in buildLinux (args // {
+  inherit version;
+
+  # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
+  modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
+    else lib.replaceStrings ["-"] [".0-"] version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
+    sha256 = "1w56qgf1vgk3dmh4xw6699kjm5pdqvyfzr19ah5yy3xj50a4q2bs";
+  };
+
+  kernelPatches = let rt-patch = {
+    name = "rt";
+    patch = fetchurl {
+      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
+      sha256 = "1fwi113x85bq09y06jhmfn5wbfscb9l2cggvlzw4yam802vlp853";
+    };
+  }; in [ rt-patch ] ++ kernelPatches;
+
+  structuredExtraConfig = with lib.kernel; {
+    PREEMPT_RT = yes;
+    # Fix error: unused option: PREEMPT_RT.
+    EXPERT = yes; # PREEMPT_RT depends on it (in kernel/Kconfig.preempt)
+    # Fix error: option not set correctly: PREEMPT_VOLUNTARY (wanted 'y', got 'n').
+    PREEMPT_VOLUNTARY = lib.mkForce no; # PREEMPT_RT deselects it.
+    # Fix error: unused option: RT_GROUP_SCHED.
+    RT_GROUP_SCHED = lib.mkForce (option no); # Removed by sched-disable-rt-group-sched-on-rt.patch.
+  } // structuredExtraConfig;
+
+  extraMeta = extraMeta // {
+    inherit branch;
+  };
+} // argsOverride)
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a1748156d098..b6f897b024e0 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,9 +1,11 @@
 { lib
+, stdenv
 , fetchpatch
 , kernel
-, date ? "2022-04-25"
-, commit ? "bdf6d7c1350497bc7b0be6027a51d9330645672d"
-, diffHash ? "09bcbklvfj9i9czjdpix2iz7fvjksmavaljx8l92ay1i9fapjmhc"
+, commitDate ? "2023-02-01"
+, currentCommit ? "65960c284ad149cc4bfbd64f21e6889c1e3d1c5f"
+, diffHash ? "sha256-4wpY3aYZ93OXSU4wmQs9K62nPyIzjKu4RBQTwksmyyk="
+
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
@@ -11,22 +13,20 @@
 
 # NOTE: bcachefs-tools should be updated simultaneously to preserve compatibility
 (kernel.override ( args // {
-  argsOverride = {
-    version = "${kernel.version}-bcachefs-unstable-${date}";
+  version = "${kernel.version}-bcachefs-unstable-${commitDate}";
 
-    extraMeta = {
-      branch = "master";
-      maintainers = with lib.maintainers; [ davidak Madouura ];
-      broken = true;
-    };
-  } // argsOverride;
+  extraMeta = {
+    branch = "master";
+    broken = stdenv.isAarch64;
+    maintainers = with lib.maintainers; [ davidak Madouura pedrohlc ];
+  };
 
   kernelPatches = [ {
-      name = "bcachefs-${commit}";
+      name = "bcachefs-${currentCommit}";
 
       patch = fetchpatch {
-        name = "bcachefs-${commit}.diff";
-        url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${commit}&id2=v${lib.versions.majorMinor kernel.version}";
+        name = "bcachefs-${currentCommit}.diff";
+        url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${currentCommit}&id2=v${lib.versions.majorMinor kernel.version}";
         sha256 = diffHash;
       };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
index a4304e9e9369..e30689cdd3ea 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,17 +1,17 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib, buildPackages, fetchzip, perl, buildLinux, nixosTests, ... } @ args:
 
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0-rc1";
+  version = "6.4-rc4";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
-  modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
+  modDirVersion = versions.pad 3 version;
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "sha256-RReHoEYavib86K9XQKwguBYQvyQboRl7537p69P8ca0=";
+    hash = "sha256-PlxGRb4wKjamEDrSWpKXLxa7aX9lQoDgrjjrWhArisk=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch b/nixpkgs/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch
deleted file mode 100644
index 2f1fa6a0daec..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index dd10cf78f2d3..8f006638452b 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -28,8 +28,8 @@
- #include "trace.h"
- #include "nvme.h"
- 
--#define SQ_SIZE(depth)		(depth * sizeof(struct nvme_command))
--#define CQ_SIZE(depth)		(depth * sizeof(struct nvme_completion))
-+#define SQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_command))
-+#define CQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_completion))
- 
- #define SGES_PER_PAGE	(PAGE_SIZE / sizeof(struct nvme_sgl_desc))
- 
-@@ -1344,16 +1344,16 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
- 
- static void nvme_free_queue(struct nvme_queue *nvmeq)
- {
--	dma_free_coherent(nvmeq->dev->dev, CQ_SIZE(nvmeq->q_depth),
-+	dma_free_coherent(nvmeq->dev->dev, CQ_SIZE(nvmeq),
- 				(void *)nvmeq->cqes, nvmeq->cq_dma_addr);
- 	if (!nvmeq->sq_cmds)
- 		return;
- 
- 	if (test_and_clear_bit(NVMEQ_SQ_CMB, &nvmeq->flags)) {
- 		pci_free_p2pmem(to_pci_dev(nvmeq->dev->dev),
--				nvmeq->sq_cmds, SQ_SIZE(nvmeq->q_depth));
-+				nvmeq->sq_cmds, SQ_SIZE(nvmeq));
- 	} else {
--		dma_free_coherent(nvmeq->dev->dev, SQ_SIZE(nvmeq->q_depth),
-+		dma_free_coherent(nvmeq->dev->dev, SQ_SIZE(nvmeq),
- 				nvmeq->sq_cmds, nvmeq->sq_dma_addr);
- 	}
- }
-@@ -1433,12 +1433,12 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
- }
- 
- static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
--				int qid, int depth)
-+				int qid)
- {
- 	struct pci_dev *pdev = to_pci_dev(dev->dev);
- 
- 	if (qid && dev->cmb_use_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
--		nvmeq->sq_cmds = pci_alloc_p2pmem(pdev, SQ_SIZE(depth));
-+		nvmeq->sq_cmds = pci_alloc_p2pmem(pdev, SQ_SIZE(nvmeq));
- 		if (nvmeq->sq_cmds) {
- 			nvmeq->sq_dma_addr = pci_p2pmem_virt_to_bus(pdev,
- 							nvmeq->sq_cmds);
-@@ -1447,11 +1447,11 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
- 				return 0;
- 			}
- 
--			pci_free_p2pmem(pdev, nvmeq->sq_cmds, SQ_SIZE(depth));
-+			pci_free_p2pmem(pdev, nvmeq->sq_cmds, SQ_SIZE(nvmeq));
- 		}
- 	}
- 
--	nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-+	nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(nvmeq),
- 				&nvmeq->sq_dma_addr, GFP_KERNEL);
- 	if (!nvmeq->sq_cmds)
- 		return -ENOMEM;
-@@ -1465,12 +1465,13 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	if (dev->ctrl.queue_count > qid)
- 		return 0;
- 
--	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(depth),
-+	nvmeq->q_depth = depth;
-+	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(nvmeq),
- 					 &nvmeq->cq_dma_addr, GFP_KERNEL);
- 	if (!nvmeq->cqes)
- 		goto free_nvmeq;
- 
--	if (nvme_alloc_sq_cmds(dev, nvmeq, qid, depth))
-+	if (nvme_alloc_sq_cmds(dev, nvmeq, qid))
- 		goto free_cqdma;
- 
- 	nvmeq->dev = dev;
-@@ -1479,15 +1480,14 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	nvmeq->cq_head = 0;
- 	nvmeq->cq_phase = 1;
- 	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
--	nvmeq->q_depth = depth;
- 	nvmeq->qid = qid;
- 	dev->ctrl.queue_count++;
- 
- 	return 0;
- 
-  free_cqdma:
--	dma_free_coherent(dev->dev, CQ_SIZE(depth), (void *)nvmeq->cqes,
--							nvmeq->cq_dma_addr);
-+	dma_free_coherent(dev->dev, CQ_SIZE(nvmeq), (void *)nvmeq->cqes,
-+			  nvmeq->cq_dma_addr);
-  free_nvmeq:
- 	return -ENOMEM;
- }
-@@ -1515,7 +1515,7 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid)
- 	nvmeq->cq_head = 0;
- 	nvmeq->cq_phase = 1;
- 	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
--	memset((void *)nvmeq->cqes, 0, CQ_SIZE(nvmeq->q_depth));
-+	memset((void *)nvmeq->cqes, 0, CQ_SIZE(nvmeq));
- 	nvme_dbbuf_init(dev, nvmeq, qid);
- 	dev->online_queues++;
- 	wmb(); /* ensure the first interrupt sees the initialization */
-diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
-index cc09b81fc7f4..716ebe87a2b8 100644
---- a/drivers/nvme/host/core.c
-+++ b/drivers/nvme/host/core.c
-@@ -1986,6 +1986,7 @@ int nvme_enable_ctrl(struct nvme_ctrl *ctrl, u64 cap)
- 	ctrl->ctrl_config = NVME_CC_CSS_NVM;
- 	ctrl->ctrl_config |= (page_shift - 12) << NVME_CC_MPS_SHIFT;
- 	ctrl->ctrl_config |= NVME_CC_AMS_RR | NVME_CC_SHN_NONE;
-+	/* Use default IOSQES. We'll update it later if needed */
- 	ctrl->ctrl_config |= NVME_CC_IOSQES | NVME_CC_IOCQES;
- 	ctrl->ctrl_config |= NVME_CC_ENABLE;
- 
-@@ -2698,6 +2699,30 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
- 		ctrl->hmmin = le32_to_cpu(id->hmmin);
- 		ctrl->hmminds = le32_to_cpu(id->hmminds);
- 		ctrl->hmmaxd = le16_to_cpu(id->hmmaxd);
-+
-+		/* Grab required IO queue size */
-+		ctrl->iosqes = id->sqes & 0xf;
-+		if (ctrl->iosqes < NVME_NVM_IOSQES) {
-+			dev_err(ctrl->device,
-+				"unsupported required IO queue size %d\n", ctrl->iosqes);
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+		/*
-+		 * If our IO queue size isn't the default, update the setting
-+		 * in CC:IOSQES.
-+		 */
-+		if (ctrl->iosqes != NVME_NVM_IOSQES) {
-+			ctrl->ctrl_config &= ~(0xfu << NVME_CC_IOSQES_SHIFT);
-+			ctrl->ctrl_config |= ctrl->iosqes << NVME_CC_IOSQES_SHIFT;
-+			ret = ctrl->ops->reg_write32(ctrl, NVME_REG_CC,
-+						     ctrl->ctrl_config);
-+			if (ret) {
-+				dev_err(ctrl->device,
-+					"error updating CC register\n");
-+				goto out_free;
-+			}
-+		}
- 	}
- 
- 	ret = nvme_mpath_init(ctrl, id);
-diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
-index 716a876119c8..34ef35fcd8a5 100644
---- a/drivers/nvme/host/nvme.h
-+++ b/drivers/nvme/host/nvme.h
-@@ -244,6 +244,7 @@ struct nvme_ctrl {
- 	u32 hmmin;
- 	u32 hmminds;
- 	u16 hmmaxd;
-+	u8 iosqes;
- 
- 	/* Fabrics only */
- 	u16 sqsize;
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 8f006638452b..54b35ea4af88 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -28,7 +28,7 @@
- #include "trace.h"
- #include "nvme.h"
- 
--#define SQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_command))
-+#define SQ_SIZE(q)	((q)->q_depth << (q)->sqes)
- #define CQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_completion))
- 
- #define SGES_PER_PAGE	(PAGE_SIZE / sizeof(struct nvme_sgl_desc))
-@@ -162,7 +162,7 @@ static inline struct nvme_dev *to_nvme_dev(struct nvme_ctrl *ctrl)
- struct nvme_queue {
- 	struct nvme_dev *dev;
- 	spinlock_t sq_lock;
--	struct nvme_command *sq_cmds;
-+	void *sq_cmds;
- 	 /* only used for poll queues: */
- 	spinlock_t cq_poll_lock ____cacheline_aligned_in_smp;
- 	volatile struct nvme_completion *cqes;
-@@ -178,6 +178,7 @@ struct nvme_queue {
- 	u16 last_cq_head;
- 	u16 qid;
- 	u8 cq_phase;
-+	u8 sqes;
- 	unsigned long flags;
- #define NVMEQ_ENABLED		0
- #define NVMEQ_SQ_CMB		1
-@@ -488,7 +489,8 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd,
- 			    bool write_sq)
- {
- 	spin_lock(&nvmeq->sq_lock);
--	memcpy(&nvmeq->sq_cmds[nvmeq->sq_tail], cmd, sizeof(*cmd));
-+	memcpy(nvmeq->sq_cmds + (nvmeq->sq_tail << nvmeq->sqes),
-+	       cmd, sizeof(*cmd));
- 	if (++nvmeq->sq_tail == nvmeq->q_depth)
- 		nvmeq->sq_tail = 0;
- 	nvme_write_sq_db(nvmeq, write_sq);
-@@ -1465,6 +1467,7 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	if (dev->ctrl.queue_count > qid)
- 		return 0;
- 
-+	nvmeq->sqes = qid ? dev->ctrl.iosqes : NVME_NVM_ADMSQES;
- 	nvmeq->q_depth = depth;
- 	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(nvmeq),
- 					 &nvmeq->cq_dma_addr, GFP_KERNEL);
-diff --git a/include/linux/nvme.h b/include/linux/nvme.h
-index 01aa6a6c241d..7af18965fb57 100644
---- a/include/linux/nvme.h
-+++ b/include/linux/nvme.h
-@@ -141,6 +141,7 @@ enum {
-  * (In bytes and specified as a power of two (2^n)).
-  */
- #define NVME_NVM_IOSQES		6
-+#define NVME_NVM_ADMSQES	6
- #define NVME_NVM_IOCQES		4
- 
- enum {
-diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
-index 716ebe87a2b8..480ea24d8cf4 100644
---- a/drivers/nvme/host/core.c
-+++ b/drivers/nvme/host/core.c
-@@ -2701,7 +2701,10 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
- 		ctrl->hmmaxd = le16_to_cpu(id->hmmaxd);
- 
- 		/* Grab required IO queue size */
--		ctrl->iosqes = id->sqes & 0xf;
-+		if (ctrl->quirks & NVME_QUIRK_128_BYTES_SQES)
-+			ctrl->iosqes = 7;
-+		else
-+			ctrl->iosqes = id->sqes & 0xf;
- 		if (ctrl->iosqes < NVME_NVM_IOSQES) {
- 			dev_err(ctrl->device,
- 				"unsupported required IO queue size %d\n", ctrl->iosqes);
-diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
-index 34ef35fcd8a5..b2a78d08b984 100644
---- a/drivers/nvme/host/nvme.h
-+++ b/drivers/nvme/host/nvme.h
-@@ -92,6 +92,16 @@ enum nvme_quirks {
- 	 * Broken Write Zeroes.
- 	 */
- 	NVME_QUIRK_DISABLE_WRITE_ZEROES		= (1 << 9),
-+
-+	/*
-+	 * Use only one interrupt vector for all queues
-+	 */
-+	NVME_QUIRK_SINGLE_VECTOR		= (1 << 10),
-+
-+	/*
-+	 * Use non-standard 128 bytes SQEs.
-+	 */
-+	NVME_QUIRK_128_BYTES_SQES		= (1 << 11),
- };
- 
- /*
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 54b35ea4af88..ab2358137419 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -2080,6 +2080,9 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
- 	dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
- 	dev->io_queues[HCTX_TYPE_READ] = 0;
- 
-+	if (dev->ctrl.quirks & NVME_QUIRK_SINGLE_VECTOR)
-+		irq_queues = 1;
-+
- 	return pci_alloc_irq_vectors_affinity(pdev, 1, irq_queues,
- 			      PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY, &affd);
- }
-@@ -3037,6 +3040,9 @@ static const struct pci_device_id nvme_id_table[] = {
- 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
-+		.driver_data = NVME_QUIRK_SINGLE_VECTOR |
-+				NVME_QUIRK_128_BYTES_SQES },
- 	{ 0, }
- };
- MODULE_DEVICE_TABLE(pci, nvme_id_table);
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
index 7e734a4f13ab..d7ea4ac2c498 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,8 +1,12 @@
-{ lib, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole
+{ lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, ubootTools
+, fetchpatch
 }:
 
 let
+  lib_ = lib;
+  stdenv_ = stdenv;
+
   readConfig = configfile: import (runCommand "config.nix" {} ''
     echo "{" > "$out"
     while IFS='=' read key val; do
@@ -12,18 +16,16 @@ let
     done < "${configfile}"
     echo "}" >> $out
   '').outPath;
-in {
-  lib,
-  # Allow overriding stdenv on each buildLinux call
-  stdenv,
+in lib.makeOverridable ({
   # The kernel version
   version,
   # Position of the Linux build expression
   pos ? null,
   # Additional kernel make flags
   extraMakeFlags ? [],
-  # The version of the kernel module directory
-  modDirVersion ? version,
+  # The name of the kernel module directory
+  # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
+  modDirVersion ? lib.versions.pad 3 version,
   # The kernel source (tarball, git checkout, etc.)
   src,
   # a list of { name=..., patch=..., extraConfig=...} patches
@@ -36,7 +38,7 @@ in {
   # Custom seed used for CONFIG_GCC_PLUGIN_RANDSTRUCT if enabled. This is
   # automatically extended with extra per-version and per-config values.
   randstructSeed ? "",
-  # Use defaultMeta // extraMeta
+  # Extra meta attributes
   extraMeta ? {},
 
   # for module compatibility
@@ -47,284 +49,164 @@ in {
   # Whether to utilize the controversial import-from-derivation feature to parse the config
   allowImportFromDerivation ? false,
   # ignored
-  features ? null,
+  features ? null, lib ? lib_, stdenv ? stdenv_,
 }:
 
 let
+  config_ = config;
+in
+
+let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl ]
-    ++ optional (lib.versionAtLeast version "4.14") libelf
-    ++ optional (lib.versionAtLeast version "5.13") zstd;
+  moduleBuildDependencies = [
+    pahole
+    perl
+    libelf
+    # module makefiles often run uname commands to find out the kernel version
+    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
+  config = let attrName = attr: "CONFIG_" + attr; in {
+    isSet = attr: hasAttr (attrName attr) config;
 
-  installkernel = buildPackages.writeShellScript "installkernel" ''
-    set -e
-    mkdir -p $4
-    cp -av $2 $4
-    cp -av $3 $4
-  '';
+    getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
+
+    isYes = attr: (config.getValue attr) == "y";
+
+    isNo = attr: (config.getValue attr) == "n";
+
+    isModule = attr: (config.getValue attr) == "m";
+
+    isEnabled = attr: (config.isModule attr) || (config.isYes attr);
+
+    isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
+  } // config_;
 
-  drvAttrs = config_: kernelConf: kernelPatches: configfile:
-    let
-      config = let attrName = attr: "CONFIG_" + attr; in {
-        isSet = attr: hasAttr (attrName attr) config;
-
-        getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
-
-        isYes = attr: (config.getValue attr) == "y";
-
-        isNo = attr: (config.getValue attr) == "n";
-
-        isModule = attr: (config.getValue attr) == "m";
-
-        isEnabled = attr: (config.isModule attr) || (config.isYes attr);
-
-        isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
-      } // config_;
-
-      isModular = config.isYes "MODULES";
-
-      buildDTBs = kernelConf.DTB or false;
-
-      installsFirmware = (config.isEnabled "FW_LOADER") &&
-        (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL")) &&
-        (lib.versionOlder version "4.14");
-    in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
-      passthru = rec {
-        inherit version modDirVersion config kernelPatches configfile
-          moduleBuildDependencies stdenv;
-        inherit isZen isHardened isLibre;
-        isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-        baseVersion = lib.head (lib.splitString "-rc" version);
-        kernelOlder = lib.versionOlder baseVersion;
-        kernelAtLeast = lib.versionAtLeast baseVersion;
-      };
-
-      inherit src;
-
-      patches =
-        map (p: p.patch) kernelPatches
-        # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
-        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
-        # Fixes determinism by normalizing metadata for the archive of kheaders
-        ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
-
-      prePatch = ''
-        for mf in $(find -name Makefile -o -name Makefile.include -o -name install.sh); do
-            echo "stripping FHS paths in \`$mf'..."
-            sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
-        done
-        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
-
-        # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
-        # This way kernels can be bit-by-bit reproducible depending on settings
-        # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
-        # See also https://kernelnewbies.org/BuildId
-        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
-
-        # Some linux-hardened patches now remove certain files in the scripts directory, so we cannot
-        # patch all scripts until after patches are applied.
-        # However, scripts/ld-version.sh is still ran when generating a configfile for a kernel, so it needs
-        # to be patched prior to patchPhase
-        patchShebangs scripts/ld-version.sh
-      '';
-
-      postPatch = ''
-        # Set randstruct seed to a deterministic but diversified value. Note:
-        # we could have instead patched gen-random-seed.sh to take input from
-        # the buildFlags, but that would require also patching the kernel's
-        # toplevel Makefile to add a variable export. This would be likely to
-        # cause future patch conflicts.
-        if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
-          substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
-            --replace NIXOS_RANDSTRUCT_SEED \
-            $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
-        fi
-
-        patchShebangs scripts
-      '';
-
-      configurePhase = ''
-        runHook preConfigure
-
-        mkdir build
-        export buildRoot="$(pwd)/build"
-
-        echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
-
-        if [ -f "$buildRoot/.config" ]; then
-          echo "Could not link $buildRoot/.config : file exists"
-          exit 1
-        fi
-        ln -sv ${configfile} $buildRoot/.config
-
-        # reads the existing .config file and prompts the user for options in
-        # the current kernel source that are not found in the file.
-        make $makeFlags "''${makeFlagsArray[@]}" oldconfig
-        runHook postConfigure
-
-        make $makeFlags "''${makeFlagsArray[@]}" prepare
-        actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
-        if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
-          echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
-          exit 1
-        fi
-
-        # Note: we can get rid of this once http://permalink.gmane.org/gmane.linux.kbuild.devel/13800 is merged.
-        buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
-        cd $buildRoot
-      '';
-
-      buildFlags = [
-        "KBUILD_BUILD_VERSION=1-NixOS"
-        kernelConf.target
-        "vmlinux"  # for "perf" and things like that
-      ] ++ optional isModular "modules"
-        ++ optional buildDTBs "dtbs"
-      ++ extraMakeFlags;
-
-      installFlags = [
-        "INSTALLKERNEL=${installkernel}"
-        "INSTALL_PATH=$(out)"
-      ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-      ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware"
-      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
-
-      preInstall = ''
-        installFlagsArray+=("-j$NIX_BUILD_CORES")
-      '';
-
-      # Some image types need special install targets (e.g. uImage is installed with make uinstall)
-      installTargets = [
-        (kernelConf.installTarget or (
-          /**/ if kernelConf.target == "uImage" then "uinstall"
-          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
-          else "install"))
-      ];
-
-      postInstall = (optionalString installsFirmware ''
-        mkdir -p $out/lib/firmware
-      '') + (if isModular then ''
-        mkdir -p $dev
-        cp vmlinux $dev/
-        if [ -z "''${dontStrip-}" ]; then
-          installFlagsArray+=("INSTALL_MOD_STRIP=1")
-        fi
-        make modules_install $makeFlags "''${makeFlagsArray[@]}" \
-          $installFlags "''${installFlagsArray[@]}"
-        unlink $out/lib/modules/${modDirVersion}/build
-        unlink $out/lib/modules/${modDirVersion}/source
-
-        mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
-
-        # To save space, exclude a bunch of unneeded stuff when copying.
-        (cd .. && rsync --archive --prune-empty-dirs \
-            --exclude='/build/' \
-            * $dev/lib/modules/${modDirVersion}/source/)
-
-        cd $dev/lib/modules/${modDirVersion}/source
-
-        cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-        make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-        # For reproducibility, removes accidental leftovers from a `cc1` call
-        # from a `try-run` call from the Makefile
-        rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
-        # Keep some extra files on some arches (powerpc, aarch64)
-        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
-          if [ -f "$buildRoot/$f" ]; then
-            cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
-          fi
-        done
-
-        # !!! No documentation on how much of the source tree must be kept
-        # If/when kernel builds fail due to missing files, you can add
-        # them here. Note that we may see packages requiring headers
-        # from drivers/ in the future; it adds 50M to keep all of its
-        # headers on 3.10 though.
-
-        chmod u+w -R ..
-        arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
-
-        # Remove unused arches
-        for d in $(cd arch/; ls); do
-          if [ "$d" = "$arch" ]; then continue; fi
-          if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
-          rm -rf arch/$d
-        done
-
-        # Remove all driver-specific code (50M of which is headers)
-        rm -fR drivers
-
-        # Keep all headers
-        find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
-
-        # Keep linker scripts (they are required for out-of-tree modules on aarch64)
-        find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
-
-        # Keep root and arch-specific Makefiles
-        chmod u-w Makefile arch/"$arch"/Makefile*
-
-        # Keep whole scripts dir
-        chmod u-w -R scripts
-
-        # Delete everything not kept
-        find . -type f -perm -u=w -print0 | xargs -0 -r rm
-
-        # Delete empty directories
-        find -empty -type d -delete
-
-        # Remove reference to kmod
-        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-      '' else optionalString installsFirmware ''
-        make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
-          $installFlags "''${installFlagsArray[@]}"
-      '');
-
-      requiredSystemFeatures = [ "big-parallel" ];
-
-      meta = {
-        description =
-          "The Linux kernel" +
-          (if kernelPatches == [] then "" else
-            " (with patches: "
-            + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-            + ")");
-        license = lib.licenses.gpl2Only;
-        homepage = "https://www.kernel.org/";
-        maintainers = lib.teams.linux-kernel.members ++ [
-          maintainers.thoughtpolice
-        ];
-        platforms = platforms.linux;
-        timeout = 14400; # 4 hours
-      } // extraMeta;
-    };
+  isModular = config.isYes "MODULES";
+
+  kernelConf = stdenv.hostPlatform.linux-kernel;
+  target = kernelConf.target or "vmlinux";
+
+  buildDTBs = kernelConf.DTB or false;
 in
 
-assert (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") -> libelf != null;
+assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
-stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
+stdenv.mkDerivation ({
   pname = "linux";
-  inherit version;
-
-  enableParallelBuilding = true;
+  inherit version src;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
-      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
-      ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
-      # Removed util-linuxMinimal since it should not be a dependency.
-      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-      ;
+  nativeBuildInputs = [
+    bc gmp libmpc mpfr nettools openssl perl python3Minimal rsync ubootTools
+    zstd
+  ] ++ optional  (lib.versionOlder version "5.8") libelf
+    ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+    ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+    ++ optional  (lib.versionAtLeast version "5.8")  elfutils;
+
+  patches =
+    map (p: p.patch) kernelPatches
+    # Required for deterministic builds along with some postPatch magic.
+    ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+    ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
+    # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
+    # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
+    # https://github.com/openzfs/zfs/pull/13367
+    ++ optional (lib.versionAtLeast version "5.12" &&
+                 lib.versionOlder version "5.19" &&
+                 stdenv.hostPlatform.isPower)
+      (fetchpatch {
+        url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
+        hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
+      });
+
+  preUnpack = ''
+    # The same preUnpack is used to build the configfile,
+    # which does not have $dev.
+    if [ -n "$dev" ]; then
+        mkdir -p $dev/lib/modules/${modDirVersion}
+        cd $dev/lib/modules/${modDirVersion}
+    fi
+  '';
+
+  postUnpack = ''
+    mv -Tv "$sourceRoot" source 2>/dev/null || :
+    export sourceRoot=$PWD/source
+  '';
+
+  postPatch = ''
+    sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+
+    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
+    # FIXME: remove when no longer needed
+    substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
+
+    # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
+    # This way kernels can be bit-by-bit reproducible depending on settings
+    # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
+    # See also https://kernelnewbies.org/BuildId
+    sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
+
+    # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+    [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
+
+    # Set randstruct seed to a deterministic but diversified value. Note:
+    # we could have instead patched gen-random-seed.sh to take input from
+    # the buildFlags, but that would require also patching the kernel's
+    # toplevel Makefile to add a variable export. This would be likely to
+    # cause future patch conflicts.
+    for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
+      if [ -f "$file" ]; then
+        substituteInPlace "$file" \
+          --replace NIXOS_RANDSTRUCT_SEED \
+          $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+        break
+      fi
+    done
+
+    patchShebangs scripts
+
+    # also patch arch-specific install scripts
+    for i in $(find arch -name install.sh); do
+        patchShebangs "$i"
+    done
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export buildRoot=$TMPDIR/kernel-buildroot
+    mkdir -p $buildRoot
+
+    echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
+
+    if [ -f "$buildRoot/.config" ]; then
+      echo "Could not link $buildRoot/.config : file exists"
+      exit 1
+    fi
+    ln -sv ${configfile} $buildRoot/.config
+
+    # reads the existing .config file and prompts the user for options in
+    # the current kernel source that are not found in the file.
+    make $makeFlags "''${makeFlagsArray[@]}" oldconfig
+    runHook postConfigure
+
+    make $makeFlags "''${makeFlagsArray[@]}" prepare
+    actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
+    if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
+      echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
+      exit 1
+    fi
+
+    buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
+
+    cd $buildRoot
+  '';
 
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
@@ -333,11 +215,202 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
     "O=$(buildRoot)"
     "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+    "HOSTLD=${buildPackages.stdenv.cc.bintools}/bin/${buildPackages.stdenv.cc.targetPrefix}ld"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ] ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [])
+  ] ++ (kernelConf.makeFlags or [])
     ++ extraMakeFlags;
 
   karch = stdenv.hostPlatform.linuxArch;
-} // (optionalAttrs (pos != null) { inherit pos; }))
+
+  buildFlags = [
+    "DTC_FLAGS=-@"
+    "KBUILD_BUILD_VERSION=1-NixOS"
+
+    # Set by default in the kernel since a73619a845d5,
+    # replicated here to apply to older versions.
+    # Makes __FILE__ relative to the build directory.
+    "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
+  ] ++ extraMakeFlags;
+
+  installFlags = [
+    "INSTALL_PATH=$(out)"
+  ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
+  ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
+
+  preInstall = let
+    # All we really need to do here is copy the final image and System.map to $out,
+    # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+    # for the rest. Easy, right?
+    #
+    # Unfortunately for us, the obvious way of getting the built image path,
+    # make -s image_name, does not work correctly, because some architectures
+    # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+    # so we end up attempting to install the thing we didn't actually build.
+    #
+    # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+    #
+    # The kernel has an install target, which runs a pretty simple shell script
+    # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+    # which kernel version you're looking at) that tries to do something sensible.
+    #
+    # (it would be great to hijack this script immediately, as it has all the
+    #   information we need passed to it and we don't need it to try and be smart,
+    #   but unfortunately, the exact location of the scripts differs between kernel
+    #   versions, and they're seemingly not considered to be public API at all)
+    #
+    # One of the ways it tries to discover what "something sensible" actually is
+    # is by delegating to what's supposed to be a user-provided install script
+    # located at ~/bin/installkernel.
+    #
+    # (the other options are:
+    #   - a distribution-specific script at /sbin/installkernel,
+    #        which we can't really create in the sandbox easily
+    #   - an architecture-specific script at arch/$arch/boot/install.sh,
+    #        which attempts to guess _something_ and usually guesses very wrong)
+    #
+    # More specifically, the install script exec's into ~/bin/installkernel, if one
+    # exists, with the following arguments:
+    #
+    # $1: $KERNELRELEASE - full kernel version string
+    # $2: $KBUILD_IMAGE - the final image path
+    # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+    # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+    #
+    # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+    # by the makefile overlords for our own nefarious ends.
+    #
+    # Note that the makefiles specifically look in ~/bin/installkernel, and
+    # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+    # so HOME needs to be set to just the store path.
+    #
+    # FIXME: figure out a less roundabout way of doing this.
+    installkernel = buildPackages.writeShellScriptBin "installkernel" ''
+      cp -av $2 $4
+      cp -av $3 $4
+    '';
+  in ''
+    installFlagsArray+=("-j$NIX_BUILD_CORES")
+    export HOME=${installkernel}
+  '';
+
+  # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+  installTargets = [
+    (kernelConf.installTarget or (
+      /**/ if target == "uImage" then "uinstall"
+      else if target == "zImage" || target == "Image.gz" then "zinstall"
+      else "install"))
+  ];
+
+  postInstall = optionalString isModular ''
+    if [ -z "''${dontStrip-}" ]; then
+      installFlagsArray+=("INSTALL_MOD_STRIP=1")
+    fi
+    make modules_install $makeFlags "''${makeFlagsArray[@]}" \
+      $installFlags "''${installFlagsArray[@]}"
+    unlink $out/lib/modules/${modDirVersion}/build
+    unlink $out/lib/modules/${modDirVersion}/source
+
+    mkdir $dev/lib/modules/${modDirVersion}/build
+
+    cd $dev/lib/modules/${modDirVersion}/source
+
+    cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
+    make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
+
+    # For reproducibility, removes accidental leftovers from a `cc1` call
+    # from a `try-run` call from the Makefile
+    rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
+
+    # Keep some extra files
+    for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
+             scripts/gdb/linux vmlinux vmlinux-gdb.py
+    do
+      if [ -e "$buildRoot/$f" ]; then
+        mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
+        cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+      fi
+    done
+    ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
+
+    # !!! No documentation on how much of the source tree must be kept
+    # If/when kernel builds fail due to missing files, you can add
+    # them here. Note that we may see packages requiring headers
+    # from drivers/ in the future; it adds 50M to keep all of its
+    # headers on 3.10 though.
+
+    chmod u+w -R ..
+    arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
+
+    # Remove unused arches
+    for d in $(cd arch/; ls); do
+      if [ "$d" = "$arch" ]; then continue; fi
+      if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
+      rm -rf arch/$d
+    done
+
+    # Remove all driver-specific code (50M of which is headers)
+    rm -fR drivers
+
+    # Keep all headers
+    find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
+
+    # Keep linker scripts (they are required for out-of-tree modules on aarch64)
+    find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
+
+    # Keep root and arch-specific Makefiles
+    chmod u-w Makefile arch/"$arch"/Makefile*
+
+    # Keep whole scripts dir
+    chmod u-w -R scripts
+
+    # Delete everything not kept
+    find . -type f -perm -u=w -print0 | xargs -0 -r rm
+
+    # Delete empty directories
+    find -empty -type d -delete
+
+    # Remove reference to kmod
+    sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+  '';
+
+  preFixup = ''
+    # Don't strip $dev/lib/modules/*/vmlinux
+    stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru = rec {
+    inherit version modDirVersion config kernelPatches configfile
+      moduleBuildDependencies stdenv;
+    inherit isZen isHardened isLibre;
+    isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
+    baseVersion = lib.head (lib.splitString "-rc" version);
+    kernelOlder = lib.versionOlder baseVersion;
+    kernelAtLeast = lib.versionAtLeast baseVersion;
+  };
+
+  requiredSystemFeatures = [ "big-parallel" ];
+
+  meta = {
+    description =
+      "The Linux kernel" +
+      (if kernelPatches == [] then "" else
+        " (with patches: "
+        + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
+        + ")");
+    license = lib.licenses.gpl2Only;
+    homepage = "https://www.kernel.org/";
+    maintainers = lib.teams.linux-kernel.members ++ [
+      maintainers.thoughtpolice
+    ];
+    platforms = platforms.linux;
+    timeout = 14400; # 4 hours
+  } // extraMeta;
+} // optionalAttrs (pos != null) {
+  inherit pos;
+} // optionalAttrs isModular {
+  outputs = [ "out" "dev" ];
+}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/p9-fixes.patch b/nixpkgs/pkgs/os-specific/linux/kernel/p9-fixes.patch
deleted file mode 100644
index f6061b60667a..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/p9-fixes.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode *inode, void *data)
- 
- 	if (v9inode->qid.type != st->qid.type)
- 		return 0;
-+
-+	if (v9inode->qid.path != st->qid.path)
-+		return 0;
- 	return 1;
- }
- 
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct inode *inode, void *data)
- 
- 	if (v9inode->qid.type != st->qid.type)
- 		return 0;
-+
-+	if (v9inode->qid.path != st->qid.path)
-+		return 0;
- 	return 1;
- }
- 
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 3ce672af1596..f1c8ad373f90 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -749,8 +749,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
- 	}
- again:
- 	/* Wait for the response */
--	err = wait_event_interruptible(*req->wq,
--				       req->status >= REQ_STATUS_RCVD);
-+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
- 
- 	/*
- 	 * Make sure our req is coherent with regard to updates in other
-diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
-index f24b25c25106..f3a4efcf1456 100644
---- a/net/9p/trans_virtio.c
-+++ b/net/9p/trans_virtio.c
-@@ -286,8 +286,8 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
- 		if (err == -ENOSPC) {
- 			chan->ring_bufs_avail = 0;
- 			spin_unlock_irqrestore(&chan->lock, flags);
--			err = wait_event_interruptible(*chan->vc_wq,
--							chan->ring_bufs_avail);
-+			err = wait_event_killable(*chan->vc_wq,
-+						  chan->ring_bufs_avail);
- 			if (err  == -ERESTARTSYS)
- 				return err;
- 
-@@ -327,7 +327,7 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
- 		 * Other zc request to finish here
- 		 */
- 		if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
--			err = wait_event_interruptible(vp_wq,
-+			err = wait_event_killable(vp_wq,
- 			      (atomic_read(&vp_pinned) < chan->p9_max_pages));
- 			if (err == -ERESTARTSYS)
- 				return err;
-@@ -471,8 +471,8 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
- 		if (err == -ENOSPC) {
- 			chan->ring_bufs_avail = 0;
- 			spin_unlock_irqrestore(&chan->lock, flags);
--			err = wait_event_interruptible(*chan->vc_wq,
--						       chan->ring_bufs_avail);
-+			err = wait_event_killable(*chan->vc_wq,
-+						  chan->ring_bufs_avail);
- 			if (err  == -ERESTARTSYS)
- 				goto err_out;
- 
-@@ -489,8 +489,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
- 	virtqueue_kick(chan->vq);
- 	spin_unlock_irqrestore(&chan->lock, flags);
- 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
--	err = wait_event_interruptible(*req->wq,
--				       req->status >= REQ_STATUS_RCVD);
-+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
- 	/*
- 	 * Non kernel buffers are pinned, unpin them
- 	 */
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
index f64a0a0ef158..972235c7f852 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
@@ -29,21 +29,11 @@
       patch = ./request-key-helper-updated.patch;
     };
 
-  p9_fixes =
-    { name = "p9-fixes";
-      patch = ./p9-fixes.patch;
-    };
-
   modinst_arg_list_too_long =
     { name = "modinst-arglist-too-long";
       patch = ./modinst-arg-list-too-long.patch;
     };
 
-  genksyms_fix_segfault =
-    { name = "genksyms-fix-segfault";
-      patch = ./genksyms-fix-segfault.patch;
-    };
-
   cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
 
   hardened = let
@@ -56,36 +46,6 @@
     patches = lib.importJSON ./hardened/patches.json;
   in lib.mapAttrs mkPatch patches;
 
-  # https://bugzilla.kernel.org/show_bug.cgi?id=197591#c6
-  iwlwifi_mvm_support_version_7_scan_req_umac_fw_command = rec {
-    name = "iwlwifi_mvm_support_version_7_scan_req_umac_fw_command";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://bugzilla.kernel.org/attachment.cgi?id=260597";
-      sha256 = "09096npxpgvlwdz3pb3m9brvxh7vy0xc9z9p8hh85xyczyzcsjhr";
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/42755
-  xen-netfront_fix_mismatched_rtnl_unlock = rec {
-    name = "xen-netfront_fix_mismatched_rtnl_unlock";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://github.com/torvalds/linux/commit/cb257783c2927b73614b20f915a91ff78aa6f3e8.patch";
-      sha256 = "0xhblx2j8wi3kpnfpgjjwlcwdry97ji2aaq54r3zirk5g5p72zs8";
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/42755
-  xen-netfront_update_features_after_registering_netdev = rec {
-    name = "xen-netfront_update_features_after_registering_netdev";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://github.com/torvalds/linux/commit/45c8184c1bed1ca8a7f02918552063a00b909bf5.patch";
-      sha256 = "1l8xq02rd7vakxg52xm9g4zng0ald866rpgm8kjlh88mwwyjkrwv";
-    };
-  };
-
   # Adapted for Linux 5.4 from:
   # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04896832c94aae4842100cafb8d3a73e1bed3a45
   rtl8761b_support =
@@ -98,9 +58,12 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
-  # patches from https://lkml.org/lkml/2019/7/15/1748
-  mac_nvme_t2 = rec {
-    name = "mac_nvme_t2";
-    patch = ./mac-nvme-t2.patch;
+  CVE-2023-32233 = rec {
+    name = "CVE-2023-32233";
+    patch = fetchpatch {
+      name = name + ".patch";
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab";
+      hash = "sha256-DYPWgraXPNeFkjtuDYkFXHnCJ4yDewrukM2CCAqC2BE=";
+    };
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch b/nixpkgs/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
deleted file mode 100644
index 5f4f2fc0b4a9..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
+++ /dev/null
@@ -1,352 +0,0 @@
-Fetched as:
-    $ wget 'https://github.com/torvalds/linux/compare/00b32625982e0c796f0abb8effcac9c05ef55bd3...600b7b26c07a070d0153daa76b3806c1e52c9e00.patch'
-
-Adds support for binutils-2.39 API change around init_disassemble_info().
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -70,6 +70,7 @@ FEATURE_TESTS_BASIC :=                  \
-         libaio				\
-         libzstd				\
-         disassembler-four-args		\
-+        disassembler-init-styled	\
-         file-handle
- 
- # FEATURE_TESTS_BASIC + FEATURE_TESTS_EXTRA is the complete list
---- a/tools/build/feature/Makefile
-+++ b/tools/build/feature/Makefile
-@@ -18,6 +18,7 @@ FILES=                                          \
-          test-libbfd.bin                        \
-          test-libbfd-buildid.bin		\
-          test-disassembler-four-args.bin        \
-+         test-disassembler-init-styled.bin	\
-          test-reallocarray.bin			\
-          test-libbfd-liberty.bin                \
-          test-libbfd-liberty-z.bin              \
-@@ -248,6 +249,9 @@ $(OUTPUT)test-libbfd-buildid.bin:
- $(OUTPUT)test-disassembler-four-args.bin:
- 	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
- 
-+$(OUTPUT)test-disassembler-init-styled.bin:
-+	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
-+
- $(OUTPUT)test-reallocarray.bin:
- 	$(BUILD)
- 
---- a/tools/build/feature/test-all.c
-+++ b/tools/build/feature/test-all.c
-@@ -166,6 +166,10 @@
- # include "test-disassembler-four-args.c"
- #undef main
- 
-+#define main main_test_disassembler_init_styled
-+# include "test-disassembler-init-styled.c"
-+#undef main
-+
- #define main main_test_libzstd
- # include "test-libzstd.c"
- #undef main
---- /dev/null
-+++ b/tools/build/feature/test-disassembler-init-styled.c
-@@ -0,0 +1,13 @@
-+// SPDX-License-Identifier: GPL-2.0
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+int main(void)
-+{
-+	struct disassemble_info info;
-+
-+	init_disassemble_info(&info, stdout,
-+			      NULL, NULL);
-+
-+	return 0;
-+}
-
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -135,8 +135,7 @@ FEATURE_DISPLAY ?=              \
-          get_cpuid              \
-          bpf			\
-          libaio			\
--         libzstd		\
--         disassembler-four-args
-+         libzstd
- 
- # Set FEATURE_CHECK_(C|LD)FLAGS-all for all FEATURE_TESTS features.
- # If in the future we need per-feature checks/flags for features not
-
---- /dev/null
-+++ b/tools/include/tools/dis-asm-compat.h
-@@ -0,0 +1,55 @@
-+/* SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause */
-+#ifndef _TOOLS_DIS_ASM_COMPAT_H
-+#define _TOOLS_DIS_ASM_COMPAT_H
-+
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+/* define types for older binutils version, to centralize ifdef'ery a bit */
-+#ifndef DISASM_INIT_STYLED
-+enum disassembler_style {DISASSEMBLER_STYLE_NOT_EMPTY};
-+typedef int (*fprintf_styled_ftype) (void *, enum disassembler_style, const char*, ...);
-+#endif
-+
-+/*
-+ * Trivial fprintf wrapper to be used as the fprintf_styled_func argument to
-+ * init_disassemble_info_compat() when normal fprintf suffices.
-+ */
-+static inline int fprintf_styled(void *out,
-+				 enum disassembler_style style,
-+				 const char *fmt, ...)
-+{
-+	va_list args;
-+	int r;
-+
-+	(void)style;
-+
-+	va_start(args, fmt);
-+	r = vfprintf(out, fmt, args);
-+	va_end(args);
-+
-+	return r;
-+}
-+
-+/*
-+ * Wrapper for init_disassemble_info() that hides version
-+ * differences. Depending on binutils version and architecture either
-+ * fprintf_func or fprintf_styled_func will be called.
-+ */
-+static inline void init_disassemble_info_compat(struct disassemble_info *info,
-+						void *stream,
-+						fprintf_ftype unstyled_func,
-+						fprintf_styled_ftype styled_func)
-+{
-+#ifdef DISASM_INIT_STYLED
-+	init_disassemble_info(info, stream,
-+			      unstyled_func,
-+			      styled_func);
-+#else
-+	(void)styled_func;
-+	init_disassemble_info(info, stream,
-+			      unstyled_func);
-+#endif
-+}
-+
-+#endif /* _TOOLS_DIS_ASM_COMPAT_H */
-
---- a/tools/perf/Makefile.config
-+++ b/tools/perf/Makefile.config
-@@ -298,6 +298,7 @@ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS)
- FEATURE_CHECK_LDFLAGS-libaio = -lrt
- 
- FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes -ldl
-+FEATURE_CHECK_LDFLAGS-disassembler-init-styled = -lbfd -lopcodes -ldl
- 
- CORE_CFLAGS += -fno-omit-frame-pointer
- CORE_CFLAGS += -ggdb3
-@@ -924,13 +925,16 @@ ifndef NO_LIBBFD
-     ifeq ($(feature-libbfd-liberty), 1)
-       EXTLIBS += -lbfd -lopcodes -liberty
-       FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl
-+      FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -ldl
-     else
-       ifeq ($(feature-libbfd-liberty-z), 1)
-         EXTLIBS += -lbfd -lopcodes -liberty -lz
-         FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl
-+        FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -lz -ldl
-       endif
-     endif
-     $(call feature_check,disassembler-four-args)
-+    $(call feature_check,disassembler-init-styled)
-   endif
- 
-   ifeq ($(feature-libbfd-buildid), 1)
-@@ -1044,6 +1048,10 @@ ifeq ($(feature-disassembler-four-args), 1)
-     CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
- 
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
-+
- ifeq (${IS_64_BIT}, 1)
-   ifndef NO_PERF_READ_VDSO32
-     $(call feature_check,compile-32)
---- a/tools/perf/util/annotate.c
-+++ b/tools/perf/util/annotate.c
-@@ -1720,6 +1720,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
- #include <bpf/btf.h>
- #include <bpf/libbpf.h>
- #include <linux/btf.h>
-+#include <tools/dis-asm-compat.h>
- 
- static int symbol__disassemble_bpf(struct symbol *sym,
- 				   struct annotate_args *args)
-@@ -1762,9 +1763,9 @@ static int symbol__disassemble_bpf(struct symbol *sym,
- 		ret = errno;
- 		goto out;
- 	}
--	init_disassemble_info(&info, s,
--			      (fprintf_ftype) fprintf);
--
-+	init_disassemble_info_compat(&info, s,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -34,7 +34,7 @@ else
- endif
- 
- FEATURE_USER = .bpf
--FEATURE_TESTS = libbfd disassembler-four-args
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
- FEATURE_DISPLAY = libbfd disassembler-four-args
- 
- check_feat := 1
-@@ -56,6 +56,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- $(OUTPUT)%.yacc.c: $(srctree)/tools/bpf/%.y
- 	$(QUIET_BISON)$(YACC) -o $@ -d $<
---- a/tools/bpf/bpf_jit_disasm.c
-+++ b/tools/bpf/bpf_jit_disasm.c
-@@ -28,6 +28,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <limits.h>
-+#include <tools/dis-asm-compat.h>
- 
- #define CMD_ACTION_SIZE_BUFFER		10
- #define CMD_ACTION_READ_ALL		3
-@@ -64,7 +65,9 @@ static void get_asm_insns(uint8_t *image, size_t len, int opcodes)
- 	assert(bfdf);
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
--	init_disassemble_info(&info, stdout, (fprintf_ftype) fprintf);
-+	init_disassemble_info_compat(&info, stdout,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 	info.buffer = image;
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -35,7 +35,7 @@ endif
- 
- FEATURE_USER = .bpf
- FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
--FEATURE_DISPLAY = libbfd disassembler-four-args
-+FEATURE_DISPLAY = libbfd
- 
- check_feat := 1
- NON_CHECK_FEAT_TARGETS := clean bpftool_clean runqslower_clean resolve_btfids_clean
-
---- a/tools/bpf/bpftool/Makefile
-+++ b/tools/bpf/bpftool/Makefile
-@@ -93,7 +93,7 @@ INSTALL ?= install
- RM ?= rm -f
- 
- FEATURE_USER = .bpftool
--FEATURE_TESTS = libbfd disassembler-four-args zlib libcap \
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled zlib libcap \
- 	clang-bpf-co-re
- FEATURE_DISPLAY = libbfd disassembler-four-args zlib libcap \
- 	clang-bpf-co-re
-@@ -117,6 +117,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- LIBS = $(LIBBPF) -lelf -lz
- LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz
---- a/tools/bpf/bpftool/jit_disasm.c
-+++ b/tools/bpf/bpftool/jit_disasm.c
-@@ -24,6 +24,7 @@
- #include <sys/stat.h>
- #include <limits.h>
- #include <bpf/libbpf.h>
-+#include <tools/dis-asm-compat.h>
- 
- #include "json_writer.h"
- #include "main.h"
-@@ -39,15 +40,12 @@ static void get_exec_path(char *tpath, size_t size)
- }
- 
- static int oper_count;
--static int fprintf_json(void *out, const char *fmt, ...)
-+static int printf_json(void *out, const char *fmt, va_list ap)
- {
--	va_list ap;
- 	char *s;
- 	int err;
- 
--	va_start(ap, fmt);
- 	err = vasprintf(&s, fmt, ap);
--	va_end(ap);
- 	if (err < 0)
- 		return -1;
- 
-@@ -73,6 +71,32 @@ static int fprintf_json(void *out, const char *fmt, ...)
- 	return 0;
- }
- 
-+static int fprintf_json(void *out, const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
-+static int fprintf_json_styled(void *out,
-+			       enum disassembler_style style __maybe_unused,
-+			       const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
- void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 		       const char *arch, const char *disassembler_options,
- 		       const struct btf *btf,
-@@ -99,11 +123,13 @@ void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
- 	if (json_output)
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf_json);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf_json,
-+					     fprintf_json_styled);
- 	else
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf,
-+					     fprintf_styled);
- 
- 	/* Update architecture info for offload. */
- 	if (arch) {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/perf/default.nix b/nixpkgs/pkgs/os-specific/linux/kernel/perf/default.nix
index d481eea7e753..620ecfc43df2 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -1,11 +1,58 @@
-{ lib, stdenv, fetchpatch, kernel, elfutils, python2, python3, perl, newt, slang, asciidoc, xmlto, makeWrapper
-, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkg-config, libunwind, binutils-unwrapped
-, libiberty, audit, libbfd, libopcodes, openssl, systemtap, numactl
+{ lib
+, stdenv
+, fetchpatch
+, fetchurl
+, kernel
+, elfutils
+, python3
+, perl
+, newt
+, slang
+, asciidoc
+, xmlto
+, makeWrapper
+, docbook_xsl
+, docbook_xml_dtd_45
+, libxslt
+, flex
+, bison
+, pkg-config
+, libunwind
+, binutils-unwrapped
+, libiberty
+, audit
+, libbfd
+, libbfd_2_38
+, libopcodes
+, libopcodes_2_38
+, libtraceevent
+, openssl
+, systemtap
+, numactl
 , zlib
-, withGtk ? false, gtk2
-, withZstd ? true, zstd
-, withLibcap ? true, libcap
+, babeltrace
+, withGtk ? false
+, gtk2
+, withZstd ? true
+, zstd
+, withLibcap ? true
+, libcap
 }:
+let
+  d3-flame-graph-templates = stdenv.mkDerivation rec {
+    pname = "d3-flame-graph-templates";
+    version = "4.1.3";
+
+    src = fetchurl {
+      url = "https://registry.npmjs.org/d3-flame-graph/-/d3-flame-graph-${version}.tgz";
+      sha256 = "sha256-W5/Vh5jarXUV224aIiTB2TnBFYT3naEIcG2945QjY8Q=";
+    };
+
+    installPhase = ''
+      install -D -m 0755 -t $out/share/d3-flame-graph/ ./dist/templates/*
+    '';
+  };
+in
 
 stdenv.mkDerivation {
   pname = "perf-linux";
@@ -13,66 +60,98 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
-  patches = lib.optionals (lib.versionAtLeast kernel.version "5.19" && lib.versionOlder kernel.version "5.20") [
-    # binutils-2.39 support around init_disassemble_info()
-    # API change.
-    # Will be included in 5.20.
-    ./5.19-binutils-2.39-support.patch
-  ];
+  postPatch = ''
+    # Linux scripts
+    patchShebangs scripts
 
-  preConfigure = ''
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.3") ''
+    # perf-specific scripts
+    patchShebangs tools/perf/pmu-events
+  '' + ''
     cd tools/perf
 
-    substituteInPlace Makefile \
-      --replace /usr/include/elfutils $elfutils/include/elfutils
-
     for x in util/build-id.c util/dso.c; do
       substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
     done
 
-    if [ -f bash_completion ]; then
-      sed -i 's,^have perf,_have perf,' bash_completion
-    fi
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
+    substituteInPlace scripts/python/flamegraph.py \
+      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
+      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
+
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
+    patchShebangs pmu-events/jevents.py
   '';
 
-  makeFlags = ["prefix=$(out)" "WERROR=0"] ++ kernel.makeFlags;
+  makeFlags = [ "prefix=$(out)" "WERROR=0" "ASCIIDOC8=1" ] ++ kernel.makeFlags
+    ++ lib.optional (!withGtk) "NO_GTK2=1"
+    ++ lib.optional (!withZstd) "NO_LIBZSTD=1"
+    ++ lib.optional (!withLibcap) "NO_LIBCAP=1";
 
   hardeningDisable = [ "format" ];
 
   # perf refers both to newt and slang
   nativeBuildInputs = [
-    asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-    flex bison libiberty audit makeWrapper pkg-config python3
+    asciidoc
+    xmlto
+    docbook_xsl
+    docbook_xml_dtd_45
+    libxslt
+    flex
+    bison
+    libiberty
+    audit
+    makeWrapper
+    pkg-config
+    python3
   ];
+
   buildInputs = [
-    elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
-    libopcodes python3 perl
-  ] ++ lib.optional withGtk gtk2
-    ++ (if (lib.versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ])
-    ++ lib.optional withZstd zstd
-    ++ lib.optional withLibcap libcap;
-
-  NIX_CFLAGS_COMPILE = toString [
+    elfutils
+    newt
+    slang
+    libtraceevent
+    libunwind
+    zlib
+    openssl
+    numactl
+    python3
+    perl
+    babeltrace
+  ] ++ (if (lib.versionAtLeast kernel.version "5.19")
+  then [ libbfd libopcodes ]
+  else [ libbfd_2_38 libopcodes_2_38 ])
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap) systemtap.stapBuild
+  ++ lib.optional withGtk gtk2
+  ++ lib.optional withZstd zstd
+  ++ lib.optional withLibcap libcap
+  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
+
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
     "-Wno-error=bool-compare"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=stringop-truncation"
   ];
 
-  postPatch = ''
-    patchShebangs scripts
-  '';
-
   doCheck = false; # requires "sparse"
-  doInstallCheck = false; # same
+
+  installTargets = [ "install" "install-man" ];
+
+  # TODO: Add completions based on perf-completion.sh
+  postInstall = ''
+    # Same as perf. Remove.
+    rm -f $out/bin/trace
+  '';
 
   separateDebugInfo = true;
-  installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
 
   preFixup = ''
-    # pull in 'objdump' into PATH to make annotations work
+    # Pull in 'objdump' into PATH to make annotations work.
+    # The embedded Python interpreter will search PATH to calculate the Python path configuration(Should be fixed by upstream).
+    # Add python.interpreter to PATH for now.
     wrapProgram $out/bin/perf \
-      --prefix PATH : "${binutils-unwrapped}/bin"
+      --prefix PATH : ${lib.makeBinPath [ binutils-unwrapped python3 ]}
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/update-zen.py b/nixpkgs/pkgs/os-specific/linux/kernel/update-zen.py
index 204a39ad3a9a..3c51f806d8f8 100755
--- a/nixpkgs/pkgs/os-specific/linux/kernel/update-zen.py
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/update-zen.py
@@ -78,6 +78,29 @@ def update_file(relpath, variant, version, suffix, sha256):
             print(result, end='')
 
 
+def read_file(relpath, variant):
+    file_path = os.path.join(DIR, relpath)
+    re_version = re.compile(fr'^\s*version = "(.+)"; #{variant}')
+    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; #{variant}')
+    version = None
+    suffix = None
+    with fileinput.FileInput(file_path, mode='r') as f:
+        for line in f:
+            version_match = re_version.match(line)
+            if version_match:
+                version = version_match.group(1)
+                continue
+
+            suffix_match = re_suffix.match(line)
+            if suffix_match:
+                suffix = suffix_match.group(1)
+                continue
+
+            if version and suffix:
+                break
+    return version, suffix
+
+
 if __name__ == "__main__":
     if len(sys.argv) == 1:
         panic("Update variant expected")
@@ -93,5 +116,7 @@ if __name__ == "__main__":
             zen_version = zen_match.group(1)
             zen_suffix = zen_match.group(2)
             break
-    zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
-    update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
+    old_version, old_suffix = read_file('zen-kernels.nix', variant)
+    if old_version != zen_version or old_suffix != zen_suffix:
+        zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
+        update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 53b00b93358a..8eaab5a6f8b1 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -3,24 +3,20 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "5.15.60";
-    hash = "sha256-XSOYgrJ/uvPpEG+P3Zy1geFeF/HMZ4LejsKWtTxMUTs=";
+    version = "6.1.31";
+    hash = "sha256-quYsp6h7IV6gUT0e55FeBlS8rH9OGrqdbM1XSIYNRV4=";
+    variant = "lts";
   };
 
-  edgeVariant = {
-    version = "5.19.1";
-    hash = "sha256-Fw+XW2YDAGKEzZ4AO88Y8GcypfOb6AjKp3XOlkT8ZTQ=";
+  mainVariant = {
+    version = "6.3.5";
+    hash = "sha256-2+8WDj1VdmIdC0DjmKyY/fMi5zoiXDAWy7EAmkImvXk=";
+    variant = "main";
   };
 
-  ttVariant = {
-    version = "5.15.54";
-    suffix = "xanmod1-tt";
-    hash = "sha256-4ck9PAFuIt/TxA/U+moGlVfCudJnzSuAw7ooFG3OJis=";
-  };
-
-  xanmodKernelFor = { version, suffix ? "xanmod1", hash }: buildLinux (args // rec {
+  xanmodKernelFor = { version, suffix ? "xanmod1", hash, variant }: buildLinux (args // rec {
     inherit version;
-    modDirVersion = "${version}-${suffix}";
+    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
 
     src = fetchFromGitHub {
       owner = "xanmod";
@@ -30,25 +26,8 @@ let
     };
 
     structuredExtraConfig = with lib.kernel; {
-      # removed options
-      CFS_BANDWIDTH = lib.mkForce (option no);
-      RT_GROUP_SCHED = lib.mkForce (option no);
-      SCHED_AUTOGROUP = lib.mkForce (option no);
-
       # AMD P-state driver
-      X86_AMD_PSTATE = yes;
-
-      # Paragon's NTFS3 driver
-      NTFS3_FS = module;
-      NTFS3_LZX_XPRESS = yes;
-      NTFS3_FS_POSIX_ACL = yes;
-
-      # Preemptive Full Tickless Kernel at 500Hz
-      SCHED_CORE = lib.mkForce (option no);
-      PREEMPT_VOLUNTARY = lib.mkForce no;
-      PREEMPT = lib.mkForce yes;
-      NO_HZ_FULL = yes;
-      HZ_500 = yes;
+      X86_AMD_PSTATE = lib.mkOverride 60 yes;
 
       # Google's BBRv2 TCP congestion Control
       TCP_CONG_BBR2 = yes;
@@ -58,20 +37,22 @@ let
       NET_SCH_DEFAULT = yes;
       DEFAULT_FQ_PIE = yes;
 
-      # Graysky's additional CPU optimizations
-      CC_OPTIMIZE_FOR_PERFORMANCE_O3 = yes;
-
       # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
       FUTEX = yes;
       FUTEX_PI = yes;
 
       # WineSync driver for fast kernel-backed Wine
       WINESYNC = module;
+
+      # Preemptive Full Tickless Kernel at 500Hz
+      HZ = freeform "500";
+      HZ_500 = yes;
+      HZ_1000 = no;
     };
 
     extraMeta = {
       branch = lib.versions.majorMinor version;
-      maintainers = with lib.maintainers; [ fortuneteller2k lovesegfault atemu ];
+      maintainers = with lib.maintainers; [ fortuneteller2k lovesegfault atemu shawn8901 ];
       description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
       broken = stdenv.isAarch64;
     };
@@ -79,6 +60,5 @@ let
 in
 {
   lts = xanmodKernelFor ltsVariant;
-  edge = xanmodKernelFor edgeVariant;
-  tt = xanmodKernelFor ttVariant;
+  main = xanmodKernelFor mainVariant;
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 58a71edf6fa9..2e0a9cfd8c46 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,21 +4,21 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "5.19.1"; #zen
+    version = "6.3.4"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1b906fa4hk56y5g1hx50kp395fakrphna4nnvy98vs8cxpcfyqi7"; #zen
+    sha256 = "1dj5pk8fqf4plk5nri6cajwvdcs9b6gpfk1y620vi3g7w15p1gvx"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "5.18.17"; #lqx
+    version = "6.3.4"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "1cf4ix9xx1yi781xsrkaxn673mzi98dxlccsfvky78gjchmc8d6p"; #lqx
+    sha256 = "06xkcrd4wjpj23dnrfbyxyx1699vxzswb3r6p2xjwmpy44j5wjgf"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
     inherit version;
-    modDirVersion = "${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version ++ [ "0" "0" ]))}-${suffix}";
+    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
 
     src = fetchFromGitHub {
@@ -32,7 +32,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ andresilva pedrohlc ];
+      maintainers = with lib.maintainers; [ ];
       description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
         lib.optionalString isLqx " (Same as linux_zen but less aggressive release schedule)";
     };
diff --git a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
index 6faa401eccc5..2df5c0454ddc 100644
--- a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.23";
+  version = "2.0.26";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "qmPNbH3ZWwbOumJAp/3GeSeJytp1plXmcUmHF1IkJBs=";
+    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/keyutils/default.nix b/nixpkgs/pkgs/os-specific/linux/keyutils/default.nix
index 88410654f3b3..86b2535e1dde 100644
--- a/nixpkgs/pkgs/os-specific/linux/keyutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/keyutils/default.nix
@@ -18,8 +18,14 @@ stdenv.mkDerivation rec {
     ./conf-symlink.patch
     # This patch solves a duplicate symbol error when building with a clang stdenv
     # Before removing this patch, please ensure the package still builds by running eg.
-    # nix-build -E 'with import ./. {}; pkgs.keyutils.override { stdenv = pkgs.llvmPackages_latest.stdenv; }'
+    # nix-build -E 'with import ./. {}; pkgs.keyutils.override { stdenv = pkgs.clangStdenv; }'
     ./0001-Remove-unused-function-after_eq.patch
+
+    # Fix build for s390-linux, where size_t is different from ptrdiff_t.
+    (fetchurl {
+      url = "https://lore.kernel.org/keyrings/20230301134250.301819-1-hi@alyssa.is/raw";
+      sha256 = "1cbgwxq28fw5ldh38ngcs7xiqvpnmrw0hw9zzhbhb1hdxkavrc1s";
+    })
   ];
 
   makeFlags = lib.optionals stdenv.hostPlatform.isStatic "NO_SOLIB=1";
diff --git a/nixpkgs/pkgs/os-specific/linux/klibc/default.nix b/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
index 6efcb01cc531..36128a081a24 100644
--- a/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, buildPackages, linuxHeaders, perl }:
+{ lib, stdenv, fetchurl, buildPackages, linuxHeaders, perl, nixosTests }:
 
 let
   commonMakeFlags = [
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "klibc";
-  version = "2.0.10";
+  version = "2.0.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/klibc/2.0/klibc-${version}.tar.xz";
-    sha256 = "sha256-ZidT2oiJ50TfwNtutAIcM3fufvjtZtfVd2X4yeJZOc0=";
+    hash = "sha256-cfgWoNOr46uotGMZrlyhR+eno4QBs/XiYgJfTcCMR10=";
   };
 
   patches = [ ./no-reinstall-kernel-headers.patch ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" "stackprotector" ];
 
   makeFlags = commonMakeFlags ++ [
-    "KLIBCARCH=${stdenv.hostPlatform.linuxArch}"
+    "KLIBCARCH=${if stdenv.hostPlatform.isRiscV64 then "riscv64" else stdenv.hostPlatform.linuxArch}"
     "KLIBCKERNELSRC=${linuxHeaders}"
   ] # TODO(@Ericson2314): We now can get the ABI from
     # `stdenv.hostPlatform.parsed.abi`, is this still a good idea?
@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = {
+    # uses klibc's ipconfig
+    inherit (nixosTests) initrd-network-ssh;
+  };
+
   meta = {
     description = "Minimalistic libc subset for initramfs usage";
     homepage = "https://kernel.org/pub/linux/libs/klibc/";
diff --git a/nixpkgs/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch b/nixpkgs/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
index 709dd30f8c7e..bf46a17f3d7d 100644
--- a/nixpkgs/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
+++ b/nixpkgs/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
@@ -1,11 +1,12 @@
-diff -Naur klibc-2.0.3-orig/scripts/Kbuild.install klibc-2.0.3/scripts/Kbuild.install
---- klibc-2.0.3-orig/scripts/Kbuild.install	2013-12-03 13:53:46.000000000 -0500
-+++ klibc-2.0.3/scripts/Kbuild.install	2014-01-04 18:17:09.342609021 -0500
-@@ -95,7 +95,6 @@
+diff --git a/scripts/Kbuild.install b/scripts/Kbuild.install
+index 0788637f..6708e19f 100644
+--- a/scripts/Kbuild.install
++++ b/scripts/Kbuild.install
+@@ -102,7 +102,6 @@ header:
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)lib
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)bin
 -	$(Q)cp -rfL $(KLIBCKERNELSRC)/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
- 	$(Q)cp -rf usr/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
- 	$(Q)chmod -R a+rX $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include
- 	$(Q)$(install-data) $(srctree)/klcc/klcc.1 $(INSTALLROOT)$(mandir)/man1/$(KCROSS)klcc.1
+ ifneq ($(srctree),$(objtree))
+ 	$(Q)cp -rf $(srctree)/usr/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
+ endif
diff --git a/nixpkgs/pkgs/os-specific/linux/kmod/default.nix b/nixpkgs/pkgs/os-specific/linux/kmod/default.nix
index 802335046342..0843ca3556ae 100644
--- a/nixpkgs/pkgs/os-specific/linux/kmod/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kmod/default.nix
@@ -26,12 +26,15 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "lib" ] ++ lib.optional withDevdoc "devdoc";
 
+  strictDeps = true;
   nativeBuildInputs = [
     autoconf automake docbook_xsl libtool libxslt pkg-config
 
     docbook_xml_dtd_42 # for the man pages
   ] ++ lib.optionals withDevdoc [ docbook_xml_dtd_43 gtk-doc ];
-  buildInputs = [ xz zstd ];
+  buildInputs = [ xz zstd ]
+    # gtk-doc is looked for with pkg-config
+    ++ lib.optionals withDevdoc [ gtk-doc ];
 
   preConfigure = ''
     ./autogen.sh
@@ -58,7 +61,6 @@ in stdenv.mkDerivation rec {
   '';
 
   passthru.updateScript = gitUpdater {
-    inherit pname version;
     # No nicer place to find latest release.
     url = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git";
     rev-prefix = "v";
diff --git a/nixpkgs/pkgs/os-specific/linux/kmscon/default.nix b/nixpkgs/pkgs/os-specific/linux/kmscon/default.nix
index f48895fc017e..0d146613542d 100644
--- a/nixpkgs/pkgs/os-specific/linux/kmscon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kmscon/default.nix
@@ -1,31 +1,37 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, autoreconfHook
+, fetchpatch
+, meson
 , libtsm
 , systemd
 , libxkbcommon
 , libdrm
-, libGLU, libGL
+, libGLU
+, libGL
 , pango
 , pixman
 , pkg-config
 , docbook_xsl
 , libxslt
+, mesa
+, ninja
 }:
 
 stdenv.mkDerivation rec {
   pname = "kmscon";
-  version = "unstable-2018-09-07";
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "Aetf";
     repo = "kmscon";
-    rev = "01dd0a231e2125a40ceba5f59fd945ff29bf2cdc";
-    sha256 = "0q62kjsvy2iwy8adfiygx2bfwlh83rphgxbis95ycspqidg9py87";
+    rev = "v${version}";
+    sha256 = "sha256-8owyyzCrZVbWXcCR+RA+m0MOrdzW+efI+rIMWEVEZ1o=";
   };
 
   buildInputs = [
-    libGLU libGL
+    libGLU
+    libGL
     libdrm
     libtsm
     libxkbcommon
@@ -33,14 +39,28 @@ stdenv.mkDerivation rec {
     pango
     pixman
     systemd
+    mesa
   ];
 
   nativeBuildInputs = [
-    autoreconfHook
+    meson
+    ninja
     docbook_xsl
     pkg-config
   ];
 
+  patches = [
+    (fetchpatch {
+      name = "0001-tests-fix-warnings.patch";
+      url = "https://github.com/Aetf/kmscon/commit/b65f4269b03de580923ab390bde795e7956b633f.patch";
+      sha256 = "sha256-ngflPwmNMM/2JzhV+hHiH3efQyoSULfqEywzWox9iAQ=";
+    })
+  ];
+
+  # _FORTIFY_SOURCE requires compiling with optimization (-O)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O"
+    + " -Wno-error=maybe-uninitialized"; # https://github.com/Aetf/kmscon/issues/49
+
   configureFlags = [
     "--enable-multi-seat"
     "--disable-debug"
diff --git a/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix
new file mode 100644
index 000000000000..2376dddbb34a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, glib
+, libkrb5
+, libnl
+, libtool
+, pkg-config
+, withKerberos ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ksmbd-tools";
+  version = "3.4.8";
+
+  src = fetchFromGitHub {
+    owner = "cifsd-team";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-R/OWZekAGtDxE71MrzjWsdpaWGBu0c+VP0VkPro6GEo=";
+  };
+
+  buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+
+  preConfigure = "./autogen.sh";
+
+  configureFlags = lib.optional withKerberos "--enable-krb5";
+
+  meta = with lib; {
+    description = "Userspace utilities for the ksmbd kernel SMB server";
+    homepage = "https://www.kernel.org/doc/html/latest/filesystems/cifs/ksmbd.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/kvdo/default.nix b/nixpkgs/pkgs/os-specific/linux/kvdo/default.nix
index 7e7c765bd819..e2390b68a5ca 100644
--- a/nixpkgs/pkgs/os-specific/linux/kvdo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kvdo/default.nix
@@ -1,16 +1,19 @@
 { stdenv, lib, fetchFromGitHub, vdo, kernel }:
 
 stdenv.mkDerivation rec {
-  inherit (vdo) version;
+  inherit (vdo);
   pname = "kvdo";
+  version = "8.2.1.6"; # bump this version with vdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = "kvdo";
     rev = version;
-    hash = "sha256-4FYTFUIvGjea3bh2GbQYG7hSswVDdNS3S+jWQ9+inpg=";
+    hash = "sha256-S5r2Rgx5pWk4IsdIwmfZkuGL/oEQ3prquyVqxjR3cO0=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   dontConfigure = true;
   enableParallelBuilding = true;
 
@@ -19,7 +22,7 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     makeFlags="$makeFlags -C ${KSRC} M=$(pwd)"
-'';
+  '';
   installTargets = [ "modules_install" ];
 
   meta = with lib; {
@@ -27,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dm-vdo/kvdo";
     description = "A pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.15" || kernel.kernelAtLeast "5.17";
+    broken = kernel.kernelOlder "5.15";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix b/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
index 24fedbf59d78..6b5f31a1d350 100644
--- a/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel, kmod, looking-glass-client }:
+{ lib, stdenv, fetchFromGitHub, kernel, kmod, looking-glass-client }:
 
 stdenv.mkDerivation rec {
   pname = "kvmfr";
@@ -9,19 +9,6 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  patches = lib.optional (kernel.kernelAtLeast "5.16") (fetchpatch {
-    name = "kvmfr-5.16.patch";
-    url = "https://github.com/gnif/LookingGlass/commit/a9b5302a517e19d7a2da114acf71ef1e69cfb497.patch";
-    sha256 = "017nxlk2f7kyjp6llwa74dbczdb1jk8v791qld81dxhzkm9dyqqx";
-    stripLen = 1;
-  })
-  ++ lib.optional (kernel.kernelAtLeast "5.18") (fetchpatch {
-    name = "kvmfr-5.18.patch";
-    url = "https://github.com/gnif/LookingGlass/commit/c7029f95042fe902843cb6acbfc75889e93dc210.patch";
-    sha256 = "sha256-6DpL17XWj8BKpiBdKdCPC51MWKLIo6PixQ9UaygT2Zg=";
-    stripLen = 1;
-  });
-
   makeFlags = [
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
new file mode 100644
index 000000000000..ba189767bca6
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -0,0 +1,48 @@
+{ lib, fetchFromGitHub, xorg, libsForQt5, wrapQtAppsHook, python3 }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "lenovo-legion-app";
+  version = "2023-04-02-16-53-51";
+
+  src = fetchFromGitHub {
+    owner = "johnfanv2";
+    repo = "LenovoLegionLinux";
+    rev = "main${version}";
+    sha256 = "sha256-s4JFFmawokdC4qoqNvZDhuJSinhQ3YKSIfAYi79VTTA=";
+  };
+
+  sourceRoot = "source/python/legion_linux";
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyqt5
+    argcomplete
+    pyyaml
+    xorg.libxcb
+    libsForQt5.qtbase
+  ];
+
+  postInstall = ''
+    cp -r ./{legion.py,legion_cli.py,legion_gui.py} $out/${python3.sitePackages}
+    cp ./legion_logo.png $out/${python3.sitePackages}/legion_logo.png
+
+    rm -rf $out/data
+  '';
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  meta = {
+    description = "An utility to control Lenovo Legion laptop";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    mainProgram = "legion_gui";
+  };
+}
+
diff --git a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix
new file mode 100644
index 000000000000..375b835ac47d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchurl, stdenv, kernel, bash, lenovo-legion }:
+
+stdenv.mkDerivation {
+  pname = "lenovo-legion-module";
+  inherit (lenovo-legion) version src;
+
+  sourceRoot = "source/kernel_module";
+
+  hardeningDisable = [ "pic" ];
+
+  preConfigure = ''
+    sed -i -e '/depmod/d' ./Makefile
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "SHELL=bash"
+    "KERNELVERSION=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALLDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "MODDESTDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "DKMSDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/misc"
+  ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = {
+    description = "Linux kernel module for controlling fan and power in Lenovo Legion laptops";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/libaio/default.nix b/nixpkgs/pkgs/os-specific/linux/libaio/default.nix
index 046bba5dda0f..324e2695dd53 100644
--- a/nixpkgs/pkgs/os-specific/linux/libaio/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libaio/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  version = "0.3.112";
+  version = "0.3.113";
   pname = "libaio";
 
   src = fetchurl {
     url = "https://pagure.io/libaio/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.gz";
-    sha256 = "0wi2myh191sja13qj3claxhpfkngvy10x30f78hm9cxzkfr97kxp";
+    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
   };
 
   postPatch = ''
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Library for asynchronous I/O in Linux";
-    homepage = "http://lse.sourceforge.net/io/aio.html";
+    homepage = "https://lse.sourceforge.net/io/aio.html";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libbpf/0.x.nix b/nixpkgs/pkgs/os-specific/linux/libbpf/0.x.nix
new file mode 100644
index 000000000000..480e78d0803a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/libbpf/0.x.nix
@@ -0,0 +1,54 @@
+{ fetchFromGitHub
+, elfutils
+, pkg-config
+, stdenv
+, zlib
+, lib
+, nixosTests
+}:
+
+# update bot does not seem to limit updates here to 0.8.x despite
+# the all-packages derivation being libbpf_0 as the libbpf base alias
+# is still present: just disable it for 0.x:
+# nixpkgs-update: no auto update
+
+stdenv.mkDerivation rec {
+  pname = "libbpf";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "libbpf";
+    repo = "libbpf";
+    rev = "v${version}";
+    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ elfutils zlib ];
+
+  enableParallelBuilding = true;
+  makeFlags = [ "PREFIX=$(out)" "-C src" ];
+
+  passthru.tests = {
+    bpf = nixosTests.bpf;
+  };
+
+  postInstall = ''
+    # install linux's libbpf-compatible linux/btf.h
+    install -Dm444 include/uapi/linux/*.h -t $out/include/linux
+  '';
+
+  # FIXME: Multi-output requires some fixes to the way the pkg-config file is
+  # constructed (it gets put in $out instead of $dev for some reason, with
+  # improper paths embedded). Don't enable it for now.
+
+  # outputs = [ "out" "dev" ];
+
+  meta = with lib; {
+    description = "Upstream mirror of libbpf";
+    homepage = "https://github.com/libbpf/libbpf";
+    license = with licenses; [ lgpl21 /* or */ bsd2 ];
+    maintainers = with maintainers; [ thoughtpolice vcunat saschagrunert martinetd ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix b/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
index 2c15e3d49ee1..be1a1453e871 100644
--- a/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.8.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+    sha256 = "sha256-NimK4pdYcai21hZHdP1mBX1MOlNY61iDJ+PDYwpRuVE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libcap-ng/default.nix b/nixpkgs/pkgs/os-specific/linux/libcap-ng/default.nix
index ad01a83ac935..0f60a8655ced 100644
--- a/nixpkgs/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -1,36 +1,21 @@
-{ lib, stdenv, fetchurl, swig ? null, python2 ? null, python3 ? null }:
-
-assert python2 != null || python3 != null -> swig != null;
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  # When updating make sure to test that the version with
-  # all of the python bindings still works
   version = "0.8.3";
 
   src = fetchurl {
-    url = "${meta.homepage}/${pname}-${version}.tar.gz";
+    url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
     sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
-  nativeBuildInputs = [ swig ];
-  buildInputs = [ python2 python3 ];
-
-  postPatch = ''
-    function get_header() {
-      echo -e "#include <$1>" | gcc -M -xc - | tr ' ' '\n' | grep "$1" | head -n 1
-    }
-
-    # Fix some hardcoding of header paths
-    sed -i "s,/usr/include/linux/capability.h,$(get_header linux/capability.h),g" bindings/python{,3}/Makefile.in
-  '';
+  outputs = [ "out" "dev" "man" ];
 
   configureFlags = [
-    (if python2 != null then "--with-python" else "--without-python")
-    (if python3 != null then "--with-python3" else "--without-python3")
+    "--without-python"
   ];
 
-  meta = let inherit (lib) platforms licenses; in {
+  meta = with lib; {
     description = "Library for working with POSIX capabilities";
     homepage = "https://people.redhat.com/sgrubb/libcap-ng/";
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/libcap/default.nix b/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
index 0577107fd026..17fcbd128408 100644
--- a/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.65";
+  version = "2.69";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
+    sha256 = "sha256-8xH489rYRpnQVm0db37JQ6kpiyj3FMrjyTHf1XSS1+s=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/nixpkgs/pkgs/os-specific/linux/libcgroup/default.nix b/nixpkgs/pkgs/os-specific/linux/libcgroup/default.nix
index 6d6a8e7c21e1..8f24362b94b2 100644
--- a/nixpkgs/pkgs/os-specific/linux/libcgroup/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libcgroup/default.nix
@@ -2,17 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libcgroup";
-  version = "0.42.2";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1h8s70lm6g7r0wj7j3xgj2g3j9fifvsy2pna6w0j3i5hh42qfms4";
+    fetchSubmodules = true;
+    hash = "sha256-x2yBqpr3LedtWmpZ4K1ipZxIualNJuDtC4FVGzzcQn8=";
   };
 
-  buildInputs = [ pam bison flex ];
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook bison flex ];
+  buildInputs = [ pam ];
 
   postPatch = ''
     substituteInPlace src/tools/Makefile.am \
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Library and tools to manage Linux cgroups";
-    homepage    = "http://libcg.sourceforge.net/";
+    homepage    = "https://github.com/libcgroup/libcgroup";
     license     = lib.licenses.lgpl2;
     platforms   = lib.platforms.linux;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libnl-tiny/default.nix b/nixpkgs/pkgs/os-specific/linux/libnl-tiny/default.nix
new file mode 100644
index 000000000000..fc520830f6a2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/libnl-tiny/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config }:
+
+stdenv.mkDerivation {
+  pname = "libnl-tiny";
+  version = "unstable-2022-12-13";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/libnl-tiny.git";
+    rev = "f5d9b7e4f534a69cbd35c3f150fa6d57b9d631e4";
+    sha256 = "0c5ycsdas8rr5c33gd0mnmm515dq631fmdjn5mp2j1m0j1bk7hc0";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  preConfigure = ''
+    sed -e 's|''${prefix}/@CMAKE_INSTALL_LIBDIR@|@CMAKE_INSTALL_FULL_LIBDIR@|g' \
+        -e 's|''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@|@CMAKE_INSTALL_FULL_INCLUDEDIR@|g' \
+        -i libnl-tiny.pc.in
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/libnl-tiny.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/libnl/default.nix b/nixpkgs/pkgs/os-specific/linux/libnl/default.nix
index 08a55134e773..c9eea70db992 100644
--- a/nixpkgs/pkgs/os-specific/linux/libnl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libnl/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   postBuild = lib.optionalString (pythonSupport) ''
       cd python
-      ${python.interpreter} setup.py install --prefix=../pythonlib
+      ${python.pythonForBuild.interpreter} setup.py install --prefix=../pythonlib
       cd -
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/libnvme/default.nix b/nixpkgs/pkgs/os-specific/linux/libnvme/default.nix
new file mode 100644
index 000000000000..4ed838051f6f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/libnvme/default.nix
@@ -0,0 +1,70 @@
+{ fetchFromGitHub
+, json_c
+, keyutils
+, lib
+, meson
+, ninja
+, openssl
+, perl
+, pkg-config
+, python3
+, stdenv
+, swig
+, systemd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libnvme";
+  version = "1.4";
+
+  outputs = [ "out" "man" ];
+
+  src = fetchFromGitHub {
+    owner = "linux-nvme";
+    repo = "libnvme";
+    rev = "v${version}";
+    sha256 = "sha256-8DlEQ4LH6UhIHr0znJGqkuCosLHqA6hkJjmiCawNE1k=";
+  };
+
+  postPatch = ''
+    patchShebangs meson-vcs-tag.sh
+    chmod +x doc/kernel-doc-check
+    patchShebangs doc/kernel-doc doc/kernel-doc-check doc/list-man-pages.sh
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    perl # for kernel-doc
+    pkg-config
+    python3.pythonForBuild
+    swig
+  ];
+
+  buildInputs = [
+    keyutils
+    json_c
+    openssl
+    systemd
+    python3
+  ];
+
+  mesonFlags = [
+    "-Ddocs=man"
+    "-Ddocs-build=true"
+  ];
+
+  preConfigure = ''
+    export KBUILD_BUILD_TIMESTAMP="$(date -u -d @$SOURCE_DATE_EPOCH)"
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "C Library for NVM Express on Linux";
+    homepage = "https://github.com/linux-nvme/libnvme";
+    maintainers = with maintainers; [ zseri ];
+    license = with licenses; [ lgpl21Plus ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
index ebfe492f7364..683448cbe41b 100644
--- a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpsm2";
-  version = "11.2.229";
+  version = "11.2.230";
 
   preConfigure= ''
     export UDEVDIR=$out/etc/udev
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ numactl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ numactl ];
 
   makeFlags = [
     # Disable blanket -Werror to avoid build failures
@@ -29,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "opa-psm2";
     rev = "PSM2_${version}";
-    sha256 = "sha256-t3tZCxGmGMscDmeyCATLbHxU7jEJqAzxwPV0Z8pl2ko=";
+    sha256 = "sha256-dMfGq067TqstGAWNSZZaZCwvChTyPUsvaPVjFGGzp64=";
   };
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix b/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
index a264c4544874..a35ab1dcc01c 100644
--- a/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libratbag";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner  = "libratbag";
     repo   = "libratbag";
     rev    = "v${version}";
-    sha256 = "sha256-wJLG0Gxm1RWwW5SCGoa2QscU1VC0r93KZfEMNVg3Tko=";
+    sha256 = "sha256-TQ8DVj4yqq3IA0oGnLDz+QNTyNRmGqspEjkPeBmXNew=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix b/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
index fd697fed7763..ec6d3f5aa4bf 100644
--- a/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix b/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
index d828c38be1d9..2f5a0f7172ca 100644
--- a/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,12 +6,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "3.3";
+  version = "3.5";
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
-    sha256 = "1s3wb66l47blc15s6lkqs11j9l8pycdqqbb03x3vpfrlz9dfrl44";
+    sha256 = "sha256-9TU05QJHU4KA7Q12xs6B2Ps5Ob1kytuJ2hDbpC5A3Zw=";
    };
 
   outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   #  1278 |  int i;
   #       |      ^
   # cc1: all warnings being treated as errors
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=clobbered" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=clobbered" ];
 
   installTargets = [ "install" ] ++ optionals enablePython [ "install-pywrap" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix b/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
index 108e65072314..abe797f74b25 100644
--- a/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.3";
+  version = "3.5";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${version}/libsepol-${version}.tar.gz";
-    sha256 = "12r39ygn7aa1kz52wibfr4520m0cp75hlrn3i6rnjqa6p0zdz5rd";
+    sha256 = "sha256-eP2vaZJNt4C6x4VG5D2cRAdLrXmMLEFdC5u5bQZe6KI=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/libsmbios/default.nix b/nixpkgs/pkgs/os-specific/linux/libsmbios/default.nix
index 46d0e94bb14c..2049b7cf0e70 100644
--- a/nixpkgs/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libsmbios/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, help2man, gettext
-, libxml2, perl, python3, doxygen }:
-
+{ lib, stdenv, fetchFromGitHub, fetchurl
+, pkg-config, autoreconfHook, help2man, gettext, libxml2, perl, python3, doxygen
+}:
 
 stdenv.mkDerivation rec {
   pname = "libsmbios";
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0krwwydyvb9224r884y1mlmzyxhlfrcqw73vi1j8787rl0gl5a2i";
   };
 
+  patches = [
+    (fetchurl {
+      name = "musl.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/libsmbios/fixes.patch?id=bdc4f67889c958c1266fa5d0cab71c3cd639122f";
+      sha256 = "aVVc52OovDYvqWRyKcRAi62daa9AalkKvnVOGvrTmRk=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook doxygen gettext libxml2 help2man perl pkg-config ];
 
   buildInputs = [ python3 ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
index c81949bf39a6..427f2eb69c49 100644
--- a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.6.2";
 
   src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
     rev = "libtraceevent-${version}";
     sha256 = "sha256-iLy2rEKn0UJguRcY/W8RvUq7uX+snQojb/cXOmMsjwc=";
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix b/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
index 3a973b9880d5..3cb79ae07780 100644
--- a/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libtracefs";
-  version = "1.4.2";
+  version = "1.6.4";
 
   src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
     rev = "libtracefs-${version}";
-    sha256 = "sha256-CmFzonPq91iLflolJaucpPWzb8MCgfuov/OQ6KUD3f4=";
+    sha256 = "sha256-fWop0EMkoVulLBzU7q8x1IhMtdnEJ89wMz0cz964F6s=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/libzbc/default.nix b/nixpkgs/pkgs/os-specific/linux/libzbc/default.nix
new file mode 100644
index 000000000000..9c70d9a19b0a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/libzbc/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gtk3
+, libtool
+, pkg-config
+, guiSupport ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libzbc";
+  version = "5.13.0";
+
+  src = fetchFromGitHub {
+    owner = "westerndigitalcorporation";
+    repo = "libzbc";
+    rev = "v${version}";
+    sha256 = "6xkA96bgQ2Ik1vEwkw7hwjMbjMSlopzv5ziTh60Mjx0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+  ] ++ lib.optionals guiSupport [ pkg-config ];
+
+  buildInputs = lib.optionals guiSupport [ gtk3 ];
+
+  configureFlags = lib.optional guiSupport "--enable-gui";
+
+  meta = with lib; {
+    description = "ZBC device manipulation library";
+    homepage = "https://github.com/westerndigitalcorporation/libzbc";
+    maintainers = with maintainers; [ zseri ];
+    license = with licenses; [ bsd2 lgpl3Plus ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/libzbd/default.nix b/nixpkgs/pkgs/os-specific/linux/libzbd/default.nix
new file mode 100644
index 000000000000..c5d8e9cf80a4
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/libzbd/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, autoconf-archive
+, autoreconfHook
+, fetchFromGitHub
+, gtk3
+, libtool
+, pkg-config
+, guiSupport ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libzbd";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "westerndigitalcorporation";
+    repo = "libzbd";
+    rev = "v${version}";
+    sha256 = "sha256-iMQjOWsgsS+uI8mqoOXHRAV1+SIu1McUAcrsY+/zcu8=";
+  };
+
+  nativeBuildInputs = [
+    autoconf-archive # this can be removed with the next release
+    autoreconfHook
+    libtool
+  ] ++ lib.optionals guiSupport [ pkg-config ];
+
+  buildInputs = lib.optionals guiSupport [ gtk3 ];
+
+  configureFlags = lib.optional guiSupport "--enable-gui";
+
+  meta = with lib; {
+    description = "Zoned block device manipulation library and tools";
+    homepage = "https://github.com/westerndigitalcorporation/libzbd";
+    maintainers = with maintainers; [ zseri ];
+    license = with licenses; [ lgpl3Plus gpl3Plus ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/lightum/default.nix b/nixpkgs/pkgs/os-specific/linux/lightum/default.nix
index 95b766aec05b..e9925b95bcd6 100644
--- a/nixpkgs/pkgs/os-specific/linux/lightum/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lightum/default.nix
@@ -11,13 +11,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-dzWUVY2srgk6BM6jZ7FF+snxnPopz3fx9nq+mVkmogc=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     dbus
     glib
     libX11
     libXScrnSaver
     libXext
-    pkg-config
     systemd
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix b/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
index e5e4e1dca87a..471882ae1b42 100644
--- a/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-wifi-hotspot";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "lakinduakash";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XCgYWOX7QSdANG6DqYk0yZZqnvZGDl3GaF9KtYRmpJ0=";
+    sha256 = "sha256-cCVJPEAZZzOGCf45oo1J7wWtYn/IJfcASHnKR+R0Ge4=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,10 @@ stdenv.mkDerivation rec {
       --replace "etc" "$out/etc"
     substituteInPlace ./src/scripts/wihotspot \
       --replace "/usr" "$out"
+    substituteInPlace ./src/desktop/wifihotspot.desktop \
+      --replace "/usr" "$out"
+    substituteInPlace ./src/scripts/policies/polkit.policy \
+      --replace "/usr" "$out"
   '';
 
   makeFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix b/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
index 4c14d2ecae3d..fb7f410db8dc 100644
--- a/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linuxptp";
-  version = "3.1.1";
+  version = "4.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxptp/${pname}-${version}.tgz";
-    sha256 = "1nf0w4xyzg884v8blb81zkk6q8p6zbiq9lx61jdqwbbzkdgqbmll";
+    hash = "sha256-0n1e8pa7PSheIuafda4CO0tCovRlUTDW05DYr8vD2TM=";
   };
 
   postPatch = ''
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux";
-    homepage = "http://linuxptp.sourceforge.net/";
+    homepage = "https://linuxptp.sourceforge.net/";
     maintainers = [ maintainers.markuskowa ];
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/lkrg/default.nix b/nixpkgs/pkgs/os-specific/linux/lkrg/default.nix
new file mode 100644
index 000000000000..4d6118f8b9f8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lkrg/default.nix
@@ -0,0 +1,53 @@
+{ lib, stdenv, fetchpatch, fetchFromGitHub, kernel }:
+let
+  isKernelRT = (kernel.structuredExtraConfig ? PREEMPT_RT) && (kernel.structuredExtraConfig.PREEMPT_RT == lib.kernel.yes);
+in
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}-${kernel.version}";
+  pname = "lkrg";
+  version = "0.9.5";
+
+  src = fetchFromGitHub {
+    owner = "lkrg-org";
+    repo = "lkrg";
+    rev = "v${version}";
+    sha256 = "sha256-+yIKkTvfVbLnFBoXSKGebB1A8KqpaRmsLh8SsNuI9Dc=";
+  };
+  patches = [
+    (fetchpatch {
+      name = "fix-aarch64.patch";
+      url = "https://github.com/lkrg-org/lkrg/commit/a4e5c00f13f7081b346bc3736e4c035e3d17d3f7.patch";
+      sha256 = "sha256-DPscqi+DySHwFxGuGe7P2itPkoyb3XGu5Xp2S/ezP4Y=";
+    })
+  ];
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNEL=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  dontConfigure = true;
+
+  prePatch = ''
+    substituteInPlace Makefile --replace "KERNEL := " "KERNEL ?= "
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D lkrg.ko $out/lib/modules/${kernel.modDirVersion}/extra/lkrg.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "LKRG Linux Kernel module";
+    longDescription = "LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.";
+    homepage = "https://lkrg.org/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ chivay ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.10" || kernel.kernelAtLeast "6.1" || isKernelRT;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/lksctp-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/lksctp-tools/default.nix
index 19d6f10e3de1..24915143fbd0 100644
--- a/nixpkgs/pkgs/os-specific/linux/lksctp-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lksctp-tools/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux Kernel Stream Control Transmission Protocol Tools";
-    homepage = "http://lksctp.sourceforge.net/";
+    homepage = "https://lksctp.sourceforge.net/";
     license = with licenses; [ gpl2 lgpl21 ]; # library is lgpl21
     platforms = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix b/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
index c40a37940543..895e84f827b4 100644
--- a/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -24,6 +24,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-9lfHCcODlS7sZMjQhK0yQcCBEoGyZOChx/oM0CU37sY=";
   };
 
+  # Upstream build system have knob to enable and disable building of static
+  # library, shared library is built unconditionally.
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 'lib/Module.mk' -e '/LIBTARGETS :=/,+1d; /-m 755/ d'
+    substituteInPlace prog/sensors/Module.mk --replace 'lib/$(LIBSHBASENAME)' ""
+  '';
+
   nativeBuildInputs = [ bison flex which ];
   # bash is required for correctly replacing the shebangs in all tools for cross-compilation.
   buildInputs = [ bash perl ]
@@ -39,6 +46,12 @@ stdenv.mkDerivation rec {
     "ETCDIR=${placeholder "out"}/etc"
   ];
 
+  # Making regexp to patch-out installing of .so symlinks from Makefile is
+  # complicated, it is easier to remove them post-install.
+  postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+    rm $out/lib/*.so*
+  '';
+
   meta = with lib; {
     homepage = "https://hwmon.wiki.kernel.org/lm_sensors";
     changelog = "https://raw.githubusercontent.com/lm-sensors/lm-sensors/V${dashedVersion}/CHANGES";
diff --git a/nixpkgs/pkgs/os-specific/linux/lockdep/default.nix b/nixpkgs/pkgs/os-specific/linux/lockdep/default.nix
index 047b2499a827..1ea2de63560b 100644
--- a/nixpkgs/pkgs/os-specific/linux/lockdep/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lockdep/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: lockdep.o:/build/linux-5.0.21/tools/lib/lockdep/../../include/linux/rcu.h:5: multiple definition of
   #     `rcu_scheduler_active'; common.o:/build/linux-5.0.21/tools/lib/lockdep/../../include/linux/rcu.h:5: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildPhase = ''
     make defconfig
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
-  checkInputs = [ valgrind ];
+  nativeCheckInputs = [ valgrind ];
   checkPhase = ''
     # there are more /bin/bash references than just shebangs
     for f in lockdep run_tests.sh tests/*.sh; do
diff --git a/nixpkgs/pkgs/os-specific/linux/lsb-release/lsb_release.sh b/nixpkgs/pkgs/os-specific/linux/lsb-release/lsb_release.sh
index 47b449c31614..ae524181e88a 100644
--- a/nixpkgs/pkgs/os-specific/linux/lsb-release/lsb_release.sh
+++ b/nixpkgs/pkgs/os-specific/linux/lsb-release/lsb_release.sh
@@ -32,7 +32,7 @@ short=0
 @getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
 if [[ $rc -ne 4 ]]; then
   # This shouldn't happen.
-  echo "Warning: Enhanced getopt not supported, please open an issue." >&2
+  echo "Warning: Enhanced getopt not supported, please open an issue in nixpkgs." >&2
 else
   # Define all short and long options.
   SHORT=hvidrcas
diff --git a/nixpkgs/pkgs/os-specific/linux/lsirec/default.nix b/nixpkgs/pkgs/os-specific/linux/lsirec/default.nix
index cf2da7d16480..10da88b691d9 100644
--- a/nixpkgs/pkgs/os-specific/linux/lsirec/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lsirec/default.nix
@@ -32,5 +32,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.bsd2;
     maintainers = with maintainers; [ Luflosi ];
+    # never built on aarch64-linux since first introduction in nixpkgs
+    broken = stdenv.isLinux && stdenv.isAarch64;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix b/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
index b2fa10568075..f7b5b3fd1fa1 100644
--- a/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -1,46 +1,21 @@
-{ lib, stdenv, fetchgit, fetchpatch, kernel }:
+{ lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${kernel.version}";
-  version = "2.13.4";
+  version = "2.13.8";
 
-  src = fetchgit {
-    url = "https://git.lttng.org/lttng-modules.git";
+  src = fetchFromGitHub {
+    owner = "lttng";
+    repo = "lttng-modules";
     rev = "v${version}";
-    hash = "sha256-J2Tr1vOiCAilmnf3attF3bz8Irn9IQ2QbapdXJ4MUSg=";
+    hash = "sha256-6ohWsGUGFz7QlHkKWyW5edpSsBTE9DFS3v6EsH9wNZo=";
   };
 
-  patches = [
-    # fix: mm/page_alloc: fix tracepoint mm_page_alloc_zone_locked() (v5.19)
-    (fetchpatch {
-      url = "https://git.lttng.org/?p=lttng-modules.git;a=patch;h=6229bbaa423832f6b7c7a658ad11e1d4242752ff";
-      hash = "sha256-pqbKxBzjfN20wfsqSeBLXNQ+/U+3qk9RfTiT32OwSIc=";
-    })
-
-    # fix: fs: Remove flags parameter from aops->write_begin (v5.19)
-    (fetchpatch {
-      url = "https://git.lttng.org/?p=lttng-modules.git;a=patch;h=5e2f832d59d51589ab69479c7db43c7581fb9346";
-      hash = "sha256-auoCbvFEVR76sOCLjIe+q/Q+vunQlR3G3gVcjqAGGPk=";
-    })
-
-    # fix: workqueue: Fix type of cpu in trace event (v5.19)
-    (fetchpatch {
-      url = "https://git.lttng.org/?p=lttng-modules.git;a=patch;h=c6da9604b1666780ea4725b3b3d1bfa1548f9c89";
-      hash = "sha256-qoTwy+P32qg1L+JctqM1+70OkeTbnbL3QJ9LwaBq/bw=";
-    })
-
-    # fix: net: skb: introduce kfree_skb_reason() (v5.15.58..v5.16)
-    (fetchpatch {
-      url = "https://git.lttng.org/?p=lttng-modules.git;a=patch;h=96c477dabaaf6cd1734bebe0972fef877e5a463b";
-      hash = "sha256-b7BhrYZ5SZqeRVGEu0Eo9GfbcZdDPrgEnOl2XU3z+ds=";
-    })
-  ];
-
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   makeFlags = kernel.makeFlags ++ [
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -57,5 +32,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21Only gpl2Only mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
+    broken = (lib.versions.majorMinor kernel.modDirVersion) == "5.10" || (lib.versions.majorMinor kernel.modDirVersion) == "5.4";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/2_02.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/2_02.nix
deleted file mode 100644
index 56ab613afd24..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/2_02.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.02.187";
-  sha256 = "sha256-Dg1SGoY6XbJEDy4edie6grcCc65KsLvhMIUdsNWOWvE=";
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
index 0cca51feab30..e054d3dbfc9c 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.16";
-  sha256 = "sha256-5mHs4VtdiNir45pMHh2y9D4YlvAZlIu5iw4V13doB4Y=";
+  version = "2.03.21";
+  hash = "sha256-HiYZIdYhmYrcN5YMYV3nhMYUXH9zeoC3gfMQj77Gen4=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
index 4cb86bf3d8b9..27a160033b11 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
@@ -1,7 +1,6 @@
-{ version, sha256 }:
+{ version, hash }:
 
 { lib, stdenv
-, fetchpatch
 , fetchurl
 , pkg-config
 , coreutils
@@ -28,8 +27,11 @@ stdenv.mkDerivation rec {
   inherit version;
 
   src = fetchurl {
-    url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    inherit sha256;
+    urls = [
+      "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz"
+      "ftp://sourceware.org/pub/lvm2/LVM2.${version}.tgz"
+    ];
+    inherit hash;
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -49,10 +51,12 @@ stdenv.mkDerivation rec {
     "--with-default-locking-dir=/run/lock/lvm"
     "--with-default-run-dir=/run/lvm"
     "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemd-run=/run/current-system/systemd/bin/systemd-run"
   ] ++ lib.optionals (!enableCmdlib) [
     "--bindir=${placeholder "bin"}/bin"
     "--sbindir=${placeholder "bin"}/bin"
     "--libdir=${placeholder "lib"}/lib"
+    "--with-libexecdir=${placeholder "lib"}/libexec"
   ] ++ lib.optional enableCmdlib "--enable-cmdlib"
   ++ lib.optionals enableDmeventd [
     "--enable-dmeventd"
@@ -64,28 +68,17 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals udevSupport [
     "--enable-udev_rules"
     "--enable-udev_sync"
+  ] ++ lib.optionals enableVDO [
+    "--enable-vdo"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "--enable-static_link"
-  ] ++  lib.optionals enableVDO [
-    "--enable-vdo"
   ];
 
   preConfigure = ''
     sed -i /DEFAULT_SYS_DIR/d Makefile.in
     sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
-  '' + lib.optionalString (lib.versionOlder version "2.03.15") ''
-    substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
-      --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
-    # https://github.com/lvmteam/lvm2/issues/36
-  '' + lib.optionalString (lib.versionOlder version "2.03.14") ''
-    substituteInPlace udev/69-dm-lvm-metad.rules.in \
-      --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
-  '' + lib.optionalString (lib.versionAtLeast version "2.03.14") ''
-    substituteInPlace udev/69-dm-lvm.rules.in \
-      --replace "/usr/bin/systemd-run" /run/current-system/systemd/bin/systemd-run
-  '' + ''
+
     substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
-  '' + lib.optionalString (lib.versionAtLeast version "2.03") ''
     substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
 
     substituteInPlace scripts/blk_availability_systemd_red_hat.service.in \
@@ -96,9 +89,8 @@ stdenv.mkDerivation rec {
     sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
   '';
 
-  patches = lib.optionals (lib.versionAtLeast version "2.03.15") [
+  patches = [
     # fixes paths to and checks for tools
-    # TODO: needs backport to LVM 2.02 used by static/musl
     (substituteAll (let
       optionalTool = cond: pkg: if cond then pkg else "/run/current-system/sw";
     in {
@@ -109,22 +101,16 @@ stdenv.mkDerivation rec {
       multipath_tools = optionalTool enableMultipath multipath-tools;
       vdo = optionalTool enableVDO vdo;
     }))
-  ] ++ lib.optionals (lib.versionOlder version "2.03.15") [
-    # Musl fixes from Alpine.
+    # Musl fix from Alpine
     ./fix-stdio-usage.patch
-    (fetchpatch {
-      name = "mallinfo.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/lvm2/mallinfo.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
-      sha256 = "0g6wlqi215i5s30bnbkn8w7axrs27y3bnygbpbnf64wwx7rxxlj0";
-    })
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-    ./no-shared.diff
+    ./no-shared.patch
   ];
 
   doCheck = false; # requires root
 
   makeFlags = lib.optionals udevSupport [
-    "SYSTEMD_GENERATOR_DIR=$(out)/lib/systemd/system-generators"
+    "SYSTEMD_GENERATOR_DIR=${placeholder "out"}/lib/systemd/system-generators"
   ] ++ lib.optionals onlyLib [
     "libdm.device-mapper"
   ];
@@ -160,7 +146,10 @@ stdenv.mkDerivation rec {
     moveToOutput lib/libdevmapper.so $lib
   '';
 
-  passthru.tests.installer = nixosTests.installer.lvm;
+  passthru.tests = {
+    installer = nixosTests.installer.lvm;
+    lvm2 = nixosTests.lvm2;
+  };
 
   meta = with lib; {
     homepage = "http://sourceware.org/lvm2/";
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch b/nixpkgs/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
index 59666ffbad5a..98cdc6eb3ec9 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
@@ -1,8 +1,18 @@
+From 63b1c7332bee6080bffecf9ce9d75ff15d799166 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Wed, 16 Nov 2022 10:42:39 +0100
+Subject: [PATCH] fix stdio usage
+
+---
+ lib/commands/toolcontext.c | 4 ++--
+ tools/lvmcmdline.c         | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
 diff --git a/lib/commands/toolcontext.c b/lib/commands/toolcontext.c
-index 296618686..96343eeb7 100644
+index b630554a9..f20080d18 100644
 --- a/lib/commands/toolcontext.c
 +++ b/lib/commands/toolcontext.c
-@@ -1619,7 +1619,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
+@@ -1667,7 +1667,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
  	/* FIXME Make this configurable? */
  	reset_lvm_errno(1);
  
@@ -11,20 +21,20 @@ index 296618686..96343eeb7 100644
  	/* Set in/out stream buffering before glibc */
  	if (set_buffering
  #ifdef SYS_gettid
-@@ -2006,7 +2006,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+@@ -2045,7 +2045,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+ 		dm_hash_destroy(cmd->cft_def_hash);
  
- 	if (cmd->pending_delete_mem)
- 		dm_pool_destroy(cmd->pending_delete_mem);
+ 	dm_device_list_destroy(&cmd->cache_dm_devs);
 -#ifndef VALGRIND_POOL
 +#if !defined(VALGRIND_POOL) && defined(__GLIBC__)
  	if (cmd->linebuffer) {
  		/* Reset stream buffering to defaults */
  		if (is_valid_fd(STDIN_FILENO) &&
 diff --git a/tools/lvmcmdline.c b/tools/lvmcmdline.c
-index d97ff5720..bbbda82bd 100644
+index a5bb6a5c5..0ebfa375c 100644
 --- a/tools/lvmcmdline.c
 +++ b/tools/lvmcmdline.c
-@@ -3342,7 +3342,7 @@ static int _check_standard_fds(void)
+@@ -3422,7 +3422,7 @@ static int _check_standard_fds(void)
  	int err = is_valid_fd(STDERR_FILENO);
  
  	if (!is_valid_fd(STDIN_FILENO) &&
@@ -33,7 +43,7 @@ index d97ff5720..bbbda82bd 100644
  		if (err)
  			perror("stdin stream open");
  		else
-@@ -3352,7 +3352,7 @@ static int _check_standard_fds(void)
+@@ -3432,7 +3432,7 @@ static int _check_standard_fds(void)
  	}
  
  	if (!is_valid_fd(STDOUT_FILENO) &&
@@ -42,7 +52,7 @@ index d97ff5720..bbbda82bd 100644
  		if (err)
  			perror("stdout stream open");
  		/* else no stdout */
-@@ -3360,7 +3360,7 @@ static int _check_standard_fds(void)
+@@ -3440,7 +3440,7 @@ static int _check_standard_fds(void)
  	}
  
  	if (!is_valid_fd(STDERR_FILENO) &&
@@ -51,3 +61,6 @@ index d97ff5720..bbbda82bd 100644
  		printf("stderr stream open: %s\n",
  		       strerror(errno));
  		return 0;
+-- 
+2.38.1
+
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff b/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff
deleted file mode 100644
index d40dd85dfc62..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/libdm/Makefile.in b/libdm/Makefile.in
-index 66ec39513..ab7123dae 100644
---- a/libdm/Makefile.in
-+++ b/libdm/Makefile.in
-@@ -44,7 +44,6 @@ endif
- 
- LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
- LIB_VERSION = $(LIB_VERSION_DM)
--TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION)
- 
- CFLOW_LIST = $(SOURCES)
- CFLOW_LIST_TARGET = libdevmapper.cflow
-diff --git a/make.tmpl.in b/make.tmpl.in
-index e7780e8d4..ca4aa9fdd 100644
---- a/make.tmpl.in
-+++ b/make.tmpl.in
-@@ -346,7 +346,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- all: $(SUBDIRS) $(TARGETS)
- 
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.patch b/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.patch
new file mode 100644
index 000000000000..23a82a0fa294
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.patch
@@ -0,0 +1,46 @@
+diff --git a/libdm/Makefile.in b/libdm/Makefile.in
+index 2758648e6..f305a12b0 100644
+--- a/libdm/Makefile.in
++++ b/libdm/Makefile.in
+@@ -47,7 +47,6 @@ endif
+ 
+ LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
+ LIB_VERSION = $(LIB_VERSION_DM)
+-TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION) .symver_check
+ 
+ CFLOW_LIST = $(SOURCES)
+ CFLOW_LIST_TARGET = libdevmapper.cflow
+diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
+index a731687c2..9366cdf1c 100644
+--- a/libdm/make.tmpl.in
++++ b/libdm/make.tmpl.in
+@@ -314,7 +314,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ all: $(SUBDIRS) $(TARGETS)
+ 
+@@ -431,7 +431,6 @@ DEFS+=-D_FILE_OFFSET_BITS=64
+ 
+ ifneq (,$(LIB_SHARED))
+ 
+-TARGETS += $(LIB_SHARED).$(LIB_VERSION)
+ $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
+ 	@echo "    [CC] $@"
+ ifeq ("@LIB_SUFFIX@","so")
+diff --git a/make.tmpl.in b/make.tmpl.in
+index b73176f5a..6100d0dfd 100644
+--- a/make.tmpl.in
++++ b/make.tmpl.in
+@@ -368,7 +368,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ INTERNAL_LIBS = \
+ 	$(top_builddir)/libdaemon/client/libdaemonclient.a \
diff --git a/nixpkgs/pkgs/os-specific/linux/lxc/default.nix b/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
index 18c23c46c13c..49f16db002f3 100644
--- a/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, perl, docbook2x
-, docbook_xml_dtd_45, python3Packages, pam
+, docbook_xml_dtd_45, python3Packages, pam, fetchpatch
 
 # Optional Dependencies
 , libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./support-db2x.patch
+
+    # Backport of https://github.com/lxc/lxc/pull/4179 for glibc-2.36 build
+    (fetchpatch {
+      url = "https://github.com/lxc/lxc/commit/c1115e1503bf955c97f4cf3b925a6a9f619764c3.patch";
+      sha256 = "sha256-aC1XQesRJfkyQnloB3NvR4p/1WITrqkGYzw50PDxDrs=";
+      excludes = [ "meson.build" ];
+    })
   ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix b/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
index 67e96289e2ab..70d84d6311c4 100644
--- a/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+wp29GD+toXGfQbPGYbDJ7/P+FY1uQY4uK3OQxTE9GM=";
   };
 
+  postPatch = ''
+    sed -i -e '1i #include <sys/pidfd.h>' src/bindings.c
+  '';
+
   nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
   buildInputs = [ fuse ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix b/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
index 1c5167070496..c862fd4e1675 100644
--- a/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A utility for viewing/manipulating the MAC address of network interfaces";
-    maintainers = with maintainers; [ joachifm ma27 dotlambda ];
+    maintainers = with maintainers; [ joachifm dotlambda ];
     license = licenses.gpl2Plus;
     homepage = "https://github.com/alobbs/macchanger";
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix b/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
index 26c3d07364ce..9a56249de39a 100644
--- a/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "mbpfan";
-  version = "2.3.0";
+  version = "2.4.0";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "sha256-jIYg9b0c/7mMRS5WF+mOH6t9SCWEP32lsdbCgpWpg24=";
+    sha256 = "sha256-F9IWUcILOuLn5K4zRSU5jn+1Wk1xy0CONSI6JTXU2pA=";
   };
   installPhase = ''
     mkdir -p $out/bin $out/etc
diff --git a/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix b/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix
index 3e89ed83361f..524225763742 100644
--- a/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ flex bison ];
 
-  NIX_CFLAGS_COMPILE = "-Os -g -Wall";
+  env.NIX_CFLAGS_COMPILE = "-Os -g -Wall";
 
   NIX_LDFLAGS = [ "-lpthread" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/mdevctl/default.nix b/nixpkgs/pkgs/os-specific/linux/mdevctl/default.nix
new file mode 100644
index 000000000000..80c3c1316d85
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/mdevctl/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchCrate
+, docutils
+, installShellFiles
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mdevctl";
+  version = "1.2.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-0X/3DWNDPOgSNNTqcj44sd7DNGFt+uGBjkc876dSgU8=";
+  };
+
+  cargoHash = "sha256-TmumQBWuH5fJOe2qzcDtEGbmCs2G9Gfl8mH7xifzRGc=";
+
+  nativeBuildInputs = [
+    docutils
+    installShellFiles
+  ];
+
+  postInstall = ''
+    ln -s mdevctl $out/bin/lsmdev
+
+    install -Dm444 60-mdevctl.rules -t $out/lib/udev/rules.d
+
+    installManPage $releaseDir/build/mdevctl-*/out/mdevctl.8
+    ln -s mdevctl.8 $out/share/man/man8/lsmdev.8
+
+    installShellCompletion $releaseDir/build/mdevctl-*/out/{lsmdev,mdevctl}.bash
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/mdevctl/mdevctl";
+    description = "A mediated device management utility for linux";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ edwtjo ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix b/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix
deleted file mode 100644
index 2a55676fc767..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "mdevd";
-  version = "0.1.5.2";
-  sha256 = "sha256-RgNys9O6yfNXQVbtfkhhj59KNhy1LESUrZBjJIq0pP8=";
-
-  description = "mdev-compatible Linux hotplug manager daemon";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "out" "dev" "doc" ];
-
-  configureFlags = [
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-  ];
-
-  postInstall = ''
-    # remove all mdevd executables from build directory
-    rm $(find -type f -mindepth 1 -maxdepth 1 -executable)
-
-    mv doc $doc/share/doc/mdevd/html
-    mv examples $doc/share/doc/mdevd/examples
-  '';
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
index 6bb2855719bf..cd11bcb9e210 100644
--- a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
+++ b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20220809";
+  version = "20230512";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-vcuLQHAGr5uRkGWWIwA2WXLJadVNxfcPgjmNS82Logg=";
+    hash = "sha256-Ay907cXbT+LlE4foK4TODcDB5Rx/Zo7HY17erem71rw=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/nixpkgs/pkgs/os-specific/linux/microcode/iucode-tool.nix b/nixpkgs/pkgs/os-specific/linux/microcode/iucode-tool.nix
index e38dd83e0dba..d27e3ca6987b 100644
--- a/nixpkgs/pkgs/os-specific/linux/microcode/iucode-tool.nix
+++ b/nixpkgs/pkgs/os-specific/linux/microcode/iucode-tool.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, autoreconfHook }:
+{ lib, stdenv, fetchFromGitLab, autoreconfHook, fetchpatch, argp-standalone }:
 
 stdenv.mkDerivation rec {
   pname = "iucode-tool";
@@ -11,7 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "04dlisw87dd3q3hhmkqc5dd58cp22fzx3rzah7pvcyij135yjc3a";
   };
 
+  patches = [
+    # build fix for musl libc, pending upstream review
+    # https://gitlab.com/iucode-tool/iucode-tool/-/merge_requests/4
+    (fetchpatch {
+      url = "https://gitlab.com/iucode-tool/iucode-tool/-/commit/fda4aaa4727601dbe817fac001f234c19420351a.patch";
+      hash = "sha256-BxYrXALpZFyJtFrgU5jFmzd1dIMPmpNgvYArgkwGt/w=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = lib.optional stdenv.hostPlatform.isMusl argp-standalone;
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix
new file mode 100644
index 000000000000..41e3547a7861
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix
@@ -0,0 +1,146 @@
+{ lib
+, derivationWithMeta
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+, coreutils
+, mescc-tools-extra
+, bash_2_05
+}:
+let
+  pname = "bash";
+  version = "2.05b";
+
+  src = fetchurl {
+    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    sha256 = "1r1z2qdw3rz668nxrzwa14vk2zcn00hw7mpjn384picck49d80xs";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/bash-2.05b/bash-2.05b.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/bash-2.05b";
+
+  main_mk = fetchurl {
+    url = "${liveBootstrap}/mk/main.mk";
+    sha256 = "0hj29q3pq3370p18sxkpvv9flb7yvx2fs96xxlxqlwa8lkimd0j4";
+  };
+
+  common_mk = fetchurl {
+    url = "${liveBootstrap}/mk/common.mk";
+    sha256 = "09rigxxf85p2ybnq248sai1gdx95yykc8jmwi4yjx389zh09mcr8";
+  };
+
+  builtins_mk = fetchurl {
+    url = "${liveBootstrap}/mk/builtins.mk";
+    sha256 = "0939dy5by1xhfmsjj6w63nlgk509fjrhpb2crics3dpcv7prl8lj";
+  };
+
+  patches = [
+    # mes libc does not have locale support
+    (fetchurl {
+      url = "${liveBootstrap}/patches/mes-libc.patch";
+      sha256 = "0zksdjf6zbb3p4hqg6plq631y76hhhgab7kdvf7cnpk8bcykn12z";
+    })
+    # int name, namelen; is wrong for mes libc, it is char* name, so we modify tinycc
+    # to reflect this.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/tinycc.patch";
+      sha256 = "042d2kr4a8klazk1hlvphxr6frn4mr53k957aq3apf6lbvrjgcj2";
+    })
+    # add ifdef's for features we don't want
+    (fetchurl {
+      url = "${liveBootstrap}/patches/missing-defines.patch";
+      sha256 = "1q0k1kj5mrvjkqqly7ki5575a5b3hy1ywnmvhrln318yh67qnkj4";
+    })
+    # mes libc + setting locale = not worky
+    (fetchurl {
+      url = "${liveBootstrap}/patches/locale.patch";
+      sha256 = "1p1q1slhafsgj8x4k0dpn9h6ryq5fwfx7dicbbxhldbw7zvnnbx9";
+    })
+    # We do not have /dev at this stage of the bootstrap, including /dev/tty
+    (fetchurl {
+      url = "${liveBootstrap}/patches/dev-tty.patch";
+      sha256 = "1315slv5f7ziajqyxg4jlyanf1xwd06xw14y6pq7xpm3jzjk55j9";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    coreutils
+  ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name buildCommand;
+      builder = "${bash_2_05}/bin/bash";
+      args = [
+        "-e"
+        (builtins.toFile "bash-builder.sh" ''
+          export CONFIG_SHELL=$SHELL
+          bash -eux $buildCommandPath
+        '')
+      ];
+      passAsFile = [ "buildCommand" ];
+
+      SHELL = "${bash_2_05}/bin/bash";
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [
+        bash_2_05
+        coreutils
+        # provides untar, ungz, and unbz2
+        mescc-tools-extra
+      ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  passthru.tests.get-version = result:
+    kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bash --version
+      mkdir ''${out}
+    '';
+
+  meta = with lib; {
+    description = "GNU Bourne-Again Shell, the de facto standard shell on Linux";
+    homepage = "https://www.gnu.org/software/bash";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output bash.tar
+  untar --file bash.tar
+  rm bash.tar
+  cd bash-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  cp ${main_mk} Makefile
+  cp ${builtins_mk} builtins/Makefile
+  cp ${common_mk} common.mk
+  touch config.h
+  touch include/version.h
+  touch include/pipesize.h
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    mkbuiltins
+  cd builtins
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    libbuiltins.a
+  cd ..
+  make CC="tcc -B ${tinycc.libs}/lib"
+
+  # Install
+  install -D bash ''${out}/bin/bash
+  ln -s bash ''${out}/bin/sh
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
new file mode 100644
index 000000000000..84fb7a0a1b73
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gzip
+}:
+let
+  pname = "bzip2";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "https://sourceware.org/pub/bzip2/bzip2-${version}.tar.gz";
+    sha256 = "0s92986cv0p692icqlw1j42y9nld8zd83qwhzbqd61p1dqbh6nmb";
+  };
+
+  patches = [
+    # mes libc has no time support, so we remove that.
+    # It also does not have fch{own,mod}, which we don't care about in the bootstrap
+    # anyway, so we can null-op those calls.
+    (fetchurl {
+      url = "https://github.com/fosslinux/live-bootstrap/raw/87e9d7db9d22b400d1c05247254ac39ee2577e80/sysa/bzip2-1.0.8/patches/mes-libc.patch";
+      sha256 = "14dciwib28h413skzfkh7samzh8x87dmwhldyxxphff04pvl1j3c";
+    })
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bzip2 --version --help
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "High-quality data compression program";
+    homepage = "https://www.sourceware.org/bzip2";
+    license = licenses.bsdOriginal;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  cp ${src} bzip2.tar.gz
+  gunzip bzip2.tar.gz
+  untar --file bzip2.tar
+  rm bzip2.tar
+  cd bzip2-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib -I ." \
+    AR="tcc -ar" \
+    bzip2 bzip2recover
+
+  # Install
+  make install PREFIX=$out
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
new file mode 100644
index 000000000000..eb4fe9bcf993
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -0,0 +1,117 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+}:
+let
+  pname = "coreutils";
+  version = "5.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
+    sha256 = "10wq6k66i8adr4k08p0xmg87ff4ypiazvwzlmi7myib27xgffz62";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/a8752029f60217a5c41c548b16f5cdd2a1a0e0db/sysa/coreutils-5.0/coreutils-5.0.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/a8752029f60217a5c41c548b16f5cdd2a1a0e0db/sysa/coreutils-5.0";
+
+  makefile = fetchurl {
+    url = "${liveBootstrap}/mk/main.mk";
+    sha256 = "0njg4xccxfqrslrmlb8ls7h6hlnfmdx42nvxwmca8flvczwrplfd";
+  };
+
+  patches = [
+    # modechange.h uses functions defined in sys/stat.h, so we need to move it to
+    # after sys/stat.h include.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/modechange.patch";
+      sha256 = "04xa4a5w2syjs3xs6qhh8kdzqavxnrxpxwyhc3qqykpk699p3ms5";
+    })
+    # mbstate_t is a struct that is required. However, it is not defined by mes libc.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/mbstate.patch";
+      sha256 = "0rz3c0sflgxjv445xs87b83i7gmjpl2l78jzp6nm3khdbpcc53vy";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/ls-strcmp.patch";
+      sha256 = "0lx8rz4sxq3bvncbbr6jf0kyn5bqwlfv9gxyafp0541dld6l55p6";
+    })
+    # getdate.c is pre-compiled from getdate.y
+    # At this point we don't have bison yet and in any case getdate.y does not
+    # compile when generated with modern bison.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/touch-getdate.patch";
+      sha256 = "1xd3z57lvkj7r8vs5n0hb9cxzlyp58pji7d335snajbxzwy144ma";
+    })
+    # touch: add -h to change symlink timestamps, where supported
+    (fetchurl {
+      url = "${liveBootstrap}/patches/touch-dereference.patch";
+      sha256 = "0wky5r3k028xwyf6g6ycwqxzc7cscgmbymncjg948vv4qxsxlfda";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/expr-strcmp.patch";
+      sha256 = "19f31lfsm1iwqzvp2fyv97lmqg4730prfygz9zip58651jf739a9";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    # hard_LC_COLLATE is used but not declared when HAVE_SETLOCALE is unset.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/sort-locale.patch";
+      sha256 = "0bdch18mpyyxyl6gyqfs0wb4pap9flr11izqdyxccx1hhz0a2i6c";
+    })
+    # don't assume fopen cannot return stdin or stdout.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/uniq-fopen.patch";
+      sha256 = "0qs6shyxl9j4h34v5j5sgpxrr4gjfljd2hxzw416ghwc3xzv63fp";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+  ];
+
+  meta = with lib; {
+    description = "The GNU Core Utilities";
+    homepage = "https://www.gnu.org/software/coreutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output coreutils.tar
+  untar --file coreutils.tar
+  rm coreutils.tar
+  cd coreutils-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  catm config.h
+  cp lib/fnmatch_.h lib/fnmatch.h
+  cp lib/ftw_.h lib/ftw.h
+  cp lib/search_.h lib/search.h
+  rm src/dircolors.h
+
+  # Build
+  make -f ${makefile} \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    PREFIX=''${out}
+
+  # Check
+  ./src/echo "Hello coreutils!"
+
+  # Install
+  ./src/mkdir -p ''${out}/bin
+  make -f ${makefile} install PREFIX=''${out}
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
new file mode 100644
index 000000000000..3e4e9e7f5cb8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -0,0 +1,88 @@
+{ lib
+, config
+, buildPlatform
+, hostPlatform
+, fetchurl
+, checkMeta
+}:
+
+lib.makeScope
+  # Prevent using top-level attrs to protect against introducing dependency on
+  # non-bootstrap packages by mistake. Any top-level inputs must be explicitly
+  # declared here.
+  (extra: lib.callPackageWith ({ inherit lib config buildPlatform hostPlatform fetchurl checkMeta; } // extra))
+  (self: with self; {
+
+    bash_2_05 = callPackage ./bash/2.nix { tinycc = tinycc-mes; };
+
+    bzip2 = callPackage ./bzip2 {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    coreutils = callPackage ./coreutils { tinycc = tinycc-mes; };
+
+    gawk = callPackage ./gawk {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gnugrep = callPackage ./gnugrep {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gnumake = callPackage ./gnumake { tinycc = tinycc-mes; };
+
+    gnupatch = callPackage ./gnupatch { tinycc = tinycc-mes; };
+
+    gnused = callPackage ./gnused {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gnutar = callPackage ./gnutar {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gzip = callPackage ./gzip {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    heirloom = callPackage ./heirloom {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    heirloom-devtools = callPackage ./heirloom-devtools { tinycc = tinycc-mes; };
+
+    ln-boot = callPackage ./ln-boot { };
+
+    mes = lib.recurseIntoAttrs (callPackage ./mes { });
+    mes-libc = callPackage ./mes/libc.nix { };
+
+    stage0-posix = callPackage ./stage0-posix { };
+
+    inherit (self.stage0-posix) kaem m2libc mescc-tools mescc-tools-extra;
+
+    tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
+    tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
+
+    inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;
+
+    test = kaem.runCommand "minimal-bootstrap-test" {} ''
+      echo ${bash_2_05.tests.get-version}
+      echo ${bzip2.tests.get-version}
+      echo ${gawk.tests.get-version}
+      echo ${gnugrep.tests.get-version}
+      echo ${gnused.tests.get-version}
+      echo ${gnutar.tests.get-version}
+      echo ${gzip.tests.get-version}
+      echo ${heirloom.tests.get-version}
+      echo ${mes.compiler.tests.get-version}
+      echo ${tinycc-mes.compiler.tests.chain}
+      mkdir ''${out}
+    '';
+  })
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
new file mode 100644
index 000000000000..d840a204416d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+}:
+let
+  pname = "gawk";
+  # >=3.1.x is incompatible with mes-libc
+  version = "3.0.6";
+
+  src = fetchurl {
+    url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
+    sha256 = "1z4bibjm7ldvjwq3hmyifyb429rs2d9bdwkvs0r171vv1khpdwmb";
+  };
+
+  patches = [
+    # for reproducibility don't generate date stamp
+    ./no-stamp.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/awk --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the Awk programming language";
+    homepage = "https://www.gnu.org/software/gawk";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output gawk.tar
+  untar --file gawk.tar
+  rm gawk.tar
+  cd gawk-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export ac_cv_func_getpgrp_void=yes
+  export ac_cv_func_tzset=yes
+  bash ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --prefix=$out
+
+  # Build
+  make gawk
+
+  # Install
+  install -D gawk $out/bin/gawk
+  ln -s gawk $out/bin/awk
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch
new file mode 100644
index 000000000000..74af25ba2106
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch
@@ -0,0 +1,10 @@
+--- configure
++++ configure
+@@ -3676,7 +3676,6 @@ cat >> $CONFIG_STATUS <<EOF
+ 
+ EOF
+ cat >> $CONFIG_STATUS <<\EOF
+-date > stamp-h
+ exit 0
+ EOF
+ chmod +x $CONFIG_STATUS
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix
new file mode 100644
index 000000000000..b2899961dfa2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+}:
+let
+  pname = "gnugrep";
+  version = "2.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/grep/grep-${version}.tar.gz";
+    sha256 = "05iayw5sfclc476vpviz67hdy03na0pz2kb5csa50232nfx34853";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4
+  makefile = fetchurl {
+    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4/mk/main.mk";
+    sha256 = "08an9ljlqry3p15w28hahm6swnd3jxizsd2188przvvsj093j91k";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/grep --version
+      mkdir ''${out}
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the Unix grep command";
+    homepage = "https://www.gnu.org/software/grep";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "grep";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output grep.tar
+  untar --file grep.tar
+  rm grep.tar
+  cd grep-${version}
+
+  # Configure
+  cp ${makefile} Makefile
+
+  # Build
+  make CC="tcc -B ${tinycc.libs}/lib"
+
+  # Install
+  make install PREFIX=$out
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch
new file mode 100644
index 000000000000..58ee2d6fe09b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch
@@ -0,0 +1,35 @@
+From e00a5257a6ca5fedbf68b09eee7df3502971a057 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:11:40 +0200
+Subject: [PATCH 1/2] No impure bin sh
+
+default_shell is used to populuate default shell used to execute jobs.
+Unless SHELL is set to a different value this would be /bin/sh.
+Our stdenv provides sh in form of bash anyway. Having this value not
+hard-coded has some advantages:
+
+- It would ensure that on all systems it uses sh from its PATH rather
+  than /bin/sh, which helps as different systems might have different
+  shells there (bash vs. dash)
+- In the past I had issues with LD_PRELOAD with BEAR, where /bin/sh
+  used a different glibc than BEAR which came from my development shell.
+---
+ src/job.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/job.c b/src/job.c
+index ae1f18b..6b4ddb3 100644
+--- a/src/job.c
++++ b/src/job.c
+@@ -77,7 +77,7 @@ char * vms_strsignal (int status);
+ 
+ #else
+ 
+-const char *default_shell = "/bin/sh";
++const char *default_shell = "sh";
+ int batch_mode_shell = 0;
+ 
+ #endif
+-- 
+2.31.1
+
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch
new file mode 100644
index 000000000000..e62aee7d9993
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch
@@ -0,0 +1,40 @@
+From 795d63d3c8b5c0dbb7e544954f75507b371b7228 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:20:16 +0200
+Subject: [PATCH 2/2] remove impure dirs
+
+---
+ src/read.c   | 3 ---
+ src/remake.c | 2 --
+ 2 files changed, 5 deletions(-)
+
+diff --git a/src/read.c b/src/read.c
+index fa197fb..defacfb 100644
+--- a/src/read.c
++++ b/src/read.c
+@@ -109,9 +109,6 @@ static const char *default_include_directories[] =
+ #endif
+     INCLUDEDIR,
+ #ifndef _AMIGA
+-    "/usr/gnu/include",
+-    "/usr/local/include",
+-    "/usr/include",
+ #endif
+     0
+   };
+diff --git a/src/remake.c b/src/remake.c
+index fb237c5..94bff7d 100644
+--- a/src/remake.c
++++ b/src/remake.c
+@@ -1601,8 +1601,6 @@ library_search (const char *lib, FILE_TIMESTAMP *mtime_ptr)
+   static const char *dirs[] =
+     {
+ #ifndef _AMIGA
+-      "/lib",
+-      "/usr/lib",
+ #endif
+ #if defined(WINDOWS32) && !defined(LIBDIR)
+ /*
+-- 
+2.31.1
+
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch
new file mode 100644
index 000000000000..e2e3f3395153
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch
@@ -0,0 +1,58 @@
+diff --git a/src/dir.c b/src/dir.c
+index 3e94b98..cfaa6a2 100644
+--- a/src/dir.c
++++ b/src/dir.c
+@@ -1331,10 +1331,9 @@ local_stat (const char *path, struct stat *buf)
+ 
+ /* Similarly for lstat.  */
+ #if !defined(lstat) && !defined(WINDOWS32) || defined(VMS)
+-# ifndef VMS
+-#  ifndef HAVE_SYS_STAT_H
++// mes-libc implements but does not declare lstat
++# if (!defined(VMS) && !defined(HAVE_SYS_STAT_H)) || defined(__TINYC__)
+ int lstat (const char *path, struct stat *sbuf);
+-#  endif
+ # else
+     /* We are done with the fake lstat.  Go back to the real lstat */
+ #   ifdef lstat
+diff --git a/src/job.c b/src/job.c
+index ea88561..8388a82 100644
+--- a/src/job.c
++++ b/src/job.c
+@@ -2052,7 +2052,8 @@ job_next_command (struct child *child)
+ static int
+ load_too_high (void)
+ {
+-#if defined(__MSDOS__) || defined(VMS) || defined(_AMIGA) || defined(__riscos__)
++// mes-libc does not support getloadavg
++#if defined(__MSDOS__) || defined(VMS) || defined(_AMIGA) || defined(__riscos__) || defined (__TINYC__)
+   return 1;
+ #else
+   static double last_sec;
+diff --git a/src/main.c b/src/main.c
+index a9d3a64..664d40f 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -2770,7 +2770,7 @@ main (int argc, char **argv, char **envp)
+               char *b = alloca (40);
+               sprintf (b, "MAKE_RESTARTS=%s%u",
+                        OUTPUT_IS_TRACED () ? "-" : "", restarts);
+-              putenv (b);
++              // mes-libc does not support putenv
+             }
+ 
+           fflush (stdout);
+diff --git a/src/misc.c b/src/misc.c
+index eb14f40..bffca82 100644
+--- a/src/misc.c
++++ b/src/misc.c
+@@ -653,7 +653,8 @@ get_tmppath ()
+ 
+ # ifdef HAVE_MKTEMP
+   path = get_tmptemplate ();
+-  if (*mktemp (path) == '\0')
++  // tinycc: "src/misc.c:656: error: pointer expected"
++  if (!strcmp(mktemp (path), ""))
+     {
+       OSS (error, NILF,
+            _("cannot generate temp path from %s: %s"), path, strerror (errno));
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
new file mode 100644
index 000000000000..823d314f2802
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
@@ -0,0 +1,190 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnupatch
+}:
+let
+  pname = "gnumake";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/make/make-${version}.tar.gz";
+    sha256 = "1cwgcmwdn7gqn5da2ia91gkyiqs9birr10sy5ykpkaxzcwfzn5nx";
+  };
+
+  patches = [
+    # Replaces /bin/sh with sh, see patch file for reasoning
+    ./0001-No-impure-bin-sh.patch
+    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
+    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
+    # included Makefiles, don't look in /usr/include and friends.
+    ./0002-remove-impure-dirs.patch
+    # Fixes for tinycc. See comments in patch file for reasoning
+    ./0003-tinycc-support.patch
+  ];
+
+  CFLAGS = [
+    "-I./src"
+    "-I./lib"
+    "-DHAVE_CONFIG_H"
+    "-DMAKE_MAINTAINER_MODE"
+    "-DLIBDIR=\\\"${placeholder "out"}/lib\\\""
+    "-DLOCALEDIR=\\\"/fake-locale\\\""
+    "-DPOSIX=1"
+    # mes-libc doesn't implement osync_* methods
+    "-DNO_OUTPUT_SYNC=1"
+    # mes-libc doesn't define O_TMPFILE
+    "-DO_TMPFILE=020000000"
+  ] ++ config;
+
+  /*
+    Maintenance notes:
+
+    Generated by
+        ./configure \
+          --build i686-pc-linux-gnu \
+          --host i686-pc-linux-gnu \
+          CC="${tinycc.compiler}/bin/tcc -B ${tinycc.libs}/lib" \
+          ac_cv_func_dup=no
+    - `ac_cv_func_dup` disabled as mes-libc doesn't implement tmpfile()
+
+    The output src/config.h was then manually filtered, removing definitions that
+    didn't have uses in the source code
+  */
+  config = [
+    "-DFILE_TIMESTAMP_HI_RES=0"
+    "-DHAVE_ALLOCA"
+    "-DHAVE_ALLOCA_H"
+    "-DHAVE_ATEXIT"
+    "-DHAVE_DECL_BSD_SIGNAL=0"
+    "-DHAVE_DECL_GETLOADAVG=0"
+    "-DHAVE_DECL_SYS_SIGLIST=0"
+    "-DHAVE_DECL__SYS_SIGLIST=0"
+    "-DHAVE_DECL___SYS_SIGLIST=0"
+    "-DHAVE_DIRENT_H"
+    "-DHAVE_DUP2"
+    "-DHAVE_FCNTL_H"
+    "-DHAVE_FDOPEN"
+    "-DHAVE_GETCWD"
+    "-DHAVE_GETTIMEOFDAY"
+    "-DHAVE_INTTYPES_H"
+    "-DHAVE_ISATTY"
+    "-DHAVE_LIMITS_H"
+    "-DHAVE_LOCALE_H"
+    "-DHAVE_MEMORY_H"
+    "-DHAVE_MKTEMP"
+    "-DHAVE_SA_RESTART"
+    "-DHAVE_SETVBUF"
+    "-DHAVE_SIGACTION"
+    "-DHAVE_SIGSETMASK"
+    "-DHAVE_STDINT_H"
+    "-DHAVE_STDLIB_H"
+    "-DHAVE_STRDUP"
+    "-DHAVE_STRERROR"
+    "-DHAVE_STRINGS_H"
+    "-DHAVE_STRING_H"
+    "-DHAVE_STRTOLL"
+    "-DHAVE_SYS_FILE_H"
+    "-DHAVE_SYS_PARAM_H"
+    "-DHAVE_SYS_RESOURCE_H"
+    "-DHAVE_SYS_SELECT_H"
+    "-DHAVE_SYS_STAT_H"
+    "-DHAVE_SYS_TIMEB_H"
+    "-DHAVE_SYS_TIME_H"
+    "-DHAVE_SYS_WAIT_H"
+    "-DHAVE_TTYNAME"
+    "-DHAVE_UMASK"
+    "-DHAVE_UNISTD_H"
+    "-DHAVE_WAITPID"
+    "-DMAKE_JOBSERVER"
+    "-DMAKE_SYMLINKS"
+    "-DPATH_SEPARATOR_CHAR=':'"
+    "-DSCCS_GET=\\\"get\\\""
+    "-DSTDC_HEADERS"
+    "-Dsig_atomic_t=int"
+    "-Dvfork=fork"
+  ];
+
+  # Maintenance note: list of source files derived from Basic.mk
+  make_SOURCES = [
+    "src/ar.c"
+    "src/arscan.c"
+    "src/commands.c"
+    "src/default.c"
+    "src/dir.c"
+    "src/expand.c"
+    "src/file.c"
+    "src/function.c"
+    "src/getopt.c"
+    "src/getopt1.c"
+    "src/guile.c"
+    "src/hash.c"
+    "src/implicit.c"
+    "src/job.c"
+    "src/load.c"
+    "src/loadapi.c"
+    "src/main.c"
+    "src/misc.c"
+    "src/output.c"
+    "src/read.c"
+    "src/remake.c"
+    "src/rule.c"
+    "src/shuffle.c"
+    "src/signame.c"
+    "src/strcache.c"
+    "src/variable.c"
+    "src/version.c"
+    "src/vpath.c"
+  ];
+  glob_SOURCES = [ "lib/fnmatch.c" "lib/glob.c" ];
+  remote_SOURCES = [ "src/remote-stub.c" ];
+  sources = make_SOURCES ++ glob_SOURCES ++ remote_SOURCES ++ [
+    "src/posixos.c"
+  ];
+
+  objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ tinycc.compiler gnupatch ];
+
+  meta = with lib; {
+    description = "A tool to control the generation of non-source files from sources";
+    homepage = "https://www.gnu.org/software/make";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "make";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output make.tar
+  untar --file make.tar
+  rm make.tar
+  cd make-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  catm src/config.h src/mkconfig.h src/mkcustom.h
+  cp lib/glob.in.h lib/glob.h
+  cp lib/fnmatch.in.h lib/fnmatch.h
+
+  # Compile
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
+  ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
+
+  # Link
+  CC -o make ${lib.concatStringsSep " " objects}
+
+  # Check
+  ./make --version
+
+  # Install
+  mkdir -p ''${out}/bin
+  cp ./make ''${out}/bin
+  chmod 555 ''${out}/bin/make
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
new file mode 100644
index 000000000000..8e6f6696c68c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
@@ -0,0 +1,107 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+}:
+let
+  pname = "gnupatch";
+  # 2.6.x and later use features not implemented in mes-libc (eg. quotearg.h)
+  version = "2.5.9";
+
+  src = fetchurl {
+    url = "mirror://gnu/patch/patch-${version}.tar.gz";
+    sha256 = "12nv7jx3gxfp50y11nxzlnmqqrpicjggw6pcsq0wyavkkm3cddgc";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/patch-2.5.9/mk/main.mk
+  CFLAGS = [
+    "-I."
+    "-DHAVE_DECL_GETENV"
+    "-DHAVE_DECL_MALLOC"
+    "-DHAVE_DIRENT_H"
+    "-DHAVE_LIMITS_H"
+    "-DHAVE_GETEUID"
+    "-DHAVE_MKTEMP"
+    "-DPACKAGE_BUGREPORT="
+    "-Ded_PROGRAM=\\\"/nullop\\\""
+    "-Dmbstate_t=int" # When HAVE_MBRTOWC is not enabled uses of mbstate_t are always a no-op
+    "-DRETSIGTYPE=int"
+    "-DHAVE_MKDIR"
+    "-DHAVE_RMDIR"
+    "-DHAVE_FCNTL_H"
+    "-DPACKAGE_NAME=\\\"patch\\\""
+    "-DPACKAGE_VERSION=\\\"${version}\\\""
+    "-DHAVE_MALLOC"
+    "-DHAVE_REALLOC"
+    "-DSTDC_HEADERS"
+    "-DHAVE_STRING_H"
+    "-DHAVE_STDLIB_H"
+  ];
+
+  # Maintenance note: List of sources from Makefile.in
+  SRCS = [
+    "addext.c"
+    "argmatch.c"
+    "backupfile.c"
+    "basename.c"
+    "dirname.c"
+    "getopt.c"
+    "getopt1.c"
+    "inp.c"
+    "maketime.c"
+    "partime.c"
+    "patch.c"
+    "pch.c"
+    "quote.c"
+    "quotearg.c"
+    "quotesys.c"
+    "util.c"
+    "version.c"
+    "xmalloc.c"
+  ];
+  sources = SRCS ++ [
+    # mes-libc doesn't implement `error()`
+    "error.c"
+  ];
+
+  objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ tinycc.compiler ];
+
+  meta = with lib; {
+    description = "GNU Patch, a program to apply differences to files";
+    homepage = "https://www.gnu.org/software/patch";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "patch";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output patch.tar
+  untar --file patch.tar
+  rm patch.tar
+  cd patch-${version}
+
+  # Configure
+  catm config.h
+
+  # Build
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
+  ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
+
+  # Link
+  CC -o patch ${lib.concatStringsSep " " objects}
+
+  # Check
+  ./patch --version
+
+  # Install
+  mkdir -p ''${out}/bin
+  cp ./patch ''${out}/bin
+  chmod 555 ''${out}/bin/patch
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
new file mode 100644
index 000000000000..b6b1f9f198c7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+}:
+let
+  pname = "gnused";
+  # last version that can be compiled with mes-libc
+  version = "4.0.9";
+
+  src = fetchurl {
+    url = "mirror://gnu/sed/sed-${version}.tar.gz";
+    sha256 = "0006gk1dw2582xsvgx6y6rzs9zw8b36rhafjwm288zqqji3qfrf3";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/sed-4.0.9.kaem
+  makefile = fetchurl {
+    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/mk/main.mk";
+    sha256 = "0w1f5ri0g5zla31m6l6xyzbqwdvandqfnzrsw90dd6ak126w3mya";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/sed --version
+      mkdir ''${out}
+    '';
+
+  meta = with lib; {
+    description = "GNU sed, a batch stream editor";
+    homepage = "https://www.gnu.org/software/sed";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "sed";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output sed.tar
+  untar --file sed.tar
+  rm sed.tar
+  cd sed-${version}
+
+  # Configure
+  cp ${makefile} Makefile
+  catm config.h
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    LIBC=mes
+
+  # Install
+  make install PREFIX=$out
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix
new file mode 100644
index 000000000000..e07561b3e7e5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnused
+, gnugrep
+}:
+let
+  pname = "gnutar";
+  # >= 1.13 is incompatible with mes-libc
+  version = "1.12";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    sha256 = "02m6gajm647n8l9a5bnld6fnbgdpyi4i3i83p7xcwv0kif47xhy6";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output tar.tar
+  untar --file tar.tar
+  rm tar.tar
+  cd tar-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  bash ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --prefix=$out
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix
new file mode 100644
index 000000000000..39353bf2b48b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnused
+, gnugrep
+}:
+let
+  pname = "gzip";
+  version = "1.2.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/gzip/gzip-${version}.tar.gz";
+    sha256 = "0ryr5b00qz3xcdcv03qwjdfji8pasp0007ay3ppmk71wl8c1i90w";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/gzip --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU zip compression program";
+    homepage = "https://www.gnu.org/software/gzip";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output gzip.tar
+  untar --file gzip.tar
+  rm gzip.tar
+  cd gzip-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib -Dstrlwr=unused"
+  bash ./configure --prefix=$out
+
+  # Build
+  make
+
+  # Install
+  mkdir $out
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix
new file mode 100644
index 000000000000..88637811b953
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+, coreutils
+}:
+let
+  pname = "heirloom-devtools";
+  version = "070527";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/heirloom/heirloom-devtools/heirloom-devtools-${version}.tar.bz2";
+    sha256 = "9f233d8b78e4351fe9dd2d50d83958a0e5af36f54e9818521458a08e058691ba";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/d918b984ad6fe4fc7680f3be060fd82f8c9fddd9/sysa/heirloom-devtools-070527/heirloom-devtools-070527.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/d918b984ad6fe4fc7680f3be060fd82f8c9fddd9/sysa/heirloom-devtools-070527";
+
+  patches = [
+    # Remove all kinds of wchar support. Mes Libc does not support wchar in any form
+    (fetchurl {
+      url = "${liveBootstrap}/patches/yacc_remove_wchar.patch";
+      sha256 = "0wgiz02bb7xzjy2gnbjp8y31qy6rc4b29v01zi32zh9lw54j68hc";
+    })
+    # Similarly to yacc, remove wchar. See yacc patch for further information
+    (fetchurl {
+      url = "${liveBootstrap}/patches/lex_remove_wchar.patch";
+      sha256 = "168dfngi51ljjqgd55wbvmffaq61gk48gak50ymnl1br92qkp4zh";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    coreutils
+  ];
+
+  meta = with lib; {
+    description = "Portable yacc and lex derived from OpenSolaris";
+    homepage = "https://heirloom.sourceforge.net/devtools.html";
+    license = with licenses; [ cddl bsdOriginalUC caldera ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  unbz2 --file ${src} --output heirloom-devtools.tar
+  untar --file heirloom-devtools.tar
+  rm heirloom-devtools.tar
+  build=''${NIX_BUILD_TOP}/heirloom-devtools-${version}
+  cd ''${build}
+
+  # Patch
+  ${lib.concatLines (map (f: "patch -Np0 -i ${f}") patches)}
+
+  # Build yacc
+  cd yacc
+  make -f Makefile.mk \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    AR="tcc -ar" \
+    CFLAGS="-DMAXPATHLEN=4096 -DEILSEQ=84 -DMB_LEN_MAX=100" \
+    LDFLAGS="-lgetopt" \
+    RANLIB=true \
+    LIBDIR=''${out}/lib
+
+  # Install yacc
+  install -D yacc ''${out}/bin/yacc
+  install -Dm 444 liby.a ''${out}/lib/liby.a
+  install -Dm 444 yaccpar ''${out}/lib/yaccpar
+
+  # Make yacc available to lex
+  PATH="''${out}/bin:''${PATH}"
+
+  # Build lex
+  cd ../lex
+  make -f Makefile.mk \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    AR="tcc -ar" \
+    CFLAGS="-DEILSEQ=84 -DMB_LEN_MAX=100" \
+    LDFLAGS="-lgetopt" \
+    RANLIB=true \
+    LIBDIR=''${out}/lib
+
+  # Install lex
+  install -D lex ''${out}/bin/lex
+  install -Dm 444 ncform ''${out}/lib/lex/ncform
+  install -Dm 444 nceucform ''${out}/lib/lex/nceucform
+  install -Dm 444 nrform ''${out}/lib/lex/nrform
+  install -Dm 444 libl.a ''${out}/lib/libl.a
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch
new file mode 100644
index 000000000000..88d6e7d6fa4d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch
@@ -0,0 +1,84 @@
+--- cp/cp.c
++++ cp/cp.c
+@@ -42,8 +42,6 @@ static const char sccsid[] USED = "@(#)cp.sl	1.84 (gritter) 3/4/06";
+ 
+ #include	<sys/types.h>
+ #include	<sys/stat.h>
+-#include	<sys/socket.h>
+-#include	<sys/un.h>
+ #include	<sys/time.h>
+ #include	<sys/resource.h>
+ #include	<fcntl.h>
+@@ -427,6 +425,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ #endif
+ 
+ #ifdef	__linux__
++#ifdef	O_DIRECT
+ 	if (!bflag && !Dflag && ssp->st_size > 0) {
+ 		long long	sent;
+ 
+@@ -436,6 +435,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ 		if (sent < 0)
+ 			goto err;
+ 	}
++#endif
+ #endif	/* __linux__ */
+ 	if (pagesize == 0)
+ 		if ((pagesize = 4096) < 0)
+@@ -702,37 +702,6 @@ symlinkcopy(const char *src, const struct stat *ssp,
+ 	}
+ }
+ 
+-static void
+-socketcopy(const char *src, const struct stat *ssp,
+-		const char *tgt, const struct stat *dsp)
+-{
+-	int	fd, addrsz;
+-	struct sockaddr_un	addr;
+-	size_t	len;
+-
+-	if (do_unlink(tgt, dsp) != OKAY)
+-		return;
+-	len = strlen(tgt);
+-	memset(&addr, 0, sizeof addr);
+-	addr.sun_family = AF_UNIX;
+-	addrsz = sizeof addr - sizeof addr.sun_path + len;
+-	if ((len >= sizeof addr.sun_path ? errno = ENAMETOOLONG, fd = -1, 1 :
+-			(strncpy(addr.sun_path,tgt,sizeof addr.sun_path), 0)) ||
+-			(fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0 ||
+-			bind(fd, (struct sockaddr *)&addr, addrsz) < 0) {
+-		fprintf(stderr, "%s: cannot create socket %s\n%s: %s\n",
+-				progname, tgt,
+-				progname, strerror(errno));
+-		if (fd >= 0)
+-			close(fd);
+-		errcnt |= 01;
+-		return;
+-	}
+-	close(fd);
+-	if (pflag)
+-		permissions(tgt, ssp);
+-}
+-
+ static void
+ specialcopy(const char *src, const struct stat *ssp,
+ 		const char *tgt, const struct stat *dsp)
+@@ -748,9 +717,6 @@ specialcopy(const char *src, const struct stat *ssp,
+ 	case S_IFLNK:
+ 		symlinkcopy(src, ssp, tgt, dsp);
+ 		break;
+-	case S_IFSOCK:
+-		socketcopy(src, ssp, tgt, dsp);
+-		break;
+ 	case S_IFDOOR:
+ 		ignoring("door", src);
+ 		break;
+@@ -1043,7 +1009,7 @@ ln(const char *src, const char *tgt, struct stat *dsp, int level,
+ 		errcnt |= 01;
+ 		return;
+ 	}
+-#if (defined (SUS) || defined (S42)) && (defined (__linux__) || defined (__sun))
++#if (defined (SUS) || defined (S42)) && (defined (__linux__) || defined (__sun)) && !defined (__TINYC__)
+ 	if (sflag == 0) {
+ 		char	*rpbuf = alloca(PATH_MAX+1);
+ 		if (realpath(src, rpbuf) == NULL) {
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
new file mode 100644
index 000000000000..182e515c2f1b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
@@ -0,0 +1,130 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, heirloom-devtools
+, heirloom
+}:
+let
+  pname = "heirloom";
+  version = "070715";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/heirloom/heirloom/${version}/heirloom-${version}.tar.bz2";
+    sha256 = "sha256-6zP3C8wBmx0OCkHx11UtRcV6FicuThxIY07D5ESWow8=";
+  };
+
+  patches = [
+    # we pre-generate nawk's proctab.c as meslibc is not capable of running maketab
+    # during build time (insufficient sscanf support)
+    ./proctab.patch
+
+    # disable utilities that don't build successfully
+    ./disable-programs.patch
+
+    # "tcc -ar" doesn't support creating empty archives
+    ./tcc-empty-ar.patch
+    # meslibc doesn't have seperate libm
+    ./dont-link-lm.patch
+    # meslibc's vprintf doesn't support %ll
+    ./vprintf.patch
+    # meslibc doesn't support sysconf()
+    ./sysconf.patch
+    # meslibc doesn't support locale
+    ./strcoll.patch
+    # meslibc doesn't support termios.h
+    ./termios.patch
+    # meslibc doesn't support utime.h
+    ./utime.patch
+    # meslibc doesn't support langinfo.h
+    ./langinfo.patch
+    # support building with meslibc
+    ./meslibc-support.patch
+    # remove socket functionality as unsupported by meslibc
+    ./cp-no-socket.patch
+  ];
+
+  makeFlags = [
+    # mk.config build options
+    "CC='tcc -B ${tinycc.libs}/lib -include ${./stubs.h} -include ${./musl.h}'"
+    "AR='tcc -ar'"
+    "RANLIB=true"
+    "STRIP=true"
+    "SHELL=${bash}/bin/sh"
+    "POSIX_SHELL=${bash}/bin/sh"
+    "DEFBIN=/bin"
+    "SV3BIN=/5bin"
+    "S42BIN=/5bin/s42"
+    "SUSBIN=/bin"
+    "SU3BIN=/5bin/posix2001"
+    "UCBBIN=/ucb"
+    "CCSBIN=/ccs/bin"
+    "DEFLIB=/lib"
+    "DEFSBIN=/bin"
+    "MANDIR=/share/man"
+    "LCURS=" # disable ncurses
+    "USE_ZLIB=0" # disable zlib
+    "IWCHAR='-I../libwchar'"
+    "LWCHAR='-L../libwchar -lwchar'"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    heirloom-devtools
+  ];
+
+  passthru.sed =
+    bash.runCommand "${pname}-sed-${version}" {} ''
+      install -D ${heirloom}/bin/sed $out/bin/sed
+    '';
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/banner Hello Heirloom
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "The Heirloom Toolchest is a collection of standard Unix utilities";
+    homepage = "https://heirloom.sourceforge.net/tools.html";
+    license = with licenses; [
+      # All licenses according to LICENSE/
+      zlib
+      caldera
+      bsdOriginalUC
+      cddl
+      bsd3
+      gpl2Plus
+      lgpl21Plus
+      lpl-102
+      info-zip
+    ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  unbz2 --file ${src} --output heirloom.tar
+  untar --file heirloom.tar
+  rm heirloom.tar
+  cd heirloom-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+  cp ${./proctab.c} nawk/proctab.c
+
+  # Build
+  # These tools are required during later build steps
+  export PATH="$PATH:$PWD/ed:$PWD/nawk:$PWD/sed"
+  make ${lib.concatStringsSep " " makeFlags}
+
+  # Install
+  make install ROOT=$out ${lib.concatStringsSep " " makeFlags}
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch
new file mode 100644
index 000000000000..2b15ae296805
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch
@@ -0,0 +1,43 @@
+--- makefile
++++ makefile
+@@ -1,21 +1,24 @@
+-SHELL = /bin/sh
++SHELL = sh
+ 
+-SUBDIRS = build libwchar libcommon libuxre _install \
+-	banner basename bc bdiff bfs \
+-	cal calendar cat chmod chown \
+-	cksum cmp col comm copy cp cpio csplit cut \
+-	date dc dd deroff diff diff3 dircmp dirname df du \
++SUBDIRS = libwchar libcommon libuxre _install \
++	banner basename bdiff bfs \
++	cat chmod chown \
++	cksum cmp col comm copy cp csplit cut \
++	dc dirname \
+ 	echo ed env expand expr \
+-	factor file find fmt fmtmsg fold \
+-	getconf getopt grep groups hd head hostname id join \
+-	kill line listusers ln logins logname ls \
+-	mail man mesg mkdir mkfifo mknod more mvdir \
+-	nawk news nice nl nohup oawk od \
+-	paste pathchk pg pgrep pr printenv printf priocntl ps psrinfo pwd \
+-	random renice rm rmdir \
+-	sdiff sed setpgrp shl sleep sort spell split stty su sum sync \
+-	tabs tail tapecntl tar tcopy tee test time touch tr true tsort tty \
+-	ul uname uniq units users wc what who whoami whodo xargs yes
++	file fmt fold \
++	getopt grep hd head join \
++	kill line ln logname ls \
++	mesg mkdir mknod \
++	nl nohup od \
++	paste pathchk pgrep pr printenv printf pwd \
++	random rm rmdir \
++	sed sleep sort split sum \
++	tee test touch tr true tsort tty \
++	uniq units wc what whoami xargs yes
++
++# These depend on some coreutils that we need to build first
++SUBDIRS += bc nawk build
+ 
+ dummy: makefiles all
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch
new file mode 100644
index 000000000000..bf7a72b733ee
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch
@@ -0,0 +1,44 @@
+--- csplit/Makefile.mk
++++ csplit/Makefile.mk
+@@ -1,19 +1,19 @@
+ all: csplit csplit_sus csplit_su3
+ 
+ csplit: csplit.o
+-	$(LD) $(LDFLAGS) csplit.o $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit
++	$(LD) $(LDFLAGS) csplit.o $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit
+ 
+ csplit.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IWCHAR) $(ICOMMON) -c csplit.c
+ 
+ csplit_sus: csplit_sus.o
+-	$(LD) $(LDFLAGS) csplit_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit_sus
++	$(LD) $(LDFLAGS) csplit_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit_sus
+ 
+ csplit_sus.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IUXRE) $(IWCHAR) $(ICOMMON) -DSUS -c csplit.c -o csplit_sus.o
+ 
+ csplit_su3: csplit_su3.o
+-	$(LD) $(LDFLAGS) csplit_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit_su3
++	$(LD) $(LDFLAGS) csplit_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit_su3
+ 
+ csplit_su3.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IUXRE) $(IWCHAR) $(ICOMMON) -DSU3 -c csplit.c -o csplit_su3.o
+--- nawk/Makefile.mk
++++ nawk/Makefile.mk
+@@ -3,13 +3,13 @@ all: awk awk_sus awk_su3
+ OBJ = awk.lx.o b.o lib.o main.o parse.o proctab.o run.o tran.o
+ 
+ awk: awk.g.o $(OBJ) version.o
+-	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk
++	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk
+ 
+ awk_sus: awk.g.o $(OBJ) version_sus.o
+-	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version_sus.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_sus
++	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_sus
+ 
+ awk_su3: awk.g.2001.o $(OBJ) version_su3.o
+-	$(LD) $(LDFLAGS) awk.g.2001.o $(OBJ) version_su3.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_su3
++	$(LD) $(LDFLAGS) awk.g.2001.o $(OBJ) version_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_su3
+ 
+ awk.g.c: awk.g.y
+ 	$(YACC) -d awk.g.y
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch
new file mode 100644
index 000000000000..a8ad842b37c8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch
@@ -0,0 +1,99 @@
+--- nawk/main.c
++++ nawk/main.c
+@@ -35,7 +35,6 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <locale.h>
+-#include <langinfo.h>
+ #include <libgen.h>
+ 
+ #define	CMDCLASS	""/*"UX:"*/	/* Command classification */
+--- sort/sort.c
++++ sort/sort.c
+@@ -63,7 +63,6 @@ static const char sccsid[] USED = "@(#)sort.sl	1.37 (gritter) 5/29/05";
+ #include <locale.h>
+ #include <wchar.h>
+ #include <wctype.h>
+-#include <langinfo.h>
+ #include <inttypes.h>
+ #include <errno.h>
+ 
+@@ -287,18 +286,6 @@ main(int argc, char **argv)
+ 	else
+ 		chkblank();
+ 	compare = cmpf = ccoll ? mb_cur_max > 1 ? cmpm : cmpa : cmpl;
+-	setlocale(LC_NUMERIC, "");
+-	arg = nl_langinfo(RADIXCHAR);
+-	if (mb_cur_max > 1)
+-		next(radixchar, arg, i);
+-	else
+-		radixchar = *arg & 0377;
+-	arg = nl_langinfo(THOUSEP);
+-	if (mb_cur_max > 1)
+-		next(thousep, arg, i);
+-	else
+-		thousep = *arg & 0377;
+-	setlocale(LC_TIME, "");
+ 	fields = smalloc(NF * sizeof *fields);
+ 	copyproto();
+ 	eargv = argv;
+@@ -1088,8 +1075,7 @@ cmp(const char *i, const char *j)
+ 		} else {
+ 			sa = elicpy(collba, pa, la, '\n', ignore, code);
+ 			sb = elicpy(collbb, pb, lb, '\n', ignore, code);
+-			n = fp->Mflg ? monthcmp(collba, collbb) :
+-				strcoll(collba, collbb);
++			n = strcmp(collba, collbb);
+ 			if (n)
+ 				return n > 0 ? -fp->rflg : fp->rflg;
+ 			pa = &pa[sa];
+@@ -1570,49 +1556,6 @@ upcdup(const char *s)
+ 	return r;
+ }
+ 
+-static const char	*months[12];
+-
+-#define	COPY_ABMON(m)	months[m-1] = upcdup(nl_langinfo(ABMON_##m))
+-
+-static void
+-fillmonths(void)
+-{
+-	COPY_ABMON(1);
+-	COPY_ABMON(2);
+-	COPY_ABMON(3);
+-	COPY_ABMON(4);
+-	COPY_ABMON(5);
+-	COPY_ABMON(6);
+-	COPY_ABMON(7);
+-	COPY_ABMON(8);
+-	COPY_ABMON(9);
+-	COPY_ABMON(10);
+-	COPY_ABMON(11);
+-	COPY_ABMON(12);
+-}
+-
+-static int
+-monthcoll(const char *s)
+-{
+-	int	i;
+-	char	u[MB_LEN_MAX*3+1];
+-
+-	cpcu3(u, s);
+-	for (i = 0; i < 12; i++)
+-		if (strcmp(u, months[i]) == 0)
+-			return i;
+-	return 0;
+-}
+-
+-
+-static int
+-monthcmp(const char *pa, const char *pb)
+-{
+-	if (months[0] == NULL)
+-		fillmonths();
+-	return monthcoll(pa) - monthcoll(pb);
+-}
+-
+ /*
+  * isblank() consumes half of execution time (in skip()) with
+  * glibc 2.3.1. Check if it contains only space and tab, and
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch
new file mode 100644
index 000000000000..f8f7daede3b0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch
@@ -0,0 +1,322 @@
+--- _install/install_ucb.c
++++ _install/install_ucb.c
+@@ -267,7 +267,7 @@ cp(const char *src, const char *tgt, struct stat *dsp)
+ 	if (check(src, tgt, dsp, &sst) != OKAY)
+ 		return;
+ 	unlink(tgt);
+-	if ((dfd = creat(tgt, 0700)) < 0 || fchmod(dfd, 0700) < 0 ||
++	if ((dfd = creat(tgt, 0700)) < 0 || chmod(tgt, 0700) < 0 ||
+ 			fstat(dfd, &nst) < 0) {
+ 		fprintf(stderr, "%s: %s: %s\n", progname, src,
+ 				strerror(errno));
+--- libcommon/Makefile.mk
++++ libcommon/Makefile.mk
+@@ -15,7 +15,7 @@ CHECK: CHECK.c
+ headers: CHECK
+ 	one() { \
+ 		rm -f "$$1.h"; \
+-		if grep "$$1_h[	 ]*=[ 	]*[^0][	 ]*;" CHECK >/dev/null; \
++		if true; \
+ 		then \
+ 			ln -s "_$$1.h" "$$1.h"; \
+ 		fi; \
+--- libcommon/atoll.h
++++ libcommon/atoll.h
+@@ -1,8 +1,10 @@
+ /*	Sccsid @(#)atoll.h	1.4 (gritter) 7/18/04	*/
+ 
+ #if defined (__hpux) || defined (_AIX) || \
+-	defined (__FreeBSD__) && (__FreeBSD__) < 5
++	(defined (__FreeBSD__) && (__FreeBSD__) < 5) || defined (__TINYC__)
++#ifndef __TINYC__
+ extern long long strtoll(const char *nptr, char **endptr, int base);
+ extern unsigned long long strtoull(const char *nptr, char **endptr, int base);
++#endif
+ extern long long atoll(const char *nptr);
+ #endif	/* __hpux || _AIX || __FreeBSD__ < 5 */
+--- libcommon/blank.h
++++ libcommon/blank.h
+@@ -5,7 +5,7 @@
+  */
+ /*	Sccsid @(#)blank.h	1.3 (gritter) 5/1/04	*/
+ 
+-#ifndef	__dietlibc__
++#if !defined(__dietlibc__) && !defined(__TINYC__)
+ #ifndef	LIBCOMMON_BLANK_H
+ #define	LIBCOMMON_BLANK_H	1
+ 
+--- libcommon/getdir.c
++++ libcommon/getdir.c
+@@ -52,7 +52,7 @@ extern int	getdents(int, struct dirent *, size_t);
+ #undef	d_ino
+ #endif	/* __FreeBSD__ || __NetBSD__ || __OpenBSD__ || __DragonFly__
+ 	 || __APPLE__ */
+-#elif defined	(__dietlibc__)
++#elif defined	(__dietlibc__) || defined(__TINYC__)
+ #include	<dirent.h>
+ #include	<unistd.h>
+ #else		/* !__GLIBC__, !__dietlibc__ */
+--- libcommon/memalign.c
++++ libcommon/memalign.c
+@@ -23,7 +23,7 @@
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (_AIX) || \
+ 	defined (__NetBSD__) || defined (__OpenBSD__) || \
+-	defined (__DragonFly__) || defined (__APPLE__)
++	defined (__DragonFly__) || defined (__APPLE__) || defined(__TINYC__)
+ /*
+  * FreeBSD malloc(3) promises to page-align the return of malloc() calls
+  * if size is at least a page. This serves for a poor man's memalign() 
+--- libcommon/memalign.h
++++ libcommon/memalign.h
+@@ -26,7 +26,7 @@
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (_AIX) || \
+ 	defined (__NetBSD__) || defined (__OpenBSD__) || \
+-	defined (__DragonFly__) || defined (__APPLE__)
++	defined (__DragonFly__) || defined (__APPLE__) || defined(__TINYC__)
+ #include	<stdlib.h>
+ 
+ extern void	*memalign(size_t, size_t);
+--- libcommon/pathconf.c
++++ libcommon/pathconf.c
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)pathconf.c	1.2 (gritter) 5/1/04	*/
+ 
+-#ifdef	__dietlibc__
++#if defined(__dietlibc__) || defined(__TINYC__)
+ #include <unistd.h>
+ #include "pathconf.h"
+ 
+--- libcommon/pathconf.h
++++ libcommon/pathconf.h
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)pathconf.h	1.2 (gritter) 5/1/04	*/
+ 
+-#ifdef	__dietlibc__
++#if defined(__dietlibc__) || defined(__TINYC__)
+ #include <unistd.h>
+ 
+ extern long	fpathconf(int, int);
+--- libcommon/regexp.h
++++ libcommon/regexp.h
+@@ -47,7 +47,7 @@
+ static const char regexp_h_sccsid[] REGEXP_H_USED =
+ 	"@(#)regexp.sl	1.56 (gritter) 5/29/05";
+ 
+-#if !defined (REGEXP_H_USED_FROM_VI) && !defined (__dietlibc__)
++#if !defined (REGEXP_H_USED_FROM_VI) && !defined (__dietlibc__) && !defined (__TINYC__)
+ #define	REGEXP_H_WCHARS
+ #endif
+ 
+--- libcommon/sfile.c
++++ libcommon/sfile.c
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)sfile.c	1.9 (gritter) 6/7/04	*/
+ 
+-#ifdef	__linux__
++#if defined(__linux__) && !defined(__TINYC__)
+ #undef	_FILE_OFFSET_BITS
+ 
+ #include	<sys/types.h>
+--- libcommon/sighold.c
++++ libcommon/sighold.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sighold.c	1.7 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigignore.c
++++ libcommon/sigignore.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigignore.c	1.6 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigpause.c
++++ libcommon/sigpause.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigpause.c	1.6 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigrelse.c
++++ libcommon/sigrelse.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigrelse.c	1.8 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigset.c
++++ libcommon/sigset.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigset.c	1.7 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+@@ -46,10 +46,7 @@ void (*sigset(int sig, void (*func)(int)))(int)
+ 	if (sigaction(sig, func==SIG_HOLD?(struct sigaction *)0:&nact, &oact)
+ 			== -1)
+ 		return SIG_ERR;
+-	if (sigismember(&oset, sig))
+-		return SIG_HOLD;
+-	else
+-		return (oact.sa_handler);
++	return (oact.sa_handler);
+ }
+ #endif	/* __FreeBSD__ || __dietlibc__ || __NetBSD__ || __OpenBSD__ ||
+ 	__DragonFly__ || __APPLE__ */
+--- libcommon/sigset.h
++++ libcommon/sigset.h
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigset.h	1.9 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ 
+ #ifndef	SIG_HOLD
+ #define	SIG_HOLD	((void (*)(int))2)
+--- libcommon/strtol.c
++++ libcommon/strtol.c
+@@ -1,7 +1,7 @@
+ /*	Sccsid @(#)strtol.c	1.6 (gritter) 7/18/04	*/
+ 
+ #if defined (__hpux) || defined (_AIX) || \
+-	defined (__FreeBSD__) && (__FreeBSD__) < 5
++	(defined (__FreeBSD__) && (__FreeBSD__) < 5) || defined (__TINYC__)
+ 
+ #include	<stdlib.h>
+ #include	<ctype.h>
+@@ -97,6 +97,7 @@ out:	if (pp <= bptr) {
+ 	return v * sign;
+ }
+ 
++#ifndef __TINYC__
+ long long
+ strtoll(const char *nptr, char **endptr, int base)
+ {
+@@ -108,6 +109,7 @@ strtoull(const char *nptr, char **endptr, int base)
+ {
+ 	return (unsigned long long)internal(nptr, endptr, base, 3);
+ }
++#endif
+ 
+ long long
+ atoll(const char *nptr)
+--- nawk/awk.h
++++ nawk/awk.h
+@@ -156,7 +156,6 @@ extern Cell	*rlengthloc;	/* RLENGTH */
+ #endif
+ 
+ #ifndef	IN_MAKETAB
+-#include <wchar.h>
+ 
+ /*
+  * Get next character from string s and store it in wc; n is set to
+--- nawk/awk.lx.l
++++ nawk/awk.lx.l
+@@ -71,7 +71,6 @@
+ 
+ #include	"awk.h"
+ #include	"y.tab.h"
+-#include	<pfmt.h>
+ #include	<unistd.h>
+ 
+ static void	awk_unputstr(const char *s);
+--- nawk/run.c
++++ nawk/run.c
+@@ -1467,14 +1467,6 @@ Cell *bltin(Node **a, int n)
+ 	case FRAND:
+ 		u = (Awkfloat) (rand() % 32767) / 32767.0;
+ 		break;
+-	case FSRAND:
+-		u = saved_srand; /* return previous seed */
+-		if (x->tval & REC)	/* no argument provided */
+-			saved_srand = time(NULL);
+-		else
+-			saved_srand = getfval(x);
+-		srand((int) saved_srand);
+-		break;
+ 	case FTOUPPER:
+ 	case FTOLOWER:
+ 		p = getsval(x);
+--- pgrep/pgrep.c
++++ pgrep/pgrep.c
+@@ -214,7 +214,7 @@ chdir_to_proc(void)
+ 		fprintf(stderr, "%s: cannot open %s\n", progname, PROCDIR);
+ 		exit(3);
+ 	}
+-	if (fchdir(fd) < 0) {
++	if (chdir(PROCDIR) < 0) {
+ 		fprintf(stderr, "%s: cannot chdir to %s\n", progname, PROCDIR);
+ 		exit(3);
+ 	}
+--- rm/rm.c
++++ rm/rm.c
+@@ -242,7 +242,7 @@ rm(size_t pend, const char *base, const int olddir, int ssub, int level)
+ 				}
+ 				return;
+ 			}
+-			if (fchdir(df) < 0) {
++			if (chdir(base) < 0) {
+ 				if (rmfile(base, &st) < 0) {
+ 					fprintf(stderr,
+ 						"%s: cannot chdir to %s\n",
+@@ -270,7 +270,7 @@ rm(size_t pend, const char *base, const int olddir, int ssub, int level)
+ 					progname, path);
+ 				errcnt |= 4;
+ 			}
+-			if (olddir >= 0 && fchdir(olddir) < 0) {
++			if (olddir >= 0) {
+ 				fprintf(stderr, "%s: cannot change backwards\n",
+ 						progname);
+ 				exit(1);
+@@ -316,24 +316,6 @@ subproc(size_t pend, const char *base, int level)
+ 		int status;
+ 
+ 		while (waitpid(pid, &status, 0) != pid);
+-		if (status && WIFSIGNALED(status)) {
+-			/*
+-			 * If the signal was sent due to a tty keypress,
+-			 * we should be terminated automatically and
+-			 * never reach this point. Otherwise, we terminate
+-			 * with the same signal, but make sure that we do
+-			 * not overwrite a possibly generated core file.
+-			 * This results in nearly the usual behavior except
+-			 * that the shell never prints a 'core dumped'
+-			 * message.
+-			 */
+-			struct rlimit	rl;
+-
+-			rl.rlim_cur = rl.rlim_max = 0;
+-			setrlimit(RLIMIT_CORE, &rl);
+-			raise(WTERMSIG(status));
+-			pause();
+-		}
+ 		return status ? WEXITSTATUS(status) : 0;
+ 	}
+ 	case -1:
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h
new file mode 100644
index 000000000000..b4a314056074
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h
@@ -0,0 +1,53 @@
+/*
+  Copyright © 2005-2019 Rich Felker, et al.
+
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so, subject to
+  the following conditions:
+
+  The above copyright notice and this permission notice shall be
+  included in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+// Additional utilities from musl 1.1.24
+
+// include/stdlib.h
+#define WEXITSTATUS(s) (((s) & 0xff00) >> 8)
+#define WTERMSIG(s) ((s) & 0x7f)
+#define WIFEXITED(s) (!WTERMSIG(s))
+#define WIFSIGNALED(s) (((s)&0xffff)-1U < 0xffu)
+
+// include/sys/sysmacros.h
+#define major(x) \
+	((unsigned)( (((x)>>31>>1) & 0xfffff000) | (((x)>>8) & 0x00000fff) ))
+#define minor(x) \
+	((unsigned)( (((x)>>12) & 0xffffff00) | ((x) & 0x000000ff) ))
+#define makedev(x,y) ( \
+        (((x)&0xfffff000ULL) << 32) | \
+	(((x)&0x00000fffULL) << 8) | \
+        (((y)&0xffffff00ULL) << 12) | \
+	(((y)&0x000000ffULL)) )
+
+// src/misc/basename.c
+#include <string.h>
+char *basename(char *s)
+{
+	size_t i;
+	if (!s || !*s) return ".";
+	i = strlen(s)-1;
+	for (; i&&s[i]=='/'; i--) s[i] = 0;
+	for (; i&&s[i-1]!='/'; i--);
+	return s+i;
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c
new file mode 100644
index 000000000000..7a498a33f369
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c
@@ -0,0 +1,205 @@
+#include <stdio.h>
+#include "awk.h"
+#include "y.tab.h"
+
+static unsigned char *printname[92] = {
+	(unsigned char *) "FIRSTTOKEN",	/* 258 */
+	(unsigned char *) "PROGRAM",	/* 259 */
+	(unsigned char *) "PASTAT",	/* 260 */
+	(unsigned char *) "PASTAT2",	/* 261 */
+	(unsigned char *) "XBEGIN",	/* 262 */
+	(unsigned char *) "XEND",	/* 263 */
+	(unsigned char *) "NL",	/* 264 */
+	(unsigned char *) "ARRAY",	/* 265 */
+	(unsigned char *) "MATCH",	/* 266 */
+	(unsigned char *) "NOTMATCH",	/* 267 */
+	(unsigned char *) "MATCHOP",	/* 268 */
+	(unsigned char *) "FINAL",	/* 269 */
+	(unsigned char *) "DOT",	/* 270 */
+	(unsigned char *) "ALL",	/* 271 */
+	(unsigned char *) "CCL",	/* 272 */
+	(unsigned char *) "NCCL",	/* 273 */
+	(unsigned char *) "CHAR",	/* 274 */
+	(unsigned char *) "MCHAR",	/* 275 */
+	(unsigned char *) "OR",	/* 276 */
+	(unsigned char *) "STAR",	/* 277 */
+	(unsigned char *) "QUEST",	/* 278 */
+	(unsigned char *) "PLUS",	/* 279 */
+	(unsigned char *) "AND",	/* 280 */
+	(unsigned char *) "BOR",	/* 281 */
+	(unsigned char *) "APPEND",	/* 282 */
+	(unsigned char *) "EQ",	/* 283 */
+	(unsigned char *) "GE",	/* 284 */
+	(unsigned char *) "GT",	/* 285 */
+	(unsigned char *) "LE",	/* 286 */
+	(unsigned char *) "LT",	/* 287 */
+	(unsigned char *) "NE",	/* 288 */
+	(unsigned char *) "IN",	/* 289 */
+	(unsigned char *) "ARG",	/* 290 */
+	(unsigned char *) "BLTIN",	/* 291 */
+	(unsigned char *) "BREAK",	/* 292 */
+	(unsigned char *) "CONTINUE",	/* 293 */
+	(unsigned char *) "DELETE",	/* 294 */
+	(unsigned char *) "DO",	/* 295 */
+	(unsigned char *) "EXIT",	/* 296 */
+	(unsigned char *) "FOR",	/* 297 */
+	(unsigned char *) "FUNC",	/* 298 */
+	(unsigned char *) "SUB",	/* 299 */
+	(unsigned char *) "GSUB",	/* 300 */
+	(unsigned char *) "IF",	/* 301 */
+	(unsigned char *) "INDEX",	/* 302 */
+	(unsigned char *) "LSUBSTR",	/* 303 */
+	(unsigned char *) "MATCHFCN",	/* 304 */
+	(unsigned char *) "NEXT",	/* 305 */
+	(unsigned char *) "ADD",	/* 306 */
+	(unsigned char *) "MINUS",	/* 307 */
+	(unsigned char *) "MULT",	/* 308 */
+	(unsigned char *) "DIVIDE",	/* 309 */
+	(unsigned char *) "MOD",	/* 310 */
+	(unsigned char *) "ASSIGN",	/* 311 */
+	(unsigned char *) "ASGNOP",	/* 312 */
+	(unsigned char *) "ADDEQ",	/* 313 */
+	(unsigned char *) "SUBEQ",	/* 314 */
+	(unsigned char *) "MULTEQ",	/* 315 */
+	(unsigned char *) "DIVEQ",	/* 316 */
+	(unsigned char *) "MODEQ",	/* 317 */
+	(unsigned char *) "POWEQ",	/* 318 */
+	(unsigned char *) "PRINT",	/* 319 */
+	(unsigned char *) "PRINTF",	/* 320 */
+	(unsigned char *) "SPRINTF",	/* 321 */
+	(unsigned char *) "ELSE",	/* 322 */
+	(unsigned char *) "INTEST",	/* 323 */
+	(unsigned char *) "CONDEXPR",	/* 324 */
+	(unsigned char *) "POSTINCR",	/* 325 */
+	(unsigned char *) "PREINCR",	/* 326 */
+	(unsigned char *) "POSTDECR",	/* 327 */
+	(unsigned char *) "PREDECR",	/* 328 */
+	(unsigned char *) "VAR",	/* 329 */
+	(unsigned char *) "IVAR",	/* 330 */
+	(unsigned char *) "VARNF",	/* 331 */
+	(unsigned char *) "CALL",	/* 332 */
+	(unsigned char *) "NUMBER",	/* 333 */
+	(unsigned char *) "STRING",	/* 334 */
+	(unsigned char *) "FIELD",	/* 335 */
+	(unsigned char *) "REGEXPR",	/* 336 */
+	(unsigned char *) "GETLINE",	/* 337 */
+	(unsigned char *) "RETURN",	/* 338 */
+	(unsigned char *) "SPLIT",	/* 339 */
+	(unsigned char *) "SUBSTR",	/* 340 */
+	(unsigned char *) "WHILE",	/* 341 */
+	(unsigned char *) "CAT",	/* 342 */
+	(unsigned char *) "NOT",	/* 343 */
+	(unsigned char *) "UMINUS",	/* 344 */
+	(unsigned char *) "POWER",	/* 345 */
+	(unsigned char *) "DECR",	/* 346 */
+	(unsigned char *) "INCR",	/* 347 */
+	(unsigned char *) "INDIRECT",	/* 348 */
+	(unsigned char *) "LASTTOKEN",	/* 349 */
+};
+
+
+Cell *(*proctab[92])(Node **, int) = {
+	nullproc,	/* FIRSTTOKEN */
+	program,	/* PROGRAM */
+	pastat,	/* PASTAT */
+	dopa2,	/* PASTAT2 */
+	nullproc,	/* XBEGIN */
+	nullproc,	/* XEND */
+	nullproc,	/* NL */
+	array,	/* ARRAY */
+	matchop,	/* MATCH */
+	matchop,	/* NOTMATCH */
+	nullproc,	/* MATCHOP */
+	nullproc,	/* FINAL */
+	nullproc,	/* DOT */
+	nullproc,	/* ALL */
+	nullproc,	/* CCL */
+	nullproc,	/* NCCL */
+	nullproc,	/* CHAR */
+	nullproc,	/* MCHAR */
+	nullproc,	/* OR */
+	nullproc,	/* STAR */
+	nullproc,	/* QUEST */
+	nullproc,	/* PLUS */
+	boolop,	/* AND */
+	boolop,	/* BOR */
+	nullproc,	/* APPEND */
+	relop,	/* EQ */
+	relop,	/* GE */
+	relop,	/* GT */
+	relop,	/* LE */
+	relop,	/* LT */
+	relop,	/* NE */
+	instat,	/* IN */
+	arg,	/* ARG */
+	bltin,	/* BLTIN */
+	jump,	/* BREAK */
+	jump,	/* CONTINUE */
+	delete,	/* DELETE */
+	dostat,	/* DO */
+	jump,	/* EXIT */
+	forstat,	/* FOR */
+	nullproc,	/* FUNC */
+	sub,	/* SUB */
+	gsub,	/* GSUB */
+	ifstat,	/* IF */
+	sindex,	/* INDEX */
+	nullproc,	/* LSUBSTR */
+	matchop,	/* MATCHFCN */
+	jump,	/* NEXT */
+	arith,	/* ADD */
+	arith,	/* MINUS */
+	arith,	/* MULT */
+	arith,	/* DIVIDE */
+	arith,	/* MOD */
+	assign,	/* ASSIGN */
+	nullproc,	/* ASGNOP */
+	assign,	/* ADDEQ */
+	assign,	/* SUBEQ */
+	assign,	/* MULTEQ */
+	assign,	/* DIVEQ */
+	assign,	/* MODEQ */
+	assign,	/* POWEQ */
+	print,	/* PRINT */
+	aprintf,	/* PRINTF */
+	awsprintf,	/* SPRINTF */
+	nullproc,	/* ELSE */
+	intest,	/* INTEST */
+	condexpr,	/* CONDEXPR */
+	incrdecr,	/* POSTINCR */
+	incrdecr,	/* PREINCR */
+	incrdecr,	/* POSTDECR */
+	incrdecr,	/* PREDECR */
+	nullproc,	/* VAR */
+	nullproc,	/* IVAR */
+	getnf,	/* VARNF */
+	call,	/* CALL */
+	nullproc,	/* NUMBER */
+	nullproc,	/* STRING */
+	nullproc,	/* FIELD */
+	nullproc,	/* REGEXPR */
+	getline,	/* GETLINE */
+	jump,	/* RETURN */
+	split,	/* SPLIT */
+	substr,	/* SUBSTR */
+	whilestat,	/* WHILE */
+	cat,	/* CAT */
+	boolop,	/* NOT */
+	arith,	/* UMINUS */
+	arith,	/* POWER */
+	nullproc,	/* DECR */
+	nullproc,	/* INCR */
+	indirect,	/* INDIRECT */
+	nullproc,	/* LASTTOKEN */
+};
+
+unsigned char *tokname(int n)
+{
+	static unsigned char buf[100];
+
+	if (n < FIRSTTOKEN || n > LASTTOKEN) {
+		snprintf((char *)buf, sizeof buf, "token %d", n);
+		return buf;
+	}
+	return printname[n-257];
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch
new file mode 100644
index 000000000000..30913c9022b7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch
@@ -0,0 +1,11 @@
+--- nawk/Makefile.mk
++++ nawk/Makefile.mk
+@@ -28,8 +28,6 @@ maketab: maketab.o
+ 	$(HOSTCC) maketab.o -o maketab
+ 	./maketab > proctab.c
+ 
+-proctab.c: maketab
+-
+ awk.g.o: awk.g.c
+ 	$(CC) $(CFLAGSS) $(CPPFLAGS) $(XO5FL) $(LARGEF) $(IWCHAR) $(ICOMMON) $(IUXRE) -c awk.g.c
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch
new file mode 100644
index 000000000000..20ed5c5c352e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch
@@ -0,0 +1,73 @@
+--- comm/comm.c
++++ comm/comm.c
+@@ -242,7 +242,7 @@ compare(const char *a, const char *b)
+ 			return(2);
+ 		}
+ 	} else {
+-		n = strcoll(a, b);
++		n = strcmp(a, b);
+ 		return n ? n > 0 ? 2 : 1 : 0;
+ 	}
+ }
+--- expr/expr.y
++++ expr/expr.y
+@@ -234,7 +234,7 @@ _rel(int op, register char *r1, register char *r2)
+ 	if (numeric(r1) && numeric(r2))
+ 		i = atoll(r1) - atoll(r2);
+ 	else
+-		i = strcoll(r1, r2);
++		i = strcmp(r1, r2);
+ 	switch(op) {
+ 	case EQ: i = i==0; break;
+ 	case GT: i = i>0; break;
+--- join/join.c
++++ join/join.c
+@@ -65,7 +65,7 @@ enum {
+ 	JF = -1
+ };
+ #define	ppi(f, j)	((j) >= 0 && (j) < ppisize[f] ? ppibuf[f][j] : null)
+-#define comp() strcoll(ppi(F1, j1),ppi(F2, j2))
++#define comp() strcmp(ppi(F1, j1),ppi(F2, j2))
+ 
+ #define	next(wc, s, n)	(*(s) & 0200 ? ((n) = mbtowi(&(wc), (s), mb_cur_max), \
+ 		(n) = ((n) > 0 ? (n) : (n) < 0 ? (wc=WEOF, 1) : 1)) : \
+--- ls/ls.c
++++ ls/ls.c
+@@ -575,13 +575,13 @@ _mergesort(struct file **al)
+ static int
+ namecmp(struct file *f1, struct file *f2)
+ {
+-	return strcoll(f1->name, f2->name);
++	return strcmp(f1->name, f2->name);
+ }
+ 
+ static int
+ extcmp(struct file *f1, struct file *f2)
+ {
+-	return strcoll(extension(f1->name), extension(f2->name));
++	return strcmp(extension(f1->name), extension(f2->name));
+ }
+ 
+ static int
+--- nawk/run.c
++++ nawk/run.c
+@@ -608,7 +608,7 @@ Cell *relop(Node **a, int n)
+ 		j = x->fval - y->fval;
+ 		i = j<0? -1: (j>0? 1: 0);
+ 	} else {
+-		i = strcoll((char*)getsval(x), (char*)getsval(y));
++		i = strcmp((char*)getsval(x), (char*)getsval(y));
+ 	}
+ 	tempfree(x, "");
+ 	tempfree(y, "");
+--- sort/sort.c
++++ sort/sort.c
+@@ -1148,7 +1148,7 @@ cmpl(const char *pa, const char *pb)
+ 
+ 	ecpy(collba, pa, '\n');
+ 	ecpy(collbb, pb, '\n');
+-	n = strcoll(collba, collbb);
++	n = strcmp(collba, collbb);
+ 	return n ? n > 0 ? -fields[0].rflg : fields[0].rflg : 0;
+ }
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h
new file mode 100644
index 000000000000..5aef8168180b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h
@@ -0,0 +1,64 @@
+#include <getopt.h>
+extern int optopt;
+
+int ftruncate(int fd, int offset) {
+  return -1;
+}
+
+int getsid (int pid) {
+  return -1;
+}
+
+static int isblank(int c)
+{
+	return c == ' ' || c == '\t';
+}
+
+#define lchown chown
+
+// meslibc implements lstat but is missing declaration
+#include <sys/stat.h>
+int lstat (char const *file_name, struct stat *statbuf);
+
+#include <fcntl.h>
+int mkstemp(char *t)
+{
+  mktemp(t);
+  int fd = open(t, O_CREAT|O_RDWR|O_TRUNC, 0600);
+  return fd;
+}
+
+int putenv(char *string)
+{
+  return 0;
+}
+
+char* realpath (char* path, char* resolved) {
+  return NULL;
+}
+
+#define strncasecmp(a,b,n) strncmp(strupr(a),strupr(b),n)
+
+
+#define nlink_t unsigned long
+
+#include <limits.h>
+#define USHRT_MAX UINT16_MAX
+#define SSIZE_MAX LONG_MAX
+#define MB_LEN_MAX 1 
+
+#define EPERM 1
+#define ESRCH 3
+#define EDOM 33
+#define S_IFSOCK 0140000
+#define S_ISVTX 01000
+#define S_IREAD S_IRUSR
+#define S_IWRITE S_IWUSR
+#define S_IEXEC S_IXUSR
+
+#define _PC_PATH_MAX PATH_MAX
+#define _PC_VDISABLE 8
+#define _POSIX_PATH_MAX PATH_MAX
+#define LINE_MAX 4096
+
+#define LC_TIME 0
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch
new file mode 100644
index 000000000000..3d1b3e152ee1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch
@@ -0,0 +1,77 @@
+--- cmp/cmp.c
++++ cmp/cmp.c
+@@ -264,7 +264,7 @@ openfile(const char *fn)
+ 	struct file	*f;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if ((f = memalign(pagesize, sizeof *f)) == NULL) {
+ 		write(2, "no memory\n", 10);
+--- copy/copy.c
++++ copy/copy.c
+@@ -362,7 +362,7 @@ fdcopy(const char *src, const struct stat *sp, int sfd,
+ 			goto err;
+ 	}
+ #endif	/* __linux__ */
+-	if (pagesize == 0 && (pagesize = sysconf(_SC_PAGESIZE)) <= 0)
++	if (pagesize == 0 && (pagesize = 4096) <= 0)
+ 		pagesize = 4096;
+ 	if ((blksize = sp->st_blksize) <= 0)
+ 		blksize = 512;
+--- cp/cp.c
++++ cp/cp.c
+@@ -438,7 +438,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ 	}
+ #endif	/* __linux__ */
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if (bflag)
+ 		blksize = bflag;
+--- libcommon/ib_alloc.c
++++ libcommon/ib_alloc.c
+@@ -41,7 +41,7 @@ ib_alloc(int fd, unsigned blksize)
+ 	struct stat	st;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if (blksize == 0) {
+ 		if (fstat(fd, &st) < 0)
+--- libcommon/memalign.c
++++ libcommon/memalign.c
+@@ -40,7 +40,7 @@ memalign(size_t alignment, size_t size)
+ 	static long	pagesize;
+ 
+ 	if (pagesize == 0)
+-		pagesize = sysconf(_SC_PAGESIZE);
++		pagesize = 4096;
+ 	if (alignment != pagesize)
+ 		return NULL;
+ 	if (size < pagesize)
+--- libcommon/oblok.c
++++ libcommon/oblok.c
+@@ -100,7 +100,7 @@ ob_alloc(int fd, enum ob_mode bf)
+ 	struct oblok	*op;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if ((op = memalign(pagesize, sizeof *op)) == NULL)
+ 		return NULL;
+--- xargs/xargs.c
++++ xargs/xargs.c
+@@ -404,7 +404,7 @@ static void
+ endcmd(void)
+ {
+ 	a_agg = a_cnt;
+-	a_maxsize = sysconf(_SC_ARG_MAX) - envsz() - 2048 - a_asz;
++	a_maxsize = 65536 - envsz() - 2048 - a_asz;
+ 	if (nflag || sflag) {
+ 		long	newsize = sflag ? atol(sflag) :
+ #ifdef	WEIRD_LIMITS
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch
new file mode 100644
index 000000000000..7c57a54b93b3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch
@@ -0,0 +1,11 @@
+--- libwchar/Makefile.mk
++++ libwchar/Makefile.mk
+@@ -10,7 +10,7 @@ fake:
+ 	if test "x$(LWCHAR)" = x; \
+ 	then \
+ 		touch $(OBJ); \
+-		ar r libwchar.a $(OBJ); \
++		touch libwchar.a $(OBJ); \
+ 	fi
+ 
+ install:
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch
new file mode 100644
index 000000000000..ea40a8d7a040
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch
@@ -0,0 +1,141 @@
+--- ed/ed.c
++++ ed/ed.c
+@@ -68,7 +68,6 @@ static const char sccsid[] USED = "@(#)ed.sl	1.99 (gritter) 7/27/06";
+ #include <stdlib.h>
+ #include <signal.h>
+ #include "sigset.h"
+-#include <termios.h>
+ #include <setjmp.h>
+ #include <libgen.h>
+ #include <inttypes.h>
+@@ -77,7 +76,6 @@ static const char sccsid[] USED = "@(#)ed.sl	1.99 (gritter) 7/27/06";
+ #include <ctype.h>
+ #include <wctype.h>
+ #include <limits.h>
+-#include <termios.h>
+ static int	FNSIZE;
+ static int	LBSIZE;
+ static int	RHSIZE;
+@@ -2273,22 +2271,10 @@ sclose(int fd)
+ static void
+ fspec(const char *lp)
+ {
+-	struct termios	ts;
+ 	const char	*cp;
+ 
+ 	freetabs();
+ 	maxlength = 0;
+-	if (tcgetattr(1, &ts) < 0
+-#ifdef	TAB3
+-			|| (ts.c_oflag&TAB3) == 0
+-#endif
+-			)
+-		return;
+-	while (lp[0]) {
+-		if (lp[0] == '<' && lp[1] == ':')
+-			break;
+-		lp++;
+-	}
+ 	if (lp[0]) {
+ 		lp += 2;
+ 		while ((cp = ftok(&lp)) != NULL) {
+--- ls/ls.c
++++ ls/ls.c
+@@ -102,7 +102,6 @@ static char ifmt_c[] = "-pc-d-b--nl-SD--";
+ #include <grp.h>
+ #include <errno.h>
+ #include <fcntl.h>
+-#include <termios.h>
+ #include <locale.h>
+ #include <limits.h>
+ #include <ctype.h>
+@@ -110,14 +109,6 @@ static char ifmt_c[] = "-pc-d-b--nl-SD--";
+ #include <wchar.h>
+ #include <wctype.h>
+ #include "config.h"
+-#ifndef	USE_TERMCAP
+-#ifndef	sun
+-#include <curses.h>
+-#include <term.h>
+-#endif
+-#else	/* USE_TERMCAP */
+-#include <termcap.h>
+-#endif	/* USE_TERMCAP */
+ 
+ #ifdef	_AIX
+ #include <sys/sysmacros.h>
+@@ -989,13 +980,6 @@ printname(const char *name, struct file *f, int doit)
+ 			bold++;
+ 		}
+ 		if (color) {
+-#ifndef	USE_TERMCAP
+-			if (bold)
+-				vidattr(A_BOLD);
+-#else	/* USE_TERMCAP */
+-			if (Bold)
+-				tputs(Bold, 1, putchar);
+-#endif	/* USE_TERMCAP */
+ 			printf(color);
+ 		}
+ 	}
+@@ -1056,13 +1040,6 @@ printname(const char *name, struct file *f, int doit)
+ 		}
+ 	}
+ 	if (doit && color) {
+-#if !defined (USE_TERMCAP)
+-		if (bold)
+-			vidattr(A_NORMAL);
+-#else	/* USE_TERMCAP */
+-		if (Normal)
+-			tputs(Normal, 1, putchar);
+-#endif	/* USE_TERMCAP */
+ 		printf(fc_get(FC_NORMAL));
+ 	}
+ 	if (f)
+@@ -1598,16 +1575,12 @@ main(int argc, char **argv)
+ {
+ 	struct file *flist = nil, **aflist = &flist;
+ 	enum depth depth;
+-	struct winsize ws;
+ 	int i;
+ 	char *cp;
+ 
+ #ifdef	__GLIBC__
+ 	putenv("POSIXLY_CORRECT=1");
+ #endif
+-	setlocale(LC_COLLATE, "");
+-	setlocale(LC_CTYPE, "");
+-	setlocale(LC_TIME, "");
+ #ifndef	UCB
+ 	if (getenv("SYSV3") != NULL)
+ 		sysv3 = 1;
+@@ -1624,16 +1597,6 @@ main(int argc, char **argv)
+ 	}
+ 	if (istty || isatty(1)) {
+ 		istty = 1;
+-#if !defined (USE_TERMCAP)
+-		setupterm(NULL, 1, &tinfostat);
+-#else	/* USE_TERMCAP */
+-		{
+-			char	buf[2048];
+-			if ((cp = getenv("TERM")) != NULL)
+-				if (tgetent(buf, cp) > 0)
+-					tinfostat = 1;
+-		}
+-#endif	/* USE_TERMCAP */
+ 		field |= FL_STATUS;
+ 	}
+ 	while ((i = getopt(argc, argv, personalities[personality].per_opt))
+@@ -1753,12 +1716,6 @@ main(int argc, char **argv)
+ 	if ((cp = getenv("COLUMNS")) != NULL) {
+ 		ncols = atoi(cp);
+ 	} else if ((present('C') || present('x') || present('m')) && istty) {
+-		if (ioctl(1, TIOCGWINSZ, &ws) == 0 && ws.ws_col > 0)
+-			ncols = ws.ws_col - 1;
+-#if !defined (USE_TERMCAP)
+-		else if (tinfostat == 1 && columns > 0)
+-			ncols = columns;
+-#endif	/* !USE_TERMCAP */
+ 	}
+ 	depth = SURFACE;
+ 	if (optind == argc) {
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch
new file mode 100644
index 000000000000..081ac9d2ee3c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch
@@ -0,0 +1,90 @@
+--- copy/copy.c
++++ copy/copy.c
+@@ -46,7 +46,6 @@ static const char sccsid[] USED = "@(#)copy.sl	1.15 (gritter) 5/29/05";
+ #include <libgen.h>
+ #include <limits.h>
+ #include <dirent.h>
+-#include <utime.h>
+ #include <stdarg.h>
+ #include "sfile.h"
+ #include "memalign.h"
+@@ -441,12 +440,6 @@ attribs(const char *dst, const struct stat *sp)
+ 	if (oflag && ((sp->st_mode&S_IFMT) == S_IFLNK ?
+ 			lchown:chown)(dst, sp->st_uid, sp->st_gid) < 0)
+ 		complain("Unable to chown %s", dst);
+-	if (mflag && (sp->st_mode&S_IFMT) != S_IFLNK) {
+-		struct utimbuf	ut;
+-		ut.actime = sp->st_atime;
+-		ut.modtime = sp->st_mtime;
+-		utime(dst, &ut);
+-	}
+ }
+ 
+ static void
+--- cp/cp.c
++++ cp/cp.c
+@@ -56,7 +56,6 @@ static const char sccsid[] USED = "@(#)cp.sl	1.84 (gritter) 3/4/06";
+ #include	<libgen.h>
+ #include	<limits.h>
+ #include	<dirent.h>
+-#include	<utime.h>
+ #include	"sfile.h"
+ #include	"memalign.h"
+ #include	"alloca.h"
+@@ -354,18 +353,6 @@ permissions(const char *path, const struct stat *ssp)
+ 
+ 	mode = ssp->st_mode & 07777;
+ 	if (pflag) {
+-		struct utimbuf ut;
+-		ut.actime = ssp->st_atime;
+-		ut.modtime = ssp->st_mtime;
+-		if (utime(path, &ut) < 0) {
+-#if defined (SUS) || defined (S42)
+-			fprintf(stderr, "%s: cannot set times for %s\n%s: %s\n",
+-					progname, path,
+-					progname, strerror(errno));
+-#endif /* SUS || S42 */
+-			if (pers != PERS_MV)
+-				errcnt |= 010;
+-		}
+ 		if (myuid == 0) {
+ 			if (chown(path, ssp->st_uid, ssp->st_gid) < 0) {
+ #if defined (SUS) || defined (S42)
+--- touch/touch.c
++++ touch/touch.c
+@@ -47,7 +47,6 @@ static const char sccsid[] USED = "@(#)touch.sl	1.21 (gritter) 5/29/05";
+ #include	<stdlib.h>
+ #include	<errno.h>
+ #include	<libgen.h>
+-#include	<utime.h>
+ #include	<ctype.h>
+ #include	<time.h>
+ 
+@@ -80,7 +79,6 @@ static void
+ touch(const char *fn)
+ {
+ 	struct stat st;
+-	struct utimbuf ut;
+ 
+ 	if (stat(fn, &st) < 0) {
+ 		if (errno == ENOENT) {
+@@ -113,19 +111,6 @@ touch(const char *fn)
+ 			return;
+ 		}
+ 	}
+-	if (aflag)
+-		ut.actime = nacc;
+-	else
+-		ut.actime = st.st_atime;
+-	if (mflag)
+-		ut.modtime = nmod;
+-	else
+-		ut.modtime = st.st_mtime;
+-	if (utime(fn, nulltime ? NULL : &ut) < 0) {
+-		fprintf(stderr, "%s: cannot change times on %s\n",
+-				progname, fn);
+-		errcnt++;
+-	}
+ }
+ 
+ static void
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch
new file mode 100644
index 000000000000..6abce89b2f31
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch
@@ -0,0 +1,128 @@
+--- cksum/cksum.c
++++ cksum/cksum.c
+@@ -147,7 +147,7 @@ cksum(const char *name)
+ 		s = (s << 8) ^ crctab[(s >> 24) ^ c];
+ 	}
+ 	s = ~s;
+-	printf("%u %llu", (unsigned)s, nbytes);
++	printf("%u %lu", (unsigned)s, nbytes);
+ 	if(name)
+ 		printf(" %s", name);
+ 	printf("\n");
+--- cmp/cmp.c
++++ cmp/cmp.c
+@@ -246,8 +246,8 @@ different:
+ 				errcnt = 1;
+ 			} else {
+ 				if (sflag == 0)
+-					printf("%s %s differ: char %lld,"
+-							" line %lld\n",
++					printf("%s %s differ: char %ld,"
++							" line %ld\n",
+ 						f1->f_nam, f2->f_nam,
+ 						(long long)offset(f1),
+ 						line);
+--- csplit/csplit.c
++++ csplit/csplit.c
+@@ -284,7 +284,7 @@ csplit(const char *fn)
+ 				op = nextfile();
+ 			if (op) {
+ 				if (!sflag)
+-					printf("%lld\n", bytes);
++					printf("%ld\n", bytes);
+ 				bytes = 0;
+ 				fclose(op);
+ 			}
+--- expr/expr.y
++++ expr/expr.y
+@@ -140,7 +140,7 @@ expression:	expr NOARG {
+ 			if (sus && numeric($1)) {
+ 				int64_t	n;
+ 				n = atoll($1);
+-				printf("%lld\n", n);
++				printf("%ld\n", n);
+ 				exit(n == 0);
+ 			} else
+ 				puts($1);
+@@ -447,10 +447,10 @@ numpr(int64_t val)
+ 	int	ret;
+ 
+ 	rv = smalloc(NUMSZ);
+-	ret = snprintf(rv, NUMSZ, "%lld", (long long)val);
++	ret = snprintf(rv, NUMSZ, "%ld", (long long)val);
+ 	if (ret < 0 || ret >= NUMSZ) {
+ 		rv = srealloc(rv, ret + 1);
+-		ret = snprintf(rv, ret, "%lld", (long long)val);
++		ret = snprintf(rv, ret, "%ld", (long long)val);
+ 		if (ret < 0)
+ 			yyerror("illegal number");
+ 	}
+--- grep/Makefile.mk
++++ grep/Makefile.mk
+@@ -92,7 +92,7 @@ config.h:
+ 	-echo 'long long foo;' >___build$$$$.c ; \
+ 	$(CC) $(CFLAGS2) $(CPPFLAGS) $(IWCHAR) $(ICOMMON) $(IUXRE) $(LARGEF) -c ___build$$$$.c >/dev/null 2>&1 ; \
+ 	if test $$? = 0 && test -f ___build$$$$.o ; \
+-	then	echo '#define	LONGLONG' >>config.h ; \
++	then	echo '' >>config.h ; \
+ 	fi ; \
+ 	rm -f ___build$$$$.o ___build$$$$.c
+ 
+--- ls/Makefile.mk
++++ ls/Makefile.mk
+@@ -76,7 +76,7 @@ config.h:
+ 	-echo 'long long foo;' >___build$$$$.c ; \
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(LARGEF) $(IWCHAR) -c ___build$$$$.c >/dev/null 2>&1 ; \
+ 	if test $$? = 0 && test -f ___build$$$$.o ; \
+-	then	echo '#define	LONGLONG' >>config.h ; \
++	then	echo '' >>config.h ; \
+ 	fi ; \
+ 	rm -f ___build$$$$.o ___build$$$$.c
+ 	-echo '#include <sys/types.h>' >___build$$$$.c ; \
+--- pr/pr.c
++++ pr/pr.c
+@@ -548,7 +548,7 @@ print(const char *fp, const char **argp)
+ 			putcs("  ");
+ 			putcs(header);
+ 			snprintf(linebuf, sizeof linebuf,
+-					" Page %lld\n\n\n", page);
++					" Page %ld\n\n\n", page);
+ 			putcs(linebuf);
+ 		}
+ 		c = putpage();
+--- sed/sed1.c
++++ sed/sed1.c
+@@ -489,7 +489,7 @@ command(struct reptr *ipc)
+ 			break;
+ 
+ 		case EQCOM:
+-			fprintf(stdout, "%lld\n", lnum);
++			fprintf(stdout, "%ld\n", lnum);
+ 			break;
+ 
+ 		case GCOM:
+--- sum/sum.c
++++ sum/sum.c
+@@ -116,7 +116,7 @@ sum(const char *name)
+ 	else {
+ 		s = (s & 0xFFFF) + (s >> 16);
+ 		s = (s & 0xFFFF) + (s >> 16);
+-		printf("%u %llu", (unsigned)s,
++		printf("%u %lu", (unsigned)s,
+ 				(unsigned long long)(nbytes+UNIT-1)/UNIT);
+ 	}
+ 	if(name)
+--- wc/wc.c
++++ wc/wc.c
+@@ -89,9 +89,9 @@ report(unsigned long long count)
+ #if defined (S42)
+ 	if (putspace++)
+ 		printf(" ");
+-	printf("%llu", count);
++	printf("%lu", count);
+ #else	/* !S42 */
+-	printf("%7llu ", count);
++	printf("%7lu ", count);
+ #endif	/* !S42 */
+ }
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
new file mode 100644
index 000000000000..c24504ec00a0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, kaem
+, mes
+}:
+let
+  pname = "ln-boot";
+  version = "unstable-2023-05-22";
+
+  src = ./ln.c;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  meta = with lib; {
+    description = "Basic tool for creating symbolic links";
+    license = licenses.mit;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "ln";
+    platforms = platforms.unix;
+  };
+} ''
+  mkdir -p ''${out}/bin
+  ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+    -L ${mes.libs}/lib \
+    -lc+tcc \
+    -o ''${out}/bin/ln \
+    ${src}
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
new file mode 100644
index 000000000000..b7a681f8270c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int main(int argc, char** argv)
+{
+  if (argc != 4 || strcmp(argv[1], "-s")) {
+    fputs("Usage: ", stdout);
+    fputs(argv[0], stdout);
+    fputs(" -s TARGET LINK_NAME\n", stdout);
+    exit(EXIT_FAILURE);
+  }
+
+  symlink(argv[2], argv[3]);
+  exit(EXIT_SUCCESS);
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
new file mode 100644
index 000000000000..04ab2fdbfaf0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@@ -0,0 +1,238 @@
+{ lib
+, fetchurl
+, callPackage
+, kaem
+, m2libc
+, mescc-tools
+}:
+
+# Maintenance note:
+# Build steps have been adapted from build-aux/bootstrap.sh.in
+# as well as the live-bootstrap project
+# https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/mes-0.24.2/mes-0.24.2.kaem
+
+let
+  pname = "mes";
+  version = "0.24.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/mes/mes-${version}.tar.gz";
+    sha256 = "0vp8v88zszh1imm3dvdfi3m8cywshdj7xcrsq4cgmss69s2y1nkx";
+  };
+
+  nyacc = callPackage ./nyacc.nix { inherit nyacc; };
+
+  config_h = builtins.toFile "config.h" ''
+    #undef SYSTEM_LIBC
+    #define MES_VERSION "${version}"
+  '';
+
+  sources = (import ./sources.nix).x86.linux.mescc;
+  inherit (sources) libc_mini_SOURCES libmescc_SOURCES libc_SOURCES mes_SOURCES;
+
+  # add symlink() to libc+tcc so we can use it in ln-boot
+  libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+
+  meta = with lib; {
+    description = "Scheme interpreter and C compiler for bootstrapping";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  srcPost = kaem.runCommand "${pname}-src-${version}" {
+    outputs = [ "out" "bin" ];
+    inherit meta;
+  } ''
+    # Unpack source
+    ungz --file ${src} --output mes.tar
+    mkdir ''${out}
+    cd ''${out}
+    untar --non-strict --file ''${NIX_BUILD_TOP}/mes.tar # ignore symlinks
+
+    MES_PREFIX=''${out}/mes-${version}
+
+    cd ''${MES_PREFIX}
+
+    cp ${config_h} include/mes/config.h
+
+    mkdir include/arch
+    cp include/linux/x86/syscall.h include/arch/syscall.h
+    cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
+
+    # Remove pregenerated files
+    rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
+
+    # These files are symlinked in the repo
+    cp mes/module/srfi/srfi-9-struct.mes mes/module/srfi/srfi-9.mes
+    cp mes/module/srfi/srfi-9/gnu-struct.mes mes/module/srfi/srfi-9/gnu.mes
+
+    # Fixes to support newer M2-Planet
+    catm x86_defs.M1 ${m2libc}/x86/x86_defs.M1 lib/m2/x86/x86_defs.M1
+    cp x86_defs.M1 lib/m2/x86/x86_defs.M1
+    rm x86_defs.M1
+
+    # Remove environment impurities
+    __GUILE_LOAD_PATH="\"''${MES_PREFIX}/mes/module:''${MES_PREFIX}/module:${nyacc.guilePath}\""
+    boot0_scm=mes/module/mes/boot-0.scm
+    guile_mes=mes/module/mes/guile.mes
+    replace --file ''${boot0_scm} --output ''${boot0_scm} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+    replace --file ''${guile_mes} --output ''${guile_mes} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+
+    module_mescc_scm=module/mescc/mescc.scm
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"M1\")" --replace-with "\"${mescc-tools}/bin/M1\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"HEX2\")" --replace-with "\"${mescc-tools}/bin/hex2\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"BLOOD_ELF\")" --replace-with "\"${mescc-tools}/bin/blood-elf\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    mes_c=src/mes.c
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    # Increase runtime resource limits
+    gc_c=src/gc.c
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_MAX_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_STACK\")" --replace-with "\"6000000\""
+
+    # Create mescc.scm
+    mescc_in=scripts/mescc.scm.in
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"includedir\")" --replace-with "\"''${MES_PREFIX}/include\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
+    mkdir -p ''${bin}/bin
+    cp ''${mescc_in} ''${bin}/bin/mescc.scm
+
+    # Build mes-m2
+    mes_cpu=x86
+    stage0_cpu=x86
+    kaem --verbose --strict --file kaem.run
+    cp bin/mes-m2 ''${bin}/bin/mes-m2
+    chmod 555 ''${bin}/bin/mes-m2
+  '';
+
+  srcPrefix = "${srcPost.out}/mes-${version}";
+
+  cc = "${srcPost.bin}/bin/mes-m2";
+  ccArgs = [
+    "-e" "main"
+    "${srcPost.bin}/bin/mescc.scm"
+    "--"
+    "-D" "HAVE_CONFIG_H=1"
+    "-I" "${srcPrefix}/include"
+    "-I" "${srcPrefix}/include/linux/x86"
+  ];
+
+  CC = toString ([ cc ] ++ ccArgs);
+
+  stripExt = source:
+    lib.replaceStrings
+      [ ".c" ]
+      [ "" ]
+      (builtins.baseNameOf source);
+
+  compile = source: kaem.runCommand (stripExt source) {} ''
+    mkdir ''${out}
+    cd ''${out}
+    ${CC} -c ${srcPrefix}/${source}
+  '';
+
+  crt1 = compile "/lib/linux/x86-mes-mescc/crt1.c";
+
+  getRes = suffix: res: "${res}/${res.name}${suffix}";
+
+  archive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".o") sources}";
+  sourceArchive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".s") sources}";
+
+  mkLib = libname: sources: let
+    os = map compile sources;
+  in kaem.runCommand "${pname}-${libname}-${version}" {
+    inherit meta;
+  } ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${LIBDIR}
+    cd ''${LIBDIR}
+
+    ${archive "${libname}.a" os}
+    ${sourceArchive "${libname}.s" os}
+  '';
+
+  libc-mini = mkLib "libc-mini" libc_mini_SOURCES;
+  libmescc = mkLib "libmescc" libmescc_SOURCES;
+  libc = mkLib "libc" libc_SOURCES;
+  libc_tcc = mkLib "libc+tcc" libc_tcc_SOURCES;
+
+  # Recompile Mes and Mes C library using mes-m2 bootstrapped Mes
+  libs = kaem.runCommand "${pname}-m2-libs-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${out} ''${LIBDIR}
+
+    mkdir -p ''${LIBDIR}/x86-mes
+
+    # crt1.o
+    cp ${crt1}/crt1.o ''${LIBDIR}/x86-mes
+    cp ${crt1}/crt1.s ''${LIBDIR}/x86-mes
+
+    # libc-mini.a
+    cp ${libc-mini}/lib/libc-mini.a ''${LIBDIR}/x86-mes
+    cp ${libc-mini}/lib/libc-mini.s ''${LIBDIR}/x86-mes
+
+    # libmescc.a
+    cp ${libmescc}/lib/libmescc.a ''${LIBDIR}/x86-mes
+    cp ${libmescc}/lib/libmescc.s ''${LIBDIR}/x86-mes
+
+    # libc.a
+    cp ${libc}/lib/libc.a ''${LIBDIR}/x86-mes
+    cp ${libc}/lib/libc.s ''${LIBDIR}/x86-mes
+
+    # libc+tcc.a
+    cp ${libc_tcc}/lib/libc+tcc.a ''${LIBDIR}/x86-mes
+    cp ${libc_tcc}/lib/libc+tcc.s ''${LIBDIR}/x86-mes
+  '';
+
+  # Build mes itself
+  compiler = kaem.runCommand "${pname}-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    mkdir -p ''${out}/bin
+
+    ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+      --base-address 0x08048000 \
+      -L ''${srcPrefix}/lib \
+      -L ${libs}/lib \
+      -lc \
+      -lmescc \
+      -nostdlib \
+      -o ''${out}/bin/mes \
+      ${libs}/lib/x86-mes/crt1.o \
+      ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
+  '';
+in {
+  inherit srcPost srcPrefix nyacc;
+  inherit compiler libs;
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
new file mode 100755
index 000000000000..3a734129c1f7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash coreutils gnutar
+
+# Generate a sources.nix for a version of GNU mes. Creates lists of source files
+# from build-aux/configure-lib.sh.
+#
+# You may point this tool at a manually downloaded tarball, but more ideal is
+# using the source tarball from Nixpkgs. For example:
+#
+# MES_TARBALL="$(nix-build --no-link -A minimal-bootstrap.mes.src ../../../../..)"
+# ./gen-sources.sh "$MES_TARBALL" > ./new-sources.nix
+
+set -eu
+
+# Supported platforms
+ARCHS="x86"
+KERNELS="linux"
+COMPILERS="mescc gcc"
+
+
+format() {
+  echo -n "[ "
+  # Terrible hack to convert a newline-delimited string to space-delimited
+  echo $* | xargs printf '"%s" '
+  echo -n "]"
+}
+
+gen_sources() {
+  # Configuration variables used by configure-lib.sh
+  export mes_libc=mes
+  export mes_cpu=$1
+  export mes_kernel=$2
+  export compiler=$3
+
+  # Populate source file lists
+  source $CONFIGURE_LIB_SH
+
+  cat <<EOF
+  $mes_cpu.$mes_kernel.$compiler = {
+    libc_mini_SOURCES = $(format $libc_mini_SOURCES);
+    libmescc_SOURCES  = $(format $libmescc_SOURCES);
+    libtcc1_SOURCES   = $(format $libtcc1_SOURCES);
+    libc_SOURCES      = $(format $libc_SOURCES);
+    libc_tcc_SOURCES  = $(format $libc_tcc_SOURCES);
+    libc_gnu_SOURCES  = $(format $libc_gnu_SOURCES);
+    mes_SOURCES       = $(format $mes_SOURCES);
+  };
+EOF
+}
+
+
+MES_TARBALL=$1
+if [ ! -f $MES_TARBALL ]; then
+    echo "Provide path to mes-x.x.x.tar.gz as first argument" >&2
+    exit 1
+fi
+echo "Generating sources.nix from $MES_TARBALL" >&2
+
+TMP=$(mktemp -d)
+cd $TMP
+echo "Workdir: $TMP" >&2
+
+echo "Extracting $MES_TARBALL" >&2
+tar --strip-components 1 -xf $MES_TARBALL
+
+CONFIGURE_LIB_SH="$TMP/build-aux/configure-lib.sh"
+if [ ! -f $CONFIGURE_LIB_SH ]; then
+    echo "Could not find mes's configure-lib.sh script at $CONFIGURE_LIB_SH" >&2
+    exit 1
+fi
+
+# Create dummy config expected by configure-lib.sh
+touch config.sh
+chmod +x config.sh
+
+
+echo "Configuring with $CONFIGURE_LIB_SH" >&2
+
+cat <<EOF
+# This file is generated by ./gen-sources.sh.
+# Do not edit!
+{
+EOF
+
+for arch in $ARCHS; do
+  for kernel in $KERNELS; do
+    for compiler in $COMPILERS; do
+      gen_sources $arch $kernel $compiler
+    done
+  done
+done
+
+cat <<EOF
+}
+EOF
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
new file mode 100644
index 000000000000..807d043fa9e3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -0,0 +1,60 @@
+{ lib
+, kaem
+, ln-boot
+, mes
+, mes-libc
+}:
+let
+  pname = "mes-libc";
+  inherit (mes.compiler) version;
+
+  sources = (import ./sources.nix).x86.linux.gcc;
+  inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
+
+  # Concatenate all source files into a convenient bundle
+  # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
+  # compiled by tinycc
+  #
+  # Passing this many arguments is too much for kaem so we need to split
+  # the operation in two
+  firstLibc = lib.take 100 libc_gnu_SOURCES;
+  lastLibc = lib.drop 100 libc_gnu_SOURCES;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ ln-boot ];
+
+  passthru.CFLAGS = "-DHAVE_CONFIG_H=1 -I${mes-libc}/include -I${mes-libc}/include/linux/x86";
+
+  meta = with lib; {
+    description = "The Mes C Library";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+} ''
+  cd ${mes.srcPrefix}
+
+  # mescc compiled libc.a
+  mkdir -p ''${out}/lib/x86-mes
+
+  # libc.c
+  catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
+  catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
+
+  # crt{1,n,i}.c
+  cp lib/linux/x86-mes-gcc/crt1.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crtn.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crti.c ''${out}/lib
+
+  # libtcc1.c
+  catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}
+
+  # getopt.c
+  cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
+
+  # Install headers
+  ln -s ${mes.srcPrefix}/include ''${out}/include
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
new file mode 100644
index 000000000000..ed402cbaacf3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchurl
+, kaem
+, nyacc
+}:
+let
+  pname = "nyacc";
+  # NYACC is a tightly coupled dependency of mes. This version is known to work
+  # with mes 0.24.2.
+  # https://git.savannah.gnu.org/cgit/mes.git/tree/INSTALL?h=v0.24.2&id=7562330ec746f09b4060d3081e3377fb7083897d#n31
+  version = "1.00.2";
+
+  src = fetchurl {
+    url = "mirror://savannah/nyacc/nyacc-${version}.tar.gz";
+    sha256 = "065ksalfllbdrzl12dz9d9dcxrv97wqxblslngsc6kajvnvlyvpk";
+  };
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  passthru.guilePath = "${nyacc}/share/${pname}-${version}/module";
+
+  meta = with lib; {
+    description = "Modules for generating parsers and lexical analyzers";
+    longDescription = ''
+      Not Yet Another Compiler Compiler is a set of guile modules for
+      generating computer language parsers and lexical analyzers.
+    '';
+    homepage = "https://savannah.nongnu.org/projects/nyacc";
+    license = licenses.lgpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.all;
+  };
+} ''
+  ungz --file ${src} --output nyacc.tar
+  mkdir -p ''${out}/share
+  cd ''${out}/share
+  untar --file ''${NIX_BUILD_TOP}/nyacc.tar
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
new file mode 100644
index 000000000000..ac534284346d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
@@ -0,0 +1,22 @@
+# This file is generated by ./gen-sources.sh.
+# Do not edit!
+{
+  x86.linux.mescc = {
+    libc_mini_SOURCES = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/mes/mini-write.c" ];
+    libmescc_SOURCES  = [ "lib/mes/globals.c" "lib/linux/x86-mes-mescc/syscall-internal.c" ];
+    libtcc1_SOURCES   = [ "lib/libtcc1.c" ];
+    libc_SOURCES      = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" ];
+    libc_tcc_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-mescc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" ];
+    libc_gnu_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-mescc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" "lib/ctype/isalnum.c" "lib/ctype/isalpha.c" "lib/ctype/isascii.c" "lib/ctype/iscntrl.c" "lib/ctype/isgraph.c" "lib/ctype/isprint.c" "lib/ctype/ispunct.c" "lib/dirent/__getdirentries.c" "lib/dirent/closedir.c" "lib/dirent/opendir.c" "lib/dirent/readdir.c" "lib/math/ceil.c" "lib/math/fabs.c" "lib/math/floor.c" "lib/mes/fdgets.c" "lib/posix/alarm.c" "lib/posix/execl.c" "lib/posix/execlp.c" "lib/posix/mktemp.c" "lib/posix/sbrk.c" "lib/posix/sleep.c" "lib/posix/unsetenv.c" "lib/stdio/clearerr.c" "lib/stdio/feof.c" "lib/stdio/fgets.c" "lib/stdio/fileno.c" "lib/stdio/freopen.c" "lib/stdio/fscanf.c" "lib/stdio/perror.c" "lib/stdio/vfscanf.c" "lib/stdlib/__exit.c" "lib/stdlib/abort.c" "lib/stdlib/abs.c" "lib/stdlib/alloca.c" "lib/stdlib/atexit.c" "lib/stdlib/atof.c" "lib/stdlib/atol.c" "lib/stdlib/mbstowcs.c" "lib/string/bcmp.c" "lib/string/bcopy.c" "lib/string/bzero.c" "lib/string/index.c" "lib/string/rindex.c" "lib/string/strcspn.c" "lib/string/strdup.c" "lib/string/strerror.c" "lib/string/strncat.c" "lib/string/strpbrk.c" "lib/string/strspn.c" "lib/stub/__cleanup.c" "lib/stub/atan2.c" "lib/stub/bsearch.c" "lib/stub/chown.c" "lib/stub/cos.c" "lib/stub/ctime.c" "lib/stub/exp.c" "lib/stub/fpurge.c" "lib/stub/freadahead.c" "lib/stub/frexp.c" "lib/stub/getgrgid.c" "lib/stub/getgrnam.c" "lib/stub/getlogin.c" "lib/stub/getpgid.c" "lib/stub/getpgrp.c" "lib/stub/getpwnam.c" "lib/stub/getpwuid.c" "lib/stub/gmtime.c" "lib/stub/log.c" "lib/stub/mktime.c" "lib/stub/modf.c" "lib/stub/pclose.c" "lib/stub/popen.c" "lib/stub/pow.c" "lib/stub/rand.c" "lib/stub/rewind.c" "lib/stub/setbuf.c" "lib/stub/setgrent.c" "lib/stub/setlocale.c" "lib/stub/setvbuf.c" "lib/stub/sigaddset.c" "lib/stub/sigblock.c" "lib/stub/sigdelset.c" "lib/stub/sigsetmask.c" "lib/stub/sin.c" "lib/stub/sqrt.c" "lib/stub/strftime.c" "lib/stub/sys_siglist.c" "lib/stub/system.c" "lib/stub/times.c" "lib/stub/ttyname.c" "lib/stub/umask.c" "lib/stub/utime.c" "lib/linux/chdir.c" "lib/linux/fcntl.c" "lib/linux/fstat.c" "lib/linux/getdents.c" "lib/linux/getegid.c" "lib/linux/geteuid.c" "lib/linux/getgid.c" "lib/linux/getppid.c" "lib/linux/getrusage.c" "lib/linux/getuid.c" "lib/linux/ioctl.c" "lib/linux/link.c" "lib/linux/lstat.c" "lib/linux/mkdir.c" "lib/linux/mknod.c" "lib/linux/nanosleep.c" "lib/linux/pipe.c" "lib/linux/readlink.c" "lib/linux/rename.c" "lib/linux/setgid.c" "lib/linux/settimer.c" "lib/linux/setuid.c" "lib/linux/signal.c" "lib/linux/sigprogmask.c" "lib/linux/symlink.c" ];
+    mes_SOURCES       = [ "src/builtins.c" "src/cc.c" "src/core.c" "src/display.c" "src/eval-apply.c" "src/gc.c" "src/globals.c" "src/hash.c" "src/lib.c" "src/math.c" "src/mes.c" "src/module.c" "src/posix.c" "src/reader.c" "src/stack.c" "src/string.c" "src/struct.c" "src/symbol.c" "src/vector.c" ];
+  };
+  x86.linux.gcc = {
+    libc_mini_SOURCES = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/mes/mini-write.c" ];
+    libmescc_SOURCES  = [ "lib/mes/globals.c" "lib/linux/x86-mes-gcc/syscall-internal.c" ];
+    libtcc1_SOURCES   = [ "lib/libtcc1.c" ];
+    libc_SOURCES      = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" ];
+    libc_tcc_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-gcc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" ];
+    libc_gnu_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-gcc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" "lib/ctype/isalnum.c" "lib/ctype/isalpha.c" "lib/ctype/isascii.c" "lib/ctype/iscntrl.c" "lib/ctype/isgraph.c" "lib/ctype/isprint.c" "lib/ctype/ispunct.c" "lib/dirent/__getdirentries.c" "lib/dirent/closedir.c" "lib/dirent/opendir.c" "lib/dirent/readdir.c" "lib/math/ceil.c" "lib/math/fabs.c" "lib/math/floor.c" "lib/mes/fdgets.c" "lib/posix/alarm.c" "lib/posix/execl.c" "lib/posix/execlp.c" "lib/posix/mktemp.c" "lib/posix/sbrk.c" "lib/posix/sleep.c" "lib/posix/unsetenv.c" "lib/stdio/clearerr.c" "lib/stdio/feof.c" "lib/stdio/fgets.c" "lib/stdio/fileno.c" "lib/stdio/freopen.c" "lib/stdio/fscanf.c" "lib/stdio/perror.c" "lib/stdio/vfscanf.c" "lib/stdlib/__exit.c" "lib/stdlib/abort.c" "lib/stdlib/abs.c" "lib/stdlib/alloca.c" "lib/stdlib/atexit.c" "lib/stdlib/atof.c" "lib/stdlib/atol.c" "lib/stdlib/mbstowcs.c" "lib/string/bcmp.c" "lib/string/bcopy.c" "lib/string/bzero.c" "lib/string/index.c" "lib/string/rindex.c" "lib/string/strcspn.c" "lib/string/strdup.c" "lib/string/strerror.c" "lib/string/strncat.c" "lib/string/strpbrk.c" "lib/string/strspn.c" "lib/stub/__cleanup.c" "lib/stub/atan2.c" "lib/stub/bsearch.c" "lib/stub/chown.c" "lib/stub/cos.c" "lib/stub/ctime.c" "lib/stub/exp.c" "lib/stub/fpurge.c" "lib/stub/freadahead.c" "lib/stub/frexp.c" "lib/stub/getgrgid.c" "lib/stub/getgrnam.c" "lib/stub/getlogin.c" "lib/stub/getpgid.c" "lib/stub/getpgrp.c" "lib/stub/getpwnam.c" "lib/stub/getpwuid.c" "lib/stub/gmtime.c" "lib/stub/log.c" "lib/stub/mktime.c" "lib/stub/modf.c" "lib/stub/pclose.c" "lib/stub/popen.c" "lib/stub/pow.c" "lib/stub/rand.c" "lib/stub/rewind.c" "lib/stub/setbuf.c" "lib/stub/setgrent.c" "lib/stub/setlocale.c" "lib/stub/setvbuf.c" "lib/stub/sigaddset.c" "lib/stub/sigblock.c" "lib/stub/sigdelset.c" "lib/stub/sigsetmask.c" "lib/stub/sin.c" "lib/stub/sqrt.c" "lib/stub/strftime.c" "lib/stub/sys_siglist.c" "lib/stub/system.c" "lib/stub/times.c" "lib/stub/ttyname.c" "lib/stub/umask.c" "lib/stub/utime.c" "lib/linux/chdir.c" "lib/linux/fcntl.c" "lib/linux/fstat.c" "lib/linux/getdents.c" "lib/linux/getegid.c" "lib/linux/geteuid.c" "lib/linux/getgid.c" "lib/linux/getppid.c" "lib/linux/getrusage.c" "lib/linux/getuid.c" "lib/linux/ioctl.c" "lib/linux/link.c" "lib/linux/lstat.c" "lib/linux/mkdir.c" "lib/linux/mknod.c" "lib/linux/nanosleep.c" "lib/linux/pipe.c" "lib/linux/readlink.c" "lib/linux/rename.c" "lib/linux/setgid.c" "lib/linux/settimer.c" "lib/linux/setuid.c" "lib/linux/signal.c" "lib/linux/sigprogmask.c" "lib/linux/symlink.c" ];
+    mes_SOURCES       = [ "src/builtins.c" "src/cc.c" "src/core.c" "src/display.c" "src/eval-apply.c" "src/gc.c" "src/globals.c" "src/hash.c" "src/lib.c" "src/math.c" "src/mes.c" "src/module.c" "src/posix.c" "src/reader.c" "src/stack.c" "src/string.c" "src/struct.c" "src/symbol.c" "src/vector.c" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
new file mode 100644
index 000000000000..f06db98a8efe
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -0,0 +1,34 @@
+rec {
+  name = "stage0-posix-${version}-${rev}-source";
+  # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
+  version = "unstable-2023-05-02";
+  rev = "3189b5f325b7ef8b88e3edec7c1cde4fce73c76c";
+
+  # This 256 byte seed is the only pre-compiled binary in the bootstrap chain.
+  # While it is included in the stage0-posix source bundle and is synced with
+  # stage0-posix updates, we have split it out into its own derivation to highlight
+  # its unique status as a trusted binary seed.
+  hex0-seed = import <nix/fetchurl.nix> {
+    name = "hex0-seed-${version}";
+    url = "https://github.com/oriansj/bootstrap-seeds/raw/b1263ff14a17835f4d12539226208c426ced4fba/POSIX/x86/hex0-seed";
+    hash = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
+    executable = true;
+  };
+
+  # Packaged resources required for the first bootstrapping stage.
+  # Contains source code and 256-byte hex0 binary seed.
+  #
+  # We don't have access to utilities such as fetchgit and fetchzip since this
+  # is this is part of the bootstrap process and would introduce a circular
+  # dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
+  # with the unpack option, taking a NAR file as input. This requires source
+  # tarballs to be repackaged.
+  #
+  # To build see `make-bootstrap-sources.nix`
+  src = import <nix/fetchurl.nix> {
+    inherit name;
+    url = "https://github.com/emilytrau/bootstrap-tools-nar-mirror/releases/download/2023-05-02/${name}.nar.xz";
+    hash = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
+    unpack = true;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
new file mode 100644
index 000000000000..2b41261add3a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
@@ -0,0 +1,22 @@
+{ lib
+, newScope
+}:
+
+lib.makeScope newScope (self: with self; {
+  inherit (import ./bootstrap-sources.nix) version hex0-seed src;
+
+  m2libc = src + "/M2libc";
+
+  hex0 = callPackage ./hex0.nix { };
+
+  kaem = callPackage ./kaem { };
+  kaem-minimal = callPackage ./kaem/minimal.nix { };
+
+  stage0-posix-x86 = callPackage ./stage0-posix-x86.nix { };
+
+  inherit (self.stage0-posix-x86) blood-elf-0 hex2 kaem-unwrapped M1 M2;
+
+  mescc-tools = callPackage ./mescc-tools { };
+
+  mescc-tools-extra = callPackage ./mescc-tools-extra { };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
new file mode 100644
index 000000000000..43859b966add
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
@@ -0,0 +1,28 @@
+{ lib
+, derivationWithMeta
+, hex0-seed
+, src
+, version
+}:
+derivationWithMeta {
+  inherit version;
+  pname = "hex0";
+  builder = hex0-seed;
+  args = [
+    "${src}/bootstrap-seeds/POSIX/x86/hex0_x86.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "Minimal assembler for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  # Ensure the untrusted hex0-seed binary produces a known-good hex0
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
new file mode 100644
index 000000000000..77e9a8e8d63f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, derivationWithMeta
+, writeText
+, kaem
+, kaem-unwrapped
+, mescc-tools
+, mescc-tools-extra
+, version
+}:
+
+# Once mescc-tools-extra is available we can install kaem at /bin/kaem
+# to make it findable in environments
+derivationWithMeta {
+  inherit version kaem-unwrapped;
+  pname = "kaem";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    (builtins.toFile "kaem-wrapper.kaem" ''
+      mkdir -p ''${out}/bin
+      cp ''${kaem-unwrapped} ''${out}/bin/kaem
+      chmod 555 ''${out}/bin/kaem
+    '')
+  ];
+  PATH = lib.makeBinPath [ mescc-tools-extra ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name;
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (writeText "${name}-builder" buildCommand)
+      ];
+
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [ kaem mescc-tools mescc-tools-extra ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  meta = with lib; {
+    description = "Minimal build tool for running scripts on systems that lack any shell";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
new file mode 100644
index 000000000000..e85efbbb0243
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
@@ -0,0 +1,24 @@
+{ lib
+, derivationWithMeta
+, src
+, hex0
+, version
+}:
+derivationWithMeta {
+  inherit version;
+  pname = "kaem-minimal";
+  builder = hex0;
+  args = [
+    "${src}/bootstrap-seeds/POSIX/x86/kaem-minimal.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "First stage minimal scriptable build tool for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+}
+
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
new file mode 100644
index 000000000000..fec03f370bc3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -0,0 +1,46 @@
+# Packaged resources required for the first bootstrapping stage.
+# Contains source code and 256-byte hex0 binary seed.
+#
+# We don't have access to utilities such as fetchgit and fetchzip since this
+# is this is part of the bootstrap process and would introduce a circular
+# dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
+# with the unpack option, taking a NAR file as input. This requires source
+# tarballs to be repackaged.
+#
+# To build:
+#
+#   nix-build pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+#   => ./result/stage0-posix-$version-$rev-source.nar.xz
+#
+
+{ pkgs ? import ../../../../.. {} }:
+let
+  inherit (pkgs) callPackage runCommand fetchFromGitHub nix xz;
+
+  inherit (import ./bootstrap-sources.nix) name rev;
+
+  src = fetchFromGitHub {
+    owner = "oriansj";
+    repo = "stage0-posix";
+    inherit rev;
+    sha256 = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
+    fetchSubmodules = true;
+    postFetch = ''
+      # Remove vendored/duplicate M2libc's
+      echo "Removing duplicate M2libc"
+      rm -rf \
+        $out/M2-Mesoplanet/M2libc \
+        $out/M2-Planet/M2libc \
+        $out/mescc-tools/M2libc \
+        $out/mescc-tools-extra/M2libc
+    '';
+  };
+in
+runCommand name {
+  nativeBuildInputs = [ nix xz ];
+
+  passthru = { inherit src; };
+} ''
+  mkdir $out
+  nix-store --dump ${src} | xz -c > "$out/${name}.nar.xz"
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
new file mode 100644
index 000000000000..e50fc1c68474
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
@@ -0,0 +1,39 @@
+# This is a modified version of mescc-tools-extra/mescc-tools-extra.kaem
+# https://github.com/oriansj/mescc-tools-extra/blob/ec53af69d6d2119b47b369cd0ec37ac806e7ad60/mescc-tools-extra.kaem
+# - Paths to build inputs have been changed for nix
+# - Added additional step to create $out directory
+
+## Copyright (C) 2017 Jeremiah Orians
+## This file is part of mescc-tools.
+##
+## mescc-tools is free software: you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation, either version 3 of the License, or
+## (at your option) any later version.
+##
+## mescc-tools is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+##
+## You should have received a copy of the GNU General Public License
+## along with mescc-tools.  If not, see <http://www.gnu.org/licenses/>.
+
+alias CC="${mescc-tools}/bin/M2-Mesoplanet --operating-system ${OPERATING_SYSTEM} --architecture ${ARCH} -f"
+cd ${src}/mescc-tools-extra
+
+# Create output folder
+CC mkdir.c -o ${TMP}/mkdir
+${TMP}/mkdir -p ${out}/bin
+
+CC sha256sum.c -o ${out}/bin/sha256sum
+CC match.c -o ${out}/bin/match
+CC mkdir.c -o ${out}/bin/mkdir
+CC untar.c -o ${out}/bin/untar
+CC ungz.c -o ${out}/bin/ungz
+CC unbz2.c -o ${out}/bin/unbz2
+CC catm.c -o ${out}/bin/catm
+CC cp.c -o ${out}/bin/cp
+CC chmod.c -o ${out}/bin/chmod
+CC rm.c -o ${out}/bin/rm
+CC replace.c -o ${out}/bin/replace
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
new file mode 100644
index 000000000000..425a10cfb35a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, mescc-tools
+, src
+, version
+}:
+derivationWithMeta {
+  inherit version src mescc-tools;
+  pname = "mescc-tools-extra";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+
+  ARCH = "x86";
+  OPERATING_SYSTEM = "linux";
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools-extra";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
new file mode 100644
index 000000000000..3a7ae25fbd82
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
@@ -0,0 +1,204 @@
+# This is a modified version of stage0-posix/x86/mescc-tools-full-kaem.kaem
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-full-kaem.kaem
+# - Paths to build inputs have been changed for nix
+
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+${mkdir} -p ${out}/bin
+${cp} ${M2} ${out}/bin/M2
+${chmod} 0555 ${out}/bin/M2
+${cp} ${M1} ${out}/bin/M1
+${chmod} 0555 ${out}/bin/M1
+${cp} ${hex2} ${out}/bin/hex2
+${chmod} 0555 ${out}/bin/hex2
+
+# M2-Mesoplanet searches for runtime dependencies in environment variables
+# We can hardcode them with the "replace" utility from mescc-tools-extra
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc.c \
+	--output ./cc_patched.c \
+	--match-on "env_lookup(\"M2LIBC_PATH\")" \
+	--replace-with "\"${m2libc}\""
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc_spawn.c \
+	--output ./cc_spawn_patched.c \
+	--match-on "env_lookup(\"PATH\")" \
+	--replace-with "\"${out}/bin:\""
+
+###############################################
+# Phase-12 Build M2-Mesoplanet from M2-Planet #
+###############################################
+
+${M2} --architecture ${ARCH} \
+  -f ${m2libc}/sys/types.h \
+  -f ${m2libc}/stddef.h \
+  -f ${m2libc}/${ARCH}/linux/fcntl.c \
+  -f ${m2libc}/fcntl.c \
+  -f ${m2libc}/${ARCH}/linux/unistd.c \
+  -f ${m2libc}/${ARCH}/linux/sys/stat.c \
+  -f ${m2libc}/stdlib.c \
+  -f ${m2libc}/stdio.h \
+  -f ${m2libc}/stdio.c \
+  -f ${m2libc}/string.c \
+  -f ${m2libc}/bootstrappable.c \
+  -f ${src}/M2-Mesoplanet/cc.h \
+  -f ${src}/M2-Mesoplanet/cc_globals.c \
+  -f ${src}/M2-Mesoplanet/cc_env.c \
+  -f ${src}/M2-Mesoplanet/cc_reader.c \
+  -f ./cc_spawn_patched.c \
+  -f ${src}/M2-Mesoplanet/cc_core.c \
+  -f ${src}/M2-Mesoplanet/cc_macro.c \
+  -f ./cc_patched.c \
+  --debug \
+  -o ./M2-Mesoplanet-1.M1
+
+${blood-elf-0} ${ENDIAN_FLAG} ${BLOOD_FLAG} -f ./M2-Mesoplanet-1.M1 -o ./M2-Mesoplanet-1-footer.M1
+
+${M1} --architecture ${ARCH} \
+  ${ENDIAN_FLAG} \
+  -f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+  -f ${m2libc}/${ARCH}/libc-full.M1 \
+  -f ./M2-Mesoplanet-1.M1 \
+  -f ./M2-Mesoplanet-1-footer.M1 \
+  -o ./M2-Mesoplanet-1.hex2
+
+${hex2} --architecture ${ARCH} \
+  ${ENDIAN_FLAG} \
+  --base-address ${BASE_ADDRESS} \
+  -f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+  -f ./M2-Mesoplanet-1.hex2 \
+  -o ${out}/bin/M2-Mesoplanet
+
+#################################################
+# Phase-13 Build final blood-elf from C sources #
+#################################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/stringify.c \
+	-f ${src}/mescc-tools/blood-elf.c \
+	--debug \
+	-o ./blood-elf-1.M1
+
+${blood-elf-0} ${BLOOD_FLAG} ${ENDIAN_FLAG} -f ./blood-elf-1.M1 -o ./blood-elf-1-footer.M1
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./blood-elf-1.M1 \
+	-f ./blood-elf-1-footer.M1 \
+	-o ./blood-elf-1.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./blood-elf-1.hex2 \
+	-o ${out}/bin/blood-elf
+
+# Now we have our shipping debuggable blood-elf, the rest will be down hill from
+# here as we have ALL of the core pieces of compiling and assembling debuggable
+# programs in a debuggable form with corresponding C source code.
+
+#############################################
+# Phase-14 Build get_machine from C sources #
+#############################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/get_machine.c \
+	--debug \
+	-o get_machine.M1
+
+${out}/bin/blood-elf ${BLOOD_FLAG} ${ENDIAN_FLAG} -f ./get_machine.M1 -o ./get_machine-footer.M1
+
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./get_machine.M1 \
+	-f ./get_machine-footer.M1 \
+	-o ./get_machine.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./get_machine.hex2 \
+	-o ${out}/bin/get_machine
+
+############################################
+# Phase-15 Build M2-Planet from M2-Planet  #
+############################################
+
+${M2} --architecture ${ARCH} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${ARCH}/linux/unistd.c \
+	-f ${m2libc}/${ARCH}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/M2-Planet/cc.h \
+	-f ${src}/M2-Planet/cc_globals.c \
+	-f ${src}/M2-Planet/cc_reader.c \
+	-f ${src}/M2-Planet/cc_strings.c \
+	-f ${src}/M2-Planet/cc_types.c \
+	-f ${src}/M2-Planet/cc_core.c \
+	-f ${src}/M2-Planet/cc_macro.c \
+	-f ${src}/M2-Planet/cc.c \
+	--debug \
+	-o ./M2-1.M1
+
+${out}/bin/blood-elf ${ENDIAN_FLAG} ${BLOOD_FLAG} -f ./M2-1.M1 -o ./M2-1-footer.M1
+
+${M1} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	-f ${m2libc}/${ARCH}/${ARCH}_defs.M1 \
+	-f ${m2libc}/${ARCH}/libc-full.M1 \
+	-f ./M2-1.M1 \
+	-f ./M2-1-footer.M1 \
+	-o ./M2-1.hex2
+
+${hex2} --architecture ${ARCH} \
+	${ENDIAN_FLAG} \
+	--base-address ${BASE_ADDRESS} \
+	-f ${m2libc}/${ARCH}/ELF-${ARCH}-debug.hex2 \
+	-f ./M2-1.hex2 \
+	-o ${out}/bin/M2-Planet
+
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
new file mode 100644
index 000000000000..c4aca823203d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
@@ -0,0 +1,88 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, M1
+, M2
+, blood-elf-0
+, hex2
+, m2libc
+, src
+, version
+}:
+
+let
+  ARCH = "x86";
+  BLOOD_FLAG = " ";
+  BASE_ADDRESS = "0x8048000";
+  ENDIAN_FLAG = "--little-endian";
+
+  # We need a few tools from mescc-tools-extra to assemble the output folder
+  buildMesccToolsExtraUtil = name:
+    derivationWithMeta {
+      pname = "mescc-tools-extra-${name}";
+      builder = kaem-unwrapped;
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "build-${name}.kaem" ''
+          ''${M2} --architecture ''${ARCH} \
+            -f ''${m2libc}/sys/types.h \
+            -f ''${m2libc}/stddef.h \
+            -f ''${m2libc}/''${ARCH}/linux/fcntl.c \
+            -f ''${m2libc}/fcntl.c \
+            -f ''${m2libc}/''${ARCH}/linux/unistd.c \
+            -f ''${m2libc}/''${ARCH}/linux/sys/stat.c \
+            -f ''${m2libc}/stdlib.c \
+            -f ''${m2libc}/stdio.h \
+            -f ''${m2libc}/stdio.c \
+            -f ''${m2libc}/string.c \
+            -f ''${m2libc}/bootstrappable.c \
+            -f ''${src}/mescc-tools-extra/${name}.c \
+            --debug \
+            -o ${name}.M1
+
+          ''${blood-elf-0} ''${ENDIAN_FLAG} -f ${name}.M1 -o ${name}-footer.M1
+
+          ''${M1} --architecture ''${ARCH} \
+            ''${ENDIAN_FLAG} \
+            -f ''${m2libc}/''${ARCH}/''${ARCH}_defs.M1 \
+            -f ''${m2libc}/''${ARCH}/libc-full.M1 \
+            -f ${name}.M1 \
+            -f ${name}-footer.M1 \
+            -o ${name}.hex2
+
+          ''${hex2} --architecture ''${ARCH} \
+            ''${ENDIAN_FLAG} \
+            -f ''${m2libc}/''${ARCH}/ELF-''${ARCH}-debug.hex2 \
+            -f ${name}.hex2 \
+            --base-address ''${BASE_ADDRESS} \
+            -o ''${out}
+        '')
+      ];
+      inherit version M1 M2 blood-elf-0 hex2 m2libc src ARCH BLOOD_FLAG BASE_ADDRESS ENDIAN_FLAG;
+    };
+  mkdir = buildMesccToolsExtraUtil "mkdir";
+  cp = buildMesccToolsExtraUtil "cp";
+  chmod = buildMesccToolsExtraUtil "chmod";
+  replace = buildMesccToolsExtraUtil "replace";
+in
+derivationWithMeta {
+  pname = "mescc-tools";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+  inherit version M1 M2 blood-elf-0 hex2 mkdir cp chmod replace m2libc src ARCH BLOOD_FLAG BASE_ADDRESS ENDIAN_FLAG;
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix
new file mode 100644
index 000000000000..bcb02537b916
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/stage0-posix-x86.nix
@@ -0,0 +1,345 @@
+# This is a translation of stage0-posix/stage0-posix/x86/mescc-tools-mini-kaem.kaem to nix
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-mini-kaem.kaem
+#
+# We have access to mini-kaem at this point but it doesn't support substituting
+# environment variables. Without variables there's no way of passing in store inputs,
+# or the $out path, other than as command line arguments directly
+
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+# Warning all binaries prior to the use of blood-elf will not be readable by
+# Objdump, you may need to use ndism or gdb to view the assembly in the binary.
+
+{ lib
+, derivationWithMeta
+, hex0
+, m2libc
+, src
+, version
+}:
+rec {
+  out = placeholder "out";
+
+  run = pname: builder: args:
+    derivationWithMeta {
+      inherit pname version builder args;
+
+      meta = with lib; {
+        description = "Collection of tools written for use in bootstrapping";
+        homepage = "https://github.com/oriansj/stage0-posix";
+        license = licenses.gpl3Plus;
+        maintainers = teams.minimal-bootstrap.members;
+        platforms = [ "i686-linux" ];
+      };
+    };
+
+  ################################
+  # Phase-1 Build hex1 from hex0 #
+  ################################
+
+  hex1 = run "hex1" hex0 ["${src}/x86/hex1_x86.hex0" out];
+
+  # hex1 adds support for single character labels and is available in various forms
+  # in mescc-tools/x86_bootstrap to allow you various ways to verify correctness
+
+  ################################
+  # Phase-2 Build hex2 from hex1 #
+  ################################
+
+  hex2-0 = run "hex2" hex1 ["${src}/x86/hex2_x86.hex1" out];
+
+  # hex2 adds support for long labels and absolute addresses thus allowing it
+  # to function as an effective linker for later stages of the bootstrap
+  # This is a minimal version which will be used to bootstrap a much more advanced
+  # version in a later stage.
+
+  #################################
+  # Phase-2b Build catm from hex2 #
+  #################################
+
+  catm = run "catm" hex2-0 ["${src}/x86/catm_x86.hex2" out];
+
+  # catm removes the need for cat or shell support for redirection by providing
+  # equivalent functionality via catm output_file input1 input2 ... inputN
+
+  ##############################
+  # Phase-3 Build M0 from hex2 #
+  ##############################
+
+  M0_hex2 = run "M0.hex2" catm [out "${src}/x86/ELF-i386.hex2" "${src}/x86/M0_x86.hex2"];
+  M0 = run "M0" hex2-0 [M0_hex2 out];
+
+  # M0 is the architecture specific version of M1 and is by design single
+  # architecture only and will be replaced by the C code version of M1
+
+  ################################
+  # Phase-4 Build cc_x86 from M0 #
+  ################################
+
+  cc_x86-0_hex2 = run "cc_x86-0.hex2" M0 ["${src}/x86/cc_x86.M1" out];
+  cc_x86-1_hex2 = run "cc_x86-1.hex2" catm [out "${src}/x86/ELF-i386.hex2" cc_x86-0_hex2];
+  cc_x86 = run "cc_x86" hex2-0 [cc_x86-1_hex2 out];
+
+  #######################################
+  # Phase-5 Build M2-Planet from cc_x86 #
+  #######################################
+
+  M2-0_c = run "M2-0.c" catm [
+    out
+    "${m2libc}/x86/linux/bootstrap.c"
+    "${src}/M2-Planet/cc.h"
+    "${m2libc}/bootstrappable.c"
+    "${src}/M2-Planet/cc_globals.c"
+    "${src}/M2-Planet/cc_reader.c"
+    "${src}/M2-Planet/cc_strings.c"
+    "${src}/M2-Planet/cc_types.c"
+    "${src}/M2-Planet/cc_core.c"
+    "${src}/M2-Planet/cc_macro.c"
+    "${src}/M2-Planet/cc.c"
+  ];
+  M2-0_M1 = run "M2-0.M1" cc_x86 [M2-0_c out];
+  M2-0-0_M1 = run "M2-0-0.M1" catm [out "${src}/x86/x86_defs.M1" "${src}/x86/libc-core.M1" M2-0_M1];
+  M2-0_hex2 = run "M2-0.hex2" M0 [M2-0-0_M1 out];
+  M2-0-0_hex2 = run "M2-0-0.hex2" catm [out "${src}/x86/ELF-i386.hex2" M2-0_hex2];
+  M2 = run "M2" hex2-0 [M2-0-0_hex2 out];
+
+  ############################################
+  # Phase-6 Build blood-elf-0 from C sources #
+  ############################################
+
+  blood-elf-0_M1 = run "blood-elf-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/x86/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/blood-elf.c"
+    "--bootstrap-mode"
+    "-o" out
+  ];
+
+  blood-elf-0-0_M1 = run "blood-elf-0-0.M1" catm [out "${m2libc}/x86/x86_defs.M1" "${m2libc}/x86/libc-core.M1" blood-elf-0_M1];
+  blood-elf-0_hex2 = run "blood-elf-0.hex2" M0 [blood-elf-0-0_M1 out];
+  blood-elf-0-0_hex2 = run "blood-elf-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86.hex2" blood-elf-0_hex2];
+  blood-elf-0 = run "blood-elf-0" hex2-0 [blood-elf-0-0_hex2 out];
+
+  # This is the last stage where the binaries will not have debug info
+  # and the last piece built that isn't part of the output binaries
+
+  #####################################
+  # Phase-7 Build M1-0 from C sources #
+  #####################################
+
+  M1-macro-0_M1 = run "M1-macro-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/x86/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--bootstrap-mode"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-0-footer_M1 = run "M1-macro-0-footer.M1" blood-elf-0 ["-f" M1-macro-0_M1 "--little-endian" "-o" out];
+  M1-macro-0-0_M1 = run "M1-macro-0-0.M1" catm [out "${m2libc}/x86/x86_defs.M1" "${m2libc}/x86/libc-core.M1" M1-macro-0_M1 M1-macro-0-footer_M1];
+  M1-macro-0_hex2 = run "M1-macro-0.hex2" M0 [M1-macro-0-0_M1 out];
+  M1-macro-0-0_hex2 = run "M1-macro-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86-debug.hex2" M1-macro-0_hex2];
+  M1-0 = run "M1-0" hex2-0 [M1-macro-0-0_hex2 out];
+
+  # This is the last stage where catm will need to be used and the last stage where
+  # M0 is used, as we will being using it's much more powerful and cross-platform
+  # version with a bunch of extra goodies.
+
+  #######################################
+  # Phase-8 Build hex2-1 from C sources #
+  #######################################
+
+  hex2_linker-0_M1 = run "hex2_linker-0.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-0-footer_M1 = run "hex2_linker-0-footer.M1" blood-elf-0 ["-f" hex2_linker-0_M1 "--little-endian" "-o" out];
+
+  hex2_linker-0_hex2 = run "hex2_linker-0.hex2" M1-0 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" hex2_linker-0_M1
+    "-f" hex2_linker-0-footer_M1
+    "-o" out
+  ];
+
+  hex2_linker-0-0_hex2 = run "hex2_linker-0-0.hex2" catm [out "${m2libc}/x86/ELF-x86-debug.hex2" hex2_linker-0_hex2];
+
+  hex2-1 = run "hex2-1" hex2-0 [hex2_linker-0-0_hex2 out];
+
+  # This is the last stage where we will be using the handwritten hex2 and instead
+  # be using the far more powerful, cross-platform version with a bunch more goodies
+
+  ###################################
+  # Phase-9 Build M1 from C sources #
+  ###################################
+
+  M1-macro-1_M1 = run "M1-macro-1.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-1-footer_M1 = run "M1-macro-1-footer.M1" blood-elf-0 ["-f" M1-macro-1_M1 "--little-endian" "-o" out];
+
+  M1-macro-1_hex2 = run "M1-macro-1.hex2" M1-0 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" M1-macro-1_M1
+    "-f" M1-macro-1-footer_M1
+    "-o" out
+  ];
+
+  M1 = run "M1" hex2-1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "--base-address" "0x8048000"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" M1-macro-1_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-10 Build hex2 from C sources #
+  ######################################
+
+  hex2_linker-2_M1 = run "hex2_linker-2.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/x86/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-2-footer_M1 = run "hex2_linker-2-footer.M1" blood-elf-0 ["-f" hex2_linker-2_M1 "--little-endian" "-o" out];
+
+  hex2_linker-2_hex2 = run "hex2_linker-2.hex2" M1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" hex2_linker-2_M1
+    "-f" hex2_linker-2-footer_M1
+    "-o" out
+  ];
+
+  hex2 = run "hex2" hex2-1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "--base-address" "0x8048000"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" hex2_linker-2_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-11 Build kaem from C sources #
+  ######################################
+
+  kaem_M1 = run "kaem.M1" M2 [
+    "--architecture" "x86"
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/x86/linux/unistd.c"
+    "-f" "${m2libc}/x86/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.h"
+    "-f" "${src}/mescc-tools/Kaem/variable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem_globals.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.c"
+    "--debug"
+    "-o" out
+  ];
+
+  kaem-footer_M1 = run "kaem-footer.M1" blood-elf-0 ["-f" kaem_M1 "--little-endian" "-o" out];
+
+  kaem_hex2 = run "kaem.hex2" M1 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/x86_defs.M1"
+    "-f" "${m2libc}/x86/libc-full.M1"
+    "-f" kaem_M1
+    "-f" kaem-footer_M1
+    "-o" out
+  ];
+
+  kaem-unwrapped = run "kaem-unwrapped" hex2 [
+    "--architecture" "x86"
+    "--little-endian"
+    "-f" "${m2libc}/x86/ELF-x86-debug.hex2"
+    "-f" kaem_hex2
+    "--base-address" "0x8048000"
+    "-o" out
+  ];
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
new file mode 100644
index 000000000000..83d89012b0fc
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
@@ -0,0 +1,172 @@
+# Bootstrappable TCC is a fork from mainline TCC development
+# that can be compiled by MesCC
+
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.26/tcc-0.9.26.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, callPackage
+, fetchurl
+, kaem
+, mes
+, mes-libc
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes recompileLibc;
+
+  version = "unstable-2023-04-20";
+  rev = "80114c4da6b17fbaabb399cc29f427e368309bc8";
+
+  tarball = fetchurl {
+    url = "https://gitlab.com/janneke/tinycc/-/archive/${rev}/tinycc-${rev}.tar.gz";
+    sha256 = "1a0cw9a62qc76qqn5sjmp3xrbbvsz2dxrw21lrnx9q0s74mwaxbq";
+  };
+  src = (kaem.runCommand "tinycc-bootstrappable-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+
+    # Patch
+    cd tinycc-${rev}
+    # Static link by default
+    replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+  '') + "/tinycc-${rev}";
+
+  meta = with lib; {
+    description = "Tiny C Compiler's bootstrappable fork";
+    homepage = "https://gitlab.com/janneke/tinycc";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  pname = "tinycc-boot-mes";
+
+  tinycc-boot-mes = rec {
+    compiler = kaem.runCommand "${pname}-${version}" {
+      passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+        ${result}/bin/tcc -version
+        mkdir ''${out}
+      '';
+    } ''
+      catm config.h
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -S \
+        -o tcc.s \
+        -I . \
+        -D BOOTSTRAP=1 \
+        -I ${src} \
+        -D TCC_TARGET_I386=1 \
+        -D inline= \
+        -D CONFIG_TCCDIR=\"\" \
+        -D CONFIG_SYSROOT=\"\" \
+        -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+        -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
+        -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+        -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+        -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
+        -D CONFIG_TCC_LIBTCC1_MES=0 \
+        -D CONFIG_TCCBOOT=1 \
+        -D CONFIG_TCC_STATIC=1 \
+        -D CONFIG_USE_LIBGCC=1 \
+        -D TCC_MES_LIBC=1 \
+        -D TCC_VERSION=\"${version}\" \
+        -D ONE_SOURCE=1 \
+        ${src}/tcc.c
+      mkdir -p ''${out}/bin
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -L ${mes.libs}/lib \
+        -l c+tcc \
+        -o ''${out}/bin/tcc \
+        tcc.s
+    '';
+
+    libs = recompileLibc {
+      inherit pname version;
+      tcc = compiler;
+      src = mes-libc;
+      libtccOptions = mes-libc.CFLAGS;
+    };
+  };
+
+  # Bootstrap stage build flags obtained from
+  # https://gitlab.com/janneke/tinycc/-/blob/80114c4da6b17fbaabb399cc29f427e368309bc8/boot.sh
+
+  tinycc-boot0 = buildTinyccMes {
+    pname = "tinycc-boot0";
+    inherit src version meta;
+    prev = tinycc-boot-mes;
+    buildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+    ];
+  };
+
+  tinycc-boot1 = buildTinyccMes {
+    pname = "tinycc-boot1";
+    inherit src version meta;
+    prev = tinycc-boot0;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot2 = buildTinyccMes {
+    pname = "tinycc-boot2";
+    inherit src version meta;
+    prev = tinycc-boot1;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot3 = buildTinyccMes {
+    pname = "tinycc-boot3";
+    inherit src version meta;
+    prev = tinycc-boot2;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-bootstrappable";
+  inherit src version meta;
+  prev = tinycc-boot3;
+  buildOptions = [
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+  ];
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
new file mode 100644
index 000000000000..28dde3298767
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
@@ -0,0 +1,104 @@
+{ lib
+, kaem
+, mes-libc
+}:
+
+rec {
+
+  # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+  recompileLibc =
+    { tcc
+    , pname
+    , version
+    , src
+    , libtccOptions
+    }:
+    let
+
+    crt = kaem.runCommand "crt" {} ''
+      mkdir -p ''${out}/lib
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
+    '';
+
+    library = lib: options: source: kaem.runCommand "${lib}.a" {} ''
+      ${tcc}/bin/tcc ${options} -c -o ${lib}.o ${source}
+      ${tcc}/bin/tcc -ar cr ''${out} ${lib}.o
+    '';
+
+    libtcc1 = library "libtcc1" libtccOptions "${src}/lib/libtcc1.c";
+    libc = library "libc" mes-libc.CFLAGS "${mes-libc}/lib/libc.c";
+    libgetopt = library "libgetopt" mes-libc.CFLAGS "${mes-libc}/lib/libgetopt.c";
+  in
+  kaem.runCommand "${pname}-libs-${version}" {} ''
+    mkdir -p ''${out}/lib
+    cp ${crt}/lib/crt1.o ''${out}/lib
+    cp ${crt}/lib/crtn.o ''${out}/lib
+    cp ${crt}/lib/crti.o ''${out}/lib
+    cp ${libtcc1} ''${out}/lib/libtcc1.a
+    cp ${libc} ''${out}/lib/libc.a
+    cp ${libgetopt} ''${out}/lib/libgetopt.a
+  '';
+
+  buildTinyccMes =
+    { pname
+    , version
+    , src
+    , prev
+    , buildOptions
+    , libtccBuildOptions
+    , meta
+    }:
+    let
+      options = lib.strings.concatStringsSep " " buildOptions;
+      libtccOptions = lib.strings.concatStringsSep " "
+        (["-c" "-D" "TCC_TARGET_I386=1" ] ++ libtccBuildOptions);
+      compiler =  kaem.runCommand "${pname}-${version}" {
+        inherit pname version meta;
+        passthru.tests = rec {
+          get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+          chain = result: kaem.runCommand "${pname}-chain-${version}" {} ''
+            echo ${prev.compiler.tests.chain or prev.compiler.tests.get-version};
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+        };
+      } ''
+        catm config.h
+        mkdir -p ''${out}/bin
+        ${prev.compiler}/bin/tcc \
+          -B ${prev.libs}/lib \
+          -g \
+          -v \
+          -o ''${out}/bin/tcc \
+          -D BOOTSTRAP=1 \
+          ${options} \
+          -I . \
+          -I ${src} \
+          -D TCC_TARGET_I386=1 \
+          -D CONFIG_TCCDIR=\"\" \
+          -D CONFIG_SYSROOT=\"\" \
+          -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+          -D CONFIG_TCC_ELFINTERP=\"\" \
+          -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+          -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+          -D TCC_LIBGCC=\"libc.a\" \
+          -D TCC_LIBTCC1=\"libtcc1.a\" \
+          -D CONFIG_TCCBOOT=1 \
+          -D CONFIG_TCC_STATIC=1 \
+          -D CONFIG_USE_LIBGCC=1 \
+          -D TCC_MES_LIBC=1 \
+          -D TCC_VERSION=\"${version}\" \
+          -D ONE_SOURCE=1 \
+          ${src}/tcc.c
+      '';
+    libs = recompileLibc {
+      inherit pname version src libtccOptions;
+      tcc = compiler;
+    };
+  in { inherit prev compiler libs; };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
new file mode 100644
index 000000000000..55f6321412db
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
@@ -0,0 +1,96 @@
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.27/tcc-0.9.27.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, fetchurl
+, callPackage
+, kaem
+, tinycc-bootstrappable
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes;
+
+  version = "unstable-2023-04-20";
+  rev = "86f3d8e33105435946383aee52487b5ddf918140";
+
+  tarball = fetchurl {
+    url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
+    sha256 = "11idrvbwfgj1d03crv994mpbbbyg63j1k64lw1gjy7mkiifw2xap";
+  };
+  src = (kaem.runCommand "tinycc-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+
+    # Patch
+    cd tinycc-${builtins.substring 0 7 rev}
+    # Static link by default
+    replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+  '') + "/tinycc-${builtins.substring 0 7 rev}";
+
+  meta = with lib; {
+    description = "Small, fast, and embeddable C compiler and interpreter";
+    homepage = "https://repo.or.cz/w/tinycc.git";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  tccdefs = kaem.runCommand "tccdefs-${version}" {} ''
+    mkdir ''${out}
+    ${tinycc-bootstrappable.compiler}/bin/tcc \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      -DC2STR \
+      -o c2str \
+      ${src}/conftest.c
+    ./c2str ${src}/include/tccdefs.h ''${out}/tccdefs_.h
+  '';
+
+  tinycc-mes-boot = buildTinyccMes {
+    pname = "tinycc-mes-boot";
+    inherit src version meta;
+    prev = tinycc-bootstrappable;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-mes";
+  inherit src version meta;
+  prev = tinycc-mes-boot;
+  buildOptions = [
+    "-std=c99"
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
new file mode 100644
index 000000000000..bba6edae973a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPlatform
+, callPackage
+, kaem
+, mescc-tools-extra
+, checkMeta
+}:
+rec {
+  derivationWithMeta = attrs:
+    let
+      passthru = attrs.passthru or {};
+      validity = checkMeta.assertValidity { inherit meta attrs; };
+      meta = checkMeta.commonMeta { inherit validity attrs; };
+      baseDrv = derivation ({
+        inherit (buildPlatform) system;
+        inherit (meta) name;
+      } // (builtins.removeAttrs attrs [ "meta" "passthru" ]));
+      passthru' = passthru // lib.optionalAttrs (passthru ? tests) {
+        tests = lib.mapAttrs (_: f: f baseDrv) passthru.tests;
+      };
+    in
+    lib.extendDerivation
+      validity.handled
+      ({ inherit meta; passthru = passthru'; } // passthru')
+      baseDrv;
+
+  writeTextFile =
+    { name # the name of the derivation
+    , text
+    , executable ? false # run chmod +x ?
+    , destination ? ""   # relative path appended to $out eg "/bin/foo"
+    , allowSubstitutes ? false
+    , preferLocalBuild ? true
+    }:
+    derivationWithMeta {
+      inherit name text allowSubstitutes preferLocalBuild;
+      passAsFile = [ "text" ];
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "write-text-file.kaem" (''
+          target=''${out}''${destination}
+        '' + lib.optionalString (builtins.dirOf destination == ".") ''
+          mkdir -p ''${out}''${destinationDir}
+        '' + ''
+          cp ''${textPath} ''${target}
+        '' + lib.optionalString executable ''
+          chmod 555 ''${target}
+        ''))
+      ];
+
+      PATH = lib.makeBinPath [ mescc-tools-extra ];
+      destinationDir = builtins.dirOf destination;
+      inherit destination;
+    };
+
+  writeText = name: text: writeTextFile {inherit name text;};
+
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
index 6d737ea6bad3..ee172f81f6df 100644
--- a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "mmc-utils";
-  version = "unstable-2022-07-13";
+  version = "unstable-2023-04-17";
 
   src = fetchzip rec {
     url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/snapshot/mmc-utils-${passthru.rev}.tar.gz";
-    passthru.rev = "d7b343fd262880994f041ce2335442e7bd1071f5";
-    sha256 = "cTF3xSNvZ1wifItPmflNFd+fpYArPRvinM7Cyg3JoeE=";
+    passthru.rev = "145c74ab6f2e13a9a8ccdbbf1758afedb8a3965c";
+    sha256 = "cYLIO83uZHDe1COKtSN0SyFOoC3qrqMP0RNsOO9cQ70=";
   };
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "prefix=$(out)" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/molly-guard/default.nix b/nixpkgs/pkgs/os-specific/linux/molly-guard/default.nix
index de396e4f5c76..1100751f451e 100644
--- a/nixpkgs/pkgs/os-specific/linux/molly-guard/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/molly-guard/default.nix
@@ -11,10 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ dpkg ];
 
-  sourceRoot = ".";
-
   unpackCmd = ''
-    dpkg-deb -x "$src" .
+    dpkg-deb -x "$src" source
   '';
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
index 437fe9bd1bd9..bb753e70aa98 100644
--- a/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -1,36 +1,37 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, perl, lvm2, libaio, readline, systemd, liburcu, json_c, kmod, nixosTests }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, coreutils
+, pkg-config
+, perl
+, lvm2
+, libaio
+, readline
+, systemd
+, liburcu
+, json_c
+, linuxHeaders
+, cmocka
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
-  version = "0.8.3";
+  version = "0.9.4";
 
-  src = fetchurl {
-    name = "${pname}-${version}.tar.gz";
-    url = "https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=snapshot;h=refs/tags/${version};sf=tgz";
-    sha256 = "1mgjylklh1cx8px8ffgl12kyc0ln3445vbabd2sy8chq31rpiiq8";
+  src = fetchFromGitHub {
+    owner = "opensvc";
+    repo = "multipath-tools";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-CPvtnjzkyxKXrT8+YXaIgDA548h8X61+jCxMHKFfEyg=";
   };
 
-  patches = [
-    # fix build with json-c 0.14 https://www.redhat.com/archives/dm-devel/2020-May/msg00261.html
-    ./json-c-0.14.patch
-
-    # pull upstream fix for -fno-common toolchains like clang-12
-    (fetchpatch {
-        name = "fno-common.patch";
-        url = "https://github.com/opensvc/multipath-tools/commit/23a9247fa89cd0c84fe7e0f32468fd698b1caa48.patch";
-        sha256 = "10hq0g2jfkfbmwhm4x4q5cgsswj30lm34ib153alqzjzsxc1hqjk";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace libmultipath/Makefile \
-      --replace /usr/include/libdevmapper.h ${lib.getDev lvm2}/include/libdevmapper.h
+    substituteInPlace create-config.mk \
+      --replace /bin/echo ${coreutils}/bin/echo
 
-    # systemd-udev-settle.service is deprecated.
     substituteInPlace multipathd/multipathd.service \
-      --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
-      --replace /sbin/multipathd "$out/bin/multipathd" \
-      --replace " systemd-udev-settle.service" ""
+      --replace /sbin/multipathd "$out/bin/multipathd"
 
     sed -i -re '
       s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
@@ -39,24 +40,34 @@ stdenv.mkDerivation rec {
       kpartx/Makefile libmpathpersist/Makefile
     sed -i -e "s,GZIP,GZ," \
       $(find * -name Makefile\*)
+
+    sed '1i#include <assert.h>' -i tests/{util,vpd}.c
   '';
 
   nativeBuildInputs = [ pkg-config perl ];
-  buildInputs = [ systemd lvm2 libaio readline liburcu json_c ];
+  buildInputs = [ systemd lvm2 libaio readline liburcu json_c linuxHeaders ];
 
   makeFlags = [
     "LIB=lib"
     "prefix=$(out)"
+    "systemd_prefix=$(out)"
+    "kernel_incdir=${linuxHeaders}/include/"
     "man8dir=$(out)/share/man/man8"
     "man5dir=$(out)/share/man/man5"
     "man3dir=$(out)/share/man/man3"
-    "SYSTEMDPATH=lib"
   ];
 
+  doCheck = true;
+  preCheck = ''
+    # skip test attempting to access /sys/dev/block
+    substituteInPlace tests/Makefile --replace ' devt ' ' '
+  '';
+  nativeCheckInputs = [ cmocka ];
+
   passthru.tests = { inherit (nixosTests) iscsi-multipath-root; };
 
   meta = with lib; {
-    description = "Tools for the Linux multipathing driver";
+    description = "Tools for the Linux multipathing storage driver";
     homepage = "http://christophe.varoqui.free.fr/";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch b/nixpkgs/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
deleted file mode 100644
index d5fee4248830..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/libdmmp/libdmmp_private.h b/libdmmp/libdmmp_private.h
-index ac85b63f..b1a6ddea 100644
---- a/libdmmp/libdmmp_private.h
-+++ b/libdmmp/libdmmp_private.h
-@@ -30,6 +30,7 @@
- #include <stdint.h>
- #include <string.h>
- #include <assert.h>
-+#include <stdbool.h>
- #include <json.h>
- 
- #include "libdmmp/libdmmp.h"
-@@ -82,7 +83,7 @@ static out_type func_name(struct dmmp_context *ctx, const char *var_name) { \
- do { \
- 	json_type j_type = json_type_null; \
- 	json_object *j_obj_tmp = NULL; \
--	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != TRUE) { \
-+	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != true) { \
- 		_error(ctx, "Invalid JSON output from multipathd IPC: " \
- 		       "key '%s' not found", key); \
- 		rc = DMMP_ERR_IPC_ERROR; \
diff --git a/nixpkgs/pkgs/os-specific/linux/musl/default.nix b/nixpkgs/pkgs/os-specific/linux/musl/default.nix
index fb0d19115da3..e0d20c772e0c 100644
--- a/nixpkgs/pkgs/os-specific/linux/musl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/musl/default.nix
@@ -4,20 +4,24 @@
 }:
 let
   cdefs_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    name = "sys-cdefs.h";
+    url = "https://git.alpinelinux.org/aports/plain/main/libc-dev/sys-cdefs.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
   };
   queue_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    name = "sys-queue.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-queue.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
   };
   tree_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    name = "sys-tree.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-tree.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
   stack_chk_fail_local_c = fetchurl {
-    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    name = "__stack_chk_fail_local.c";
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?id=9afbe3cbbf4c30ff23c733218c3c03d7e8c6461d";
     sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
   };
 
@@ -67,6 +71,12 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/87606e25afac6776d1bbc67ed284434ec5a832b4/toolchain/musl/patches/300-relative.patch";
       sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
     })
+
+    # fix parsing lines with optional fields in fstab etc. NOTE: Remove for the next release since it has been merged upstream
+    (fetchurl {
+      url = "https://git.musl-libc.org/cgit/musl/patch/?id=751bee0ee727e8d8b003c87cff77ac76f1dbecd6";
+      sha256 = "sha256-qCw132TCSaZrkISmtDb8Q8ufyt8sAJdwACkvfwuoi/0=";
+    })
   ];
   CFLAGS = [ "-fstack-protector-strong" ]
     ++ lib.optional stdenv.hostPlatform.isPower "-mlong-double-64";
@@ -79,7 +89,7 @@ stdenv.mkDerivation rec {
     "--syslibdir=${placeholder "out"}/lib"
   ];
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "bin" "dev" ];
 
   dontDisableStatic = true;
   dontAddStaticConfigureFlags = true;
@@ -88,12 +98,11 @@ stdenv.mkDerivation rec {
   NIX_DONT_SET_RPATH = true;
 
   preBuild = ''
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
     "# the -x c flag is required since the file extension confuses gcc
     # that detect the file as a linker script.
     $CC -x c -c ${stack_chk_fail_local_c} -o __stack_chk_fail_local.o
     $AR r libssp_nonshared.a __stack_chk_fail_local.o"
-      else ""
     }
   '';
 
@@ -102,19 +111,12 @@ stdenv.mkDerivation rec {
     # Apparently glibc provides scsi itself?
     (cd $dev/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
 
-    # Strip debug out of the static library
-    $STRIP -S $out/lib/libc.a
-    mkdir -p $out/bin
-
-
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
-      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a
-      $STRIP -S $out/lib/libssp_nonshared.a"
-      else ""
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
+      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a"
     }
 
     # Create 'ldd' symlink, builtin
-    ln -rs $out/lib/libc.so $out/bin/ldd
+    ln -s $out/lib/libc.so $bin/bin/ldd
 
     # (impure) cc wrapper around musl for interactive usuage
     for i in musl-gcc musl-clang ld.musl-clang; do
@@ -125,7 +127,7 @@ stdenv.mkDerivation rec {
       --replace $out/lib/musl-gcc.specs $dev/lib/musl-gcc.specs
 
     # provide 'iconv' utility, using just-built headers, libc/ldso
-    $CC ${iconv_c} -o $out/bin/iconv \
+    $CC ${iconv_c} -o $bin/bin/iconv \
       -I$dev/include \
       -L$out/lib -Wl,-rpath=$out/lib \
       -lc \
@@ -147,7 +149,13 @@ stdenv.mkDerivation rec {
     homepage    = "https://musl.libc.org/";
     changelog   = "https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?h=v${version}";
     license     = licenses.mit;
-    platforms   = platforms.linux;
+    platforms   = [
+      "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux"
+      "armv7l-linux" "i686-linux" "x86_64-linux" "m68k-linux"
+      "microblaze-linux" "microblazeel-linux" "mipsel-linux"
+      "mips64el-linux" "powerpc64-linux" "powerpc64le-linux"
+      "riscv64-linux" "s390x-linux"
+    ];
     maintainers = with maintainers; [ thoughtpolice dtzWill ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/mwprocapture/default.nix b/nixpkgs/pkgs/os-specific/linux/mwprocapture/default.nix
index 2286e86df72c..681307a00b29 100644
--- a/nixpkgs/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -12,12 +12,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mwprocapture";
-  subVersion = "4236";
+  subVersion = "4328";
   version = "1.3.0.${subVersion}-${kernel.version}";
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "1mfgj84km276sq5i8dny1vqp2ycqpvgplrmpbqwnk230d0w3qs74";
+    sha256 = "197l86ad52ijmmq5an6891gd1chhkxqiagamcchirrky4c50qs36";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+
   postInstall = ''
     cd ../
     mkdir -p $out/bin
@@ -55,8 +57,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    broken = kernel.kernelAtLeast "5.16";
-    homepage = "http://www.magewell.com/";
+    homepage = "https://www.magewell.com/";
     description = "Linux driver for the Magewell Pro Capture family";
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ MP2E ];
diff --git a/nixpkgs/pkgs/os-specific/linux/mxu11x0/default.nix b/nixpkgs/pkgs/os-specific/linux/mxu11x0/default.nix
index ee29180a8d9d..17d0c6938206 100644
--- a/nixpkgs/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
 
   version = mxu_version + "-${kernel.version}";
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   preBuild = ''
-    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
-    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/mxu11x0/srcs.nix b/nixpkgs/pkgs/os-specific/linux/mxu11x0/srcs.nix
index 5c4e9137c6a6..1f7b75e6bc1e 100644
--- a/nixpkgs/pkgs/os-specific/linux/mxu11x0/srcs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mxu11x0/srcs.nix
@@ -5,14 +5,14 @@
     version = "4.1";
     src = fetchurl {
       url = "https://www.moxa.com/getmedia/b152d8c2-b9d6-4bc7-b0f4-420633b4bc2d/moxa-uport-1100-series-linux-kernel-4.x-driver-v4.1.tgz";
-      sha256 = "sha256-sbq5M5FQjrrORtSS07PQHf+MAZArxFcUDN5wszBwbnc=";
+      sha256 = "sha256-cM3imuMG483ZinFazVa8V4Id0kUGlHaezDHnYtSSb28=";
     };
   };
   mxu11x0_5 = {
     version = "5.1";
     src = fetchurl {
       url = "https://www.moxa.com/getmedia/57dfa4c1-8a2a-4da6-84c1-a36944ead74d/moxa-uport-1100-series-linux-kernel-5.x-driver-v5.1.tgz";
-      sha256 = "sha256-pdFIiD5naSDdYwRz8ww8Mg8z1gDOfZ/OeO6Q5n+kjDQ=";
+      sha256 = "sha256-P1YMlyAhS955CSBiZ/tyu5m6ds2PiFMcHmyrdTjloPs=";
     };
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/net-tools/mptcp.nix b/nixpkgs/pkgs/os-specific/linux/net-tools/mptcp.nix
deleted file mode 100644
index b4ce59a7c68d..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/net-tools/mptcp.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, nettools, fetchFromGitHub  }:
-
-nettools.overrideAttrs(oa: rec {
-  pname = "net-tools-mptcp";
-  version = "0.95";
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "net-tools";
-    rev = "mptcp_v${version}";
-    sha256 = "0i7gr1y699nc7j9qllsx8kicqkpkhw51x4chcmyl5xs06b2mdjri";
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/multipath-tcp/net-tools";
-    description = "A set of tools for controlling the network subsystem in Linux";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ teto ];
-  };
-})
diff --git a/nixpkgs/pkgs/os-specific/linux/netatop/default.nix b/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
index b892292477ce..d7d04e8368db 100644
--- a/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   buildInputs = [ kmod zlib ];
 
   hardeningDisable = [ "pic" ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-fallthrough" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
 
   patches = [
     # fix paths in netatop.service
diff --git a/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix b/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
index df2b66e9079a..26b0f67b6c43 100644
--- a/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "new-lg4ff";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "berarma";
     repo = "new-lg4ff";
     rev = "${version}";
-    sha256 = "+05xDpNI4m6wTS+YPgA0fP4iM10nMOZOtCrdQxpevBU=";
+    sha256 = "ZFwNdeJcSxzWtqjOF86SZpqhuz8jXZ2drvlQeIqsaNY=";
   };
 
   preBuild = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/nfs-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/nfs-utils/default.nix
index 7b5f6e720018..4fde1dcf910d 100644
--- a/nixpkgs/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nfs-utils";
-  version = "2.5.1";
+  version = "2.6.2";
 
   src = fetchurl {
-    url = "https://kernel.org/pub/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1i1h3n2m35q9ixs1i2qf1rpjp10cipa3c25zdf1xj1vaw5q8270g";
+    url = "mirror://kernel/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
+    hash = "sha256-UgCHPoHE1hDiRi/CYv4YE18tvni3l5+VrM0VmuZNUBE=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
@@ -46,13 +46,10 @@ stdenv.mkDerivation rec {
       "--enable-libmount-mount"
       "--with-pluginpath=${placeholder "lib"}/lib/libnfsidmap" # this installs libnfsidmap
       "--with-rpcgen=${buildPackages.rpcsvc-proto}/bin/rpcgen"
+      "--with-modprobedir=${placeholder "out"}/etc/modprobe.d"
     ];
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/0011-exportfs-only-do-glibc-specific-hackery-on-glibc.patch";
-      sha256 = "0rrddrykz8prk0dcgfvmnz0vxn09dbgq8cb098yjjg19zz6d7vid";
-    })
     # http://openwall.com/lists/musl/2015/08/18/10
     (fetchpatch {
       url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/musl-getservbyport.patch";
@@ -71,6 +68,9 @@ stdenv.mkDerivation rec {
       substituteInPlace systemd/nfs-utils.service \
         --replace "/bin/true" "${coreutils}/bin/true"
 
+      substituteInPlace tools/nfsrahead/Makefile.in \
+        --replace "/usr/lib/udev/rules.d/" "$out/lib/udev/rules.d/"
+
       substituteInPlace utils/mount/Makefile.in \
         --replace "chmod 4511" "chmod 0511"
 
diff --git a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
index 8339eabb495a..26c7b6a9ea34 100644
--- a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.4";
+  version = "1.0.7";
   pname = "nftables";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-kn+x/qH2haMowQz3ketlXX4e1J0xDupcsxAd/Y1sujU=";
+    url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
+    hash = "sha256-wSrJQf/5ra7fFzZ9XOITeJuYoNMUJ3vCKz1x4QiR9BI=";
   };
 
   nativeBuildInputs = [
@@ -43,5 +43,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ izorkin ajs124 ];
+    mainProgram = "nft";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
index b54f9e36515d..6e0af1217219 100644
--- a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nix-ld";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "mic92";
     repo = "nix-ld";
     rev = version;
-    sha256 = "sha256-DlWU5i/MykqWgB9vstYbECy3e+XagXWCxi+XDJNey0s=";
+    sha256 = "sha256-dM9YPN+yq6sHmRhJQinYdAVXBkTgEtrVQcsd/mIIX0o=";
   };
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/default.nix b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/default.nix
index 34611d3f4009..b0a00972eca2 100644
--- a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -23,7 +23,8 @@ substituteAll {
 
   # run some a simple installer tests to make sure nixos-rebuild still works for them
   passthru.tests = {
-    simple-installer-test = nixosTests.installer.simple;
+    simple-installer = nixosTests.installer.simple;
+    specialisations = nixosTests.nixos-rebuild-specialisations;
   };
 
   meta = {
diff --git a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index ebbb596f91f6..f90da9db3bf8 100755
--- a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -28,7 +28,8 @@ rollback=
 upgrade=
 upgrade_all=
 profile=/nix/var/nix/profiles/system
-buildHost=localhost
+specialisation=
+buildHost=
 targetHost=
 remoteSudo=
 verboseScript=
@@ -107,6 +108,14 @@ while [ "$#" -gt 0 ]; do
         fi
         shift 1
         ;;
+      --specialisation|-c)
+        if [ -z "$1" ]; then
+            log "$0: ‘--specialisation’ requires an argument"
+            exit 1
+        fi
+        specialisation="$1"
+        shift 1
+        ;;
       --build-host|h)
         buildHost="$1"
         shift 1
@@ -148,16 +157,6 @@ if [[ -n "$SUDO_USER" || -n $remoteSudo ]]; then
     maybeSudo=(sudo --preserve-env="$preservedSudoVars" --)
 fi
 
-if [[ -z "$buildHost" && -n "$targetHost" ]]; then
-    buildHost="$targetHost"
-fi
-if [ "$targetHost" = localhost ]; then
-    targetHost=
-fi
-if [ "$buildHost" = localhost ]; then
-    buildHost=
-fi
-
 # log the given argument to stderr if verbose mode is on
 logVerbose() {
     if [ -n "$verboseScript" ]; then
@@ -371,6 +370,10 @@ if [[ -n $flake ]]; then
     fi
 fi
 
+if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then
+    log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’"
+    exit 1
+fi
 
 tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
 
@@ -565,7 +568,18 @@ fi
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
 if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
-    if ! targetHostCmd "$pathToConfig/bin/switch-to-configuration" "$action"; then
+    if [[ -z "$specialisation" ]]; then
+        cmd="$pathToConfig/bin/switch-to-configuration"
+    else
+        cmd="$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration"
+
+        if [[ ! -f "$cmd" ]]; then
+            log "error: specialisation not found: $specialisation"
+            exit 1
+        fi
+    fi
+
+    if ! targetHostCmd "$cmd" "$action"; then
         log "warning: error(s) occurred while switching to the new configuration"
         exit 1
     fi
diff --git a/nixpkgs/pkgs/os-specific/linux/nmon/default.nix b/nixpkgs/pkgs/os-specific/linux/nmon/default.nix
index 41c16f9f394c..4dfacd4404fd 100644
--- a/nixpkgs/pkgs/os-specific/linux/nmon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nmon/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "AIX & Linux Performance Monitoring tool";
-    homepage = "http://nmon.sourceforge.net";
+    homepage = "https://nmon.sourceforge.net";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ sveitser ];
diff --git a/nixpkgs/pkgs/os-specific/linux/nsncd/default.nix b/nixpkgs/pkgs/os-specific/linux/nsncd/default.nix
new file mode 100644
index 000000000000..da26a13c404e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/nsncd/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, nix-gitignore
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nsncd";
+  version = "unstable-2022-11-14";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nsncd";
+    rev = "47e580f1db99603df6e212a2e62f18cc970cef40";
+    hash = "sha256-Nv3MYZcuYgD66BAGs3Tg37s086HAGsaDBFvELqQF3Tk=";
+  };
+
+  cargoSha256 = "sha256-c1L6nEUBHw1YegmoRrI3WU/bF80Nzbz13hsGlNyBR9o=";
+
+  meta = with lib; {
+    description = "the name service non-caching daemon";
+    longDescription = ''
+      nsncd is a nscd-compatible daemon that proxies lookups, without caching.
+    '';
+    homepage = "https://github.com/twosigma/nsncd";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ flokli ninjatrappeur ];
+    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/numactl/default.nix b/nixpkgs/pkgs/os-specific/linux/numactl/default.nix
index 2f8a4feb0301..998b7d052b35 100644
--- a/nixpkgs/pkgs/os-specific/linux/numactl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/numactl/default.nix
@@ -2,15 +2,17 @@
 
 stdenv.mkDerivation rec {
   pname = "numactl";
-  version = "2.0.14";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0hahpdp5xqy9cbg251bdxqkml341djn2h856g435h4ngz63sr9fs";
+    sha256 = "sha256-aDKzkmvrPDzQl4n0KgeiU5LOLhQA0tmwzGiXvJDp7ZI=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/numatop/default.nix b/nixpkgs/pkgs/os-specific/linux/numatop/default.nix
index 0946d5050db4..ad0138f18b75 100644
--- a/nixpkgs/pkgs/os-specific/linux/numatop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/numatop/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ numactl ncurses ];
-  checkInputs = [ check ];
+  nativeCheckInputs = [ check ];
 
   patches = [
     (fetchpatch {
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/builder.sh b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/builder.sh
index a7746194570c..2b0f55c03879 100755
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -1,8 +1,9 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 unpackManually() {
     skip=$(sed 's/^skip=//; t; d' $src)
-    tail -n +$skip $src | xz -d | tar xvf -
+    tail -n +$skip $src | bsdtar xvf -
     sourceRoot=.
 }
 
@@ -125,6 +126,12 @@ installPhase() {
         fi
     done
 
+
+    # OptiX tries loading `$ORIGIN/nvoptix.bin` first
+    if [ -e nvoptix.bin ]; then
+        install -Dm444 -t $out/lib/ nvoptix.bin
+    fi
+
     if [ -n "$bin" ]; then
         # Install the X drivers.
         mkdir -p $bin/lib/xorg/modules
@@ -153,7 +160,7 @@ installPhase() {
 
     if [ -n "$firmware" ]; then
         # Install the GSP firmware
-        install -Dm644 firmware/gsp.bin $firmware/lib/firmware/nvidia/$version/gsp.bin
+        install -Dm644 -t $firmware/lib/firmware/nvidia/$version firmware/gsp*.bin
     fi
 
     # All libs except GUI-only are installed now, so fixup them.
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index bc66e3c8b7eb..1b47c400395f 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -1,4 +1,4 @@
-{ lib, callPackage, fetchpatch, fetchurl, stdenv, pkgsi686Linux }:
+{ lib, callPackage, fetchFromGitHub, fetchurl, fetchpatch, stdenv, pkgsi686Linux }:
 
 let
   generic = args: let
@@ -25,39 +25,54 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "515.65.01";
-    sha256_64bit = "sha256-BJLdxbXmWqAMvHYujWaAIFyNCOEDtxMQh6FRJq7klek=";
-    openSha256 = "sha256-GCCDnaDsbXTmbCYZBCM3fpHmOSWti/DkBJwYrRGAMPI=";
-    settingsSha256 = "sha256-kBELMJCIWD9peZba14wfCoxsi3UXO3ehFYcVh4nvzVg=";
-    persistencedSha256 = "sha256-P8oT7g944HvNk2Ot/0T0sJM7dZs+e0d+KwbwRrmsuDY=";
+    version = "525.116.04";
+    sha256_64bit = "sha256-hhDsgkR8/3LLXxizZX7ppjSlFRZiuK2QHrgfTE+2F/4=";
+    sha256_aarch64 = "sha256-k7k22z5PYZdBVfuYXVcl9SFUMqZmK4qyxoRwlYyRdgU=";
+    openSha256 = "sha256-dktHCoESqoNfu5M73aY5MQGROlZawZwzBqs3RkOyfoQ=";
+    settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
+    persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
+
+    ibtSupport = true;
   };
 
   latest = selectHighestVersion production (generic {
-    version = "495.46";
-    sha256_64bit = "2Dt30X2gxUZnqlsT1uqVpcUTBCV7Hs8vjUo7WuMcYvU=";
-    settingsSha256 = "vbcZYn+UBBGwjfrJ6SyXt3+JLBeNcXK4h8mjj7qxZPk=";
-    persistencedSha256 = "ieYqkVxe26cLw1LUgBsFSSowAyfZkTcItIzQCestCXI=";
+    version = "530.41.03";
+    sha256_64bit = "sha256-riehapaMhVA/XRYd2jQ8FgJhKwJfSu4V+S4uoKy3hLE=";
+    sha256_aarch64 = "sha256-uM5zMEO/AO32VmqUOzmc05FFm/lz76jPSSaQmeZUlFo=";
+    openSha256 = "sha256-etbtw6LMRUcFoZC9EDDRrTDekV8JFRYmkp3idLaMk5g=";
+    settingsSha256 = "sha256-8KB6T9f+gWl8Ni+uOyrJKiiH5mNx9eyfCcW/RjPTQQA=";
+    persistencedSha256 = "sha256-zrstlt/0YVGnsPGUuBbR9ULutywi2wNDVxh7OhJM7tM=";
+
+    patchFlags = [ "-p1" "-d" "kernel" ];
+    patches = [
+      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
+      (fetchpatch {
+        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
+        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
+      })
+    ];
   });
 
   beta = selectHighestVersion latest (generic {
-    version = "515.43.04";
-    sha256_64bit = "sha256-PodaTTUOSyMW8rtdtabIkSLskgzAymQyfToNlwxPPcc=";
-    openSha256 = "sha256-1bAr5dWZ4jnY3Uo2JaEz/rhw2HuW9LZ5bACmA1VG068=";
-    settingsSha256 = "sha256-j47LtP6FNTPfiXFh9KwXX8vZOQzlytA30ZfW9N5F2PY=";
-    persistencedSha256 = "sha256-hULBy0wnVpLH8I0L6O9/HfgvJURtE2whpXOgN/vb3Wo=";
+    version = "535.43.02";
+    sha256_64bit = "sha256-4KTdk4kGDmBGyHntMIzWRivUpEpzmra+p7RBsTL8mYM=";
+    sha256_aarch64 = "sha256-0blD8R+xpOVlitWefIbtw1d3KAnmWHBy7hkxGZHBrE4=";
+    openSha256 = "sha256-W1fwbbEEM7Z/S3J0djxGTtVTewbSALqX1G1OSpdajCM=";
+    settingsSha256 = "sha256-j0sSEbtF2fapv4GSthVTkmJga+ycmrGc1OnGpV6jEkc=";
+    persistencedSha256 = "sha256-M0ovNaJo8SZwLW4CQz9accNK79Z5JtTJ9kKwOzicRZ4=";
   });
 
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "470.62.13";
-    persistencedVersion = "470.86";
-    settingsVersion = "470.86";
-    sha256_64bit = "sha256-itBFNPMy+Nn0g8V8qdkRb+ELHj57GRso1lXhPHUxKVI=";
-    settingsSha256 = "sha256-fq6RlD6g3uylvvTjE4MmaQwxPJYU0u6IMfpPVzks0tI=";
-    persistencedSha256 = "sha256-eHvauvh8Wd+b8DK6B3ZWNjoWGztupWrR8iog9ok58io=";
-    url = "https://developer.nvidia.com/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
-    broken = kernel.kernelAtLeast "5.17";
+    version = "525.47.26";
+    persistencedVersion = "525.116.04";
+    settingsVersion = "525.116.04";
+    sha256_64bit = "sha256-QfxEUTi71Pav1qzO0mObmKbsyg6FHTAyc7jkOj9D4lY=";
+    openSha256 = "sha256-QFpFRPpBXAB7v2+NP/M/1T1qKDqjdhigHkktnVyWw20=";
+    settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
+    persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
+    url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
   };
 
   # Update note:
@@ -66,38 +81,62 @@ rec {
 
   # Last one supporting Kepler architecture
   legacy_470 = generic {
-      version = "470.141.03";
-      sha256_64bit = "sha256-vpjSR6Q9dJGmW/3Jl/tlMeFZQ0brEqD6qgRGcs21cJ8=";
-      settingsSha256 = "sha256-OWSUmUBqAxsR3e6EPzcIotpd6nm4Le8hIj4pzJ5WnhE=";
-      persistencedSha256 = "sha256-XsGYGgucDhvPpqtM9IBLfo3tbn7sIobpo5JW/XqOkTo=";
+    version = "470.182.03";
+    sha256_64bit = "sha256-PbwUCPxIuGXT3azvxF9KP8E7kLg6Yo7lRrAIKrLD/Hk=";
+    sha256_aarch64 = "sha256-FEoWikgQjZKkHvAHgtkxnDhB41GdYplZTttEUBit4QQ=";
+    settingsSha256 = "sha256-TRKQ4brLnCbBZt1smGSIHTfwW+wEFPWWPEwDxjVXN7s=";
+    persistencedSha256 = "sha256-fSJMx49z9trdNxx0iPI45oG57smvvhaqVNxsRnfXKCI=";
+
+    patchFlags = [ "-p1" "-d" "kernel" ];
+    patches = [
+      # source: https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf
+      (fetchpatch {
+        url = "https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf/raw/f5d5238bdbaa16cd4008658a0f82b9dd84f1b38f/nvidia-470xx-fix-linux-6.3.patch";
+        hash = "sha256-mR+vXDHgVhWC0JeLgGlbNVCH8XTs7XnhEJS6BV75tI8=";
+      })
+      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
+      (fetchpatch {
+        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
+        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
+      })
+    ];
   };
 
   # Last one supporting x86
   legacy_390 = generic {
-    version = "390.154";
-    sha256_32bit = "sha256-XuhxuEvZ8o4iW3o+Xxvh+eLQBn83uNa40MJRcC8G0+c=";
-    sha256_64bit = "sha256-9EICgMVSEJZMAI1bck8mFYRdR61MnAXY7SamL8YzH3w=";
-    settingsSha256 = "sha256-iNT6//EvtasivDfXPY6j6OrpymbslO/q45uKd5smFUw=";
-    persistencedSha256 = "sha256-y+MkudjQBkuVzHrY/rh7IGRN8VjLsJQ3a+fYDXdrzzk=";
-
-    broken = kernel.kernelAtLeast "5.18";
-
-    patches =
-      let patch390 = o:
-        (lib.optional ((lib.versions.majorMinor kernel.modDirVersion) == o.version) (fetchpatch {
-          inherit (o) sha256;
-          url = "https://gitlab.com/herecura/packages/nvidia-390xx-dkms/-/raw/herecura/kernel-${o.version}.patch";
-        }));
-      in
-        []
-        ++ (patch390 {
-          version = "5.18";
-          sha256 = "sha256-A6itoozgDWmXKQAU0D8bT2vUaZqh5G5Tg3d3E+CLOTs=";
-        })
-      ;
+    version = "390.157";
+    sha256_32bit = "sha256-VdZeCkU5qct5YgDF8Qgv4mP7CVHeqvlqnP/rioD3B5k=";
+    sha256_64bit = "sha256-W+u8puj+1da52BBw+541HxjtxTSVJVPL3HHo/QubMoo=";
+    settingsSha256 = "sha256-uJZO4ak/w/yeTQ9QdXJSiaURDLkevlI81de0q4PpFpw=";
+    persistencedSha256 = "sha256-NuqUQbVt80gYTXgIcu0crAORfsj9BCRooyH3Gp1y1ns=";
+
+    broken = kernel.kernelAtLeast "6.2";
   };
 
-  legacy_340 = generic {
+  legacy_340 = let
+    # Source cooresponding to https://aur.archlinux.org/packages/nvidia-340xx-dkms
+    aurPatches = fetchFromGitHub {
+      owner = "archlinux-jerry";
+      repo = "nvidia-340xx";
+      rev = "f472f9297fe2ae285b954cd3f88abd8e2e255e4f";
+      hash = "sha256-tMA69Wlhi14DMS3O3nfwMX3EiT8pKa6McLxFpAayoEI=";
+    };
+    patchset = [
+      "0001-kernel-5.7.patch"
+      "0002-kernel-5.8.patch"
+      "0003-kernel-5.9.patch"
+      "0004-kernel-5.10.patch"
+      "0005-kernel-5.11.patch"
+      "0006-kernel-5.14.patch"
+      "0007-kernel-5.15.patch"
+      "0008-kernel-5.16.patch"
+      "0009-kernel-5.17.patch"
+      "0010-kernel-5.18.patch"
+      "0011-kernel-6.0.patch"
+      "0012-kernel-6.2.patch"
+      "0013-kernel-6.3.patch"
+    ];
+  in generic {
     version = "340.108";
     sha256_32bit = "1jkwa1phf0x4sgw8pvr9d6krmmr3wkgwyygrxhdazwyr2bbalci0";
     sha256_64bit = "06xp6c0sa7v1b82gf0pq0i5p0vdhmm3v964v0ypw36y0nzqx8wf6";
@@ -105,7 +144,7 @@ rec {
     persistencedSha256 = "1ax4xn3nmxg1y6immq933cqzw6cj04x93saiasdc0kjlv0pvvnkn";
     useGLVND = false;
 
-    broken = kernel.kernelAtLeast "5.5";
-    patches = [ ./vm_operations_struct-fault.patch ];
+    broken = kernel.kernelAtLeast "6.4";
+    patches = map (patch: "${aurPatches}/${patch}") patchset;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
index d6dcc7ad6cd0..2571812b9645 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -2,6 +2,7 @@
 , url ? null
 , sha256_32bit ? null
 , sha256_64bit
+, sha256_aarch64 ? null
 , openSha256 ? null
 , settingsSha256
 , settingsVersion ? version
@@ -11,21 +12,25 @@
 , useProfiles ? true
 , preferGtk2 ? false
 , settings32Bit ? false
+, ibtSupport ? false
 
 , prePatch ? ""
+, postPatch ? null
+, patchFlags ? null
 , patches ? []
 , broken ? false
+, brokenOpen ? broken
 }@args:
 
 { lib, stdenv, callPackage, pkgs, pkgsi686Linux, fetchurl
-, kernel ? null, perl, nukeReferences, which
+, kernel ? null, perl, nukeReferences, which, libarchive
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
   libsOnly ? false
 , # don't include the bundled 32-bit libraries on 64-bit platforms,
   # even if it’s in downloaded binary
-  disable32Bit ? false
+  disable32Bit ? stdenv.hostPlatform.system == "aarch64-linux"
   # 32 bit libs only version of this package
 , lib32 ? null
   # Whether to extract the GSP firmware
@@ -45,7 +50,7 @@ let
   libPathFor = pkgs: lib.makeLibraryPath (with pkgs; [
     libdrm xorg.libXext xorg.libX11
     xorg.libXv xorg.libXrandr xorg.libxcb zlib stdenv.cc.cc
-    wayland mesa libGL
+    wayland mesa libGL openssl
   ]);
 
   self = stdenv.mkDerivation {
@@ -56,18 +61,32 @@ let
     src =
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
-          url = args.url or "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run";
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+          ];
           sha256 = sha256_64bit;
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
-          url = args.url or "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run";
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+          ];
           sha256 = sha256_32bit;
         }
+      else if stdenv.hostPlatform.system == "aarch64-linux" && sha256_aarch64 != null then
+        fetchurl {
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+          ];
+          sha256 = sha256_aarch64;
+        }
       else throw "nvidia-x11 does not support platform ${stdenv.hostPlatform.system}";
 
     patches = if libsOnly then null else patches;
-    inherit prePatch;
+    inherit prePatch postPatch patchFlags;
     inherit version useGLVND useProfiles;
     inherit (stdenv.hostPlatform) system;
     inherit i686bundled;
@@ -96,16 +115,16 @@ let
     libPath = libPathFor pkgs;
     libPath32 = optionalString i686bundled (libPathFor pkgsi686Linux);
 
-    buildInputs = [ which ];
-    nativeBuildInputs = [ perl nukeReferences ]
+    nativeBuildInputs = [ perl nukeReferences which libarchive ]
       ++ optionals (!libsOnly) kernel.moduleBuildDependencies;
 
-    disallowedReferences = optional (!libsOnly) [ kernel.dev ];
+    disallowedReferences = optionals (!libsOnly) [ kernel.dev ];
 
     passthru = {
       open = mapNullable (hash: callPackage ./open.nix {
-        inherit hash broken;
+        inherit hash;
         nvidia_x11 = self;
+        broken = brokenOpen;
       }) openSha256;
       settings = (if settings32Bit then pkgsi686Linux.callPackage else callPackage) (import ./settings.nix self settingsSha256) {
         withGtk2 = preferGtk2;
@@ -113,6 +132,8 @@ let
       };
       persistenced = mapNullable (hash: callPackage (import ./persistenced.nix self hash) { }) persistencedSha256;
       inherit persistencedVersion settingsVersion;
+      compressFirmware = false;
+      ibtSupport = ibtSupport || (lib.versionAtLeast version "530");
     } // optionalAttrs (!i686bundled) {
       inherit lib32;
     };
@@ -121,8 +142,10 @@ let
       homepage = "https://www.nvidia.com/object/unix.html";
       description = "X.org driver and kernel module for NVIDIA graphics cards";
       license = licenses.unfreeRedistributable;
-      platforms = [ "x86_64-linux" ] ++ optionals (!i686bundled) [ "i686-linux" ];
-      maintainers = with maintainers; [ jonringer ];
+      platforms = [ "x86_64-linux" ]
+        ++ optionals (sha256_32bit != null) [ "i686-linux" ]
+        ++ optionals (sha256_aarch64 != null) [ "aarch64-linux" ];
+      maintainers = with maintainers; [ jonringer kiskae ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
       inherit broken;
     };
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/open.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/open.nix
index 3e21dade83ae..a6795c3fd5e7 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/open.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/open.nix
@@ -7,7 +7,7 @@
 , broken ? false
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation ({
   pname = "nvidia-open";
   version = "${kernel.version}-${nvidia_x11.version}";
 
@@ -24,6 +24,10 @@ stdenv.mkDerivation {
     "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
     "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
+    {
+      aarch64-linux = "TARGET_ARCH=aarch64";
+      x86_64-linux = "TARGET_ARCH=x86_64";
+    }.${stdenv.hostPlatform.system}
   ];
 
   installTargets = [ "modules_install" ];
@@ -33,8 +37,10 @@ stdenv.mkDerivation {
     description = "NVIDIA Linux Open GPU Kernel Module";
     homepage = "https://github.com/NVIDIA/open-gpu-kernel-modules";
     license = with licenses; [ gpl2Plus mit ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ nickcao ];
     inherit broken;
   };
-}
+} // lib.optionalAttrs stdenv.hostPlatform.isAarch64 {
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 5276dfd2aff4..febae9110644 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       $out/bin/nvidia-persistenced
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-ltirpc" ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/settings.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/settings.nix
index 884ccdd6c52d..5570228d78bf 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -25,7 +25,7 @@ let
       cd src/libXNVCtrl
     '';
 
-    makeFlags = nvidia_x11.makeFlags ++ [
+    makeFlags = [
       "OUTPUTDIR=." # src/libXNVCtrl
     ];
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation {
   '';
 
   enableParallelBuilding = true;
-  makeFlags = nvidia_x11.makeFlags ++ [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
+  makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
 
   preBuild = ''
     if [ -e src/libXNVCtrl/libXNVCtrl.a ]; then
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch
deleted file mode 100644
index 6ce5c1205e2d..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-https://devtalk.nvidia.com/default/topic/1025051/fully-working-patches-2-of-them-for-nvidia-driver-340-104-compiler-installer-file-and-linux-kernels-4-13-amp-4-14/?offset=5
---- a/kernel/uvm/nvidia_uvm_lite.c
-+++ b/kernel/uvm/nvidia_uvm_lite.c
-@@ -818,8 +818,15 @@ done:
- }
-
- #if defined(NV_VM_OPERATIONS_STRUCT_HAS_FAULT)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0)
- int _fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+#else
-+int _fault(struct vm_fault *vmf)
-+#endif
- {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-+    struct vm_area_struct *vma = vmf->vma;
-+#endif
- #if defined(NV_VM_FAULT_HAS_ADDRESS)
-     unsigned long vaddr = vmf->address;
- #else
-@@ -866,7 +873,11 @@ static struct vm_operations_struct uvmlite_vma_ops =
- // it's dealing with anonymous mapping (see handle_pte_fault).
- //
- #if defined(NV_VM_OPERATIONS_STRUCT_HAS_FAULT)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0)
- int _sigbus_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+#else
-+int _sigbus_fault(struct vm_fault *vmf)
-+#endif
- {
-     vmf->page = NULL;
-     return VM_FAULT_SIGBUS;
diff --git a/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix b/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
index c7819afe3ef4..d267a12266bd 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -1,26 +1,38 @@
 { lib, stdenv, fetchFromGitHub, pkg-config
-, libuuid
+, meson
+, ninja
+, libnvme
+, json_c
+, zlib
+, python3Packages
 }:
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.16";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "sha256-/wDQxsN1sji56zfcvqx02iciYnyxjIbL85bNaRwrHYw=";
+    hash = "sha256-vnhvVVfEDnmEIdIkfTRoiLB7dZ1rJV3U4PmUUoaxTUs=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libuuid ];
+  mesonFlags = [
+    "-Dversion-tag=${version}"
+  ];
 
-  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
-
-  # To omit the hostnqn and hostid files that are impure and should be unique
-  # for each target host:
-  installTargets = [ "install-spec" ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3Packages.nose2
+  ];
+  buildInputs = [
+    libnvme
+    json_c
+    zlib
+  ];
 
   meta = with lib; {
     inherit (src.meta) homepage; # https://nvmexpress.org/
@@ -36,5 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mic92 ];
+    mainProgram = "nvme";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/nixpkgs/pkgs/os-specific/linux/ocf-resource-agents/default.nix
index 8d7f2b527144..11f094f72c9d 100644
--- a/nixpkgs/pkgs/os-specific/linux/ocf-resource-agents/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -42,6 +42,11 @@ let
       python3
     ];
 
+    env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+      # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+      "-Wno-error=maybe-uninitialized"
+    ]);
+
     meta = with lib; {
       homepage = "https://github.com/ClusterLabs/resource-agents";
       description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
diff --git a/nixpkgs/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/nixpkgs/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 75f210f4c228..40ef0796dfa1 100644
--- a/nixpkgs/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "oci-seccomp-bpf-hook";
-  version = "1.2.6";
+  version = "1.2.9";
   src = fetchFromGitHub {
     owner = "containers";
     repo = "oci-seccomp-bpf-hook";
     rev = "v${version}";
-    sha256 = "sha256-+HGVxPBCPIdFwzZf3lFE0MWA2xMKsHQkfDo4zyNgzpg=";
+    sha256 = "sha256-KPO9xqLgPML6smoO7P50yP81b4iCvRFIR74ciUiva7o=";
   };
-  vendorSha256 = null;
+  vendorHash = null;
 
   outputs = [ "out" "man" ];
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/odp-dpdk/default.nix b/nixpkgs/pkgs/os-specific/linux/odp-dpdk/default.nix
index a9dac153b15d..5c8cd9efc986 100644
--- a/nixpkgs/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,32 +1,37 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config
-, dpdk, libbpf, libconfig, libpcap, numactl, openssl, zlib, libbsd, libelf, jansson
-}: let
-  dpdk_19_11 = dpdk.overrideAttrs (old: rec {
-    version = "19.11.12";
-    src = fetchurl {
-      url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-      sha256 = "sha256-F9m2+MZi3n0psPIwjWwhiIbbNkoGlxqtru2OlV7TbzQ=";
-    };
-    mesonFlags = old.mesonFlags ++ [
-      "-Denable_docs=false"
-    ];
-  });
-
-in stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, pkg-config
+, dpdk
+, libbpf
+, libconfig
+, libpcap
+, numactl
+, openssl
+, zlib
+, libbsd
+, libelf
+, jansson
+, libnl
+}:
+
+stdenv.mkDerivation rec {
   pname = "odp-dpdk";
-  version = "1.35.0.0_DPDK_19.11";
+  version = "1.41.0.0_DPDK_22.11";
 
   src = fetchurl {
     url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-R4cRfz0uUDbeQmJfFSIAmq3KfD6CE9hIW2yvFqL+b0M=";
+    hash = "sha256-4p+R+7IeDKQFqBzQTvXfR407exxhoS8pnKxF9Qnr8tw=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
-    dpdk_19_11
+    dpdk
     libconfig
     libpcap
     numactl
@@ -36,6 +41,13 @@ in stdenv.mkDerivation rec {
     libelf
     jansson
     libbpf
+    libnl
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
   ];
 
   # binaries will segfault otherwise
diff --git a/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix b/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
index 32b3e636ac56..38912e0aa215 100644
--- a/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -1,55 +1,60 @@
-{ lib, stdenv, fetchFromGitHub, automake, autoconf, libtool, gettext
-, util-linux, open-isns, openssl, kmod, perl, systemd, pkgconf, nixosTests
-}:
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, pkg-config
+, ninja
+, perl
+, util-linux
+, open-isns
+, openssl
+, kmod
+, systemd
+, runtimeShell
+, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "open-iscsi";
-  version = "2.1.7";
-
-  nativeBuildInputs = [ autoconf automake gettext libtool perl pkgconf ];
-  buildInputs = [ kmod open-isns.lib openssl systemd util-linux ];
+  version = "2.1.8";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-iscsi";
     rev = version;
-    sha256 = "sha256-R1ttHHxVSQ5TGtWVy4I9BAmEJfcRhKRD5jThoeddjUw=";
+    hash = "sha256-JzSyX9zvUkhCEpNwTMneTZpCRgaYxHZ1wP215YnMI78=";
   };
 
-  DESTDIR = "$(out)";
-
-  NIX_LDFLAGS = "-lkmod -lsystemd";
-  NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
-
-  preConfigure = ''
-    # Remove blanket -Werror. Fails for minor error on gcc-11.
-    substituteInPlace usr/Makefile --replace ' -Werror ' ' '
-  '';
-
-  # avoid /usr/bin/install
-  makeFlags = [
-    "INSTALL=install"
-    "SED=sed"
-    "prefix=/"
-    "manprefix=/share"
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    perl
   ];
-
-  installFlags = [
-    "install"
+  buildInputs = [
+    kmod
+    (lib.getLib open-isns)
+    openssl
+    systemd
+    util-linux
   ];
 
-  postInstall = ''
-    cp usr/iscsistart $out/sbin/
-    for f in $out/lib/systemd/system/*; do
-      substituteInPlace $f --replace /sbin $out/bin
-    done
-    $out/sbin/iscsistart -v
+  preConfigure = ''
+    patchShebangs .
   '';
 
-  postFixup = ''
-    sed -i "s|/sbin/iscsiadm|$out/bin/iscsiadm|" $out/bin/iscsi_fw_login
+  prePatch = ''
+    substituteInPlace etc/systemd/iscsi-init.service.template \
+      --replace /usr/bin/sh ${runtimeShell}
+    sed -i '/install_dir: db_root/d' meson.build
   '';
 
+  mesonFlags = [
+    "-Discsi_sbindir=${placeholder "out"}/sbin"
+    "-Drulesdir=${placeholder "out"}/etc/udev/rules.d"
+    "-Dsystemddir=${placeholder "out"}/lib/systemd"
+    "-Ddbroot=/etc/iscsi"
+  ];
+
   passthru.tests = { inherit (nixosTests) iscsi-root iscsi-multipath-root; };
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/open-isns/default.nix b/nixpkgs/pkgs/os-specific/linux/open-isns/default.nix
index 3f939024a48f..7afe13eea86a 100644
--- a/nixpkgs/pkgs/os-specific/linux/open-isns/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/open-isns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "open-isns";
-  version = "0.101";
+  version = "0.102";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-isns";
     rev = "v${version}";
-    sha256 = "1g7kp1j2f8afsach6sbl4k05ybz1yz2s8yg073bv4gnv48gyxb2p";
+    sha256 = "sha256-Vz6VqqvEr0f8AdN9NcVnruapswmoOgvAXxXSfrM3yRA=";
   };
 
   propagatedBuildInputs = [ openssl ];
diff --git a/nixpkgs/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh b/nixpkgs/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
index cd21899e60e7..34f9b1579455 100644
--- a/nixpkgs/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
+++ b/nixpkgs/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/lib
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
index ba93b068fddc..664adfdc164c 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
@@ -1,65 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, pkg-config, util-linux, which
-, procps, libcap_ng, openssl, python3 , perl
-, kernel ? null }:
-
-with lib;
-
-let
-  _kernel = kernel;
-  pythonEnv = python3.withPackages (ps: with ps; [ six ]);
-in stdenv.mkDerivation rec {
-  version = "2.17.0";
-  pname = "openvswitch";
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-4Dv6t8qC2Bp9OjbeTzkKO1IQ4/OWV2cfkih3zU6m3HM=";
-  };
-
-  kernel = optional (_kernel != null) _kernel.dev;
-
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  buildInputs = [ util-linux openssl libcap_ng pythonEnv
-                  perl procps which ];
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  postBuild = ''
-    # fix tests
-    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
-    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
-  '';
-
-  enableParallelBuilding = true;
-  doCheck = false; # bash-completion test fails with "compgen: command not found"
-
-  meta = with lib; {
-    platforms = platforms.linux;
-    description = "A multilayer virtual switch";
-    longDescription =
-      ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-      '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-  };
+import ./generic.nix {
+  version = "3.1.1";
+  hash = "sha256-YEiRg6RNO5WlUiQHIhfF9tN6oRvhKnV2JRDO25Ok4gQ=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
new file mode 100644
index 000000000000..be4bc90fe428
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
@@ -0,0 +1,126 @@
+{ version
+, hash
+}:
+
+{ lib
+, stdenv
+, fetchurl
+, autoconf
+, automake
+, installShellFiles
+, iproute2
+, kernel ? null
+, libcap_ng
+, libtool
+, openssl
+, perl
+, pkg-config
+, procps
+, python3
+, sphinxHook
+, util-linux
+, which
+}:
+
+let
+  _kernel = kernel;
+in stdenv.mkDerivation rec {
+  pname = "openvswitch";
+  inherit version;
+
+  kernel = lib.optional (_kernel != null) _kernel.dev;
+
+  src = fetchurl {
+    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
+    inherit hash;
+  };
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  patches = [
+    # 8: vsctl-bashcomp - argument completion FAILED (completion.at:664)
+    ./patches/disable-bash-arg-completion-test.patch
+  ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    installShellFiles
+    libtool
+    pkg-config
+    sphinxHook
+  ];
+
+  sphinxBuilders = [
+    "man"
+  ];
+
+  sphinxRoot = "./Documentation";
+
+  buildInputs = [
+    libcap_ng
+    openssl
+    perl
+    procps
+    python3
+    util-linux
+    which
+  ];
+
+  preConfigure = "./boot.sh";
+
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sharedstatedir=/var"
+    "--sbindir=$(out)/bin"
+  ] ++ (lib.optionals (_kernel != null) ["--with-linux"]);
+
+  # Leave /var out of this!
+  installFlags = [
+    "LOGDIR=$(TMPDIR)/dummy"
+    "RUNDIR=$(TMPDIR)/dummy"
+    "PKIDIR=$(TMPDIR)/dummy"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    installShellCompletion --bash utilities/ovs-appctl-bashcomp.bash
+    installShellCompletion --bash utilities/ovs-vsctl-bashcomp.bash
+  '';
+
+  doCheck = true;
+  preCheck = ''
+    patchShebangs tests/
+  '';
+
+  nativeCheckInputs = [
+    iproute2
+  ] ++ (with python3.pkgs; [
+    netaddr
+    pyparsing
+    pytest
+  ]);
+
+  meta = with lib; {
+    changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
+    description = "A multilayer virtual switch";
+    longDescription = ''
+      Open vSwitch is a production quality, multilayer virtual switch
+      licensed under the open source Apache 2.0 license. It is
+      designed to enable massive network automation through
+      programmatic extension, while still supporting standard
+      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
+      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
+      support distribution across multiple physical servers similar
+      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
+    '';
+    homepage = "https://www.openvswitch.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ netixx kmcopper ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
index 15c6c05b0613..9fb9977c2017 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -1,81 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, pkg-config, util-linux, which
-, procps, libcap_ng, openssl, python2, perl
-, automake, autoconf, libtool, kernel ? null }:
-
-with lib;
-
-let
-  _kernel = kernel;
-in stdenv.mkDerivation rec {
-  version = "2.5.12";
-  pname = "openvswitch";
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "0a8wa1lj5p28x3vq0yaxjhqmppp4hvds6hhm0j3czpp8mc09fsfq";
-  };
-
-  patches = [ ./patches/lts-ssl.patch ];
-
-  kernel = optional (_kernel != null) _kernel.dev;
-
-  nativeBuildInputs = [ autoconf libtool automake pkg-config makeWrapper ];
-  buildInputs = [ util-linux openssl libcap_ng python2 perl procps which ];
-
-  preConfigure = "./boot.sh";
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  postBuild = ''
-    # fix tests
-    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${python2.interpreter}'
-    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${python2.interpreter}'
-  '';
-
-  enableParallelBuilding = true;
-  doCheck = false; # bash-completion test fails with "compgen: command not found"
-
-  postInstall = ''
-    cp debian/ovs-monitor-ipsec $out/share/openvswitch/scripts
-    makeWrapper \
-      $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      $out/bin/ovs-monitor-ipsec \
-      --prefix PYTHONPATH : "$out/share/openvswitch/python"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "UnixctlServer.create(None)" "UnixctlServer.create(os.environ['UNIXCTLPATH'])"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.psk_file" "root_prefix + self.psk_file"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.cert_dir" "root_prefix + self.cert_dir"
-  '';
-
-  meta = with lib; {
-    platforms = platforms.linux;
-    description = "A multilayer virtual switch";
-    longDescription =
-      ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-      '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-  };
+import ./generic.nix {
+  version = "2.17.6";
+  hash = "sha256-dNqvK+c0iuXdQBe6RbjaxlNB8Vn0+0paecVC/tQQENk=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch b/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
new file mode 100644
index 000000000000..2b4542741763
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/completion.at b/tests/completion.at
+index b6155af25..6367cb545 100644
+--- a/tests/completion.at
++++ b/tests/completion.at
+@@ -425,6 +425,7 @@ AT_CLEANUP
+ 
+ 
+ AT_SETUP([vsctl-bashcomp - argument completion])
++AT_SKIP_IF([true])
+ AT_SKIP_IF([test -z ${BASH_VERSION+x}])
+ AT_SKIP_IF([eval 'test ${BASH_VERSINFO[[0]]} -lt 4'])
+ OVS_VSWITCHD_START(
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch b/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
deleted file mode 100644
index 0d8ff5b0d523..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
+++ /dev/null
@@ -1,274 +0,0 @@
-diff --git a/build-aux/automake.mk b/build-aux/automake.mk
-new file mode 100644
-index 000000000..5d2657fd6
---- /dev/null
-+++ b/build-aux/automake.mk
-@@ -0,0 +1,2 @@
-+EXTRA_DIST += \
-+	build-aux/generate-dhparams-c 
-diff --git a/build-aux/generate-dhparams-c b/build-aux/generate-dhparams-c
-new file mode 100755
-index 000000000..bcd25e2d8
---- /dev/null
-+++ b/build-aux/generate-dhparams-c
-@@ -0,0 +1,33 @@
-+#! /bin/sh -e
-+
-+cat <<'EOF'
-+/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
-+ *
-+ * If you do need to regenerate this file, run "make generate-dhparams-c". */
-+
-+#include <config.h>
-+#include "lib/dhparams.h"
-+#include "lib/util.h"
-+
-+static int
-+my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
-+{
-+    ovs_assert(q == NULL);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
-+    dh->p = p;
-+    dh->g = g;
-+    return 1;
-+#else
-+    return DH_set0_pqg(dh, p, NULL, g);
-+#endif
-+}
-+EOF
-+(openssl dhparam -C -in lib/dh1024.pem -noout &&
-+openssl dhparam -C -in lib/dh2048.pem -noout &&
-+openssl dhparam -C -in lib/dh4096.pem -noout) | sed '
-+    s/^static DH/DH/
-+    s/\(get_dh[0-9]*\)()/\1(void)/
-+    s/\(DH_set0_pqg\)/my_\1/
-+    s/[ 	]*$//
-+    s/	/        /g
-+'
-diff --git a/lib/automake.mk b/lib/automake.mk
-index 5387d519a..804a8b7d7 100644
---- a/lib/automake.mk
-+++ b/lib/automake.mk
-@@ -399,15 +399,16 @@ lib_libopenvswitch_la_SOURCES += \
- 	lib/route-table-bsd.c
- endif
- 
-+.PHONY: generate-dhparams-c
- if HAVE_OPENSSL
--lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c
--nodist_lib_libopenvswitch_la_SOURCES += lib/dhparams.c
--lib/dhparams.c: lib/dh1024.pem lib/dh2048.pem lib/dh4096.pem
--	$(AM_V_GEN)(echo '#include "lib/dhparams.h"' &&                 \
--	 openssl dhparam -C -in $(srcdir)/lib/dh1024.pem -noout &&	\
--	 openssl dhparam -C -in $(srcdir)/lib/dh2048.pem -noout &&	\
--	 openssl dhparam -C -in $(srcdir)/lib/dh4096.pem -noout)	\
--	| sed 's/\(get_dh[0-9]*\)()/\1(void)/' > lib/dhparams.c.tmp &&  \
-+lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c lib/dhparams.c
-+
-+# Manually regenerates lib/dhparams.c.  Not normally necessary since
-+# lib/dhparams.c is part of the repository and doesn't normally need
-+# updates.
-+generate-dhparams-c:
-+	$(AM_V_GEN)cd $(srcdir) && \
-+	build-aux/generate-dhparams-c > lib/dhparams.c.tmp && \
- 	mv lib/dhparams.c.tmp lib/dhparams.c
- else
- lib_libopenvswitch_la_SOURCES += lib/stream-nossl.c
-diff --git a/lib/dhparams.c b/lib/dhparams.c
-new file mode 100644
-index 000000000..4e42efad2
---- /dev/null
-+++ b/lib/dhparams.c
-@@ -0,0 +1,192 @@
-+/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
-+ *
-+ * If you do need to regenerate this file, run "make generate-dhparams-c". */
-+
-+#include <config.h>
-+#include "lib/dhparams.h"
-+#include "lib/util.h"
-+
-+static int
-+my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
-+{
-+    ovs_assert(q == NULL);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
-+    dh->p = p;
-+    dh->g = g;
-+    return 1;
-+#else
-+    return DH_set0_pqg(dh, p, NULL, g);
-+#endif
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh1024(void)
-+{
-+    static unsigned char dhp_1024[] = {
-+        0xF4, 0x88, 0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4,
-+        0x9D, 0xE4, 0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D,
-+        0x45, 0x1D, 0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D,
-+        0x8E, 0xF6, 0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B,
-+        0x18, 0x8D, 0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3,
-+        0x34, 0xFD, 0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C,
-+        0xDE, 0x33, 0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1,
-+        0x29, 0x40, 0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72,
-+        0xD6, 0x86, 0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA,
-+        0x95, 0x0C, 0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B,
-+        0x02, 0x46, 0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F,
-+        0x9C, 0x7C, 0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB,
-+        0xA2, 0x5E, 0xC3, 0x55, 0xE9, 0x2F, 0x78, 0xC7
-+    };
-+    static unsigned char dhg_1024[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_1024, sizeof (dhp_1024), NULL);
-+    dhg_bn = BN_bin2bn(dhg_1024, sizeof (dhg_1024), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh2048(void)
-+{
-+    static unsigned char dhp_2048[] = {
-+        0xF6, 0x42, 0x57, 0xB7, 0x08, 0x7F, 0x08, 0x17, 0x72, 0xA2,
-+        0xBA, 0xD6, 0xA9, 0x42, 0xF3, 0x05, 0xE8, 0xF9, 0x53, 0x11,
-+        0x39, 0x4F, 0xB6, 0xF1, 0x6E, 0xB9, 0x4B, 0x38, 0x20, 0xDA,
-+        0x01, 0xA7, 0x56, 0xA3, 0x14, 0xE9, 0x8F, 0x40, 0x55, 0xF3,
-+        0xD0, 0x07, 0xC6, 0xCB, 0x43, 0xA9, 0x94, 0xAD, 0xF7, 0x4C,
-+        0x64, 0x86, 0x49, 0xF8, 0x0C, 0x83, 0xBD, 0x65, 0xE9, 0x17,
-+        0xD4, 0xA1, 0xD3, 0x50, 0xF8, 0xF5, 0x59, 0x5F, 0xDC, 0x76,
-+        0x52, 0x4F, 0x3D, 0x3D, 0x8D, 0xDB, 0xCE, 0x99, 0xE1, 0x57,
-+        0x92, 0x59, 0xCD, 0xFD, 0xB8, 0xAE, 0x74, 0x4F, 0xC5, 0xFC,
-+        0x76, 0xBC, 0x83, 0xC5, 0x47, 0x30, 0x61, 0xCE, 0x7C, 0xC9,
-+        0x66, 0xFF, 0x15, 0xF9, 0xBB, 0xFD, 0x91, 0x5E, 0xC7, 0x01,
-+        0xAA, 0xD3, 0x5B, 0x9E, 0x8D, 0xA0, 0xA5, 0x72, 0x3A, 0xD4,
-+        0x1A, 0xF0, 0xBF, 0x46, 0x00, 0x58, 0x2B, 0xE5, 0xF4, 0x88,
-+        0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4, 0x9D, 0xE4,
-+        0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D, 0x45, 0x1D,
-+        0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D, 0x8E, 0xF6,
-+        0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B, 0x18, 0x8D,
-+        0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3, 0x34, 0xFD,
-+        0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C, 0xDE, 0x33,
-+        0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1, 0x29, 0x40,
-+        0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72, 0xD6, 0x86,
-+        0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA, 0x95, 0x0C,
-+        0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B, 0x02, 0x46,
-+        0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F, 0x9C, 0x7C,
-+        0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB, 0xA2, 0x5E,
-+        0xC3, 0x55, 0xE9, 0x32, 0x0B, 0x3B
-+    };
-+    static unsigned char dhg_2048[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
-+    dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh4096(void)
-+{
-+    static unsigned char dhp_4096[] = {
-+        0xFA, 0x14, 0x72, 0x52, 0xC1, 0x4D, 0xE1, 0x5A, 0x49, 0xD4,
-+        0xEF, 0x09, 0x2D, 0xC0, 0xA8, 0xFD, 0x55, 0xAB, 0xD7, 0xD9,
-+        0x37, 0x04, 0x28, 0x09, 0xE2, 0xE9, 0x3E, 0x77, 0xE2, 0xA1,
-+        0x7A, 0x18, 0xDD, 0x46, 0xA3, 0x43, 0x37, 0x23, 0x90, 0x97,
-+        0xF3, 0x0E, 0xC9, 0x03, 0x50, 0x7D, 0x65, 0xCF, 0x78, 0x62,
-+        0xA6, 0x3A, 0x62, 0x22, 0x83, 0xA1, 0x2F, 0xFE, 0x79, 0xBA,
-+        0x35, 0xFF, 0x59, 0xD8, 0x1D, 0x61, 0xDD, 0x1E, 0x21, 0x13,
-+        0x17, 0xFE, 0xCD, 0x38, 0x87, 0x9E, 0xF5, 0x4F, 0x79, 0x10,
-+        0x61, 0x8D, 0xD4, 0x22, 0xF3, 0x5A, 0xED, 0x5D, 0xEA, 0x21,
-+        0xE9, 0x33, 0x6B, 0x48, 0x12, 0x0A, 0x20, 0x77, 0xD4, 0x25,
-+        0x60, 0x61, 0xDE, 0xF6, 0xB4, 0x4F, 0x1C, 0x63, 0x40, 0x8B,
-+        0x3A, 0x21, 0x93, 0x8B, 0x79, 0x53, 0x51, 0x2C, 0xCA, 0xB3,
-+        0x7B, 0x29, 0x56, 0xA8, 0xC7, 0xF8, 0xF4, 0x7B, 0x08, 0x5E,
-+        0xA6, 0xDC, 0xA2, 0x45, 0x12, 0x56, 0xDD, 0x41, 0x92, 0xF2,
-+        0xDD, 0x5B, 0x8F, 0x23, 0xF0, 0xF3, 0xEF, 0xE4, 0x3B, 0x0A,
-+        0x44, 0xDD, 0xED, 0x96, 0x84, 0xF1, 0xA8, 0x32, 0x46, 0xA3,
-+        0xDB, 0x4A, 0xBE, 0x3D, 0x45, 0xBA, 0x4E, 0xF8, 0x03, 0xE5,
-+        0xDD, 0x6B, 0x59, 0x0D, 0x84, 0x1E, 0xCA, 0x16, 0x5A, 0x8C,
-+        0xC8, 0xDF, 0x7C, 0x54, 0x44, 0xC4, 0x27, 0xA7, 0x3B, 0x2A,
-+        0x97, 0xCE, 0xA3, 0x7D, 0x26, 0x9C, 0xAD, 0xF4, 0xC2, 0xAC,
-+        0x37, 0x4B, 0xC3, 0xAD, 0x68, 0x84, 0x7F, 0x99, 0xA6, 0x17,
-+        0xEF, 0x6B, 0x46, 0x3A, 0x7A, 0x36, 0x7A, 0x11, 0x43, 0x92,
-+        0xAD, 0xE9, 0x9C, 0xFB, 0x44, 0x6C, 0x3D, 0x82, 0x49, 0xCC,
-+        0x5C, 0x6A, 0x52, 0x42, 0xF8, 0x42, 0xFB, 0x44, 0xF9, 0x39,
-+        0x73, 0xFB, 0x60, 0x79, 0x3B, 0xC2, 0x9E, 0x0B, 0xDC, 0xD4,
-+        0xA6, 0x67, 0xF7, 0x66, 0x3F, 0xFC, 0x42, 0x3B, 0x1B, 0xDB,
-+        0x4F, 0x66, 0xDC, 0xA5, 0x8F, 0x66, 0xF9, 0xEA, 0xC1, 0xED,
-+        0x31, 0xFB, 0x48, 0xA1, 0x82, 0x7D, 0xF8, 0xE0, 0xCC, 0xB1,
-+        0xC7, 0x03, 0xE4, 0xF8, 0xB3, 0xFE, 0xB7, 0xA3, 0x13, 0x73,
-+        0xA6, 0x7B, 0xC1, 0x0E, 0x39, 0xC7, 0x94, 0x48, 0x26, 0x00,
-+        0x85, 0x79, 0xFC, 0x6F, 0x7A, 0xAF, 0xC5, 0x52, 0x35, 0x75,
-+        0xD7, 0x75, 0xA4, 0x40, 0xFA, 0x14, 0x74, 0x61, 0x16, 0xF2,
-+        0xEB, 0x67, 0x11, 0x6F, 0x04, 0x43, 0x3D, 0x11, 0x14, 0x4C,
-+        0xA7, 0x94, 0x2A, 0x39, 0xA1, 0xC9, 0x90, 0xCF, 0x83, 0xC6,
-+        0xFF, 0x02, 0x8F, 0xA3, 0x2A, 0xAC, 0x26, 0xDF, 0x0B, 0x8B,
-+        0xBE, 0x64, 0x4A, 0xF1, 0xA1, 0xDC, 0xEE, 0xBA, 0xC8, 0x03,
-+        0x82, 0xF6, 0x62, 0x2C, 0x5D, 0xB6, 0xBB, 0x13, 0x19, 0x6E,
-+        0x86, 0xC5, 0x5B, 0x2B, 0x5E, 0x3A, 0xF3, 0xB3, 0x28, 0x6B,
-+        0x70, 0x71, 0x3A, 0x8E, 0xFF, 0x5C, 0x15, 0xE6, 0x02, 0xA4,
-+        0xCE, 0xED, 0x59, 0x56, 0xCC, 0x15, 0x51, 0x07, 0x79, 0x1A,
-+        0x0F, 0x25, 0x26, 0x27, 0x30, 0xA9, 0x15, 0xB2, 0xC8, 0xD4,
-+        0x5C, 0xCC, 0x30, 0xE8, 0x1B, 0xD8, 0xD5, 0x0F, 0x19, 0xA8,
-+        0x80, 0xA4, 0xC7, 0x01, 0xAA, 0x8B, 0xBA, 0x53, 0xBB, 0x47,
-+        0xC2, 0x1F, 0x6B, 0x54, 0xB0, 0x17, 0x60, 0xED, 0x79, 0x21,
-+        0x95, 0xB6, 0x05, 0x84, 0x37, 0xC8, 0x03, 0xA4, 0xDD, 0xD1,
-+        0x06, 0x69, 0x8F, 0x4C, 0x39, 0xE0, 0xC8, 0x5D, 0x83, 0x1D,
-+        0xBE, 0x6A, 0x9A, 0x99, 0xF3, 0x9F, 0x0B, 0x45, 0x29, 0xD4,
-+        0xCB, 0x29, 0x66, 0xEE, 0x1E, 0x7E, 0x3D, 0xD7, 0x13, 0x4E,
-+        0xDB, 0x90, 0x90, 0x58, 0xCB, 0x5E, 0x9B, 0xCD, 0x2E, 0x2B,
-+        0x0F, 0xA9, 0x4E, 0x78, 0xAC, 0x05, 0x11, 0x7F, 0xE3, 0x9E,
-+        0x27, 0xD4, 0x99, 0xE1, 0xB9, 0xBD, 0x78, 0xE1, 0x84, 0x41,
-+        0xA0, 0xDF
-+    };
-+    static unsigned char dhg_4096[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_4096, sizeof (dhp_4096), NULL);
-+    dhg_bn = BN_bin2bn(dhg_4096, sizeof (dhg_4096), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
diff --git a/nixpkgs/pkgs/os-specific/linux/otpw/default.nix b/nixpkgs/pkgs/os-specific/linux/otpw/default.nix
index 14381ac68c16..6c53bf16efc1 100644
--- a/nixpkgs/pkgs/os-specific/linux/otpw/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/otpw/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pam }:
+{ lib, stdenv, fetchurl, pam, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "otpw";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     cp *.8 $out/share/man/man8
   '';
 
-  buildInputs = [ pam ];
+  buildInputs = [ pam libxcrypt ];
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix b/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix
new file mode 100644
index 000000000000..02afb28e66e0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub
+, glibc, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "0xtools";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "tanelpoder";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-pe64st3yhVfZi8/sTEfH1cNjx7JpqxDmxMmodpXnqaU=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/0xtools/proc.py \
+      --replace /usr/include/asm/unistd_64.h ${glibc.dev}/include/asm/unistd_64.h
+  '';
+
+  buildInputs = [ python3 ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = with lib; {
+    description = "Utilities for analyzing application performance";
+    homepage = "https://0x.tools";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ astro ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/pam/default.nix b/nixpkgs/pkgs/os-specific/linux/pam/default.nix
index 72f91e89c745..b16bebbe3d60 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam/default.nix
@@ -1,6 +1,5 @@
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit
+{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
-, withLibxcrypt ? false, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -20,9 +19,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
-  buildInputs = [ cracklib db4 ]
-    ++ lib.optional stdenv.buildPlatform.isLinux audit
-    ++ lib.optional withLibxcrypt libxcrypt;
+  buildInputs = [ cracklib db4 libxcrypt ]
+    ++ lib.optional stdenv.buildPlatform.isLinux audit;
 
   enableParallelBuilding = true;
 
@@ -46,7 +44,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   passthru.tests = {
-    inherit (nixosTests) pam-oath-login pam-u2f shadow;
+    inherit (nixosTests) pam-oath-login pam-u2f shadow sssd-ldap;
   };
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_mount/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_mount/default.nix
index c49351f3249d..1613e11e0280 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_mount/default.nix
@@ -18,9 +18,22 @@ stdenv.mkDerivation rec {
       --replace @@NIX_UTILLINUX@@ ${util-linux}/bin
   '';
 
-  nativeBuildInputs = [ autoreconfHook libtool pkg-config ];
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+    perl
+    pkg-config
+  ];
 
-  buildInputs = [ pam libHX util-linux libxml2 pcre2 perl openssl cryptsetup ];
+  buildInputs = [
+    cryptsetup
+    libHX
+    libxml2
+    openssl
+    pam
+    pcre2
+    util-linux
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_mysql/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_mysql/default.nix
index 807899cf2b28..036d4b20cb4c 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_mysql/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_mysql/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pam, pkg-config, libmysqlclient, mariadb }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pam, pkg-config, libmysqlclient, mariadb, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "pam_mysql";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
-  buildInputs = [ pam libmysqlclient mariadb ];
+  buildInputs = [ pam libmysqlclient mariadb libxcrypt ];
 
   meta = with lib; {
     description = "PAM authentication module against a MySQL database";
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_p11/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_p11/default.nix
index 35199d3357b1..8970f7ed6285 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_p11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_p11/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, openssl, libp11, pam, libintl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libp11, pam, libintl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "pam_p11";
@@ -11,8 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "1caidy18rq5zk82d51x8vwidmkhwmanf3qm25x1yrdlbhxv6m7lk";
   };
 
+  patches = [
+    # fix with openssl 3.x
+    (fetchpatch {
+      url = "https://github.com/OpenSC/pam_p11/pull/22.patch";
+      excludes = [ ".github/build.sh" ];
+      hash = "sha256-bm/agnBgvrr8L8yoGK4gzBqOGgsNWf9NIgcNJG7proE=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ pam openssl libp11 ]
+  buildInputs = [ pam libp11.passthru.openssl libp11 ]
     ++ lib.optionals stdenv.isDarwin [ libintl ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_pgsql/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_pgsql/default.nix
index 3cfa6733efa8..2eabcefe584c 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_pgsql/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_pgsql/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, postgresql, libgcrypt, pam }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, postgresql, libgcrypt, pam, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "pam_pgsql";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libgcrypt pam postgresql ];
+  buildInputs = [ libgcrypt pam postgresql libxcrypt ];
 
   meta = with lib; {
     description = "Support to authenticate against PostgreSQL for PAM-enabled appliations";
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_u2f/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_u2f/default.nix
index bcccd20cd6f0..085ff43a7935 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_u2f/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_u2f/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_u2f";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src     = fetchurl {
     url = "https://developers.yubico.com/pam-u2f/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cOdBvKGXtktPvo3R9tV84ritWMp4Y1LFJfPy1EEliUw=";
+    sha256 = "sha256-cjYMaHVIXrTfQJ2o+PUrF4k/BeTZmFKcI4gUSA4RUiA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_usb/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_usb/default.nix
index ebd45246ae8d..1264894ad0c9 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_usb/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     # pam_usb dependencies
-    dbus libxml2 pam pmount pkg-config
+    dbus libxml2 pam pmount
     # pam_usb's tools dependencies
     python
     # cElementTree is included with python 2.5 and later.
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_ussh/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_ussh/default.nix
index 889c8bc6f57c..b0eeef0948e6 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_ussh/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_ussh/default.nix
@@ -16,14 +16,12 @@ buildGoModule rec {
     sha256 = "0nb9hpqbghgi3zvq41kabydzyc6ffaaw9b4jkc5jrwn1klpw1xk8";
   };
 
-  prePatch = ''
+  preBuild = ''
     cp ${./go.mod} go.mod
+    cp ${./go.sum} go.sum
   '';
-  overrideModAttrs = (_: {
-    inherit prePatch;
-  });
 
-  vendorSha256 = "0hjifc3kbwmx7kjn858vi05cwwra6q19cqjfd94k726pwhk37qkw";
+  vendorSha256 = "sha256-fOIzJuTXiDNJak5ilgI2KnPOCogbFWTlPL3yNQdzUUI=";
 
   buildInputs = [
     pam
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_ussh/go.sum b/nixpkgs/pkgs/os-specific/linux/pam_ussh/go.sum
new file mode 100644
index 000000000000..0df3145edbd5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/pam_ussh/go.sum
@@ -0,0 +1,22 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000 h1:SL+8VVnkqyshUSz5iNnXtrBQzvFF2SkROm6t5RczFAE=
+golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
index 844dc61dac37..1c1edc5abce0 100644
--- a/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
@@ -9,17 +9,18 @@
 , meson
 , ninja
 , xmlto
+, python3
 
 , gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "pax-utils";
-  version = "1.3.5";
+  version = "1.3.7";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8KWwPfIwiqLdeq9TuewLK0hFW4YSnkd6FkPeYpBKuHQ=";
+    sha256 = "sha256-EINi0pZo0lz3sMrcY7FaTBz8DbxxrcFRszxf597Ok5o=";
   };
 
   strictDeps = true;
@@ -27,9 +28,10 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ docbook_xml_dtd_44 docbook_xsl meson ninja pkg-config xmlto ];
   buildInputs = [ libcap ];
+  # Needed for lddtree
+  propagatedBuildInputs = [ (python3.withPackages (p: with p; [ pyelftools ])) ];
 
   passthru.updateScript = gitUpdater {
-    inherit pname version;
     url = "https://anongit.gentoo.org/git/proj/pax-utils.git";
     rev-prefix = "v";
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
index a5d9771a2f9c..d9b93eafdb0e 100644
--- a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
@@ -1,23 +1,19 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ cmake, fetchFromGitHub, lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202112";
+  version = "202302";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    sha256 = "sha256-uuQvj8BcUmuYDwV4r3oqkT+QTcSFcGjBeGUM2NZRFcA=";
+    hash = "sha256-69wdA6/bRN5gYl02GgA8mXnXxVZlHIGkhtC8vFKZVcA=";
   };
 
+  nativeBuildInputs = [ cmake ];
   enableParallelBuilding = true;
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp pcm*.x $out/bin
-  '';
-
   meta = with lib; {
     description = "Processor counter monitor";
     homepage = "https://www.intel.com/software/pcm";
diff --git a/nixpkgs/pkgs/os-specific/linux/pcmciautils/default.nix b/nixpkgs/pkgs/os-specific/linux/pcmciautils/default.nix
index bca58bd808eb..b5f9d8a0a2c2 100644
--- a/nixpkgs/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
       s,/etc/pcmcia,$out&,;
     " src/{startup.c,pcmcia-check-broken-cis.c} # fix-color */
   ''
-  + (if firmware == [] then ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'' else "")
-  + (if configOpts == null then "" else "ln -sf ${configOpts} ./config/config.opts")
+  + (lib.optionalString (firmware == []) ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'')
+  + (lib.optionalString (configOpts != null) "ln -sf ${configOpts} ./config/config.opts")
   ;
 
   makeFlags = [ "LEX=flex" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
new file mode 100644
index 000000000000..4a651bf473e5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+## Usage
+# In NixOS, simply add this package to services.udev.packages:
+#   services.udev.packages = [ pkgs.picoprobe-udev-rules ];
+
+stdenv.mkDerivation rec {
+  pname = "picoprobe-udev-rules";
+  version = "unstable-2023-01-31";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/probe-rs/webpage/1cba61acc6ecb5ff96f74641269844ad88ad8ad5/static/files/69-probe-rs.rules";
+    sha256 = "sha256-vQMPX3Amttja0u03KWGnPDAVTGM9ekJ+IBTjW+xlJS0=";
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/lib/udev/rules.d/69-probe-rs.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://probe.rs/docs/getting-started/probe-setup/#udev-rules";
+    description = "Picoprobe udev rules list";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/piper/default.nix b/nixpkgs/pkgs/os-specific/linux/piper/default.nix
index 5edcd263f0d9..39b0eaf5325e 100644
--- a/nixpkgs/pkgs/os-specific/linux/piper/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/piper/default.nix
@@ -1,10 +1,10 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
 , wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
-, gobject-introspection }:
+, gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "piper";
-  version = "0.5.1";
+  version = "0.7";
 
   format = "other";
 
@@ -12,20 +12,23 @@ python3.pkgs.buildPythonApplication rec {
     owner  = "libratbag";
     repo   = "piper";
     rev    =  version;
-    sha256 = "1nfjnsiwg2rs6gkjsxzhr2708i6di149dgwq3cf6l12rxqpb8arj";
+    sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
   nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
-    gtk3 glib gnome.adwaita-icon-theme python3
+    gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
-  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ] ++ [
-    gobject-introspection # fixes https://github.com/NixOS/nixpkgs/issues/56943 for now
+  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ];
+
+  mesonFlags = [
+    "-Druntime-dependency-checks=false"
+    "-Dtests=false"
   ];
 
   postPatch = ''
     chmod +x meson_install.sh # patchShebangs requires executable file
-    patchShebangs meson_install.sh
+    patchShebangs meson_install.sh data/generate-piper-gresource.xml.py
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/pktgen/default.nix b/nixpkgs/pkgs/os-specific/linux/pktgen/default.nix
index 0ddda99bf592..b81bf74a3d9e 100644
--- a/nixpkgs/pkgs/os-specific/linux/pktgen/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pktgen/default.nix
@@ -1,19 +1,40 @@
-{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config
-, dpdk, libbsd, libpcap, lua5_3, numactl, util-linux
-, gtk2, which, withGtk ? false
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+, dpdk
+, libbsd
+, libpcap
+, lua5_3
+, numactl
+, util-linux
+, gtk2
+, which
+, withGtk ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "pktgen";
-  version = "22.04.1";
+  version = "22.07.1";
 
   src = fetchFromGitHub {
     owner = "pktgen";
     repo = "Pktgen-DPDK";
     rev = "pktgen-${version}";
-    sha256 = "0gbag98i2jq0p2hpvfgc3fiqy2sark1dm72hla4sxmn3gljy3p70";
+    sha256 = "sha256-wBLGwVdn3ymUTVv7J/kbQYz4WNIgV246PHg51+FStUo=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Ealier DPDK deprecated some macros, which were finally removed in >= 22.11
+      url = "https://github.com/pktgen/Pktgen-DPDK/commit/089ef94ac04629f7380f5e618443bcacb2cef5ab.patch";
+      sha256 = "sha256-ITU/dIfu7QPpdIVYuCuDhDG9rVF+n8i1YYn9bFmQUME=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [
@@ -25,6 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
diff --git a/nixpkgs/pkgs/os-specific/linux/pmount/default.nix b/nixpkgs/pkgs/os-specific/linux/pmount/default.nix
index 0f65e0278cab..8267a2d4a7f9 100644
--- a/nixpkgs/pkgs/os-specific/linux/pmount/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pmount/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "db38fc290b710e8e9e9d442da2fb627d41e13b3ee80326c15cc2595ba00ea036";
   };
 
-  buildInputs = [ intltool util-linux ];
+  nativeBuildInputs = [ intltool util-linux ];
+  buildInputs = [ util-linux ];
 
   configureFlags = [
     "--with-media-dir=${mediaDir}"
diff --git a/nixpkgs/pkgs/os-specific/linux/policycoreutils/default.nix b/nixpkgs/pkgs/os-specific/linux/policycoreutils/default.nix
index c066dd4c4c5c..33875049747d 100644
--- a/nixpkgs/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gettext, libsepol, libselinux, libsemanage }:
+{ lib, stdenv, fetchurl, gettext, libsepol, libselinux, libsemanage, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ gettext ];
-  buildInputs = [ libsepol libselinux libsemanage ];
+  buildInputs = [ libsepol libselinux libsemanage libxcrypt ];
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/nixpkgs/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/nixpkgs/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 402b2536163c..ae08f59cc1ad 100644
--- a/nixpkgs/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -2,6 +2,7 @@
 , lib
 , pkg-config
 , meson
+, mesonEmulatorHook
 , ninja
 , fetchFromGitLab
 , fetchpatch
@@ -24,16 +25,9 @@
 , nixosTests
 }:
 
-let
-  testPythonPkgs = ps: with ps; [
-    pygobject3
-    dbus-python
-    python-dbusmock
-  ];
-in
 stdenv.mkDerivation rec {
   pname = "power-profiles-daemon";
-  version = "0.12";
+  version = "0.13";
 
   outputs = [ "out" "devdoc" ];
 
@@ -42,7 +36,7 @@ stdenv.mkDerivation rec {
     owner = "hadess";
     repo = "power-profiles-daemon";
     rev = version;
-    sha256 = "sha256-2eMFPGVLwTBIlaB1zM3BzHrhydgBEm+kvx+VIZdUDPM=";
+    sha256 = "sha256-ErHy+shxZQ/aCryGhovmJ6KmAMt9OZeQGDbHIkC0vUE=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +52,14 @@ stdenv.mkDerivation rec {
     gobject-introspection
     wrapGAppsNoGuiHook
     python3.pkgs.wrapPython
+    # checkInput but cheked for during the configuring
+    (python3.pythonForBuild.withPackages (ps: with ps; [
+      pygobject3
+      dbus-python
+      python-dbusmock
+    ]))
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
@@ -67,7 +69,7 @@ stdenv.mkDerivation rec {
     glib
     polkit
     python3 # for cli tool
-    # Duplicate from checkInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
+    # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
     umockdev
   ];
 
@@ -78,16 +80,15 @@ stdenv.mkDerivation rec {
     python3.pkgs.pygobject3
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     umockdev
     dbus
-    (python3.withPackages testPythonPkgs)
   ];
 
   mesonFlags = [
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "-Dgtk_doc=true"
-    "-Dtests=true"
+    "-Dtests=${lib.boolToString (stdenv.buildPlatform.canExecute stdenv.hostPlatform)}"
   ];
 
   doCheck = true;
@@ -103,16 +104,6 @@ stdenv.mkDerivation rec {
       tests/unittest_inspector.py
   '';
 
-  preInstall = ''
-    # We have pkexec on PATH so Meson will try to use it when installation fails
-    # due to being unable to write to e.g. /etc.
-    # Let’s pretend we already ran pkexec –
-    # the pkexec on PATH would complain it lacks setuid bit,
-    # obscuring the underlying error.
-    # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
-    export PKEXEC_UID=-1
-  '';
-
   postCheck = ''
     # Do not contaminate the wrapper with test dependencies.
     unset GI_TYPELIB_PATH
@@ -137,6 +128,6 @@ stdenv.mkDerivation rec {
     description = "Makes user-selected power profiles handling available over D-Bus";
     platforms = platforms.linux;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar mvnetbiz ];
+    maintainers = with maintainers; [ mvnetbiz ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/powercap/default.nix b/nixpkgs/pkgs/os-specific/linux/powercap/default.nix
index 96ec83852d9d..e705b6a34857 100644
--- a/nixpkgs/pkgs/os-specific/linux/powercap/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/powercap/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "powercap";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-l+IpFqBnCYUU825++sUPySD/Ku0TEIX2kt+S0Wml6iA=";
   };
 
+  # in master post 0.6.0, see https://github.com/powercap/powercap/issues/8
+  patches = [
+    (fetchpatch {
+      name = "fix-pkg-config.patch";
+      url = "https://github.com/powercap/powercap/commit/278dceb51635686e343edfc357b6020533fff299.patch";
+      sha256 = "0h62j63xdn0iqyx4xbia6hlmdjn45camb82z4vv6sb37x9sph7rg";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/powerstat/default.nix b/nixpkgs/pkgs/os-specific/linux/powerstat/default.nix
index 86f2e124ed29..901a522fe8fa 100644
--- a/nixpkgs/pkgs/os-specific/linux/powerstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/powerstat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "powerstat";
-  version = "0.02.27";
+  version = "0.03.03";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-P6DhsHnB+ak35JpUfD8Q8XbgMhI1QKKe31B8uMT2ZcY=";
+    hash = "sha256-D8VwczXHUHQ8p03IgYW3t8hOIGHKp0n1c7FpAUWua74=";
   };
 
   installFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
index 2b498d9ddc91..481cf1cd3bb5 100644
--- a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
@@ -1,44 +1,57 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, gettext, libnl, ncurses, pciutils
-, pkg-config, zlib, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gettext
+, libnl
+, ncurses
+, pciutils
+, pkg-config
+, zlib
+, autoreconfHook
+, autoconf-archive
+, nix-update-script
+, testers
+, powertop
+, xorg
+}:
 
 stdenv.mkDerivation rec {
   pname = "powertop";
-  version = "2.14";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = "fenrus75";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zkr2y5nb1nr22nq8a3zli87iyfasfq6489p7h1k428pv8k45w4f";
+    hash = "sha256-53jfqt0dtMqMj3W3m6ravUTzApLQcljDHfdXejeZa4M=";
   };
 
-  patches = [
-    # Pull upstream patch for ncurses-6.3 compatibility
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/fenrus75/powertop/commit/9ef1559a1582f23d599c149601c3a8e06809296c.patch";
-      sha256 = "0qx69f3bwhxgsga9nas8lgrclf1rxvr7fq7fd2n8dv3x4lsb46j1";
-    })
-  ];
-
   outputs = [ "out" "man" ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook autoconf-archive ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
-  NIX_LDFLAGS = [ "-lpthread" ];
-
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
-    substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
+    substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "${lib.getExe xorg.xset}"
     substituteInPlace src/tuning/bluetooth.cpp --replace "/usr/bin/hcitool" "hcitool"
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = powertop;
+      command = "powertop --version";
+      inherit version;
+    };
+  };
+
   meta = with lib; {
+    inherit (src.meta) homepage;
+    changelog = "https://github.com/fenrus75/powertop/releases/tag/v${version}";
     description = "Analyze power consumption on Intel-based laptops";
-    homepage = "https://01.org/powertop";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz anthonyroussel ];
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
index 0b4acc44400e..933622b68144 100644
--- a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
@@ -1,159 +1,176 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, bbe
 , makeWrapper
 , p7zip
-, gawk
-, util-linux
-, xorg
-, glib
+, perl
+, undmg
 , dbus-glib
+, glib
+, xorg
 , zlib
-, bbe
+, kernel
 , bash
-, timetrap
-, netcat
 , cups
-, kernel ? null
-, libsOnly ? false
-, fetchurl
-, undmg
-, perl
-, autoPatchelfHook
+, gawk
+, netcat
+, timetrap
+, util-linux
 }:
 
-assert (!libsOnly) -> kernel != null;
+let
+  kernelVersion = kernel.modDirVersion;
+  kernelDir = "${kernel.dev}/lib/modules/${kernelVersion}";
 
+  libPath = lib.concatStringsSep ":" [ "${glib.out}/lib" "${xorg.libXrandr}/lib" ];
+  scriptPath = lib.concatStringsSep ":" [
+    "${bash}/bin"
+    "${cups}/sbin"
+    "${gawk}/bin"
+    "${netcat}/bin"
+    "${timetrap}/bin"
+    "${util-linux}/bin"
+  ];
+in
 stdenv.mkDerivation rec {
-  version = "18.0.0-53049";
+  version = "18.3.0-53606";
   pname = "prl-tools";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    sha256 = "sha256-MGiqCvOsu/sKz6JHJFGP5bT12XYnm2kTMdOiflg9ses=";
+    hash = "sha256-uthaY6266YJqh5UtlI6ifmJVZVC6JTlsEoxEUOihx4I=";
   };
 
   hardeningDisable = [ "pic" "format" ];
 
-  nativeBuildInputs = [ p7zip undmg perl bbe autoPatchelfHook ]
-    ++ lib.optionals (!libsOnly) [ makeWrapper ] ++ kernel.moduleBuildDependencies;
-
-  buildInputs = with xorg; [ libXrandr libXext libX11 libXcomposite libXinerama ]
-    ++ lib.optionals (!libsOnly) [ libXi glib dbus-glib zlib ];
-
-  runtimeDependencies = [ glib xorg.libXrandr ];
-
-  inherit libsOnly;
+  nativeBuildInputs = [
+    autoPatchelfHook
+    bbe
+    makeWrapper
+    p7zip
+    perl
+    undmg
+  ] ++ kernel.moduleBuildDependencies;
+
+  buildInputs = [
+    dbus-glib
+    glib
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXext
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libXinerama
+    zlib
+  ];
+
+  runtimeDependencies = [
+    glib
+    xorg.libXrandr
+  ];
 
   unpackPhase = ''
-    undmg "${src}"
+    runHook preUnpack
+
+    undmg $src
     export sourceRoot=prl-tools-build
     7z x "Parallels Desktop.app/Contents/Resources/Tools/prl-tools-lin${lib.optionalString stdenv.isAarch64 "-arm"}.iso" -o$sourceRoot
-    if test -z "$libsOnly"; then
-      ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
-    fi
-  '';
+    ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
 
-  kernelVersion = lib.optionalString (!libsOnly) kernel.modDirVersion;
-  kernelDir = lib.optionalString (!libsOnly) "${kernel.dev}/lib/modules/${kernelVersion}";
-
-  libPath = lib.concatStringsSep ":" [ "${glib.out}/lib" "${xorg.libXrandr}/lib" ];
-
-  scriptPath = lib.concatStringsSep ":" (lib.optionals (!libsOnly) [
-    "${util-linux}/bin"
-    "${gawk}/bin"
-    "${bash}/bin"
-    "${timetrap}/bin"
-    "${netcat}/bin"
-    "${cups}/sbin"
-  ]);
+    runHook postUnpack
+  '';
 
   buildPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        make -f Makefile.kmods \
-          KSRC=$kernelDir/source \
-          HEADERS_CHECK_DIR=$kernelDir/source \
-          KERNEL_DIR=$kernelDir/build \
-          SRC=$kernelDir/build \
-          KVER=$kernelVersion
-      )
-    fi
+    runHook preBuild
+
+    ( # kernel modules
+      cd kmods
+      make -f Makefile.kmods \
+        KSRC=${kernelDir}/source \
+        HEADERS_CHECK_DIR=${kernelDir}/source \
+        KERNEL_DIR=${kernelDir}/build \
+        SRC=${kernelDir}/build \
+        KVER=${kernelVersion}
+    )
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        mkdir -p $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
-        ${lib.optionalString stdenv.isAarch64
-        "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
-      )
-    fi
+    runHook preInstall
+
+    ( # kernel modules
+      cd kmods
+      mkdir -p $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
+      ${lib.optionalString stdenv.isAarch64
+      "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
+    )
 
     ( # tools
       cd tools/tools${if stdenv.isAarch64 then "-arm64" else if stdenv.isx86_64 then "64" else "32"}
       mkdir -p $out/lib
 
-      if test -z "$libsOnly"; then
-        # prltoolsd contains hardcoded /bin/bash path
-        # we're lucky because it uses only -c command
-        # => replace to /bin/sh
-        bbe -e "s:/bin/bash:/bin/sh\x00\x00:" -o bin/prltoolsd.tmp bin/prltoolsd
-        rm -f bin/prltoolsd
-        mv bin/prltoolsd.tmp bin/prltoolsd
-
-        # install binaries
-        for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
-          # also patch binaries to replace /usr/bin/XXX to XXX
-          # here a two possible cases:
-          # 1. it is uses as null terminated string and should be truncated by null;
-          # 2. it is uses inside shell script and should be truncated by space.
-          for p in bin/* sbin/prl_nettool sbin/prl_snapshot sbin/prlfsmountd; do
-            p=$(basename $p)
-            bbe -e "s:/usr/bin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00:" -o $i.tmp $i
-            bbe -e "s:/usr/sbin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00 :" -o $i $i.tmp
-            bbe -e "s:/usr/bin/$p:$p         :" -o $i.tmp $i
-            bbe -e "s:/usr/sbin/$p:$p          :" -o $i $i.tmp
-          done
-
-          install -Dm755 $i $out/$i
+      # prltoolsd contains hardcoded /bin/bash path
+      # we're lucky because it uses only -c command
+      # => replace to /bin/sh
+      bbe -e "s:/bin/bash:/bin/sh\x00\x00:" -o bin/prltoolsd.tmp bin/prltoolsd
+      rm -f bin/prltoolsd
+      mv bin/prltoolsd.tmp bin/prltoolsd
+
+      # install binaries
+      for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
+        # also patch binaries to replace /usr/bin/XXX to XXX
+        # here a two possible cases:
+        # 1. it is uses as null terminated string and should be truncated by null;
+        # 2. it is uses inside shell script and should be truncated by space.
+        for p in bin/* sbin/prl_nettool sbin/prl_snapshot sbin/prlfsmountd; do
+          p=$(basename $p)
+          bbe -e "s:/usr/bin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00:" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00 :" -o $i $i.tmp
+          bbe -e "s:/usr/bin/$p:$p         :" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p:$p          :" -o $i $i.tmp
         done
 
-        install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
-        for f in $out/bin/* $out/sbin/*; do
-          wrapProgram $f \
-            --prefix LD_LIBRARY_PATH ':' "$libPath" \
-            --prefix PATH ':' "$scriptPath"
-        done
+        install -Dm755 $i $out/$i
+      done
 
-        for i in lib/libPrl*.0.0; do
-          cp $i $out/lib
-          ln -s $out/$i $out/''${i%.0.0}
-        done
+      install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
+      for f in $out/bin/* $out/sbin/*; do
+        wrapProgram $f \
+          --prefix LD_LIBRARY_PATH ':' "${libPath}" \
+          --prefix PATH ':' "${scriptPath}"
+      done
+
+      for i in lib/libPrl*.0.0; do
+        cp $i $out/lib
+        ln -s $out/$i $out/''${i%.0.0}
+      done
 
-        mkdir -p $out/share/man/man8
-        install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
+      mkdir -p $out/share/man/man8
+      install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
 
-        substituteInPlace ../99prltoolsd-hibernate \
-          --replace "/bin/bash" "${bash}/bin/bash"
+      substituteInPlace ../99prltoolsd-hibernate \
+        --replace "/bin/bash" "${bash}/bin/bash"
 
-        mkdir -p $out/etc/pm/sleep.d
-        install -Dm644 ../99prltoolsd-hibernate $out/etc/pm/sleep.d
-      fi
+      mkdir -p $out/etc/pm/sleep.d
+      install -Dm644 ../99prltoolsd-hibernate $out/etc/pm/sleep.d
     )
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Parallels Tools for Linux guests";
     homepage = "https://parallels.com";
-    platforms = platforms.linux;
     license = licenses.unfree;
     maintainers = with maintainers; [ catap wegank ];
+    platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/procps-ng/default.nix b/nixpkgs/pkgs/os-specific/linux/procps-ng/default.nix
index 1d19d9151175..67b839a1bd36 100644
--- a/nixpkgs/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,13 +1,13 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , ncurses
 , pkg-config
+, fetchpatch
 
   # `ps` with systemd support is able to properly report different
   # attributes like unit name, so we want to have it on linux.
-, withSystemd ? stdenv.isLinux
+, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , systemd
 
   # procps is mostly Linux-only. Most commands require a running Linux
@@ -19,19 +19,21 @@
 
 stdenv.mkDerivation rec {
   pname = "procps";
-  version = "3.3.16";
+  version = "3.3.17";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
+    sha256 = "sha256-RRiz56r9NOwH0AY9JQ/UdJmbILIAIYw65W9dIRPxQbQ=";
   };
 
-  patches = [
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
+    # NOTE: Starting from 4.x we will not need a patch anymore, but need to add
+    # "--disable-w" to configureFlags instead to prevent the utmp errors
     (fetchpatch {
-      url = "https://gitlab.com/procps-ng/procps/-/commit/bb96fc42956c9ed926a1b958ab715f8b4a663dec.diff";
-      sha256 = "0fzsb6ns3fvrszyzsz28qvbmcn135ilr4nwh2z1a0vlpl2fw961z";
-      name = "sysconf-argmax-sanity.patch";
+      name = "musl-fix-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/procps/musl-fixes.patch?id=37cb5b6ef194db66d9ed07c8ecab59bca3b91215";
+      sha256 = "sha256-DphAvESmVg1U3bJABU95R++QD34odStCl82EF0vmht0=";
     })
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix b/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
index 63de7453935c..ecb0fe535d35 100644
--- a/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
@@ -13,6 +13,10 @@ mkDerivation rec {
     sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/device.h # gcc12
+  '';
+
   buildInputs = [ qtbase qtgraphicaleffects ];
   nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/pscircle/default.nix b/nixpkgs/pkgs/os-specific/linux/pscircle/default.nix
index a293790cc97c..a7ee92beb52b 100644
--- a/nixpkgs/pkgs/os-specific/linux/pscircle/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pscircle/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pscircle";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "mildlyparallel";
     repo = "pscircle";
     rev = "v${version}";
-    sha256 = "1sm99423hh90kr4wdjqi9sdrrpk65j2vz2hzj65zcxfxyr6khjci";
+    sha256 = "sha256-bqbQBNscNfoqXprhoFUnUQO88YQs9xDhD4d3KHamtG0=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/psmisc/default.nix b/nixpkgs/pkgs/os-specific/linux/psmisc/default.nix
index e2f0fe59a075..092c75a5837d 100644
--- a/nixpkgs/pkgs/os-specific/linux/psmisc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/psmisc/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitLab, autoconf, automake, gettext, ncurses}:
+{lib, stdenv, fetchFromGitLab, fetchpatch, autoconf, automake, gettext, ncurses}:
 
 stdenv.mkDerivation rec {
   pname = "psmisc";
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-02jvRPqN8DS30ID42hQFu400NoFC5QiH5YA3NB+EoFI=";
   };
 
+  patches = [
+    # Upstream patch to be released in the next version
+    (fetchpatch {
+      name = "fallback-to-kill.diff";
+      url = "https://gitlab.com/psmisc/psmisc/-/commit/6892e321e7042e3df60a5501a1c59d076e8a856f.patch";
+      sha256 = "sha256-3uk1KXEOqAxpHWBORUw5+dR5s/Z55JJs5tuBZlTdjlo=";
+      excludes = [ "ChangeLog" ];
+    })
+  ];
+
   nativeBuildInputs = [ autoconf automake gettext ];
   buildInputs = [ ncurses ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/qc71_laptop/default.nix b/nixpkgs/pkgs/os-specific/linux/qc71_laptop/default.nix
index 92818ccfb096..bb4bf20ad0f6 100644
--- a/nixpkgs/pkgs/os-specific/linux/qc71_laptop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/qc71_laptop/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qc71_laptop";
-  version = "unstable-2022-06-01";
+  version = "unstable-2023-03-02";
 
   src = fetchFromGitHub {
     owner = "pobrn";
     repo = "qc71_laptop";
-    rev = "28106e0602807d78d1f5fa220ab6148dd6477c1c";
-    hash = "sha256-3bhw2HbEVuxPfGMt/eE2nCuMLHzYHRY3nRWPzZxKHro=";
+    rev = "8805dc5639f6659addf153a295ad4bbaa2483fa3";
+    hash = "sha256-wg7APGArjrl9DEAHTG6BknOBx+UbtNrzziwmLueKPfA=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
index 5e956f3baf34..6fc6e0012b31 100644
--- a/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qmk-udev-rules";
-  version = "0.15.25";
+  version = "0.19.11";
 
   src = fetchFromGitHub {
     owner = "qmk";
     repo = "qmk_firmware";
     rev = version;
-    sha256 = "4U1/9DgoKZ1Al76lZ2P8x4LIvtqaJPLq81cCSCy+9iE=";
+    hash = "sha256-RevCj+tFlleH08VGRwJjKhZdXwU6VlMsSCR9090pgRI=";
   };
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/qperf/default.nix b/nixpkgs/pkgs/os-specific/linux/qperf/default.nix
new file mode 100644
index 000000000000..a074cde448d9
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/qperf/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, lib
+, fetchFromGitHub, fetchpatch
+, autoconf, automake, perl, rdma-core }:
+
+stdenv.mkDerivation rec {
+  pname = "qperf";
+  version = "0.4.11";
+
+  src = fetchFromGitHub {
+    owner = "linux-rdma";
+    repo = "qperf";
+    rev = "v${version}";
+    hash = "sha256-x9l8xqwMDHlXRZpWt3XiqN5xyCTV5rk8jp/ClRPPECI=";
+  };
+
+  patches = [ (fetchpatch {
+    name = "version-bump.patch";
+    url = "https://github.com/linux-rdma/qperf/commit/34ec57ddb7e5ae1adfcfc8093065dff90b69a275.patch";
+    hash = "sha256-+7ckhUUB+7BG6qRKv0wgyIxkyvll2xjf3Wk1hpRsDo0=";
+  }) ];
+
+  nativeBuildInputs = [ autoconf automake perl rdma-core ];
+  buildInputs = [ rdma-core ];
+
+  postUnpack =  ''
+    patchShebangs .
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    ./autogen.sh
+    ./configure --prefix=$out
+    runHook postConfigure
+  '';
+
+  meta = with lib; {
+    description = "Measure RDMA and IP performance";
+    homepage = "https://github.com/linux-rdma/qperf";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ edwtjo ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/r8168/default.nix b/nixpkgs/pkgs/os-specific/linux/r8168/default.nix
index bcf5fb8956ab..69e779dfaa66 100644
--- a/nixpkgs/pkgs/os-specific/linux/r8168/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/r8168/default.nix
@@ -54,6 +54,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ timokau ];
-    broken = kernel.kernelAtLeast "5.17";
+    broken = (lib.versions.majorMinor kernel.modDirVersion) != "5.15";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rasdaemon/default.nix b/nixpkgs/pkgs/os-specific/linux/rasdaemon/default.nix
index cccd91fff8e1..35201d49b7f0 100644
--- a/nixpkgs/pkgs/os-specific/linux/rasdaemon/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rasdaemon/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rasdaemon";
-  version = "0.6.8";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mchehab";
     repo = "rasdaemon";
     rev = "v${version}";
-    sha256 = "sha256-gcwoc9lIJyqUiCSAHf1U8geLG58CxzjMFYFl8moaA2Q=";
+    sha256 = "sha256-oLwR+bNgKceVgLTOLYiKHNUkRmLouaQshdp/8UJnfqg=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix b/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
index c2ce195faf1c..3c19db403917 100644
--- a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
@@ -3,13 +3,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "raspberrypi-eeprom";
-  version = "unstable-2022-03-10";
+  version = "2023.01.11-138c0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "rpi-eeprom";
-    rev = "e8927007e3800db3a72100ee6cd38b0d9b687c16";
-    hash = "sha256-/hn6l5gheh6E3zoANwU1SXYgdry2IjOT9Muw2jkrtCU=";
+    rev = "v${version}";
+    hash = "sha256-z3VyqdSkvxAgVmtMI/Is9qYrOeDXlyVLwHSSC2+AxcA=";
   };
 
   buildInputs = [ python3 ];
diff --git a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
index aeed100fd84c..d6d67d4d1d41 100644
--- a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rdma-core";
-  version = "41.0";
+  version = "46.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "sha256-D6pgWdJKA6ZL+atFChqSW7hI6/dYfDBRzvb6hu1wxPg=";
+    sha256 = "sha256-/mhaEACBAtKdjn5hIj7YnuzrwraiuA4sR9eHg3w0YZM=";
   };
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix b/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
index f02b0acd3492..0c58ca7b3b91 100644
--- a/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, lib, fetchFromGitHub, python2 }:
+{ stdenv, lib, fetchFromGitHub, python3 }:
 
-stdenv.mkDerivation rec {
+let
+  python = python3.withPackages (p: [ p.pexpect ]);
+in stdenv.mkDerivation rec {
   version = "0.9.0";
   pname = "reptyr";
 
@@ -13,9 +15,14 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
 
-  checkInputs = [ (python2.withPackages (p: [ p.pexpect ])) ];
+  nativeCheckInputs = [ python ];
+
   doCheck = true;
 
+  checkFlags = [
+    "PYTHON_CMD=${python.interpreter}"
+  ];
+
   meta = {
     platforms = [
       "i686-linux"
diff --git a/nixpkgs/pkgs/os-specific/linux/restool/default.nix b/nixpkgs/pkgs/os-specific/linux/restool/default.nix
index add68522e7f9..853d9eeb7f3d 100644
--- a/nixpkgs/pkgs/os-specific/linux/restool/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/restool/default.nix
@@ -1,11 +1,12 @@
-{ stdenv, lib, fetchgit, bash, coreutils, dtc, file, gawk, gnugrep, gnused, pandoc, which }:
+{ stdenv, lib, fetchFromGitHub, bash, coreutils, dtc, file, gawk, gnugrep, gnused, pandoc, which }:
 
 stdenv.mkDerivation rec {
   pname = "restool";
   version = "2.4";
 
-  src = fetchgit {
-    url = "https://source.codeaurora.org/external/qoriq/qoriq-components/restool";
+  src = fetchFromGitHub {
+    owner = "nxp-qoriq";
+    repo = "restool";
     rev = "abd2f5b7181db9d03db9e6ccda0194923b73e9a2";
     sha256 = "sha256-ryTDyqSy39e8Omf7l8lK4mLWr8jccDhMVPldkVGSQVo=";
   };
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
       restool is a user space application providing the ability to dynamically
       create and manage DPAA2 containers and objects from Linux.
     '';
-    homepage = "https://source.codeaurora.org/external/qoriq/qoriq-components/restool/about/";
+    homepage = "https://github.com/nxp-qoriq/restool";
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ delroth ];
diff --git a/nixpkgs/pkgs/os-specific/linux/roccat-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/roccat-tools/default.nix
index bea79c2007db..389d5036b754 100644
--- a/nixpkgs/pkgs/os-specific/linux/roccat-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/roccat-tools/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, cmake, pkg-config, gettext
 , dbus, dbus-glib, libgaminggear, libgudev, lua
-, harfbuzz
+, harfbuzz, runtimeShell, coreutils, kmod
 }:
 
 stdenv.mkDerivation rec {
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
       /return/c \
         return g_build_path("/", g_get_user_data_dir(), "roccat", NULL);
     }' libroccat/roccat_helper.c
+
+    substituteInPlace udev/90-roccat-kone.rules \
+      --replace "/bin/sh" "${runtimeShell}" \
+      --replace "/sbin/modprobe" "${kmod}/bin/modprobe" \
+      --replace "/bin/echo" "${coreutils}/bin/echo"
   '';
 
   nativeBuildInputs = [ cmake pkg-config gettext ];
@@ -31,7 +36,7 @@ stdenv.mkDerivation rec {
     "-DLIBDIR=lib"
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${harfbuzz.dev}/include/harfbuzz"
 
     # Workaround build failure on -fno-common toolchains:
@@ -42,7 +47,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Tools to configure ROCCAT devices";
-    homepage = "http://roccat.sourceforge.net/";
+    homepage = "https://roccat.sourceforge.net/";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2Plus;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix b/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
index 67000776256c..6185bf9912dd 100644
--- a/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rt-tests";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yuSfeYTaCZ0F1GXQkDnH8PBvyzR2w/XDitN8csHB9xE=";
+    sha256 = "sha256-LzN3YB3Lb7tjyEplrFaNYtiGwHUUTztZBsMrUndd2cU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index 0f2e00c8382f..ecfd6a87e6b4 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -30,9 +29,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ bc ];
-
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   preInstall = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8189es/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8189es/default.nix
index a755404e6e5d..e31a54f56c31 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2021-10-01";
+  version = "2023-03-14";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "be378f47055da1bae42ff6ec1d62f1a5052ef097";
-    sha256 = "sha256-+19q1Xux2BjquavY+s0UDzTubEt6BEUZ9XVDVmj36us=";
+    rev = "ae7b31e55526ca0e01d2a3310118530bff4f1055";
+    sha256 = "sha256-l/xUxs63Y5LVT6ZafuRc+iaCXCSt2HwysYJLJ5hg3RM=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
-    substituteInPlace ./Makefile --replace '$(shell uname -r)' "${kernel.modDirVersion}"
     substituteInPlace ./Makefile --replace /sbin/depmod \#
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -42,6 +41,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ danielfullmer lheckemann ];
-    broken = kernel.kernelAtLeast "5.17";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8189fs/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8189fs/default.nix
index c1fe5e9733fa..67642f11d322 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8189fs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -1,15 +1,15 @@
-{ lib, kernel, rtl8189es, fetchFromGitHub }:
+{ lib, kernel, rtl8189es, fetchFromGitHub, fetchpatch }:
 
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
   name = "rtl8189fs-${kernel.version}-${version}";
-  version = "2022-05-20";
+  version = "2023-03-27";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "71500c28164369800041d1716ac513457179ce93";
-    sha256 = "sha256-JTv+ssSv5toNcZ5wR6p0Cywdk87z9Bdq0ftU0ekr/98=";
+    rev = "c223a25b1000d64432eca4201a8f012414dfc7ce";
+    sha256 = "sha256-5b5IshLbWxvmzcKy/xLsqKa3kZpwDQXTQtjqZLHyOCo=";
   };
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8723ds/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8723ds/default.nix
new file mode 100644
index 000000000000..be4b954c1b61
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -0,0 +1,44 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc }:
+
+stdenv.mkDerivation {
+  pname = "rtl8723ds";
+  version = "${kernel.version}-unstable-2022-12-01";
+
+  src = fetchFromGitHub {
+    owner = "lwfinger";
+    repo = "rtl8723ds";
+    rev = "a638cc8639015b8b9390af3350fab0366b6c87e7";
+    sha256 = "sha256-qfVE7k71NPzw3FwoOaUxH66PnDjbpMAF6CyOyUVdSMA=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace "/sbin/depmod" "#" \
+      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Linux driver for RTL8723DS.";
+    homepage = "https://github.com/lwfinger/rtl8723ds";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ chuangzhu ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
index 30f04c1eb8b3..786bcab86c2f 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,35 +2,30 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8812au";
-  version = "${kernel.version}-5.9.3.2.20210427";
+  version = "${kernel.version}-unstable-2023-05-11";
 
   src = fetchFromGitHub {
-    owner = "gordboy";
-    repo = "rtl8812au-5.9.3.2";
-    rev = "6ef5d8fcdb0b94b7490a9a38353877708fca2cd4";
-    sha256 = "sha256-czExf4z0nf7XEJ1YnRSB3CrGV6NTmUKDiZjLmrh6Hwo=";
+    owner = "morrownr";
+    repo = "8812au-20210629";
+    rev = "765d4e4bd5970f4c1c79e63bbe301667e5e029c9";
+    hash = "sha256-FF2LVfOpITMJ5LiwsGAudrWStlkKsZUlHvzZs03gb9g=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-
-  buildInputs = kernel.moduleBuildDependencies;
-
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
@@ -46,10 +41,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = "https://github.com/gordboy/rtl8812au-5.9.3.2";
+    homepage = "https://github.com/morrownr/8812au-20210629";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ fortuneteller2k ];
-    broken = kernel.kernelOlder "4.10" || kernel.kernelAtLeast "5.15" || kernel.isHardened;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8814au/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8814au/default.nix
index cab36054f516..0b1522c96972 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8814au";
-  version = "${kernel.version}-unstable-2022-05-23";
+  version = "${kernel.version}-unstable-2023-03-21";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8814au";
-    rev = "687f05c73e22dc14d5f24f2bb92f2ecac3cc71d5";
-    sha256 = "08znnihk9rdrwgyzazxqcrzwdjnm5q8ah92bfb552wjv11r87zv1";
+    rev = "6f80699e68fd2a9f2bba3f1a56ca06d1b7992bd8";
+    hash = "sha256-7dv+8vNI1OLLA4SdZQPL87pTS9HR6mGijzWo9WL7vc0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -16,12 +16,11 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
index dc693f01f572..37494d9c37ec 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -2,26 +2,32 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821au";
-  version = "${kernel.version}-unstable-2022-03-08";
+  version = "${kernel.version}-unstable-2023-03-22";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821au-20210708";
-    rev = "2c0c6fef81c0c7dcf8fa06fc4ab72168abc4f7bb";
-    sha256 = "sha256-Hdzi3pGqH71O0Jenjd/myG4+rZDLC/CcWHkjDoXBxS0=";
+    rev = "a133274b0532c17318e8790b771566f4a6b12b7c";
+    hash = "sha256-xn2cmbtqQhLM9qLCEvVhCuoCa7y8LM4sevPqv3a6pBw=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -40,7 +46,7 @@ stdenv.mkDerivation rec {
     description = "rtl8821AU and rtl8812AU chipset driver with firmware";
     homepage = "https://github.com/morrownr/8821au";
     license = licenses.gpl2Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = lib.platforms.linux;
     maintainers = with maintainers; [ plchldr ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8821ce/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8821ce/default.nix
index f841ba471a42..87670105b10b 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -1,20 +1,19 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , kernel
 , bc
 }:
 
 stdenv.mkDerivation rec {
   pname = "rtl8821ce";
-  version = "${kernel.version}-unstable-2022-06-01";
+  version = "${kernel.version}-unstable-2023-05-04";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "be733dc86781c68571650b395dd0fa6b53c0a039";
-    sha256 = "sha256-4PgISOjCSSGymz96VwE4jzcUiOEO+Ocuk2kJVIA+TQM=";
+    rev = "a478095a45d8aa957b45be4f9173c414efcacc6f";
+    hash = "sha256-xqVxylKhL7vbC7m5Av6ven5i7OBkS2RHxrKzLOVBlgE=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -25,7 +24,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -41,7 +39,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tomaspinho/rtl8821ce";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = stdenv.isAarch64;
     maintainers = with maintainers; [ hhm ivar ];
+    broken = stdenv.isAarch64 || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
index 3af4fee9eda2..d85186301071 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2022-05-07";
+  version = "${kernel.version}-unstable-2023-04-28";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "8821cu-20210118";
-    rev = "e3cf788e1dddaba3273190755ce424f93fe593e4";
-    hash = "sha256-VUZU/oFSaxewy/BF/2k4OssAi4AWSWweqXYZPHmsQvY=";
+    repo = "8821cu-20210916";
+    rev = "e49409f22ceea0d5b5ef431e6170580028b84c9d";
+    hash = "sha256-mElZRr4RkRFiraBM8BxT8yesYgvDaj6xP+9T3P+0Ns4=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
index cd13c48779ea..eb5a795c933b 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2022-05-23";
+  version = "${kernel.version}-unstable-2023-03-17";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "88x2bu-20210702";
-    rev = "3fbe980a9a8cee223e4671449128212cf7514b3c";
-    sha256 = "1p4bp8g94ny385nl3m2ca824dbm6lhjvh7s5rqyzk220il2sa0nd";
+    rev = "f0a2c9c74045cf2c3701084f389e358f9236fc8c";
+    sha256 = "sha256-hquLmEOzdBQ6rJld5kkzVw+hXBFb/ZwpBI0eL0rUrkM=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -35,6 +34,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/morrownr/88x2bu-20210702";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = [ maintainers.ralith ];
+    maintainers = with maintainers; [ otavio ralith ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index de5c79a56013..78409b7bd14a 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -1,29 +1,23 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 
-let
-  rev = "37e27f9165300c89607144b646545fac576ec510";
-in
 stdenv.mkDerivation rec {
   pname = "rtl88xxau-aircrack";
-  version = "${kernel.version}-${builtins.substring 0 6 rev}";
+  version = "${kernel.version}-unstable-02-05-2023";
 
   src = fetchFromGitHub {
     owner = "aircrack-ng";
     repo = "rtl8812au";
-    inherit rev;
-    sha256 = "sha256-TpmpueKAaCe7Nlmv8pMvgMXGVmXVa/1mBwtEoy4JyCY=";
+    rev = "35308f4dd73e77fa572c48867cce737449dd8548";
+    hash = "sha256-0kHrNsTKRl/xTQpDkIOYqTtcHlytXhXX8h+6guvLmLI=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
-
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -40,6 +34,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = [ maintainers.jethro ];
     platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
-    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtw88/default.nix b/nixpkgs/pkgs/os-specific/linux/rtw88/default.nix
index bbff4f6e4a71..abe98927613f 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtw88/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtw88/default.nix
@@ -5,13 +5,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw88";
-  version = "unstable-2022-06-03";
+  version = "unstable-2022-11-05";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw88";
-    rev = "03da251c76ea1005b42625825c39181e12d75693";
-    sha256 = "0l5ysp4x5wzrn48sfjv3rciqhq5ldcmk86b9x6j9775zjj7yw8hw";
+    rev = "c0dfe571fd7b307e036f186ef5711b4c0d9f3f08";
+    sha256 = "1gc5nv5pyrfag826z36vsrbirg6iww99yx45pcgpp7rmrpbwamvg";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     license = with licenses; [ bsd3 gpl2Only ];
     maintainers = with maintainers; [ tvorog atila ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.14";
+    broken = kernel.kernelOlder "4.20";
     priority = -1;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtw89/default.nix b/nixpkgs/pkgs/os-specific/linux/rtw89/default.nix
index 6ff208fa6dd9..1bb42860a8c7 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtw89/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtw89/default.nix
@@ -5,13 +5,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw89";
-  version = "unstable-2021-10-21";
+  version = "unstable-2022-12-18";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw89";
-    rev = "0684157cba90e36bff5bc61a59e7e87c359b5e5c";
-    sha256 = "0cvawyi1ksw9xkr8pzwipsl7b8hnmrb17w5cblyicwih8fqaw632";
+    rev = "e834edfe8bee6e27e31c2f783817a9c13ff45665";
+    sha256 = "19ApYiEvA0E6qgf5XQc03paZ+ghjZL8JoC3vSYYw3xU=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -30,12 +30,12 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = " Driver for Realtek 8852AE, an 802.11ax device";
+    description = " Driver for Realtek 8852AE, 8852BE, and 8853CE, 802.11ax devices";
     homepage = "https://github.com/lwfinger/rtw89";
     license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ tvorog ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.4";
+    broken = kernel.kernelOlder "5.7";
     priority = -1;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix b/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
index c7d9c1f8fb96..9204121a8cff 100644
--- a/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.10.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "sha256-SEM+HN5ecxp64jZTOouWuFO1HICtc6M+GitnS+bdfb4=";
+    sha256 = "sha256-n/LHFv14aDLbobeamOgDYBml1DgSGJmfmg/qff78i4c=";
   };
 
   nativeBuildInputs = [ pciutils cmake ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ asbachb ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix b/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix
deleted file mode 100644
index 27773a90e283..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "s6-linux-init";
-  version = "1.0.8.0";
-  sha256 = "sha256-kgVaeWTPZmBAZq2WSiwjku58XmSCG+AxRsE0Hg2MPcY=";
-
-  description = "A set of minimalistic tools used to create a s6-based init system, including a /sbin/init binary, on a Linux kernel";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "dev" "doc" "out" ];
-
-  configureFlags = [
-    "--bindir=\${bin}/bin"
-    "--includedir=\${dev}/include"
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-include=${execline.dev}/include"
-    "--with-include=${s6.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-    "--with-lib=${s6.out}/lib"
-    "--with-lib=${execline.lib}/lib"
-    "--with-dynlib=${skalibs.lib}/lib"
-    "--with-dynlib=${execline.lib}/lib"
-    "--with-dynlib=${s6.out}/lib"
-  ];
-
-  postInstall = ''
-    # remove all s6 executables from build directory
-    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable)
-    rm libs6_linux_init.* libhpr.*
-    rm -rf skel
-
-    mv doc $doc/share/doc/s6-linux-init/html
-  '';
-
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix
deleted file mode 100644
index 98199516a04e..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "s6-linux-utils";
-  version = "2.6.0.0";
-  sha256 = "sha256-bHEyc0oMgocALuaRDEafF1qX12aoAjwMM6+LqSZD7Vk=";
-
-  description = "A set of minimalistic Linux-specific system utilities";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "dev" "doc" "out" ];
-
-  # TODO: nsss support
-  configureFlags = [
-    "--bindir=\${bin}/bin"
-    "--includedir=\${dev}/include"
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-    "--with-dynlib=${skalibs.lib}/lib"
-  ];
-
-  postInstall = ''
-    # remove all s6 executables from build directory
-    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable) rngseed
-
-    mv doc $doc/share/doc/s6-linux-utils/html
-  '';
-
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/sasutils/default.nix b/nixpkgs/pkgs/os-specific/linux/sasutils/default.nix
index fd1a6f0b049b..d30e7f608c77 100644
--- a/nixpkgs/pkgs/os-specific/linux/sasutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sasutils/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sasutils";
-  version = "0.3.12";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "stanford-rc";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0kh5pcc2shdmrvqqi2y1zamzsfvk56pqgwqgqhjfz4r6yfpm04wl";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-9JRw+UoxU0I5RHuimzYrM/3j8UWHuicVpoOdRRrj2Wc=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/default.nix b/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/default.nix
deleted file mode 100644
index b4b6a7f42a7e..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ stdenv, lib, runCommandCC, skawarePackages }:
-
-with skawarePackages;
-
-let
-  # From https://skarnet.org/software/misc/sdnotify-wrapper.c,
-  # which is unversioned.
-  src = ./sdnotify-wrapper.c;
-
-in runCommandCC "sdnotify-wrapper" {
-
-   outputs = [ "bin" "doc" "out" ];
-
-   meta = {
-     homepage = "https://skarnet.org/software/misc/sdnotify-wrapper.c";
-     description = "Use systemd sd_notify without having to link against libsystemd";
-     platforms = lib.platforms.linux;
-     license = lib.licenses.isc;
-     maintainers = with lib.maintainers; [ Profpatsch ];
-   };
-
-} ''
-  mkdir -p $bin/bin
-  mkdir $out
-
-  # the -lskarnet has to come at the end to support static builds
-  $CC \
-    -o $bin/bin/sdnotify-wrapper \
-    -I${skalibs.dev}/include \
-    -L${skalibs.lib}/lib \
-    ${src} \
-    -lskarnet
-
-  mkdir -p $doc/share/doc/sdnotify-wrapper
-  # copy the documentation comment
-  sed -ne '/Usage:/,/*\//p' ${src} > $doc/share/doc/sdnotify-wrapper/README
-''
diff --git a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c b/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
deleted file mode 100644
index 3ad3cbc69063..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
-   Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
-   ISC license. See http://opensource.org/licenses/ISC
-
-   Build-time requirements: skalibs.  https://skarnet.org/software/skalibs/
-   Run-time requirements: none, if you link skalibs statically.
-
-   Compilation:
-     gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
-   Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
-   Adapt gcc's -I and -L options to your skalibs installation paths.
-
-   Usage: if a daemon would be launched by systemd as "foobard args...",
-   launch it as "sdnotify-wrapper foobard args..." instead, and you can now
-   tell systemd that this daemon supports readiness notification.
-
-   Instead of using sd_notify() and having to link against the systemd
-   library, the daemon notifies readiness by writing whatever it wants
-   to a file descriptor (by default: stdout), then a newline. (Then it
-   should close that file descriptor.) The simplest way is something like
-   int notify_readiness() { write(1, "\n", 1) ; close(1) ; }
-   This mechanism is understandable by any notification readiness framework.
-
-   Readiness notification occurs when the newline is written, not when
-   the descriptor is closed; but since sdnotify-wrapper stops reading
-   after the first newline and will exit, any subsequent writes will
-   fail and it's best to simply close the descriptor right away.
-
-   sdnotify-wrapper sees the notification when it occurs and sends it
-   to systemd using the sd_notify format.
-
-   Options:
-     -d fd: the daemon will write its notification on descriptor fd.
-     Default is 1.
-     -f: do not doublefork. Use if the daemon waits for children it does
-     not know it has (for instance, superservers do this). When in doubt,
-     do not use that option, or you may have a zombie hanging around.
-     -t timeout: if the daemon has not sent a notification after timeout
-     milliseconds, give up and exit; systemd will not be notified.
-     -k: keep the NOTIFY_SOCKET environment variable when execing into the
-     daemon. By default, the variable is unset: the daemon should not need it.
-
-   Notes:
-     sdnotify-wrapper does not change the daemon's pid. It runs as a
-     (grand)child of the daemon.
-     If the NOTIFY_SOCKET environment variable is not set, sdnotify-wrapper
-     does nothing - it only execs into the daemon.
-     sdnotify-wrapper is more liberal than sd_notify(). It will accept
-     a relative path in NOTIFY_SOCKET.
-*/
-
-
-#include <sys/types.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <skalibs/uint64.h>
-#include <skalibs/types.h>
-#include <skalibs/bytestr.h>
-#include <skalibs/sgetopt.h>
-#include <skalibs/strerr2.h>
-#include <skalibs/allreadwrite.h>
-#include <skalibs/tai.h>
-#include <skalibs/iopause.h>
-#include <skalibs/djbunix.h>
-#include <skalibs/socket.h>
-#include <skalibs/exec.h>
-
-#define USAGE "sdnotify-wrapper [ -d fd ] [ -f ] [ -t timeout ] [ -k ] prog..."
-#define dieusage() strerr_dieusage(100, USAGE)
-
-#define VAR "NOTIFY_SOCKET"
-
-static inline int ipc_sendto (int fd, char const *s, size_t len, char const *path)
-{
-  struct sockaddr_un sa ;
-  size_t l = strlen(path) ;
-  if (l > IPCPATH_MAX) return (errno = ENAMETOOLONG, 0) ;
-  memset(&sa, 0, sizeof sa) ;
-  sa.sun_family = AF_UNIX ;
-  memcpy(sa.sun_path, path, l+1) ;
-  if (path[0] == '@') sa.sun_path[0] = 0 ;
-  return sendto(fd, s, len, MSG_NOSIGNAL, (struct sockaddr *)&sa, sizeof sa) >= 0 ;
-}
-
-static inline void notify_systemd (pid_t pid, char const *socketpath)
-{
-  size_t n = 16 ;
-  char fmt[16 + PID_FMT] = "READY=1\nMAINPID=" ;
-  int fd = ipc_datagram_b() ;
-  if (fd < 0) strerr_diefu1sys(111, "create socket") ;
-  n += pid_fmt(fmt + n, pid) ;
-  fmt[n++] = '\n' ;
-  if (!ipc_sendto(fd, fmt, n, socketpath))
-    strerr_diefu2sys(111, "send notification message to ", socketpath) ;
-  close(fd) ;
-}
-
-static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const *s)
-{
-  char dummy[4096] ;
-  iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
-  tain deadline ;
-  tain_now_g() ;
-  if (timeout) tain_from_millisecs(&deadline, timeout) ;
-  else deadline = tain_infinite_relative ;
-  tain_add_g(&deadline, &deadline) ;
-  for (;;)
-  {
-    int r = iopause_g(&x, 1, &deadline) ;
-    if (r < 0) strerr_diefu1sys(111, "iopause") ;
-    if (!r) return 99 ;
-    r = sanitize_read(fd_read(fd, dummy, 4096)) ;
-    if (r < 0)
-      if (errno == EPIPE) return 1 ;
-      else strerr_diefu1sys(111, "read from parent") ;
-    else if (r && memchr(dummy, '\n', r)) break ;
-  }
-  close(fd) ;
-  notify_systemd(pid, s) ;
-  return 0 ;
-}
-
-int main (int argc, char const *const *argv)
-{
-  char const *s = getenv(VAR) ;
-  unsigned int fd = 1 ;
-  unsigned int timeout = 0 ;
-  int df = 1, keep = 0 ;
-  PROG = "sdnotify-wrapper" ;
-  {
-    subgetopt l = SUBGETOPT_ZERO ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'd' : if (!uint0_scan(l.arg, &fd)) dieusage() ; break ;
-        case 'f' : df = 0 ; break ;
-        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
-        case 'k' : keep = 1 ; break ;
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
-  }
-  if (!argc) dieusage() ;
-
-  if (!s) xexec(argv) ;
-  else
-  {
-    pid_t parent = getpid() ;
-    pid_t child ;
-    int p[2] ;
-    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
-    child = df ? doublefork() : fork() ;
-    if (child < 0) strerr_diefu1sys(111, df ? "doublefork" : "fork") ;
-    else if (!child)
-    {
-      PROG = "sdnotify-wrapper (child)" ;
-      close(p[1]) ;
-      return run_child(p[0], timeout, parent, s) ;
-    }
-    close(p[0]) ;
-    if (fd_move((int)fd, p[1]) < 0) strerr_diefu1sys(111, "move descriptor") ;
-    if (keep) xexec(argv) ;
-    else xmexec_m(argv, VAR, sizeof(VAR)) ;
-  }
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
index 5c8d83c3f82a..e6b8e778a77a 100644
--- a/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "3.3";
+  version = "3.5";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0qvhl40a6jlm8p719nnlw2ghlxbh8lxbcsd59azxp884bxgfr61h";
+    sha256 = "sha256-yaVQpzcFHrrywQL2ZcfsL4XnIyhwmAqgBnmYRZtBQoM=";
   };
 
   buildInputs = [ libsepol ];
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
     description = "SELinux policy core utilities (packaging additions)";
     license = licenses.gpl2;
     inherit (libsepol.meta) homepage platforms;
-    maintainers = [ maintainers.e-user ];
+    maintainers = [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/setools/default.nix b/nixpkgs/pkgs/os-specific/linux/setools/default.nix
index 9d547d2007ec..2e554a0241b2 100644
--- a/nixpkgs/pkgs/os-specific/linux/setools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/setools/default.nix
@@ -8,13 +8,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
-    rev = version;
-    sha256 = "1qvd5j6zwq4fmlahg45swjplhif2z89x7s6pnp07gvcp2fbqdsh5";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-4T5FIdnKi35JSm+IoYA2gIBBRV0nN0YLEw9xvDqNcgo=";
   };
 
   nativeBuildInputs = [ cython ];
@@ -22,7 +22,7 @@ buildPythonApplication rec {
   propagatedBuildInputs = [ enum34 libselinux networkx ]
     ++ optionals withGraphics [ pyqt5 ];
 
-  checkInputs = [ tox checkpolicy ];
+  nativeCheckInputs = [ tox checkpolicy ];
   preCheck = ''
     export CHECKPOLICY=${checkpolicy}/bin/checkpolicy
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
new file mode 100644
index 000000000000..eed99122cd64
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -0,0 +1,93 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, lib
+, curl
+, nlohmann_json
+, openssl
+, pkg-config
+, linkFarmFromDrvs
+, callPackage
+}:
+
+let
+  # Although those headers are also included in the source of `sgx-psw`, the `azure-dcap-client` build needs specific versions
+  filterSparse = list: ''
+    cp -r "$out"/. .
+    find "$out" -mindepth 1 -delete
+    cp ${lib.concatStringsSep " " list} "$out/"
+  '';
+  headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "SGXDataCenterAttestationPrimitives";
+      rev = "0436284f12f1bd5da7e7a06f6274d36b4c8d39f9";
+      sparseCheckout = [ "QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h" ];
+      hash = "sha256-ipKpYHbiwjCUXF/pCArJZy5ko1YX2wqMMdSnMUzhkgY=";
+      postFetch = filterSparse sparseCheckout;
+    })
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "linux-sgx";
+      rev = "1ccf25b64abd1c2eff05ead9d14b410b3c9ae7be";
+      hash = "sha256-WJRoS6+NBVJrFmHABEEDpDhW+zbWFUl65AycCkRavfs=";
+      sparseCheckout = [
+        "common/inc/sgx_report.h"
+        "common/inc/sgx_key.h"
+        "common/inc/sgx_attributes.h"
+      ];
+      postFetch = filterSparse sparseCheckout;
+    })
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "azure-dcap-client";
+  version = "1.11.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EYj3jnzTyJRl6N7avNf9VrB8r9U6zIE6wBNeVsMtWCA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    nlohmann_json
+    openssl
+  ];
+
+  postPatch = ''
+    mkdir -p src/Linux/ext/intel
+    find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \;
+
+    substitute src/Linux/Makefile{.in,} \
+      --replace '##CURLINC##' '${curl.dev}/include/curl/' \
+      --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
+  '';
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
+  makeFlags = [
+    "-C src/Linux"
+    "prefix=$(out)"
+  ];
+
+  # Online test suite; run with
+  # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests
+  passthru.tests.suite = callPackage ./test-suite.nix { };
+
+  meta = with lib; {
+    description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
+    homepage = "https://github.com/microsoft/azure-dcap-client";
+    maintainers = with maintainers; [ trundle veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = [ licenses.mit ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix b/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
new file mode 100644
index 000000000000..71fdb2bab39c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
@@ -0,0 +1,27 @@
+{ lib
+, sgx-azure-dcap-client
+, gtest
+, makeWrapper
+}:
+sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+    makeWrapper
+    gtest
+  ];
+
+  buildFlags = [
+    "tests"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ./src/Linux/tests "$out/bin/tests"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/tests" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
+  '';
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix b/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
index 2077d23bc9d7..4a5e50d9c6ab 100644
--- a/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
+      --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
       --chdir "$out/aesm"
 
     # Make sure we didn't forget to handle any files
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
   # NixOS module which is based on those files without relying on them. Still, it
   # is helpful to have properly patched versions for non-NixOS distributions.
   postFixup = ''
-    header "Fixing aesmd.service"
+    echo "Fixing aesmd.service"
     substituteInPlace $out/lib/systemd/system/aesmd.service \
       --replace '@aesm_folder@' \
                 "$out/aesm" \
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
       --replace "/bin/kill" \
                 "${coreutils}/bin/kill"
 
-    header "Fixing remount-dev-exec.service"
+    echo "Fixing remount-dev-exec.service"
     substituteInPlace $out/lib/systemd/system/remount-dev-exec.service \
       --replace '/bin/mount' \
                 "${util-linux}/bin/mount"
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix b/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
index 977139406fe9..053aaecbcbb7 100644
--- a/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -16,7 +16,7 @@
 , nasm
 , ocaml
 , ocamlPackages
-, openssl
+, openssl_1_1
 , perl
 , python3
 , texinfo
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libtool
-    openssl
+    openssl_1_1
   ];
 
   BINUTILS_DIR = "${binutils}/bin";
@@ -109,7 +109,7 @@ stdenv.mkDerivation rec {
       };
     in
     ''
-      header "Setting up IPP crypto build artifacts"
+      echo "Setting up IPP crypto build artifacts"
 
       pushd 'external/ippcp_internal'
 
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
     ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
     installDir=$installDir/sgxsdk
 
-    header "Move files created by installer"
+    echo "Move files created by installer"
 
     mkdir -p $out/bin
     pushd $out
@@ -206,15 +206,15 @@ stdenv.mkDerivation rec {
 
 
   preFixup = ''
-    header "Strip sgxsdk prefix"
+    echo "Strip sgxsdk prefix"
     for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
       substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
     done
 
-    header "Fixing pkg-config files"
+    echo "Fixing pkg-config files"
     sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
 
-    header "Fixing SGX_SDK default in samples"
+    echo "Fixing SGX_SDK default in samples"
     substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
       --replace '/opt/intel/sgxsdk' "$out"
     for file in $out/share/SampleCode/*/Makefile; do
@@ -222,12 +222,12 @@ stdenv.mkDerivation rec {
         --replace '/opt/intel/sgxsdk' "$out"
     done
 
-    header "Fixing BINUTILS_DIR in buildenv.mk"
+    echo "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
       --replace 'BINUTILS_DIR ?= /usr/local/bin' \
                 'BINUTILS_DIR ?= ${BINUTILS_DIR}'
 
-    header "Fixing GDB path in bin/sgx-gdb"
+    echo "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/nixpkgs/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
index 85fcfc9c554d..b9f682f5319b 100644
--- a/nixpkgs/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -1,14 +1,14 @@
 { lib
-, stdenv
+, gcc11Stdenv
 , fetchFromGitHub
 , cmake
 , nasm
-, openssl
+, openssl_1_1
 , python3
 , extraCmakeFlags ? [ ]
 }:
 
-stdenv.mkDerivation rec {
+gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
   version = "2021.3";
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     nasm
-    openssl
+    openssl_1_1
     python3
   ];
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/shadow/default.nix b/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
index 5537f9f6aacb..f0e2c281aa56 100644
--- a/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
@@ -1,56 +1,62 @@
-{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
-, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
-, pam ? null, glibcCross ? null
+{ lib, stdenv, fetchFromGitHub
+, runtimeShell, nixosTests, fetchpatch
+, autoreconfHook, bison, flex
+, docbook_xml_dtd_45, docbook_xsl
+, itstool , libxml2, libxslt
+, libxcrypt
+, glibcCross ? null
+, pam ? null
+, withTcb ? lib.meta.availableOn stdenv.hostPlatform tcb, tcb
 }:
-
 let
-
   glibc =
-    if stdenv.hostPlatform != stdenv.buildPlatform
-    then glibcCross
+    if stdenv.hostPlatform != stdenv.buildPlatform then glibcCross
     else assert stdenv.hostPlatform.libc == "glibc"; stdenv.cc.libc;
 
-  dots_in_usernames = fetchpatch {
-    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch";
-    sha256 = "1fj3rg6x3jppm5jvi9y7fhd2djbi4nc5pgwisw00xlh4qapgz692";
-  };
-
 in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.11.1";
+  version = "4.13";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
-    repo = "shadow";
-    rev = "v${version}";
-    sha256 = "sha256-PxLX5V0t18JftT5wT41krNv18Ew7Kz3MfZkOi/80ODA=";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-L54DhdBYthfB9436t/XWXiqKhW7rfd0GLS7pYGB32rA=";
   };
 
-  buildInputs = lib.optional (pam != null && stdenv.isLinux) pam;
-  nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_45 docbook_xsl flex bison itstool
-    ];
-
-  patches =
-    [ ./keep-path.patch
-      # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
-      ./respect-xml-catalog-files-var.patch
-      dots_in_usernames
-      ./runtime-shell.patch
-    ];
+  outputs = [ "out" "su" "dev" "man" ];
 
   RUNTIME_SHELL = runtimeShell;
 
-  # The nix daemon often forbids even creating set[ug]id files.
-  postPatch =
-    ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
-    '';
-
-  outputs = [ "out" "su" "man" ];
+  nativeBuildInputs = [
+    autoreconfHook bison flex
+    docbook_xml_dtd_45 docbook_xsl
+    itstool libxml2 libxslt
+  ];
+
+  buildInputs = [ libxcrypt ]
+    ++ lib.optional (pam != null && stdenv.isLinux) pam
+    ++ lib.optional withTcb tcb;
+
+  patches = [
+    ./keep-path.patch
+    # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
+    ./respect-xml-catalog-files-var.patch
+    ./runtime-shell.patch
+    ./fix-install-with-tcb.patch
+    # Fix HAVE_SHADOWGRP configure check
+    (fetchpatch {
+      url = "https://github.com/shadow-maint/shadow/commit/a281f241b592aec636d1b93a99e764499d68c7ef.patch";
+      sha256 = "sha256-GJWg/8ggTnrbIgjI+HYa26DdVbjTHTk/IHhy7GU9G5w=";
+    })
+  ];
 
-  enableParallelBuilding = true;
+  # The nix daemon often forbids even creating set[ug]id files.
+  postPatch = ''
+    sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
+  '';
 
   # Assume System V `setpgrp (void)', which is the default on GNU variants
   # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
@@ -62,23 +68,26 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-man"
     "--with-group-name-max-length=32"
-  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd";
-
-  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc")
-    ''
-      substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
-    '';
-
-  postInstall =
-    ''
-      # Don't install ‘groups’, since coreutils already provides it.
-      rm $out/bin/groups
-      rm $man/share/man/man1/groups.*
-
-      # Move the su binary into the su package
-      mkdir -p $su/bin
-      mv $out/bin/su $su/bin
-    '';
+    "--with-bcrypt"
+    "--with-yescrypt"
+  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd"
+    ++ lib.optional withTcb "--with-tcb";
+
+  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
+    substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
+  '';
+
+  postInstall = ''
+    # Don't install ‘groups’, since coreutils already provides it.
+    rm $out/bin/groups
+    rm $man/share/man/man1/groups.*
+
+    # Move the su binary into the su package
+    mkdir -p $su/bin
+    mv $out/bin/su $su/bin
+  '';
+
+  enableParallelBuilding = true;
 
   disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch b/nixpkgs/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
new file mode 100644
index 000000000000..ff6166b92f1d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
@@ -0,0 +1,28 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index a1a2e4e..fa17f9d 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -74,10 +74,6 @@ suidubins += newgidmap newuidmap
+ endif
+ endif
+ 
+-if WITH_TCB
+-shadowsgidubins = passwd
+-endif
+-
+ LDADD          = $(INTLLIBS) \
+ 		 $(top_builddir)/libmisc/libmisc.la \
+ 		 $(top_builddir)/lib/libshadow.la \
+@@ -146,12 +142,6 @@ install-am: all-am
+ 	set -e; for i in $(suidusbins); do \
+ 		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
+ 	done
+-if WITH_TCB
+-	set -e; for i in $(shadowsgidubins); do \
+-		chown root:shadow $(DESTDIR)$(ubindir)/$$i; \
+-		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
+-	done
+-endif
+ if ENABLE_SUBIDS
+ if FCAPS
+ 	setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap
diff --git a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
index 054d0c9fa1a4..6a02bd43aa89 100644
--- a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sssd";
-  version = "2.7.3";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mdgBRFqIT5SvDTeNiv1IbTyd9tcu8YJVfbw49gR6bKI=";
+    sha256 = "sha256-H9Snh2RzbnjGPqvC9fJHeZvAkGX/O/vmVsl143yb194=";
   };
 
   postPatch = ''
@@ -27,11 +27,11 @@ stdenv.mkDerivation rec {
   '';
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     export SGML_CATALOG_FILES="${docbookFiles}"
-    export PYTHONPATH=$(find ${python3.pkgs.ldap} -type d -name site-packages)
+    export PYTHONPATH=$(find ${python3.pkgs.python-ldap} -type d -name site-packages)
     export PATH=$PATH:${openldap}/libexec
 
     configureFlagsArray=(
@@ -54,12 +54,15 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  # Disable parallel install due to missing depends:
+  #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
+  enableParallelInstalling = false;
   nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config doxygen ];
   buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
                   samba nfs-utils p11-kit python3 popt
                   talloc tdb tevent ldb pam openldap pcre2 libkrb5
                   cifs-utils glib keyutils dbus fakeroot libxslt libxml2
-                  libuuid python3.pkgs.ldap systemd nspr check cmocka uid_wrapper
+                  libuuid python3.pkgs.python-ldap systemd nspr check cmocka uid_wrapper
                   nss_wrapper ncurses Po4a http-parser jansson jose ];
 
   makeFlags = [
@@ -101,6 +104,6 @@ stdenv.mkDerivation rec {
     changelog = "https://sssd.io/release-notes/sssd-${version}.html";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ e-user illustris ];
+    maintainers = with maintainers; [ illustris ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/switcheroo-control/default.nix b/nixpkgs/pkgs/os-specific/linux/switcheroo-control/default.nix
index 38945c706221..bb0f262a2b1c 100644
--- a/nixpkgs/pkgs/os-specific/linux/switcheroo-control/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/switcheroo-control/default.nix
@@ -12,7 +12,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "switcheroo-control";
-  version = "2.3";
+  version = "2.6";
 
   format = "other";
 
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "hadess";
     repo = pname;
     rev = version;
-    hash = "sha256-1Pze2TJ9mggfcpiLFwJ7/9WhsdJx4G3GoA7+Z47shuc=";
+    hash = "sha256-F+5HhMxM8pcnAGmVBARKWNCL0rIEzHW/jsGHHqYZJug=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix b/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
index 4f5f3b585dad..1a59244f8d4c 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,13 +1,12 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, kernel, installShellFiles, pkg-config
 , luajit, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
-, libyamlcpp, nlohmann_json
+, yaml-cpp, nlohmann_json, re2, zstd
 }:
 
-with lib;
 let
   # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
-  libsRev = "e5c53d648f3c4694385bbe488e7d47eaa36c229a";
-  libsSha256 = "sha256-pG10y5PpDqaF/cq8oAvax5B/ls2UTRQd7tCfBjWVf0U=";
+  libsRev = "0.11.0";
+  libsSha256 = "sha256-QvRTz3yMS6i+qdiSG51wvho9D7w/dMQhY72OYd3qOgU=";
 
   # Compare with https://github.com/falcosecurity/libs/blob/master/cmake/modules/valijson.cmake#L17
   valijson = fetchFromGitHub {
@@ -17,18 +16,34 @@ let
     sha256 = "sha256-ZD19Q2MxMQd3yEKbY90GFCrerie5/jzgO8do4JQDoKM=";
   };
 
+  # https://github.com/draios/sysdig/blob/0.31.5/cmake/modules/driver.cmake
+  driver = fetchFromGitHub {
+    owner = "falcosecurity";
+    repo = "libs";
+    rev = "5.0.1+driver";
+    sha256 = "sha256-CQ6QTcyTnThpJHDXgOM1Zdp5SG7rngp9XtEM+2mS8ro=";
+  };
+
 in
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.29.3";
+  version = "0.31.5";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "sha256-dMLeroOd9CgvmgQdPfX8oBxQSyksZi/hP4vO03JhlF0=";
+    sha256 = "sha256-RuoPqVulATtn7jSga/8fECs7weNfjt/YFh7iHmfCKjw=";
   };
 
+  # to fix the build against the latest kernel
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/draios/sysdig/compare/35ded9aab87801281e22898242e24e0bc63873b2...954e6fc6238f21d4870a491395d68a7dd3062aa9.patch";
+      sha256 = "sha256-gnLURnv8FW5LvqjbreCf9DPGdBcn7rfizGeznFqJ+Fk=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
   buildInputs = [
     luajit
@@ -40,12 +55,15 @@ stdenv.mkDerivation rec {
     gcc
     elfutils
     tbb
+    libb64
+    re2
     protobuf
     grpc
-    libyamlcpp
+    yaml-cpp
     jsoncpp
     nlohmann_json
-  ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
+    zstd
+  ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
@@ -57,25 +75,37 @@ stdenv.mkDerivation rec {
       sha256 = libsSha256;
     }} libs
     chmod -R +w libs
-    cmakeFlagsArray+=("-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs" "-DVALIJSON_INCLUDE=${valijson}/include")
+    cp -r ${driver} driver-src
+    chmod -R +w driver-src
+    cmakeFlagsArray+=(
+      "-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs"
+      "-DVALIJSON_INCLUDE=${valijson}/include"
+      "-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver"
+    )
   '';
 
   cmakeFlags = [
     "-DUSE_BUNDLED_DEPS=OFF"
     "-DSYSDIG_VERSION=${version}"
+    "-DUSE_BUNDLED_B64=OFF"
+    "-DUSE_BUNDLED_TBB=OFF"
+    "-DUSE_BUNDLED_RE2=OFF"
     "-DCREATE_TEST_TARGETS=OFF"
-  ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
+  ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
-  # needed since luajit-2.1.0-beta3
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
+  env.NIX_CFLAGS_COMPILE =
+   # needed since luajit-2.1.0-beta3
+   "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
+   # fix compiler warnings been treated as errors
+   "-Wno-error";
 
   preConfigure = ''
     if ! grep -q "${libsRev}" cmake/modules/falcosecurity-libs.cmake; then
       echo "falcosecurity-libs checksum needs to be updated!"
       exit 1
     fi
-    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -labsl_synchronization")
-  '' + optionalString (kernel != null) ''
+    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -lzstd -labsl_synchronization")
+  '' + lib.optionalString (kernel != null) ''
     export INSTALL_MOD_PATH="$out"
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
@@ -88,22 +118,26 @@ stdenv.mkDerivation rec {
       rmdir $out/etc/bash_completion.d
       rmdir $out/etc
     ''
-    + optionalString (kernel != null) ''
+    + lib.optionalString (kernel != null) ''
       make install_driver
       kernel_dev=${kernel.dev}
-      kernel_dev=''${kernel_dev#/nix/store/}
+      kernel_dev=''${kernel_dev#${builtins.storeDir}/}
       kernel_dev=''${kernel_dev%%-linux*dev*}
       if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
           sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
       else
-          xz -d $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko.xz
-          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
-          xz $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
+          for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
+            if test -f "$i"; then
+              xz -d $i
+              sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
+              xz -9 ''${i%.xz}
+            fi
+          done
       fi
     '';
 
 
-  meta = {
+  meta = with lib; {
     description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
     license = with licenses; [ asl20 gpl2 mit ];
     maintainers = [maintainers.raskin];
diff --git a/nixpkgs/pkgs/os-specific/linux/sysfsutils/default.nix b/nixpkgs/pkgs/os-specific/linux/sysfsutils/default.nix
index b5f067fffd72..113ba7939a65 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysfsutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysfsutils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
-    homepage = "http://linux-diag.sourceforge.net/Sysfsutils.html";
+    homepage = "https://linux-diag.sourceforge.net/Sysfsutils.html";
     longDescription =
       ''
         These are a set of utilites built upon sysfs, a new virtual
diff --git a/nixpkgs/pkgs/os-specific/linux/sysklogd/default.nix b/nixpkgs/pkgs/os-specific/linux/sysklogd/default.nix
index 4d9844f516b0..048d82b5a530 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysklogd/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./systemd.patch ./union-wait.patch ./fix-includes-for-musl.patch ];
 
-  NIX_CFLAGS_COMPILE = "-DSYSV";
+  env.NIX_CFLAGS_COMPILE = "-DSYSV";
 
   installFlags = [ "BINDIR=$(out)/sbin" "MANDIR=$(out)/share/man" "INSTALL=install" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/syslinux/default.nix b/nixpkgs/pkgs/os-specific/linux/syslinux/default.nix
index 821d51133087..f5153eb5abc9 100644
--- a/nixpkgs/pkgs/os-specific/linux/syslinux/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/syslinux/default.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation {
   # gcc-10. Otherwise build fails as:
   #   ld: acpi/xsdt.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: multiple definition of
   #     `e820_types'; memory.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: first defined here
-  NIX_CFLAGS_COMPILE="-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [
     "BINDIR=$(out)/bin"
diff --git a/nixpkgs/pkgs/os-specific/linux/sysstat/default.nix b/nixpkgs/pkgs/os-specific/linux/sysstat/default.nix
index f28b163a2fc7..ce7aa5f753f2 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysstat/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sysstat";
-  version = "12.4.5";
+  version = "12.6.2";
 
   src = fetchurl {
     url = "http://pagesperso-orange.fr/sebastien.godard/sysstat-${version}.tar.xz";
-    sha256 = "sha256-70RazqMBu7mW5BCEL2KQqNBJ6ITUhoz+9+hdwEt+7ls=";
+    hash = "sha256-PncTSu2qb8V9l0XaZ+39iZDhmt7nGsRxliKSYcVj+0g=";
   };
 
   buildInputs = [ gettext ];
diff --git a/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix b/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
index edaf2b5c8144..f1a4c9b7bb3b 100644
--- a/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
@@ -2,22 +2,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "system76-power";
-  version = "1.1.20";
+  version = "1.1.23";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "system76-power";
     rev = version;
-    sha256 = "sha256-Qk9zHqwFlUTWE+YRt2GASIekbDoBCHPAUUN3+0wpvfw=";
+    sha256 = "sha256-RuYDG4eZE599oa04xUR+W5B3/IPOpQUss1x7hzoydUQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libusb1 ];
 
-  cargoSha256 = "sha256-iG7M9ICFRTFVkbC89DyfR+Iyi7jaT9WmG3PSdBOF7YI=";
+  cargoSha256 = "sha256-Vps02ZRVmeOQ8jDFZJYAUb502MhqY+2YV2W1/9XGY+0=";
 
   postInstall = ''
-    install -D -m 0644 data/system76-power.conf $out/etc/dbus-1/system.d/system76-power.conf
+    install -D -m 0644 data/com.system76.PowerDaemon.conf $out/etc/dbus-1/system.d/com.system76.PowerDaemon.conf
+    install -D -m 0644 data/com.system76.PowerDaemon.policy $out/share/polkit-1/actions/com.system76.PowerDaemon.policy
+    install -D -m 0644 data/com.system76.PowerDaemon.xml $out/share/dbus-1/interfaces/com.system76.PowerDaemon.xml
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl b/nixpkgs/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl
new file mode 100644
index 000000000000..1ce08e2d3436
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl
@@ -0,0 +1,8 @@
+assignments {
+  sound-server {
+    // original config matches on /usr/bin/..., but this is NixOS
+    pipewire
+    pipewire-pulse
+    jackd
+  }
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/system76-scheduler/default.nix b/nixpkgs/pkgs/os-specific/linux/system76-scheduler/default.nix
new file mode 100644
index 000000000000..99c54900cf71
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/system76-scheduler/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pipewire
+, pkg-config
+, bcc
+, dbus }:
+
+let
+  version = "2.0.1";
+in rustPlatform.buildRustPackage {
+  pname = "system76-scheduler";
+  inherit version;
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "system76-scheduler";
+    rev = version;
+    hash = "sha256-o4noaLBXHDe7pMBHfQ85uzKJzwbBE5mkWq8h9l6iIZs=";
+  };
+  cargoSha256 = "sha256-hpFDAhOzm4v3lBWwAl/10pS5xvKCScdKsp5wpCeQ+FE=";
+
+  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
+  buildInputs = [ dbus pipewire ];
+
+  EXECSNOOP_PATH = "${bcc}/bin/execsnoop";
+
+  # tests don't build
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/data
+    install -D -m 0644 data/com.system76.Scheduler.conf $out/etc/dbus-1/system.d/com.system76.Scheduler.conf
+    install -D -m 0644 data/*.kdl $out/data/
+  '';
+
+  meta = with lib; {
+    description = "System76 Scheduler";
+    homepage = "https://github.com/pop-os/system76-scheduler";
+    license = licenses.mpl20;
+    platforms = [ "x86_64-linux" "x86-linux" "aarch64-linux" ];
+    maintainers = [ maintainers.cmm ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 2699c38440ce..a5cb7ba6bf78 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,17 +13,17 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 25b8a590a6..d18999ea87 100644
+index 3dbba1f850..40d367d1c8 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
- SUBSYSTEM=="block", TAG+="systemd"
+@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+ SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
 -# Ignore encrypted devices with no identified superblock on it, since
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Explicitly set SYSTEMD_READY=1 for DM devices that don't have it set yet, so that we always have something to import above
+ SUBSYSTEM=="block", ENV{DM_UUID}=="?*", ENV{SYSTEMD_READY}=="", ENV{SYSTEMD_READY}="1"
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index f46480d32feb..138823ec68f5 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -12,10 +12,10 @@ https://github.com/NixOS/nixos/issues/126
  2 files changed, 4 insertions(+)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index f683f05981..5a04c2c2a6 100644
+index 164e71a150..68e0766594 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -41,6 +41,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -25,10 +25,10 @@ index f683f05981..5a04c2c2a6 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 820aa8e286..653e43053d 100644
+index 61bd9d2601..a6243da417 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -518,6 +518,8 @@ static int delete_md(MountPoint *m) {
+@@ -531,6 +531,8 @@ static int delete_md(MountPoint *m) {
  
  static bool nonunmountable_path(const char *path) {
          return path_equal(path, "/")
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index a669350dbed8..c0d38c60202c 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 4ce80bba70..bb149192bd 100644
+index a697ea5cb9..65d9e7e398 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5651,6 +5651,7 @@ static int run(int argc, char *argv[]) {
+@@ -5635,6 +5635,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 4ce80bba70..bb149192bd 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5665,6 +5666,7 @@ static int run(int argc, char *argv[]) {
+@@ -5649,6 +5650,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
deleted file mode 100644
index dfaf53e4a314..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Thu, 1 May 2014 14:10:10 +0200
-Subject: [PATCH] Look for fsck in the right place
-
----
- src/fsck/fsck.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 745d01ff50..dd4eef45c3 100644
---- a/src/fsck/fsck.c
-+++ b/src/fsck/fsck.c
-@@ -368,7 +368,7 @@ static int run(int argc, char *argv[]) {
-                 } else
-                         dash_c[0] = 0;
- 
--                cmdline[i++] = "/sbin/fsck";
-+                cmdline[i++] = "/run/current-system/sw/bin/fsck";
-                 cmdline[i++] =  arg_repair;
-                 cmdline[i++] = "-T";
- 
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
new file mode 100644
index 000000000000..617cef50cc3c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
@@ -0,0 +1,152 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Thu, 13 Apr 2023 22:54:54 +0200
+Subject: [PATCH] fsck: look for fsck binary not just in /sbin
+
+This removes remaining hardcoded occurences of `/sbin/fsck`, and instead
+uses `find_executable` to find `fsck`.
+
+We also use `fsck_exists_for_fstype` to check for the `fsck.*`
+executable, which also checks in `$PATH`, so it's fair to assume fsck
+itself is also available.
+---
+ man/systemd-fsck@.service.xml |  8 ++++----
+ src/fsck/fsck.c               |  9 ++++++++-
+ src/home/homework-luks.c      | 11 ++++++++++-
+ src/shared/dissect-image.c    | 13 +++++++++++--
+ 4 files changed, 33 insertions(+), 8 deletions(-)
+
+diff --git a/man/systemd-fsck@.service.xml b/man/systemd-fsck@.service.xml
+index e928aebdb3..403286829e 100644
+--- a/man/systemd-fsck@.service.xml
++++ b/man/systemd-fsck@.service.xml
+@@ -51,17 +51,17 @@
+     <para><filename>systemd-fsck</filename> does not know any details
+     about specific filesystems, and simply executes file system
+     checkers specific to each filesystem type
+-    (<filename>/sbin/fsck.<replaceable>type</replaceable></filename>). These checkers will decide if
++    (<filename>fsck.<replaceable>type</replaceable></filename>). These checkers will decide if
+     the filesystem should actually be checked based on the time since
+     last check, number of mounts, unclean unmount, etc.</para>
+ 
+     <para><filename>systemd-fsck-root.service</filename> and <filename>systemd-fsck-usr.service</filename>
+-    will activate <filename>reboot.target</filename> if <filename>/sbin/fsck</filename> returns the "System
+-    should reboot" condition, or <filename>emergency.target</filename> if <filename>/sbin/fsck</filename>
++    will activate <filename>reboot.target</filename> if <filename>fsck</filename> returns the "System
++    should reboot" condition, or <filename>emergency.target</filename> if <filename>fsck</filename>
+     returns the "Filesystem errors left uncorrected" condition.</para>
+ 
+     <para><filename>systemd-fsck@.service</filename> will fail if
+-    <filename>/sbin/fsck</filename> returns with either "System should reboot"
++    <filename>fsck</filename> returns with either "System should reboot"
+     or "Filesystem errors left uncorrected" conditions. For filesystems
+     listed in <filename>/etc/fstab</filename> without <literal>nofail</literal>
+     or <literal>noauto</literal> options, <literal>local-fs.target</literal>
+diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
+index e25c5d5efa..0e0e73c9ac 100644
+--- a/src/fsck/fsck.c
++++ b/src/fsck/fsck.c
+@@ -351,6 +351,7 @@ static int run(int argc, char *argv[]) {
+         if (r == 0) {
+                 char dash_c[STRLEN("-C") + DECIMAL_STR_MAX(int) + 1];
+                 int progress_socket = -1;
++                _cleanup_free_ char *fsck_path = NULL;
+                 const char *cmdline[9];
+                 int i = 0;
+ 
+@@ -371,7 +372,13 @@ static int run(int argc, char *argv[]) {
+                 } else
+                         dash_c[0] = 0;
+ 
+-                cmdline[i++] = "/sbin/fsck";
++                r = find_executable("fsck", &fsck_path);
++                if (r < 0) {
++                        log_error_errno(r, "Cannot find fsck binary: %m");
++                        _exit(FSCK_OPERATIONAL_ERROR);
++                }
++
++                cmdline[i++] = fsck_path;
+                 cmdline[i++] =  arg_repair;
+                 cmdline[i++] = "-T";
+ 
+diff --git a/src/home/homework-luks.c b/src/home/homework-luks.c
+index 2ea9887853..e267457b8e 100644
+--- a/src/home/homework-luks.c
++++ b/src/home/homework-luks.c
+@@ -215,6 +215,7 @@ static int block_get_size_by_path(const char *path, uint64_t *ret) {
+ static int run_fsck(const char *node, const char *fstype) {
+         int r, exit_status;
+         pid_t fsck_pid;
++        _cleanup_free_ char *fsck_path = NULL;
+ 
+         assert(node);
+         assert(fstype);
+@@ -227,6 +228,14 @@ static int run_fsck(const char *node, const char *fstype) {
+                 return 0;
+         }
+ 
++        r = find_executable("fsck", &fsck_path);
++        /* We proceed anyway if we can't determine whether the fsck
++         * binary for some specific fstype exists,
++         * but the lack of the main fsck binary should be considered
++         * an error. */
++        if (r < 0)
++                return log_error_errno(r, "Cannot find fsck binary: %m");
++
+         r = safe_fork("(fsck)",
+                       FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
+                       &fsck_pid);
+@@ -234,7 +243,7 @@ static int run_fsck(const char *node, const char *fstype) {
+                 return r;
+         if (r == 0) {
+                 /* Child */
+-                execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
++                execl(fsck_path, fsck_path, "-aTl", node, NULL);
+                 log_open();
+                 log_error_errno(errno, "Failed to execute fsck: %m");
+                 _exit(FSCK_OPERATIONAL_ERROR);
+diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
+index 4749bdd230..2b6e1418dd 100644
+--- a/src/shared/dissect-image.c
++++ b/src/shared/dissect-image.c
+@@ -1423,6 +1423,7 @@ static int is_loop_device(const char *path) {
+ static int run_fsck(int node_fd, const char *fstype) {
+         int r, exit_status;
+         pid_t pid;
++        _cleanup_free_ char *fsck_path = NULL;
+ 
+         assert(node_fd >= 0);
+         assert(fstype);
+@@ -1437,6 +1438,14 @@ static int run_fsck(int node_fd, const char *fstype) {
+                 return 0;
+         }
+ 
++        r = find_executable("fsck", &fsck_path);
++        /* We proceed anyway if we can't determine whether the fsck
++         * binary for some specific fstype exists,
++         * but the lack of the main fsck binary should be considered
++         * an error. */
++        if (r < 0)
++                return log_error_errno(r, "Cannot find fsck binary: %m");
++
+         r = safe_fork_full(
+                         "(fsck)",
+                         &node_fd, 1, /* Leave the node fd open */
+@@ -1446,7 +1455,7 @@ static int run_fsck(int node_fd, const char *fstype) {
+                 return log_debug_errno(r, "Failed to fork off fsck: %m");
+         if (r == 0) {
+                 /* Child */
+-                execl("/sbin/fsck", "/sbin/fsck", "-aT", FORMAT_PROC_FD_PATH(node_fd), NULL);
++                execl(fsck_path, fsck_path, "-aT", FORMAT_PROC_FD_PATH(node_fd), NULL);
+                 log_open();
+                 log_debug_errno(errno, "Failed to execl() fsck: %m");
+                 _exit(FSCK_OPERATIONAL_ERROR);
+@@ -1454,7 +1463,7 @@ static int run_fsck(int node_fd, const char *fstype) {
+ 
+         exit_status = wait_for_terminate_and_check("fsck", pid, 0);
+         if (exit_status < 0)
+-                return log_debug_errno(exit_status, "Failed to fork off /sbin/fsck: %m");
++                return log_debug_errno(exit_status, "Failed to fork off %s: %m", fsck_path);
+ 
+         if ((exit_status & ~FSCK_ERROR_CORRECTED) != FSCK_SUCCESS) {
+                 log_debug("fsck failed with exit status %i.", exit_status);
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 8a06e2cf69cb..b4a0da30c8f6 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -14,7 +14,7 @@ Also, remove /usr and /lib as these don't exist on NixOS.
  2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 1f4331a8bf..4b9a8ae26e 100644
+index c99e9d8786..b9f85d1f8c 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index c06f12550261..0a638dfbf0ea 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 296b759959..71ef7f27b4 100644
+index 380a4e30d7..817acb87b8 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1428,7 +1428,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1437,7 +1437,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 174cca335b8e..2c4c3f6564e1 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 5f09e6d0eb..46bef3b59d 100644
+index 36ab0148b9..7d458d196d 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -910,6 +910,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1028,6 +1028,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index 5f09e6d0eb..46bef3b59d 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -973,6 +976,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1091,6 +1094,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,44 +35,44 @@ index 5f09e6d0eb..46bef3b59d 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 89bf9c6fba..af2f37a4ca 100644
+index 841e5e3e91..a21e34430b 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -359,6 +359,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
-         if (r < 0)
-                 return r;
+@@ -264,6 +264,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+                                 "Changing system settings via systemd is not supported on NixOS.");
-+
          use_localegen = locale_gen_check_available();
  
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
          /* If single locale without variable name is provided, then we assume it is LANG=. */
-@@ -484,6 +487,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+         if (strv_length(l) == 1 && !strchr(l[0], '=')) {
+                 if (!locale_is_valid(l[0]))
+@@ -382,6 +385,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
-                 return r;
+                 return bus_log_parse_error(r);
  
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
 +
-         keymap = empty_to_null(keymap);
-         keymap_toggle = empty_to_null(keymap_toggle);
+         vc_context_empty_to_null(&in);
  
-@@ -664,6 +670,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+         FOREACH_STRING(name, in.keymap ?: in.toggle, in.keymap ? in.toggle : NULL) {
+@@ -607,6 +613,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
-                 return r;
+                 return bus_log_parse_error(r);
  
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
 +
-         layout = empty_to_null(layout);
-         model = empty_to_null(model);
-         variant = empty_to_null(variant);
+         x11_context_empty_to_null(&in);
+ 
+         if (!x11_context_is_safe(&in))
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 9ca5d37b75..e41d8d73df 100644
+index ad483301ef..31ed86955b 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -669,6 +669,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index 9ca5d37b75..e41d8d73df 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -748,6 +752,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index 9ca5d37b75..e41d8d73df 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -930,6 +937,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
index 69bd1cc97b27..7777ba7e4259 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
@@ -5,14 +5,14 @@ Subject: [PATCH] Fix hwdb paths
 
 Patch by vcunat.
 ---
- src/libsystemd/sd-hwdb/hwdb-internal.h | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
+ src/libsystemd/sd-hwdb/hwdb-internal.h | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
 
 diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 62d27f7b89..87318e041b 100644
+index 5302679a62..39e59a527f 100644
 --- a/src/libsystemd/sd-hwdb/hwdb-internal.h
 +++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
-@@ -83,8 +83,5 @@ struct trie_value_entry2_f {
+@@ -83,8 +83,4 @@ struct trie_value_entry2_f {
  } _packed_;
  
  #define hwdb_bin_paths                          \
@@ -22,4 +22,3 @@ index 62d27f7b89..87318e041b 100644
 -        _CONF_PATHS_SPLIT_USR_NULSTR("systemd/hwdb/hwdb.bin") \
 -        UDEVLIBEXECDIR "/hwdb.bin\0"
 +        "/etc/udev/hwdb.bin\0"
-+
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 106eba2bed83..52733a4c4920 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 0ad8de4b9a..b794c6c7d0 100644
+index 0bea149324..4b16115d43 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1281,7 +1281,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1283,7 +1283,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
          if (!f)
                  return -errno;
  
-@@ -1320,7 +1320,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1322,7 +1322,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
          _cleanup_strv_free_ char **zones = NULL;
          int r;
  
@@ -56,7 +56,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
          if (!f)
                  return -errno;
  
-@@ -1433,7 +1433,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1434,7 +1434,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1491,7 +1491,7 @@ int get_timezone(char **ret) {
+@@ -1492,7 +1492,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 0ad8de4b9a..b794c6c7d0 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 39160182ef..8dcc3307c8 100644
+index 9e79f84691..1a1c75718c 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -494,7 +494,7 @@ static int process_timezone(void) {
+@@ -512,7 +512,7 @@ static int process_timezone(void) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -86,12 +86,12 @@ index 39160182ef..8dcc3307c8 100644
 +        e = strjoina("zoneinfo/", arg_timezone);
  
          (void) mkdir_parents(etc_localtime, 0755);
-         if (symlink(e, etc_localtime) < 0)
+         r = symlink_atomic(e, etc_localtime);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index bb149192bd..08751ed944 100644
+index 65d9e7e398..dd44d529ca 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1901,8 +1901,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1915,8 +1915,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,7 +103,7 @@ index bb149192bd..08751ed944 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index e41d8d73df..ff1a384b3b 100644
+index 31ed86955b..8db8d8c288 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
index a3315a1e657a..fac9916cf3b4 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,10 +10,10 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 661d54c27d..e98b578531 100644
+index fb83881cc7..c47a33134a 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -277,7 +277,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index 75d113d00339..eec57111b913 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] build: don't create statedir and don't touch prefixdir
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 9c170acc0a..818b7a3eb5 100644
+index b1f5477836..1a39484855 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3928,9 +3928,6 @@ install_data('LICENSE.GPL2',
+@@ -4278,9 +4278,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
index c1659ae8a78a..6e07928d5fbd 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
@@ -8,14 +8,14 @@ discovery default udev rules. By adding `$out/lib` to the lookup paths
 we should again be able to discover the udev rules amongst other default
 files that I might have missed.
 ---
- src/basic/def.h | 6 ++++--
+ src/basic/constants.h | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
 
-diff --git a/src/basic/def.h b/src/basic/def.h
-index 0a1ae023a3..cc00ff6c68 100644
---- a/src/basic/def.h
-+++ b/src/basic/def.h
-@@ -39,13 +39,15 @@
+diff --git a/src/basic/constants.h b/src/basic/constants.h
+index 5d68cc6332..33c06c1f65 100644
+--- a/src/basic/constants.h
++++ b/src/basic/constants.h
+@@ -73,13 +73,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 4add87267ddb..84ac0d882d6d 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -6,19 +6,18 @@ Subject: [PATCH] systemd-shutdown: execute scripts in
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
 ---
- src/shutdown/shutdown.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ src/shutdown/shutdown.c | 1 +
+ 1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 2c3cbec02c..1b876203c6 100644
+index 42111d2772..53467ac229 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -335,7 +335,7 @@ int main(int argc, char *argv[]) {
+@@ -335,6 +335,7 @@ static void init_watchdog(void) {
+ int main(int argc, char *argv[]) {
+         static const char* const dirs[] = {
+                 SYSTEM_SHUTDOWN_PATH,
++                "/etc/systemd/system-shutdown",
+                 NULL
+         };
          _cleanup_free_ char *cgroup = NULL;
-         char *arguments[3];
-         int cmd, r, umount_log_level = LOG_INFO;
--        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, NULL};
-+        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, "/etc/systemd/system-shutdown", NULL};
- 
-         /* The log target defaults to console, but the original systemd process will pass its log target in through a
-          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 22e2bc8e5300..5fa3fb14f1ff 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 65e391d02a..28af2f8bf5 100644
+index 288fa4ae84..07deb19d7c 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -180,6 +180,7 @@ static int execute(
+@@ -186,6 +186,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 653f3beea965..b3d1db340ef8 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,7 +10,7 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 553aa4fb58..46294f4bb1 100644
+index 56f01f41d8..f9b8627388 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -24,11 +24,11 @@
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
index f4925437aa58..236af4b2c97b 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 71ef7f27b4..33ded94a7c 100644
+index 817acb87b8..3f31359f8a 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3704,9 +3704,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3714,9 +3714,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
new file mode 100644
index 000000000000..18982ecd04bd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: oxalica <oxalicc@pm.me>
+Date: Tue, 4 Oct 2022 09:18:07 +0800
+Subject: [PATCH] core: don't taint on unmerged /usr
+
+NixOS has very different approach towards /bin and /sbin - they don't
+really exist (except for /bin/sh and /usr/bin/env, because these are used
+heavily in shebangs around the world). The concept of merged or unmerged
+usr doesn't really apply here at all, it's neither of the two.
+Users don't execute things from /bin or /sbin, there's nothing else in
+there. In all cases, systemd doesn't look things up from /usr/bin or /bin,
+so showing the taint isn't really helpful.
+
+See also: https://github.com/systemd/systemd/issues/24191
+---
+ src/core/manager.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 3f31359f8a..0c4ec0b4fb 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -4556,10 +4556,6 @@ char* manager_taint_string(const Manager *m) {
+         if (m->taint_usr)
+                 stage[n++] = "split-usr";
+ 
+-        _cleanup_free_ char *usrbin = NULL;
+-        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
+-                stage[n++] = "unmerged-usr";
+-
+         if (access("/proc/cgroups", F_OK) < 0)
+                 stage[n++] = "cgroups-missing";
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
new file mode 100644
index 000000000000..8d6eab5ed847
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Sun, 15 Jan 2023 20:15:55 +0800
+Subject: [PATCH] tpm2_context_init: fix driver name checking
+
+https://github.com/systemd/systemd/commit/542dbc623e introduced
+additional checks for tpm2 driver names, namely ensuring the driver
+name, when concated with "libtss2-tcti-" and ".so.0", generates a valid
+filename (with no '/' inside).
+
+For example, if the driver is name "device", the line
+  fn = strjoina("libtss2-tcti-", driver, ".so.0")
+would yield "libtss2-tcti-device.so.0", passing the check. And the
+filename is then passed to dlopen for loading the driver.
+
+Our current approach for systemd to correctly locate these dynamically
+loaded libraries is to patch the filenames to include their absolute
+path. Thus the line mentioned above is patched into
+  fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0")
+yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0",
+tripping the check.
+
+This patch relaxes the check to also accept absolute paths, by replacing
+filename_is_valid with path_is_valid.
+---
+ src/shared/tpm2-util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
+index 4345b95106..424a334df1 100644
+--- a/src/shared/tpm2-util.c
++++ b/src/shared/tpm2-util.c
+@@ -176,7 +176,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+                 fn = strjoina("libtss2-tcti-", driver, ".so.0");
+ 
+                 /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
+-                if (!filename_is_valid(fn))
++                if (!path_is_valid(fn))
+                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+ 
+                 context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 348f0e11342e..7275d275f74b 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -3,10 +3,12 @@
 { stdenv
 , lib
 , nixosTests
+, pkgsCross
 , fetchFromGitHub
 , fetchpatch
 , fetchzip
 , buildPackages
+, makeBinaryWrapper
 , ninja
 , meson
 , m4
@@ -27,6 +29,7 @@
 , util-linux
 , kbd
 , kmod
+, libxcrypt
 
   # Optional dependencies
 , pam
@@ -61,45 +64,66 @@
 , withKexectools ? lib.meta.availableOn stdenv.hostPlatform kexec-tools
 , kexec-tools
 , bashInteractive
+, bash
 , libmicrohttpd
 , libfido2
 , p11-kit
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
   # Only libbpf should be a runtime dependency.
+  # Note: llvmPackages is explicitly taken from buildPackages instead of relying
+  # on splicing. Splicing will evaluate the adjacent (pkgsHostTarget) llvmPackages
+  # which is sometimes problematic: llvmPackages.clang looks at targetPackages.stdenv.cc
+  # which, in the unfortunate case of pkgsCross.ghcjs, `throw`s. If we explicitly
+  # take buildPackages.llvmPackages, this is no problem because
+  # `buildPackages.targetPackages.stdenv.cc == stdenv.cc` relative to us. Working
+  # around this is important, because systemd is in the dependency closure of
+  # GHC via emscripten and jdk.
 , bpftools
 , libbpf
-, llvmPackages
 
+, withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
+, withAudit ? true
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
-, withHomed ? false
+, withHomed ? !stdenv.hostPlatform.isMusl
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
-, withLibBPF ? false # currently fails while generating BPF objects
+, withKmod ? true
+, withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
+    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
+    && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+    # buildPackages.targetPackages.llvmPackages is the same as llvmPackages,
+    # but we do it this way to avoid taking llvmPackages as an input, and
+    # risking making it too easy to ignore the above comment about llvmPackages.
+    && lib.meta.availableOn stdenv.hostPlatform buildPackages.targetPackages.llvmPackages.compiler-rt
+, withLibidn2 ? true
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
 , withNetworkd ? true
 , withNss ? !stdenv.hostPlatform.isMusl
-, withOomd ? false
+, withOomd ? true
+, withPam ? true
 , withPCRE2 ? true
 , withPolkit ? true
-, withPortabled ? false
+, withPortabled ? !stdenv.hostPlatform.isMusl
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
 , withTimedated ? true
 , withTimesyncd ? true
-, withTpm2Tss ? !stdenv.hostPlatform.isMusl
-, withUserDb ? !stdenv.hostPlatform.isMusl
+, withTpm2Tss ? true
+, withUkify ? false  # adds python to closure which is too much by default
+, withUserDb ? true
+, withUtmp ? !stdenv.hostPlatform.isMusl
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
 
@@ -112,30 +136,24 @@
 , docbook_xml_dtd_45
 }:
 
-assert withResolved -> (libgcrypt != null && libgpg-error != null);
-assert withImportd ->
-(curl.dev != null && zlib != null && xz != null && libgcrypt != null
-  && gnutar != null && gnupg != null && withCompression);
-
-assert withEfi -> (gnu-efi != null);
-assert withRemote -> lib.getDev curl != null;
+assert withImportd -> withCompression;
 assert withCoredump -> withCompression;
-
 assert withHomed -> withCryptsetup;
+assert withHomed -> withPam;
+assert withUkify -> withEfi;
 
-assert withCryptsetup -> (cryptsetup != null);
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "251.3";
+  version = "253.3";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1653143108";
+  releaseTimestamp = "1676488940";
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
@@ -144,7 +162,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "sha256-vcj+k/duRID2R+wGQIyq+dVRrFYNQTsjHya6k0hmZxk=";
+    hash = "sha256-iy1kyqiVeXIhFJAQ+nYorrXm/xb2gfakyrEfMyNR5l8=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -156,7 +174,7 @@ stdenv.mkDerivation {
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
-    ./0004-Look-for-fsck-in-the-right-place.patch
+    ./0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
     ./0005-Add-some-NixOS-specific-unit-directories.patch
     ./0006-Get-rid-of-a-useless-message-in-user-sessions.patch
     ./0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -170,34 +188,48 @@ stdenv.mkDerivation {
     ./0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0016-pkg-config-derive-prefix-from-prefix.patch
     ./0017-inherit-systemd-environment-when-calling-generators.patch
+    ./0018-core-don-t-taint-on-unmerged-usr.patch
+    ./0019-tpm2_context_init-fix-driver-name-checking.patch
+
+    (fetchpatch {
+      # https://github.com/systemd/systemd/pull/25948
+      #
+      # [Firmware file size bug]: Some UEFI firmwares fail on large
+      # reads. Now that systemd-boot loads initrd itself, systems with
+      # such firmware won't boot without this fix
+      url = "https://github.com/systemd/systemd/commit/3ed1d966f00b002ed822ca9de116252bd91fe6c3.patch";
+      hash = "sha256-pwXrLTScqgnvfddlzUBZpwsoMrvRLcZPp6e4whMcyL4=";
+    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-86a33f98a7c0d6f2c2b51d02ba9e01b63062cf98.tar.bz2";
-        sha256 = "081j01sw21hl405l7g9z4bavvq0q0k4g80365677m0ykhiqlx3am";
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-f34f6ab04b443608497b73668365819343d0c2fe.tar.gz";
+        sha256 = "DFcLPvjQIxGEDADpP232ZRd7cOEKt6B48Ah29nIGTt4=";
       };
       musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
     in
     [
-      (musl-patches + "/0003-missing_type.h-add-comparison_fn_t.patch")
-      (musl-patches + "/0004-add-fallback-parse_printf_format-implementation.patch")
-      (musl-patches + "/0005-src-basic-missing.h-check-for-missing-strndupa.patch")
-      (musl-patches + "/0007-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
-      (musl-patches + "/0008-add-missing-FTW_-macros-for-musl.patch")
-      (musl-patches + "/0010-Use-uintmax_t-for-handling-rlim_t.patch")
-      (musl-patches + "/0011-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
-      (musl-patches + "/0012-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
-      (musl-patches + "/0013-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
-      (musl-patches + "/0014-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
-      (musl-patches + "/0015-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
-      (musl-patches + "/0018-avoid-redefinition-of-prctl_mm_map-structure.patch")
-      (musl-patches + "/0022-do-not-disable-buffer-in-writing-files.patch")
-      (musl-patches + "/0025-Handle-__cpu_mask-usage.patch")
-      (musl-patches + "/0026-Handle-missing-gshadow.patch")
-      (musl-patches + "/0028-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
-      (musl-patches + "/0001-pass-correct-parameters-to-getdents64.patch")
-      (musl-patches + "/0002-Add-sys-stat.h-for-S_IFDIR.patch")
       (musl-patches + "/0001-Adjust-for-musl-headers.patch")
+      (musl-patches + "/0005-pass-correct-parameters-to-getdents64.patch")
+      (musl-patches + "/0006-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch")
+      (musl-patches + "/0007-Add-sys-stat.h-for-S_IFDIR.patch")
+      (musl-patches + "/0009-missing_type.h-add-comparison_fn_t.patch")
+      (musl-patches + "/0010-add-fallback-parse_printf_format-implementation.patch")
+      (musl-patches + "/0011-src-basic-missing.h-check-for-missing-strndupa.patch")
+      (musl-patches + "/0012-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
+      (musl-patches + "/0013-add-missing-FTW_-macros-for-musl.patch")
+      (musl-patches + "/0014-Use-uintmax_t-for-handling-rlim_t.patch")
+      (musl-patches + "/0015-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
+      (musl-patches + "/0016-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
+      (musl-patches + "/0017-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
+      (musl-patches + "/0018-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
+      (musl-patches + "/0019-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
+      (musl-patches + "/0020-avoid-redefinition-of-prctl_mm_map-structure.patch")
+      (musl-patches + "/0021-do-not-disable-buffer-in-writing-files.patch")
+      (musl-patches + "/0022-Handle-__cpu_mask-usage.patch")
+      (musl-patches + "/0023-Handle-missing-gshadow.patch")
+      (musl-patches + "/0024-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
+      (musl-patches + "/0026-src-boot-efi-efi-string.c-define-wchar_t-from-__WCHA.patch")
     ]
   );
 
@@ -207,6 +239,12 @@ stdenv.mkDerivation {
       --replace \
       "run_command(cc.cmd_array(), '-print-prog-name=objcopy', check: true).stdout().strip()" \
       "'${stdenv.cc.bintools.targetPrefix}objcopy'"
+  '' + lib.optionalString withLibBPF ''
+    substituteInPlace meson.build \
+      --replace "find_program('clang'" "find_program('${stdenv.cc.targetPrefix}clang'"
+    # BPF does not work with stack protector
+    substituteInPlace src/core/bpf/meson.build \
+      --replace "clang_flags = [" "clang_flags = [ '-fno-stack-protector',"
   '' + (
     let
       # The following patches references to dynamic libraries to ensure that
@@ -241,12 +279,14 @@ stdenv.mkDerivation {
           opt = condition: pkg: if condition then pkg else null;
         in
         [
-          # bpf compilation support
-          { name = "libbpf.so.0"; pkg = opt withLibBPF libbpf; }
+          # bpf compilation support. We use libbpf 1 now.
+          { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
+          { name = "libbpf.so.0"; pkg = null; }
 
           # We did never provide support for libxkbcommon & qrencode
           { name = "libxkbcommon.so.0"; pkg = null; }
           { name = "libqrencode.so.4"; pkg = null; }
+          { name = "libqrencode.so.3"; pkg = null; }
 
           # We did not provide libpwquality before so it is safe to disable it for
           # now.
@@ -261,7 +301,7 @@ stdenv.mkDerivation {
           # Systemd does this decision during configure time and uses ifdef's to
           # enable specific branches. We can safely ignore (nuke) the libidn "v1"
           # libraries.
-          { name = "libidn2.so.0"; pkg = libidn2; }
+          { name = "libidn2.so.0"; pkg = opt withLibidn2 libidn2; }
           { name = "libidn.so.12"; pkg = null; }
           { name = "libidn.so.11"; pkg = null; }
 
@@ -278,6 +318,9 @@ stdenv.mkDerivation {
           # inspect-elf support
           { name = "libelf.so.1"; pkg = opt withCoredump elfutils; }
           { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
+
+          # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
+          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
         ];
 
       patchDlOpen = dl:
@@ -287,8 +330,8 @@ stdenv.mkDerivation {
         if dl.pkg == null then ''
           # remove the dependency on the library by replacing it with an invalid path
           for file in $(grep -lr '"${dl.name}"' src); do
-            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
-            substituteInPlace "$file" --replace '"${dl.name}"' '"/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
+            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
+            substituteInPlace "$file" --replace '"${dl.name}"' '"${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
           done
         '' else ''
           # ensure that the library we provide actually exists
@@ -324,7 +367,7 @@ stdenv.mkDerivation {
   # when cross-compiling.
   + ''
     shopt -s extglob
-    patchShebangs tools test src/!(rpm)
+    patchShebangs tools test src/!(rpm|kernel-install|ukify) src/kernel-install/test-kernel-install.sh
   '';
 
   outputs = [ "out" "man" "dev" ];
@@ -332,6 +375,7 @@ stdenv.mkDerivation {
   nativeBuildInputs =
     [
       pkg-config
+      makeBinaryWrapper
       gperf
       ninja
       meson
@@ -346,46 +390,49 @@ stdenv.mkDerivation {
       docbook_xsl
       docbook_xml_dtd_42
       docbook_xml_dtd_45
+      bash
       (buildPackages.python3Packages.python.withPackages (ps: with ps; [ lxml jinja2 ]))
     ]
-    ++ lib.optional withLibBPF [
+    ++ lib.optionals withLibBPF [
       bpftools
-      llvmPackages.clang
-      llvmPackages.libllvm
+      buildPackages.llvmPackages.clang
+      buildPackages.llvmPackages.libllvm
     ]
   ;
 
   buildInputs =
     [
-      acl
-      audit
-      kmod
+      libxcrypt
       libcap
-      libidn2
       libuuid
       linuxHeaders
-      pam
+      bashInteractive # for patch shebangs
     ]
 
-    ++ lib.optional wantGcrypt libgcrypt
+    ++ lib.optionals wantGcrypt [ libgcrypt libgpg-error ]
     ++ lib.optional withTests glib
+    ++ lib.optional withAcl acl
     ++ lib.optional withApparmor libapparmor
+    ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
     ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withEfi gnu-efi
     ++ lib.optional withKexectools kexec-tools
+    ++ lib.optional withKmod kmod
+    ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
+    ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
-    ++ lib.optional withResolved libgpg-error
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
-    ++ lib.optionals withHomed [ p11-kit ]
+    ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
+    ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
   ;
 
   #dontAddPrefix = true;
@@ -400,9 +447,11 @@ stdenv.mkDerivation {
     # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
     "-Dtime-epoch=${releaseTimestamp}"
 
+    "-Dmode=release"
     "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dpam=${lib.boolToString withPam}"
     "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
     "-Drootprefix=${placeholder "out"}"
     "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
@@ -414,7 +463,9 @@ stdenv.mkDerivation {
     "-Dglib=${lib.boolToString withTests}"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dacl=${lib.boolToString withAcl}"
     "-Danalyze=${lib.boolToString withAnalyze}"
+    "-Daudit=${lib.boolToString withAudit}"
     "-Dgcrypt=${lib.boolToString wantGcrypt}"
     "-Dimportd=${lib.boolToString withImportd}"
     "-Dlz4=${lib.boolToString withCompression}"
@@ -440,7 +491,7 @@ stdenv.mkDerivation {
     "-Dsplit-usr=false"
     "-Dlibcurl=${lib.boolToString wantCurl}"
     "-Dlibidn=false"
-    "-Dlibidn2=true"
+    "-Dlibidn2=${lib.boolToString withLibidn2}"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"
@@ -467,7 +518,6 @@ stdenv.mkDerivation {
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkmod-path=${kmod}/bin/kmod"
     "-Dsulogin-path=${util-linux}/bin/sulogin"
     "-Dmount-path=${util-linux}/bin/mount"
     "-Dumount-path=${util-linux}/bin/umount"
@@ -481,6 +531,8 @@ stdenv.mkDerivation {
 
     "-Defi=${lib.boolToString withEfi}"
     "-Dgnu-efi=${lib.boolToString withEfi}"
+
+    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals withEfi [
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
@@ -496,14 +548,18 @@ stdenv.mkDerivation {
     "-Dbpf-framework=true"
   ] ++ lib.optionals withTpm2Tss [
     "-Dtpm2=true"
+  ] ++ lib.optionals (!withUtmp) [
+    "-Dutmp=false"
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "-Dgshadow=false"
-    "-Dutmp=false"
     "-Didn=false"
+  ] ++ lib.optionals withKmod [
+    "-Dkmod=true"
+    "-Dkmod-path=${kmod}/bin/kmod"
   ];
   preConfigure =
     let
-      # A list of all the runtime binaries that the systemd exectuables, tests and libraries are referencing in their source code, scripts and unit files.
+      # A list of all the runtime binaries that the systemd executables, tests and libraries are referencing in their source code, scripts and unit files.
       # As soon as a dependency isn't required anymore we should remove it from the list. The `where` attribute for each of the replacement patterns must be exhaustive. If another (unhandled) case is found in the source code the build fails with an error message.
       binaryReplacements = [
         { search = "/usr/bin/getent"; replacement = "${getent}/bin/getent"; where = [ "src/nspawn/nspawn-setuid.c" ]; }
@@ -534,7 +590,6 @@ stdenv.mkDerivation {
           replacement = "${coreutils}/bin/cat";
           where = [ "test/create-busybox-container" "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
         }
-        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
         {
           search = "/usr/lib/systemd/systemd-fsck";
           replacement = "$out/lib/systemd/systemd-fsck";
@@ -557,7 +612,7 @@ stdenv.mkDerivation {
             "src/import/import-tar.c"
           ];
           ignore = [
-            # occurences here refer to the tar sub command
+            # occurrences here refer to the tar sub command
             "src/sysupdate/sysupdate-resource.c"
             "src/sysupdate/sysupdate-transfer.c"
             "src/import/pull.c"
@@ -568,24 +623,27 @@ stdenv.mkDerivation {
             "src/import/pull-tar.c"
           ];
         }
+      ] ++ lib.optionals withKmod [
+        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
       ];
 
       # { replacement, search, where } -> List[str]
-      mkSubstitute = { replacement, search, where, ignore ? [] }:
+      mkSubstitute = { replacement, search, where, ignore ? [ ] }:
         map (path: "substituteInPlace ${path} --replace '${search}' \"${replacement}\"") where;
-      mkEnsureSubstituted = { replacement, search, where, ignore ? [] }:
-      let
-        ignore' = lib.concatStringsSep "|" (ignore ++ ["^test" "NEWS"]);
-      in ''
-        set +e
-        search=$(grep '${search}' -r | grep -v "${replacement}" | grep -Ev "${ignore'}")
-        set -e
-        if [[ -n "$search" ]]; then
-          echo "Not all references to '${search}' have been replaced. Found the following matches:"
-          echo "$search"
-          exit 1
-        fi
-      '';
+      mkEnsureSubstituted = { replacement, search, where, ignore ? [ ] }:
+        let
+          ignore' = lib.concatStringsSep "|" (ignore ++ [ "^test" "NEWS" ]);
+        in
+        ''
+          set +e
+          search=$(grep '${search}' -r | grep -v "${replacement}" | grep -Ev "${ignore'}")
+          set -e
+          if [[ -n "$search" ]]; then
+            echo "Not all references to '${search}' have been replaced. Found the following matches:"
+            echo "$search"
+            exit 1
+          fi
+        '';
     in
     ''
       mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
@@ -610,7 +668,7 @@ stdenv.mkDerivation {
       --replace "SYSTEMD_CGROUP_AGENTS_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
     "-UPOLKIT_AGENT_BINARY_PATH"
@@ -638,7 +696,7 @@ stdenv.mkDerivation {
 
   postInstall = ''
     mkdir -p $out/example/systemd
-    mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
+    mv $out/lib/{binfmt.d,sysctl.d,tmpfiles.d} $out/example
     mv $out/lib/systemd/{system,user} $out/example/systemd
 
     rm -rf $out/etc/systemd/system
@@ -654,6 +712,8 @@ stdenv.mkDerivation {
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
     rm -rf $out/share/doc
+  '' + lib.optionalString withKmod ''
+    mv $out/lib/modules-load.d $out/example
   '';
 
   # Avoid *.EFI binary stripping. At least on aarch64-linux strip
@@ -664,10 +724,21 @@ stdenv.mkDerivation {
   preFixup = lib.optionalString withEfi ''
     mv $out/lib/systemd/boot/efi $out/dont-strip-me
   '';
-  postFixup = lib.optionalString withEfi ''
+
+  # Wrap in the correct path for LUKS2 tokens.
+  postFixup = lib.optionalString withCryptsetup ''
+    for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
+      # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
+      wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
+    done
+  '' + lib.optionalString withEfi ''
     mv $out/dont-strip-me $out/lib/systemd/boot/efi
   '';
 
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
+    # 'or p' is for manually specified buildPackages as they dont have __spliced
+    (builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs);
+
   passthru = {
     # The interface version prevents NixOS from switching to an
     # incompatible systemd at runtime.  (Switching across reboots is
@@ -677,10 +748,11 @@ stdenv.mkDerivation {
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withTimedated util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;
+      cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
     };
   };
 
@@ -689,9 +761,10 @@ stdenv.mkDerivation {
     description = "A system and service manager for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
     # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
     broken = stdenv.hostPlatform.isStatic;
     priority = 10;
     maintainers = with maintainers; [ flokli kloenk mic92 ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix b/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
index 091584a93cf4..c8ba3164ab09 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, withoutInitTools ? false }:
+{ lib, stdenv, fetchurl, libxcrypt, withoutInitTools ? false }:
 
 stdenv.mkDerivation rec {
   pname = if withoutInitTools then "sysvtools" else "sysvinit";
-  version = "3.01";
+  version = "3.04";
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
-    sha256 = "sha256-aLEaR3LNrM5ftlpMvq0ySizjmZ0Ti0/2HcLVnlfvV5M=";
+    sha256 = "sha256-KmIf5uRSi8kTCLdIZ92q6733dT8COVwMW66Be9K346U=";
   };
 
   prePatch = ''
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sed -i -e "s,/sbin/,$out/sbin/," src/halt.c src/init.c src/paths.h
   '';
 
+  buildInputs = [ libxcrypt ];
+
   makeFlags = [ "SULOGINLIBS=-lcrypt" "ROOT=$(out)" "MANDIR=/share/man" ];
 
   preInstall =
diff --git a/nixpkgs/pkgs/os-specific/linux/targetcli/default.nix b/nixpkgs/pkgs/os-specific/linux/targetcli/default.nix
index f08ac284f23c..381a15006627 100644
--- a/nixpkgs/pkgs/os-specific/linux/targetcli/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/targetcli/default.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "targetcli";
-  version = "2.1.54";
+  version = "2.1.56";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "${pname}-fb";
     rev = "v${version}";
-    sha256 = "1kbbvx0lba96ynr5iwws9jpi319m4rzph4bmcj7yfb37k8mi161v";
+    hash = "sha256-sWLwjfuy9WPnrGK0BxUGnNrhtGDoQyRFMY1OSlyxqs4=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ configshell rtslib ];
diff --git a/nixpkgs/pkgs/os-specific/linux/tinyalsa/default.nix b/nixpkgs/pkgs/os-specific/linux/tinyalsa/default.nix
index 45d9191eea08..cae778227c73 100644
--- a/nixpkgs/pkgs/os-specific/linux/tinyalsa/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tinyalsa/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     "-DTINYALSA_USES_PLUGINS=ON"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=sign-compare"
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/tiptop/default.nix b/nixpkgs/pkgs/os-specific/linux/tiptop/default.nix
index 7e88e1b14b52..a26602b6b44c 100644
--- a/nixpkgs/pkgs/os-specific/linux/tiptop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tiptop/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with lib; {
     description = "Performance monitoring tool for Linux";
diff --git a/nixpkgs/pkgs/os-specific/linux/tpacpi-bat/default.nix b/nixpkgs/pkgs/os-specific/linux/tpacpi-bat/default.nix
index 5512eed63abb..2ec8badb1ce5 100644
--- a/nixpkgs/pkgs/os-specific/linux/tpacpi-bat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tpacpi-bat/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = {
     maintainers = [lib.maintainers.orbekk];
     platforms = lib.platforms.linux;
-    description = "Tool to set battery charging thesholds on Lenovo Thinkpad";
+    description = "Tool to set battery charging thresholds on Lenovo Thinkpad";
     license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix b/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
index 0bf5a8e2adb0..6b349e70656f 100644
--- a/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,18 +1,19 @@
 { lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
 stdenv.mkDerivation rec {
   pname = "trace-cmd";
-  version = "3.1.1";
+  version = "3.1.6";
 
   src = fetchgit {
-    url    = "git://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
+    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
     rev    = "trace-cmd-v${version}";
-    sha256 = "sha256-zYw6DObwmroAU3ikUNo9XrwQeDlyLppe7E63WFjn44Q=";
+    sha256 = "sha256-qjfeomeExjsx/6XrUaGm5szbL7XVlekGd4Hsuncv8NY=";
   };
 
   # Don't build and install html documentation
   postPatch = ''
     sed -i -e '/^all:/ s/html//' -e '/^install:/ s/install-html//' \
        Documentation{,/trace-cmd,/libtracecmd}/Makefile
+    patchShebangs check-manpages.sh
   '';
 
   nativeBuildInputs = [ asciidoc libxslt pkg-config xmlto docbook_xsl docbook_xml_dtd_45 sourceHighlight ];
@@ -35,7 +36,7 @@ stdenv.mkDerivation rec {
   # because the Makefile would not print warnings about too old
   # libraries (see "warning:" in the Makefile)
   postBuild = ''
-    make libs doc -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make libs doc -j$NIX_BUILD_CORES
   '';
 
   installTargets = [
diff --git a/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index e59e37c0b3cf..e492bc2403fd 100644
--- a/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -5,12 +5,12 @@
 
 mkDerivation rec {
   pname = "kernelshark";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/";
     rev = "kernelshark-v${version}";
-    sha256 = "18yx8bp2996hiy026ncw2z5yfihvkjfl6m09y19yvs72crgvpyn8";
+    sha256 = "sha256-VkUah8qAlOck9245f/zngtVpHmJdx6eQXqwzLwK2xjU=";
   };
 
   outputs = [ "out" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/tuigreet/default.nix b/nixpkgs/pkgs/os-specific/linux/tuigreet/default.nix
deleted file mode 100644
index 8660c4a1a49c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/tuigreet/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "tuigreet";
-  version = "0.8.0";
-
-  src = fetchFromGitHub {
-    owner = "apognu";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-8/2I6bk29/GqZ1ACuN9RgBiGAy7yt0iw2fagHfu4/BI=";
-  };
-
-  cargoSha256 = "sha256-fOs9a0/1c8Kh4JA5up3XSQ+km/FwSYzl0w4UDL4yU4M=";
-
-  meta = with lib; {
-    description = "Graphical console greeter for greetd";
-    homepage = "https://github.com/apognu/tuigreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ivar ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/tunctl/default.nix b/nixpkgs/pkgs/os-specific/linux/tunctl/default.nix
index 646e3702fed0..e71e349a2516 100644
--- a/nixpkgs/pkgs/os-specific/linux/tunctl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tunctl/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://tunctl.sourceforge.net/";
+    homepage = "https://tunctl.sourceforge.net/";
     description = "Utility to set up and maintain TUN/TAP network interfaces";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix b/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
index f122aaf641db..e6eccaa51d7e 100644
--- a/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
@@ -1,24 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, kernel, linuxHeaders }:
+{ lib, stdenv, fetchFromGitHub, kernel, linuxHeaders, pahole }:
 
 stdenv.mkDerivation rec {
   pname = "tuxedo-keyboard-${kernel.version}";
-  version = "3.0.9";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "tuxedocomputers";
     repo = "tuxedo-keyboard";
     rev = "v${version}";
-    sha256 = "HGN2CKJ76FzgKkOsU5pLMsRl7hEGMcZ8Loa2YP0P558=";
+    hash = "sha256-pSGshUyim06Sqkp5QFzhUjeIz/N3aORvVt6DEyzQLaU=";
   };
 
-  buildInputs = [ linuxHeaders ];
+  buildInputs = [
+    pahole
+    linuxHeaders
+  ];
 
   makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   installPhase = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}"
 
-    for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko; do
+    for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko uniwill_wmi.ko; do
         mv src/$module $out/lib/modules/${kernel.modDirVersion}
     done
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix b/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix
index f7cd34a458c3..b357bc50e584 100644
--- a/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix
@@ -58,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "uclibc-ng";
-  version = "1.0.41";
+  version = "1.0.42";
 
   src = fetchurl {
     url = "https://downloads.uclibc-ng.org/releases/${version}/uClibc-ng-${version}.tar.xz";
-    sha256 = "sha256-syqSoCGNlZItaXZGTm71Hi66z7zbYFggRY2du4ph4CU=";
+    sha256 = "sha256-7G2uRM6GVYiF5WvDvva9TQgjlxFObh/BV5X3HoBNcBY=";
   };
 
   # 'ftw' needed to build acl, a coreutils dependency
diff --git a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
index 5aff6e969705..9b56695e212b 100644
--- a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, pkg-config, gnused, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, substituteAll, fetchpatch, pkg-config, gnused, autoreconfHook
 , gtk-doc, acl, systemd, glib, libatasmart, polkit, coreutils, bash, which
 , expat, libxslt, docbook_xsl, util-linux, mdadm, libgudev, libblockdev, parted
 , gobject-introspection, docbook_xml_dtd_412, docbook_xml_dtd_43
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
         xfsprogs ntfs3g parted util-linux
       ];
     })
+    # Fix crash on exit, remove on upgrade to 2.10.
+    (fetchpatch {
+      url = "https://github.com/storaged-project/udisks/commit/6464e3083c27b9e4d97848b9e69e862f265511d5.patch";
+      hash = "sha256-XGprXjJLIL8l4P5MRTHV8GOQR1hpaaFiLgexGnO9Lvg=";
+    })
   ];
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
index 688a743fa9c1..f75d8578833c 100644
--- a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -1,11 +1,11 @@
-{ appimageTools, lib, fetchurl, polkit, udev }:
+{ appimageTools, lib, fetchurl }:
 let
   pname = "uhk-agent";
-  version = "1.5.17";
+  version = "2.1.2";
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-auOoTTRmkXVDDvcmRFzQIStNlbai8bTBLb/KUjk6EAc=";
+    sha256 = "sha256-G/UT1ec7rWl8xONZnT+dpHAFOQh6/s0Vq7MTqAcmJSA=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix b/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix
new file mode 100644
index 000000000000..cb48d20043fd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix
@@ -0,0 +1,74 @@
+{ stdenv, lib, fetchurl, gnumake, libnetfilter_acct, libnetfilter_conntrack
+, libnetfilter_log, libmnl, libnfnetlink, automake, autoconf, autogen, libtool
+, pkg-config, libpcap, linuxdoc-tools, autoreconfHook, nixosTests }:
+
+stdenv.mkDerivation rec {
+  version = "2.0.8";
+  pname = "ulogd";
+
+  src = fetchurl {
+    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
+    hash = "sha256-Tq1sOXDD9X+h6J/i18xIO6b+K9GwhwFSHgs6/WZ98pE=";
+  };
+
+  outputs = [ "out" "doc" "man" ];
+
+  postPatch = ''
+    substituteInPlace ulogd.8 --replace "/usr/share/doc" "$doc/share/doc"
+  '';
+
+  postBuild = ''
+    pushd doc/
+    linuxdoc --backend=txt --filter ulogd.sgml
+    linuxdoc --backend=html --split=0 ulogd.sgml
+    popd
+  '';
+
+  postInstall = ''
+    install -Dm444 -t $out/share/doc/${pname} ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
+    install -Dm444 -t $out/share/doc/${pname}-mysql doc/mysql*.sql
+    install -Dm444 -t $out/share/doc/${pname}-pgsql doc/pgsql*.sql
+  '';
+
+  buildInputs = [
+    libnetfilter_acct
+    libnetfilter_conntrack
+    libnetfilter_log
+    libmnl
+    libnfnetlink
+    libpcap
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    automake
+    autoconf
+    autogen
+    libtool
+    linuxdoc-tools
+  ];
+
+  passthru.tests = { inherit (nixosTests) ulogd; };
+
+  meta = with lib; {
+    description = "Userspace logging daemon for netfilter/iptables";
+
+    longDescription = ''
+      Logging daemon that reads event messages coming from the Netfilter
+      connection tracking, the Netfilter packet logging subsystem and from the
+      Netfilter accounting subsystem. You have to enable support for connection
+      tracking event delivery; ctnetlink and the NFLOG target in your Linux
+      kernel 2.6.x or load their respective modules. The deprecated ULOG target
+      (which has been superseded by NFLOG) is also supported.
+
+      The received messages can be logged into files or into a MySQL, SQLite3
+      or PostgreSQL database. IPFIX and Graphite output are also supported.
+    '';
+
+    homepage = "https://www.netfilter.org/projects/ulogd/index.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ p-h ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix b/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix
new file mode 100644
index 000000000000..74a7fe9cfbcd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule {
+  pname = "ultrablue-server";
+  version = "unstable-fosdem2023";
+
+  src = fetchFromGitHub {
+    owner = "ANSSI-FR";
+    repo = "ultrablue";
+    # Do not use a more recent
+    rev = "tags/fosdem-2023";
+    hash = "sha256-rnUbgZI+SycYCDUoSziOy+WxRFvyM3XJWJnk3+t0eb4=";
+    # rev = "6de04af6e353e38c030539c5678e5918f64be37e";
+  };
+
+  sourceRoot = "source/server";
+
+  vendorSha256 = "sha256-249LWguTHIF0HNIo8CsE/HWpAtBw4P46VPvlTARLTpw=";
+  doCheck = false;
+
+  meta = with lib; {
+    description = "User-friendly Lightweight TPM Remote Attestation over Bluetooth";
+    homepage = "https://github.com/ANSSI-FR/ultrablue";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/default.nix b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
index ae24c4db6ec8..9973b1ac5a8a 100644
--- a/nixpkgs/pkgs/os-specific/linux/upower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-+C/4dDg6WTLpBgkpNyxjthSdqYdaTLC8vG6jG1LNJ7w=";
   };
 
+  # Remove when this is fixed upstream:
+  # https://gitlab.freedesktop.org/upower/upower/-/issues/214
+  patches = lib.optional (stdenv.hostPlatform.system == "i686-linux")
+    ./i686-test-remove-battery-check.patch;
+
   strictDeps = true;
 
   depsBuildBuild = [
@@ -64,13 +69,13 @@ stdenv.mkDerivation rec {
     libusb1
     udev
     systemd
-    # Duplicate from checkInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
+    # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
     umockdev
   ] ++ lib.optionals useIMobileDevice [
     libimobiledevice
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     python3.pkgs.dbus-python
     python3.pkgs.python-dbusmock
     python3.pkgs.pygobject3
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch b/nixpkgs/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
new file mode 100644
index 000000000000..c9121dfb038a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
@@ -0,0 +1,12 @@
+diff -u "a/src/linux/integration-test.py" "b/src/linux/integration-test.py"

+--- a/src/linux/integration-test.py

++++ b/src/linux/integration-test.py

+@@ -870,5 +870,4 @@

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFull'), 126.0)

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFullDesign'), 132.0)

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Voltage'), 12.0)

+-        self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Percentage'), 40.0)

+         self.stop_daemon()

+

+

+Diff finished.  Tue Nov  8 16:48:57 2022

diff --git a/nixpkgs/pkgs/os-specific/linux/usbguard-notifier/default.nix b/nixpkgs/pkgs/os-specific/linux/usbguard-notifier/default.nix
new file mode 100644
index 000000000000..c5b296809da1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/usbguard-notifier/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  libqb,
+  usbguard,
+  librsvg,
+  libnotify,
+  catch2,
+  asciidoc,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "usbguard-notifier";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cropi";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-gWvCGSbOuey2ELAPD2WCG4q77IClL0S7rE2RaUJDc1I=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config asciidoc ];
+  buildInputs = [ libqb usbguard librsvg libnotify ];
+
+  configureFlags = [ "CPPFLAGS=-I${catch2}/include/catch2" ];
+
+  prePatch = ''
+    substituteInPlace configure.ac \
+      --replace 'AC_MSG_FAILURE([Cannot detect the systemd system unit dir])' \
+        'systemd_unit_dir="$out/lib/systemd/user"'
+  '';
+
+  meta = {
+    description = "Notifications for detecting usbguard policy and device presence changes";
+    homepage = "https://github.com/Cropi/usbguard-notifier";
+    maintainers = with lib.maintainers; [ fpletz ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/usbguard/default.nix b/nixpkgs/pkgs/os-specific/linux/usbguard/default.nix
index 35505af5a1ed..46e9ee3d0a55 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbguard/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbguard/default.nix
@@ -17,21 +17,18 @@
 , polkit
 , protobuf
 , audit
-, libgcrypt
 , libsodium
 }:
 
-assert libgcrypt != null -> libsodium == null;
-
 stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.1.2";
   pname = "usbguard";
 
   src = fetchFromGitHub {
     owner = "USBGuard";
     repo = pname;
     rev = "usbguard-${version}";
-    sha256 = "sha256-lAh+l9GF+FHQqv2kEYU5JienZKGwR5e45BYAwjieYgw=";
+    sha256 = "sha256-uwNoKczmVOMpkU4KcKTOtbcTHiYVGXjk/rVbqMl5pGk=";
     fetchSubmodules = true;
   };
 
@@ -44,6 +41,8 @@ stdenv.mkDerivation rec {
     libxml2 # xmllint
     docbook_xml_dtd_45
     docbook_xsl
+    dbus-glib # gdbus-codegen
+    protobuf # protoc
   ];
 
   buildInputs = [
@@ -51,21 +50,19 @@ stdenv.mkDerivation rec {
     libcap_ng
     libqb
     libseccomp
+    libsodium
     polkit
     protobuf
     audit
-  ]
-  ++ (lib.optional (libgcrypt != null) libgcrypt)
-  ++ (lib.optional (libsodium != null) libsodium);
+  ];
 
   configureFlags = [
     "--with-bundled-catch"
     "--with-bundled-pegtl"
     "--with-dbus"
+    "--with-crypto-library=sodium"
     "--with-polkit"
-  ]
-  ++ (lib.optional (libgcrypt != null) "--with-crypto-library=gcrypt")
-  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium");
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/usbip/default.nix b/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
index cadf38b106cc..b91f55dcd2fb 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=address-of-packed-member" ];
 
   preConfigure = ''
     cd tools/usb/usbip
diff --git a/nixpkgs/pkgs/os-specific/linux/usbrelay/daemon.nix b/nixpkgs/pkgs/os-specific/linux/usbrelay/daemon.nix
index e5e4baae9e99..6e4e4661fd53 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbrelay/daemon.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbrelay/daemon.nix
@@ -1,11 +1,11 @@
-{ stdenv, usbrelay, python3 }:
+{ stdenv, usbrelay, python3, installShellFiles }:
 let
   python = python3.withPackages (ps: with ps; [ usbrelay-py paho-mqtt ]);
 in
 # This is a separate derivation, not just an additional output of
 # usbrelay, because otherwise, we have a cyclic dependency between
 # usbrelay (default.nix) and the python module (python.nix).
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "usbrelayd";
 
   inherit (usbrelay) src version;
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
       --replace '/usr/sbin/usbrelayd' "$out/bin/usbrelayd"
   '';
 
+  nativeBuildInputs = [ installShellFiles ];
+
   buildInputs = [ python ];
 
   dontBuild = true;
@@ -26,6 +28,7 @@ stdenv.mkDerivation rec {
     install -m 644 -D usbrelayd.service $out/lib/systemd/system/usbrelayd.service
     install -m 644 -D 50-usbrelay.rules $out/lib/udev/rules.d/50-usbrelay.rules
     install -m 644 -D usbrelayd.conf $out/etc/usbrelayd.conf # include this as an example
+    installManPage usbrelayd.8
     runHook postInstall
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix b/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
index 25388d3b2308..385f4da1142d 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, hidapi, installShellFiles }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "usbrelay";
-  version = "1.0";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "darrylb123";
     repo = "usbrelay";
-    rev = version;
-    sha256 = "sha256-5zgpN4a+r0tmw0ISTJM+d9mo+L/qwUvpWPSsykuG0cg=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-oJyHzbXOBKxLmPFZMS2jLF80frkiKjPJ89UwkenjIzs=";
   };
 
   nativeBuildInputs = [
@@ -19,8 +19,9 @@ stdenv.mkDerivation rec {
   ];
 
   makeFlags = [
-    "DIR_VERSION=${version}"
+    "DIR_VERSION=${finalAttrs.version}"
     "PREFIX=${placeholder "out"}"
+    "LDCONFIG=${stdenv.cc.libc.bin}/bin/ldconfig"
   ];
 
   postInstall = ''
@@ -34,4 +35,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ wentasah ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/usbrelay/python.nix b/nixpkgs/pkgs/os-specific/linux/usbrelay/python.nix
index 02d5ac284eda..90838295ecb5 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbrelay/python.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbrelay/python.nix
@@ -1,9 +1,13 @@
 { buildPythonPackage, usbrelay }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "usbrelay_py";
   inherit (usbrelay) version src;
 
+  preConfigure = ''
+    cd usbrelay_py
+  '';
+
   buildInputs = [ usbrelay ];
 
   pythonImportsCheck = [ "usbrelay_py" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/usbrelay/test.nix b/nixpkgs/pkgs/os-specific/linux/usbrelay/test.nix
index dc5847558a69..58e4375dab8d 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbrelay/test.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbrelay/test.nix
@@ -42,6 +42,7 @@ import ../../../../nixos/tests/make-test-python.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
+    import os
     if os.waitstatus_to_exitcode(os.system("lsusb -d 16c0:05df")) != 0:
         print("No USB relay detected, skipping test")
         import sys
diff --git a/nixpkgs/pkgs/os-specific/linux/usbutils/default.nix b/nixpkgs/pkgs/os-specific/linux/usbutils/default.nix
index 0e0163c2ae2a..20936fa7d495 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbutils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "usbutils";
-  version = "014";
+  version = "015";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/usb/usbutils/usbutils-${version}.tar.xz";
-    sha256 = "sha256-Ogec+tYFYCJ7ZxkkgteBO/ljJvy7ZsBCVIOXFfJ2/Gk=";
+    sha256 = "sha256-w7RRux9P+fY1bKxaaVaprI6F2BZRr1ainmiflPpv2m4=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/usermount/default.nix b/nixpkgs/pkgs/os-specific/linux/usermount/default.nix
index 934367dcd11b..475ccd848eb1 100644
--- a/nixpkgs/pkgs/os-specific/linux/usermount/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usermount/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
+  env.NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
index cb323e623bed..7b98c6bcd9d2 100644
--- a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,28 +1,43 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
-, capabilitiesSupport ? true
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
+, capabilitiesSupport ? stdenv.isLinux
 , libcap_ng
+, libxcrypt
 , ncursesSupport ? true
 , ncurses
 , pamSupport ? true
 , pam
-, systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
+, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
 , systemd
 , nlsSupport ? true
 , translateManpages ? true
 , po4a
+, installShellFiles
+, writeSupport ? stdenv.isLinux
+, shadowSupport ? stdenv.isLinux
+, memstreamHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.38";
+  version = "2.39";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-bREcvk1VszbbLx++/7xluJkIcEwBE2Nx0yqpvsNz62Q=";
+    hash = "sha256-MrMKM2zakDGC7WH+s+m5CLdipeZv4U5D77iNNxYgdcs=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+
+    # FIXME: backport mount fixes for older kernels, remove in next release
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d.diff";
+      hash = "sha256-UorqDeECK8pBePkmpo2x90p/jP3rCMshyPCyijSX1wo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
+      hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "lib" "man" ];
@@ -31,10 +46,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patchShebangs tests/run.sh
 
-    substituteInPlace include/pathnames.h \
-      --replace "/bin/login" "${shadow}/bin/login"
     substituteInPlace sys-utils/eject.c \
       --replace "/bin/umount" "$bin/bin/umount"
+  '' + lib.optionalString shadowSupport ''
+    substituteInPlace include/pathnames.h \
+      --replace "/bin/login" "${shadow}/bin/login"
   '';
 
   # !!! It would be better to obtain the path to the mount helpers
@@ -43,11 +59,11 @@ stdenv.mkDerivation rec {
   # root...
   configureFlags = [
     "--localstatedir=/var"
-    "--enable-write"
     "--disable-use-tty-group"
     "--enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
     "--disable-su" # provided by shadow
+    (lib.enableFeature writeSupport "write")
     (lib.enableFeature nlsSupport "nls")
     (lib.withFeature ncursesSupport "ncursesw")
     (lib.withFeature systemdSupport "systemd")
@@ -65,26 +81,31 @@ stdenv.mkDerivation rec {
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config installShellFiles ]
     ++ lib.optionals translateManpages [ po4a ];
 
-  buildInputs = [ zlib ]
+  buildInputs = [ zlib libxcrypt ]
     ++ lib.optionals pamSupport [ pam ]
     ++ lib.optionals capabilitiesSupport [ libcap_ng ]
     ++ lib.optionals ncursesSupport [ ncurses ]
-    ++ lib.optionals systemdSupport [ systemd ];
+    ++ lib.optionals systemdSupport [ systemd ]
+    ++ lib.optionals (stdenv.system == "x86_64-darwin") [ memstreamHook ];
 
   doCheck = false; # "For development purpose only. Don't execute on production system!"
 
   enableParallelBuilding = true;
 
+  postInstall = ''
+    installShellCompletion --bash bash-completion/*
+  '';
+
   meta = with lib; {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "A set of system utilities for Linux";
     changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
     # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
     license = with licenses; [ gpl2Only gpl2Plus gpl3Plus lgpl21Plus bsd3 bsdOriginalUC publicDomain ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/uvcdynctrl/default.nix b/nixpkgs/pkgs/os-specific/linux/uvcdynctrl/default.nix
index d5f3a729978d..8fa91e158e1c 100644
--- a/nixpkgs/pkgs/os-specific/linux/uvcdynctrl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uvcdynctrl/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "A simple interface for devices supported by the linux UVC driver";
-    homepage = "http://guvcview.sourceforge.net";
+    homepage = "https://guvcview.sourceforge.net";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.puffnfresh ];
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
index f8d0c9be0d90..87fd282f6960 100644
--- a/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.22.1";
+  version = "1.24.1";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-Zcb76DCkTKEFxEOwJxgsGyyQU6kdHnKthJ36s4i5TjE=";
+    hash = "sha256-y7f+imMH9c5TOgXN7XC7k8O6BjlaubbQB+tTt12AX1s=";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/default.nix b/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/default.nix
new file mode 100644
index 000000000000..a089ce8c77f8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchgit
+, autoreconfHook
+, glib
+, gst_all_1
+, libtool
+, pkg-config
+, which
+}:
+stdenv.mkDerivation rec {
+  pname = "v4l2-relayd";
+  version = "0.1.3";
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/v4l2-relayd";
+    rev = "refs/tags/upstream/${version}";
+    hash = "sha256-oU6naDFZ0PQVHZ3brANfMULDqYMYxeJN+MCUCvN/DpU=";
+  };
+
+  patches = [
+    ./upstream-v4l2loopback-compatibility.patch
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+  ];
+
+  preConfigure = "./autogen.sh --prefix=$out";
+
+  meta = with lib; {
+    description = "Streaming relay for v4l2loopback using GStreamer";
+    homepage = "https://git.launchpad.net/v4l2-relayd";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ betaboon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch b/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch
new file mode 100644
index 000000000000..643535228256
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch
@@ -0,0 +1,16 @@
+diff --git a/src/v4l2-relayd.c b/src/v4l2-relayd.c
+index 21bb0d5..cfc9e27 100644
+--- a/src/v4l2-relayd.c
++++ b/src/v4l2-relayd.c
+@@ -27,7 +27,10 @@
+ #include <gst/app/gstappsrc.h>
+ #include <gst/video/video-info.h>
+ 
+-#define V4L2_EVENT_PRI_CLIENT_USAGE  V4L2_EVENT_PRIVATE_START
++#define V4L2LOOPBACK_EVENT_BASE (V4L2_EVENT_PRIVATE_START)
++#define V4L2LOOPBACK_EVENT_OFFSET 0x08E00000
++#define V4L2_EVENT_PRI_CLIENT_USAGE \
++	(V4L2LOOPBACK_EVENT_BASE + V4L2LOOPBACK_EVENT_OFFSET + 1)
+ 
+ struct v4l2_event_client_usage {
+   __u32 count;
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l2loopback/default.nix b/nixpkgs/pkgs/os-specific/linux/v4l2loopback/default.nix
index 095d873e66cb..2c1b4fbb4f4f 100644
--- a/nixpkgs/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -2,15 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "v4l2loopback";
-  version = "unstable-2021-07-13-${kernel.version}";
+  version = "unstable-2023-02-19-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "umlaeute";
     repo = "v4l2loopback";
-    rev = "baf9de279afc7a7c7513e9c40a0c9ff88f456af4";
-    sha256 = "sha256-uglYTeqz81fgkKYYU9Cw8x9+S088jGxDEGkb3rmkhrw==";
+    rev = "fb410fc7af40e972058809a191fae9517b9313af";
+    hash = "sha256-gLFtR7s+3LUQ0BZxHbmaArHbufuphbtAX99nxJU3c84=";
   };
 
+  patches = [
+    # fix bug https://github.com/umlaeute/v4l2loopback/issues/535
+    ./revert-pr518.patch
+  ];
+
   hardeningDisable = [ "format" "pic" ];
 
   preBuild = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch b/nixpkgs/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch
new file mode 100644
index 000000000000..d5d2564c32c4
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch
@@ -0,0 +1,55 @@
+diff --git a/v4l2loopback.c b/v4l2loopback.c
+index 2ab1f76..2514f09 100644
+--- a/v4l2loopback.c
++++ b/v4l2loopback.c
+@@ -92,17 +92,6 @@ MODULE_LICENSE("GPL");
+ 		}                                                      \
+ 	} while (0)
+ 
+-/* TODO: Make sure that function is never interrupted. */
+-static inline int mod_inc(int *number, int mod)
+-{
+-	int result;
+-	result = (*number + 1) % mod;
+-	if (unlikely(result < 0))
+-		result += mod;
+-	*number = result;
+-	return result;
+-}
+-
+ static inline void v4l2l_get_timestamp(struct v4l2_buffer *b)
+ {
+ 	/* ktime_get_ts is considered deprecated, so use ktime_get_ts64 if possible */
+@@ -1424,8 +1413,9 @@ static int vidioc_reqbufs(struct file *file, void *fh,
+ 			i = dev->write_position;
+ 			list_for_each_entry(pos, &dev->outbufs_list,
+ 					    list_head) {
+-				dev->bufpos2index[mod_inc(&i, b->count)] =
++				dev->bufpos2index[i % b->count] =
+ 					pos->buffer.index;
++				++i;
+ 			}
+ 		}
+ 
+@@ -1489,9 +1479,10 @@ static void buffer_written(struct v4l2_loopback_device *dev,
+ 	del_timer_sync(&dev->timeout_timer);
+ 	spin_lock_bh(&dev->lock);
+ 
+-	dev->bufpos2index[mod_inc(&dev->write_position, dev->used_buffers)] =
++	dev->bufpos2index[dev->write_position % dev->used_buffers] =
+ 		buf->buffer.index;
+ 	list_move_tail(&buf->list_head, &dev->outbufs_list);
++	++dev->write_position;
+ 	dev->reread_count = 0;
+ 
+ 	check_timers(dev);
+@@ -1586,7 +1577,8 @@ static int get_capture_buffer(struct file *file)
+ 		if (dev->write_position >
+ 		    opener->read_position + dev->used_buffers)
+ 			opener->read_position = dev->write_position - 1;
+-		pos = mod_inc(&opener->read_position, dev->used_buffers);
++		pos = opener->read_position % dev->used_buffers;
++		++opener->read_position;
+ 	}
+ 	timeout_happened = dev->timeout_happened;
+ 	dev->timeout_happened = 0;
diff --git a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
index d9033e65876b..669f67e09f34 100644
--- a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.0.2";  # kvdo uses this!
+  version = "8.2.0.2";  # bump this version with kvdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
@@ -57,7 +57,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/dm-vdo/vdo";
     description = "A set of userspace tools for managing pools of deduplicated and/or compressed block storage";
-    platforms = platforms.linux;
+    # platforms are defined in https://github.com/dm-vdo/vdo/blob/master/utils/uds/atomicDefs.h
+    platforms = [ "x86_64-linux" "aarch64-linux" "s390-linux" "powerpc64-linux" "powerpc64le-linux" ];
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ ajs124 ];
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix b/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
index ccf462702fd3..d18818a10de8 100644
--- a/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "virtio_vmmci";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "virtio_vmmci";
     rev = "${version}";
-    sha256 = "104xnpcy5kb4y7ipy1fx1v6byddzs63bv2dqjy3yl23n764fsy43";
+    hash = "sha256-ZHslYYZFjM3wp0W5J3/WwCtQ2wDzT1jNc26Z/giTC8g=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix b/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
index b630ed4749fa..648a61b5e880 100644
--- a/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
-  name = "vmm_clock";
-  version = "0.1.0";
+  pname = "vmm_clock";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "vmm_clock";
     rev = "${version}";
-    sha256 = "0hg7ywznh6v11fywsz6f7w298bxph0wwm046zqaqncjvr4aizla4";
+    hash = "sha256-8z/N/dbkeFd40sH7jatNmSS62B88tC0jVgNljhxslOo=";
   };
 
   hardeningDisable = [ "pic" "format" ];
@@ -26,13 +26,12 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    broken = kernel.kernelOlder "4.19";
     description =
       "Experimental implementation of a kvmclock-derived clocksource for Linux guests under OpenBSD's hypervisor";
     homepage = "https://github.com/voutilad/vmm_clock";
     license = licenses.gpl2;
     maintainers = with maintainers; [ qbit ];
-    platforms = platforms.linux;
+    platforms = [ "i686-linux" "x86_64-linux" ];
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/vmware/default.nix b/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
index ecc43bf3f3a9..73c579288bca 100644
--- a/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
@@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "mkubecek";
     repo = "vmware-host-modules";
-    rev = "w${vmware-workstation.version}-k5.18";
-    sha256 = "sha256-sAeCjaSrBXGP5szfCY5CpMrGwzCw4aM67EN+YfA3AWA=";
+    rev = "w${vmware-workstation.version}";
+    sha256 = "sha256-EHMiSmljpUjYuZH6r/0Vk5OVGeyQyNngy0AVJO/48a0=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -20,14 +20,12 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile \
       --replace '/lib/modules/$(VM_UNAME)/misc' "$out/lib/modules/${kernel.modDirVersion}/misc" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/modinfo "${kmod}/bin/modinfo" \
       --replace 'test -z "$(DESTDIR)"' "0"
 
     for module in "vmmon-only" "vmnet-only"; do
       substituteInPlace "./$module/Makefile" \
         --replace '/lib/modules/' "${kernel.dev}/lib/modules/" \
-        --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
         --replace /bin/grep "${gnugrep}/bin/grep"
     done
   '';
@@ -41,7 +39,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/mkubecek/vmware-host-modules";
     license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
-    broken = (kernel.kernelOlder "5.5" && kernel.isHardened) || kernel.kernelAtLeast "5.19";
+    broken = (kernel.kernelOlder "5.5" && kernel.isHardened);
     maintainers = with maintainers; [ deinferno ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
index 0a0a4019e983..2cf6e0c47e48 100644
--- a/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
@@ -1,31 +1,44 @@
-{ stdenv
-, lib
+{ lib
 , fetchFromGitHub
 , python3Packages
 , dnsmasq
+, gawk
 , getent
+, gobject-introspection
+, gtk3
 , kmod
 , lxc
 , iproute2
 , iptables
-, nftables
 , util-linux
-, which
+, wrapGAppsHook
 , xclip
+, runtimeShell
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.2.1";
+  version = "1.4.1";
+  format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Sf1rl8GCSTuneuYroGqsm9Aq2rBurpyswOrfCq2mWOs=";
+    sha256 = "sha256-0AkNzMIumvgnVcLKX72E2+Eg54Y9j7tdIYPsroOTLWA=";
   };
 
+  buildInputs = [
+    gtk3
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
   propagatedBuildInputs = with python3Packages; [
+    dbus-python
     gbinder-python
     pyclip
     pygobject3
@@ -35,37 +48,34 @@ python3Packages.buildPythonApplication rec {
   dontUsePipInstall = true;
   dontUseSetuptoolsCheck = true;
   dontWrapPythonPrograms = true;
+  dontWrapGApps = true;
 
   installPhase = ''
-    mkdir -p $out/${python3Packages.python.sitePackages}
-
-    cp -ra tools $out/${python3Packages.python.sitePackages}/tools
-
-    cp -ra data $out/${python3Packages.python.sitePackages}/data
-    wrapProgram $out/${python3Packages.python.sitePackages}/data/scripts/waydroid-net.sh \
-       --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 iptables nftables ]}
-
-    mkdir -p $out/share/waydroid/gbinder.d
-    cp gbinder/anbox.conf $out/share/waydroid/gbinder.d/anbox.conf
+    make install PREFIX=$out USE_SYSTEMD=0
+  '';
 
-    mkdir -p $out/share/applications
-    ln -s $out/${python3Packages.python.sitePackages}/data/Waydroid.desktop $out/share/applications/Waydroid.desktop
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
 
-    mkdir $out/bin
-    cp -a waydroid.py $out/${python3Packages.python.sitePackages}/waydroid.py
-    ln -s $out/${python3Packages.python.sitePackages}/waydroid.py $out/bin/waydroid
+    patchShebangs --host $out/lib/waydroid/data/scripts
+    wrapProgram $out/lib/waydroid/data/scripts/waydroid-net.sh \
+      --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 iptables ]}
 
-    wrapPythonProgramsIn $out/${python3Packages.python.sitePackages} "${lib.concatStringsSep " " [
+    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " [
       "$out"
+      python3Packages.dbus-python
       python3Packages.gbinder-python
       python3Packages.pygobject3
       python3Packages.pyclip
+      gawk
       kmod
       lxc
       util-linux
-      which
       xclip
     ]}"
+
+    substituteInPlace $out/lib/waydroid/tools/helpers/*.py \
+      --replace '"sh"' '"${runtimeShell}"'
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix b/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
index a47fb30c1b39..8d8342cce980 100644
--- a/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
@@ -5,11 +5,11 @@ assert lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20211208";
+  version = "1.0.20220627";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "sha256-MHC4ojhRD8IGwTUE8oEew8IVof9hQCC7CPgVQIBfBRQ=";
+    sha256 = "sha256-skbho3e49lZ/GLp/JDQpf/yXIEjes86aYtw/dn6e0Uo=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd src";
   buildFlags = [ "module" ];
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
 
   INSTALL_MOD_PATH = placeholder "out";
   installFlags = [ "DEPMOD=true" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix b/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix
new file mode 100644
index 000000000000..eed71188eb07
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix
@@ -0,0 +1,84 @@
+{ lib
+, stdenv
+, symlinkJoin
+, fetchFromGitHub
+, libxcrypt
+}:
+
+let
+  version = "2.61-1";
+  mkSubProject = { subprj # The only mandatory argument
+  , buildInputs ? []
+  , src ? fetchFromGitHub {
+    owner = "WiringPi";
+    repo = "WiringPi";
+    rev = version;
+    sha256 = "sha256-VxAaPhaPXd9xYt663Ju6SLblqiSLizauhhuFqCqbO5M=";
+  }
+  }: stdenv.mkDerivation rec {
+    pname = "wiringpi-${subprj}";
+    inherit version src;
+    sourceRoot = "source/${subprj}";
+    inherit buildInputs;
+    # Remove (meant for other OSs) lines from Makefiles
+    preInstall = ''
+      sed -i "/chown root/d" Makefile
+      sed -i "/chmod/d" Makefile
+    '';
+    makeFlags = [
+      "DESTDIR=${placeholder "out"}"
+      "PREFIX=/."
+      # On NixOS we don't need to run ldconfig during build:
+      "LDCONFIG=echo"
+    ];
+  };
+  passthru = {
+    inherit mkSubProject;
+    wiringPi = mkSubProject {
+      subprj = "wiringPi";
+      buildInputs = [
+        libxcrypt
+      ];
+    };
+    devLib = mkSubProject {
+      subprj = "devLib";
+      buildInputs = [
+        passthru.wiringPi
+      ];
+    };
+    wiringPiD = mkSubProject {
+      subprj = "wiringPiD";
+      buildInputs = [
+        libxcrypt
+        passthru.wiringPi
+        passthru.devLib
+      ];
+    };
+    gpio = mkSubProject {
+      subprj = "gpio";
+      buildInputs = [
+        libxcrypt
+        passthru.wiringPi
+        passthru.devLib
+      ];
+    };
+  };
+in
+
+symlinkJoin {
+  name = "wiringpi-${version}";
+  inherit passthru;
+  paths = [
+    passthru.wiringPi
+    passthru.devLib
+    passthru.wiringPiD
+    passthru.gpio
+  ];
+  meta = with lib; {
+    description = "Gordon's Arduino wiring-like WiringPi Library for the Raspberry Pi (Unofficial Mirror for WiringPi bindings)";
+    homepage = "https://github.com/WiringPi/WiringPi";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ doronbehar ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/wlgreet/default.nix b/nixpkgs/pkgs/os-specific/linux/wlgreet/default.nix
deleted file mode 100644
index 932aa47fd714..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/wlgreet/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromSourcehut
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "wlgreet-unstable";
-  version = "2022-01-25";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = "wlgreet";
-    rev = "8517e578cb64a8fb3bd8f8a438cdbe46f208b87c";
-    sha256 = "0la4xlikw61cxvbkil1d22dgvazi7rs17n5i2z02090fvnfxxzxh";
-  };
-
-  cargoSha256 = "651d2bf01612534f1c4b0472c812095a86eb064d16879380c87f684c04fe0d8d";
-
-  meta = with lib; {
-    description = "Raw wayland greeter for greetd, to be run under sway or similar";
-    homepage = "https://git.sr.ht/~kennylevinsen/wlgreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
index fa4148d87438..a243f68ed133 100644
--- a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
+++ b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
@@ -1,14 +1,84 @@
-# Wooting One
+# Wooting One Legacy
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE:="0660", GROUP="input"
 # Wooting One update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2402", MODE:="0660", GROUP="input"
 
-# Wooting Two
+# Wooting Two Legacy
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE:="0660", GROUP="input"
 # Wooting Two update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2403", MODE:="0660", GROUP="input"
 
-# Wooting Two Lekker Edition
+# Wooting One
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE:="0660", GROUP="input"
+# Wooting One Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE:="0660", GROUP="input"
+# Wooting One 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
+
+
+# Wooting Two
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
+# Wooting Two Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE:="0660", GROUP="input"
+# Wooting Two 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE:="0660", GROUP="input"
+
+# Wooting Lekker
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE:="0660", GROUP="input"
-# Wooting Two Lekker Edition update mode
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE:="0660", GROUP="input"
+# Wooting Lekker Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE:="0660", GROUP="input"
+# Wooting Lekker 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE:="0660", GROUP="input"
+
+# Wooting Lekker update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="121f", MODE:="0660", GROUP="input"
+
+# Wooting Two HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE:="0660", GROUP="input"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE:="0660", GROUP="input"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE:="0660", GROUP="input"
+
+# Wooting Two HE update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="122f", MODE:="0660", GROUP="input"
+
+# Wooting 60HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
+# Wooting 60HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE:="0660", GROUP="input"
+# Wooting 60HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE:="0660", GROUP="input"
+
+# Wooting 60HE update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="130f", MODE:="0660", GROUP="input"
+
+# Wooting 60HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE:="0660", GROUP="input"
+# Wooting 60HE (ARM) Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE:="0660", GROUP="input"
+# Wooting 60HE (ARM) 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE:="0660", GROUP="input"
+
+# Wooting 60HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="131f", MODE:="0660", GROUP="input"
diff --git a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 2d954d83ecf3..ba4fe8356ce7 100644
--- a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchurl, openssl, pkg-config, libnl
 , nixosTests, wpa_supplicant_gui
-, dbusSupport ? true, dbus
+, dbusSupport ? !stdenv.hostPlatform.isStatic, dbus
 , withReadline ? true, readline
-, withPcsclite ? true, pcsclite
+, withPcsclite ? !stdenv.hostPlatform.isStatic, pcsclite
 , readOnlyModeSSIDs ? false
 }:
 
@@ -73,6 +73,15 @@ stdenv.mkDerivation rec {
     CONFIG_CTRL_IFACE_DBUS=y
     CONFIG_CTRL_IFACE_DBUS_NEW=y
     CONFIG_CTRL_IFACE_DBUS_INTRO=y
+  ''
+    # Upstream uses conditionals based on ifdef, so opposite of =y is
+    # not =n, as one may expect, but undefine.
+    #
+    # This config is sourced into makefile.
+    + optionalString (!dbusSupport) ''
+    undefine CONFIG_CTRL_IFACE_DBUS
+    undefine CONFIG_CTRL_IFACE_DBUS_NEW
+    undefine CONFIG_CTRL_IFACE_DBUS_INTRO
   '' + (if withReadline then ''
     CONFIG_READLINE=y
   '' else ''
@@ -104,13 +113,15 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
-
+  ''
+  + lib.optionalString dbusSupport ''
     mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
-
+  ''
+  + ''
     rm $out/share/man/man8/wpa_priv.8
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/nixpkgs/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index af1dc126bfdc..7b7687bc3063 100644
--- a/nixpkgs/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xf86-input-wacom";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-AYjO7B0Z6G1JqpLdvm9LS+ujz7iUp8UwZ9X1WQ/dGk0=";
+    sha256 = "sha256-PuIfeHlkcoin7w2v822P8uhWBNhYQGuOA7yD62L3qto=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     maintainers = with maintainers; [ goibhniu fortuneteller2k ];
     description = "Wacom digitizer driver for X11";
-    homepage = "http://linuxwacom.sourceforge.net";
+    homepage = "https://linuxwacom.sourceforge.net";
     license = licenses.gpl2Only;
     platforms = platforms.linux; # Probably, works with other unixes as well
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/xf86-video-nested/default.nix b/nixpkgs/pkgs/os-specific/linux/xf86-video-nested/default.nix
index bba646e583b8..4092e3797c2f 100644
--- a/nixpkgs/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
   };
 
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+
   buildInputs =
-    [ autoreconfHook xorgproto libX11 libXext pixman
-      pkg-config utilmacros xorgserver
+    [ xorgproto libX11 libXext pixman
+      utilmacros xorgserver
     ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/xone/default.nix b/nixpkgs/pkgs/os-specific/linux/xone/default.nix
index 71bafb7abd9b..da0ae54e560f 100644
--- a/nixpkgs/pkgs/os-specific/linux/xone/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, kernel, fetchurl }:
+{ stdenv, lib, fetchFromGitHub, kernel, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "xone";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-h+j4xCV9R6hp9trsv1NByh9m0UBafOz42ZuYUjclILE=";
   };
 
+  patches = [
+    # Fix build on kernel 6.3
+    (fetchpatch {
+      name = "kernel-6.3.patch";
+      url = "https://github.com/medusalix/xone/commit/bbf0dcc484c3f5611f4e375da43e0e0ef08f3d18.patch";
+      hash = "sha256-A2OzRRk4XT++rS6k6EIyiPy/LJptvVRUxoP7CIGrPWU=";
+    })
+  ];
+
   setSourceRoot = ''
     export sourceRoot=$(pwd)/source
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix b/nixpkgs/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
index 32804afa9ff2..8ae426269a86 100644
--- a/nixpkgs/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
@@ -5,6 +5,7 @@
 , glibc
 , libGL
 , xorg
+, makeWrapper
 , qtx11extras
 , wrapQtAppsHook
 , autoPatchelfHook
@@ -20,17 +21,18 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "xp-pen-deco-01-v2-driver";
-  version = "3.2.3.220323-1";
+  version = "3.2.3.230215-1";
 
   src = fetchzip {
-    url = "https://www.xp-pen.com/download/file/id/1936/pid/440/ext/gz.html#.tar.gz";
+    url = "https://download01.xp-pen.com/file/2023/03/XPPen-pentablet-${version}.x86_64.tar.gz";
     name = "xp-pen-deco-01-v2-driver-${version}.tar.gz";
-    sha256 = "sha256-n/yutkRsjcIRRhB4q1yqEmaa03/1SO8RigJi/ZkfLbk=";
+    sha256 = "sha256-CV4ZaGCFFcfy2J0O8leYgcyzFVwJQFQJsShOv9B7jfI=";
   };
 
   nativeBuildInputs = [
     wrapQtAppsHook
     autoPatchelfHook
+    makeWrapper
   ];
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/xpadneo/default.nix b/nixpkgs/pkgs/os-specific/linux/xpadneo/default.nix
index 623b881cd0f2..bb47bf03f58a 100644
--- a/nixpkgs/pkgs/os-specific/linux/xpadneo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xpadneo/default.nix
@@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, kernel, bluez }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+, bluez
+, nixosTests
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xpadneo";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "atar-axis";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-4zd+x9uYl0lJgePM9LEgLYFqvcw6VPF/CbR1XiYSwGE=";
+    repo = "xpadneo";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-rT2Mq40fE055FemDG7PBjt+cxgIHJG9tTjtw2nW6B98=";
   };
 
   setSourceRoot = ''
@@ -22,13 +28,17 @@ stdenv.mkDerivation rec {
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"
-    "VERSION=${version}"
+    "VERSION=${finalAttrs.version}"
   ];
 
   buildFlags = [ "modules" ];
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
+  passthru.tests = {
+    xpadneo = nixosTests.xpadneo;
+  };
+
   meta = with lib; {
     description = "Advanced Linux driver for Xbox One wireless controllers";
     homepage = "https://atar-axis.github.io/xpadneo";
@@ -36,4 +46,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/zenpower/default.nix b/nixpkgs/pkgs/os-specific/linux/zenpower/default.nix
index 1ba01a1c88fb..bf1240610f8c 100644
--- a/nixpkgs/pkgs/os-specific/linux/zenpower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zenpower/default.nix
@@ -1,14 +1,15 @@
-{ lib, stdenv, kernel, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, kernel, fetchFromGitea }:
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "unstable-2022-04-13";
+  version = "unstable-2022-11-04";
 
-  src = fetchFromGitHub {
-    owner = "Ta180m";
+  src = fetchFromGitea {
+    domain = "git.exozy.me";
+    owner = "a";
     repo = "zenpower3";
-    rev = "c36a86c64b802e9b90b5166caee6a8e8eddaeb56";
-    sha256 = "1i9ap7xgab421f3c68mcmad25xs4h8pfz0g0f9yzg7hxpmb0npxi";
+    rev = "c176fdb0d5bcba6ba2aba99ea36812e40f47751f";
+    sha256 = "sha256-d2WH8Zv7F0phZmEKcDiaak9On+Mo9bAFhMulT/N5FWI=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -22,8 +23,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    inherit (src.meta) homepage;
     description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs.";
-    homepage = "https://github.com/Ta180m/zenpower3";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ alexbakker artturin ];
     platforms = [ "x86_64-linux" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/default.nix b/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
deleted file mode 100644
index 5d55d1db6574..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
+++ /dev/null
@@ -1,244 +0,0 @@
-{ pkgs, lib, stdenv, fetchFromGitHub
-, autoreconfHook269, util-linux, nukeReferences, coreutils
-, perl, nixosTests
-, configFile ? "all"
-
-# Userspace dependencies
-, zlib, libuuid, python3, attr, openssl
-, libtirpc
-, nfs-utils, samba
-, gawk, gnugrep, gnused, systemd
-, smartmontools, enableMail ? false
-, sysstat, pkg-config
-
-# Kernel dependencies
-, kernel ? null
-, enablePython ? true
-
-# for determining the latest compatible linuxPackages
-, linuxPackages_5_18 ? pkgs.linuxKernel.packages.linux_5_18
-}:
-
-let
-  inherit (lib) any optionalString optionals optional makeBinPath;
-
-  smartmon = smartmontools.override { inherit enableMail; };
-
-  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
-  buildUser = any (n: n == configFile) [ "user" "all" ];
-
-  # XXX: You always want to build kernel modules with the same stdenv as the
-  # kernel was built with. However, since zfs can also be built for userspace we
-  # need to correctly pick between the provided/default stdenv, and the one used
-  # by the kernel.
-  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
-  # clang-built) kernels.
-  stdenv' = if kernel == null then stdenv else kernel.stdenv;
-
-  common = { version
-    , sha256
-    , extraPatches ? []
-    , rev ? "zfs-${version}"
-    , isUnstable ? false
-    , latestCompatibleLinuxPackages
-    , kernelCompatible ? null }:
-
-    stdenv'.mkDerivation {
-      name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
-
-      src = fetchFromGitHub {
-        owner = "openzfs";
-        repo = "zfs";
-        inherit rev sha256;
-      };
-
-      patches = extraPatches;
-
-      postPatch = optionalString buildKernel ''
-        patchShebangs scripts
-        # The arrays must remain the same length, so we repeat a flag that is
-        # already part of the command and therefore has no effect.
-        substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
-          --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
-          --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
-      '' + optionalString buildUser ''
-        substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
-          # We don't *need* python support, but we set it like this to minimize closure size:
-          # If it's disabled by default, no need to enable it, even if we have python enabled
-          # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
-          nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
-        }/bin/exportfs"
-        substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
-        substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
-        substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
-                                                      --replace "/etc/default"            "$out/etc/default"
-        substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-
-        substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
-          --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
-        substituteInPlace ./contrib/initramfs/Makefile.am \
-          --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./etc/systemd/system/Makefile.am \
-          --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
-
-        substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
-        substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
-
-        substituteInPlace ./cmd/vdev_id/vdev_id \
-          --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-          "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
-      '';
-
-      nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
-        ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
-        ++ optional buildUser pkg-config;
-      buildInputs = optionals buildUser [ zlib libuuid attr libtirpc ]
-        ++ optional buildUser openssl
-        ++ optional (buildUser && enablePython) python3;
-
-      # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-      NIX_CFLAGS_LINK = "-lgcc_s";
-
-      hardeningDisable = [ "fortify" "stackprotector" "pic" ];
-
-      configureFlags = [
-        "--with-config=${configFile}"
-        "--with-tirpc=1"
-        (lib.withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
-      ] ++ optionals buildUser [
-        "--with-dracutdir=$(out)/lib/dracut"
-        "--with-udevdir=$(out)/lib/udev"
-        "--with-systemdunitdir=$(out)/etc/systemd/system"
-        "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
-        "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
-        "--with-mounthelperdir=$(out)/bin"
-        "--libexecdir=$(out)/libexec"
-        "--sysconfdir=/etc"
-        "--localstatedir=/var"
-        "--enable-systemd"
-      ] ++ optionals buildKernel ([
-        "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-        "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      ] ++ kernel.makeFlags);
-
-      makeFlags = optionals buildKernel kernel.makeFlags;
-
-      enableParallelBuilding = true;
-
-      installFlags = [
-        "sysconfdir=\${out}/etc"
-        "DEFAULT_INITCONF_DIR=\${out}/default"
-        "INSTALL_MOD_PATH=\${out}"
-      ];
-
-      # Enabling BTF causes zfs to be build with debug symbols.
-      # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
-      # Hence we strip modules prior to compression.
-      postBuild = optionalString buildKernel ''
-         find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES ${stdenv.cc.targetPrefix}strip --strip-debug
-      '';
-
-      postInstall = optionalString buildKernel ''
-        # Add reference that cannot be detected due to compressed kernel module
-        mkdir -p "$out/nix-support"
-        echo "${util-linux}" >> "$out/nix-support/extra-refs"
-      '' + optionalString buildUser ''
-        # Remove provided services as they are buggy
-        rm $out/etc/systemd/system/zfs-import-*.service
-
-        sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
-
-        for i in $out/etc/systemd/system/*; do
-        substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
-        done
-
-        # Remove tests because they add a runtime dependency on gcc
-        rm -rf $out/share/zfs/zfs-tests
-
-        # Add Bash completions.
-        install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
-        (cd $out/share/bash-completion/completions; ln -s zfs zpool)
-      '';
-
-      postFixup = let
-        path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
-      in ''
-        for i in $out/libexec/zfs/zpool.d/*; do
-          sed -i '2i${path}' $i
-        done
-      '';
-
-      outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
-
-      passthru = {
-        inherit enableMail latestCompatibleLinuxPackages;
-
-        tests =
-          if isUnstable then [
-            nixosTests.zfs.unstable
-          ] else [
-            nixosTests.zfs.installer
-            nixosTests.zfs.stable
-          ];
-      };
-
-      meta = {
-        description = "ZFS Filesystem Linux Kernel module";
-        longDescription = ''
-          ZFS is a filesystem that combines a logical volume manager with a
-          Copy-On-Write filesystem with data integrity detection and repair,
-          snapshotting, cloning, block devices, deduplication, and more.
-        '';
-        homepage = "https://github.com/openzfs/zfs";
-        changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
-        license = lib.licenses.cddl;
-        platforms = lib.platforms.linux;
-        maintainers = with lib.maintainers; [ hmenke jcumming jonringer wizeman globin ];
-        mainProgram = "zfs";
-        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
-        # On NixOS set the option boot.zfs.enableUnstable.
-        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
-      };
-    };
-in {
-  # also check if kernel version constraints in
-  # ./nixos/modules/tasks/filesystems/zfs.nix needs
-  # to be adapted
-  zfsStable = common {
-    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.19";
-    latestCompatibleLinuxPackages = linuxPackages_5_18;
-
-    # this package should point to the latest release.
-    version = "2.1.5";
-
-    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";
-  };
-
-  zfsUnstable = common {
-    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.19";
-    latestCompatibleLinuxPackages = linuxPackages_5_18;
-
-    # this package should point to a version / git revision compatible with the latest kernel release
-    # IMPORTANT: Always use a tagged release candidate or commits from the
-    # zfs-<version>-staging branch, because this is tested by the OpenZFS
-    # maintainers.
-    version = "2.1.5";
-    # rev = "0000000000000000000000000000000000000000";
-
-    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";
-
-    isUnstable = true;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix b/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix
new file mode 100644
index 000000000000..347b4a299710
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix
@@ -0,0 +1,234 @@
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchpatch
+, autoreconfHook269, util-linux, nukeReferences, coreutils
+, perl, nixosTests
+, configFile ? "all"
+
+# Userspace dependencies
+, zlib, libuuid, python3, attr, openssl
+, libtirpc
+, nfs-utils, samba
+, gawk, gnugrep, gnused, systemd
+, smartmontools, enableMail ? false
+, sysstat, pkg-config
+, curl
+, pam
+
+# Kernel dependencies
+, kernel ? null
+, enablePython ? true
+, ...
+}:
+
+{ version
+, sha256
+, extraPatches ? []
+, rev ? "zfs-${version}"
+, isUnstable ? false
+, latestCompatibleLinuxPackages
+, kernelCompatible ? null
+}:
+
+let
+  inherit (lib) any optionalString optionals optional makeBinPath;
+
+  smartmon = smartmontools.override { inherit enableMail; };
+
+  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
+  buildUser = any (n: n == configFile) [ "user" "all" ];
+
+  # XXX: You always want to build kernel modules with the same stdenv as the
+  # kernel was built with. However, since zfs can also be built for userspace we
+  # need to correctly pick between the provided/default stdenv, and the one used
+  # by the kernel.
+  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
+  # clang-built) kernels.
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+
+stdenv'.mkDerivation {
+  name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+  src = fetchFromGitHub {
+    owner = "openzfs";
+    repo = "zfs";
+    inherit rev sha256;
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
+      sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
+    })
+  ] ++ extraPatches;
+
+  postPatch = optionalString buildKernel ''
+    patchShebangs scripts
+    # The arrays must remain the same length, so we repeat a flag that is
+    # already part of the command and therefore has no effect.
+    substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
+      --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
+      --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
+  '' + optionalString buildUser ''
+    substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
+      # We don't *need* python support, but we set it like this to minimize closure size:
+      # If it's disabled by default, no need to enable it, even if we have python enabled
+      # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
+      nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
+    }/bin/exportfs"
+    substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
+    # Disable dynamic loading of libcurl
+    substituteInPlace ./config/user-libfetch.m4   --replace "curl-config --built-shared" "true"
+    substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
+    substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
+                                                  --replace "/etc/default"            "$out/etc/default"
+    substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+
+    substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
+      --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
+    substituteInPlace ./contrib/initramfs/Makefile.am \
+      --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
+    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
+    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
+    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
+    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
+    substituteInPlace ./etc/systemd/system/Makefile.am \
+      --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
+
+    substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
+      --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
+    substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
+      --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
+
+    substituteInPlace ./cmd/vdev_id/vdev_id \
+      --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+      "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
+    ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
+    ++ optional buildUser pkg-config;
+  buildInputs = optionals buildUser [ zlib libuuid attr libtirpc pam ]
+    ++ optional buildUser openssl
+    ++ optional buildUser curl
+    ++ optional (buildUser && enablePython) python3;
+
+  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
+  NIX_CFLAGS_LINK = "-lgcc_s";
+
+  hardeningDisable = [ "fortify" "stackprotector" "pic" ];
+
+  configureFlags = [
+    "--with-config=${configFile}"
+    "--with-tirpc=1"
+    (lib.withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
+  ] ++ optionals buildUser [
+    "--with-dracutdir=$(out)/lib/dracut"
+    "--with-udevdir=$(out)/lib/udev"
+    "--with-systemdunitdir=$(out)/etc/systemd/system"
+    "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+    "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
+    "--with-mounthelperdir=$(out)/bin"
+    "--libexecdir=$(out)/libexec"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-systemd"
+    "--enable-pam"
+  ] ++ optionals buildKernel ([
+    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ] ++ kernel.makeFlags);
+
+  makeFlags = optionals buildKernel kernel.makeFlags;
+
+  enableParallelBuilding = true;
+
+  installFlags = [
+    "sysconfdir=\${out}/etc"
+    "DEFAULT_INITCONF_DIR=\${out}/default"
+    "INSTALL_MOD_PATH=\${out}"
+  ];
+
+  # Enabling BTF causes zfs to be build with debug symbols.
+  # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
+  # Hence we strip modules prior to compression.
+  postBuild = optionalString buildKernel ''
+     find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES ${stdenv.cc.targetPrefix}strip --strip-debug
+  '';
+
+  postInstall = optionalString buildKernel ''
+    # Add reference that cannot be detected due to compressed kernel module
+    mkdir -p "$out/nix-support"
+    echo "${util-linux}" >> "$out/nix-support/extra-refs"
+  '' + optionalString buildUser ''
+    # Remove provided services as they are buggy
+    rm $out/etc/systemd/system/zfs-import-*.service
+
+    sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
+
+    for i in $out/etc/systemd/system/*; do
+    substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+    done
+
+    # Remove tests because they add a runtime dependency on gcc
+    rm -rf $out/share/zfs/zfs-tests
+
+    # Add Bash completions.
+    install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
+    (cd $out/share/bash-completion/completions; ln -s zfs zpool)
+  '';
+
+  postFixup = let
+    path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
+  in ''
+    for i in $out/libexec/zfs/zpool.d/*; do
+      sed -i '2i${path}' $i
+    done
+  '';
+
+  outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
+
+  passthru = {
+    inherit enableMail latestCompatibleLinuxPackages;
+
+    tests =
+      if isUnstable then [
+        nixosTests.zfs.unstable
+      ] else [
+        nixosTests.zfs.installer
+        nixosTests.zfs.stable
+      ];
+  };
+
+  meta = {
+    description = "ZFS Filesystem Linux Kernel module";
+    longDescription = ''
+      ZFS is a filesystem that combines a logical volume manager with a
+      Copy-On-Write filesystem with data integrity detection and repair,
+      snapshotting, cloning, block devices, deduplication, and more.
+    '';
+    homepage = "https://github.com/openzfs/zfs";
+    changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
+    license = lib.licenses.cddl;
+
+    # The case-block for TARGET_CPU has branches for only five CPU families,
+    # which prevents ZFS from building on any other platform.  Since the NixOS
+    # `boot.zfs.enabled` property is `readOnly`, excluding platforms where ZFS
+    # does not build is the only way to produce a NixOS installer on such
+    # platforms.
+    # https://github.com/openzfs/zfs/blob/6a6bd493988c75331deab06e5352a9bed035a87d/config/always-arch.m4#L16
+    platforms =
+      with lib.systems.inspect.patterns;
+      map (p: p // isLinux) [ isx86_32 isx86_64 isPower isAarch64 isSparc ];
+
+    maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
+    mainProgram = "zfs";
+    # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+    # On NixOS set the option boot.zfs.enableUnstable.
+    broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
new file mode 100644
index 000000000000..77ea4bb84b4b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
@@ -0,0 +1,23 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  kernelCompatible =
+    if stdenv'.isx86_64
+    then kernel.kernelOlder "6.4"
+    else kernel.kernelOlder "6.2";
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_3;
+
+  # this package should point to the latest release.
+  version = "2.1.12";
+
+  sha256 = "eYUR5d4gpTrlFu6j1uL83DWL9uPGgAUDRdSEb73V5i4=";
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
new file mode 100644
index 000000000000..b8cf789e8ffa
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
@@ -0,0 +1,31 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  # NOTE:
+  #   zfs-2.1.9<=x<=2.1.10 is broken with aarch64-linux-6.2
+  #   for future releases, please delete this condition.
+  kernelCompatible = if stdenv'.isx86_64
+    then kernel.kernelOlder "6.3"
+    else kernel.kernelOlder "6.2";
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;
+
+  # this package should point to a version / git revision compatible with the latest kernel release
+  # IMPORTANT: Always use a tagged release candidate or commits from the
+  # zfs-<version>-staging branch, because this is tested by the OpenZFS
+  # maintainers.
+  version = "2.1.12-staging-2023-04-18";
+  rev = "e25f9131d679692704c11dc0c1df6d4585b70c35";
+
+  sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
+
+  isUnstable = true;
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/zsa-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/zsa-udev-rules/default.nix
index 3dfc2354fae3..c015da7456a0 100644
--- a/nixpkgs/pkgs/os-specific/linux/zsa-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zsa-udev-rules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsa-udev-rules";
-  version = "2.1.3";
+  version = "unstable-2022-10-26";
 
   src = fetchFromGitHub {
     owner = "zsa";
     repo = "wally";
-    rev = "${version}-linux";
-    sha256 = "mZzXKFKlO/jAitnqzfvmIHp46A+R3xt2gOhVC3qN6gM=";
+    rev = "623a50d0e0b90486e42ad8ad42b0a7313f7a37b3";
+    hash = "sha256-meR2V7T4hrJFXFPLENHoAgmOILxxynDBk0BLqzsAZvQ=";
   };
 
   # Only copies udevs rules
diff --git a/nixpkgs/pkgs/os-specific/solo5/default.nix b/nixpkgs/pkgs/os-specific/solo5/default.nix
index c50cea7b3850..f235902a91cd 100644
--- a/nixpkgs/pkgs/os-specific/solo5/default.nix
+++ b/nixpkgs/pkgs/os-specific/solo5/default.nix
@@ -2,7 +2,7 @@
 , pkg-config, qemu, syslinux, util-linux }:
 
 let
-  version = "0.7.3";
+  version = "0.8.0";
   # list of all theoretically available targets
   targets = [
     "genode"
@@ -21,11 +21,9 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/Solo5/solo5/releases/download/v${version}/solo5-v${version}.tar.gz";
-    sha256 = "sha256-8LftT22XzmmWxgYez+BAHDX4HOyl5DrwrpuO2+bqqcY=";
+    sha256 = "sha256-t80VOZ8Tr1Dq+mJfRPVLGqYprCaqegcQtDqdoHaSXW0=";
   };
 
-  patches = [ ./fix_paths.patch ./test_sleep.patch ];
-
   hardeningEnable = [ "pie" ];
 
   configurePhase = ''
@@ -36,6 +34,9 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  separateDebugInfo = true;
+    # debugging requires information for both the unikernel and the tender
+
   installPhase = ''
     runHook preInstall
     export DESTDIR=$out
@@ -54,7 +55,7 @@ in stdenv.mkDerivation {
   '';
 
   doCheck = stdenv.hostPlatform.isLinux;
-  checkInputs = [ util-linux qemu ];
+  nativeCheckInputs = [ util-linux qemu ];
   checkPhase = ''
     runHook preCheck
     patchShebangs tests
diff --git a/nixpkgs/pkgs/os-specific/solo5/fix_paths.patch b/nixpkgs/pkgs/os-specific/solo5/fix_paths.patch
deleted file mode 100644
index 8895de311dae..000000000000
--- a/nixpkgs/pkgs/os-specific/solo5/fix_paths.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/toolchain/cc.in b/toolchain/cc.in
-index 337562a..0ec9315 100644
---- a/toolchain/cc.in
-+++ b/toolchain/cc.in
-@@ -30,9 +30,9 @@
- # symbols.
- 
- prog="$(basename $0)"
--I="$(dirname $0)/../include"
-+I="$(realpath $0 | xargs dirname)/../include"
- [ ! -d "${I}" ] && echo "$prog: Could not determine include path" 1>&2 && exit 1
--L="$(dirname $0)/../lib/@@CONFIG_TARGET_TRIPLE@@"
-+L="$(realpath $0 | xargs dirname)/../lib/@@CONFIG_TARGET_TRIPLE@@"
- [ ! -d "${L}" ] && echo "$prog: Could not determine library path" 1>&2 && exit 1
- # we can't really tell if 'cc' is called with no input, but work around the
- # most obvious cases and stop them from "succeeding" and producing an "a.out"
-diff --git a/toolchain/ld.in b/toolchain/ld.in
-index 01dffa8..13dca2c 100644
---- a/toolchain/ld.in
-+++ b/toolchain/ld.in
-@@ -28,7 +28,7 @@
- # linking a unikernel. No default for ABI is provided, as it is expected that a
- # caller directly using 'ld' knows what they are doing.
- 
--L="$(dirname $0)/../lib/@@CONFIG_TARGET_TRIPLE@@"
-+L="$(realpath $0 | xargs dirname)/../lib/@@CONFIG_TARGET_TRIPLE@@"
- [ ! -d "${L}" ] && echo "$0: Could not determine library path" 1>&2 && exit 1
- # ld accepts -z solo5-abi=ABI, but does not provide a default ABI
- # this is intentional
diff --git a/nixpkgs/pkgs/os-specific/solo5/test_sleep.patch b/nixpkgs/pkgs/os-specific/solo5/test_sleep.patch
deleted file mode 100644
index f86a83d09dec..000000000000
--- a/nixpkgs/pkgs/os-specific/solo5/test_sleep.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/tests/test_time/test_time.c b/tests/test_time/test_time.c
-index 931500b..cde64ad 100644
---- a/tests/test_time/test_time.c
-+++ b/tests/test_time/test_time.c
-@@ -110,7 +110,8 @@ int solo5_app_main(const struct solo5_start_info *si __attribute__((unused)))
-         /*
-          * Verify that we did not sleep less than requested (see above).
-          */
--        if (delta < NSEC_PER_SEC) {
-+        const solo5_time_t slack = 100000000ULL;
-+        if (delta < NSEC_PER_SEC - slack) {
-             printf("[%d] ERROR: slept too little (expected at least %llu ns)\n",
-                     iters, (unsigned long long)NSEC_PER_SEC);
-             failed = true;
-@@ -120,7 +121,6 @@ int solo5_app_main(const struct solo5_start_info *si __attribute__((unused)))
-          * Verify that we did not sleep more than requested, within reason
-          * (scheduling delays, general inaccuracy of the current timing code).
-          */
--        const solo5_time_t slack = 100000000ULL;
-         if (delta > (NSEC_PER_SEC + slack)) {
-             printf("[%d] ERROR: slept too much (expected at most %llu ns)\n",
-                     iters, (unsigned long long)slack);
diff --git a/nixpkgs/pkgs/os-specific/windows/mingw-w64/default.nix b/nixpkgs/pkgs/os-specific/windows/mingw-w64/default.nix
index 569b149868ff..221bcd8e89f2 100644
--- a/nixpkgs/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/nixpkgs/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -1,16 +1,36 @@
-{ lib, stdenv, windows, fetchurl }:
+{ lib
+, stdenv
+, windows
+, fetchurl
+, fetchpatch
+, autoreconfHook
+}:
 
 let
-  version = "9.0.0";
+  version = "10.0.0";
 in stdenv.mkDerivation {
   pname = "mingw-w64";
   inherit version;
 
   src = fetchurl {
     url = "mirror://sourceforge/mingw-w64/mingw-w64-v${version}.tar.bz2";
-    sha256 = "10a15bi4lyfi0k0haj0klqambicwma6yi7vssgbz8prg815vja8r";
+    hash = "sha256-umtDCu1yxjo3aFMfaj/8Kw/eLFejslFFDc9ImolPCJQ=";
   };
 
+  patches = [
+    # Upstream patches to fix build parallelism
+    (fetchpatch {
+      name = "crt-suff-make-4.4.patch";
+      url = "https://github.com/mirror/mingw-w64/commit/953bcd32ae470c4647e94de8548dda5a8f07d82d.patch";
+      hash = "sha256-lrS4ZDa/Uwsj5DXajOUv+knZXan0JVU70KHHdIjJ07Y=";
+    })
+    (fetchpatch {
+      name = "dll-dep-make-4.4.patch";
+      url = "https://github.com/mirror/mingw-w64/commit/e1b0c1420bbd52ef505c71737c57393ac1397b0a.patch";
+      hash = "sha256-/56Cmmy0UYTaDKIWG7CgXsThvCHK6lSbekbBOoOJSIQ=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   configureFlags = [
@@ -20,6 +40,7 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ windows.mingw_w64_headers ];
   hardeningDisable = [ "stackprotector" "fortify" ];
 
diff --git a/nixpkgs/pkgs/os-specific/windows/wxMSW-2.8/default.nix b/nixpkgs/pkgs/os-specific/windows/wxMSW-2.8/default.nix
index bf1e73f67b9a..091897b69343 100644
--- a/nixpkgs/pkgs/os-specific/windows/wxMSW-2.8/default.nix
+++ b/nixpkgs/pkgs/os-specific/windows/wxMSW-2.8/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     (if compat24 then "--enable-compat24" else "--disable-compat24")
     (if compat26 then "--enable-compat26" else "--disable-compat26")
     "--disable-precomp-headers"
-    (if unicode then "--enable-unicode" else "")
+    (lib.optionalString unicode "--enable-unicode")
     "--with-opengl"
   ];