Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

Conflicts:
	nixpkgs/nixos/modules/services/mail/rss2email.nix
	nixpkgs/pkgs/build-support/go/module.nix

20 files changed, 228 insertions, 162 deletions

diff --git a/nixpkgs/pkgs/tools/filesystems/apfs-fuse/default.nix b/nixpkgs/pkgs/tools/filesystems/apfs-fuse/default.nix
index 0beffca1a54e..5881d361c549 100644
--- a/nixpkgs/pkgs/tools/filesystems/apfs-fuse/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/apfs-fuse/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, fuse, fuse3, bzip2, zlib, attr, cmake }:
 
 stdenv.mkDerivation {
-  pname = "apfs-fuse-unstable";
-  version = "2023-01-04";
+  pname = "apfs-fuse";
+  version = "unstable-2023-03-12";
 
   src = fetchFromGitHub {
     owner  = "sgan81";
     repo   = "apfs-fuse";
-    rev    = "1f041d7af5df5423832e54e9f358fd9234773fcc";
-    hash = "sha256-EmhCvIwyVJvib/ZHzCsULh8bOjhzKRu47LojX+L40qQ=";
+    rev    = "66b86bd525e8cb90f9012543be89b1f092b75cf3";
+    hash = "sha256-uYAlqnQp0K880XEWuH1548DUA3ii53+hfsuh/T3Vwzg=";
     fetchSubmodules = true;
   };
 
@@ -37,8 +37,8 @@ stdenv.mkDerivation {
     homepage    = "https://github.com/sgan81/apfs-fuse";
     description = "FUSE driver for APFS (Apple File System)";
     license     = licenses.gpl2Plus;
+    mainProgram = "apfs-fuse";
     maintainers = with maintainers; [ ealasu ];
     platforms   = platforms.unix;
   };
-
 }
diff --git a/nixpkgs/pkgs/tools/filesystems/apfsprogs/default.nix b/nixpkgs/pkgs/tools/filesystems/apfsprogs/default.nix
deleted file mode 100644
index 015bb0b88d1b..000000000000
--- a/nixpkgs/pkgs/tools/filesystems/apfsprogs/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, nixosTests
-}:
-
-stdenv.mkDerivation {
-  pname = "apfsprogs";
-  version = "unstable-2023-06-06";
-
-  src = fetchFromGitHub {
-    owner = "linux-apfs";
-    repo = "apfsprogs";
-    rev = "91827679dfb1d6f5719fbe22fa67e89c17adb133";
-    hash = "sha256-gF7bOozAGGpuVP23mnPW81qH2gnVUdT9cxukzGJ+ydI=";
-  };
-
-  buildPhase = ''
-    runHook preBuild
-    make -C apfs-snap $makeFlags
-    make -C apfsck $makeFlags
-    make -C mkapfs $makeFlags
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    make -C apfs-snap install DESTDIR="$out" $installFlags
-    make -C apfsck install DESTDIR="$out" $installFlags
-    make -C mkapfs install DESTDIR="$out" $installFlags
-    runHook postInstall
-  '';
-
-  passthru.tests = {
-    apfs = nixosTests.apfs;
-  };
-
-  meta = with lib; {
-    description = "Experimental APFS tools for linux";
-    homepage = "https://github.com/linux-apfs/apfsprogs";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ Luflosi ];
-  };
-}
diff --git a/nixpkgs/pkgs/tools/filesystems/bashmount/default.nix b/nixpkgs/pkgs/tools/filesystems/bashmount/default.nix
index ef7bfd492e37..dbd573d5f012 100644
--- a/nixpkgs/pkgs/tools/filesystems/bashmount/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/bashmount/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/jamielinux/bashmount";
     description = "A menu-driven bash script for the management of removable media with udisks";
+    mainProgram = "bashmount";
     maintainers = [ maintainers.koral ];
     license = licenses.gpl2;
     platforms = platforms.all;
diff --git a/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix b/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 17b438ac46b8..36566dc71002 100644
--- a/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -19,6 +19,7 @@
 , rustPlatform
 , makeWrapper
 , writeScript
+, python3
 , fuseSupport ? false
 }:
 
@@ -26,7 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
   version = "1.4.1";
 
-
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
@@ -65,20 +65,32 @@ stdenv.mkDerivation (finalAttrs: {
     udev
   ] ++ lib.optional fuseSupport fuse3;
 
+  # FIXME: Try enabling this once the default linux kernel is at least 6.7
   doCheck = false; # needs bcachefs module loaded on builder
   checkFlags = [ "BCACHEFS_TEST_USE_VALGRIND=no" ];
 
   makeFlags = [
-    "DESTDIR=${placeholder "out"}"
-    "PREFIX="
+    "PREFIX=${placeholder "out"}"
     "VERSION=${finalAttrs.version}"
     "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
+    "BCACHEFS_FUSE=${toString fuseSupport}"
   ];
 
   preCheck = lib.optionalString (!fuseSupport) ''
     rm tests/test_fuse.py
   '';
 
+  # Tries to install to the 'systemd-minimal' and 'udev' nix installation paths
+  installFlags = [
+    "PKGCONFIG_SERVICEDIR=$(out)/lib/systemd/system"
+    "PKGCONFIG_UDEVDIR=$(out)/lib/udev"
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/libexec/bcachefsck_all \
+      --replace "/usr/bin/python3" "${python3}/bin/python3"
+  '';
+
   passthru = {
     tests = {
       smoke-test = nixosTests.bcachefs;
diff --git a/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix b/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
index dc9f8a0a27d6..ef3ba227ea6b 100644
--- a/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.6.3";
+  version = "6.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-9BzlP2Zz/1Ue5KP+fclgHloN3mttCRd9H6ticYq8bZo=";
+    hash = "sha256-wn91UYW58tqzH0LoowPTa+0qPzNBzG117migplCiR2c=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/filesystems/ceph/default.nix b/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
index f38cd4be880c..fa312c8fb356 100644
--- a/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
@@ -50,6 +50,9 @@
 , zlib
 , zstd
 
+# Dependencies of overridden Python dependencies, hopefully we can remove these soon.
+, rustPlatform
+
 # Optional Dependencies
 , curl ? null
 , expat ? null
@@ -166,7 +169,67 @@ let
 
   # Watch out for python <> boost compatibility
   python = python310.override {
-    packageOverrides = self: super: {
+    packageOverrides = self: super: let cryptographyOverrideVersion = "40.0.1"; in {
+      # Ceph does not support `cryptography` > 40 yet:
+      # * https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602
+      # * Upstream issue: https://tracker.ceph.com/issues/63529
+      #   > Python Sub-Interpreter Model Used by ceph-mgr Incompatible With Python Modules Based on PyO3
+      #
+      # We pin the older `cryptography` 40 here;
+      # this also forces us to pin an older `pyopenssl` because the current one
+      # is not compatible with older `cryptography`, see:
+      #     https://github.com/pyca/pyopenssl/blob/d9752e44127ba36041b045417af8a0bf16ec4f1e/CHANGELOG.rst#2320-2023-05-30
+      cryptography = super.cryptography.overridePythonAttrs (old: rec {
+        version = cryptographyOverrideVersion;
+
+        src = fetchPypi {
+          inherit (old) pname;
+          version = cryptographyOverrideVersion;
+          hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI=";
+        };
+
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = let cargoRoot = "src/rust"; in "${old.pname}-${cryptographyOverrideVersion}/${cargoRoot}";
+          name = "${old.pname}-${cryptographyOverrideVersion}";
+          hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU=";
+        };
+
+        patches = (old.patches or []) ++ [
+          # Fix https://nvd.nist.gov/vuln/detail/CVE-2023-49083 which has no upstream backport.
+          # See https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a#diff-f5134bf8f3cf0a5cc8601df55e50697acc866c603a38caff98802bd8e17976c5R1893
+          ./python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch
+        ];
+
+        # Tests would require overriding `cryptography-vectors`, which is not currently
+        # possible/desired, see: https://github.com/NixOS/nixpkgs/pull/281858#pullrequestreview-1841421866
+        doCheck = false;
+      });
+
+      # This is the most recent version of `pyopenssl` that's still compatible with `cryptography` 40.
+      # See https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602
+      pyopenssl = super.pyopenssl.overridePythonAttrs (old: rec {
+        version = "23.1.1";
+        src = fetchPypi {
+          pname = "pyOpenSSL";
+          inherit version;
+          hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc=";
+        };
+      });
+
+      # Ceph does not support `kubernetes` >= 19, see:
+      #     https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1900324090
+      kubernetes = super.kubernetes.overridePythonAttrs (old: rec {
+        version = "18.20.0";
+        src = fetchFromGitHub {
+          owner = "kubernetes-client";
+          repo = "python";
+          rev = "v${version}";
+          sha256 = "1sawp62j7h0yksmg9jlv4ik9b9i1a1w9syywc9mv8x89wibf5ql1";
+          fetchSubmodules = true;
+        };
+      });
+
     };
   };
 
@@ -215,10 +278,10 @@ let
   ]);
   inherit (ceph-python-env.python) sitePackages;
 
-  version = "18.2.0";
+  version = "18.2.1";
   src = fetchurl {
     url = "https://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-    hash = "sha256:0k9nl6xi5brva51rr14m7ig27mmmd7vrpchcmqc40q3c2khn6ns9";
+    hash = "sha256-gHWwNHf0KtI7Hv0MwaCqP6A3YR/AWakfUZTktRyddko=";
   };
 in rec {
   ceph = stdenv.mkDerivation {
diff --git a/nixpkgs/pkgs/tools/filesystems/ceph/python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch b/nixpkgs/pkgs/tools/filesystems/ceph/python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch
new file mode 100644
index 000000000000..7ca05cf7450f
--- /dev/null
+++ b/nixpkgs/pkgs/tools/filesystems/ceph/python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch
@@ -0,0 +1,44 @@
+commit 08dbad8552ecca85d3e38072f94eb864b143d218
+Author: Niklas Hambüchen <mail@nh2.me>
+Date:   Mon Jan 22 12:52:06 2024 +0000
+
+    Cherry-pick fix for CVE-2023-49083
+    
+    Cherry-Picked-From: f09c261ca10a31fe41b1262306db7f8f1da0e48a
+    Cherry-Picked-By: Niklas Hambüchen <mail@nh2.me>
+
+diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
+index a3fe1bce4..58e7207c4 100644
+--- a/src/cryptography/hazmat/backends/openssl/backend.py
++++ b/src/cryptography/hazmat/backends/openssl/backend.py
+@@ -2383,9 +2383,12 @@ class Backend:
+                 _Reasons.UNSUPPORTED_SERIALIZATION,
+             )
+ 
++        certs: list[x509.Certificate] = []
++        if p7.d.sign == self._ffi.NULL:
++            return certs
++
+         sk_x509 = p7.d.sign.cert
+         num = self._lib.sk_X509_num(sk_x509)
+-        certs = []
+         for i in range(num):
+             x509 = self._lib.sk_X509_value(sk_x509, i)
+             self.openssl_assert(x509 != self._ffi.NULL)
+diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py
+index 4e61c5ef5..d8170bfb9 100644
+--- a/tests/hazmat/primitives/test_pkcs7.py
++++ b/tests/hazmat/primitives/test_pkcs7.py
+@@ -89,6 +89,12 @@ class TestPKCS7Loading:
+                 mode="rb",
+             )
+ 
++    def test_load_pkcs7_empty_certificates(self, backend):
++        der = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
++
++        certificates = pkcs7.load_der_pkcs7_certificates(der)
++        assert certificates == []
++
+ 
+ # We have no public verification API and won't be adding one until we get
+ # some requirements from users so this function exists to give us basic
diff --git a/nixpkgs/pkgs/tools/filesystems/convoy/default.nix b/nixpkgs/pkgs/tools/filesystems/convoy/default.nix
deleted file mode 100644
index 774568fdde17..000000000000
--- a/nixpkgs/pkgs/tools/filesystems/convoy/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-# This file was generated by go2nix.
-{ lib, buildGoPackage, fetchFromGitHub, lvm2 }:
-
-buildGoPackage rec {
-  pname = "convoy";
-  version = "0.5.2";
-
-  goPackagePath = "github.com/rancher/convoy";
-
-  src = fetchFromGitHub {
-    rev = "v${version}";
-    owner = "rancher";
-    repo = "convoy";
-    sha256 = "09nygrxd5hril4xcfsvgjg74xxhhimznqq4sdk0f360c5ra0dbhj";
-  };
-
-  buildInputs = [lvm2];
-
-  meta = with lib; {
-    homepage = "https://github.com/rancher/convoy";
-    description = "A Docker volume plugin, managing persistent container volumes";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ offline ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/tools/filesystems/dwarfs/default.nix b/nixpkgs/pkgs/tools/filesystems/dwarfs/default.nix
index 8703c11bf3c7..abd99731de13 100644
--- a/nixpkgs/pkgs/tools/filesystems/dwarfs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/dwarfs/default.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation rec {
   pname = "dwarfs";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "mhx";
     repo = "dwarfs";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-wclUyATUZmF7EEkrK9nWASmfiB+MBrvEzc73ngOrhZ0=";
+    hash = "sha256-Zzm2SaFR31TBBMDfgJulVbqsJBh1He2wBFzHRC/c5vg=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/tools/filesystems/garage/default.nix b/nixpkgs/pkgs/tools/filesystems/garage/default.nix
index 894840d2dd04..e34822845b40 100644
--- a/nixpkgs/pkgs/tools/filesystems/garage/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/garage/default.nix
@@ -24,6 +24,12 @@ let
       inherit sha256;
     };
 
+    postPatch = ''
+      # Starting in 0.9.x series, Garage is using mold in local development
+      # and this leaks in this packaging, we remove it to use the default linker.
+      rm .cargo/config.toml || true
+    '';
+
     inherit cargoSha256;
 
     nativeBuildInputs = [ protobuf pkg-config ];
@@ -68,6 +74,7 @@ let
 
     meta = {
       description = "S3-compatible object store for small self-hosted geo-distributed deployments";
+      changelog = "https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v${version}";
       homepage = "https://garagehq.deuxfleurs.fr";
       license = lib.licenses.agpl3Only;
       maintainers = with lib.maintainers; [ nickcao _0x4A6F teutat3s raitobezarius ];
@@ -82,28 +89,22 @@ rec {
   # we have to keep all the numbers in the version to handle major/minor/patch level.
   # for <1.0.
 
-  garage_0_8_4 = generic {
-    version = "0.8.4";
-    sha256 = "sha256-YgMw41ofM59h7OnHK1H8+Se5mZEdYypPIdkqbyX9qfs=";
-    cargoSha256 = "sha256-dEtksOVqy5wAPoqCuXJj3c4TB6UbR8PTaB70fbL6iR8=";
+  garage_0_8_5 = generic {
+    version = "0.8.5";
+    sha256 = "sha256-YRxkjETSmI1dcHP9qTPLcOMqXx9B2uplVR3bBjJWn3I=";
+    cargoSha256 = "sha256-VOcymlvqqQRdT1MFzRcMuD+Xo3fc3XTuRA12tW7ZjdI=";
+    broken = stdenv.isDarwin;
   };
 
-  garage_0_8 = garage_0_8_4;
-
-  garage_0_9_0 = (generic {
-    version = "0.9.0";
-    sha256 = "sha256-Bw7ohMAfnbkhl43k8KxYu2OJd5689PqDS0vAcgU09W8=";
-    cargoSha256 = "sha256-JqCt/8p24suQMRzEyTE2OkbzZCGUDLuGq32kCq3eZ7o=";
-  }).overrideAttrs (oldAttrs: {
-    patches = oldAttrs.patches or [ ] ++ [
-      (fetchpatch {
-        url = "https://git.deuxfleurs.fr/Deuxfleurs/garage/commit/c7f5dcd953ff1fdfa002a8bccfb43eafcc6fddd4.patch";
-        sha256 = "sha256-q7E6gtPjnj5O/K837LMP6LPEFcgdkifxRFrYzBuqkk0=";
-      })
-    ];
-  });
+  garage_0_8 = garage_0_8_5;
+
+  garage_0_9_1 = generic {
+    version = "0.9.1";
+    sha256 = "sha256-AXLaifVmZU4j5D/wKn/0TzhjHZBzZW1+tMyhsAo2eBU=";
+    cargoSha256 = "sha256-4/+OsM73TroBB1TGqare2xASO5KhqVyNkkss0Y0JZXg=";
+  };
 
-  garage_0_9 = garage_0_9_0;
+  garage_0_9 = garage_0_9_1;
 
   garage = garage_0_9;
 }
diff --git a/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix b/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
index 500d5cb1f1f5..145fddb9222b 100644
--- a/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-IrLbKBCguj2B1PvtUwCaPP+4NoLbJZRtcsNGMDDC8b8=";
+    hash = "sha256-xQWkrFuMvwloDjnIU2T1Fmfpc/2w3ISbyDhFmN/ETFA=";
   };
 
   vendorHash = "sha256-cIOjgoS3cW6GA697K0Loi76ed64Ev2jZbuOIPNRM1HU=";
diff --git a/nixpkgs/pkgs/tools/filesystems/genimage/default.nix b/nixpkgs/pkgs/tools/filesystems/genimage/default.nix
index ab93f4233d8f..34500447b875 100644
--- a/nixpkgs/pkgs/tools/filesystems/genimage/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/genimage/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "genimage";
-  version = "16";
+  version = "17";
 
   src = fetchurl {
     url = "https://public.pengutronix.de/software/genimage/genimage-${version}.tar.xz";
-    sha256 = "sha256-hp+WYtO3eMabHR/nDfZY4cnpCu2iart1P2/lXosMbnM=";
+    sha256 = "sha256-qHVuNWeg1NgsNrCMzB4IglC5AG1WcMaysBQYXm7GBnE=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/nixpkgs/pkgs/tools/filesystems/juicefs/default.nix b/nixpkgs/pkgs/tools/filesystems/juicefs/default.nix
index 00f45c332cbe..6f6dd4101597 100644
--- a/nixpkgs/pkgs/tools/filesystems/juicefs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/juicefs/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "juicefs";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "juicedata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dMzBgwd5tVxE6OFHf6QTZfoqgL/t2pX+OgI6Pki6PG8=";
+    sha256 = "sha256-Sf68N5ZKveKM6xZEqF7Ah0KGgOx1cGZpJ2lYkUlgpI0=";
   };
 
-  vendorHash = "sha256-orq03bwN1cbwHoZFXz92tcA2F0oivGR/C5EJDAPA+pk=";
+  vendorHash = "sha256-ofUo/3EQPhXPNeD/3to5oFir/3eAaf9WBHR4DOzcxBQ=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix b/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
index 46c62b7ae4b0..edc5708a6119 100644
--- a/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mergerfs";
-  version = "2.38.0";
+  version = "2.39.0";
 
   src = fetchFromGitHub {
     owner = "trapexit";
     repo = pname;
     rev = version;
-    sha256 = "sha256-eENtsN9OqPpUQM+O8tPTBzDk26/F/zc2hZ4ZiXiDp2I=";
+    sha256 = "sha256-48ArTS1Gd1z7WUX1RjiHMuyp3K3p9FJPU2XO4bj292I=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/filesystems/rmfuse/default.nix b/nixpkgs/pkgs/tools/filesystems/rmfuse/default.nix
index a75ed9429c13..04a4d6273878 100644
--- a/nixpkgs/pkgs/tools/filesystems/rmfuse/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/rmfuse/default.nix
@@ -7,7 +7,7 @@ python3.pkgs.buildPythonApplication rec {
   pname = "rmfuse";
   version = "unstable-2021-06-06";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rschroll";
@@ -16,13 +16,15 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-W3kS6Kkmp8iWMOYFL7r1GyjSQvFotBXQCuTMK0vyHQ8=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'bidict = "^' 'bidict = ">='
-  '';
-
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "bidict"
+    "rmrl"
+    "xdg"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/nixpkgs/pkgs/tools/filesystems/snapraid/default.nix b/nixpkgs/pkgs/tools/filesystems/snapraid/default.nix
index 3afabf8cd643..89be607027f2 100644
--- a/nixpkgs/pkgs/tools/filesystems/snapraid/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/snapraid/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapraid";
-  version = "12.2";
+  version = "12.3";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    sha256 = "sha256-3wy442tv3m1CSOAj1cngTWRiqX934c/7V2YL6j30+3U=";
+    sha256 = "sha256-pkLooA3JZV/rPlE5+JeJN1QW2xAdNu7c/iFFtT4M4vc=";
   };
 
   VERSION = version;
diff --git a/nixpkgs/pkgs/tools/filesystems/ssdfs-utils/default.nix b/nixpkgs/pkgs/tools/filesystems/ssdfs-utils/default.nix
index 7fd837ddbe77..46d2c8ed9293 100644
--- a/nixpkgs/pkgs/tools/filesystems/ssdfs-utils/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/ssdfs-utils/default.nix
@@ -12,13 +12,13 @@ stdenv.mkDerivation {
   # as ssdfs-utils, not ssdfs-tools.
   pname = "ssdfs-utils";
   # The version is taken from `configure.ac`, there are no tags.
-  version = "4.37";
+  version = "4.38";
 
   src = fetchFromGitHub {
     owner = "dubeyko";
     repo = "ssdfs-tools";
-    rev = "f83f70409c5e4fa81e9a67f8ed7f824368aba063";
-    hash = "sha256-OuGQ876HRjjSyxMbd/l8yySxmEjW1Yo1PTyO9zEt8+Q=";
+    rev = "14c0e9eb63f75c100a711493a16665c313c7bcf7";
+    hash = "sha256-s8HWuUub7EzDVZTFSitW/Zg2u0PSrXnmb5fnfOyrNL0=";
   };
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/tools/filesystems/stratis-cli/default.nix b/nixpkgs/pkgs/tools/filesystems/stratis-cli/default.nix
index 3a1838ef303e..4c27b888bbaa 100644
--- a/nixpkgs/pkgs/tools/filesystems/stratis-cli/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/stratis-cli/default.nix
@@ -7,7 +7,7 @@
 python3Packages.buildPythonApplication rec {
   pname = "stratis-cli";
   version = "3.6.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
@@ -16,6 +16,10 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-mLmjMofdr0U+Bfnkde7lJqPXkd1ICPYdlcsOm2nOcQA=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     dbus-client-gen
     dbus-python-client-gen
diff --git a/nixpkgs/pkgs/tools/filesystems/stratisd/Cargo.lock b/nixpkgs/pkgs/tools/filesystems/stratisd/Cargo.lock
index 1406bc0aea3f..ddca983aa1cb 100644
--- a/nixpkgs/pkgs/tools/filesystems/stratisd/Cargo.lock
+++ b/nixpkgs/pkgs/tools/filesystems/stratisd/Cargo.lock
@@ -413,17 +413,6 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "errno"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
@@ -676,9 +665,9 @@ dependencies = [
 
 [[package]]
 name = "itertools"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+checksum = "25db6b064527c5d482d0423354fcd07a89a2dfe07b67892e62411946db7f07b0"
 dependencies = [
  "either",
 ]
@@ -837,12 +826,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
 
 [[package]]
-name = "loopdev"
-version = "0.4.0"
-source = "git+https://github.com/mulkieran/loopdev?branch=bump-bindgen-reduce-version-0.68.1#63e6105d5599d9df00041de873d7fc91f53b9f20"
+name = "loopdev-3"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378e7ca4e85e592564e6a96c362303972b5c7860367014383aadc10a8704fc38"
 dependencies = [
  "bindgen",
- "errno 0.2.8",
+ "errno",
  "libc",
 ]
 
@@ -862,6 +852,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "memoffset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
 name = "minimal-lexical"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -900,12 +899,24 @@ dependencies = [
  "bitflags 1.3.2",
  "cfg-if 1.0.0",
  "libc",
- "memoffset",
+ "memoffset 0.7.1",
  "pin-utils",
  "static_assertions",
 ]
 
 [[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.4.0",
+ "cfg-if 1.0.0",
+ "libc",
+ "memoffset 0.9.0",
+]
+
+[[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1010,9 +1021,9 @@ dependencies = [
 
 [[package]]
 name = "pretty-hex"
-version = "0.3.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6fa0831dd7cc608c38a5e323422a0077678fa5744aa2be4ad91c4ece8eec8d5"
+checksum = "bbc83ee4a840062f368f9096d80077a9841ec117e17e7f700df81958f1451254"
 
 [[package]]
 name = "proc-macro2"
@@ -1154,7 +1165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4eb579851244c2c03e7c24f501c3432bed80b8f720af1d6e5b0e0f01555a035"
 dependencies = [
  "bitflags 1.3.2",
- "errno 0.3.1",
+ "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys",
@@ -1229,9 +1240,9 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.1.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
@@ -1269,7 +1280,7 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "stratisd"
-version = "3.6.3"
+version = "3.6.4"
 dependencies = [
  "assert_cmd",
  "assert_matches",
@@ -1287,7 +1298,7 @@ dependencies = [
  "env_logger",
  "futures",
  "iocuddle",
- "itertools 0.11.0",
+ "itertools 0.12.0",
  "lazy_static",
  "libblkid-rs",
  "libc",
@@ -1296,8 +1307,8 @@ dependencies = [
  "libmount",
  "libudev",
  "log",
- "loopdev",
- "nix 0.26.2",
+ "loopdev-3",
+ "nix 0.27.1",
  "pkg-config",
  "predicates",
  "pretty-hex",
diff --git a/nixpkgs/pkgs/tools/filesystems/stratisd/default.nix b/nixpkgs/pkgs/tools/filesystems/stratisd/default.nix
index cd6ee0884637..d299a1dc93ff 100644
--- a/nixpkgs/pkgs/tools/filesystems/stratisd/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/stratisd/default.nix
@@ -27,20 +27,17 @@
 
 stdenv.mkDerivation rec {
   pname = "stratisd";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = pname;
     rev = "refs/tags/stratisd-v${version}";
-    hash = "sha256-Wu3SkuHyMCBape+pMymQntXRtdMIlF5wz75kKxaZlms=";
+    hash = "sha256-0zSMFjAzTtTmpSCqlIq5GXk3/AhlhtECFZXmo6xcjWA=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
-    outputHashes = {
-      "loopdev-0.4.0" = "sha256-YS0hqxphxbbImT/mn/XBzkgabK2kbIym5VqG3XDVAx8=";
-    };
   };
 
   postPatch = ''
@@ -99,10 +96,10 @@ stdenv.mkDerivation rec {
   # remove files for supporting dracut
   postInstall = ''
     mkdir -p "$initrd/bin"
-    cp "dracut/90stratis/stratis-rootfs-setup" "$initrd/bin"
+    cp "$out/lib/dracut/modules.d/90stratis/stratis-rootfs-setup" "$initrd/bin"
     mkdir -p "$initrd/lib/systemd/system"
-    substitute "dracut/90stratis/stratisd-min.service" "$initrd/lib/systemd/system/stratisd-min.service" \
-      --replace /usr "$out" \
+    substitute "$out/lib/dracut/modules.d/90stratis/stratisd-min.service" \
+      "$initrd/lib/systemd/system/stratisd-min.service" \
       --replace mkdir "${coreutils}/bin/mkdir"
     mkdir -p "$initrd/lib/udev/rules.d"
     cp udev/61-stratisd.rules "$initrd/lib/udev/rules.d"
@@ -110,7 +107,9 @@ stdenv.mkDerivation rec {
     rm -r "$out/lib/systemd/system-generators"
   '';
 
-  passthru.tests = nixosTests.stratis;
+  passthru.tests = nixosTests.stratis // {
+    inherit (nixosTests.installer-systemd-stage-1) stratisRoot;
+  };
 
   meta = with lib; {
     description = "Easy to use local storage management for Linux";