Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

15 files changed, 393 insertions, 77 deletions

diff --git a/nixpkgs/pkgs/top-level/all-packages.nix b/nixpkgs/pkgs/top-level/all-packages.nix
index de307f75df0e..0b8906ce8a9d 100644
--- a/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/nixpkgs/pkgs/top-level/all-packages.nix
@@ -104,10 +104,10 @@ with pkgs;
 
   ### Evaluating the entire Nixpkgs naively will fail, make failure fast
   AAAAAASomeThingsFailToEvaluate = throw ''
-    Please be informed that this pseudo-package is not the only part of
-    Nixpkgs that fails to evaluate. You should not evaluate entire Nixpkgs
-    without some special measures to handle failing packages, like those taken
-    by Hydra.
+    Please be informed that this pseudo-package is not the only part
+    of Nixpkgs that fails to evaluate. You should not evaluate
+    entire Nixpkgs without some special measures to handle failing
+    packages, like using pkgs/top-level/release-attrpaths.nix.
   '';
 
   tests = callPackages ../test { };
@@ -116,7 +116,7 @@ with pkgs;
     # We don't want nix-env -q to enter this, because all of these are aliases.
     dontRecurseIntoAttrs (
       import ./pkg-config/defaultPkgConfigPackages.nix pkgs
-    );
+    ) // { __attrsFailEvaluation = true; };
 
   ### Nixpkgs maintainer tools
 
@@ -159,6 +159,7 @@ with pkgs;
       system = stdenv.hostPlatform.system;
       callTest = config: config.test.driver;
     };
+    __attrsFailEvaluation = true;
   };
 
   ### BUILD SUPPORT
@@ -902,7 +903,7 @@ with pkgs;
 
   dockerTools = callPackage ../build-support/docker {
     writePython3 = buildPackages.writers.writePython3;
-  };
+  } // { __attrsFailEvaluation = true; };
 
   fakeNss = callPackage ../build-support/fake-nss { };
 
@@ -2160,7 +2161,7 @@ with pkgs;
   vrrtest = callPackage ../tools/video/vrrtest { };
 
   winbox = callPackage ../tools/admin/winbox {
-    wine = wineWowPackages.staging;
+    wine = wineWowPackages.stable;
   };
 
   wtwitch = callPackage ../tools/video/wtwitch { };
@@ -5304,8 +5305,6 @@ with pkgs;
 
   esptool = callPackage ../tools/misc/esptool { };
 
-  esptool_3 = callPackage ../tools/misc/esptool/3.nix { };
-
   esptool-ck = callPackage ../tools/misc/esptool-ck { };
 
   ephemeralpg = callPackage ../development/tools/database/ephemeralpg { };
@@ -9898,8 +9897,6 @@ with pkgs;
 
   kubergrunt = callPackage ../applications/networking/cluster/kubergrunt { };
 
-  kubo = callPackage ../applications/networking/kubo { };
-
   kubo-migrator-all-fs-repo-migrations = callPackage ../applications/networking/kubo-migrator/all-migrations.nix { };
   kubo-migrator-unwrapped = callPackage ../applications/networking/kubo-migrator/unwrapped.nix { };
   kubo-migrator = callPackage ../applications/networking/kubo-migrator { };
@@ -10095,6 +10092,7 @@ with pkgs;
 
   matrix-appservice-slack = callPackage ../servers/matrix-synapse/matrix-appservice-slack {
     matrix-sdk-crypto-nodejs = matrix-sdk-crypto-nodejs-0_1_0-beta_3;
+    nodejs = nodejs_18;
   };
 
   matrix-appservice-discord = callPackage ../servers/matrix-appservice-discord {
@@ -10346,9 +10344,9 @@ with pkgs;
   inherit (callPackages ../build-support/node/fetch-npm-deps { })
     fetchNpmDeps prefetch-npm-deps;
 
-  nodePackages_latest = dontRecurseIntoAttrs nodejs_latest.pkgs;
+  nodePackages_latest = dontRecurseIntoAttrs nodejs_latest.pkgs // { __attrsFailEvaluation = true; };
 
-  nodePackages = dontRecurseIntoAttrs nodejs.pkgs;
+  nodePackages = dontRecurseIntoAttrs nodejs.pkgs // { __attrsFailEvaluation = true; };
 
   node2nix = nodePackages.node2nix;
 
@@ -16253,7 +16251,8 @@ with pkgs;
      # Prefer native-bignum to avoid linking issues with gmp
      else if stdenv.hostPlatform.isStatic
      then haskell.packages.native-bignum.ghc94
-     else haskell.packages.ghc94);
+     else haskell.packages.ghc94)
+  // { __recurseIntoDerivationForReleaseJobs = true; };
 
   # haskellPackages.ghc is build->host (it exposes the compiler used to build the
   # set, similarly to stdenv.cc), but pkgs.ghc should be host->target to be more
@@ -16834,7 +16833,7 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  ocaml-ng = callPackage ./ocaml-packages.nix { };
+  ocaml-ng = callPackage ./ocaml-packages.nix { } // { __attrsFailEvaluation = true; };
   ocaml = ocamlPackages.ocaml;
 
   ocamlPackages = recurseIntoAttrs ocaml-ng.ocamlPackages;
@@ -17618,8 +17617,9 @@ with pkgs;
   inherit (beam.packages.erlang)
     erlang-ls erlfmt elvis-erlang
     rebar rebar3 rebar3WithPlugins
-    fetchHex beamPackages
+    fetchHex
     lfe lfe_2_1;
+  beamPackages = beam.packages.erlang // { __attrsFailEvaluation = true; };
 
   expr = callPackage ../development/interpreters/expr { };
 
@@ -17901,19 +17901,19 @@ with pkgs;
   # List of extensions with overrides to apply to all Python package sets.
   pythonPackagesExtensions = [ ];
   # Python package sets.
-  python27Packages = python27.pkgs;
-  python38Packages = python38.pkgs;
-  python39Packages = python39.pkgs;
-  python310Packages = recurseIntoAttrs python310.pkgs;
-  python311Packages = recurseIntoAttrs python311.pkgs;
-  python312Packages = python312.pkgs;
-  python313Packages = python313.pkgs;
-  pypyPackages = pypy.pkgs;
-  pypy2Packages = pypy2.pkgs;
-  pypy27Packages = pypy27.pkgs;
-  pypy3Packages = pypy3.pkgs;
-  pypy39Packages = pypy39.pkgs;
-  pypy310Packages = pypy310.pkgs;
+  python27Packages = python27.pkgs // { __attrsFailEvaluation = true; };
+  python38Packages = python38.pkgs // { __attrsFailEvaluation = true; };
+  python39Packages = python39.pkgs // { __attrsFailEvaluation = true; };
+  python310Packages = recurseIntoAttrs python310.pkgs // { pythonPackages = python310.pkgs // { __attrsFailEvaluation = true; }; };
+  python311Packages = recurseIntoAttrs python311.pkgs // { pythonPackages = python311.pkgs // { __attrsFailEvaluation = true; }; };
+  python312Packages = python312.pkgs // { __attrsFailEvaluation = true; };
+  python313Packages = python313.pkgs // { __attrsFailEvaluation = true; };
+  pypyPackages = pypy.pkgs // { __attrsFailEvaluation = true; };
+  pypy2Packages = pypy2.pkgs // { __attrsFailEvaluation = true; };
+  pypy27Packages = pypy27.pkgs // { __attrsFailEvaluation = true; };
+  pypy3Packages = pypy3.pkgs // { __attrsFailEvaluation = true; };
+  pypy39Packages = pypy39.pkgs // { __attrsFailEvaluation = true; };
+  pypy310Packages = pypy310.pkgs // { __attrsFailEvaluation = true; };
 
   py3c = callPackage ../development/libraries/py3c { };
 
@@ -24665,9 +24665,9 @@ with pkgs;
       stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     });
 
-  libsForQt5 = recurseIntoAttrs (import ./qt5-packages.nix {
+  libsForQt5 = (recurseIntoAttrs (import ./qt5-packages.nix {
     inherit lib __splicedPackages makeScopeWithSplicing' generateSplicesForMkScope pkgsHostTarget;
-  });
+  })) // { __recurseIntoDerivationForReleaseJobs = true; };
 
   # plasma5Packages maps to the Qt5 packages set that is used to build the plasma5 desktop
   plasma5Packages = libsForQt5;
@@ -25982,11 +25982,11 @@ with pkgs;
   };
 
   lispPackages = quicklispPackages //
-    (lispPackagesFor (wrapLisp_old sbcl));
+    (lispPackagesFor (wrapLisp_old sbcl)) // { __attrsFailEvaluation = true; };
 
   quicklispPackagesFor = clwrapper: callPackage ../development/lisp-modules-obsolete/quicklisp-to-nix.nix {
     inherit clwrapper;
-  };
+  } // { __attrsFailEvaluation = true; };
   quicklispPackagesClisp = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old clisp));
   quicklispPackagesSBCL = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old sbcl));
   quicklispPackagesECL = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old ecl));
@@ -25996,7 +25996,8 @@ with pkgs;
   quicklispPackages = quicklispPackagesSBCL;
 
   # Alternative lisp-modules implementation
-  lispPackages_new = callPackage ../development/lisp-modules-new-obsolete/lisp-packages.nix {};
+  lispPackages_new = callPackage ../development/lisp-modules-new-obsolete/lisp-packages.nix {}
+  // { __attrsFailEvaluation = true; };
 
   ## End of DEPRECATED
 
@@ -26142,9 +26143,9 @@ with pkgs;
 
   rstudioServerWrapper = rstudioWrapper.override { rstudio = rstudio-server; };
 
-  rPackages = dontRecurseIntoAttrs (callPackage ../development/r-modules {
+  rPackages = (dontRecurseIntoAttrs (callPackage ../development/r-modules {
     overrides = (config.rPackageOverrides or (_: {})) pkgs;
-  });
+  })) // { __attrsFailEvaluation = true; };
 
   ### SERVERS
 
@@ -27842,10 +27843,6 @@ with pkgs;
 
   fwts = callPackage ../os-specific/linux/fwts { };
 
-  gasket = callPackage ../os-specific/linux/gasket {
-    inherit (linuxPackages) kernel;
-  };
-
   gobi_loader = callPackage ../os-specific/linux/gobi_loader { };
 
   libossp_uuid = callPackage ../development/libraries/libossp-uuid { };
@@ -31385,7 +31382,7 @@ with pkgs;
 
   # This alias should live in aliases.nix but that would cause Hydra not to evaluate/build the packages.
   # If you turn this into "real" alias again, please add it to pkgs/top-level/packages-config.nix again too
-  emacsPackages = emacs.pkgs;
+  emacsPackages = emacs.pkgs // { __recurseIntoDerivationForReleaseJobs = true; };
 
   emptty = callPackage ../applications/display-managers/emptty { };
 
@@ -33818,9 +33815,9 @@ with pkgs;
 
   mop = callPackage ../applications/misc/mop { };
 
-  mopidyPackages = callPackages ../applications/audio/mopidy {
+  mopidyPackages = (callPackages ../applications/audio/mopidy {
     python = python3;
-  };
+  }) // { __attrsFailEvaluation = true; };
 
   inherit (mopidyPackages)
     mopidy
@@ -34727,7 +34724,10 @@ with pkgs;
 
   picosnitch = callPackage ../tools/networking/picosnitch { };
 
-  pidginPackages = recurseIntoAttrs (callPackage ../applications/networking/instant-messengers/pidgin/pidgin-plugins { });
+  pidginPackages =
+    let pidgin-plugins =
+          recurseIntoAttrs (callPackage ../applications/networking/instant-messengers/pidgin/pidgin-plugins { });
+    in pidgin-plugins // { pidginPackages = pidgin-plugins.pidginPackages // { __attrsFailEvaluation = true; }; };
 
   inherit (pidginPackages) pidgin;
 
@@ -40436,8 +40436,6 @@ with pkgs;
 
   hjson = with python3Packages; toPythonApplication hjson;
 
-  hjson-go = callPackage ../development/tools/hjson-go { };
-
   epkowa = callPackage ../misc/drivers/epkowa { };
 
   utsushi = callPackage ../misc/drivers/utsushi { };
diff --git a/nixpkgs/pkgs/top-level/beam-packages.nix b/nixpkgs/pkgs/top-level/beam-packages.nix
index ff9d1f62ab1f..62ab2a63ae74 100644
--- a/nixpkgs/pkgs/top-level/beam-packages.nix
+++ b/nixpkgs/pkgs/top-level/beam-packages.nix
@@ -101,4 +101,6 @@ in
     erlang_25 = self.packagesWith self.interpreters.erlang_25;
     erlang_24 = self.packagesWith self.interpreters.erlang_24;
   } // packagesAliases;
+
+  __attrsFailEvaluation = true;
 }
diff --git a/nixpkgs/pkgs/top-level/coq-packages.nix b/nixpkgs/pkgs/top-level/coq-packages.nix
index cf3817a3d7e4..64cbe925b518 100644
--- a/nixpkgs/pkgs/top-level/coq-packages.nix
+++ b/nixpkgs/pkgs/top-level/coq-packages.nix
@@ -8,7 +8,7 @@ let
   mkCoqPackages' = self: coq:
     let callPackage = self.callPackage; in {
       inherit coq lib;
-      coqPackages = self;
+      coqPackages = self // { coqPackages = self.coqPackages // { recurseForDerivations = false; }; };
 
       metaFetch = import ../build-support/coq/meta-fetch/default.nix
         {inherit lib stdenv fetchzip; };
@@ -190,21 +190,23 @@ in rec {
   coq_8_17 = mkCoq "8.17";
   coq_8_18 = mkCoq "8.18";
 
-  coqPackages_8_5 = mkCoqPackages coq_8_5;
-  coqPackages_8_6 = mkCoqPackages coq_8_6;
-  coqPackages_8_7 = mkCoqPackages coq_8_7;
-  coqPackages_8_8 = mkCoqPackages coq_8_8;
-  coqPackages_8_9 = mkCoqPackages coq_8_9;
-  coqPackages_8_10 = mkCoqPackages coq_8_10;
-  coqPackages_8_11 = mkCoqPackages coq_8_11;
-  coqPackages_8_12 = mkCoqPackages coq_8_12;
-  coqPackages_8_13 = mkCoqPackages coq_8_13;
-  coqPackages_8_14 = mkCoqPackages coq_8_14;
-  coqPackages_8_15 = mkCoqPackages coq_8_15;
-  coqPackages_8_16 = mkCoqPackages coq_8_16;
-  coqPackages_8_17 = mkCoqPackages coq_8_17;
-  coqPackages_8_18 = mkCoqPackages coq_8_18;
-  coqPackages = recurseIntoAttrs coqPackages_8_18;
+  coqPackages_8_5 = mkCoqPackages coq_8_5 // { __attrsFailEvaluation = true; };
+  coqPackages_8_6 = mkCoqPackages coq_8_6 // { __attrsFailEvaluation = true; };
+  coqPackages_8_7 = mkCoqPackages coq_8_7 // { __attrsFailEvaluation = true; };
+  coqPackages_8_8 = mkCoqPackages coq_8_8 // { __attrsFailEvaluation = true; };
+  coqPackages_8_9 = mkCoqPackages coq_8_9 // { __attrsFailEvaluation = true; };
+  coqPackages_8_10 = mkCoqPackages coq_8_10 // { __attrsFailEvaluation = true; };
+  coqPackages_8_11 = mkCoqPackages coq_8_11 // { __attrsFailEvaluation = true; };
+  coqPackages_8_12 = mkCoqPackages coq_8_12 // { __attrsFailEvaluation = true; };
+  coqPackages_8_13 = mkCoqPackages coq_8_13 // { __attrsFailEvaluation = true; };
+  coqPackages_8_14 = mkCoqPackages coq_8_14 // { __attrsFailEvaluation = true; };
+  coqPackages_8_15 = mkCoqPackages coq_8_15 // { __attrsFailEvaluation = true; };
+  coqPackages_8_16 = mkCoqPackages coq_8_16 // { __attrsFailEvaluation = true; };
+  coqPackages_8_17 = mkCoqPackages coq_8_17 // { __attrsFailEvaluation = true; };
+  coqPackages_8_18 = mkCoqPackages coq_8_18 // { __attrsFailEvaluation = true; };
+  coqPackages =
+    let cp = recurseIntoAttrs coqPackages_8_18;
+    in cp // { coqPackages = cp.coqPackages // { __attrsFailEvaluation = true; }; } // { __recurseIntoDerivationForReleaseJobs = true; };
   coq = coqPackages.coq;
 
 }
diff --git a/nixpkgs/pkgs/top-level/cuda-packages.nix b/nixpkgs/pkgs/top-level/cuda-packages.nix
index 19ff558afbc7..d474cf852e55 100644
--- a/nixpkgs/pkgs/top-level/cuda-packages.nix
+++ b/nixpkgs/pkgs/top-level/cuda-packages.nix
@@ -26,6 +26,7 @@
   lib,
   newScope,
   pkgs,
+  __attrsFailEvaluation ? true,
 }:
 let
   inherit (lib)
@@ -118,4 +119,4 @@ let
     fixedPoints.extends composedExtension passthruFunction
   );
 in
-cudaPackages
+cudaPackages // { inherit __attrsFailEvaluation; }
diff --git a/nixpkgs/pkgs/top-level/hare-third-party.nix b/nixpkgs/pkgs/top-level/hare-third-party.nix
index 73ffbc0ea790..ac2dc254e50d 100644
--- a/nixpkgs/pkgs/top-level/hare-third-party.nix
+++ b/nixpkgs/pkgs/top-level/hare-third-party.nix
@@ -5,7 +5,7 @@ let
   inherit (self) callPackage;
 in
 {
-  hare-json = callPackage ../development/hare-packages/hare-json { };
 
-  hare-compress = callPackage ../development/hare-third-party/hare-compress {};
+  hare-compress = callPackage ../development/hare-third-party/hare-compress { };
+  hare-json = callPackage ../development/hare-third-party/hare-json { };
 })
diff --git a/nixpkgs/pkgs/top-level/java-packages.nix b/nixpkgs/pkgs/top-level/java-packages.nix
index 88c95457afee..f2c725bfb4c2 100644
--- a/nixpkgs/pkgs/top-level/java-packages.nix
+++ b/nixpkgs/pkgs/top-level/java-packages.nix
@@ -35,6 +35,7 @@ in {
         else package-darwin;
     in {
       inherit package-linux package-darwin;
+      __attrsFailEvaluation = true;
 
       jdk-hotspot = callPackage package.jdk-hotspot {};
       jre-hotspot = callPackage package.jre-hotspot {};
diff --git a/nixpkgs/pkgs/top-level/linux-kernels.nix b/nixpkgs/pkgs/top-level/linux-kernels.nix
index 27496b910444..41177f9d039b 100644
--- a/nixpkgs/pkgs/top-level/linux-kernels.nix
+++ b/nixpkgs/pkgs/top-level/linux-kernels.nix
@@ -348,6 +348,8 @@ in {
 
     fwts-efi-runtime = callPackage ../os-specific/linux/fwts/module.nix { };
 
+    gasket = callPackage ../os-specific/linux/gasket { };
+
     gcadapter-oc-kmod = callPackage ../os-specific/linux/gcadapter-oc-kmod { };
 
     hyperv-daemons = callPackage ../os-specific/linux/hyperv-daemons { };
@@ -398,7 +400,8 @@ in {
 
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
 
-    nvidiaPackages = dontRecurseIntoAttrs (lib.makeExtensible (_: callPackage ../os-specific/linux/nvidia-x11 { }));
+    nvidiaPackages = dontRecurseIntoAttrs (lib.makeExtensible (_: callPackage ../os-specific/linux/nvidia-x11 { }))
+    // { __attrsFailEvaluation = true; };
 
     nvidia_x11             = nvidiaPackages.stable;
     nvidia_x11_beta        = nvidiaPackages.beta;
@@ -589,6 +592,7 @@ in {
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_5 = recurseIntoAttrs (packagesFor kernels.linux_6_5);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
+    __attrsFailEvaluation = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11"; # Added 2022-11-08
     linux_4_14 = throw "linux 4.14 was removed because it will reach its end of life within 23.11"; # Added 2023-10-11
@@ -606,6 +610,7 @@ in {
      linux_rt_5_10 = packagesFor kernels.linux_rt_5_10;
      linux_rt_5_15 = packagesFor kernels.linux_rt_5_15;
      linux_rt_6_1 = packagesFor kernels.linux_rt_6_1;
+     __attrsFailEvaluation = true;
   };
 
   rpiPackages = {
@@ -613,6 +618,7 @@ in {
     linux_rpi2 = packagesFor kernels.linux_rpi2;
     linux_rpi3 = packagesFor kernels.linux_rpi3;
     linux_rpi4 = packagesFor kernels.linux_rpi4;
+     __attrsFailEvaluation = true;
   };
 
   packages = recurseIntoAttrs (vanillaPackages // rtPackages // rpiPackages // {
@@ -641,6 +647,7 @@ in {
     linux_libre = recurseIntoAttrs (packagesFor kernels.linux_libre);
 
     linux_latest_libre = recurseIntoAttrs (packagesFor kernels.linux_latest_libre);
+    __recurseIntoDerivationForReleaseJobs = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
     linux_5_19_hardened = throw "linux 5.19 was removed because it has reached its end of life upstream";
@@ -655,7 +662,7 @@ in {
     linux_mptcp = throw "'linux_mptcp' has been moved to https://github.com/teto/mptcp-flake";
     linux_rt_default = packages.linux_rt_5_4;
     linux_rt_latest = packages.linux_rt_6_1;
-  };
+  } // { __attrsFailEvaluation = true; };
 
   manualConfig = callPackage ../os-specific/linux/kernel/manual-config.nix {};
 
diff --git a/nixpkgs/pkgs/top-level/perl-packages.nix b/nixpkgs/pkgs/top-level/perl-packages.nix
index 3070f6af449f..16ac93193ac3 100644
--- a/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/nixpkgs/pkgs/top-level/perl-packages.nix
@@ -23,7 +23,7 @@ in
 with self; {
 
   inherit perl;
-  perlPackages = self;
+  perlPackages = self // { perlPackages = self.perlPackages // { __attrsFailEvaluation = true; }; };
 
   # Check whether a derivation provides a perl module.
   hasPerlModule = drv: drv ? perlModule ;
diff --git a/nixpkgs/pkgs/top-level/pkg-config/tests.nix b/nixpkgs/pkgs/top-level/pkg-config/tests.nix
index ec1d445c5903..786e2ecc534b 100644
--- a/nixpkgs/pkgs/top-level/pkg-config/tests.nix
+++ b/nixpkgs/pkgs/top-level/pkg-config/tests.nix
@@ -17,5 +17,5 @@ let
   };
 in
 lib.recurseIntoAttrs {
-  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { };
+  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { } // { __recurseIntoDerivationForReleaseJobs = true; };
 }
diff --git a/nixpkgs/pkgs/top-level/python-packages.nix b/nixpkgs/pkgs/top-level/python-packages.nix
index 678c976932c8..3c40cdc0b7c9 100644
--- a/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/nixpkgs/pkgs/top-level/python-packages.nix
@@ -8592,7 +8592,7 @@ self: super: with self; {
 
   openai-triton = callPackage ../development/python-modules/openai-triton {
     llvm = pkgs.openai-triton-llvm;
-    cudaPackages = pkgs.cudaPackages_12_0;
+    cudaPackages = pkgs.cudaPackages_12_1;
   };
 
   openai-triton-cuda = self.openai-triton.override {
@@ -8754,6 +8754,8 @@ self: super: with self; {
 
   orange-widget-base = callPackage ../development/python-modules/orange-widget-base { };
 
+  oras = callPackage ../development/python-modules/oras { };
+
   orderedmultidict = callPackage ../development/python-modules/orderedmultidict { };
 
   ordered-set = callPackage ../development/python-modules/ordered-set { };
diff --git a/nixpkgs/pkgs/top-level/qt5-packages.nix b/nixpkgs/pkgs/top-level/qt5-packages.nix
index 9acaacea24a4..f38a4c1c4907 100644
--- a/nixpkgs/pkgs/top-level/qt5-packages.nix
+++ b/nixpkgs/pkgs/top-level/qt5-packages.nix
@@ -69,7 +69,9 @@ makeScopeWithSplicing' {
     };
   in (lib.makeOverridable mkMaui attrs);
 
-  noExtraAttrs = set: lib.attrsets.removeAttrs set [ "extend" "override" "overrideScope" "overrideScope'" "overrideDerivation" ];
+  noExtraAttrs = set:
+    lib.attrsets.removeAttrs set [ "extend" "override" "overrideScope" "overrideScope'" "overrideDerivation" ]
+    // { __attrsFailEvaluation = true; };
 
 in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGear // mauiPackages // qt5 // {
 
diff --git a/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix b/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix
new file mode 100644
index 000000000000..673b63a5ac34
--- /dev/null
+++ b/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix
@@ -0,0 +1,192 @@
+# This expression will, as efficiently as possible, dump a
+# *superset* of all attrpaths of derivations which might be
+# part of a release on *any* platform.
+#
+# Both this expression and what ofborg uses (release-outpaths.nix)
+# are essentially single-threaded (under the current cppnix
+# implementation).
+#
+# This expression runs much, much, much faster and uses much, much
+# less memory than the ofborg script by skipping the
+# platform-relevance checks.  The ofborg outpaths.nix script takes
+# half an hour on a 3ghz core and peaks at 60gbytes of memory; this
+# expression runs on the same machine in 44 seconds with peak memory
+# usage of 5gbytes.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and run the platform checks separately for each
+# batch, in parallel.
+#
+# To dump the attrnames:
+#
+#   nix-instantiate --eval --strict --json pkgs/top-level/release-attrpaths-superset.nix -A names
+#
+{ lib ? import (path + "/lib")
+, trace ? false
+, enableWarnings ? true
+, checkMeta ? true
+, path ? ./../..
+}:
+let
+
+  # No release package attrpath may have any of these attrnames as
+  # its initial component.
+  #
+  # If you can find a way to remove any of these entries without
+  # causing CI to fail, please do so.
+  #
+  excluded-toplevel-attrs = {
+    # spliced packagesets
+    __splicedPackages = true;
+    pkgsBuildBuild = true;
+    pkgsBuildHost = true;
+    pkgsBuildTarget = true;
+    pkgsHostHost = true;
+    pkgsHostTarget = true;
+    pkgsTargetTarget = true;
+    buildPackages = true;
+    targetPackages = true;
+
+    # cross packagesets
+    pkgsLLVM = true;
+    pkgsMusl = true;
+    pkgsStatic = true;
+    pkgsCross = true;
+    pkgsi686Linux = true;
+  };
+
+  # No release package attrname may have any of these at a component
+  # anywhere in its attrpath.  These are the names of gigantic
+  # top-level attrsets that have leaked into so many sub-packagesets
+  # that it's easier to simply exclude them entirely.
+  #
+  # If you can find a way to remove any of these entries without
+  # causing CI to fail, please do so.
+  #
+  excluded-attrnames-at-any-depth = {
+    lib = true;
+    override = true;
+    __functor = true;
+    __functionArgs = true;
+    newScope = true;
+    scope = true;
+    pkgs = true;
+
+    buildHaskellPackages = true;
+    buildPackages = true;
+    generateOptparseApplicativeCompletions = true;
+
+    callPackage = true;
+    mkDerivation = true;
+    overrideDerivation = true;
+    overrideScope = true;
+    overrideScope' = true;
+
+    # Special case: lib/types.nix leaks into a lot of nixos-related
+    # derivations, and does not eval deeply.
+    type = true;
+  };
+
+  # __attrsFailEvaluation is a temporary workaround to get top-level
+  # eval to succeed (under builtins.tryEval) for the entire
+  # packageset, without deep invasve changes into individual
+  # packages.
+  #
+  # Now that CI has been added, ensuring that top-level eval will
+  # not be broken by any new commits, you should not add any new
+  # occurrences of __attrsFailEvaluation, and should remove them
+  # wherever you are able to (doing so will likely require deep
+  # adjustments within packages).  Once all of the uses of
+  # __attrsFailEvaluation are removed, it will be deleted from the
+  # routine below.  In the meantime,
+  #
+  # The intended semantics are that an attrpath rooted at pkgs is
+  # part of the (unfiltered) release jobset iff all of the following
+  # are true:
+  #
+  # 1. The first component of the attrpath is not in
+  #    `excluded-toplevel-attrs`
+  #
+  # 2. No attrname in the attrpath belongs to the list of forbidden
+  #    attrnames `excluded-attrnames-at-any-depth`
+  #
+  # 3. The attrpath leads to a value for which lib.isDerivation is true
+  #
+  # 4. No proper prefix of the attrpath has __attrsFailEvaluation=true
+  #
+  # 5. Any proper prefix of the attrpath at which lib.isDerivation
+  #    is true also has __recurseIntoDerivationForReleaseJobs=true.
+  #
+  # The last condition is unfortunately necessary because there are
+  # Hydra release jobnames which have proper prefixes which are
+  # attrnames of derivations (!).  We should probably restructure
+  # the job tree so that this is not the case.
+  #
+  justAttrNames = path: value:
+    let
+      attempt =
+        if lib.isDerivation value &&
+           # in some places we have *derivations* with jobsets as subattributes, ugh
+           !(value.__recurseIntoDerivationForReleaseJobs or false) then
+             [ path ]
+
+        # Even wackier case: we have meta.broken==true jobs with
+        # !meta.broken jobs as subattributes with license=unfree, and
+        # check-meta.nix won't throw an "unfree" failure because the
+        # enclosing derivation is marked broken.  Yeah.  Bonkers.
+        # We should just forbid jobsets enclosed by derivations.
+        else if lib.isDerivation value &&
+                !value.meta.available then []
+
+        else if !(lib.isAttrs value) then []
+        else if (value.__attrsFailEvaluation or false) then []
+        else lib.pipe value [
+          (builtins.mapAttrs
+            (name: value:
+              if excluded-attrnames-at-any-depth.${name} or false then [] else
+              (justAttrNames (path ++ [name]) value)))
+          builtins.attrValues
+          builtins.concatLists
+        ];
+
+      seq = builtins.deepSeq attempt attempt;
+      tried = builtins.tryEval seq;
+
+      result =
+        if tried.success
+        then tried.value
+        else if enableWarnings && path != [ "AAAAAASomeThingsFailToEvaluate" ]
+        then lib.warn "tryEval failed at: ${lib.concatStringsSep "." path}" []
+        else [];
+    in
+      if !trace
+      then result
+      else lib.trace "** ${lib.concatStringsSep "." path}" result;
+
+  unfiltered = import ./release-outpaths.nix {
+    inherit checkMeta;
+    attrNamesOnly = true;
+    inherit path;
+  };
+
+  filtered = lib.pipe unfiltered [
+    (pkgs: builtins.removeAttrs pkgs (builtins.attrNames excluded-toplevel-attrs))
+  ];
+
+  paths =
+    [
+      # I am not entirely sure why these three packages end up in
+      # the Hydra jobset.  But they do, and they don't meet the
+      # criteria above, so at the moment they are special-cased.
+      [ "pkgsLLVM" "stdenv" ]
+      [ "pkgsStatic" "stdenv" ]
+      [ "pkgsMusl" "stdenv" ]
+    ] ++ justAttrNames [] filtered;
+
+  names =
+    map (path: (lib.concatStringsSep "." path)) paths;
+
+in
+{
+  inherit paths names;
+}
diff --git a/nixpkgs/pkgs/top-level/release-outpaths.nix b/nixpkgs/pkgs/top-level/release-outpaths.nix
new file mode 100644
index 000000000000..5c433fa542e0
--- /dev/null
+++ b/nixpkgs/pkgs/top-level/release-outpaths.nix
@@ -0,0 +1,87 @@
+#!/usr/bin/env nix-shell
+# When using as a callable script, passing `--argstr path some/path` overrides $PWD.
+#!nix-shell -p nix -i "nix-env -qaP --no-name --out-path --arg checkMeta true -f pkgs/top-level/release-outpaths.nix"
+
+# Vendored from:
+#   https://raw.githubusercontent.com/NixOS/ofborg/74f38efa7ef6f0e8e71ec3bfc675ae4fb57d7491/ofborg/src/outpaths.nix
+{ checkMeta
+, includeBroken ? true  # set this to false to exclude meta.broken packages from the output
+, path ? ./../..
+
+# used by pkgs/top-level/release-attrnames-superset.nix
+, attrNamesOnly ? false
+
+# Set this to `null` to build for builtins.currentSystem only
+, systems ? [
+    "aarch64-linux"
+    "aarch64-darwin"
+    #"i686-linux"  # !!!
+    "x86_64-linux"
+    "x86_64-darwin"
+  ]
+}:
+let
+  lib = import (path + "/lib");
+  hydraJobs = import (path + "/pkgs/top-level/release.nix")
+    # Compromise: accuracy vs. resources needed for evaluation.
+    {
+      inherit attrNamesOnly;
+      supportedSystems =
+        if systems == null
+        then [ builtins.currentSystem ]
+        else systems;
+      nixpkgsArgs = {
+        config = {
+          allowAliases = false;
+          allowBroken = includeBroken;
+          allowUnfree = false;
+          allowInsecurePredicate = x: true;
+          checkMeta = checkMeta;
+
+          handleEvalIssue = reason: errormsg:
+            let
+              fatalErrors = [
+                "unknown-meta"
+                "broken-outputs"
+              ];
+            in
+            if builtins.elem reason fatalErrors
+            then abort errormsg
+            # hydra does not build unfree packages, so tons of them are broken yet not marked meta.broken.
+            else if !includeBroken && builtins.elem reason [ "broken" "unfree" ]
+            then throw "broken"
+            else if builtins.elem reason [ "unsupported" ]
+            then throw "unsupported"
+            else true;
+
+          inHydra = true;
+        };
+      };
+    };
+  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
+
+  # hydraJobs leaves recurseForDerivations as empty attrmaps;
+  # that would break nix-env and we also need to recurse everywhere.
+  tweak = lib.mapAttrs
+    (name: val:
+      if name == "recurseForDerivations" then true
+      else if lib.isAttrs val && val.type or null != "derivation"
+      then recurseIntoAttrs (tweak val)
+      else val
+    );
+
+  # Some of these contain explicit references to platform(s) we want to avoid;
+  # some even (transitively) depend on ~/.nixpkgs/config.nix (!)
+  blacklist = [
+    "tarball"
+    "metrics"
+    "manual"
+    "darwin-tested"
+    "unstable"
+    "stdenvBootstrapTools"
+    "moduleSystem"
+    "lib-tests" # these just confuse the output
+  ];
+
+in
+tweak (builtins.removeAttrs hydraJobs blacklist)
diff --git a/nixpkgs/pkgs/top-level/release-python.nix b/nixpkgs/pkgs/top-level/release-python.nix
index ec5255362bcc..bc54860d45f6 100644
--- a/nixpkgs/pkgs/top-level/release-python.nix
+++ b/nixpkgs/pkgs/top-level/release-python.nix
@@ -29,7 +29,7 @@ let
     let res = builtins.tryEval (
       if isDerivation value then
         value.meta.isBuildPythonPackage or []
-      else if value.recurseForDerivations or false || value.recurseForRelease or false then
+      else if value.recurseForDerivations or false || value.recurseForRelease or false || value.__recurseIntoDerivationForReleaseJobs or false then
         packagePython value
       else
         []);
diff --git a/nixpkgs/pkgs/top-level/release.nix b/nixpkgs/pkgs/top-level/release.nix
index 9b5c60141520..f2b38b4a8964 100644
--- a/nixpkgs/pkgs/top-level/release.nix
+++ b/nixpkgs/pkgs/top-level/release.nix
@@ -37,9 +37,23 @@
       "openssl-1.1.1w"
     ];
   }; }
+
+  # This flag, if set to true, will inhibit the use of `mapTestOn`
+  # and `release-lib.packagePlatforms`.  Generally, it causes the
+  # resulting tree of attributes to *not* have a ".${system}"
+  # suffixed upon every job name like Hydra expects.
+  #
+  # This flag exists mainly for use by
+  # pkgs/top-level/release-attrnames-superset.nix; see that file for
+  # full details.  The exact behavior of this flag may change; it
+  # should be considered an internal implementation detail of
+  # pkgs/top-level/.
+  #
+, attrNamesOnly ? false
 }:
 
-with import ./release-lib.nix { inherit supportedSystems scrubJobs nixpkgsArgs; };
+let release-lib = import ./release-lib.nix { inherit supportedSystems scrubJobs nixpkgsArgs; }; in
+with release-lib;
 
 let
 
@@ -239,9 +253,9 @@ let
   # 'nonPackageAttrs' and jobs pulled in from 'pkgs'.
   # Conflicts usually cause silent job drops like in
   #   https://github.com/NixOS/nixpkgs/pull/182058
-  jobs = lib.attrsets.unionOfDisjoint
-    nonPackageJobs
-    (mapTestOn ((packagePlatforms pkgs) // {
+  jobs = let
+    packagePlatforms = if attrNamesOnly then lib.id else release-lib.packagePlatforms;
+    packageJobs = {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
       # Build selected packages (HLS) for multiple Haskell compilers to rebuild
@@ -275,6 +289,14 @@ let
       darwin = packagePlatforms pkgs.darwin // {
         xcode = {};
       };
-    } ));
+    };
+    mapTestOn-packages =
+      if attrNamesOnly
+      then pkgs // packageJobs
+      else mapTestOn ((packagePlatforms pkgs) // packageJobs);
+  in
+    lib.attrsets.unionOfDisjoint
+      nonPackageJobs
+      mapTestOn-packages;
 
 in jobs