Merge staging-next into staging

2025-02-17 01:24:47 +00:00 · 2023-04-16 12:01:49 +00:00 · 2023-04-16 12:01:49 +00:00 · 2859a56694
commit 2859a56694
parent e789c7976f 0c64e91eab
85 changed files with 330 additions and 3677 deletions
--- a/doc/builders/special/fhs-environments.section.md
+++ b/doc/builders/special/fhs-environments.section.md
@ -1,6 +1,6 @@
-# buildFHSUserEnv {#sec-fhs-environments}
+# buildFHSEnv {#sec-fhs-environments}

-`buildFHSUserEnv` provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root with bound `/nix/store`, so its footprint in terms of disk space needed is quite small. This allows one to run software which is hard or unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries. It uses Linux namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without root user rights requirement. Accepted arguments are:
+`buildFHSEnv` provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root with bound `/nix/store`, so its footprint in terms of disk space needed is quite small. This allows one to run software which is hard or unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries. It uses Linux namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without root user rights requirement. Accepted arguments are:

 - `name`
        Environment name.
@ -26,7 +26,7 @@ One can create a simple environment using a `shell.nix` like that:
 ```nix
 { pkgs ? import <nixpkgs> {} }:

-(pkgs.buildFHSUserEnv {
+(pkgs.buildFHSEnv {
  name = "simple-x11-env";
  targetPkgs = pkgs: (with pkgs;
    [ udev
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12745,6 +12745,13 @@
    githubId = 14829269;
    name = "Ram Kromberg";
  };
+  rampoina = {
+    email = "rampoina@protonmail.com";
+    matrix = "@rampoina:matrix.org";
+    github = "Rampoina";
+    githubId = 5653911;
+    name = "Rampoina";
+  };
  ranfdev = {
    email = "ranfdev@gmail.com";
    name = "Lorenzo Miglietta";
--- a/nixos/doc/manual/configuration/adding-custom-packages.section.md
+++ b/nixos/doc/manual/configuration/adding-custom-packages.section.md
@ -94,6 +94,6 @@ environment.systemPackages = [ pkgs.appimage-run ];
 Then instead of running the AppImage "as-is", run `appimage-run foo.appimage`.

 To make other pre-built executables work on NixOS, you need to package them
-with Nix and special helpers like `autoPatchelfHook` or `buildFHSUserEnv`. See
+with Nix and special helpers like `autoPatchelfHook` or `buildFHSEnv`. See
 the [Nixpkgs manual](https://nixos.org/nixpkgs/manual) for details. This
 is complex and often doing a source build is easier.
--- a/nixos/modules/services/computing/boinc/client.nix
+++ b/nixos/modules/services/computing/boinc/client.nix
@ -6,7 +6,7 @@ let
  cfg = config.services.boinc;
  allowRemoteGuiRpcFlag = optionalString cfg.allowRemoteGuiRpc "--allow_remote_gui_rpc";

-  fhsEnv = pkgs.buildFHSUserEnv {
+  fhsEnv = pkgs.buildFHSEnv {
    name = "boinc-fhs-env";
    targetPkgs = pkgs': [ cfg.package ] ++ cfg.extraEnvPackages;
    runScript = "/bin/boinc_client";
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@ -16,15 +16,16 @@
 , openimajgrabber
 , hwi
 , imagemagick
+, gzip
 }:

 let
  pname = "sparrow";
-  version = "1.7.3";
+  version = "1.7.4";

  src = fetchurl {
    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-x86_64.tar.gz";
-    sha256 = "sha256-/tKct73v0zWAjY4kTllnb/+SB/8ENgVl8Yh/LErKTxY=";
+    sha256 = "08ircrc93gsf3vgqn07gjwmy4bs3jds9rg184pihyymm7g9girfb";
  };

  launcher = writeScript "sparrow" ''
@ -93,7 +94,7 @@ let
  sparrow-modules = stdenv.mkDerivation {
    pname = "sparrow-modules";
    inherit version src;
-    nativeBuildInputs = [ makeWrapper gnugrep openjdk autoPatchelfHook stdenv.cc.cc.lib zlib ];
+    nativeBuildInputs = [ makeWrapper gzip gnugrep openjdk autoPatchelfHook stdenv.cc.cc.lib zlib ];

    buildPhase = ''
      # Extract Sparrow's JIMAGE and generate a list of them.
@ -143,9 +144,9 @@ let

      # Replace the embedded Tor binary (which is in a Tar archive)
      # with one from Nixpkgs.
-      cp ${torWrapper} ./tor
-      tar -cJf tor.tar.xz tor
-      cp tor.tar.xz modules/netlayer.jpms/native/linux/x64/tor.tar.xz
+      gzip -c ${torWrapper}  > tor.gz
+      cp tor.gz modules/kmp.tor.binary.linuxx64/kmptor/linux/x64/tor.gz
+      find modules
    '';

    installPhase = ''
@ -158,7 +159,8 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  inherit pname version src;
+  inherit version src;
+  pname = "sparrow-unwrapped";
  nativeBuildInputs = [ makeWrapper copyDesktopItems ];

  desktopItems = [
--- a/pkgs/applications/blockchains/sparrow/fhsenv.nix
+++ b/pkgs/applications/blockchains/sparrow/fhsenv.nix
@ -1,9 +1,9 @@
 { lib
-, buildFHSUserEnv
+, buildFHSEnv
 , sparrow-unwrapped
 }:

-buildFHSUserEnv {
+buildFHSEnv {
  name = "sparrow";

  runScript = "${sparrow-unwrapped}/bin/sparrow";
--- a/pkgs/applications/blockchains/sparrow/update.sh
+++ b/pkgs/applications/blockchains/sparrow/update.sh
@ -23,4 +23,4 @@ sha256sum -c --ignore-missing manifest.txt
 sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
 popd

-update-source-version sparrow "$version" "$sha256"
+update-source-version sparrow-unwrapped "$version" "$sha256"
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -2,7 +2,7 @@

 { alsa-lib
 , bash
-, buildFHSUserEnv
+, buildFHSEnv
 , cacert
 , coreutils
 , dbus
@ -178,7 +178,7 @@ let
  # Android Studio downloads prebuilt binaries as part of the SDK. These tools
  # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
  # environment is used as a work around for that.
-  fhsEnv = buildFHSUserEnv {
+  fhsEnv = buildFHSEnv {
    name = "${drvName}-fhs-env";
    multiPkgs = pkgs: [
      ncurses5
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -1,4 +1,4 @@
-{ callPackage, makeFontsConf, gnome2, buildFHSUserEnv, tiling_wm ? false }:
+{ callPackage, makeFontsConf, gnome2, buildFHSEnv, tiling_wm ? false }:

 let
  mkStudio = opts: callPackage (import ./common.nix opts) {
@ -6,7 +6,7 @@ let
      fontDirectories = [];
    };
    inherit (gnome2) GConf gnome_vfs;
-    inherit buildFHSUserEnv;
+    inherit buildFHSEnv;
    inherit tiling_wm;
  };
  stableVersion = {
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, buildFHSUserEnv, callPackage, makeDesktopItem, writeScript
+{ stdenv, lib, buildFHSEnvChroot, callPackage, makeDesktopItem, writeScript
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
 , unwrapped ? callPackage ./quartus.nix { inherit supportedDevices; }
 }:
@ -13,7 +13,7 @@ let
    categories = [ "Development" ];
  };
 # I think modelsim_ase/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
-in buildFHSUserEnv rec {
+in buildFHSEnvChroot rec {
  name = "quartus-prime-lite"; # wrapped

  targetPkgs = pkgs: with pkgs; [
@ -44,7 +44,7 @@ in buildFHSUserEnv rec {
    xorg.libXext
    xorg.libXrender
    libudev0-shim
-    libxcrypt
+    libxcrypt-legacy
  ];

  passthru = { inherit unwrapped; };
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -1,7 +1,7 @@
 { stdenv, lib, makeDesktopItem
 , unzip, libsecret, libXScrnSaver, libxshmfence, buildPackages
 , atomEnv, at-spi2-atk, autoPatchelfHook
-, systemd, fontconfig, libdbusmenu, glib, buildFHSUserEnvBubblewrap, wayland
+, systemd, fontconfig, libdbusmenu, glib, buildFHSEnv, wayland

 # Populate passthru.tests
 , tests
@ -150,9 +150,9 @@ let
  # in order to create or update extensions.
  # See: #83288 #91179 #73810 #41189
  #
-  # buildFHSUserEnv allows for users to use the existing vscode
+  # buildFHSEnv allows for users to use the existing vscode
  # extension tooling without significant pain.
-  fhs = { additionalPkgs ? pkgs: [] }: buildFHSUserEnvBubblewrap {
+  fhs = { additionalPkgs ? pkgs: [] }: buildFHSEnv {
    # also determines the name of the wrapped command
    name = executableName;

--- a/pkgs/applications/emulators/duckstation/default.nix
+++ b/pkgs/applications/emulators/duckstation/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation {
  pname = "duckstation";
-  version = "unstable-2023-01-01";
+  version = "unstable-2023-04-14";

  src = fetchFromGitHub {
    owner = "stenzek";
    repo = "duckstation";
-    rev = "06d6447e59f208f21ba42f4df1665b789db13fb7";
-    sha256 = "sha256-DyuQ7J7MVSQHpvPZhMtwqNM8ifjI8UFYQ9SxY5kikBI=";
+    rev = "5fee6f5abee7f3aad65da5523e57896e10e2a53a";
+    sha256 = "sha256-sRs/b4GVXhF3zrOef8DSBKJJGYECUER/nNWZAqv7suA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/brlcad/default.nix
+++ b/pkgs/applications/graphics/brlcad/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "brlcad";
-  version = "7.34.0";
+  version = "7.34.2";

  src = fetchFromGitHub {
    owner = "BRL-CAD";
    repo = pname;
    rev = "refs/tags/rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-Re5gEXlqdPxniaEP13Q0v0O9rt40V5NrxoUpcNBwn7s=";
+    hash = "sha256-oafu255xElEIk8p4yvNyR2maykUfxQui/L5MkicA+JA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/unigine-superposition/default.nix
+++ b/pkgs/applications/graphics/unigine-superposition/default.nix
@ -22,7 +22,7 @@
 , mkDerivation
 , xkeyboard_config
 , fetchurl
-, buildFHSUserEnv
+, buildFHSEnv
 , openal
 , makeDesktopItem
 }:
@ -94,9 +94,9 @@ let
 in

 # We can patch the "/bin/superposition", but "/bin/launcher" checks it for changes.
-# For that we need use a buildFHSUserEnv.
+# For that we need use a buildFHSEnv.

-buildFHSUserEnv {
+buildFHSEnv {
  name = "Superposition";

  targetPkgs = pkgs: [
--- a/pkgs/applications/misc/bottles/fhsenv.nix
+++ b/pkgs/applications/misc/bottles/fhsenv.nix
@ -1,5 +1,5 @@
 { lib
-, buildFHSUserEnvBubblewrap
+, buildFHSEnv
 , symlinkJoin
 , bottles-unwrapped
 , gst_all_1
@ -99,8 +99,8 @@ in
 symlinkJoin {
  name = "bottles";
  paths = [
-    (buildFHSUserEnvBubblewrap (fhsEnv // { name = "bottles"; runScript = "bottles"; }))
-    (buildFHSUserEnvBubblewrap (fhsEnv // { name = "bottles-cli"; runScript = "bottles-cli"; }))
+    (buildFHSEnv (fhsEnv // { name = "bottles"; runScript = "bottles"; }))
+    (buildFHSEnv (fhsEnv // { name = "bottles-cli"; runScript = "bottles-cli"; }))
  ];
  postBuild = ''
    mkdir -p $out/share
--- a/pkgs/applications/misc/houdini/default.nix
+++ b/pkgs/applications/misc/houdini/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv, writeScript, callPackage, buildFHSUserEnv, unwrapped ? callPackage ./runtime.nix {} }:
+{ lib, stdenv, writeScript, callPackage, buildFHSEnv, unwrapped ? callPackage ./runtime.nix {} }:

-buildFHSUserEnv rec {
+buildFHSEnv rec {
  name = "houdini-${unwrapped.version}";

  targetPkgs = pkgs: with pkgs; [
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@ -1,4 +1,4 @@
-{ lib, buildFHSUserEnv, lutris-unwrapped
+{ lib, buildFHSEnv, lutris-unwrapped
 , extraPkgs ? pkgs: [ ]
 , extraLibraries ? pkgs: [ ]
 , steamSupport ? true
@ -13,7 +13,7 @@ let
    libXxf86vm libXinerama libSM libXv libXaw libXi libXcursor libXcomposite
  ];

-in buildFHSUserEnv {
+in buildFHSEnv {
  name = "lutris";

  runScript = "lutris";
--- a/pkgs/applications/misc/pdfstudio/common.nix
+++ b/pkgs/applications/misc/pdfstudio/common.nix
@ -5,7 +5,8 @@
 , version
 , desktopName
 , longDescription
-, buildFHSUserEnv
+, broken ? false
+, buildFHSEnv
 , extraBuildInputs ? [ ]
 , jdk
 , stdenv
@ -68,7 +69,7 @@ let

 in
 # Package with cups in FHS sandbox, because JAVA bin expects "/usr/bin/lpr" for printing.
-buildFHSUserEnv {
+buildFHSEnv {
  name = pname;
  targetPkgs = pkgs: [
    cups
@ -94,6 +95,7 @@ buildFHSUserEnv {
    ];
    license = licenses.unfree;
    platforms = platforms.linux;
+    inherit broken;
    mainProgram = pname;
    maintainers = [ maintainers.pwoelfel ];
  };
--- a/pkgs/applications/misc/pdfstudio/default.nix
+++ b/pkgs/applications/misc/pdfstudio/default.nix
@ -40,6 +40,8 @@ in
      sha256 = "sha256-cc8YjrMsYZqgmwp5+AA+HsqzjxzFcTT/ga31NQz/OWc=";
    };
    jdk = jdk11;
+
+    broken = true; # Bad hash, probably unstable
  };

  pdfstudio2021 = callPackage ./common.nix rec {
@ -66,5 +68,7 @@ in
      (lib.getLib stdenv.cc.cc)  # for libstdc++.so.6 and libgomp.so.1
    ];
    jdk = jdk17;
+
+    broken = true; # URL 404s, probably unstable
  };
 }.${pname}
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, buildFHSUserEnv, makeDesktopItem, makeWrapper, atomEnv, libuuid, at-spi2-atk, icu, openssl, zlib }:
+{ stdenv, lib, fetchurl, buildFHSEnv, makeDesktopItem, makeWrapper, atomEnv, libuuid, at-spi2-atk, icu, openssl, zlib }:
  let
    pname = "sidequest";
    version = "0.10.24";
@ -38,7 +38,7 @@
          "$out/lib/SideQuest/sidequest"
      '';
    };
-  in buildFHSUserEnv {
+  in buildFHSEnv {
    name = "SideQuest";

    passthru = {
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@ -29,6 +29,9 @@ stdenv.mkDerivation {
    # https://github.com/SerenityOS/serenity/issues/17062
    substituteInPlace main.cpp \
      --replace "./SQLServer/SQLServer" "$out/bin/SQLServer"
+    # https://github.com/SerenityOS/serenity/issues/10055
+    substituteInPlace ../Meta/Lagom/CMakeLists.txt \
+      --replace "@rpath" "$out/lib"
  '';

  nativeBuildInputs = [
@ -49,13 +52,7 @@ stdenv.mkDerivation {
    "-DENABLE_UNICODE_DATABASE_DOWNLOAD=false"
  ];

-  env.NIX_CFLAGS_COMPILE = toString ([
-    "-Wno-error"
-  ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
-    # error: use of undeclared identifier 'aligned_alloc'
-    "-include mm_malloc.h"
-    "-Daligned_alloc=_mm_malloc"
-  ]);
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";

  # https://github.com/SerenityOS/serenity/issues/10055
  postInstall = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/networking/cisco-packet-tracer/7.nix
+++ b/pkgs/applications/networking/cisco-packet-tracer/7.nix
@ -1,6 +1,6 @@
 { stdenv
 , lib
-, buildFHSUserEnvBubblewrap
+, buildFHSEnv
 , copyDesktopItems
 , dpkg
 , lndir
@ -40,7 +40,7 @@ let
    mimeTypes = [ "application/x-pkt" "application/x-pka" "application/x-pkz" ];
  };

-  fhs = buildFHSUserEnvBubblewrap {
+  fhs = buildFHSEnv {
    name = "packettracer7";
    runScript = "${ptFiles}/bin/packettracer7";

--- a/pkgs/applications/networking/cisco-packet-tracer/8.nix
+++ b/pkgs/applications/networking/cisco-packet-tracer/8.nix
@ -2,7 +2,7 @@
 , lib
 , alsa-lib
 , autoPatchelfHook
-, buildFHSUserEnvBubblewrap
+, buildFHSEnv
 , copyDesktopItems
 , dbus
 , dpkg
@ -97,7 +97,7 @@ let
    mimeTypes = [ "application/x-pkt" "application/x-pka" "application/x-pkz" ];
  };

-  fhs = buildFHSUserEnvBubblewrap {
+  fhs = buildFHSEnv {
    name = "packettracer8";
    runScript = "${ptFiles}/bin/packettracer";
    targetPkgs = pkgs: [ libudev0-shim ];
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, buildFHSUserEnv, writeScript, makeDesktopItem }:
+{ stdenv, lib, buildFHSEnv, writeScript, makeDesktopItem }:

 let platforms = [ "i686-linux" "x86_64-linux" ]; in

@ -30,7 +30,7 @@ let
  };
 in

-buildFHSUserEnv {
+buildFHSEnv {
  name = "dropbox";

  targetPkgs = pkgs: with pkgs; with xorg; [
--- a/pkgs/applications/networking/expressvpn/default.nix
+++ b/pkgs/applications/networking/expressvpn/default.nix
@ -1,5 +1,5 @@
 { autoPatchelfHook
-, buildFHSUserEnv
+, buildFHSEnv
 , dpkg
 , fetchurl
 , inotify-tools
@ -41,7 +41,7 @@ let
    '';
  };

-  expressvpndFHS = buildFHSUserEnv {
+  expressvpndFHS = buildFHSEnv {
    name = "expressvpnd";

    # When connected, it directly creates/deletes resolv.conf to change the DNS entries.
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "liferea";
-  version = "1.14.4";
+  version = "1.14.5";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "MD1Qx+4/y1wdIllHFPuthLZMLiMdox0FFpVE7tcdYu8=";
+    sha256 = "IkTnjY9rbij0EaNVTWFJagEtX+E5L+G0dZeOz9jGEXc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/pcloud/default.nix
+++ b/pkgs/applications/networking/pcloud/default.nix
@ -3,7 +3,7 @@
 # of applications.
 #
 # What Nix does, simplifying a bit, is that it extracts an AppImage and starts
-# it via buildFHSUserEnv - this is totally fine for majority of apps, but makes
+# it via buildFHSEnv - this is totally fine for majority of apps, but makes
 # it by-design *impossible* to launch SUID wrappers [^1]; in case of pCloud,
 # it's fusermount.
 # (so pCloud starts, but silently fails to mount the FUSE drive.)
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@ -1,6 +1,6 @@
 { stdenv
 , lib
-, buildFHSUserEnv
+, buildFHSEnv
 , fetchurl
 , gsettings-desktop-schemas
 , makeDesktopItem
@ -57,7 +57,7 @@ let
    '';
  };

-  vmwareFHSUserEnv = name: buildFHSUserEnv {
+  vmwareFHSUserEnv = name: buildFHSEnv {
    inherit name;

    runScript = "${vmwareHorizonClientFiles}/bin/${name}_wrapper";
--- a/pkgs/applications/networking/warp/Cargo.lock
+++ b/pkgs/applications/networking/warp/Cargo.lock
--- a/pkgs/applications/networking/warp/default.nix
+++ b/pkgs/applications/networking/warp/default.nix
@ -17,25 +17,24 @@

 stdenv.mkDerivation rec {
  pname = "warp";
-  version = "0.4";
+  version = "0.5.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-c8X0kedfM8DPTEQAbh8cXIfEvxG2cdUD3twVHs0/k7U";
+    hash = "sha256-VtmLWbZXKTv+sjICnaBt2EPbtDwIVZym/PZdL2N7UQo=";
  };

  postPatch = ''
    patchShebangs build-aux
  '';

-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tempfile-3.3.0" = "sha256-zVbGZOEYEmOJGtl5Ko8rYIW9NY16lq5+zMzJ/TSkfsc=";
-    };
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-NT6reZUsieqMTX7HW9QmrjcgBpqxZOUfzht9b7suNeY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/electronics/bitscope/common.nix
+++ b/pkgs/applications/science/electronics/bitscope/common.nix
@ -1,5 +1,5 @@
 { atk
-, buildFHSUserEnv
+, buildFHSEnv
 , cairo
 , dpkg
 , gdk-pixbuf
@ -56,7 +56,7 @@ let
      ${(wrapBinary libs) attrs.toolName}
    '';
  });
-in buildFHSUserEnv {
+in buildFHSEnv {
  name = "${attrs.toolName}-${attrs.version}";
  runScript = "${pkg.outPath}/bin/${attrs.toolName}";
 } // { inherit (pkg) meta name; }
--- a/pkgs/applications/science/misc/foldingathome/client.nix
+++ b/pkgs/applications/science/misc/foldingathome/client.nix
@ -1,6 +1,6 @@
 { lib, stdenv
 , autoPatchelfHook
-, buildFHSUserEnv
+, buildFHSEnv
 , dpkg
 , fetchurl
 , gcc-unwrapped
@ -35,7 +35,7 @@ let
    installPhase = "cp -ar usr $out";
  };
 in
-buildFHSUserEnv {
+buildFHSEnv {
  name = fahclient.name;

  targetPkgs = pkgs': [
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@ -8,7 +8,7 @@
 , addOpenGLRunpath
 , libGLU
 , xorg
-, buildFHSUserEnv
+, buildFHSEnv
 , bash
 , writeText
 , ocl-icd
@ -133,7 +133,7 @@ let
    }
  );
 in
-buildFHSUserEnv {
+buildFHSEnv {
  name = "davinci-resolve";
  targetPkgs = pkgs: with pkgs; [
    librsvg
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dpkg, makeWrapper, buildFHSUserEnv
+{ lib, stdenv, fetchurl, dpkg, makeWrapper, buildFHSEnv
 , gtk3, gdk-pixbuf, cairo, libjpeg_original, glib, pango, libGLU
 , libGL, nvidia_cg_toolkit, zlib, openssl, libuuid , alsa-lib, udev, libjack2
 }:
@ -73,7 +73,7 @@ let
  };

 # Lightworks expects some files in /usr/share/lightworks
-in buildFHSUserEnv {
+in buildFHSEnv {
  name = lightworks.name;

  targetPkgs = pkgs: [
--- a/pkgs/applications/video/webtorrent_desktop/default.nix
+++ b/pkgs/applications/video/webtorrent_desktop/default.nix
@ -2,7 +2,7 @@
 ##  - export ELECTRON_SKIP_BINARY_DOWNLOAD=1
 ##  - jq "del(.scripts.preinstall)" node_modules/shellcheck/package.json | sponge node_modules/shellcheck/package.json
 {
-  lib, stdenv, buildFHSUserEnvBubblewrap, runCommand, writeScript, fetchurl, fetchzip
+  lib, stdenv, buildFHSEnv, runCommand, writeScript, fetchurl, fetchzip
 }:
 let
  pname = "webtorrent-desktop";
@ -20,7 +20,7 @@ runCommand "${pname}-${version}" rec {
    else
      throw "Webtorrent is not currently supported on ${stdenv.hostPlatform.system}";

-  fhs = buildFHSUserEnvBubblewrap rec {
+  fhs = buildFHSEnv rec {
    name = "fhsEnterWebTorrent";
    runScript = "${src}/WebTorrent";
    ## use the trampoline, if you need to shell into the fhsenv
--- a/pkgs/applications/virtualization/podman-compose/default.nix
+++ b/pkgs/applications/virtualization/podman-compose/default.nix
@ -1,14 +1,14 @@
 { lib, buildPythonApplication, fetchFromGitHub, python-dotenv, pyyaml }:

 buildPythonApplication rec {
-  version = "1.0.3";
+  version = "1.0.6";
  pname = "podman-compose";

  src = fetchFromGitHub {
    repo = "podman-compose";
    owner = "containers";
    rev = "v${version}";
-    sha256 = "sha256-Si/O4dx9bqqRp/hTv3WbTXj46OM+PpyPBnQQWUqcZfs=";
+    sha256 = "sha256-TsNM5xORqwWge+UCijKptwbAcIz1uZFN9BuIOl28vIU=";
  };

  propagatedBuildInputs = [ pyyaml python-dotenv ];
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
@ -1,5 +1,5 @@
 { stdenv
-, buildFHSUserEnv
+, buildFHSEnv
 , fetchurl
 , lib
 , zlib
@ -64,7 +64,7 @@ let
    '';
  });

-  vmware-unpack-env = buildFHSUserEnv rec {
+  vmware-unpack-env = buildFHSEnv rec {
    name = "vmware-unpack-env";
    targetPkgs = pkgs: [ zlib ];
  };
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -6,7 +6,7 @@
 , libarchive
 , pv
 , squashfsTools
-, buildFHSUserEnv
+, buildFHSEnv
 , pkgs
 }:

@ -43,7 +43,7 @@ rec {
    extraPkgs,
    meta ? {},
    ...
-  }: buildFHSUserEnv
+  }: buildFHSEnv
    (defaultFhsEnvArgs // {
      inherit name;

--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
--- a/pkgs/build-support/build-fhsenv-chroot/chrootenv/default.nix
+++ b/pkgs/build-support/build-fhsenv-chroot/chrootenv/default.nix
--- a/pkgs/build-support/build-fhsenv-chroot/chrootenv/src/chrootenv.c
+++ b/pkgs/build-support/build-fhsenv-chroot/chrootenv/src/chrootenv.c
--- a/pkgs/build-support/build-fhsenv-chroot/chrootenv/src/meson.build
+++ b/pkgs/build-support/build-fhsenv-chroot/chrootenv/src/meson.build
--- a/pkgs/build-support/build-fhsenv-chroot/default.nix
+++ b/pkgs/build-support/build-fhsenv-chroot/default.nix
--- a/pkgs/build-support/build-fhsenv-chroot/env.nix
+++ b/pkgs/build-support/build-fhsenv-chroot/env.nix
--- a/pkgs/data/icons/colloid-icon-theme/default.nix
+++ b/pkgs/data/icons/colloid-icon-theme/default.nix
@ -18,13 +18,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "default" "purple" "pink" "red"

 stdenvNoCC.mkDerivation rec {
  inherit pname;
-  version = "2023-01-08";
+  version = "2023-03-28";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    hash = "sha256-n4kMOIp7AD5Ue4qY4G3ja/VTyYF7cqhdI0uuk9b6o5c=";
+    hash = "sha256-R7QKxZdcKUeTD6E9gj02Tu5tYv9JyqyH2sCsdOk9zTM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@ -6,7 +6,7 @@
 }:

 { bash
-, buildFHSUserEnv
+, buildFHSEnv
 , cacert
 , git
 , runCommand
@ -100,7 +100,7 @@ let

  # Wrap flutter inside an fhs user env to allow execution of binary,
  # like adb from $ANDROID_HOME or java from android-studio.
-  fhsEnv = buildFHSUserEnv {
+  fhsEnv = buildFHSEnv {
    name = "${drvName}-fhs-env";
    multiPkgs = pkgs: [
      # Flutter only use these certificates
--- a/pkgs/development/embedded/arduino/arduino-cli/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-cli/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, buildGoModule, fetchFromGitHub, buildFHSUserEnv, installShellFiles }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, buildFHSEnv, installShellFiles }:

 let

@ -48,10 +48,10 @@ let

 in
 if stdenv.isLinux then
-# buildFHSUserEnv is needed because the arduino-cli downloads compiler
+# buildFHSEnv is needed because the arduino-cli downloads compiler
 # toolchains from the internet that have their interpreters pointed at
 # /lib64/ld-linux-x86-64.so.2
-  buildFHSUserEnv
+  buildFHSEnv
  {
    inherit (pkg) name meta;

--- a/pkgs/development/embedded/arduino/arduino-core/chrootenv.nix
+++ b/pkgs/development/embedded/arduino/arduino-core/chrootenv.nix
@ -1,8 +1,8 @@
-{ lib, buildFHSUserEnv, arduino-core-unwrapped, withGui ? false, withTeensyduino ? false }:
+{ lib, buildFHSEnv, arduino-core-unwrapped, withGui ? false, withTeensyduino ? false }:
 let
  arduino-unwrapped = arduino-core-unwrapped.override { inherit withGui withTeensyduino; };
 in
-buildFHSUserEnv {
+buildFHSEnv {
  name = "arduino";

  targetPkgs =
--- a/pkgs/development/embedded/platformio/chrootenv.nix
+++ b/pkgs/development/embedded/platformio/chrootenv.nix
@ -1,4 +1,4 @@
-{ lib, buildFHSUserEnv, platformio-core }:
+{ lib, buildFHSEnv, platformio-core }:

 let
  pio-pkgs = pkgs:
@ -19,7 +19,7 @@ let
    ]);

 in
-buildFHSUserEnv {
+buildFHSEnv {
  name = "platformio";

  targetPkgs = pio-pkgs;
--- a/pkgs/development/interpreters/nextflow/default.nix
+++ b/pkgs/development/interpreters/nextflow/default.nix
@ -8,7 +8,7 @@
 , gnused
 , gawk
 , coreutils
-, buildFHSUserEnv
+, buildFHSEnv
 }:

 let
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
 };
 in
 if stdenv.isLinux then
-  buildFHSUserEnv
+  buildFHSEnv
  {
    name = "nextflow";
    targetPkgs = pkgs: [ nextflow ];
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@ -115,7 +115,16 @@ let
      qtvirtualkeyboard = callPackage ./modules/qtvirtualkeyboard.nix { };
      qtwayland = callPackage ./modules/qtwayland.nix { };
      qtwebchannel = callPackage ./modules/qtwebchannel.nix { };
-      qtwebengine = callPackage ./modules/qtwebengine.nix { };
+      qtwebengine = callPackage ./modules/qtwebengine.nix {
+        inherit (darwin) bootstrap_cmds cctools xnu;
+        inherit (darwin.apple_sdk_11_0) libpm libunwind;
+        inherit (darwin.apple_sdk_11_0.libs) sandbox;
+        inherit (darwin.apple_sdk_11_0.frameworks)
+          AGL AVFoundation Accelerate Cocoa CoreLocation CoreML ForceFeedback
+          GameController ImageCaptureCore LocalAuthentication
+          MediaAccessibility MediaPlayer MetalKit Network OpenDirectory Quartz
+          ReplayKit SecurityInterface Vision;
+      };
      qtwebsockets = callPackage ./modules/qtwebsockets.nix { };
      qtwebview = callPackage ./modules/qtwebview.nix {
        inherit (darwin.apple_sdk_11_0.frameworks) WebKit;
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@ -51,8 +51,6 @@
 , systemd
 , pipewire
 , gn
-, cups
-, openbsm
 , runCommand
 , writeScriptBin
 , ffmpeg_4
@ -67,6 +65,36 @@
 , mesa
 , xkeyboard_config
 , enableProprietaryCodecs ? true
+  # darwin
+, clang_14
+, bootstrap_cmds
+, cctools
+, xcbuild
+, AGL
+, AVFoundation
+, Accelerate
+, Cocoa
+, CoreLocation
+, CoreML
+, ForceFeedback
+, GameController
+, ImageCaptureCore
+, LocalAuthentication
+, MediaAccessibility
+, MediaPlayer
+, MetalKit
+, Network
+, OpenDirectory
+, Quartz
+, ReplayKit
+, SecurityInterface
+, Vision
+, openbsm
+, libunwind
+, cups
+, libpm
+, sandbox
+, xnu
 }:

 qtModule {
@ -84,6 +112,11 @@ qtModule {
    which
    gn
    nodejs
+  ] ++ lib.optionals stdenv.isDarwin [
+    clang_14
+    bootstrap_cmds
+    cctools
+    xcbuild
  ];
  doCheck = true;
  outputs = [ "out" "dev" ];
@ -125,6 +158,14 @@ qtModule {

    substituteInPlace src/3rdparty/chromium/ui/events/ozone/layout/xkb/xkb_keyboard_layout_engine.cc \
      --replace "/usr/share/X11/xkb" "${xkeyboard_config}/share/X11/xkb"
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure.cmake \
+      --replace "AppleClang" "Clang"
+    substituteInPlace cmake/Functions.cmake \
+      --replace "/usr/bin/xcrun" "${xcbuild}/bin/xcrun"
+    substituteInPlace src/3rdparty/chromium/third_party/crashpad/crashpad/util/BUILD.gn \
+      --replace "\$sysroot/usr" "${xnu}"
  '';

  cmakeFlags = [
@ -149,6 +190,8 @@ qtModule {
    "-DQT_FEATURE_webengine_webrtc_pipewire=ON"
  ] ++ lib.optionals enableProprietaryCodecs [
    "-DQT_FEATURE_webengine_proprietary_codecs=ON"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}"
  ];

  propagatedBuildInputs = [
@ -218,10 +261,36 @@ qtModule {

    libkrb5
    mesa
+  ] ++ lib.optionals stdenv.isDarwin [
+    AGL
+    AVFoundation
+    Accelerate
+    Cocoa
+    CoreLocation
+    CoreML
+    ForceFeedback
+    GameController
+    ImageCaptureCore
+    LocalAuthentication
+    MediaAccessibility
+    MediaPlayer
+    MetalKit
+    Network
+    OpenDirectory
+    Quartz
+    ReplayKit
+    SecurityInterface
+    Vision
+
+    openbsm
+    libunwind
  ];

  buildInputs = [
    cups
+  ] ++ lib.optionals stdenv.isDarwin [
+    libpm
+    sandbox
  ];

  requiredSystemFeatures = [ "big-parallel" ];
--- a/pkgs/development/libraries/symengine/default.nix
+++ b/pkgs/development/libraries/symengine/default.nix
@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
    "-DWITH_SYMENGINE_THREAD_SAFE=yes"
    "-DWITH_MPC=yes"
    "-DBUILD_FOR_DISTRIBUTION=yes"
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # error: unrecognized instruction mnemonic, did you mean: bit, cnt, hint, ins, not?
+    "-DBUILD_TESTS=OFF"
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/bisect_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
@ -2,23 +2,18 @@

 buildDunePackage rec {
  pname = "bisect_ppx";
-  version = "2.8.1";
+  version = "2.8.2";

  src = fetchFromGitHub {
    owner = "aantron";
    repo = "bisect_ppx";
    rev = version;
-    sha256 = "sha256-pOeeSxzUF1jXQjA71atSZALdgQ2NB9qpKo5iaDnPwhQ=";
+    hash = "sha256-Uc5ZYL6tORcCCvCe9UmOnBF68FqWpQ4bc48fTQwnfis=";
  };

-  patches = lib.optionals (lib.versionAtLeast ppxlib.version "0.26.0") [
-    # Ppxlib >= 0.26.0 compatibility
+  patches = [
+    # Ppxlib >= 0.28.0 compatibility
    # remove when a new version is released
-    (fetchpatch {
-      name = "${pname}-${version}-ppxlib-0.26-compatibility.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/aantron/bisect_ppx/pull/400.patch";
-      sha256 = "sha256-WAn6+d6pMUr79LVugOENuh9s0gbVEcTg0rxXMz1P3ak=";
-    })
    (fetchpatch {
      name = "${pname}-${version}-ppxlib-0.28-compatibility.patch";
      url = "https://github.com/anmonteiro/bisect_ppx/commit/cc442a08e3a2e0e18deb48f3a696076ac0986728.patch";
@ -26,7 +21,8 @@ buildDunePackage rec {
    })
  ];

-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.11";
+  duneVersion = "3";

  buildInputs = [
    cmdliner
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@ -9,6 +9,7 @@
 , numpy
 , protobuf
 , pyarrow
+, Security
 }:

 let
@ -53,7 +54,7 @@ buildPythonPackage rec {
    maturinBuildHook
  ];

-  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];

  propagatedBuildInputs = [ pyarrow ];

--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@ -94,7 +94,7 @@ buildPythonPackage rec {

  # no tests in PyPI dist
  # run into https://stackoverflow.com/questions/51203641/attributeerror-module-alembic-context-has-no-attribute-config
-  # also, tests use conda so can't run on NixOS without buildFHSUserEnv
+  # also, tests use conda so can't run on NixOS without buildFHSEnv
  doCheck = false;

  meta = with lib; {
--- a/pkgs/development/tools/electron-fiddle/default.nix
+++ b/pkgs/development/tools/electron-fiddle/default.nix
@ -1,4 +1,4 @@
-{ buildFHSUserEnv
+{ buildFHSEnv
 , electron_22
 , fetchFromGitHub
 , fetchYarnDeps
@ -86,7 +86,7 @@ let
  };

 in
-buildFHSUserEnv {
+buildFHSEnv {
  name = "electron-fiddle";
  runScript = "${electron}/bin/electron ${unwrapped}/lib/electron-fiddle/resources/app.asar";

--- a/pkgs/development/tools/hover/default.nix
+++ b/pkgs/development/tools/hover/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildGoModule
-, buildFHSUserEnv
+, buildFHSEnv
 , binutils
 , dejavu_fonts
 , pkg-config
@ -84,7 +84,7 @@ let
  };

 in
-buildFHSUserEnv rec {
+buildFHSEnv rec {
  name = pname;
  targetPkgs = pkgs: [
    binutils
--- a/pkgs/development/tools/language-servers/verible/default.nix
+++ b/pkgs/development/tools/language-servers/verible/default.nix
@ -17,8 +17,8 @@ buildBazelPackage rec {
  # These environment variables are read in bazel/build-version.py to create
  # a build string shown in the tools --version output.
  # If env variables not set, it would attempt to extract it from .git/.
-  GIT_DATE = "2023-02-02";
-  GIT_VERSION = "v0.0-2821-gb2180bfa";
+  GIT_DATE = "2023-04-14";
+  GIT_VERSION = "v0.0-3179-g525ffaf7";

  # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
  version = builtins.concatStringsSep "." (lib.take 3 (lib.drop 1 (builtins.splitVersion GIT_VERSION)));
@ -27,7 +27,7 @@ buildBazelPackage rec {
    owner = "chipsalliance";
    repo = "verible";
    rev = "${GIT_VERSION}";
-    sha256 = "sha256-etcimvInhebH2zRPyZnWUq6m3VnCq44w32GJrIacULo=";
+    sha256 = "sha256-IXS8yeyryBNpPkCpMcOUsdIlKo447d0a8aZKroFJOzM=";
  };

  patches = [
@ -49,8 +49,8 @@ buildBazelPackage rec {
    # of the output derivation ? Is there a more robust way to do this ?
    # (Hashes extracted from the ofborg build logs)
    sha256 = {
-      aarch64-linux = "sha256-dYJoae3+u+gpULHS8nteFzzL974cVJ+cJzeG/Dz2HaQ=";
-      x86_64-linux = "sha256-Jd99+nhqgZ2Gwd78eyXfnSSfbl8C3hoWkiUnzJG1jqM=";
+      aarch64-linux = "sha256-BrJyFeq3BB4sHIXMMxRIaYV+VJAfTs2bvK7pnw6faBY=";
+      x86_64-linux = "sha256-G6tqHWeQBi2Ph3IDFNu2sp+UU2BO93+lcyJ+kvpuRJo=";
    }.${system} or (throw "No hash for system: ${system}");
  };

--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dpkg, makeWrapper, buildFHSUserEnv
+{ lib, stdenv, fetchurl, dpkg, makeWrapper, buildFHSEnv
 , extraPkgs ? pkgs: [ ]
 , extraLibs ? pkgs: [ ]
 }:
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    makeWrapper
  ];

-  fhsEnv = buildFHSUserEnv {
+  fhsEnv = buildFHSEnv {
    name = "${pname}-fhs-env";
    runScript = "";

--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, lib, buildFHSUserEnv, appimageTools, writeShellScript, anki, undmg, zstd, commandLineArgs ? [] }:
+{ fetchurl, stdenv, lib, buildFHSEnv, appimageTools, writeShellScript, anki, undmg, zstd, commandLineArgs ? [] }:

 let
  pname = "anki-bin";
@ -50,7 +50,7 @@ let

  passthru = { inherit sources; };

-  fhsUserEnvAnki = buildFHSUserEnv (appimageTools.defaultFhsEnvArgs // {
+  fhsEnvAnki = buildFHSEnv (appimageTools.defaultFhsEnvArgs // {
    inherit pname version;
    name = null; # Appimage sets it to "appimage-env"

@ -75,7 +75,7 @@ let
  });
 in

-if stdenv.isLinux then fhsUserEnvAnki
+if stdenv.isLinux then fhsEnvAnki
 else stdenv.mkDerivation {
  inherit pname version passthru;

--- a/pkgs/games/clonehero/fhs-wrapper.nix
+++ b/pkgs/games/clonehero/fhs-wrapper.nix
@ -1,6 +1,6 @@
 { clonehero-unwrapped
 , makeDesktopItem
-, buildFHSUserEnv
+, buildFHSEnv
 , liberation_ttf
 , callPackage
 }:
@ -16,7 +16,7 @@ let
    categories = [ "Game" ];
  };
 in
-buildFHSUserEnv {
+buildFHSEnv {
  inherit name;
  inherit (clonehero-unwrapped) meta;

--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@ -1,11 +1,11 @@
 { lib
-, buildFHSUserEnv
+, buildFHSEnv
 , heroic-unwrapped
 , extraPkgs ? pkgs: [ ]
 , extraLibraries ? pkgs: [ ]
 }:

-buildFHSUserEnv {
+buildFHSEnv {
  name = "heroic";

  runScript = "heroic";
--- a/pkgs/games/hex-a-hop/default.nix
+++ b/pkgs/games/hex-a-hop/default.nix
@ -0,0 +1,45 @@
+{ lib, stdenv, fetchurl, fetchzip, SDL, SDL_mixer, SDL_ttf }:
+
+stdenv.mkDerivation rec {
+  pname = "hex-a-hop";
+  version = "1.1.0";
+
+  src = fetchzip {
+    url = "https://downloads.sourceforge.net/project/hexahop/${version}/hex-a-hop-${version}.tar.gz";
+    sha256 = "sha256-fBSvNtgNR0aNofbvoYpM1e8ww4ARlXIvrQUvJqVGLlY=";
+  };
+
+  icon = fetchurl {
+    # Fetched from dfa365a90be5c52ef21235a9e90a865b04da3ad4, remove in the next version when the file is included
+    url = "https://sourceforge.net/p/hexahop/code/ci/dfa365a90be5c52ef21235a9e90a865b04da3ad4/tree/data/hex-a-hop.png?format=raw";
+    sha256 = "sha256-Vh/1wwRmC2eSD/+mk1Oqt7EX4a4k++nUAbWQD2P2hNA=";
+  };
+
+  desktop = fetchurl {
+    # Fetched from e67385078e4f248a3877ee1066613d231c0d0eee, remove in the next version when the file is included
+    url = "https://sourceforge.net/p/hexahop/code/ci/e67385078e4f248a3877ee1066613d231c0d0eee/tree/data/hex-a-hop.desktop?format=raw";
+    sha256 = "sha256-j6gKRq+8b1NDwP1WcCaScfmwNxAl78CfK6pemROrRak=";
+  };
+
+  buildInputs = [ SDL SDL_mixer SDL_ttf ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postFixup = ''
+    install -Dm644 ${icon} $out/share/icons/${pname}.png
+    install -Dm644 ${desktop} $out/share/applications/${pname}.desktop
+  '';
+
+  meta = {
+    description = "A puzzle game based on hexagonal tiles";
+    homepage = "http://hexahop.sourceforge.net";
+    license = with lib.licenses; [
+      gpl2Plus # Main code
+      cc-by-30 # Assets
+      lgpl2Plus # i18n
+      lgpl3Plus # source files from Lips of Suna
+    ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ rampoina ];
+  };
+}
--- a/pkgs/games/left4gore/default.nix
+++ b/pkgs/games/left4gore/default.nix
@ -1,4 +1,4 @@
-{ stdenvNoCC, lib, fetchurl, buildFHSUserEnv }:
+{ stdenvNoCC, lib, fetchurl, buildFHSEnv }:

 let
  version = "2.3";
@ -20,7 +20,7 @@ let
  };

  # FHS env, as patchelf will not work
-  env = buildFHSUserEnv {
+  env = buildFHSEnv {
    name = "left4gore-env-${version}";
    targetPkgs = _: [ left4gore-unwrapped ];
    runScript = "left4gore";
--- a/pkgs/games/runescape-launcher/default.nix
+++ b/pkgs/games/runescape-launcher/default.nix
@ -1,7 +1,7 @@
 { stdenv
 , lib
 , autoPatchelfHook
-, buildFHSUserEnv
+, buildFHSEnv
 , cairo
 , dpkg
 , fetchurl
@ -109,10 +109,10 @@ in

  /*
  * We can patch the runescape launcher, but it downloads a client at runtime and checks it for changes.
-  * For that we need use a buildFHSUserEnv.
+  * For that we need use a buildFHSEnv.
  * FHS simulates a classic linux shell
  */
-  buildFHSUserEnv {
+  buildFHSEnv {
    name = "RuneScape";
    targetPkgs = pkgs: [
      runescape
--- a/pkgs/games/shticker-book-unwritten/default.nix
+++ b/pkgs/games/shticker-book-unwritten/default.nix
@ -1,9 +1,9 @@
-{ buildFHSUserEnv, callPackage, lib }:
+{ buildFHSEnv, callPackage, lib }:
 let

  shticker-book-unwritten-unwrapped = callPackage ./unwrapped.nix { };

-in buildFHSUserEnv {
+in buildFHSEnv {
  name = "shticker_book_unwritten";
  targetPkgs = pkgs: with pkgs; [
      alsa-lib
--- a/pkgs/games/steam/default.nix
+++ b/pkgs/games/steam/default.nix
@ -1,5 +1,5 @@
 { makeScopeWithSplicing, generateSplicesForMkScope
-, stdenv, buildFHSUserEnv, pkgsi686Linux
+, stdenv, buildFHSEnv, pkgsi686Linux
 }:

 let
@ -19,7 +19,7 @@ let
        if self.steamArch == "amd64"
        then pkgsi686Linux.steamPackages.steam-runtime-wrapped
        else null;
-      inherit buildFHSUserEnv;
+      inherit buildFHSEnv;
    };
    steam-fhsenv-small = steam-fhsenv.override { withGameSpecificLibraries = false; };
    steamcmd = callPackage ./steamcmd.nix { };
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, writeShellScript, buildFHSUserEnv, steam, glxinfo-i686
+{ lib, stdenv, writeShellScript, buildFHSEnv, steam, glxinfo-i686
 , steam-runtime-wrapped, steam-runtime-wrapped-i686 ? null
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
@ -55,7 +55,7 @@ let

  envScript = lib.toShellVars extraEnv;

-in buildFHSUserEnv rec {
+in buildFHSEnv rec {
  name = "steam";

  targetPkgs = pkgs: with pkgs; [
@ -270,7 +270,7 @@ in buildFHSUserEnv rec {
  # breaks the ability for application to reference shared memory.
  unsharePid = false;

-  passthru.run = buildFHSUserEnv {
+  passthru.run = buildFHSEnv {
    name = "steam-run";

    targetPkgs = commonTargetPkgs;
--- a/pkgs/games/unvanquished/default.nix
+++ b/pkgs/games/unvanquished/default.nix
@ -4,7 +4,7 @@
 , fetchFromGitHub
 , fetchpatch
 , SDL2
-, buildFHSUserEnv
+, buildFHSEnv
 , cmake
 , copyDesktopItems
 , curl
@ -95,7 +95,7 @@ let
    '';
  };

-  fhsEnv = buildFHSUserEnv {
+  fhsEnv = buildFHSEnv {
    name = "unvanquished-fhs-wrapper";

    targetPkgs = pkgs: [ libstdcpp-preload-for-unvanquished-nacl ];
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libnl, iptables }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, libnl, iptables }:

 let
  sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
@ -10,6 +10,11 @@ stdenv.mkDerivation {

  src = sourceAttrs.src;

+  patches = [ (fetchpatch {
+    url = "https://github.com/NICMx/Jool/commit/490ddb0933061cab3c2a7952dffc61789deed565.patch";
+    hash = "sha256-1dpMth0ocPHujlk+96St1a63RipcWiL/CdmSz4O87Lg=";
+  }) ];
+
  outputs = [
    "out"
    "man"
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@ -3,14 +3,14 @@
 let
  # These names are how they are designated in https://xanmod.org.
  ltsVariant = {
-    version = "6.1.23";
-    hash = "sha256-yKbePeImBpDLXfexvGJdghSBr3j/oFKXeMuBAOtDqJ8=";
+    version = "6.1.24";
+    hash = "sha256-mLhuyASE/3kv5MD1v5pwHDkL0m7bTaRuAitG3junRyU=";
    variant = "lts";
  };

  mainVariant = {
-    version = "6.2.10";
-    hash = "sha256-zy6mKpoOu9YmGI6a8ZWjV761m+AGlTaWEzpL1QloCk8=";
+    version = "6.2.11";
+    hash = "sha256-rwFlSv5SUwhr8U4mvOGCMKYuU5xVKC7UYRemf7DKwr0=";
    variant = "main";
  };

--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "redis_exporter";
-  version = "1.48.0";
+  version = "1.50.0";

  src = fetchFromGitHub {
    owner = "oliver006";
    repo = "redis_exporter";
    rev = "v${version}";
-    sha256 = "sha256-hBkekoVwNuRDGhpvbW57eR+UUMkntdEcHJAVQbwk7NE=";
+    sha256 = "sha256-FP5X+2OFEFUJWtMKbVgcCkNSV3BtQyMVsXGD6dn3mjY=";
  };

  vendorHash = "sha256-Owfxy7WkucQ6BM8yjnZg9/8CgopGTtbQTTUuxoT3RRE=";
--- a/pkgs/servers/onlyoffice-documentserver/default.nix
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, buildFHSUserEnvBubblewrap
+, buildFHSEnv
 , corefonts
 , dejavu_fonts
 , dpkg
@ -57,7 +57,7 @@ let
    dontStrip = true;

    passthru = {
-      fhs = buildFHSUserEnvBubblewrap {
+      fhs = buildFHSEnv {
        name = "onlyoffice-wrapper";

        targetPkgs = pkgs: [
--- a/pkgs/servers/plex/default.nix
+++ b/pkgs/servers/plex/default.nix
@ -1,6 +1,6 @@
 # The actual Plex package that we run is a FHS userenv of the "raw" package.
 { stdenv
-, buildFHSUserEnvBubblewrap
+, buildFHSEnv
 , writeScript
 , plexRaw

@ -9,7 +9,7 @@
 , dataDir ? "/var/lib/plex"
 }:

-buildFHSUserEnvBubblewrap {
+buildFHSEnv {
  name = "plexmediaserver";

  inherit (plexRaw) meta;
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@ -2,7 +2,7 @@

 buildPythonApplication rec {
  pname = "Tautulli";
-  version = "2.12.2";
+  version = "2.12.3";
  format = "other";

  pythonPath = [ setuptools ];
@ -12,7 +12,7 @@ buildPythonApplication rec {
    owner = "Tautulli";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-d2JGVmUQQMlwoEg3hsPB3jgUrUpui5Zsdf9Eq61TyZI=";
+    sha256 = "sha256-UENYnXEdrKlU+gUmGdw46jslN8B5qWPDIFU03Z7aMps=";
  };

  installPhase = ''
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@ -13,13 +13,13 @@ in

 stdenv.mkDerivation rec {
  pname = "ibus-typing-booster";
-  version = "2.20.0";
+  version = "2.22.3";

  src = fetchFromGitHub {
    owner = "mike-fabian";
    repo = "ibus-typing-booster";
    rev = version;
-    hash = "sha256-evKCKPddQ4yRgI0NDOk6iEkS4910cYhLTvicLxJEbxE=";
+    hash = "sha256-C5WF3yS2TLPnDT+gQljt2KHYB5TqkFkLvb4XZHFKz50=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, jdk, buildFHSUserEnv, unzip, makeDesktopItem }:
+{ lib, fetchurl, jdk, buildFHSEnv, unzip, makeDesktopItem }:
 let
  version = "2023.2.4";

@ -23,7 +23,7 @@ let
  };

 in
-buildFHSUserEnv {
+buildFHSEnv {
  inherit name;

  runScript = "${jdk}/bin/java -jar ${src}";
--- a/pkgs/tools/package-management/appimage-run/default.nix
+++ b/pkgs/tools/package-management/appimage-run/default.nix
@ -1,4 +1,4 @@
-{ appimageTools, buildFHSUserEnv, makeDesktopItem, extraPkgs ? pkgs: [], appimage-run-tests ? null }:
+{ appimageTools, buildFHSEnv, makeDesktopItem, extraPkgs ? pkgs: [], appimage-run-tests ? null }:

 let
  name = "appimage-run";
@ -14,7 +14,7 @@ let
    mimeTypes = ["application/vnd.appimage" "application/x-iso9660-appimage"];
    categories = ["PackageManager" "Utility"];
  };
-in buildFHSUserEnv (fhsArgs // {
+in buildFHSEnv (fhsArgs // {
  inherit name;

  targetPkgs = pkgs: [ appimageTools.appimage-exec ]
--- a/pkgs/tools/package-management/conda/default.nix
+++ b/pkgs/tools/package-management/conda/default.nix
@ -3,7 +3,7 @@
 , fetchurl
 , runCommand
 , makeWrapper
-, buildFHSUserEnv
+, buildFHSEnv
 , libselinux
 , libarchive
 , libGL
@ -63,7 +63,7 @@ let
            --prefix "LD_LIBRARY_PATH" : "${libPath}"
        '');
 in
-  buildFHSUserEnv {
+  buildFHSEnv {
    name = "conda-shell";
    targetPkgs = pkgs: (builtins.concatLists [ [ conda ] condaDeps extraPkgs]);
    profile = ''
--- a/pkgs/tools/security/beyond-identity/default.nix
+++ b/pkgs/tools/security/beyond-identity/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dpkg, buildFHSUserEnv
+{ lib, stdenv, fetchurl, dpkg, buildFHSEnv
 , glibc, glib, openssl, tpm2-tss
 , gtk3, gnome, polkit, polkit_gnome
 }:
@ -70,7 +70,7 @@ let
    '';
  };
 # /usr/bin/pkcheck is hardcoded in binary - we need FHS
-in buildFHSUserEnv {
+in buildFHSEnv {
   inherit meta;
   name = pname;

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -163,6 +163,10 @@ mapAliases ({
  bud = throw "bud has been removed: abandoned by upstream"; # Added 2022-03-14
  inherit (libsForQt5.mauiPackages) buho; # added 2022-05-17
  buttersink = throw "buttersink has been removed: abandoned by upstream"; # Added 2022-04-05
+  # Shorter names; keep the longer name for back-compat. Added 2023-04-11
+  buildFHSUserEnv = buildFHSEnv;
+  buildFHSUserEnvChroot = buildFHSEnvChroot;
+  buildFHSUserEnvBubblewrap = buildFHSEnvBubblewrap;

  # bitwarden_rs renamed to vaultwarden with release 1.21.0 (2021-04-30)
  bitwarden_rs = vaultwarden;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -194,9 +194,7 @@ with pkgs;

  appflowy = callPackage ../applications/office/appflowy { };

-  appimageTools = callPackage ../build-support/appimage {
-    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-  };
+  appimageTools = callPackage ../build-support/appimage { };

  appindicator-sharp = callPackage ../development/libraries/appindicator-sharp { };

@ -373,10 +371,9 @@ with pkgs;

  buildEnv = callPackage ../build-support/buildenv { }; # not actually a package

-  # TODO: eventually migrate everything to buildFHSUserEnvBubblewrap
-  buildFHSUserEnv = buildFHSUserEnvChroot;
-  buildFHSUserEnvChroot = callPackage ../build-support/build-fhs-userenv { };
-  buildFHSUserEnvBubblewrap = callPackage ../build-support/build-fhs-userenv-bubblewrap { };
+  buildFHSEnv = buildFHSEnvBubblewrap;
+  buildFHSEnvChroot = callPackage ../build-support/build-fhsenv-chroot { }; # Deprecated; use buildFHSEnv/buildFHSEnvBubblewrap
+  buildFHSEnvBubblewrap = callPackage ../build-support/build-fhsenv-bubblewrap { };

  buildMaven = callPackage ../build-support/build-maven.nix { };

@ -12342,9 +12339,7 @@ with pkgs;
    openjdk = openjdk.override { enableJavaFX = true; };
  };

-  sparrow = callPackage ../applications/blockchains/sparrow/fhsenv.nix {
-    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-  };
+  sparrow = callPackage ../applications/blockchains/sparrow/fhsenv.nix { };

  sparsehash = callPackage ../development/libraries/sparsehash { };

@ -16437,12 +16432,7 @@ with pkgs;

  z88dk = callPackage ../development/compilers/z88dk { };

-  zulip = callPackage ../applications/networking/instant-messengers/zulip {
-    # Bubblewrap breaks zulip, see https://github.com/NixOS/nixpkgs/pull/97264#issuecomment-704454645
-    appimageTools = pkgs.appimageTools.override {
-      buildFHSUserEnv = pkgs.buildFHSUserEnv;
-    };
-  };
+  zulip = callPackage ../applications/networking/instant-messengers/zulip { };

  zulip-term = callPackage ../applications/networking/instant-messengers/zulip-term { };

@ -28802,9 +28792,7 @@ with pkgs;
  ams-lv2 = callPackage ../applications/audio/ams-lv2 { };

  androidStudioPackages = recurseIntoAttrs
-    (callPackage ../applications/editors/android-studio {
-      buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-    });
+    (callPackage ../applications/editors/android-studio { });
  android-studio = androidStudioPackages.stable;

  animbar = callPackage ../applications/graphics/animbar { };
@ -30725,6 +30713,8 @@ with pkgs;

  herbstluftwm = callPackage ../applications/window-managers/herbstluftwm { };

+  hex-a-hop = callPackage ../games/hex-a-hop { };
+
  hexchat = callPackage ../applications/networking/irc/hexchat { };

  hexcurse = callPackage ../applications/editors/hexcurse { };
@ -31578,7 +31568,7 @@ with pkgs;
  ladspa-sdk = callPackage ../applications/audio/ladspa-sdk { };

  ladybird = qt6Packages.callPackage ../applications/networking/browsers/ladybird {
-    stdenv = if stdenv.isDarwin then llvmPackages_14.stdenv else stdenv;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.clang14Stdenv else stdenv;
  };

  lazpaint = callPackage ../applications/graphics/lazpaint { };
@ -31771,9 +31761,7 @@ with pkgs;
  luppp = callPackage ../applications/audio/luppp { };

  lutris-unwrapped = python3.pkgs.callPackage ../applications/misc/lutris { };
-  lutris = callPackage ../applications/misc/lutris/fhsenv.nix {
-    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-  };
+  lutris = callPackage ../applications/misc/lutris/fhsenv.nix { };
  lutris-free = lutris.override {
    steamSupport = false;
  };
@ -35538,9 +35526,7 @@ with pkgs;

  heroic-unwrapped = callPackage ../games/heroic { };

-  heroic = callPackage ../games/heroic/fhsenv.nix {
-    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-  };
+  heroic = callPackage ../games/heroic/fhsenv.nix { };

  julius = callPackage ../games/julius { };

@ -35644,7 +35630,7 @@ with pkgs;
  anki = callPackage ../games/anki {
    inherit (darwin.apple_sdk.frameworks) CoreAudio;
  };
-  anki-bin = callPackage ../games/anki/bin.nix { buildFHSUserEnv = buildFHSUserEnvBubblewrap; };
+  anki-bin = callPackage ../games/anki/bin.nix { };

  armagetronad = callPackage ../games/armagetronad { };

@ -36477,9 +36463,7 @@ with pkgs;

  stockfish = callPackage ../games/stockfish { };

-  steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam {
-    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
-  });
+  steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam { });

  steam = steamPackages.steam-fhsenv;
  steam-small = steamPackages.steam-fhsenv-small;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2278,7 +2278,9 @@ self: super: with self; {

  datadog = callPackage ../development/python-modules/datadog { };

-  datafusion = callPackage ../development/python-modules/datafusion { };
+  datafusion = callPackage ../development/python-modules/datafusion {
+    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
+  };

  datamodeldict = callPackage ../development/python-modules/datamodeldict { };