Merge master into staging-next

2025-02-16 17:14:00 +00:00 · 2024-07-24 18:01:18 +00:00 · 2024-07-24 18:01:18 +00:00 · 7208220b63
commit 7208220b63
parent 8402add1f4 7b8b14a876
231 changed files with 1891 additions and 688 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -305,7 +305,11 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/make-hardcode-gsettings-patch @jtojnar

 # Cinnamon
-/pkgs/desktops/cinnamon @mkg20001
+/pkgs/by-name/ci/cinnamon-*    @mkg20001
+/pkgs/by-name/cj/cjs           @mkg20001
+/pkgs/by-name/mu/muffin        @mkg20001
+/pkgs/by-name/ne/nemo          @mkg20001
+/pkgs/by-name/ne/nemo-*        @mkg20001

 # nim
 /pkgs/development/compilers/nim   @ehmry
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -12,9 +12,14 @@
  - any:
    - changed-files:
      - any-glob-to-any-file:
-        - pkgs/desktops/cinnamon/**/*
        - nixos/modules/services/x11/desktop-managers/cinnamon.nix
        - nixos/tests/cinnamon.nix
+        - nixos/tests/cinnamon-wayland.nix
+        - pkgs/by-name/ci/cinnamon-*/**/*
+        - pkgs/by-name/cj/cjs/**/*
+        - pkgs/by-name/mu/muffin/**/*
+        - pkgs/by-name/ne/nemo/**/*
+        - pkgs/by-name/ne/nemo-*/**/*

 "6.topic: dotnet":
  - any:
--- a/doc/build-helpers/images/dockertools.section.md
+++ b/doc/build-helpers/images/dockertools.section.md
@ -185,6 +185,19 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
  _Default value:_ `"gz"`.\
  _Possible values:_ `"none"`, `"gz"`, `"zstd"`.

+`includeNixDB` (Boolean; _optional_)
+
+: Populate the nix database in the image with the dependencies of `copyToRoot`.
+  The main purpose is to be able to use nix commands in the container.
+
+  :::{.caution}
+  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
+
+  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
+  :::
+
+  _Default value:_ `false`.
+
 `contents` **DEPRECATED**

 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
@ -574,6 +587,19 @@ This allows the function to produce reproducible images.

  _Default value:_ `true`

+`includeNixDB` (Boolean; _optional_)
+
+: Populate the nix database in the image with the dependencies of `copyToRoot`.
+  The main purpose is to be able to use nix commands in the container.
+
+  :::{.caution}
+  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
+
+  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
+  :::
+
+  _Default value:_ `false`.
+
 `passthru` (Attribute Set; _optional_)

 : Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6239,6 +6239,12 @@
    githubId = 2147649;
    name = "Euan Kemp";
  };
+  eum3l = {
+    email = "eum3l@proton.me";
+    githubId = 77971322;
+    github = "eum3l";
+    name = "Emil";
+  };
  eureka-cpu = {
    email = "github.eureka@gmail.com";
    github = "eureka-cpu";
@ -7541,12 +7547,6 @@
    githubId = 605072;
    name = "Daniel Goertzen";
  };
-  goibhniu = {
-    email = "cillian.deroiste@gmail.com";
-    github = "cillianderoiste";
-    githubId = 643494;
-    name = "Cillian de Róiste";
-  };
  GoldsteinE = {
    email = "root@goldstein.rs";
    github = "GoldsteinE";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -20,6 +20,8 @@

 - [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr), proxy server to bypass Cloudflare protection. Available as [services.flaresolverr](#opt-services.flaresolverr.enable) service.

+- [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).
+
 - [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI
  for LLMs. Available as [services.open-webui](#opt-services.open-webui.enable)
  service.
@ -58,6 +60,8 @@

 - [Improved File Manager](https://github.com/misterunknown/ifm), or IFM, a single-file web-based file manager.

+- [OpenGFW](https://github.com/apernet/OpenGFW), an implementation of the Great Firewall on Linux. Available as [services.opengfw](#opt-services.opengfw.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@ -107,6 +111,8 @@
  moved into the top level scope (i.e., `budgie.budgie-desktop` is now
  `budgie-desktop`)

+- All Cinnamon and XApp packages have been moved to top-level (i.e., `cinnamon.nemo` is now `nemo`).
+
 - `services.cgit` now runs as the cgit user by default instead of root.
  This change requires granting access to the repositories to this user or
  setting the appropriate one through `services.cgit.some-instance.user`.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1137,6 +1137,7 @@
  ./services/networking/oink.nix
  ./services/networking/onedrive.nix
  ./services/networking/openconnect.nix
+  ./services/networking/opengfw.nix
  ./services/networking/openvpn.nix
  ./services/networking/ostinato.nix
  ./services/networking/owamp.nix
@ -1397,6 +1398,7 @@
  ./services/web-apps/gotosocial.nix
  ./services/web-apps/grocy.nix
  ./services/web-apps/pixelfed.nix
+  ./services/web-apps/goatcounter.nix
  ./services/web-apps/guacamole-client.nix
  ./services/web-apps/guacamole-server.nix
  ./services/web-apps/healthchecks.nix
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -355,7 +355,7 @@ in
                ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
              ''}
              ${optionalString (backup.initialize) ''
-                ${resticCmd} snapshots || ${resticCmd} init
+                ${resticCmd} cat config > /dev/null || ${resticCmd} init
              ''}
              ${optionalString (backup.paths != null && backup.paths != []) ''
                cat ${pkgs.writeText "staticPaths" (concatStringsSep "\n" backup.paths)} >> ${filesFromTmpFile}
--- a/nixos/modules/services/networking/opengfw.nix
+++ b/nixos/modules/services/networking/opengfw.nix
@ -0,0 +1,414 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib)
+    mkOption
+    types
+    mkIf
+    optionalString
+    ;
+  cfg = config.services.opengfw;
+in
+{
+  options.services.opengfw = {
+    enable = lib.mkEnableOption ''
+      OpenGFW, A flexible, easy-to-use, open source implementation of GFW on Linux
+    '';
+
+    package = lib.mkPackageOption pkgs "opengfw" { default = "opengfw"; };
+
+    user = mkOption {
+      default = "opengfw";
+      type = types.singleLineStr;
+      description = "Username of the OpenGFW user.";
+    };
+
+    dir = mkOption {
+      default = "/var/lib/opengfw";
+      type = types.singleLineStr;
+      description = ''
+        Working directory of the OpenGFW service and home of `opengfw.user`.
+      '';
+    };
+
+    logFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      example = "/var/lib/opengfw/opengfw.log";
+      description = ''
+        File to write the output to instead of systemd.
+      '';
+    };
+
+    logFormat = mkOption {
+      description = ''
+        Format of the logs. [logFormatMap](https://github.com/apernet/OpenGFW/blob/d7737e92117a11c9a6100d53019fac3b9d724fe3/cmd/root.go#L62)
+      '';
+      default = "json";
+      example = "console";
+      type = types.enum [
+        "json"
+        "console"
+      ];
+    };
+
+    pcapReplay = mkOption {
+      default = null;
+      example = "./opengfw.pcap";
+      type = types.nullOr types.path;
+      description = ''
+        Path to PCAP replay file.
+        In pcap mode, none of the actions in the rules have any effect.
+        This mode is mainly for debugging.
+      '';
+    };
+
+    logLevel = mkOption {
+      description = ''
+        Level of the logs. [logLevelMap](https://github.com/apernet/OpenGFW/blob/d7737e92117a11c9a6100d53019fac3b9d724fe3/cmd/root.go#L55)
+      '';
+      default = "info";
+      example = "warn";
+      type = types.enum [
+        "debug"
+        "info"
+        "warn"
+        "error"
+      ];
+    };
+
+    rulesFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = ''
+        Path to file containing OpenGFW rules.
+      '';
+    };
+
+    settingsFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = ''
+        Path to file containing OpenGFW settings.
+      '';
+    };
+
+    settings = mkOption {
+      default = null;
+      description = ''
+        Settings passed to OpenGFW. [Example config](https://gfw.dev/docs/build-run/#config-example)
+      '';
+      type = types.nullOr (
+        types.submodule {
+          options = {
+            replay = mkOption {
+              description = ''
+                PCAP replay settings.
+              '';
+              default = { };
+              type = types.submodule {
+                options = {
+                  realtime = mkOption {
+                    description = ''
+                      Whether the packets in the PCAP file should be replayed in "real time" (instead of as fast as possible).
+                    '';
+                    default = false;
+                    example = true;
+                    type = types.bool;
+                  };
+                };
+              };
+            };
+
+            io = mkOption {
+              description = ''
+                IO settings.
+              '';
+              default = { };
+              type = types.submodule {
+                options = {
+                  queueSize = mkOption {
+                    description = "IO queue size.";
+                    type = types.int;
+                    default = 1024;
+                    example = 2048;
+                  };
+                  local = mkOption {
+                    description = ''
+                      Set to false if you want to run OpenGFW on FORWARD chain. (e.g. on a router)
+                    '';
+                    type = types.bool;
+                    default = true;
+                    example = false;
+                  };
+                  rst = mkOption {
+                    description = ''
+                      Set to true if you want to send RST for blocked TCP connections, needs `local = false`.
+                    '';
+                    type = types.bool;
+                    default = !cfg.settings.io.local;
+                    defaultText = "`!config.services.opengfw.settings.io.local`";
+                    example = false;
+                  };
+                  rcvBuf = mkOption {
+                    description = "Netlink receive buffer size.";
+                    type = types.int;
+                    default = 4194304;
+                    example = 2097152;
+                  };
+                  sndBuf = mkOption {
+                    description = "Netlink send buffer size.";
+                    type = types.int;
+                    default = 4194304;
+                    example = 2097152;
+                  };
+                };
+              };
+            };
+            ruleset = mkOption {
+              description = ''
+                The path to load specific local geoip/geosite db files.
+                If not set, they will be automatically downloaded from (Loyalsoldier/v2ray-rules-dat)[https://github.com/Loyalsoldier/v2ray-rules-dat].
+              '';
+              default = { };
+              type = types.submodule {
+                options = {
+                  geoip = mkOption {
+                    description = "Path to `geoip.dat`.";
+                    default = null;
+                    type = types.nullOr types.path;
+                  };
+                  geosite = mkOption {
+                    description = "Path to `geosite.dat`.";
+                    default = null;
+                    type = types.nullOr types.path;
+                  };
+                };
+              };
+            };
+            workers = mkOption {
+              default = { };
+              description = "Worker settings.";
+              type = types.submodule {
+                options = {
+                  count = mkOption {
+                    type = types.int;
+                    description = ''
+                      Number of workers.
+                      Recommended to be no more than the number of CPU cores
+                    '';
+                    default = 4;
+                    example = 8;
+                  };
+                  queueSize = mkOption {
+                    type = types.int;
+                    description = "Worker queue size.";
+                    default = 16;
+                    example = 32;
+                  };
+                  tcpMaxBufferedPagesTotal = mkOption {
+                    type = types.int;
+                    description = ''
+                      TCP max total buffered pages.
+                    '';
+                    default = 4096;
+                    example = 8192;
+                  };
+                  tcpMaxBufferedPagesPerConn = mkOption {
+                    type = types.int;
+                    description = ''
+                      TCP max total bufferd pages per connection.
+                    '';
+                    default = 64;
+                    example = 128;
+                  };
+                  tcpTimeout = mkOption {
+                    type = types.str;
+                    description = ''
+                      How long a connection is considered dead when no data is being transferred.
+                      Dead connections are purged from TCP reassembly pools once per minute.
+                    '';
+                    default = "10m";
+                    example = "5m";
+                  };
+                  udpMaxStreams = mkOption {
+                    type = types.int;
+                    description = "UDP max streams.";
+                    default = 4096;
+                    example = 8192;
+                  };
+                };
+              };
+            };
+          };
+        }
+      );
+    };
+
+    rules = mkOption {
+      default = [ ];
+      description = ''
+        Rules passed to OpenGFW. [Example rules](https://gfw.dev/docs/rules)
+      '';
+      type = types.listOf (
+        types.submodule {
+          options = {
+            name = mkOption {
+              description = "Name of the rule.";
+              example = "block google dns";
+              type = types.singleLineStr;
+            };
+
+            action = mkOption {
+              description = ''
+                Action of the rule. [Supported actions](https://gfw.dev/docs/rules#supported-actions)
+              '';
+              default = "allow";
+              example = "block";
+              type = types.enum [
+                "allow"
+                "block"
+                "drop"
+                "modify"
+              ];
+            };
+
+            log = mkOption {
+              description = "Whether to enable logging for the rule.";
+              default = true;
+              example = false;
+              type = types.bool;
+            };
+
+            expr = mkOption {
+              description = ''
+                [Expr Language](https://expr-lang.org/docs/language-definition) expression using [analyzers](https://gfw.dev/docs/analyzers) and [functions](https://gfw.dev/docs/functions).
+              '';
+              type = types.str;
+              example = ''dns != nil && dns.qr && any(dns.questions, {.name endsWith "google.com"})'';
+            };
+
+            modifier = mkOption {
+              default = null;
+              description = ''
+                Modification of specified packets when using the `modify` action. [Available modifiers](https://github.com/apernet/OpenGFW/tree/master/modifier)
+              '';
+              type = types.nullOr (
+                types.submodule {
+                  options = {
+                    name = mkOption {
+                      description = "Name of the modifier.";
+                      type = types.singleLineStr;
+                      example = "dns";
+                    };
+
+                    args = mkOption {
+                      description = "Arguments passed to the modifier.";
+                      type = types.attrs;
+                      example = {
+                        a = "0.0.0.0";
+                        aaaa = "::";
+                      };
+                    };
+                  };
+                }
+              );
+            };
+          };
+        }
+      );
+
+      example = [
+        {
+          name = "block v2ex http";
+          action = "block";
+          expr = ''string(http?.req?.headers?.host) endsWith "v2ex.com"'';
+        }
+        {
+          name = "block google socks";
+          action = "block";
+          expr = ''string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80'';
+        }
+        {
+          name = "v2ex dns poisoning";
+          action = "modify";
+          modifier = {
+            name = "dns";
+            args = {
+              a = "0.0.0.0";
+              aaaa = "::";
+            };
+          };
+          expr = ''dns != nil && dns.qr && any(dns.questions, {.name endsWith "v2ex.com"})'';
+        }
+      ];
+    };
+  };
+
+  config =
+    let
+      format = pkgs.formats.yaml { };
+
+      settings =
+        if cfg.settings != null then
+          format.generate "opengfw-config.yaml" cfg.settings
+        else
+          cfg.settingsFile;
+      rules = if cfg.rules != [ ] then format.generate "opengfw-rules.yaml" cfg.rules else cfg.rulesFile;
+    in
+    mkIf cfg.enable {
+      security.wrappers.OpenGFW = {
+        owner = cfg.user;
+        group = cfg.user;
+        capabilities = "cap_net_admin+ep";
+        source = "${cfg.package}/bin/OpenGFW";
+      };
+
+      systemd.services.opengfw = {
+        description = "OpenGFW";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        path = with pkgs; [ iptables ];
+
+        preStart = ''
+          ${optionalString (rules != null) "ln -sf ${rules} rules.yaml"}
+          ${optionalString (settings != null) "ln -sf ${settings} config.yaml"}
+        '';
+
+        script = ''
+          ${config.security.wrapperDir}/OpenGFW \
+            -f ${cfg.logFormat} \
+            -l ${cfg.logLevel} \
+            ${optionalString (cfg.pcapReplay != null) "-p ${cfg.pcapReplay}"} \
+            -c config.yaml \
+            rules.yaml
+        '';
+
+        serviceConfig = rec {
+          WorkingDirectory = cfg.dir;
+          ExecReload = "kill -HUP $MAINPID";
+          Restart = "always";
+          User = cfg.user;
+          StandardOutput = mkIf (cfg.logFile != null) "append:${cfg.logFile}";
+          StandardError = StandardOutput;
+        };
+      };
+
+      users = {
+        groups.${cfg.user} = { };
+        users.${cfg.user} = {
+          description = "opengfw user";
+          isSystemUser = true;
+          group = cfg.user;
+          home = cfg.dir;
+          createHome = true;
+          homeMode = "750";
+        };
+      };
+    };
+  meta.maintainers = with lib.maintainers; [ eum3l ];
+}
--- a/nixos/modules/services/web-apps/goatcounter.nix
+++ b/nixos/modules/services/web-apps/goatcounter.nix
@ -0,0 +1,80 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.services.goatcounter;
+  stateDir = "goatcounter";
+in
+
+{
+  options = {
+    services.goatcounter = {
+      enable = lib.mkEnableOption "goatcounter";
+
+      package = lib.mkPackageOption pkgs "goatcounter" { };
+
+      address = lib.mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Web interface address.";
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = 8081;
+        description = "Web interface port.";
+      };
+
+      proxy = lib.mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether Goatcounter service is running behind a reverse proxy. Will listen for HTTPS if `false`.
+          Refer to [documentation](https://github.com/arp242/goatcounter?tab=readme-ov-file#running) for more details.
+        '';
+      };
+
+      extraArgs = lib.mkOption {
+        type = with types; listOf str;
+        default = [ ];
+        description = ''
+          List of extra arguments to be passed to goatcounter cli.
+          See {command}`goatcounter help serve` for more information.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.goatcounter = {
+      description = "Easy web analytics. No tracking of personal data.";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "serve"
+            "-listen"
+            "${cfg.address}:${toString cfg.port}"
+          ]
+          ++ lib.optionals cfg.proxy [
+            "-tls"
+            "proxy"
+          ]
+          ++ cfg.extraArgs
+        );
+        DynamicUser = true;
+        StateDirectory = stateDir;
+        WorkingDirectory = "%S/${stateDir}";
+        Restart = "always";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ bhankas ];
+}
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@ -142,7 +142,7 @@ in {
      ]
      ++ lib.optional config.networking.networkmanager.enable pkgs.networkmanagerapplet
      ++ (utils.removePackagesByName [
-          cinnamon.nemo
+          nemo
          mate.eom
          mate.pluma
          mate.atril
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -7,7 +7,7 @@ let
  cfg = config.services.xserver.desktopManager.cinnamon;
  serviceCfg = config.services.cinnamon;

-  nixos-gsettings-overrides = pkgs.cinnamon.cinnamon-gsettings-overrides.override {
+  nixos-gsettings-overrides = pkgs.cinnamon-gsettings-overrides.override {
    extraGSettingsOverridePackages = cfg.extraGSettingsOverridePackages;
    extraGSettingsOverrides = cfg.extraGSettingsOverrides;
  };
@ -51,7 +51,7 @@ in

    environment.cinnamon.excludePackages = mkOption {
      default = [];
-      example = literalExpression "[ pkgs.cinnamon.blueberry ]";
+      example = literalExpression "[ pkgs.blueman ]";
      type = types.listOf types.package;
      description = "Which packages cinnamon should exclude from the default environment";
    };
@ -60,7 +60,7 @@ in

  config = mkMerge [
    (mkIf cfg.enable {
-      services.displayManager.sessionPackages = [ pkgs.cinnamon.cinnamon-common ];
+      services.displayManager.sessionPackages = [ pkgs.cinnamon-common ];

      services.xserver.displayManager.lightdm.greeters.slick = {
        enable = mkDefault true;
@ -102,9 +102,9 @@ in
      services.accounts-daemon.enable = true;
      services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
      services.dbus.packages = with pkgs; [
-        cinnamon.cinnamon-common
-        cinnamon.cinnamon-screensaver
-        cinnamon.nemo-with-extensions
+        cinnamon-common
+        cinnamon-screensaver
+        nemo-with-extensions
        xapp
      ];
      services.cinnamon.apps.enable = mkDefault true;
@ -138,17 +138,17 @@ in
        desktop-file-utils

        # common-files
-        cinnamon.cinnamon-common
-        cinnamon.cinnamon-session
-        cinnamon.cinnamon-desktop
-        cinnamon.cinnamon-menus
-        cinnamon.cinnamon-translations
+        cinnamon-common
+        cinnamon-session
+        cinnamon-desktop
+        cinnamon-menus
+        cinnamon-translations

        # utils needed by some scripts
        killall

        # session requirements
-        cinnamon.cinnamon-screensaver
+        cinnamon-screensaver
        # cinnamon-killer-daemon: provided by cinnamon-common
        networkmanagerapplet # session requirement - also nm-applet not needed

@ -156,10 +156,10 @@ in
        polkit_gnome

        # packages
-        cinnamon.nemo-with-extensions
+        nemo-with-extensions
        gnome-online-accounts-gtk
-        cinnamon.cinnamon-control-center
-        cinnamon.cinnamon-settings-daemon
+        cinnamon-control-center
+        cinnamon-settings-daemon
        libgnomekbd

        # theme
@ -200,7 +200,7 @@ in
        })
      ];

-      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon.cinnamon-common ];
+      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon-common ];

      # Override GSettings schemas
      environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -375,6 +375,7 @@ in {
  gnome-xorg = handleTest ./gnome-xorg.nix {};
  gns3-server = handleTest ./gns3-server.nix {};
  gnupg = handleTest ./gnupg.nix {};
+  goatcounter = handleTest ./goatcounter.nix {};
  go-neb = handleTest ./go-neb.nix {};
  gobgpd = handleTest ./gobgpd.nix {};
  gocd-agent = handleTest ./gocd-agent.nix {};
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -567,6 +567,12 @@ in {
        docker.succeed("docker run --rm image-with-certs:latest test -r /etc/pki/tls/certs/ca-bundle.crt")
        docker.succeed("docker image rm image-with-certs:latest")

+    with subtest("buildImageWithNixDB: Has a nix database"):
+        docker.succeed(
+            "docker load --input='${examples.nix}'",
+            "docker run --rm ${examples.nix.imageName} nix-store -q --references /bin/bash"
+        )
+
    with subtest("buildNixShellImage: Can build a basic derivation"):
        docker.succeed(
            "${examples.nix-shell-basic} | docker load",
@ -632,5 +638,11 @@ in {
            "${nonRootTestImage} | docker load",
            "docker run --rm ${chownTestImage.imageName} | diff /dev/stdin <(echo 12345:12345)"
        )
+
+    with subtest("streamLayeredImage: with nix db"):
+        docker.succeed(
+            "${examples.nix-layered} | docker load",
+            "docker run --rm ${examples.nix-layered.imageName} nix-store -q --references /bin/bash"
+        )
  '';
 })
--- a/nixos/tests/goatcounter.nix
+++ b/nixos/tests/goatcounter.nix
@ -0,0 +1,32 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+
+  {
+    name = "goatcounter";
+
+    meta.maintainers = with lib.maintainers; [ bhankas ];
+
+    nodes.machine =
+      { config, ... }:
+      {
+        virtualisation.memorySize = 2048;
+
+        services.goatcounter = {
+          enable = true;
+          proxy = true;
+        };
+      };
+
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("goatcounter.service")
+      # wait for goatcounter to fully come up
+
+      with subtest("goatcounter service starts"):
+          machine.wait_until_succeeds(
+              "curl -sSfL http://localhost:8081/ > /dev/null",
+              timeout=30
+          )
+    '';
+  }
+)
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
    homepage = "https://a2jmidid.ladish.org/";
    license = licenses.gpl2Only;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/audio/ams-lv2/default.nix
+++ b/pkgs/applications/audio/ams-lv2/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation  rec {
    description = "LV2 port of the internal modules found in Alsa Modular Synth";
    homepage = "https://github.com/blablack/ams-lv2";
    license = licenses.gpl3;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
    # Build uses `-msse` and `-mfpmath=sse`
    badPlatforms = [ "aarch64-linux" ];
--- a/pkgs/applications/audio/ardour/7.nix
+++ b/pkgs/applications/audio/ardour/7.nix
@ -207,6 +207,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    mainProgram = "ardour7";
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu magnetophon mitchmindtree ];
+    maintainers = with maintainers; [ magnetophon mitchmindtree ];
  };
 }
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -214,6 +214,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    mainProgram = "ardour8";
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu magnetophon mitchmindtree ];
+    maintainers = with maintainers; [ magnetophon mitchmindtree ];
  };
 }
--- a/pkgs/applications/audio/bristol/default.nix
+++ b/pkgs/applications/audio/bristol/default.nix
@ -55,6 +55,6 @@ stdenv.mkDerivation rec {
    homepage = "https://bristol.sourceforge.net";
    license = licenses.gpl3;
    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    homepage = "https://calf-studio-gear.org";
    description = "Set of high quality open source audio plugins for musicians";
    license = licenses.lgpl2;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
    mainProgram = "calfjackhost";
  };
--- a/pkgs/applications/audio/distrho/default.nix
+++ b/pkgs/applications/audio/distrho/default.nix
@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
        wolpertinger
    '';
    license = with licenses; [ gpl2Only gpl3Only gpl2Plus lgpl2Plus lgpl3Only mit ];
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.drumgizmo.org";
    license = licenses.lgpl3Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu maintainers.nico202 ];
+    maintainers = [ maintainers.nico202 ];
  };
 }
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -19,6 +19,6 @@ mkDerivation rec {
    homepage = "http://drumkv1.sourceforge.net/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    description = "Real-time software synthesizer based on the SoundFont 2 specifications";
    homepage    = "https://www.fluidsynth.org";
    license     = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ goibhniu lovek323 ];
+    maintainers = with maintainers; [ lovek323 ];
    platforms   = platforms.unix;
    mainProgram = "fluidsynth";
  };
--- a/pkgs/applications/audio/gigedit/default.nix
+++ b/pkgs/applications/audio/gigedit/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    homepage = "http://www.linuxsampler.org";
    description = "Gigasampler file access library";
    license = licenses.gpl2;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
    mainProgram = "gigedit";
  };
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://github.com/brummer10/guitarix";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ astsmtl goibhniu lord-valen ];
+    maintainers = with maintainers; [ astsmtl lord-valen ];
    platforms = platforms.linux;
  };
 })
--- a/pkgs/applications/audio/hydrogen/default.nix
+++ b/pkgs/applications/audio/hydrogen/default.nix
@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    homepage = "http://www.hydrogen-music.org";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu orivej ];
+    maintainers = with maintainers; [ orivej ];
  };
 }
--- a/pkgs/applications/audio/ingen/default.nix
+++ b/pkgs/applications/audio/ingen/default.nix
@ -69,10 +69,7 @@ stdenv.mkDerivation {
    description = "Modular audio processing system using JACK and LV2 or LADSPA plugins";
    homepage = "http://drobilla.net/software/ingen";
    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [
-      goibhniu
-      t4ccer
-    ];
+    maintainers = with lib.maintainers; [ t4ccer ];
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/applications/audio/jack-capture/default.nix
+++ b/pkgs/applications/audio/jack-capture/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    mainProgram = "jack_capture";
    homepage = "https://github.com/kmatheussen/jack_capture/";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ goibhniu orivej ];
+    maintainers = with maintainers; [ orivej ];
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/applications/audio/jack-oscrolloscope/default.nix
+++ b/pkgs/applications/audio/jack-oscrolloscope/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    mainProgram = "jack_oscrolloscope";
    homepage = "http://das.nasophon.de/jack_oscrolloscope";
    license = licenses.gpl2;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/applications/audio/jalv/default.nix
+++ b/pkgs/applications/audio/jalv/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation  rec {
    description = "Simple but fully featured LV2 host for Jack";
    homepage = "http://drobilla.net/software/jalv";
    license = licenses.isc;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation  rec {
    homepage = "https://www.nongnu.org/lash";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/linuxsampler/default.nix
+++ b/pkgs/applications/audio/linuxsampler/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
      FAQ, please contact us.
    '';
    license = licenses.unfree;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/lmms/default.nix
+++ b/pkgs/applications/audio/lmms/default.nix
@ -52,6 +52,6 @@ mkDerivation rec {
    homepage = "https://lmms.io";
    license = licenses.gpl2Plus;
    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/mda-lv2/default.nix
+++ b/pkgs/applications/audio/mda-lv2/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    homepage = "http://drobilla.net/software/mda-lv2.html";
    description = "LV2 port of the MDA plugins by Paul Kellett";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/mhwaveedit/default.nix
+++ b/pkgs/applications/audio/mhwaveedit/default.nix
@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/magnush/mhwaveedit";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/mid2key/default.nix
+++ b/pkgs/applications/audio/mid2key/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    homepage = "http://code.google.com/p/mid2key/";
    description = "Simple tool which maps midi notes to simulated keystrokes";
    license = licenses.gpl3;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
    mainProgram = "mid2key";
  };
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -147,7 +147,7 @@ mkDerivation rec {
    description = "Digital DJ mixing software";
    mainProgram = "mixxx";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ goibhniu bfortz benley ];
+    maintainers = with maintainers; [ bfortz benley ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/petrifoo/default.nix
+++ b/pkgs/applications/audio/petrifoo/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation  rec {
    homepage = "https://petri-foo.sourceforge.net";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    mainProgram = "petri-foo";
  };
 }
--- a/pkgs/applications/audio/pianobooster/default.nix
+++ b/pkgs/applications/audio/pianobooster/default.nix
@ -67,6 +67,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/pianobooster/PianoBooster";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu orivej ];
+    maintainers = with maintainers; [ orivej ];
  };
 }
--- a/pkgs/applications/audio/puredata/default.nix
+++ b/pkgs/applications/audio/puredata/default.nix
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    homepage = "http://puredata.info";
    license = licenses.bsd3;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ goibhniu carlthome ];
+    maintainers = with maintainers; [ carlthome ];
    mainProgram = "pd";
    changelog = "https://msp.puredata.info/Pd_documentation/x5.htm#s1";
  };
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@ -41,7 +41,7 @@ mkDerivation rec {
    mainProgram = "qjackctl";
    homepage = "https://github.com/rncbc/qjackctl";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/qsampler/default.nix
+++ b/pkgs/applications/audio/qsampler/default.nix
@ -22,7 +22,7 @@ mkDerivation rec {
    description = "Graphical frontend to LinuxSampler";
    mainProgram = "qsampler";
    license = licenses.gpl2;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/qsynth/default.nix
+++ b/pkgs/applications/audio/qsynth/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    mainProgram = "qsynth";
    homepage = "https://sourceforge.net/projects/qsynth";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/rakarrack/default.nix
+++ b/pkgs/applications/audio/rakarrack/default.nix
@ -26,6 +26,6 @@ stdenv.mkDerivation  rec {
    homepage = "https://rakarrack.sourceforge.net";
    license = licenses.gpl2;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/samplv1/default.nix
+++ b/pkgs/applications/audio/samplv1/default.nix
@ -22,6 +22,6 @@ mkDerivation rec {
    homepage = "http://samplv1.sourceforge.net/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/seq24/default.nix
+++ b/pkgs/applications/audio/seq24/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation  rec {
    homepage = "http://www.filter24.org/seq24";
    license = licenses.gpl2;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu ];
+    maintainers = [ ];
    mainProgram = "seq24";
  };
 }
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -48,6 +48,6 @@ stdenv.mkDerivation  rec {
    homepage = "https://setbfree.org";
    license = licenses.gpl2;
    platforms = [ "x86_64-linux" "i686-linux" ]; # fails on ARM and Darwin
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/sonic-visualiser/default.nix
+++ b/pkgs/applications/audio/sonic-visualiser/default.nix
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    description = "View and analyse contents of music audio files";
    homepage = "https://www.sonicvisualiser.org/";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu maintainers.marcweber ];
+    maintainers = [ maintainers.marcweber ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/swh-lv2/default.nix
+++ b/pkgs/applications/audio/swh-lv2/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
      generators, surround encoders and more.
    '';
    license = licenses.gpl3;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@ -19,6 +19,6 @@ mkDerivation rec {
    homepage = "https://synthv1.sourceforge.io/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/vkeybd/default.nix
+++ b/pkgs/applications/audio/vkeybd/default.nix
@ -24,6 +24,6 @@ stdenv.mkDerivation  rec {
    homepage = "https://www.alsa-project.org/~tiwai/alsa.html";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/xsynth-dssi/default.nix
+++ b/pkgs/applications/audio/xsynth-dssi/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation  rec {
    homepage = "https://dssi.sourceforge.net/download.html#Xsynth-DSSI";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
    homepage = "https://yoshimi.github.io/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    mainProgram = "yoshimi";
  };
 }
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@ -148,7 +148,7 @@ in stdenv.mkDerivation rec {
      else "https://zynaddsubfx.sourceforge.io";

    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ goibhniu kira-bruneau ];
+    maintainers = with maintainers; [ kira-bruneau ];
    platforms = platforms.all;

    # On macOS:
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/color-theme-solarized/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/color-theme-solarized/default.nix
@ -8,13 +8,13 @@

 melpaBuild {
  pname = "color-theme-solarized";
-  version = "0-unstable-2017-10-24";
+  version = "0-unstable-2023-02-09";

  src = fetchFromGitHub {
    owner = "sellout";
    repo = "emacs-color-theme-solarized";
-    rev = "f3ca8902ea056fb8e46cb09f09c96294e31cd4ee";
-    hash = "sha256-oxX0lo6sxotEiR3nPrKPE9H01HKB3ohB/p8eEHFTp5k=";
+    rev = "b186e5d62d0b83cbf5cf38f7eb7a199dea9a3ee3";
+    hash = "sha256-7E8r56dzfD06tsQEnqU5mWSbwz9x9QPbzken2J/fhlg=";
  };

  packageRequires = [ color-theme ];
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-conflict/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-conflict/default.nix
@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  melpaBuild,
+  unstableGitUpdater,
 }:

 melpaBuild {
@ -15,6 +16,8 @@ melpaBuild {
    hash = "sha256-DIGvnotSQYIgHxGxtyCALHd8ZbrfkmdvjLXlkcqQ6v4=";
  };

+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
  meta = {
    homepage = "https://github.com/ibizaman/emacs-conflict";
    description = "Resolve conflicts happening when using file synchronization tools";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/evil-markdown/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/evil-markdown/default.nix
@ -4,6 +4,7 @@
  fetchFromGitHub,
  markdown-mode,
  melpaBuild,
+  unstableGitUpdater,
 }:

 melpaBuild {
@ -22,6 +23,8 @@ melpaBuild {
    markdown-mode
  ];

+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
  meta = {
    homepage = "https://github.com/Somelauw/evil-markdown";
    description = "Integrates Emacs evil and markdown";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/default.nix
@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  melpaBuild,
+  unstableGitUpdater,
 }:

 melpaBuild {
@ -15,6 +16,8 @@ melpaBuild {
    hash = "sha256-cVkK9EF6qQyVV3uVqnBEjF8e9nEx/8ixnM8PvxqCyYE=";
  };

+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
  meta = {
    homepage = "https://github.com/jwiegley/git-undo-el";
    description = "Revert region to most recent Git-historical version";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/isearch-prop/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/isearch-prop/default.nix
@ -7,13 +7,13 @@

 melpaBuild {
  pname = "isearch-prop";
-  version = "0-unstable-2019-05-01";
+  version = "0-unstable-2022-12-30";

  src = fetchFromGitHub {
    owner = "emacsmirror";
    repo = "isearch-prop";
-    rev = "4a2765f835dd115d472142da05215c4c748809f4";
-    hash = "sha256-A1Kt4nm7iRV9J5yaLupwiNL5g7ddZvQs79dggmqZ7Rk=";
+    rev = "5787fd57977c0d6c416ce71471c3b9da246dfb78";
+    hash = "sha256-Xli7TxBenl5cDMJv3Qz7ZELFpvJKStMploLpf9a+uoA=";
  };

  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/default.nix
@ -7,7 +7,9 @@
  ivy,
  pkg-config,
  tclap,
+  unstableGitUpdater,
  xapian,
+  # Configurable options
  # Include pre-configured hydras
  withHydra ? false,
  # Include Ivy integration
@ -77,6 +79,7 @@ melpaBuild {

  passthru = {
    inherit notdeft-xapian;
+    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
  };

  meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/youtube-dl/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/youtube-dl/default.nix
@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  melpaBuild,
+  unstableGitUpdater,
 }:

 melpaBuild {
@ -15,6 +16,8 @@ melpaBuild {
    hash = "sha256-Etl95rcoRACDPjcTPQqYK2L+w8OZbOrTrRT0JadMdH4=";
  };

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = {
    description = "Emacs youtube-dl download manager";
    homepage = "https://github.com/skeeto/youtube-dl-emacs";
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -145,6 +145,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.darktable.org";
    license = licenses.gpl3Plus;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ goibhniu flosse mrVanDalo paperdigits freyacodes ];
+    maintainers = with maintainers; [ flosse mrVanDalo paperdigits freyacodes ];
  };
 }
--- a/pkgs/applications/graphics/mypaint/default.nix
+++ b/pkgs/applications/graphics/mypaint/default.nix
@ -136,6 +136,6 @@ in buildPythonApplication rec {
    homepage = "http://mypaint.org/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu jtojnar ];
+    maintainers = with maintainers; [ jtojnar ];
  };
 }
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@ -160,7 +160,7 @@ stdenv.mkDerivation {
    description = "2D animation program";
    homepage = "http://www.synfig.org";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/misc/artha/default.nix
+++ b/pkgs/applications/misc/artha/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    description = "Offline thesaurus based on WordNet";
    homepage = "https://artha.sourceforge.net";
    license = licenses.gpl2;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
    platforms = platforms.linux;
    mainProgram = "artha";
  };
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -427,10 +427,7 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    # the current apple sdk is too old (currently 11_0) and fails to build "metal" on x86_64-darwin
    broken = stdenv.hostPlatform.system == "x86_64-darwin";
-    maintainers = with lib.maintainers; [
-      goibhniu
-      veprbl
-    ];
+    maintainers = with lib.maintainers; [ veprbl ];
    mainProgram = "blender";
  };
 })
--- a/pkgs/applications/misc/hovercraft/default.nix
+++ b/pkgs/applications/misc/hovercraft/default.nix
@ -39,6 +39,6 @@ buildPythonApplication rec {
    mainProgram = "hovercraft";
    homepage = "https://github.com/regebro/hovercraft";
    license = licenses.mit;
-    maintainers = with maintainers; [ goibhniu makefu ];
+    maintainers = with maintainers; [ makefu ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -4,7 +4,7 @@ let
    if stdenv.isLinux then {
      stable = "0.0.60";
      ptb = "0.0.95";
-      canary = "0.0.453";
+      canary = "0.0.455";
      development = "0.0.23";
    } else {
      stable = "0.0.311";
@ -25,7 +25,7 @@ let
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-yEU/3PfS1uQklVVcO7p/xAJTM3RPz88bSxMIajeDTUM=";
+        hash = "sha256-SDw0LaRIOq/sd7Qz9XZMikuMkau/lFrCtKv6MBvhzWs=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
--- a/pkgs/applications/science/misc/golly/default.nix
+++ b/pkgs/applications/science/misc/golly/default.nix
@ -12,6 +12,10 @@ stdenv.mkDerivation rec {
    wxGTK perl python3 zlib libGLU libGL libX11 SDL2
  ];

+  nativeBuildInputs = [
+    (python3.withPackages (ps: [ps.setuptools]))
+  ];
+
  setSourceRoot = ''
    sourceRoot=$(echo */gui-wx)
  '';
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://shotcut.org";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ goibhniu woffs peti ];
+    maintainers = with maintainers; [ woffs peti ];
    platforms = platforms.unix;
    mainProgram = "shotcut";
  };
--- a/pkgs/applications/video/simplescreenrecorder/default.nix
+++ b/pkgs/applications/video/simplescreenrecorder/default.nix
@ -40,6 +40,6 @@ mkDerivation rec {
    homepage = "https://www.maartenbaert.be/simplescreenrecorder";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -576,6 +576,8 @@ rec {
      created ? "1970-01-01T00:00:01Z"
    , # Compressor to use. One of: none, gz, zstd.
      compressor ? "gz"
+      # Populate the nix database in the image with the dependencies of `copyToRoot`.
+    , includeNixDB ? false
    , # Deprecated.
      contents ? null
    ,
@ -613,20 +615,26 @@ rec {

      compress = compressorForImage compressor name;

+      # TODO: add the dependencies of the config json.
+      extraCommandsWithDB =
+        if includeNixDB then (mkDbExtraCommand rootContents) + extraCommands
+        else extraCommands;
+
      layer =
        if runAsRoot == null
        then
          mkPureLayer
            {
              name = baseName;
-              inherit baseJson keepContentsDirlinks extraCommands uid gid;
+              inherit baseJson keepContentsDirlinks uid gid;
+              extraCommands = extraCommandsWithDB;
              copyToRoot = rootContents;
            } else
          mkRootLayer {
            name = baseName;
            inherit baseJson fromImage fromImageName fromImageTag
-              keepContentsDirlinks runAsRoot diskSize buildVMMemorySize
-              extraCommands;
+              keepContentsDirlinks runAsRoot diskSize buildVMMemorySize;
+            extraCommands = extraCommandsWithDB;
            copyToRoot = rootContents;
          };
      result = runCommand "docker-image-${baseName}.tar${compress.ext}"
@ -885,18 +893,9 @@ rec {
  # the container.
  # Be careful since this doesn't work well with multilayer.
  # TODO: add the dependencies of the config json.
-  buildImageWithNixDb = args@{ copyToRoot ? contents, contents ? null, extraCommands ? "", ... }: (
-    buildImage (args // {
-      extraCommands = (mkDbExtraCommand copyToRoot) + extraCommands;
-    })
-  );
+  buildImageWithNixDb = args: buildImage (args // { includeNixDB = true; });

-  # TODO: add the dependencies of the config json.
-  buildLayeredImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }: (
-    buildLayeredImage (args // {
-      extraCommands = (mkDbExtraCommand contents) + extraCommands;
-    })
-  );
+  buildLayeredImageWithNixDb = args: buildLayeredImage (args // { includeNixDB = true; });

  # Arguments are documented in ../../../doc/build-helpers/images/dockertools.section.md
  streamLayeredImage = lib.makeOverridable (
@ -917,6 +916,7 @@ rec {
    , fakeRootCommands ? ""
    , enableFakechroot ? false
    , includeStorePaths ? true
+    , includeNixDB ? false
    , passthru ? {}
    ,
    }:
@ -954,7 +954,9 @@ rec {
        customisationLayer = symlinkJoin {
          name = "${baseName}-customisation-layer";
          paths = contentsList;
-          inherit extraCommands fakeRootCommands;
+          extraCommands =
+            (lib.optionalString includeNixDB (mkDbExtraCommand contents)) + extraCommands;
+          inherit fakeRootCommands;
          nativeBuildInputs = [
            fakeroot
          ] ++ optionals enableFakechroot [
@ -1107,7 +1109,9 @@ rec {

        result = runCommand "stream-${baseName}"
          {
+            inherit conf;
            inherit (conf) imageName;
+            inherit streamScript;
            preferLocalBuild = true;
            passthru = passthru // {
              inherit (conf) imageTag;
@ -1118,7 +1122,7 @@ rec {
            };
            nativeBuildInputs = [ makeWrapper ];
          } ''
-          makeWrapper ${streamScript} $out --add-flags ${conf}
+          makeWrapper $streamScript $out --add-flags $conf
        '';
      in
      result
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@ -901,4 +901,16 @@ rec {
    '';
  };

+  nix-layered = pkgs.dockerTools.streamLayeredImage  {
+    name = "nix-layered";
+    tag = "latest";
+    contents = [ pkgs.nix pkgs.bash ];
+    includeNixDB = true;
+    config = {
+      Env = [
+        "NIX_PAGER=cat"
+      ];
+    };
+  };
+
 }
--- a/pkgs/by-name/al/alpaca/package.nix
+++ b/pkgs/by-name/al/alpaca/package.nix
@ -2,7 +2,6 @@
  lib,
  python3Packages,
  fetchFromGitHub,
-  fetchpatch,
  appstream,
  meson,
  ninja,
@ -18,30 +17,26 @@

 python3Packages.buildPythonApplication rec {
  pname = "alpaca";
-  version = "0.9.6.1";
+  version = "1.0.1";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Alpaca";
    rev = version;
-    hash = "sha256-EbaEjKqfotJBceaYEyz3LHilK3GnnwEpfMR7Teq96hI=";
+    hash = "sha256-GxnYPnrjaJ47/i+pigw+on2dmbHwQSX+STasvqnAtuQ=";
  };

  patches = [
    # Change the way XDG paths are handled so it makes sense outside of flatpak
    ./fix_xdg_path_flatpak.patch
-
-    # Let ollama instance stop gracefully so we don't have model instance left behind
-    (fetchpatch {
-      url = "https://github.com/Jeffser/Alpaca/commit/e81d918675896c1670cf5aa5a55e1b706be5ed51.patch";
-      hash = "sha256-gYYFvaoBI/Qn0g2qgS1cB0B4F08swznrSd5KCb51vh0=";
-    })
  ];

  postPatch = ''
    substituteInPlace src/local_instance.py \
      --replace-fail '/app/bin/ollama' 'ollama'
+    substituteInPlace src/window.py \
+      --replace-fail '/app/share' "$out/share"
  '';

  nativeBuildInputs = [
@ -64,6 +59,8 @@ python3Packages.buildPythonApplication rec {
    requests
    pillow
    pypdf
+    pytube
+    html2text
  ];

  dontWrapGApps = true;
@ -85,6 +82,7 @@ python3Packages.buildPythonApplication rec {
        ollama = pkgs.ollama-cuda;
      }
      ```
+      Or using `pkgs.ollama-rocm` for AMD GPUs.
    '';
    homepage = "https://jeffser.com/alpaca";
    license = lib.licenses.gpl3Plus;
--- a/pkgs/by-name/as/asm-lsp/package.nix
+++ b/pkgs/by-name/as/asm-lsp/package.nix
@ -6,7 +6,7 @@
 }:
 let
  pname = "asm-lsp";
-  version = "0.7.1";
+  version = "0.7.3";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -15,7 +15,7 @@ rustPlatform.buildRustPackage {
    owner = "bergercookie";
    repo = "asm-lsp";
    rev = "v${version}";
-    hash = "sha256-nHLM4cwVo6esrrpr4s+DfJIUWWKSrYwWLOPC84tb68o=";
+    hash = "sha256-LWsawBh1czS7LUX70IXrJHUonIt2XEN8L26iP5cVyRk=";
  };

  nativeBuildInputs = [
@ -26,7 +26,7 @@ rustPlatform.buildRustPackage {
    openssl
  ];

-  cargoHash = "sha256-CiHXfy8Xqrg8SAWA4nTHSGZKS0pGcoQem9kLRtTLpRs=";
+  cargoHash = "sha256-pIjOelOQ5X8jl/ZtE8IzXPtcLmANDtWsJaNXno8CT6Y=";

  # tests expect ~/.cache/asm-lsp to be writable
  preCheck = ''
--- a/pkgs/by-name/ch/charmcraft/package.nix
+++ b/pkgs/by-name/ch/charmcraft/package.nix
@ -1,12 +1,34 @@
 {
  lib,
  git,
-  python3Packages,
+  python3,
  fetchFromGitHub,
  nix-update-script,
 }:

-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      pydantic-yaml = super.pydantic-yaml.overridePythonAttrs (old: rec {
+        version = "0.11.2";
+        src = fetchFromGitHub {
+          owner = "NowanIlfideme";
+          repo = "pydantic-yaml";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-AeUyVav0/k4Fz69Qizn4hcJKoi/CDR9eUan/nJhWsDY=";
+        };
+        dependencies = with self; [
+          deprecated
+          importlib-metadata
+          pydantic_1
+          ruamel-yaml
+          types-deprecated
+        ];
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
  pname = "charmcraft";
  version = "2.7.0";

@ -23,11 +45,12 @@ python3Packages.buildPythonApplication rec {
    substituteInPlace setup.py \
      --replace-fail 'version=determine_version()' 'version="${version}"'

+    # TODO remove setuptools from dependencies once this is removed
    substituteInPlace charmcraft/env.py \
      --replace-fail "distutils.util" "setuptools.dist"
  '';

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python.pkgs; [
    craft-cli
    craft-parts
    craft-providers
@ -42,17 +65,18 @@ python3Packages.buildPythonApplication rec {
    requests
    requests-toolbelt
    requests-unixsocket
+    setuptools # see substituteInPlace above
    snap-helpers
    tabulate
    urllib3
  ];

-  nativeBuildInputs = with python3Packages; [ setuptools ];
+  build-system = with python.pkgs; [ setuptools ];

  pythonRelaxDeps = [ "urllib3" ];

  nativeCheckInputs =
-    with python3Packages;
+    with python.pkgs;
    [
      pyfakefs
      pytest-check
--- a/pkgs/desktops/cinnamon/cinnamon-common/libdir.patch
+++ b/pkgs/desktops/cinnamon/cinnamon-common/libdir.patch
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-common/use-sane-install-dir.patch
+++ b/pkgs/desktops/cinnamon/cinnamon-common/use-sane-install-dir.patch
--- a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-session/0001-Use-dbus_glib-instead-of-elogind.patch
+++ b/pkgs/desktops/cinnamon/cinnamon-session/0001-Use-dbus_glib-instead-of-elogind.patch
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/csd-backlight-helper-fix.patch
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/csd-backlight-helper-fix.patch
--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
--- a/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
--- a/pkgs/desktops/cinnamon/cjs/default.nix
+++ b/pkgs/desktops/cinnamon/cjs/default.nix
--- a/pkgs/by-name/cl/clevis/0000-tang-timeout.patch
+++ b/pkgs/by-name/cl/clevis/0000-tang-timeout.patch
--- a/pkgs/by-name/cl/clevis/package.nix
+++ b/pkgs/by-name/cl/clevis/package.nix
@ -0,0 +1,130 @@
+{
+  lib,
+  asciidoc-full,
+  coreutils,
+  cryptsetup,
+  curl,
+  fetchFromGitHub,
+  gnugrep,
+  gnused,
+  jansson,
+  jose,
+  libpwquality,
+  luksmeta,
+  makeWrapper,
+  meson,
+  ninja,
+  nixosTests,
+  pkg-config,
+  stdenv,
+  tpm2-tools,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clevis";
+  version = "20";
+
+  src = fetchFromGitHub {
+    owner = "latchset";
+    repo = "clevis";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-rBdZrnHPzRd9vbyl1h/Nb0cFAtIPUHSmxVoKrKuCrQ8=";
+  };
+
+  patches = [
+    # Replaces the clevis-decrypt 300s timeout to a 10s timeout
+    # https://github.com/latchset/clevis/issues/289
+    ./0000-tang-timeout.patch
+  ];
+
+  nativeBuildInputs = [
+    asciidoc-full
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    cryptsetup
+    curl
+    jansson
+    jose
+    libpwquality
+    luksmeta
+    tpm2-tools
+  ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  # TODO: investigate how to prepare the dependencies so that they can be found
+  # while setting strictDeps as true. This will require studying the dark
+  # corners of cross-compilation in Nixpkgs...
+  strictDeps = false;
+
+  # Since 2018-07-11, upstream relies on a hardcoded /bin/cat. See:
+  # https://github.com/latchset/clevis/issues/61
+  # https://github.com/latchset/clevis/pull/64
+  #
+  # So, we filter all src files that have the string "/bin/cat" and patch that
+  # string to an absolute path for our coreutils location.
+  # The xargs command is a little bit convoluted because a simpler version would
+  # be vulnerable to code injection. This hint is a courtesy of Stack Exchange:
+  # https://unix.stackexchange.com/a/267438
+  postPatch = ''
+    for f in $(find src/ -type f -print0 |\
+                 xargs -0 -I@ sh -c 'grep -q "/bin/cat" "$1" && echo "$1"' sh @); do
+      substituteInPlace "$f" --replace-fail '/bin/cat' '${lib.getExe' coreutils "cat"}'
+    done
+  '';
+
+  # We wrap the main clevis binary entrypoint but not the sub-binaries.
+  postInstall =
+    let
+      includeIntoPath = [
+        coreutils
+        cryptsetup
+        gnugrep
+        gnused
+        jose
+        libpwquality
+        luksmeta
+        tpm2-tools
+      ];
+    in
+    ''
+      wrapProgram $out/bin/clevis \
+        --prefix PATH ':' "${lib.makeBinPath includeIntoPath}:${placeholder "out"}/bin"
+    '';
+
+  passthru.tests = {
+    inherit (nixosTests.installer)
+      clevisBcachefs
+      clevisBcachefsFallback
+      clevisLuks
+      clevisLuksFallback
+      clevisZfs
+      clevisZfsFallback
+      ;
+    clevisLuksSystemdStage1 = nixosTests.installer-systemd-stage-1.clevisLuks;
+    clevisLuksFallbackSystemdStage1 = nixosTests.installer-systemd-stage-1.clevisLuksFallback;
+    clevisZfsSystemdStage1 = nixosTests.installer-systemd-stage-1.clevisZfs;
+    clevisZfsFallbackSystemdStage1 = nixosTests.installer-systemd-stage-1.clevisZfsFallback;
+  };
+
+  meta = {
+    homepage = "https://github.com/latchset/clevis";
+    description = "Automated Encryption Framework";
+    longDescription = ''
+      Clevis is a pluggable framework for automated decryption. It can be used
+      to provide automated decryption of data or even automated unlocking of
+      LUKS volumes.
+    '';
+    changelog = "https://github.com/latchset/clevis/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+})
--- a/pkgs/by-name/cm/cmake-lint/package.nix
+++ b/pkgs/by-name/cm/cmake-lint/package.nix
@ -18,19 +18,20 @@ python3Packages.buildPythonApplication rec {
    hash = "sha256-/OuWwerBlJynEibaYo+jkLpHt4x9GZrqMRJNxgrDBlM=";
  };

-  nativeBuildInputs = [ python3Packages.setuptools ];
+  postPatch = ''
+    # We don't need to test coverage, so remove these checks
+    substituteInPlace setup.cfg \
+      --replace-fail "addopts = --cov-fail-under=84 --cov=./cmakelint" ""
+  '';
+
+  build-system = [ python3Packages.setuptools ];

  pythonImportsCheck = [ "cmakelint" ];

-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    nose
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
  ];

-  checkPhase = ''
-    nosetests
-  '';
-
  passthru.tests = {
    version = testers.testVersion { package = cmake-lint; };
  };
--- a/pkgs/by-name/co/connectome-workbench/package.nix
+++ b/pkgs/by-name/co/connectome-workbench/package.nix
@ -0,0 +1,65 @@
+{ lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  libGL,
+  libGLU,
+  libsForQt5,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "connectome-workbench";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Washington-University";
+    repo = "workbench";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-d0J5bXp6mJlUQBmInxPXPkd5P5H+3F6fE9fc8pD1fUc=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  patches = [
+    # remove after next release:
+    (fetchpatch {
+      name = "fix-missing-includes-in-CZIlib";
+      url = "https://github.com/Washington-University/workbench/commit/7ba3345d161d567a4b628ceb02ab4471fc96cb20.diff";
+      hash = "sha256-DMrJOr/2Wr4o4Z3AuhWfMZTX8f/kOYWwZQzBUwIrTd8=";
+      relative = "src";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt  \
+      --replace-fail "ADD_SUBDIRECTORY ( Tests )" ""  \
+      --replace-fail "ENABLE_TESTING()" ""
+  '';
+  # tests are minimal and test_driver fails to link (also -DBUILD_TESTING=... is ignored):
+  # ld: ../Brain/libBrain.a(BrainOpenGLVolumeObliqueSliceDrawing.cxx.o): undefined reference to symbol 'glGetFloatv'
+  # ld: /nix/store/a5vcvrkh1c2ng5kr584g3zw3991vnhks-libGL-1.7.0/lib/libGL.so.1: error adding symbols: DSO missing from command line
+
+  nativeBuildInputs = [
+    cmake
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libGL
+    libGLU
+  ] ++ (with libsForQt5; [
+    qtbase
+  ]);
+  # note: we should be able to unvendor a few libs (ftgl, quazip, qwt) but they aren't detected properly
+
+  meta = {
+    description = "Visualization and discovery tool used to map neuroimaging data";
+    homepage = "https://www.humanconnectome.org/software/connectome-workbench";
+    license = with lib.licenses; [ gpl2Plus gpl3Plus mit ];
+    changelog = "https://github.com/Washington-University/workbench/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    mainProgram = "wb_command";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/go/goatcounter/package.nix
+++ b/pkgs/by-name/go/goatcounter/package.nix
@ -1,8 +1,10 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, testers
-, goatcounter
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  goatcounter,
+  nixosTests,
 }:

 buildGoModule rec {
@ -31,10 +33,13 @@ buildGoModule rec {
    "-X zgo.at/goatcounter/v2.Version=${src.rev}"
  ];

-  passthru.tests.version = testers.testVersion {
-    package = goatcounter;
-    command = "goatcounter version";
-    version = "v${version}";
+  passthru.tests = {
+    moduleTest = nixosTests.goatcounter;
+    version = testers.testVersion {
+      package = goatcounter;
+      command = "goatcounter version";
+      version = "v${version}";
+    };
  };

  meta = {
--- a/pkgs/by-name/go/gotree/package.nix
+++ b/pkgs/by-name/go/gotree/package.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "gotree";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "elbachir-one";
+    repo = "gt";
+    rev = "v${version}";
+    hash = "sha256-baK2pA+jVTeMy06jrn2VrQZUsMCf7wpX7gX8mnnDh3A=";
+  };
+
+  vendorHash = null;
+
+  meta = {
+    description = "Display a tree of files and directories";
+    homepage = "https://github.com/elbachir-one/gt";
+    changelog = "https://github.com/elbachir-one/gt/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    mainProgram = "gt";
+    maintainers = with lib.maintainers; [ schnow265 ];
+  };
+}
--- a/pkgs/by-name/he/hextazy/package.nix
+++ b/pkgs/by-name/he/hextazy/package.nix
@ -7,21 +7,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "hextazy";
-  version = "0.2";
+  version = "0.4";

  src = fetchFromGitHub {
-    owner = "faelian";
+    owner = "0xfalafel";
    repo = "hextazy";
    rev = "${version}";
-    hash = "sha256-e1uoKMejdTz8KH7uFkZ9YCE1WTwaxCZjcxh4g2ermNY=";
+    hash = "sha256-5ZT6oXG3dWJ8vPX0oieWQsYJQYCTwtlb1B8kmGlLv0k=";
  };

-  cargoHash = "sha256-5Z+ptr1JmeiP4hK8k+M1d189I0X53/jRUEFwgWGK3xQ=";
+  cargoHash = "sha256-n1HvkWNbHU8UUlqsCnuKESKQznk1WTe6eQiUJjVVXYE=";

  meta = {
    description = "TUI hexeditor in Rust with colored bytes";
-    homepage = "https://github.com/faelian/hextazy";
-    changelog = "https://github.com/faelian/hextazy/releases/tags/${src.rev}";
+    homepage = "https://github.com/0xfalafel/hextazy";
+    changelog = "https://github.com/0xfalafel/hextazy/releases/tags/${src.rev}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ akechishiro ];
    mainProgram = "hextazy";
--- a/pkgs/by-name/ka/karla/package.nix
+++ b/pkgs/by-name/ka/karla/package.nix
@ -0,0 +1,36 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation {
+  pname = "karla";
+  version = "2.004";
+
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = "karla";
+    rev = "69b25f663101efb4113dd7ed416c120dd2dce56a";
+    hash = "sha256-9zf2gfhSn8Aly8a2CINsNXZPRfVcaxFE9In4Qqx3Fn4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 -t $out/share/fonts/truetype fonts/ttf/*.ttf
+    install -Dm444 -t $out/share/fonts/variable fonts/variable/*.ttf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Outstanding grotesque sans serif typeface family";
+    longDescription = ''
+      Karla is an outstanding grotesque sans serif typeface
+      family created by Jonathan Pinhorn (a graduate of the
+      MA in Typeface Design at the University of Reading),
+      released through Google Webfonts in 2012.
+    '';
+    homepage = "https://github.com/googlefonts/karla";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ mimvoid ];
+  };
+}
--- a/pkgs/by-name/ma/matrix-gtk-theme/package.nix
+++ b/pkgs/by-name/ma/matrix-gtk-theme/package.nix
@ -0,0 +1,123 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  gnome,
+  sassc,
+  gnome-themes-extra,
+  gtk-engine-murrine,
+  unstableGitUpdater,
+  colorVariants ? [ ],
+  sizeVariants ? [ ],
+  themeVariants ? [ ],
+  tweakVariants ? [ ],
+  iconVariants ? [ ],
+}:
+
+let
+  pname = "matrix-gtk-theme";
+  colorVariantList = [
+    "dark"
+    "light"
+  ];
+  sizeVariantList = [
+    "compact"
+    "standard"
+  ];
+  themeVariantList = [
+    "default"
+    "green"
+    "grey"
+    "orange"
+    "pink"
+    "purple"
+    "red"
+    "teal"
+    "yellow"
+    "all"
+  ];
+  tweakVariantList = [
+    "neo"
+    "trinity"
+    "black"
+    "float"
+    "outline"
+    "macos"
+  ];
+  iconVariantList = [
+    "Dark"
+    "Light"
+    "Sweet"
+  ];
+in
+lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib.checkListOfEnum
+  "${pname}: sizeVariants"
+  sizeVariantList
+  sizeVariants
+  lib.checkListOfEnum
+  "${pname}: themeVariants"
+  themeVariantList
+  themeVariants
+  lib.checkListOfEnum
+  "${pname}: tweakVariants"
+  tweakVariantList
+  tweakVariants
+  lib.checkListOfEnum
+  "${pname}: iconVariants"
+  iconVariantList
+  iconVariants
+
+  stdenvNoCC.mkDerivation
+  {
+    inherit pname;
+    version = "0-unstable-2024-07-22";
+
+    src = fetchFromGitHub {
+      owner = "D3vil0p3r";
+      repo = "Matrix-GTK-Theme";
+      rev = "f453093dffa0f46596b325c6a760afd6ea6cd810";
+      hash = "sha256-DfM4nsJZvcNyUUn0opu3OM46sxhsjeeyuUuliQPrU0I=";
+    };
+
+    propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+    nativeBuildInputs = [
+      gnome.gnome-shell
+      sassc
+    ];
+    buildInputs = [ gnome-themes-extra ];
+
+    dontBuild = true;
+
+    passthru.updateScript = unstableGitUpdater { };
+
+    postPatch = ''
+      patchShebangs themes/install.sh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/share/themes
+      cd themes
+      ./install.sh -n Matrix \
+      ${lib.optionalString (colorVariants != [ ]) "-c " + toString colorVariants} \
+      ${lib.optionalString (sizeVariants != [ ]) "-s " + toString sizeVariants} \
+      ${lib.optionalString (themeVariants != [ ]) "-t " + toString themeVariants} \
+      ${lib.optionalString (tweakVariants != [ ]) "--tweaks " + toString tweakVariants} \
+      -d "$out/share/themes"
+      cd ../icons
+      ${lib.optionalString (iconVariants != [ ]) ''
+        mkdir -p $out/share/icons
+        cp -a ${toString (map (v: "Matrix-${v}") iconVariants)} $out/share/icons/
+      ''}
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "GTK theme based on the Matrix colour palette";
+      homepage = "https://github.com/D3vil0p3r/Matrix-GTK-Theme";
+      license = lib.licenses.gpl3Plus;
+      maintainers = with lib.maintainers; [ d3vil0p3r ];
+      platforms = lib.platforms.unix;
+    };
+  }
--- a/Show More
+++ b/Show More