Merge remote-tracking branch 'origin/staging-next' into staging

2024-11-22 06:53:01 +00:00 · 2024-09-17 21:07:02 +03:00 · 2024-09-17 21:07:02 +03:00 · 87cbfcba1c
commit 87cbfcba1c
parent e3191b8ded a452899759
58 changed files with 6203 additions and 8977 deletions
--- a/doc/languages-frameworks/dotnet.section.md
+++ b/doc/languages-frameworks/dotnet.section.md
@ -219,7 +219,7 @@ buildDotnetGlobalTool {
 ## Generating and updating NuGet dependencies {#generating-and-updating-nuget-dependencies}

 When writing a new expression, you can use the generated `fetch-deps` script to initialise the lockfile.
-After creating a blank `deps.nix` and pointing `nugetDeps` to it,
+After setting `nugetDeps` to the desired location of the lockfile (e.g. `./deps.nix`),
 build the script with `nix-build -A package.fetch-deps` and then run the result.
 (When the root attr is your package, it's simply `nix-build -A fetch-deps`.)

--- a/lib/fetchers.nix
+++ b/lib/fetchers.nix
@ -1,6 +1,17 @@
 # snippets that can be shared by multiple fetchers (pkgs/build-support)
 { lib }:
-{
+let
+  commonH = hashTypes: rec {
+      hashNames = [ "hash" ] ++ hashTypes;
+      hashSet = lib.genAttrs hashNames (lib.const {});
+  };
+
+  fakeH = {
+    hash = lib.fakeHash;
+    sha256 = lib.fakeSha256;
+    sha512 = lib.fakeSha512;
+  };
+in rec {

  proxyImpureEnvVars = [
    # We borrow these environment variables from the caller to allow
@ -14,4 +25,165 @@
    "NIX_SSL_CERT_FILE"
  ];

+  /**
+    Converts an attrset containing one of `hash`, `sha256` or `sha512`,
+    into one containing `outputHash{,Algo}` as accepted by `mkDerivation`.
+
+    An appropriate “fake hash” is substituted when the hash value is `""`,
+    as is the [convention for fetchers](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method).
+
+    All other attributes in the set remain as-is.
+
+    # Example
+
+    ```nix
+    normalizeHash { } { hash = ""; foo = "bar"; }
+    =>
+    {
+      outputHash = lib.fakeHash;
+      outputHashAlgo = null;
+      foo = "bar";
+    }
+    ```
+
+    ```nix
+    normalizeHash { } { sha256 = lib.fakeSha256; }
+    =>
+    {
+      outputHash = lib.fakeSha256;
+      outputHashAlgo = "sha256";
+    }
+    ```
+
+    ```nix
+    normalizeHash { } { sha512 = lib.fakeSha512; }
+    =>
+    {
+      outputHash = lib.fakeSha512;
+      outputHashAlgo = "sha512";
+    }
+    ```
+
+    # Type
+    ```
+    normalizeHash :: { hashTypes :: List String, required :: Bool } -> AttrSet -> AttrSet
+    ```
+
+    # Arguments
+
+    hashTypes
+    : the set of attribute names accepted as hash inputs, in addition to `hash`
+
+    required
+    : whether to throw if no hash was present in the input; otherwise returns the original input, unmodified
+  */
+  normalizeHash = {
+    hashTypes ? [ "sha256" ],
+    required ? true,
+  }:
+    let
+      inherit (lib) concatMapStringsSep head tail throwIf;
+      inherit (lib.attrsets) attrsToList intersectAttrs removeAttrs optionalAttrs;
+
+      inherit (commonH hashTypes) hashNames hashSet;
+    in
+      args:
+        if args ? "outputHash" then
+          args
+        else
+          let
+            # The argument hash, as a {name, value} pair
+            h =
+              # All hashes passed in arguments (possibly 0 or >1) as a list of {name, value} pairs
+              let hashesAsNVPairs = attrsToList (intersectAttrs hashSet args); in
+              if hashesAsNVPairs == [] then
+                throwIf required "fetcher called without `hash`" null
+              else if tail hashesAsNVPairs != [] then
+                throw "fetcher called with mutually-incompatible arguments: ${concatMapStringsSep ", " (a: a.name) hashesAsNVPairs}"
+              else
+                head hashesAsNVPairs
+            ;
+          in
+            removeAttrs args hashNames // (optionalAttrs (h != null) {
+              outputHashAlgo = if h.name == "hash" then null else h.name;
+              outputHash =
+                if h.value == "" then
+                  fakeH.${h.name} or (throw "no “fake hash” defined for ${h.name}")
+                else
+                  h.value;
+            })
+  ;
+
+  /**
+    Wraps a function which accepts `outputHash{,Algo}` into one which accepts `hash` or `sha{256,512}`
+
+    # Example
+    ```nix
+    withNormalizedHash { hashTypes = [ "sha256" "sha512" ]; } (
+      { outputHash, outputHashAlgo, ... }:
+      ...
+    )
+    ```
+    is a function which accepts one of `hash`, `sha256`, or `sha512` (or the original's `outputHash` and `outputHashAlgo`).
+
+    Its `functionArgs` metadata only lists `hash` as a parameter, optional iff. `outputHash` was an optional parameter of
+    the original function.  `sha256`, `sha512`, `outputHash`, or `outputHashAlgo` are not mentioned in the `functionArgs`
+    metadata.
+
+    # Type
+    ```
+    withNormalizedHash :: { hashTypes :: List String } -> (AttrSet -> T) -> (AttrSet -> T)
+    ```
+
+    # Arguments
+
+    hashTypes
+    : the set of attribute names accepted as hash inputs, in addition to `hash`
+    : they must correspond to a valid value for `outputHashAlgo`, currently one of: `md5`, `sha1`, `sha256`, or `sha512`.
+
+    f
+    : the function to be wrapped
+
+    ::: {.note}
+    In nixpkgs, `mkDerivation` rejects MD5 `outputHash`es, and SHA-1 is being deprecated.
+
+    As such, there is no reason to add `md5` to `hashTypes`, and
+    `sha1` should only ever be included for backwards compatibility.
+    :::
+
+    # Output
+
+    `withNormalizedHash { inherit hashTypes; } f` is functionally equivalent to
+    ```nix
+    args: f (normalizeHash {
+      inherit hashTypes;
+      required = !(lib.functionArgs f).outputHash;
+    } args)
+    ```
+
+    However, `withNormalizedHash` preserves `functionArgs` metadata insofar as possible,
+    and is implemented somewhat more efficiently.
+  */
+  withNormalizedHash = {
+    hashTypes ? [ "sha256" ]
+  }: fetcher:
+    let
+      inherit (lib.attrsets) genAttrs intersectAttrs removeAttrs;
+      inherit (lib.trivial) const functionArgs setFunctionArgs;
+
+      inherit (commonH hashTypes) hashSet;
+      fArgs = functionArgs fetcher;
+
+      normalize = normalizeHash {
+        inherit hashTypes;
+        required = !fArgs.outputHash;
+      };
+    in
+    # The o.g. fetcher must *only* accept outputHash and outputHashAlgo
+    assert fArgs ? outputHash && fArgs ? outputHashAlgo;
+    assert intersectAttrs fArgs hashSet == {};
+
+    setFunctionArgs
+      (args: fetcher (normalize args))
+      (removeAttrs fArgs [ "outputHash" "outputHashAlgo" ] // { hash = fArgs.outputHash; });
 }
--- a/lib/tests/fetchers.nix
+++ b/lib/tests/fetchers.nix
@ -0,0 +1,165 @@
+let
+  lib = import ./..;
+
+  inherit (lib)
+    fakeHash
+    fakeSha256
+    fakeSha512
+    flip
+    functionArgs
+    runTests
+    ;
+  inherit (lib.fetchers) normalizeHash withNormalizedHash;
+
+  testingThrow = expr: {
+    expr = with builtins; tryEval (seq expr "didn't throw");
+    expected = {
+      success = false;
+      value = false;
+    };
+  };
+
+  # hashes of empty
+  sri256 = "sha256-d6xi4mKdjkX2JFicDIv5niSzpyI0m/Hnm8GGAIU04kY=";
+  sri512 = "sha512-AXFyVo7jiZ5we10fxZ5E9qfPjSfqkizY2apCzORKFVYZaNhCIVbooY+J4cYST00ztLf0EjivIBPPdtIYFUMfzQ==";
+
+  unionOfDisjoints = lib.foldl lib.attrsets.unionOfDisjoint { };
+
+  genTests = n: f: {
+    "test${n}AlreadyNormalized" = {
+      expr = f { } {
+        outputHash = "";
+        outputHashAlgo = "md42";
+      };
+      expected = {
+        outputHash = "";
+        outputHashAlgo = "md42";
+      };
+    };
+
+    "test${n}EmptySha256" = {
+      expr = f { } { sha256 = ""; };
+      expected = {
+        outputHash = fakeSha256;
+        outputHashAlgo = "sha256";
+      };
+    };
+
+    "test${n}EmptySha512" = {
+      expr = f { hashTypes = [ "sha512" ]; } { sha512 = ""; };
+      expected = {
+        outputHash = fakeSha512;
+        outputHashAlgo = "sha512";
+      };
+    };
+
+    "test${n}EmptyHash" = {
+      expr = f { } { hash = ""; };
+      expected = {
+        outputHash = fakeHash;
+        outputHashAlgo = null;
+      };
+    };
+
+    "test${n}Sri256" = {
+      expr = f { } { hash = sri256; };
+      expected = {
+        outputHash = sri256;
+        outputHashAlgo = null;
+      };
+    };
+
+    "test${n}Sri512" = {
+      expr = f { } { hash = sri512; };
+      expected = {
+        outputHash = sri512;
+        outputHashAlgo = null;
+      };
+    };
+
+    "test${n}PreservesAttrs" = {
+      expr = f { } {
+        hash = "aaaa";
+        destination = "Earth";
+      };
+      expected = {
+        outputHash = "aaaa";
+        outputHashAlgo = null;
+        destination = "Earth";
+      };
+    };
+
+    "test${n}RejectsSha1ByDefault" = testingThrow (f { } { sha1 = ""; });
+    "test${n}RejectsSha512ByDefault" = testingThrow (f { } { sha512 = ""; });
+
+    "test${n}ThrowsOnMissing" = testingThrow (f { } { gibi = false; });
+  };
+in
+runTests (unionOfDisjoints [
+  (genTests "NormalizeHash" normalizeHash)
+  (genTests "WithNormalized" (
+    flip withNormalizedHash ({ outputHash, outputHashAlgo, ... }@args: args)
+  ))
+  {
+    testNormalizeNotRequiredEquivalent = {
+      expr = normalizeHash { required = false; } {
+        hash = "";
+        prof = "shadoko";
+      };
+      expected = normalizeHash { } {
+        hash = "";
+        prof = "shadoko";
+      };
+    };
+
+    testNormalizeNotRequiredPassthru = {
+      expr = normalizeHash { required = false; } { "ga bu" = "zo meu"; };
+      expected."ga bu" = "zo meu";
+    };
+
+    testOptionalArg = {
+      expr = withNormalizedHash { } (
+        {
+          outputHash ? "",
+          outputHashAlgo ? null,
+          ...
+        }@args:
+        args
+      ) { author = "Jacques Rouxel"; };
+      expected.author = "Jacques Rouxel";
+    };
+
+    testOptionalArgMetadata = {
+      expr = functionArgs (
+        withNormalizedHash { } (
+          {
+            outputHash ? "",
+            outputHashAlgo ? null,
+          }:
+          { }
+        )
+      );
+      expected.hash = true;
+    };
+
+    testPreservesArgsMetadata = {
+      expr = functionArgs (
+        withNormalizedHash { } (
+          {
+            outputHash,
+            outputHashAlgo,
+            pumping ? true,
+          }:
+          { }
+        )
+      );
+      expected = {
+        hash = false;
+        pumping = true;
+      };
+    };
+
+    testRejectsMissingHashArg = testingThrow (withNormalizedHash { } ({ outputHashAlgo }: { }));
+    testRejectsMissingAlgoArg = testingThrow (withNormalizedHash { } ({ outputHash }: { }));
+  }
+])
--- a/lib/tests/test-with-nix.nix
+++ b/lib/tests/test-with-nix.nix
@ -17,6 +17,7 @@
 pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
  buildInputs = [
    (import ./check-eval.nix)
+    (import ./fetchers.nix)
    (import ./maintainers.nix {
      inherit pkgs;
      lib = import ../.;
--- a/maintainers/scripts/update-dotnet-lockfiles.nix
+++ b/maintainers/scripts/update-dotnet-lockfiles.nix
@ -9,6 +9,7 @@
  infrastructure. Regular updates should be done through the individual packages
  update scripts.
 */
+{ startWith ? null }:
 let
  pkgs = import ../.. { config.allowAliases = false; };

@ -17,28 +18,31 @@ let
  packagesWith = cond: pkgs:
    let
      packagesWithInner = attrs:
-        lib.unique (
-          lib.concatLists (
-            lib.mapAttrsToList (name: elem:
-              let
-                result = builtins.tryEval elem;
-              in
-                if result.success then
-                  let
-                    value = result.value;
-                  in
-                    if lib.isDerivation value then
-                      lib.optional (cond value) value
-                    else
-                      if lib.isAttrs value && (value.recurseForDerivations or false || value.recurseForRelease or false) then
-                        packagesWithInner value
-                      else []
-                else []) attrs));
+        lib.concatLists (
+          lib.mapAttrsToList (name: elem:
+            let
+              result = builtins.tryEval elem;
+            in
+              if result.success then
+                let
+                  value = result.value;
+                in
+                  if lib.isDerivation value then
+                    lib.optional (cond value) value
+                  else
+                    if lib.isAttrs value && (value.recurseForDerivations or false || value.recurseForRelease or false) then
+                      packagesWithInner value
+                    else []
+              else []) attrs);
    in
      packagesWithInner pkgs;

-  packages =
-    packagesWith (pkgs: pkgs ? fetch-deps) pkgs;
+  packages = lib.unique
+    (lib.filter (p:
+      (builtins.tryEval p.outPath).success ||
+      builtins.trace "warning: skipping ${p.name} because it failed to evaluate" false)
+    ((pkgs: (lib.drop (lib.lists.findFirstIndex (p: p.name == startWith) 0 pkgs) pkgs))
+    (packagesWith (p: p ? fetch-deps) pkgs)));

  helpText = ''
    Please run:
--- a/nixos/modules/services/development/livebook.nix
+++ b/nixos/modules/services/development/livebook.nix
@ -46,7 +46,7 @@ in
      type = with lib.types; nullOr lib.types.path;
      default = null;
      description = ''
-        Additional dnvironment file as defined in {manpage}`systemd.exec(5)`.
+        Additional environment file as defined in {manpage}`systemd.exec(5)`.

        Secrets like {env}`LIVEBOOK_PASSWORD` (which is used to specify the
        password needed to access the livebook site) or {env}`LIVEBOOK_COOKIE`
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@ -235,7 +235,7 @@ in {
            };

            channel = mkOption {
-              default = 7;
+              default = 0;
              example = 11;
              type = types.int;
              description = ''
--- a/pkgs/applications/audio/openutau/default.nix
+++ b/pkgs/applications/audio/openutau/default.nix
@ -22,6 +22,10 @@ buildDotnetModule rec {
  dotnet-sdk = dotnetCorePackages.sdk_7_0;
  dotnet-runtime = dotnetCorePackages.runtime_7_0;

+  # [...]/Microsoft.NET.Sdk.targets(157,5): error MSB4018: The "GenerateDepsFile" task failed unexpectedly. [[...]/OpenUtau.Core.csproj]
+  # [...]/Microsoft.NET.Sdk.targets(157,5): error MSB4018: System.IO.IOException: The process cannot access the file '[...]/OpenUtau.Core.deps.json' because it is being used by another process. [[...]/OpenUtau.Core.csproj]
+  enableParallelBuilding = false;
+
  projectFile = "OpenUtau.sln";
  nugetDeps = ./deps.nix;

--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -64,7 +64,7 @@ let
      ;
  };
  fBuildAttrs = fArgs // buildAttrs;
-  fFetchAttrs = fArgs // removeAttrs fetchAttrs [ "sha256" ];
+  fFetchAttrs = fArgs // removeAttrs fetchAttrs [ "hash" "sha256" ];
  bazelCmd = { cmd, additionalFlags, targets, targetRunFlags ? [ ] }:
    lib.optionalString (targets != [ ]) ''
      # See footnote called [USER and BAZEL_USE_CPP_ONLY_TOOLCHAIN variables]
@ -197,8 +197,10 @@ stdenv.mkDerivation (fBuildAttrs // {
    dontFixup = true;
    allowedRequisites = [];

-    outputHashAlgo = "sha256";
-    outputHash = fetchAttrs.sha256;
+    inherit (lib.fetchers.normalizeHash { hashTypes = [ "sha256" ]; } fetchAttrs)
+      outputHash
+      outputHashAlgo
+    ;
  });

  nativeBuildInputs = fBuildAttrs.nativeBuildInputs or [] ++ [ (bazel.override { enableNixHacks = true; }) ];
--- a/pkgs/build-support/dotnet/add-nuget-deps/default.nix
+++ b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
@ -0,0 +1,108 @@
+{
+  writeShellScript,
+  runtimeShell,
+  nix,
+  lib,
+  substituteAll,
+  nuget-to-nix,
+  cacert,
+  fetchNupkg,
+  callPackage,
+}:
+
+{
+  nugetDeps,
+  overrideFetchAttrs ? x: { },
+}:
+fnOrAttrs: finalAttrs:
+let
+  attrs = if builtins.isFunction fnOrAttrs then fnOrAttrs finalAttrs else fnOrAttrs;
+
+  deps =
+    if (nugetDeps != null) then
+      if lib.isDerivation nugetDeps then
+        [ nugetDeps ]
+      else if lib.isList nugetDeps then
+        nugetDeps
+      else
+        assert (lib.isPath nugetDeps);
+        callPackage nugetDeps { fetchNuGet = fetchNupkg; }
+    else
+      [ ];
+
+  finalPackage = finalAttrs.finalPackage;
+
+in
+attrs
+// {
+  buildInputs = attrs.buildInputs or [ ] ++ deps;
+
+  passthru =
+    attrs.passthru or { }
+    // {
+      nugetDeps = deps;
+    }
+    // lib.optionalAttrs (nugetDeps == null || lib.isPath nugetDeps) rec {
+      fetch-drv =
+        let
+          pkg' = finalPackage.overrideAttrs (old: {
+            buildInputs = attrs.buildInputs or [ ];
+            nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ cacert ];
+            keepNugetConfig = true;
+            dontBuild = true;
+            doCheck = false;
+            dontInstall = true;
+            doInstallCheck = false;
+            dontFixup = true;
+            doDist = false;
+          });
+        in
+        pkg'.overrideAttrs overrideFetchAttrs;
+      fetch-deps =
+        let
+          drv = builtins.unsafeDiscardOutputDependency fetch-drv.drvPath;
+
+          innerScript = substituteAll {
+            src = ./fetch-deps.sh;
+            isExecutable = true;
+            inherit cacert;
+            nugetToNix = nuget-to-nix;
+          };
+
+          defaultDepsFile =
+            # Wire in the depsFile such that running the script with no args
+            # runs it agains the correct deps file by default.
+            # Note that toString is necessary here as it results in the path at
+            # eval time (i.e. to the file in your local Nixpkgs checkout) rather
+            # than the Nix store path of the path after it's been imported.
+            if lib.isPath nugetDeps && !lib.isStorePath nugetDeps then
+              toString nugetDeps
+            else
+              ''$(mktemp -t "${finalAttrs.pname or finalPackage.name}-deps-XXXXXX.nix")'';
+
+        in
+        writeShellScript "${finalPackage.name}-fetch-deps" ''
+          set -eu
+
+          echo 'fetching dependencies for' ${lib.escapeShellArg finalPackage.name} >&2
+
+          # this needs to be before TMPDIR is changed, so the output isn't deleted
+          # if it uses mktemp
+          depsFile=$(realpath "''${1:-${lib.escapeShellArg defaultDepsFile}}")
+
+          export TMPDIR
+          TMPDIR=$(mktemp -d -t fetch-deps-${lib.escapeShellArg finalPackage.name}.XXXXXX)
+          trap 'chmod -R +w "$TMPDIR" && rm -fr "$TMPDIR"' EXIT
+
+          export NUGET_HTTP_CACHE_PATH=''${NUGET_HTTP_CACHE_PATH-~/.local/share/NuGet/v3-cache}
+
+          HOME=$TMPDIR/home
+          mkdir "$HOME"
+
+          cd "$TMPDIR"
+
+          NIX_BUILD_SHELL=${lib.escapeShellArg runtimeShell} ${nix}/bin/nix-shell \
+            --pure --keep NUGET_HTTP_CACHE_PATH --run 'source '${lib.escapeShellArg innerScript}' '"''${depsFile@Q}" "${drv}"
+        '';
+    };
+}
--- a/pkgs/build-support/dotnet/add-nuget-deps/fetch-deps.sh
+++ b/pkgs/build-support/dotnet/add-nuget-deps/fetch-deps.sh
@ -0,0 +1,11 @@
+set -e
+
+genericBuild
+
+(
+    echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n"
+    @nugetToNix@/bin/nuget-to-nix "${NUGET_PACKAGES%/}"
+) > deps.nix
+
+mv deps.nix "$1"
+echo "Succesfully wrote lockfile to $1"
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@ -7,12 +7,8 @@
  writeShellScript,
  makeWrapper,
  dotnetCorePackages,
-  fetchNupkg,
-  nuget-to-nix,
  cacert,
-  unzip,
-  yq,
-  nix,
+  addNuGetDeps,
 }:
 let
  transformArgs =
@ -109,39 +105,9 @@ let
        dotnetFixupHook
        ;

-      _nugetDeps =
-        if (nugetDeps != null) then
-          if lib.isDerivation nugetDeps then
-            [ nugetDeps ]
-          else if lib.isList nugetDeps then
-            nugetDeps
-          else
-            assert (lib.isPath nugetDeps);
-            callPackage nugetDeps { fetchNuGet = fetchNupkg; }
-        else
-          [ ];
-
-      nugetDepsFile = if lib.isPath nugetDeps then nugetDeps else null;
-
      inherit (dotnetCorePackages) systemToDotnetRid;
    in
-    # Not all args need to be passed through to mkDerivation
-    # TODO: We should probably filter out even more attrs
-    removeAttrs args [
-      "nugetDeps"
-      "installPath"
-      "executables"
-      "projectFile"
-      "projectReferences"
-      "runtimeDeps"
-      "runtimeId"
-      "disabledTests"
-      "testProjectFile"
-      "buildType"
-      "selfContainedBuild"
-      "useDotnet"
-      "useAppHost"
-    ]
+    args
    // {
      dotnetInstallPath = installPath;
      dotnetExecutables = executables;
@ -167,6 +133,8 @@ let
        dotnetFlags
        packNupkg
        useDotnetFromEnv
+        nugetDeps
+        runtimeId
        ;

      nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
@ -179,11 +147,14 @@ let
        cacert
        makeWrapper
        dotnet-sdk
-        unzip
-        yq
      ];

-      buildInputs = args.buildInputs or [ ] ++ [ dotnet-sdk.packages ] ++ _nugetDeps ++ projectReferences;
+      buildInputs =
+        args.buildInputs or [ ]
+        ++ [
+          dotnet-sdk.packages
+        ]
+        ++ projectReferences;

      # Parse the version attr into a format acceptable for the Version msbuild property
      # The actual version attr is saved in InformationalVersion, which accepts an arbitrary string
@ -223,60 +194,45 @@ let
      # executables
      propagatedSandboxProfile = toString dotnet-runtime.__propagatedSandboxProfile;

-      passthru =
-        {
-          nugetDeps = _nugetDeps;
-        }
-        // lib.optionalAttrs (nugetDeps == null || lib.isPath nugetDeps) {
-          fetch-deps =
-            let
-              pkg = finalAttrs.finalPackage.overrideAttrs (
-                old:
-                {
-                  buildInputs = lib.subtractLists _nugetDeps old.buildInputs;
-                  keepNugetConfig = true;
-                }
-                // lib.optionalAttrs (runtimeId == null) {
-                  dotnetRuntimeIds = map (system: systemToDotnetRid system) platforms;
-                }
-              );
-
-              drv = builtins.unsafeDiscardOutputDependency pkg.drvPath;
-
-              innerScript = substituteAll {
-                src = ./fetch-deps.sh;
-                isExecutable = true;
-                defaultDepsFile =
-                  # Wire in the nugetDeps file such that running the script with no args
-                  # runs it agains the correct deps file by default.
-                  # Note that toString is necessary here as it results in the path at
-                  # eval time (i.e. to the file in your local Nixpkgs checkout) rather
-                  # than the Nix store path of the path after it's been imported.
-                  if lib.isPath nugetDeps && !lib.isStorePath nugetDepsFile then
-                    toString nugetDepsFile
-                  else
-                    ''$(mktemp -t "${finalAttrs.pname or finalAttrs.finalPackage.name}-deps-XXXXXX.nix")'';
-                nugetToNix = (nuget-to-nix.override { inherit dotnet-sdk; });
-              };
-
-            in
-            writeShellScript "${finalAttrs.finalPackage.name}-fetch-deps" ''
-              NIX_BUILD_SHELL="${runtimeShell}" exec ${nix}/bin/nix-shell \
-                --pure --run 'source "${innerScript}"' "${drv}"
-            '';
-        }
-        // args.passthru or { };
-
      meta = (args.meta or { }) // {
        inherit platforms;
      };
    };
+
 in
 fnOrAttrs:
 stdenvNoCC.mkDerivation (
  finalAttrs:
  let
-    args = if lib.isFunction fnOrAttrs then fnOrAttrs (args // finalAttrs) else fnOrAttrs;
+    args = if lib.isFunction fnOrAttrs then fnOrAttrs (args' // finalAttrs) else fnOrAttrs;
+    args' = transformArgs finalAttrs args;
+    inherit (args') nugetDeps runtimeId meta;
+    args'' = removeAttrs args' [
+      "nugetDeps"
+      "runtimeId"
+      "installPath"
+      "executables"
+      "projectFile"
+      "projectReferences"
+      "runtimeDeps"
+      "runtimeId"
+      "disabledTests"
+      "testProjectFile"
+      "buildType"
+      "selfContainedBuild"
+      "useDotnet"
+      "useAppHost"
+    ];
  in
-  transformArgs finalAttrs args
+  if nugetDeps != null then
+    addNuGetDeps {
+      inherit nugetDeps;
+      overrideFetchAttrs =
+        a:
+        lib.optionalAttrs ((args'.runtimeId or null) == null) {
+          dotnetRuntimeIds = map (system: dotnetCorePackages.systemToDotnetRid system) meta.platforms;
+        };
+    } args'' finalAttrs
+  else
+    args''
 )
--- a/pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh
@ -1,24 +0,0 @@
-set -e
-
-tmp=$(mktemp -d)
-trap 'chmod -R +w "$tmp" && rm -fr "$tmp"' EXIT
-
-HOME=$tmp/.home
-export TMPDIR="$tmp/.tmp"
-mkdir "$HOME" "$TMPDIR"
-cd "$tmp"
-
-phases="
-    ${prePhases[*]:-}
-    unpackPhase
-    patchPhase
-    ${preConfigurePhases[*]:-}
-    configurePhase
-" genericBuild
-
-depsFile=$(realpath "${1:-@defaultDepsFile@}")
-tmpFile="$tmp"/deps.nix
-echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n" > "$tmpFile"
-@nugetToNix@/bin/nuget-to-nix "$NUGET_PACKAGES" >> "$tmpFile"
-mv "$tmpFile" "$depsFile"
-echo "Succesfully wrote lockfile to $depsFile"
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
@ -38,18 +38,6 @@ dotnetConfigureHook() {
        done
    }

-    find -iname nuget.config -print0 | while IFS= read -rd "" config; do
-        if [[ -n "${keepNugetConfig-}" ]]; then
-            # If we're keeping the existing configs, we'll add _nix everywhere,
-            # in case sources are cleared.
-            dotnet nuget add source "$nugetSource" -n _nix --configfile "$config"
-        else
-            # This will allow everything to fall through to our config in the
-            # build root. Deleting them causes some build failures.
-            xq -xi '.configuration={}' "$config"
-        fi
-    done
-
    if [[ -f .config/dotnet-tools.json || -f dotnet-tools.json ]]; then
        dotnet tool restore
    fi
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
@ -62,8 +62,6 @@ dotnetFromEnv'
 }

 dotnetFixupHook() {
-    echo "Executing dotnetFixupPhase"
-
    local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"

    local executable executableBasename
@ -94,10 +92,8 @@ dotnetFixupHook() {
            wrapDotnetProgram "$executable" "$out/bin/$executableBasename" \;
        done < <(find "$dotnetInstallPath" ! -name "*.dll" -executable -type f -print0)
    fi
-
-    echo "Finished dotnetFixupPhase"
 }

-if [[ -z "${dontDotnetFixup-}" ]]; then
+if [[ -z "${dontFixup-}" && -z "${dontDotnetFixup-}" ]]; then
    preFixupPhases+=" dotnetFixupHook"
 fi
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
@ -62,8 +62,6 @@ dotnetInstallHook() {
        done
    }

-    local -r pkgs=$PWD/.nuget-pack
-
    dotnetPack() {
        local -r projectFile="${1-}"

@ -73,7 +71,7 @@ dotnetInstallHook() {
                   -p:ContinuousIntegrationBuild=true \
                   -p:Deterministic=true \
                   -p:OverwriteReadOnlyFiles=true \
-                   --output "$pkgs" \
+                   --output "$out/share/nuget/source" \
                   --configuration "$dotnetBuildType" \
                   --no-build \
                   --runtime "$runtimeId" \
@ -102,20 +100,6 @@ dotnetInstallHook() {
        fi
    fi

-    local -r unpacked="$pkgs/.unpacked"
-    for nupkg in "$pkgs"/*.nupkg; do
-        rm -rf "$unpacked"
-        unzip -qd "$unpacked" "$nupkg"
-        chmod -R +rw "$unpacked"
-        echo {} > "$unpacked"/.nupkg.metadata
-        local id version
-        id=$(xq -r '.package.metadata.id|ascii_downcase' "$unpacked"/*.nuspec)
-        version=$(xq -r '.package.metadata.version|ascii_downcase' "$unpacked"/*.nuspec)
-        mkdir -p "$out/share/nuget/packages/$id"
-        mv "$unpacked" "$out/share/nuget/packages/$id/$version"
-        # TODO: should we fix executable flags here?
-    done
-
    runHook postInstall

    echo "Finished dotnetInstallHook"
--- a/pkgs/build-support/dotnet/fetch-nupkg/default.nix
+++ b/pkgs/build-support/dotnet/fetch-nupkg/default.nix
@ -43,8 +43,7 @@ let
    unpackPhase = ''
      runHook preUnpack

-      unzip -nqd source $src
-      chmod -R +rw source
+      unpackNupkg "$src" source
      cd source

      runHook postUnpack
@ -75,6 +74,13 @@ let
    '';

    createInstallableNugetSource = installable;
+
+    meta = {
+      sourceProvenance = with lib.sourceTypes; [
+        binaryBytecode
+        binaryNativeCode
+      ];
+    };
  };
 in
 overrides.${pname} or lib.id package
--- a/pkgs/build-support/dotnet/nuget-to-nix/default.nix
+++ b/pkgs/build-support/dotnet/nuget-to-nix/default.nix
@ -5,27 +5,26 @@
 , nix
 , coreutils
 , jq
-, yq
+, xmlstarlet
 , curl
 , gnugrep
 , gawk
-, dotnet-sdk
+, cacert
 }:

 runCommandLocal "nuget-to-nix" {
  script = substituteAll {
    src = ./nuget-to-nix.sh;
-    inherit runtimeShell;
+    inherit runtimeShell cacert;

    binPath = lib.makeBinPath [
      nix
      coreutils
      jq
-      yq
+      xmlstarlet
      curl
      gnugrep
      gawk
-      dotnet-sdk
    ];
  };

--- a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@ -3,7 +3,8 @@
 set -euo pipefail
 shopt -s nullglob

-export PATH="@binPath@"
+export SSL_CERT_FILE=@cacert@/etc/ssl/certs/ca-bundle.crt
+export PATH="@binPath@:$PATH"
 # used for glob ordering of package names
 export LC_ALL=C

@ -50,7 +51,7 @@ for package in *; do
  [[ -d "$package" ]] || continue
  cd "$package"
  for version in *; do
-    id=$(xq -r .package.metadata.id "$version"/*.nuspec)
+    id=$(xmlstarlet sel -t -v /_:package/_:metadata/_:id "$version"/*.nuspec)

    if grep -qxF "$id.$version.nupkg" "$excluded_list"; then
      continue
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@ -10,8 +10,9 @@
    appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}";
  in "${if matched == null then base else builtins.head matched}${appendShort}";
 in
-lib.makeOverridable (
-{ url, rev ? "HEAD", sha256 ? "", hash ? "", leaveDotGit ? deepClone
+lib.makeOverridable (lib.fetchers.withNormalizedHash { } (
+{ url, rev ? "HEAD", leaveDotGit ? deepClone
+, outputHash ? lib.fakeHash, outputHashAlgo ? null
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
 , sparseCheckout ? []
@ -56,9 +57,7 @@ lib.makeOverridable (
 assert deepClone -> leaveDotGit;
 assert nonConeMode -> (sparseCheckout != []);

-if hash != "" && sha256 != "" then
-  throw "Only one of sha256 or hash can be set"
-else if builtins.isString sparseCheckout then
+if builtins.isString sparseCheckout then
  # Changed to throw on 2023-06-04
  throw "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
 else
@ -70,14 +69,8 @@ stdenvNoCC.mkDerivation {
  nativeBuildInputs = [ git cacert ]
    ++ lib.optionals fetchLFS [ git-lfs ];

-  outputHashAlgo = if hash != "" then null else "sha256";
+  inherit outputHash outputHashAlgo;
  outputHashMode = "recursive";
-  outputHash = if hash != "" then
-    hash
-  else if sha256 != "" then
-    sha256
-  else
-    lib.fakeSha256;

  # git-sparse-checkout(1) says:
  # > When the --stdin option is provided, the directories or patterns are read
@ -105,4 +98,4 @@ stdenvNoCC.mkDerivation {
    gitRepoUrl = url;
  };
 }
-)
+))
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@ -1,83 +1,83 @@
 { lib, stdenvNoCC, gitRepo, cacert, copyPathsToStore }:
+lib.fetchers.withNormalizedHash { } (
+  { name, manifest, rev ? "HEAD", outputHash, outputHashAlgo
+  # Optional parameters:
+  , repoRepoURL ? "", repoRepoRev ? "", referenceDir ? "", manifestName ? ""
+  , localManifests ? [], createMirror ? false, useArchive ? false
+  }:

-{ name, manifest, rev ? "HEAD", sha256
-# Optional parameters:
-, repoRepoURL ? "", repoRepoRev ? "", referenceDir ? "", manifestName ? ""
-, localManifests ? [], createMirror ? false, useArchive ? false
-}:
+  assert repoRepoRev != "" -> repoRepoURL != "";
+  assert createMirror -> !useArchive;

-assert repoRepoRev != "" -> repoRepoURL != "";
-assert createMirror -> !useArchive;
+  let
+    inherit (lib)
+      concatMapStringsSep
+      concatStringsSep
+      fetchers
+      optionalString
+      ;

-let
-  inherit (lib)
-    concatMapStringsSep
-    concatStringsSep
-    fetchers
-    optionalString
-    ;
+    extraRepoInitFlags = [
+      (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
+      (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
+      (optionalString (referenceDir != "") "--reference=${referenceDir}")
+      (optionalString (manifestName != "") "--manifest-name=${manifestName}")
+    ];

-  extraRepoInitFlags = [
-    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
-    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
-    (optionalString (referenceDir != "") "--reference=${referenceDir}")
-    (optionalString (manifestName != "") "--manifest-name=${manifestName}")
-  ];
+    repoInitFlags = [
+      "--manifest-url=${manifest}"
+      "--manifest-branch=${rev}"
+      "--depth=1"
+      (optionalString createMirror "--mirror")
+      (optionalString useArchive "--archive")
+    ] ++ extraRepoInitFlags;

-  repoInitFlags = [
-    "--manifest-url=${manifest}"
-    "--manifest-branch=${rev}"
-    "--depth=1"
-    (optionalString createMirror "--mirror")
-    (optionalString useArchive "--archive")
-  ] ++ extraRepoInitFlags;
+    local_manifests = copyPathsToStore localManifests;

-  local_manifests = copyPathsToStore localManifests;
+  in stdenvNoCC.mkDerivation {
+    inherit name;

-in stdenvNoCC.mkDerivation {
-  inherit name;
+    inherit cacert manifest rev repoRepoURL repoRepoRev referenceDir; # TODO

-  inherit cacert manifest rev repoRepoURL repoRepoRev referenceDir; # TODO
+    inherit outputHash outputHashAlgo;
+    outputHashMode = "recursive";

-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
+    preferLocalBuild = true;
+    enableParallelBuilding = true;

-  preferLocalBuild = true;
-  enableParallelBuilding = true;
+    impureEnvVars = fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND" "SOCKS_SERVER"
+    ];

-  impureEnvVars = fetchers.proxyImpureEnvVars ++ [
-    "GIT_PROXY_COMMAND" "SOCKS_SERVER"
-  ];
+    nativeBuildInputs = [ gitRepo cacert ];

-  nativeBuildInputs = [ gitRepo cacert ];
+    GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";

-  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    buildCommand = ''
+      # Path must be absolute (e.g. for GnuPG: ~/.repoconfig/gnupg/pubring.kbx)
+      export HOME="$(pwd)"

-  buildCommand = ''
-    # Path must be absolute (e.g. for GnuPG: ~/.repoconfig/gnupg/pubring.kbx)
-    export HOME="$(pwd)"
+      mkdir $out
+      cd $out

-    mkdir $out
-    cd $out
+      mkdir .repo
+      ${optionalString (local_manifests != []) ''
+        mkdir .repo/local_manifests
+        for local_manifest in ${concatMapStringsSep " " toString local_manifests}; do
+          cp $local_manifest .repo/local_manifests/$(stripHash $local_manifest)
+        done
+      ''}

-    mkdir .repo
-    ${optionalString (local_manifests != []) ''
-      mkdir .repo/local_manifests
-      for local_manifest in ${concatMapStringsSep " " toString local_manifests}; do
-        cp $local_manifest .repo/local_manifests/$(stripHash $local_manifest)
-      done
-    ''}
+      repo init ${concatStringsSep " " repoInitFlags}
+      repo sync --jobs=$NIX_BUILD_CORES --current-branch

-    repo init ${concatStringsSep " " repoInitFlags}
-    repo sync --jobs=$NIX_BUILD_CORES --current-branch
-
-    # TODO: The git-index files (and probably the files in .repo as well) have
-    # different contents each time and will therefore change the final hash
-    # (i.e. creating a mirror probably won't work).
-    ${optionalString (!createMirror) ''
-      rm -rf .repo
-      find -type d -name '.git' -prune -exec rm -rf {} +
-    ''}
-  '';
-}
+      # TODO: The git-index files (and probably the files in .repo as well) have
+      # different contents each time and will therefore change the final hash
+      # (i.e. creating a mirror probably won't work).
+      ${optionalString (!createMirror) ''
+        rm -rf .repo
+        find -type d -name '.git' -prune -exec rm -rf {} +
+      ''}
+    '';
+  }
+)
--- a/pkgs/by-name/am/amdvlk/package.nix
+++ b/pkgs/by-name/am/amdvlk/package.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    name = "amdvlk-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${finalAttrs.version}";
-    sha256 = "1Svdr93ShjhaWJUTLn5y1kBM4hHey1dUVDiHqFIKgrU=";
+    hash = "sha256-1Svdr93ShjhaWJUTLn5y1kBM4hHey1dUVDiHqFIKgrU=";
  };

  buildInputs =
--- a/pkgs/by-name/av/avalonia/0001-use-files-for-unicode-character-database.patch
+++ b/pkgs/by-name/av/avalonia/0001-use-files-for-unicode-character-database.patch
@ -0,0 +1,137 @@
+From f4c599a48d153d15ccb1879ff511617c8e310515 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Sat, 10 Aug 2024 23:14:12 -0300
+Subject: [PATCH 1/2] use files for unicode character database
+
+---
+ .../BiDiClassTestDataGenerator.cs             |  1 -
+ .../TextFormatting/BiDiTestDataGenerator.cs   |  1 -
+ .../GraphemeBreakClassTrieGenerator.cs        |  1 -
+ .../GraphemeBreakTestDataGenerator.cs         |  1 -
+ .../LineBreakEnumuratorTests.cs               |  1 -
+ .../TextFormatting/UnicodeDataGenerator.cs    | 28 +++++++++++++++++--
+ .../TextFormatting/UnicodeEnumsGenerator.cs   |  1 -
+ 7 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiClassTestDataGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiClassTestDataGenerator.cs
+index f6b01d737..bc7278ef8 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiClassTestDataGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiClassTestDataGenerator.cs
+@@ -3,7 +3,6 @@
+ using System.Collections.Generic;
+ using System.IO;
+ using System.Linq;
+-using System.Net.Http;
+ using Avalonia.Base.UnitTests.Media.TextFormatting;
+ 
+ namespace Avalonia.Visuals.UnitTests.Media.TextFormatting
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiTestDataGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiTestDataGenerator.cs
+index 28d37130a..5e26edf49 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiTestDataGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/BiDiTestDataGenerator.cs
+@@ -3,7 +3,6 @@
+ using System.Collections.Generic;
+ using System.IO;
+ using System.Linq;
+-using System.Net.Http;
+ using Avalonia.Base.UnitTests.Media.TextFormatting;
+ using Avalonia.Media.TextFormatting.Unicode;
+ 
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakClassTrieGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakClassTrieGenerator.cs
+index 1a8d41caa..185b6ea62 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakClassTrieGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakClassTrieGenerator.cs
+@@ -1,7 +1,6 @@
+ using System;
+ using System.Collections.Generic;
+ using System.IO;
+-using System.Net.Http;
+ using System.Text.RegularExpressions;
+ using Avalonia.Media.TextFormatting.Unicode;
+ 
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakTestDataGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakTestDataGenerator.cs
+index 029f8e236..44c2aaf6a 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakTestDataGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/GraphemeBreakTestDataGenerator.cs
+@@ -3,7 +3,6 @@
+ using System.Collections.Generic;
+ using System.IO;
+ using System.Linq;
+-using System.Net.Http;
+ using Avalonia.Base.UnitTests.Media.TextFormatting;
+ 
+ namespace Avalonia.Visuals.UnitTests.Media.TextFormatting
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/LineBreakEnumuratorTests.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/LineBreakEnumuratorTests.cs
+index 3db9a32b6..b8df1f446 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/LineBreakEnumuratorTests.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/LineBreakEnumuratorTests.cs
+@@ -3,7 +3,6 @@
+ using System.Collections.Generic;
+ using System.IO;
+ using System.Linq;
+-using System.Net.Http;
+ using Avalonia.Media.TextFormatting;
+ using Avalonia.Media.TextFormatting.Unicode;
+ using Xunit;
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeDataGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeDataGenerator.cs
+index f05a1e574..7e698ae0a 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeDataGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeDataGenerator.cs
+@@ -1,16 +1,40 @@
+ using System;
+ using System.Collections.Generic;
+ using System.IO;
+-using System.Net.Http;
+ using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+ using Avalonia.Media.TextFormatting.Unicode;
+ using Xunit;
+ 
+ namespace Avalonia.Base.UnitTests.Media.TextFormatting
+ {
+    class HttpContent : IDisposable {
+        readonly string url;
+        public HttpContent(string url) => this.url = url;
+
+        public void Dispose() {}
+        public Task<Stream> ReadAsStreamAsync() =>
+            Task.FromResult<Stream>(File.OpenRead(url));
+    }
+
+    class HttpResponseMessage : IDisposable {
+        HttpContent content;
+        public HttpResponseMessage(string url) => Content = new(url);
+
+        public void Dispose() {}
+        public bool IsSuccessStatusCode => true;
+        public HttpContent Content { get; init; }
+    }
+
+    class HttpClient : IDisposable {
+        public void Dispose() {}
+        public Task<HttpResponseMessage> GetAsync(string url) =>
+            Task.FromResult<HttpResponseMessage>(new (url));
+    }
+
+     internal static class UnicodeDataGenerator
+     {
+-        public const string Ucd = "https://www.unicode.org/Public/15.0.0/ucd/";
+        public static readonly string Ucd = Environment.GetEnvironmentVariable("UNICODE_CHARACTER_DATABASE");
+ 
+         public static UnicodeTrie GenerateBiDiTrie(out BiDiDataEntries biDiDataEntries, out Dictionary<int, BiDiDataItem> biDiData)
+         {
+diff --git a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeEnumsGenerator.cs b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeEnumsGenerator.cs
+index 110e57cbd..7073ea508 100644
+--- a/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeEnumsGenerator.cs
+++ b/tests/Avalonia.Base.UnitTests/Media/TextFormatting/UnicodeEnumsGenerator.cs
+@@ -2,7 +2,6 @@
+ using System.Collections.Generic;
+ using System.IO;
+ using System.Linq;
+-using System.Net.Http;
+ 
+ namespace Avalonia.Base.UnitTests.Media.TextFormatting
+ {
+-- 
+2.42.2
+
--- a/pkgs/by-name/av/avalonia/0002-disable-parallel-compile.patch
+++ b/pkgs/by-name/av/avalonia/0002-disable-parallel-compile.patch
@ -0,0 +1,38 @@
+From 9ba51df4258d0dc2fe72d4f621d29073eeadc011 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Sun, 11 Aug 2024 00:03:36 -0300
+Subject: [PATCH 2/2] disable parallel compile
+
+---
+ nukebuild/Build.cs | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/nukebuild/Build.cs b/nukebuild/Build.cs
+index e3d5139bf..ce50db574 100644
+--- a/nukebuild/Build.cs
+++ b/nukebuild/Build.cs
+@@ -136,12 +136,20 @@ DotNetConfigHelper ApplySettingCore(DotNetConfigHelper c)
+             ProcessTasks.StartProcess("xcodebuild", args).AssertZeroExitCode();
+         });
+ 
+    [Serializable]
+    public class SerialBuildSettings : DotNetBuildSettings
+    {
+        protected override Arguments ConfigureProcessArguments(Arguments arguments) =>
+            base.ConfigureProcessArguments(arguments)
+                .Add("-m:1");
+    }
+
+     Target Compile => _ => _
+         .DependsOn(Clean, CompileNative)
+         .DependsOn(CompileHtmlPreviewer)
+         .Executes(() =>
+         {
+-            DotNetBuild(c => ApplySetting(c)
+            DotNetBuild(ApplySetting(new SerialBuildSettings())
+                 .SetProjectFile(Parameters.MSBuildSolution)
+             );
+         });
+-- 
+2.42.2
+
--- a/pkgs/by-name/av/avalonia/deps.nix
+++ b/pkgs/by-name/av/avalonia/deps.nix
--- a/pkgs/by-name/av/avalonia/npm-deps.nix
+++ b/pkgs/by-name/av/avalonia/npm-deps.nix
@ -0,0 +1,14 @@
+[
+  {
+    path = "src/Avalonia.DesignerSupport/Remote/HtmlTransport/webapp";
+    hash = "sha256-gncHW5SMtAUMtvHGZ2nUc0KEjxX24DZkAnmeHgo1Roc=";
+  }
+  {
+    path = "tests/Avalonia.DesignerSupport.Tests/Remote/HtmlTransport/webapp";
+    hash = "sha256-MiznlOJ+hIO1cUswy9oGNHP6MWfx+FDLKVT8qcmg8vo=";
+  }
+  {
+    path = "src/Browser/Avalonia.Browser/webapp";
+    hash = "sha256-LTQzT4ycLyGQs9T0sa2k/0wfG1GWCdeH9Wx2KeecOyU=";
+  }
+]
--- a/pkgs/by-name/av/avalonia/nuget-packages.json
+++ b/pkgs/by-name/av/avalonia/nuget-packages.json
@ -0,0 +1,996 @@
+[
+  {
+    "id": "Avalonia",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": ".NETFramework,Version=v4.6.1",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Microsoft.Bcl.AsyncInterfaces",
+            "version": "6.0.0"
+          },
+          {
+            "id": "System.ComponentModel.Annotations",
+            "version": "4.5.0"
+          },
+          {
+            "id": "System.Memory",
+            "version": "4.5.3"
+          },
+          {
+            "id": "System.Runtime.CompilerServices.Unsafe",
+            "version": "4.6.0"
+          },
+          {
+            "id": "System.Threading.Tasks.Extensions",
+            "version": "4.5.4"
+          },
+          {
+            "id": "System.ValueTuple",
+            "version": "4.5.0"
+          },
+          {
+            "id": "MicroCom.Runtime",
+            "version": "0.11.0"
+          }
+        ]
+      },
+      {
+        "framework": ".NETCoreApp,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Microsoft.Bcl.AsyncInterfaces",
+            "version": "6.0.0"
+          },
+          {
+            "id": "System.ComponentModel.Annotations",
+            "version": "4.5.0"
+          },
+          {
+            "id": "System.Memory",
+            "version": "4.5.3"
+          },
+          {
+            "id": "System.Runtime.CompilerServices.Unsafe",
+            "version": "4.6.0"
+          },
+          {
+            "id": "System.Threading.Tasks.Extensions",
+            "version": "4.5.4"
+          },
+          {
+            "id": "System.ValueTuple",
+            "version": "4.5.0"
+          },
+          {
+            "id": "MicroCom.Runtime",
+            "version": "0.11.0"
+          }
+        ]
+      },
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "System.ComponentModel.Annotations",
+            "version": "4.5.0"
+          },
+          {
+            "id": "MicroCom.Runtime",
+            "version": "0.11.0"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Microsoft.Bcl.AsyncInterfaces",
+            "version": "6.0.0"
+          },
+          {
+            "id": "System.ComponentModel.Annotations",
+            "version": "4.5.0"
+          },
+          {
+            "id": "System.Memory",
+            "version": "4.5.3"
+          },
+          {
+            "id": "System.Runtime.CompilerServices.Unsafe",
+            "version": "4.6.0"
+          },
+          {
+            "id": "System.Threading.Tasks.Extensions",
+            "version": "4.5.4"
+          },
+          {
+            "id": "System.ValueTuple",
+            "version": "4.5.0"
+          },
+          {
+            "id": "MicroCom.Runtime",
+            "version": "0.11.0"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Browser",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net7.0",
+        "packages": [
+          {
+            "id": "HarfBuzzSharp",
+            "version": "7.3.0"
+          },
+          {
+            "id": "SkiaSharp",
+            "version": "2.88.7"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Browser.Blazor",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net7.0",
+        "packages": [
+          {
+            "id": "Microsoft.AspNetCore.Components.Web",
+            "version": "7.0.2"
+          },
+          {
+            "id": "Avalonia.Browser",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Controls.ColorPicker",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Controls.DataGrid",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia.Remote.Protocol",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Controls.ItemsRepeater",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Desktop",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Native",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.X11",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Win32",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Native",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.X11",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Win32",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Diagnostics",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Microsoft.CodeAnalysis.CSharp.Scripting",
+            "version": "3.8.0"
+          },
+          {
+            "id": "Microsoft.CodeAnalysis.Common",
+            "version": "3.8.0"
+          },
+          {
+            "id": "Avalonia.Controls.ColorPicker",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Controls.DataGrid",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Themes.Simple",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Microsoft.CodeAnalysis.CSharp.Scripting",
+            "version": "3.8.0"
+          },
+          {
+            "id": "Microsoft.CodeAnalysis.Common",
+            "version": "3.8.0"
+          },
+          {
+            "id": "Avalonia.Controls.ColorPicker",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Controls.DataGrid",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Themes.Simple",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Direct2D1",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "HarfBuzzSharp",
+            "version": "7.3.0"
+          },
+          {
+            "id": "SharpDX",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.DXGI",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.Direct2D1",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.Direct3D11",
+            "version": "4.0.1"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Win32",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "HarfBuzzSharp",
+            "version": "7.3.0"
+          },
+          {
+            "id": "SharpDX",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.DXGI",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.Direct2D1",
+            "version": "4.0.1"
+          },
+          {
+            "id": "SharpDX.Direct3D11",
+            "version": "4.0.1"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Win32",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Fonts.Inter",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.FreeDesktop",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Tmds.DBus.Protocol",
+            "version": "0.15.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Tmds.DBus.Protocol",
+            "version": "0.15.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Headless",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Headless.NUnit",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "NUnit",
+            "version": "3.13.0"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "NUnit",
+            "version": "3.13.0"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Headless.Vnc",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Quamotion.RemoteViewing",
+            "version": "1.1.21"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Quamotion.RemoteViewing",
+            "version": "1.1.21"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Headless.XUnit",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "xunit.core",
+            "version": "2.4.0"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "xunit.core",
+            "version": "2.4.0"
+          },
+          {
+            "id": "Avalonia.Headless",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.LinuxFramebuffer",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Markup.Xaml.Loader",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "System.Reflection.Emit",
+            "version": "4.3.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "System.Reflection.Emit",
+            "version": "4.3.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Native",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.ReactiveUI",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "ReactiveUI",
+            "version": "18.3.1"
+          },
+          {
+            "id": "System.Reactive",
+            "version": "5.0.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "ReactiveUI",
+            "version": "18.3.1"
+          },
+          {
+            "id": "System.Reactive",
+            "version": "5.0.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Remote.Protocol",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": []
+  },
+  {
+    "id": "Avalonia.Skia",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "HarfBuzzSharp",
+            "version": "7.3.0"
+          },
+          {
+            "id": "HarfBuzzSharp.NativeAssets.Linux",
+            "version": "7.3.0"
+          },
+          {
+            "id": "HarfBuzzSharp.NativeAssets.WebAssembly",
+            "version": "7.3.0"
+          },
+          {
+            "id": "SkiaSharp",
+            "version": "2.88.7"
+          },
+          {
+            "id": "SkiaSharp.NativeAssets.Linux",
+            "version": "2.88.7"
+          },
+          {
+            "id": "SkiaSharp.NativeAssets.WebAssembly",
+            "version": "2.88.7"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "HarfBuzzSharp",
+            "version": "7.3.0"
+          },
+          {
+            "id": "HarfBuzzSharp.NativeAssets.Linux",
+            "version": "7.3.0"
+          },
+          {
+            "id": "HarfBuzzSharp.NativeAssets.WebAssembly",
+            "version": "7.3.0"
+          },
+          {
+            "id": "SkiaSharp",
+            "version": "2.88.7"
+          },
+          {
+            "id": "SkiaSharp.NativeAssets.Linux",
+            "version": "2.88.7"
+          },
+          {
+            "id": "SkiaSharp.NativeAssets.WebAssembly",
+            "version": "2.88.7"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Themes.Fluent",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Themes.Simple",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.Win32",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia.Angle.Windows.Natives",
+            "version": "2.1.0.2023020321"
+          },
+          {
+            "id": "System.Numerics.Vectors",
+            "version": "4.5.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia.Angle.Windows.Natives",
+            "version": "2.1.0.2023020321"
+          },
+          {
+            "id": "System.Numerics.Vectors",
+            "version": "4.5.0"
+          },
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "Avalonia.X11",
+    "version": "11.0.11",
+    "hash": null,
+    "dependencies": [
+      {
+        "framework": "net6.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.FreeDesktop",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          }
+        ]
+      },
+      {
+        "framework": ".NETStandard,Version=v2.0",
+        "packages": [
+          {
+            "id": "Avalonia",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.FreeDesktop",
+            "version": "11.0.11"
+          },
+          {
+            "id": "Avalonia.Skia",
+            "version": "11.0.11"
+          }
+        ]
+      }
+    ]
+  }
+]
--- a/pkgs/by-name/av/avalonia/package.nix
+++ b/pkgs/by-name/av/avalonia/package.nix
@ -0,0 +1,199 @@
+{
+  dotnetCorePackages,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  fetchzip,
+  fontconfig,
+  lib,
+  libICE,
+  libSM,
+  libX11,
+  libXcursor,
+  libXext,
+  libXi,
+  libXrandr,
+  liberation_ttf,
+  makeFontsConf,
+  nodejs,
+  npmHooks,
+  runCommand,
+  stdenvNoCC,
+}:
+
+let
+  inherit (dotnetCorePackages) systemToDotnetRid;
+
+  dotnet-sdk =
+    with dotnetCorePackages;
+    combinePackages [
+      sdk_6_0
+      sdk_7_0_1xx
+    ];
+
+  npmDepsFile = ./npm-deps.nix;
+
+in
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  dotnetCorePackages.addNuGetDeps
+    {
+      nugetDeps = ./deps.nix;
+      overrideFetchAttrs = old: {
+        runtimeIds = map (system: dotnetCorePackages.systemToDotnetRid system) old.meta.platforms;
+      };
+    }
+    rec {
+      pname = "Avalonia";
+      version = "11.0.11";
+
+      src = fetchFromGitHub {
+        owner = "AvaloniaUI";
+        repo = "Avalonia";
+        rev = version;
+        fetchSubmodules = true;
+        hash = "sha256-Du8DEsZKl7rnVH9YZKAWTCpEQ/5HrNlgacgK/46kx/o=";
+      };
+
+      patches = [
+        # Fix failing tests that use unicode.org
+        ./0001-use-files-for-unicode-character-database.patch
+        # [ERR] Compile: [...]/Microsoft.NET.Sdk.targets(148,5): error MSB4018: The "GenerateDepsFile" task failed unexpectedly. [/build/source/src/tools/DevAnalyzers/DevAnalyzers.csproj]
+        # [ERR] Compile: [...]/Microsoft.NET.Sdk.targets(148,5): error MSB4018: System.IO.IOException: The process cannot access the file '/build/source/src/tools/DevAnalyzers/bin/Release/netstandard2.0/DevAnalyzers.deps.json' because it is being used by another process. [/build/source/src/tools/DevAnalyzers/DevAnalyzers.csproj]
+        ./0002-disable-parallel-compile.patch
+      ];
+
+      # this needs to be match the version being patched above
+      UNICODE_CHARACTER_DATABASE = fetchzip {
+        url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
+        hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
+        stripRoot = false;
+      };
+
+      postPatch =
+        ''
+          patchShebangs build.sh
+
+          substituteInPlace src/Avalonia.X11/ICELib.cs \
+            --replace-fail '"libICE.so.6"' '"${lib.getLib libICE}/lib/libICE.so.6"'
+          substituteInPlace src/Avalonia.X11/SMLib.cs \
+            --replace-fail '"libSM.so.6"' '"${lib.getLib libSM}/lib/libSM.so.6"'
+          substituteInPlace src/Avalonia.X11/XLib.cs \
+            --replace-fail '"libX11.so.6"' '"${lib.getLib libX11}/lib/libX11.so.6"' \
+            --replace-fail '"libXrandr.so.2"' '"${lib.getLib libXrandr}/lib/libXrandr.so.2"' \
+            --replace-fail '"libXext.so.6"' '"${lib.getLib libXext}/lib/libXext.so.6"' \
+            --replace-fail '"libXi.so.6"' '"${lib.getLib libXi}/lib/libXi.so.6"' \
+            --replace-fail '"libXcursor.so.1"' '"${lib.getLib libXcursor}/lib/libXcursor.so.1"'
+
+          # from RestoreAdditionalProjectSources, which isn't supported by nuget-to-nix
+          dotnet nuget add source https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet8-transport/nuget/v3/index.json
+
+          # Tricky way to run npmConfigHook multiple times (borrowed from pagefind)
+          (
+            local postPatchHooks=() # written to by npmConfigHook
+            source ${npmHooks.npmConfigHook}/nix-support/setup-hook
+        ''
+        +
+          # TODO: implement updateScript
+          lib.concatMapStrings (
+            { path, hash }:
+            let
+              deps = fetchNpmDeps {
+                src = "${src}/${path}";
+                inherit hash;
+              };
+            in
+            ''
+              npmRoot=${path} npmDeps="${deps}" npmConfigHook
+              rm -rf "$TMPDIR/cache"
+            ''
+          ) (import npmDepsFile)
+        + ''
+          )
+          # Avalonia.Native is normally only packed on darwin.
+          substituteInPlace src/Avalonia.Native/Avalonia.Native.csproj \
+            --replace-fail \
+              '<IsPackable>$(PackAvaloniaNative)</IsPackable>' \
+              '<IsPackable>true</IsPackable>'
+        '';
+
+      makeCacheWritable = true;
+
+      # CSC : error CS1566: Error reading resource 'pdbstr.exe' -- 'Could not find a part of the path '/build/.nuget-temp/packages/sourcelink/1.1.0/tools/pdbstr.exe'.' [/build/source/nukebuild/_build.csproj]
+      linkNugetPackages = true;
+
+      # [WRN] Could not inject value for Build.ApiCompatTool
+      # System.Exception: Missing package reference/download.
+      # Run one of the following commands:
+      #  ---> System.ArgumentException: Could not find package 'Microsoft.DotNet.ApiCompat.Tool' using:
+      #  - Project assets file '/build/source/nukebuild/obj/project.assets.json'
+      #  - NuGet packages config '/build/source/nukebuild/_build.csproj'
+      makeEmptyNupkgInPackages = true;
+
+      FONTCONFIG_FILE =
+        let
+          fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
+        in
+        runCommand "fonts.conf" { } ''
+          substitute ${fc} $out \
+            --replace-fail "/etc/" "${fontconfig.out}/etc/"
+        '';
+
+      preConfigure = ''
+        # closed source (telemetry?) https://github.com/AvaloniaUI/Avalonia/discussions/16878
+        dotnet remove packages/Avalonia/Avalonia.csproj package Avalonia.BuildServices
+      '';
+
+      runtimeIds = [ (systemToDotnetRid stdenvNoCC.hostPlatform.system) ];
+
+      configurePhase = ''
+        runHook preConfigure
+        for project in nukebuild/_build.csproj dirs.proj; do
+          for rid in $runtimeIds; do
+            dotnet restore --runtime "$rid" "$project"
+          done
+        done
+        runHook postConfigure
+      '';
+
+      nativeBuildInputs = [
+        nodejs
+        dotnet-sdk
+      ];
+      buildInputs = [ dotnet-sdk.packages ];
+
+      buildTarget = "Package";
+
+      buildPhase = ''
+        runHook preBuild
+        # ValidateApiDiff requires a network connection
+        ./build.sh --target $buildTarget --verbosity Verbose --skip ValidateApiDiff
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p "$out/share/nuget/source"
+        cp artifacts/nuget/* "$out/share/nuget/source"
+        runHook postInstall
+      '';
+
+      passthru = {
+        updateScript = ./update.bash;
+        inherit npmDepsFile;
+      };
+
+      meta = {
+        homepage = "https://avaloniaui.net/";
+        license = [ lib.licenses.mit ];
+        maintainers = with lib.maintainers; [ corngood ];
+        description = "A cross-platform UI framework for dotnet";
+        sourceProvenance = with lib.sourceTypes; [
+          fromSource
+          binaryNativeCode # npm dependencies contain binaries
+        ];
+        platforms = dotnet-sdk.meta.platforms;
+        broken = stdenvNoCC.hostPlatform.isDarwin;
+      };
+    }
+    finalAttrs
+)
--- a/pkgs/by-name/av/avalonia/update.bash
+++ b/pkgs/by-name/av/avalonia/update.bash
@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p nix-update -p prefetch-npm-deps
+#shellcheck shell=bash
+
+set -euo pipefail
+
+package="$UPDATE_NIX_ATTR_PATH"
+nix-update "$package"
+src=$(nix-build -A "$package".src --no-out-link)
+npmDepsFile=$(nix-instantiate --eval -A "$package".npmDepsFile)
+(
+    echo '['
+    for path in \
+        src/Avalonia.DesignerSupport/Remote/HtmlTransport/webapp \
+        tests/Avalonia.DesignerSupport.Tests/Remote/HtmlTransport/webapp \
+        src/Browser/Avalonia.Browser/webapp
+    do
+        echo '  {'
+        echo "    path = \"$path\";"
+        echo prefetch-npm-deps "$src/$path/package-lock.json" >&2
+        hash=$(prefetch-npm-deps "$src/$path/package-lock.json")
+        echo "    hash = \"$hash\";"
+        echo '  }'
+    done
+    echo ']'
+) > "$npmDepsFile"
+"$(nix-build -A "$package".fetch-deps --no-out-link)"
--- a/pkgs/by-name/be/beatsabermodmanager/package.nix
+++ b/pkgs/by-name/be/beatsabermodmanager/package.nix
@ -33,6 +33,11 @@ buildDotnetModule rec {

  nugetDeps = ./deps.nix;

+  preConfigureNuGet = ''
+    # This should really be in the upstream nuget.config
+    dotnet nuget add source https://api.nuget.org/v3/index.json \
+      -n nuget.org --configfile nuget.config
+  '';

  # Required for OneClick
  makeWrapperArgs = [
--- a/pkgs/by-name/bo/boogie/package.nix
+++ b/pkgs/by-name/bo/boogie/package.nix
@ -14,6 +14,9 @@ buildDotnetModule rec {
  projectFile = [ "Source/Boogie.sln" ];
  nugetDeps = ./deps.nix;

+  # [...]Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "[...]/NUnit3.TestAdapter.pdb" to "[...]/NUnit3.TestAdapter.pdb". Access to the path '[...]/NUnit3.TestAdapter.pdb' is denied. [[...]/ExecutionEngineTests.csproj]
+  enableParallelBuilding = false;
+
  executables = [ "BoogieDriver" ];

  makeWrapperArgs = [
@ -54,4 +57,3 @@ buildDotnetModule rec {
    platforms = with platforms; (linux ++ darwin);
  };
 }
-
--- a/pkgs/by-name/gp/gpt4all/package.nix
+++ b/pkgs/by-name/gp/gpt4all/package.nix
@ -11,6 +11,7 @@
 , wayland
 , cudaSupport ? config.cudaSupport
 , cudaPackages ? { }
+, autoAddDriverRunpath
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -41,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
    qt6.wrapQtAppsHook
  ] ++ lib.optionals cudaSupport [
    cudaPackages.cuda_nvcc
+    autoAddDriverRunpath
  ];

  buildInputs = [
@ -56,12 +58,13 @@ stdenv.mkDerivation (finalAttrs: {
    vulkan-headers
    wayland
  ] ++ lib.optionals cudaSupport (
-      with cudaPackages;
-      [
-        cuda_cccl
-        cuda_cudart
-        libcublas
-      ]);
+    with cudaPackages;
+    [
+      cuda_cccl
+      cuda_cudart
+      libcublas
+    ]
+  );

  cmakeFlags = [
    "-DKOMPUTE_OPT_USE_BUILT_IN_VULKAN_HEADER=OFF"
--- a/pkgs/by-name/ne/nexusmods-app/deps.nix
+++ b/pkgs/by-name/ne/nexusmods-app/deps.nix
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@ -1,5 +1,6 @@
 {
  _7zz,
+  avalonia,
  buildDotnetModule,
  copyDesktopItems,
  desktop-file-utils,
@ -32,13 +33,20 @@ buildDotnetModule (finalAttrs: {
  projectFile = "src/NexusMods.App/NexusMods.App.csproj";
  testProjectFile = "NexusMods.App.sln";

+  buildInputs = [ avalonia ];
+
  nativeBuildInputs = [ copyDesktopItems ];

  nugetDeps = ./deps.nix;
+  mapNuGetDependencies = true;

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
  dotnet-runtime = dotnetCorePackages.runtime_8_0;

+  postConfigureNuGet = ''
+    dotnet add src/NexusMods.Icons/NexusMods.Icons.csproj package SkiaSharp -v 2.88.7
+  '';
+
  preConfigure = ''
    substituteInPlace Directory.Build.props \
      --replace '</PropertyGroup>' '<ErrorOnDuplicatePublishOutputFiles>false</ErrorOnDuplicatePublishOutputFiles></PropertyGroup>'
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "orchard";
-  version = "0.23.0";
+  version = "0.23.2";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = pname;
    rev = version;
-    hash = "sha256-cBl3dvLZGO8a3rc4bqw7eDcSn0mcUBo3AlkjmSPKp9E=";
+    hash = "sha256-hsYIIA2JA+LT+qaootOkHVN4JD+msO1grYQq4Z6ipYU=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/pe/perf_data_converter/package.nix
+++ b/pkgs/by-name/pe/perf_data_converter/package.nix
@ -26,7 +26,7 @@ buildBazelPackage rec {
  ];

  fetchAttrs = {
-    sha256 = "sha256-Qm6Ng9cXvKx043P7qyNHyyMvdGK9aNarX1ZKeCp3mgY=";
+    hash = "sha256-Qm6Ng9cXvKx043P7qyNHyyMvdGK9aNarX1ZKeCp3mgY=";
  };

  nativeBuildInputs = [ jdk ];
--- a/pkgs/by-name/ph/pharo/package.nix
+++ b/pkgs/by-name/ph/pharo/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pharo";
-  version = "10.0.9-de76067";
+  version = "10.3.1-6cdb1e5";

  src = fetchzip {
    # It is necessary to download from there instead of from the repository because that archive
    # also contains artifacts necessary for the bootstrapping.
    url = "https://files.pharo.org/vm/pharo-spur64-headless/Linux-x86_64/source/PharoVM-${finalAttrs.version}-Linux-x86_64-c-src.zip";
-    hash = "sha256-INeQGYCxBu7DvFmlDRXO0K2nhxcd9K9Xwp55iNdlvhk=";
+    hash = "sha256-Oskbo0ZMh2Wr8uY9BjA54AhFVDEuzs4AN8cpO02gdfY=";
  };

  strictDeps = true;
--- a/pkgs/by-name/pr/protoc-gen-connect-es/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-connect-es/package.nix
@ -7,20 +7,20 @@

 buildNpmPackage rec {
  pname = "protoc-gen-connect-es";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "connectrpc";
    repo = "connect-es";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qCIwr4Hyc5PARUa7tMntuyWRmO6ognmtjxN0myo8FXc=";
+    hash = "sha256-pur1OJuud2ZwPAfd6pSuTAx2vtW6kQM9rntDmtvVj3c=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
    '';
  };

-  npmDepsHash = "sha256-OGwEpXZqzMSIES+cmseQlo6/vzkx5ztO0gM/rUB0tGY=";
+  npmDepsHash = "sha256-wObMmeFCP/zZ6P5cCVkFnn5X0h9/4ePsSj9uBd6C1/Y=";

  npmWorkspace = "packages/protoc-gen-connect-es";

--- a/pkgs/by-name/pr/protoc-gen-js/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-js/package.nix
@ -19,7 +19,7 @@ buildBazelPackage rec {

  LIBTOOL = lib.optionalString stdenv.isDarwin "${cctools}/bin/libtool";

-  fetchAttrs.sha256 = "sha256-WOBlZ0XNrl5UxIaSDxZeOfzS2a8ZkrKdTLKHBDC9UNQ=";
+  fetchAttrs.hash = "sha256-WOBlZ0XNrl5UxIaSDxZeOfzS2a8ZkrKdTLKHBDC9UNQ=";

  buildAttrs.installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
  pname = "sesh";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "joshmedeski";
    repo = "sesh";
    rev = "v${version}";
-    hash = "sha256-IbXd+lk257nw+Kh9ziQ3f6vn387A7jkJB7MUAGfgDmU=";
+    hash = "sha256-Kot5ah4NH1CvXHYRA4r3SS7ugkWgOv9rHlmWoToRpiw=";
  };

  vendorHash = "sha256-a45P6yt93l0CnL5mrOotQmE/1r0unjoToXqSJ+spimg=";
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "0.24.0";
+  version = "0.24.2";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "steampipe";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9IrjxYJz/S3lR03LdFN81VPhIaHJ1USaiETLyS8bMFk=";
+    hash = "sha256-FBWKXj1BfB9jbFMAmeBOHmv0QXmiZ3y7u1n1L8anUEg=";
  };

  vendorHash = "sha256-m4cgYDCugI7mCLCpRbVlNe0SeWZf1aVpeggufxw64oI=";
--- a/pkgs/by-name/ve/verible/package.nix
+++ b/pkgs/by-name/ve/verible/package.nix
@ -37,7 +37,7 @@ buildBazelPackage rec {
  ];

  fetchAttrs = {
-    sha256 = "sha256-bKASgc5KftCWtMvJkGA4nweBAtgdnyC9uXIJxPjKYS0=";
+    hash = "sha256-bKASgc5KftCWtMvJkGA4nweBAtgdnyC9uXIJxPjKYS0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@ -17,6 +17,7 @@
 , lndir
 , substituteAll
 , nugetPackageHook
+, xmlstarlet
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
  doInstallCheck = true;

@ -30,7 +31,7 @@
    ./dotnet-setup-hook.sh
  ] ++ lib.optional (type == "sdk") (substituteAll {
    src = ./dotnet-sdk-setup-hook.sh;
-    inherit lndir;
+    inherit lndir xmlstarlet;
  });

  propagatedBuildInputs =
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@ -56,6 +56,7 @@ makeScopeWithSplicing' {

      mkNugetSource = callPackage ../../../build-support/dotnet/make-nuget-source { };
      mkNugetDeps = callPackage ../../../build-support/dotnet/make-nuget-deps { };
+      addNuGetDeps = callPackage ../../../build-support/dotnet/add-nuget-deps { };
      fetchNupkg = callPackage ../../../build-support/dotnet/fetch-nupkg { };

      dotnet_8 = recurseIntoAttrs (callPackage ./8 { bootstrapSdk = dotnet_8_0.sdk_8_0_1xx; });
--- a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
+++ b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
@ -5,7 +5,7 @@ export MSBUILDTERMINALLOGGER=false
 declare -Ag _nugetInputs

 addNugetInputs() {
-    if [[ -d "$1/share/nuget" ]]; then
+    if [[ -d $1/share/nuget ]]; then
        _nugetInputs[$1]=1
    fi
 }
@ -18,34 +18,34 @@ _linkPackages() {
    local dir
    local x

-    for x in "$src"/*/*; do
-        dir=$dest/$(basename "$(dirname "$x")")
-        mkdir -p "$dir"
-        ln -s "$x" "$dir"/
-    done
-}
-
-createNugetDirs() {
-    nugetTemp=$PWD/.nuget-temp
-    export NUGET_PACKAGES=$nugetTemp/packages
-    export NUGET_FALLBACK_PACKAGES=$nugetTemp/fallback
-    nugetSource=$nugetTemp/source
-    mkdir -p "$NUGET_PACKAGES" "$NUGET_FALLBACK_PACKAGES" "$nugetSource"
-
-    dotnet new nugetconfig
-    if [[ -z ${keepNugetConfig-} ]]; then
-        dotnet nuget disable source nuget
-    fi
-
-    dotnet nuget add source "$nugetSource" -n _nix
+    (
+        shopt -s nullglob
+        for x in "$src"/*/*; do
+            dir=$dest/$(basename "$(dirname "$x")")
+            mkdir -p "$dir"
+            ln -s "$x" "$dir"/
+        done
+    )
 }

 configureNuget() {
-    local x
+    runHook preConfigureNuGet
+
+    local nugetTemp x
+
+    nugetTemp="$(mktemp -dt nuget.XXXXXX)"
+    # trailing slash required here:
+    # Microsoft.Managed.Core.targets(236,5): error : SourceRoot paths are required to end with a slash or backslash: '/build/.nuget-temp/packages'
+    # also e.g. from avalonia:
+    # <EmbeddedResource Include="$(NuGetPackageRoot)sourcelink/1.1.0/tools/pdbstr.exe" />
+    export NUGET_PACKAGES=$nugetTemp/packages/
+    export NUGET_FALLBACK_PACKAGES=$nugetTemp/fallback/
+    nugetSource=$nugetTemp/source
+    mkdir -p "${NUGET_PACKAGES%/}" "${NUGET_FALLBACK_PACKAGES%/}" "$nugetSource"

    for x in "${!_nugetInputs[@]}"; do
        if [[ -d $x/share/nuget/packages ]]; then
-            _linkPackages "$x/share/nuget/packages" "$NUGET_FALLBACK_PACKAGES"
+            _linkPackages "$x/share/nuget/packages" "${NUGET_FALLBACK_PACKAGES%/}"
        fi

        if [[ -d $x/share/nuget/source ]]; then
@ -53,30 +53,150 @@ configureNuget() {
        fi
    done

-    if [[ -n "${linkNugetPackages-}"
-        || -f .config/dotnet-tools.json
-        || -f dotnet-tools.json
-        || -f paket.dependencies ]]; then
+    if [[ -f .config/dotnet-tools.json
+        || -f dotnet-tools.json ]]; then
+        : ${linkNugetPackages=1}
+    fi
+
+    if [[ -z ${keepNugetConfig-} && -f paket.dependencies ]]; then
+        sed -i "s:source .*:source $nugetSource:" paket.dependencies
+        sed -i "s:remote\:.*:remote\: $nugetSource:" paket.lock
+
+        : ${linkNuGetPackagesAndSources=1}
+    fi
+
+    if [[ -n ${linkNuGetPackagesAndSources-} ]]; then
+       for x in "${!_nugetInputs[@]}"; do
+           if [[ -d $x/share/nuget/source ]]; then
+               @lndir@/bin/lndir -silent "$x/share/nuget/packages" "${NUGET_PACKAGES%/}"
+               @lndir@/bin/lndir -silent "$x/share/nuget/source" "${NUGET_PACKAGES%/}"
+           fi
+       done
+    elif [[ -n ${linkNugetPackages-} ]]; then
        for x in "${!_nugetInputs[@]}"; do
            if [[ -d $x/share/nuget/packages ]]; then
-                @lndir@/bin/lndir -silent "$x/share/nuget/packages" "$NUGET_PACKAGES"
+                _linkPackages "$x/share/nuget/packages" "${NUGET_PACKAGES%/}"
            fi
        done
    fi

-    if [[ -z ${keepNugetConfig-} && -f paket.dependencies ]]; then
-       sed -i "s:source .*:source $nugetSource:" paket.dependencies
-       sed -i "s:remote\:.*:remote\: $nugetSource:" paket.lock
-
-       for x in "${!_nugetInputs[@]}"; do
-           if [[ -d $x/share/nuget/source ]]; then
-               @lndir@/bin/lndir -silent "$x/share/nuget/source" "$NUGET_PACKAGES"
-           fi
-       done
+    # create a root nuget.config if one doesn't exist
+    local rootConfig
+    rootConfig=$(find . -maxdepth 1 -iname nuget.config -print -quit)
+    if [[ -z $rootConfig ]]; then
+        dotnet new nugetconfig
    fi
+
+    (
+        shopt -s nullglob
+
+        local -a xmlConfigArgs=() xmlRootConfigArgs=()
+
+        local -ra xmlSourceConfigArgs=(
+            -s /configuration -t elem -n packageSources
+            -d '/configuration/packageSources[position() != 1]'
+            -s /configuration/packageSources -t elem -n __new
+            -i /configuration/packageSources/__new -t attr -n key -v _nix
+            -i /configuration/packageSources/__new -t attr -n value -v "$nugetSource"
+            -r /configuration/packageSources/__new -v add)
+
+        if [[ -z ${keepNugetConfig-} ]]; then
+            xmlConfigArgs+=(-d '//configuration/*')
+            xmlRootConfigArgs+=("${xmlSourceConfigArgs[@]}")
+        else
+            if [[ -n ${mapNuGetDependencies-} ]]; then
+                xmlConfigArgs+=(
+                    -s /configuration -t elem -n __tmp
+                    # If there's no packageSourceMapping, we need to add * patterns for
+                    # all the sources, else they won't be used.
+                    -u \$prev -x ../packageSources/add
+                    -d '/configuration/__tmp/add/@*[name() != "key"]'
+                    -r /configuration/__tmp/add -v packageSource
+                    -s /configuration/__tmp/packageSource -t elem -n package
+                    -i \$prev -t attr -n pattern -v \*
+                    -r /configuration/__tmp -v packageSourceMapping
+                    -d '/configuration/packageSourceMapping[position() != 1]'
+                    "${xmlSourceConfigArgs[@]}"
+                    # add package source mappings from all existing patterns to _nix
+                    # this ensures _nix is always considered
+                    -s /configuration/packageSourceMapping -t elem -n packageSource
+                    -u \$prev -x ../packageSource/package
+                    -i \$prev -t attr -n key -v _nix)
+
+                cd "$nugetSource"
+                local id
+                for id in *; do
+                    id=${id,,}
+                    xmlConfigArgs+=(
+                        # unmap any fully-qualified patterns that exist, so they
+                        # can't be used, using a horrific method for
+                        # case-insensitivity in xpath1
+                        -d "/configuration/packageSourceMapping/packageSource/package[translate(@pattern, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz') = ${id@Q}]"
+                        -s '/configuration/packageSourceMapping/packageSource[@key="_nix"]' -t elem -n package
+                        -i \$prev -t attr -n pattern -v "$id")
+                done
+                cd - < /dev/null
+            else
+                xmlConfigArgs+=(
+                    "${xmlSourceConfigArgs[@]}"
+                    # add package source mappings from all existing patterns to _nix
+                    # this ensures _nix is always considered
+                    -s /configuration/packageSourceMapping -t elem -n packageSource
+                    -u \$prev -x '../packageSource/package'
+                    -i \$prev -t attr -n key -v _nix
+                    # delete empty _nix mapping
+                    -d '/configuration/packageSourceMapping/packageSource[@key="_nix" and not(*)]')
+            fi
+        fi
+
+        # try to stop the global config from having any effect
+        if [[ -z ${keepNugetConfig-} || -z ${allowGlobalNuGetConfig-} ]]; then
+            local -ar configSections=(
+                config
+                bindingRedirects
+                packageRestore
+                solution
+                packageSources
+                auditSources
+                apikeys
+                disabledPackageSources
+                activePackageSource
+                fallbackPackageFolders
+                packageSourceMapping
+                packageManagement)
+
+            for section in "${configSections[@]}"; do
+                xmlRootConfigArgs+=(
+                    -s /configuration -t elem -n "$section"
+                    # hacky way of ensuring we use existing sections when they exist
+                    -d "/configuration/$section[position() != 1]"
+                    # hacky way of adding to the start of a possibly empty element
+                    -s "/configuration/$section" -t elem -n __unused
+                    -i "/configuration/$section/*[1]" -t elem -n clear
+                    -d "/configuration/$section/__unused"
+                    # delete consecutive clears
+                    # these actually cause nuget tools to fail in some cases
+                    -d "/configuration/$section/clear[position() = 2 and name() = \"clear\"]")
+            done
+        fi
+
+        find . \( -iname nuget.config \) -print0 | while IFS= read -rd "" config; do
+            local dir isRoot=
+
+            dir=$(dirname "$config")
+            [[ $dir != . ]] || isRoot=1
+
+            @xmlstarlet@/bin/xmlstarlet \
+                ed --inplace \
+                "${xmlConfigArgs[@]}" \
+                ${isRoot:+"${xmlRootConfigArgs[@]}"} \
+                "$config"
+        done
+    )
+
+    runHook postConfigureNuGet
 }

 if [[ -z ${dontConfigureNuget-} ]]; then
-    appendToVar prePhases createNugetDirs
    appendToVar preConfigurePhases configureNuget
 fi
--- a/pkgs/development/compilers/dotnet/nuget-package-hook.nix
+++ b/pkgs/development/compilers/dotnet/nuget-package-hook.nix
@ -1,12 +1,14 @@
 {
  makeSetupHook,
+  unzip,
  zip,
+  xmlstarlet,
  strip-nondeterminism,
 }:
 makeSetupHook {
  name = "nuget-package-hook";
  substitutions = {
-    inherit zip;
+    inherit unzip zip xmlstarlet;
    stripNondeterminism = strip-nondeterminism;
  };
 } ./nuget-package-hook.sh
--- a/pkgs/development/compilers/dotnet/nuget-package-hook.sh
+++ b/pkgs/development/compilers/dotnet/nuget-package-hook.sh
@ -1,29 +1,85 @@
 # shellcheck shell=bash disable=SC2154

+unpackNupkg() {
+    local -r nupkg="$1" unpacked="$2"
+    local nuspec nuspec_l
+
+    mkdir -p "$unpacked"
+    @unzip@/bin/unzip -nqd "$unpacked" "$nupkg"
+    cd "$unpacked"
+    chmod -R +rw .
+    nuspec=(*.nuspec)
+    nuspec_l="${nuspec,,}"
+    if [[ $nuspec != "$nuspec_l" ]]; then
+        mv "$nuspec" "$nuspec".tmp
+        mv "$nuspec".tmp "$nuspec_l"
+    fi
+    echo {} > .nupkg.metadata
+    cd - >/dev/null
+}
+
+_unpackNugetPackagesInOutput() {
+    local -r unpacked="$prefix"/share/nuget/packages/.unpacked
+    local nuspec nuspec_l
+    (
+        shopt -s nullglob globstar
+        for nupkg in "$prefix"/share/nuget/source/**/*.nupkg; do
+            unpackNupkg "$nupkg" "$unpacked"
+            @xmlstarlet@/bin/xmlstarlet \
+                sel -t \
+                -m /_:package/_:metadata \
+                -v _:id -nl \
+                -v _:version -nl \
+                "$unpacked"/*.nuspec | (
+                read id
+                read version
+                id=''${id,,}
+                version=''${version,,}
+                mkdir -p "$prefix"/share/nuget/packages/"$id"
+                mv "$unpacked" "$prefix"/share/nuget/packages/"$id"/"$version"
+            )
+        done
+        rm -rf "$prefix"/share/nuget/source
+    )
+}
+
+unpackNugetPackages() {
+    local output
+    for output in $(getAllOutputNames); do
+        prefix="${!output}" _unpackNugetPackagesInOutput
+    done
+}
+
+if [[ -z ${dontUnpackNugetPackages-} ]]; then
+    preFixupHooks+=(unpackNugetPackages)
+fi
+
 _createNugetSourceInOutput() {
    local package version id dir nupkg content
    local -a nuspec
-    shopt -s nullglob
+    (
+        shopt -s nullglob

-    for package in "$prefix"/share/nuget/packages/*/*; do
-        version=$(basename "$package")
-        id=$(basename "$(dirname "$package")")
-        dir="$prefix/share/nuget/source/$id/$version"
-        nupkg=$dir/$id.$version.nupkg
-        nuspec=("$package"/*.nuspec)
+        for package in "$prefix"/share/nuget/packages/*/*; do
+            version=$(basename "$package")
+            id=$(basename "$(dirname "$package")")
+            dir="$prefix/share/nuget/source/$id/$version"
+            nupkg=$dir/$id.$version.nupkg
+            nuspec=("$package"/*.nuspec)

-        if [[ -n ${createInstallableNugetSource-} ]]; then
-            content=.
-        else
-            content=$(basename "${nuspec[0]}")
-        fi
+            if [[ -n ${createInstallableNugetSource-} ]]; then
+                content=.
+            else
+                content=$(basename "${nuspec[0]}")
+            fi

-        mkdir -p "$dir"
-        cp "${nuspec[0]}" "$dir/$id.nuspec"
-        (cd "$package" && @zip@/bin/zip -rq0 "$nupkg" "$content")
-        @stripNondeterminism@/bin/strip-nondeterminism --type zip "$nupkg"
-        touch "$nupkg".sha512
-    done
+            mkdir -p "$dir"
+            cp "${nuspec[0]}" "$dir/$id.nuspec"
+            (cd "$package" && @zip@/bin/zip -rq0 "$nupkg" "$content")
+            @stripNondeterminism@/bin/strip-nondeterminism --type zip "$nupkg"
+            touch "$nupkg".sha512
+        done
+    )
 }

 createNugetSource() {
--- a/pkgs/development/compilers/dotnet/packages.nix
+++ b/pkgs/development/compilers/dotnet/packages.nix
@ -59,10 +59,11 @@ in {
            -m /_:package/_:metadata \
            -v _:id -nl \
            -v _:version -nl \
-            "$package"/*.nuspec \
-            | tr A-Z a-z | (
+            "$package"/*.nuspec | (
            read id
            read version
+            id=''${id,,}
+            version=''${version,,}
            mkdir -p "$packages"/share/nuget/packages/"$id"
            cp -r "$package" "$packages"/share/nuget/packages/"$id"/"$version"
            echo {} > "$packages"/share/nuget/packages/"$id"/"$version"/.nupkg.metadata
--- a/pkgs/development/compilers/dotnet/patch-nupkgs.nix
+++ b/pkgs/development/compilers/dotnet/patch-nupkgs.nix
@ -7,6 +7,7 @@
 , libuuid
 , openssl
 , lttng-ust_2_12
+, patchelf
 , writeShellScriptBin
 }:

@ -43,23 +44,23 @@ in writeShellScriptBin "patch-nupkgs" (''
    find "$x" -type f -print0 | while IFS= read -rd "" p; do
      if [[ "$p" != *.nix-patched ]] \
        && isELF "$p" \
-        && patchelf --print-interpreter "$p" &>/dev/null; then
+        && ${patchelf}/bin/patchelf --print-interpreter "$p" &>/dev/null; then
        tmp="$p".$$.nix-patched
        # if this fails to copy then another process must have patched it
        cp --reflink=auto "$p" "$tmp" || continue
        echo "Patchelfing $p as $tmp"
-        patchelf \
+        ${patchelf}/bin/patchelf \
          --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
          "$tmp" ||:
        # This makes sure that if the binary requires some specific runtime dependencies, it can find it.
        # This fixes dotnet-built binaries like crossgen2
-        patchelf \
+        ${patchelf}/bin/patchelf \
          --add-needed libicui18n.so \
          --add-needed libicuuc.so \
          --add-needed libz.so \
          --add-needed libssl.so \
          "$tmp"
-        patchelf \
+        ${patchelf}/bin/patchelf \
          --add-rpath "${binaryRPath}" \
          "$tmp" ||:
        mv "$tmp" "$p"
--- a/pkgs/development/compilers/dotnet/stage0.nix
+++ b/pkgs/development/compilers/dotnet/stage0.nix
@ -79,7 +79,7 @@ let
          nativeBuildInputs = old.nativeBuildInputs ++ [
            nix
            cacert
-            (nuget-to-nix.override { dotnet-sdk = dotnetSdk; })
+            nuget-to-nix
          ];
          postPatch = old.postPatch or "" + ''
            xmlstarlet ed \
--- a/pkgs/development/python-modules/i-pi/default.nix
+++ b/pkgs/development/python-modules/i-pi/default.nix
@ -6,6 +6,7 @@
  makeWrapper,
  setuptools,
  numpy,
+  scipy,
  distutils,
  pytestCheckHook,
  mock,
@ -32,7 +33,10 @@ buildPythonPackage rec {
    makeWrapper
  ];

-  dependencies = [ numpy ];
+  dependencies = [
+    numpy
+    scipy
+  ];

  nativeCheckInputs = [
    pytestCheckHook
--- a/pkgs/development/python-modules/python-calamine/default.nix
+++ b/pkgs/development/python-modules/python-calamine/default.nix
@ -1,14 +1,22 @@
 {
  lib,
  buildPythonPackage,
-  cargo,
  fetchFromGitHub,
-  poetry-core,
-  pytestCheckHook,
-  pythonOlder,
-  rustc,
-  packaging,
  rustPlatform,
+
+  # buildInputs
+  libiconv,
+
+  # build-system
+  cargo,
+  poetry-core,
+  rustc,
+
+  # dependencies
+  packaging,
+
+  # tests
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
@ -16,8 +24,6 @@ buildPythonPackage rec {
  version = "0.2.3";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "dimastbk";
    repo = "python-calamine";
@ -36,6 +42,8 @@ buildPythonPackage rec {
    ln -s ${./Cargo.lock} Cargo.lock
  '';

+  buildInputs = [ libiconv ];
+
  build-system = [
    cargo
    poetry-core
--- a/pkgs/development/tools/build-managers/msbuild/create-deps.sh
+++ b/pkgs/development/tools/build-managers/msbuild/create-deps.sh
@ -1,57 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq -p xmlstarlet -p curl
-set -euo pipefail
-
-cat << EOL
-{ fetchurl }: [
-EOL
-
-mapfile -t repos < <(
-    xmlstarlet sel -t -v 'configuration/packageSources/add/@value' -n NuGet.config |
-        while IFS= read index
-        do
-            curl --compressed -fsL "$index" | \
-                jq -r '.resources[] | select(."@type" == "PackageBaseAddress/3.0.0")."@id"'
-        done
-    )
-
-find .packages fake-home/.nuget/packages -name \*.nupkg -printf '%P\n' | sort -u |
-    while IFS= read file
-    do
-        packagedir=$(dirname $file)
-        version=$(basename $packagedir)
-        package=$(dirname $packagedir)
-
-        found=false
-        for repo in "${repos[@]}"
-        do
-            url="$repo$package/$version/$package.$version.nupkg"
-            if curl -fsL "$url" -o /dev/null
-            then
-                found=true
-                break
-            fi
-        done
-
-        if ! $found
-        then
-            echo "couldn't find $package $version" >&2
-            exit 1
-        fi
-
-        sha256=$(nix-prefetch-url "$url" 2>/dev/null)
-        cat << EOL
-  {
-    name = "$package";
-    version = "$version";
-    src = fetchurl {
-      url = "$url";
-      sha256 = "$sha256";
-    };
-  }
-EOL
-    done
-
-cat << EOL
-]
-EOL
--- a/pkgs/development/tools/build-managers/msbuild/default.nix
+++ b/pkgs/development/tools/build-managers/msbuild/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, glibcLocales, mono, nuget, unzip, dotnetCorePackages, writeText, roslyn }:
+{ lib, stdenv, fetchurl, makeWrapper, glibcLocales, mono, unzip, dotnetCorePackages, roslyn }:

 let

@ -9,23 +9,21 @@ let
    sha256 = "1wnzbdpk4s9bmawlh359ak2b8zi0sgx1qvcjnvfncr1wsck53v7q";
  };

-  deps = map (package: package.src)
-    (import ./deps.nix { inherit fetchurl; });
-
-  nuget-config = writeText "NuGet.config" ''
-    <?xml version="1.0" encoding="utf-8"?>
-    <configuration>
-      <packageSources>
-        <clear />
-      </packageSources>
-    </configuration>
-  '';
-
  inherit (stdenv.hostPlatform.extensions) sharedLibrary;

+  mkPackage = attrs: stdenv.mkDerivation (finalAttrs:
+    dotnetCorePackages.addNuGetDeps
+      {
+        nugetDeps = ./deps.nix;
+        overrideFetchAttrs = a: {
+          dontBuild = false;
+        };
+      }
+      attrs finalAttrs);
+
 in

-stdenv.mkDerivation rec {
+mkPackage rec {
  pname = "msbuild";
  version = "16.10.1+xamarinxplat.2021.05.26.14.00";

@ -42,7 +40,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    nuget
    glibcLocales
  ];

@ -64,18 +61,9 @@ stdenv.mkDerivation rec {
    mv LICENSE license.bak && mv license.bak license
  '';

+  linkNugetPackages = true;
+
  buildPhase = ''
-    unset NUGET_PACKAGES
-    # nuget would otherwise try to base itself in /homeless-shelter
-    export HOME=$(pwd)/fake-home
-
-    cp ${nuget-config} NuGet.config
-    nuget sources Add -Name nixos -Source $(pwd)/nixos
-
-    for package in ${toString deps}; do
-      nuget add $package -Source nixos
-    done
-
    mkdir -p artifacts
    unzip ${xplat} -d artifacts
    mv artifacts/msbuild artifacts/mono-msbuild
@ -98,7 +86,7 @@ stdenv.mkDerivation rec {

    # DisableNerdbankVersioning https://gitter.im/Microsoft/msbuild/archives/2018/06/27?at=5b33dbc4ce3b0f268d489bfa
    # TODO there are some (many?) failing tests
-    ./eng/cibuild_bootstrapped_msbuild.sh --host_type mono --configuration Release --skip_tests /p:DisableNerdbankVersioning=true
+    NuGetPackageRoot="$NUGET_PACKAGES" ./eng/cibuild_bootstrapped_msbuild.sh --host_type mono --configuration Release --skip_tests /p:DisableNerdbankVersioning=true
    patchShebangs stage1/mono-msbuild/msbuild
  '';

--- a/pkgs/development/tools/build-managers/msbuild/deps.nix
+++ b/pkgs/development/tools/build-managers/msbuild/deps.nix
--- a/pkgs/servers/rippled/package.nix
+++ b/pkgs/servers/rippled/package.nix
--- a/pkgs/tools/games/ps3-disc-dumper/default.nix
+++ b/pkgs/tools/games/ps3-disc-dumper/default.nix
@ -21,6 +21,12 @@ buildDotnetModule rec {
  projectFile = "UI.Console/UI.Console.csproj";
  nugetDeps = ./deps.nix;

+  preConfigureNuGet = ''
+    # This should really be in the upstream nuget.config
+    dotnet nuget add source https://api.nuget.org/v3/index.json \
+      -n nuget.org --configfile nuget.config
+  '';
+
  runtimeDeps = [
    zlib
    openssl
--- a/pkgs/tools/games/scarab/default.nix
+++ b/pkgs/tools/games/scarab/default.nix
@ -25,6 +25,12 @@ buildDotnetModule rec {
  projectFile = "Scarab.sln";
  executables = [ "Scarab" ];

+  preConfigureNuGet = ''
+    # This should really be in the upstream nuget.config
+    dotnet nuget add source https://api.nuget.org/v3/index.json \
+      -n nuget.org --configfile NuGet.Config
+  '';
+
  runtimeDeps = [
    glibc
    zlib