Merge master into haskell-updates

2024-11-21 22:43:01 +00:00 · 2023-07-26 00:13:28 +00:00 · 2023-07-26 00:13:28 +00:00 · cde91a5dd2
commit cde91a5dd2
parent e31a4d909d a9b47d8550
244 changed files with 12053 additions and 2385 deletions
--- a/doc/builders/packages/ibus.section.md
+++ b/doc/builders/packages/ibus.section.md
@ -34,5 +34,7 @@ The `ibus-engines.typing-booster` package contains a program named `emoji-picker
 On NixOS, it can be installed using the following expression:

 ```nix
-{ pkgs, ... }: { fonts.fonts = with pkgs; [ noto-fonts-emoji ]; }
+{ pkgs, ... }: {
+  fonts.packages = with pkgs; [ noto-fonts-emoji ];
+}
 ```
--- a/doc/languages-frameworks/cuda.section.md
+++ b/doc/languages-frameworks/cuda.section.md
@ -12,8 +12,11 @@ compatible are available as well. For example, there can be a

 To use one or more CUDA packages in an expression, give the expression a `cudaPackages` parameter, and in case CUDA is optional
 ```nix
-cudaSupport ? false
-cudaPackages ? {}
+{ config
+, cudaSupport ? config.cudaSupport
+, cudaPackages ? { }
+, ...
+}:
 ```

 When using `callPackage`, you can choose to pass in a different variant, e.g.
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -81,9 +81,10 @@ rec {
   */
  toKeyValue = {
    mkKeyValue ? mkKeyValueDefault {} "=",
-    listsAsDuplicateKeys ? false
+    listsAsDuplicateKeys ? false,
+    indent ? ""
  }:
-  let mkLine = k: v: mkKeyValue k v + "\n";
+  let mkLine = k: v: indent + mkKeyValue k v + "\n";
      mkLines = if listsAsDuplicateKeys
        then k: v: map (mkLine k) (if lib.isList v then v else [v])
        else k: v: [ (mkLine k v) ];
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4147,6 +4147,12 @@
      fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE";
    }];
  };
+  dgollings = {
+    email = "daniel.gollings+nixpkgs@gmail.com";
+    github = "dgollings";
+    githubId = 2032823;
+    name = "Daniel Gollings";
+  };
  dgonyeo = {
    email = "derek@gonyeo.com";
    github = "dgonyeo";
@ -9853,6 +9859,15 @@
    githubId = 22085373;
    name = "Luis Hebendanz";
  };
+  luisdaranda = {
+    email = "luisdomingoaranda@gmail.com";
+    github = "propet";
+    githubId = 8515861;
+    name = "Luis D. Aranda Sánchez";
+    keys = [{
+      fingerprint = "AB7C 81F4 9E07 CC64 F3E7  BC25 DCAC C6F4 AAFC C04E";
+    }];
+  };
  luisnquin = {
    email = "lpaandres2020@gmail.com";
    matrix = "@luisnquin:matrix.org";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -83,6 +83,8 @@ In addition to numerous new and updated packages, this release has the following

 - [gitea-actions-runner](https://gitea.com/gitea/act_runner), a CI runner for Gitea/Forgejo Actions. Available as [services.gitea-actions-runner](#opt-services.gitea-actions-runner.instances).

+- [evdevremapkeys](https://github.com/philipl/evdevremapkeys), a daemon to remap key events. Available as [services.evdevremapkeys](#opt-services.evdevremapkeys.enable).
+
 - [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer.  Available as [services.gmediarender](options.html#opt-services.gmediarender.enable).

 - [go2rtc](https://github.com/AlexxIT/go2rtc), a camera streaming appliation with support for RTSP, WebRTC, HomeKit, FFMPEG, RTMP and other protocols. Available as [services.go2rtc](options.html#opt-services.go2rtc.enable).
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -123,6 +123,8 @@

 - `buildGoModule` `go-modules` attrs have been renamed to `goModules`.

+- The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to `fonts.packages` and `fonts.enableDefaultPackages` respectively.
+
 - `services.fail2ban.jails` can now be configured with attribute sets defining settings and filters instead of lines. The stringed options `daemonConfig` and `extraSettings` have respectively been replaced by `daemonSettings` and `jails.DEFAULT.settings` which use attribute sets.

 - The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -42,7 +42,7 @@ let
  # looking things up.
  makeCacheConf = { }:
    let
-      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
+      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.packages; };
      cache     = makeCache pkgs.fontconfig;
      cache32   = makeCache pkgs.pkgsi686Linux.fontconfig;
    in
@ -51,7 +51,7 @@ let
      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
      <fontconfig>
        <!-- Font directories -->
-        ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+        ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.packages)}
        ${optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
        <!-- Pre-generated font caches -->
        <cachedir>${cache}</cachedir>
--- a/nixos/modules/config/fonts/fontdir.nix
+++ b/nixos/modules/config/fonts/fontdir.nix
@ -9,7 +9,7 @@ let
  x11Fonts = pkgs.runCommand "X11-fonts" { preferLocalBuild = true; } ''
    mkdir -p "$out/share/X11/fonts"
    font_regexp='.*\.\(ttf\|ttc\|otb\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
-    find ${toString config.fonts.fonts} -regex "$font_regexp" \
+    find ${toString config.fonts.packages} -regex "$font_regexp" \
      -exec ln -sf -t "$out/share/X11/fonts" '{}' \;
    cd "$out/share/X11/fonts"
    ${optionalString cfg.decompressFonts ''
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@ -1,47 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.fonts;
-
-  defaultFonts =
-    [ pkgs.dejavu_fonts
-      pkgs.freefont_ttf
-      pkgs.gyre-fonts # TrueType substitutes for standard PostScript fonts
-      pkgs.liberation_ttf
-      pkgs.unifont
-      pkgs.noto-fonts-emoji
-    ];
-in
-{
-  imports = [
-    (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
-  ];
-
-  options = {
-
-    fonts = {
-
-      # TODO: find another name for it.
-      fonts = mkOption {
-        type = types.listOf types.path;
-        default = [];
-        example = literalExpression "[ pkgs.dejavu_fonts ]";
-        description = lib.mdDoc "List of primary font paths.";
-      };
-
-      enableDefaultFonts = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable a basic set of fonts providing several font styles
-          and families and reasonable coverage of Unicode.
-        '';
-      };
-    };
-
-  };
-
-  config = { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; };
-}
--- a/nixos/modules/config/fonts/ghostscript.nix
+++ b/nixos/modules/config/fonts/ghostscript.nix
@ -3,31 +3,21 @@
 with lib;

 {
-
  options = {
-
-    fonts = {
-
-      enableGhostscriptFonts = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to add the fonts provided by Ghostscript (such as
-          various URW fonts and the “Base-14” Postscript fonts) to the
-          list of system fonts, making them available to X11
-          applications.
-        '';
-      };
-
+    fonts.enableGhostscriptFonts = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to add the fonts provided by Ghostscript (such as
+        various URW fonts and the “Base-14” Postscript fonts) to the
+        list of system fonts, making them available to X11
+        applications.
+      '';
    };

  };

-
  config = mkIf config.fonts.enableGhostscriptFonts {
-
-    fonts.fonts = [ "${pkgs.ghostscript}/share/ghostscript/fonts" ];
-
+    fonts.packages = [ "${pkgs.ghostscript}/share/ghostscript/fonts" ];
  };
-
 }
--- a/nixos/modules/config/fonts/packages.nix
+++ b/nixos/modules/config/fonts/packages.nix
@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.fonts;
+in
+{
+  imports = [
+    (lib.mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.packages = [ pkgs.corefonts ]; instead.")
+    (lib.mkRenamedOptionModule [ "fonts" "enableDefaultFonts" ] [ "fonts" "enableDefaultPackages" ])
+    (lib.mkRenamedOptionModule [ "fonts" "fonts" ] [ "fonts" "packages" ])
+  ];
+
+  options = {
+    fonts = {
+      packages = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [];
+        example = lib.literalExpression "[ pkgs.dejavu_fonts ]";
+        description = lib.mdDoc "List of primary font packages.";
+      };
+
+      enableDefaultPackages = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Enable a basic set of fonts providing several styles
+          and families and reasonable coverage of Unicode.
+        '';
+      };
+    };
+  };
+
+  config = {
+    fonts.packages = lib.mkIf cfg.enableDefaultPackages (with pkgs; [
+      dejavu_fonts
+      freefont_ttf
+      gyre-fonts # TrueType substitutes for standard PostScript fonts
+      liberation_ttf
+      unifont
+      noto-fonts-emoji
+    ]);
+  };
+}
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@ -3,8 +3,8 @@
  configuration to work.

  See also
-   - ./nix.nix
-   - ./nix-flakes.nix
+  - ./nix.nix
+  - ./nix-flakes.nix
 */
 { config, lib, ... }:
 let
@ -28,9 +28,9 @@ in
            Whether the `nix-channel` command and state files are made available on the machine.

            The following files are initialized when enabled:
-             - `/nix/var/nix/profiles/per-user/root/channels`
-             - `/root/.nix-channels`
-             - `$HOME/.nix-defexpr/channels` (on login)
+              - `/nix/var/nix/profiles/per-user/root/channels`
+              - `/root/.nix-channels`
+              - `$HOME/.nix-defexpr/channels` (on login)

            Disabling this option will not remove the state files from the system.
          '';
@ -48,7 +48,7 @@ in
            "nixos-config=/etc/nixos/configuration.nix"
            "/nix/var/nix/profiles/per-user/root/channels"
          ]
-          else [];
+          else [ ];
        defaultText = ''
          if nix.channel.enable
          then [
@ -86,7 +86,7 @@ in
      '';

    environment.extraSetup = mkIf (!cfg.channel.enable) ''
-      rm $out/bin/nix-channel
+      rm --force $out/bin/nix-channel
    '';

    # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -4,8 +4,8 @@
  ./config/debug-info.nix
  ./config/fonts/fontconfig.nix
  ./config/fonts/fontdir.nix
-  ./config/fonts/fonts.nix
  ./config/fonts/ghostscript.nix
+  ./config/fonts/packages.nix
  ./config/gnu.nix
  ./config/gtk/gtk-icon-cache.nix
  ./config/i18n.nix
@ -636,6 +636,7 @@
  ./services/misc/etcd.nix
  ./services/misc/etebase-server.nix
  ./services/misc/etesync-dav.nix
+  ./services/misc/evdevremapkeys.nix
  ./services/misc/felix.nix
  ./services/misc/freeswitch.nix
  ./services/misc/fstrim.nix
--- a/nixos/modules/programs/hyprland.nix
+++ b/nixos/modules/programs/hyprland.nix
@ -60,7 +60,7 @@ in
  config = mkIf cfg.enable {
    environment.systemPackages = [ cfg.finalPackage ];

-    fonts.enableDefaultFonts = mkDefault true;
+    fonts.enableDefaultPackages = mkDefault true;
    hardware.opengl.enable = mkDefault true;

    programs = {
--- a/nixos/modules/programs/miriway.nix
+++ b/nixos/modules/programs/miriway.nix
@ -66,7 +66,7 @@ in {
    };

    hardware.opengl.enable = lib.mkDefault true;
-    fonts.enableDefaultFonts = lib.mkDefault true;
+    fonts.enableDefaultPackages = lib.mkDefault true;
    programs.dconf.enable = lib.mkDefault true;
    programs.xwayland.enable = lib.mkDefault true;

--- a/nixos/modules/programs/wayland/wayland-session.nix
+++ b/nixos/modules/programs/wayland/wayland-session.nix
@ -5,7 +5,7 @@
    };

    hardware.opengl.enable = mkDefault true;
-    fonts.enableDefaultFonts = mkDefault true;
+    fonts.enableDefaultPackages = mkDefault true;

    programs = {
      dconf.enable = mkDefault true;
--- a/nixos/modules/services/misc/evdevremapkeys.nix
+++ b/nixos/modules/services/misc/evdevremapkeys.nix
@ -0,0 +1,59 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  format = pkgs.formats.yaml { };
+  cfg = config.services.evdevremapkeys;
+
+in
+{
+  options.services.evdevremapkeys = {
+    enable = mkEnableOption (lib.mdDoc ''evdevremapkeys'');
+
+    settings = mkOption {
+      type = format.type;
+      default = { };
+      description = lib.mdDoc ''
+        config.yaml for evdevremapkeys
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "uinput" ];
+    services.udev.extraRules = ''
+      KERNEL=="uinput", MODE="0660", GROUP="input"
+    '';
+    users.groups.evdevremapkeys = { };
+    users.users.evdevremapkeys = {
+      description = "evdevremapkeys service user";
+      group = "evdevremapkeys";
+      extraGroups = [ "input" ];
+      isSystemUser = true;
+    };
+    systemd.services.evdevremapkeys = {
+      description = "evdevremapkeys";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig =
+        let
+          config = format.generate "config.yaml" cfg.settings;
+        in
+        {
+          ExecStart = "${pkgs.evdevremapkeys}/bin/evdevremapkeys --config-file ${config}";
+          User = "evdevremapkeys";
+          Group = "evdevremapkeys";
+          StateDirectory = "evdevremapkeys";
+          Restart = "always";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateNetwork = true;
+          PrivateTmp = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = true;
+        };
+    };
+  };
+}
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -26,14 +26,11 @@ let
    lib.mapAttrs (_: toString) cfg.extraConfig
  );

-  manage =
-    let
-      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
-    in
-    pkgs.writeShellScript "manage" ''
-      ${setupEnv}
-      exec ${pkg}/bin/paperless-ngx "$@"
-    '';
+  manage = pkgs.writeShellScript "manage" ''
+    set -o allexport # Export the following env vars
+    ${lib.toShellVars env}
+    exec ${pkg}/bin/paperless-ngx "$@"
+  '';

  # Secure the services
  defaultServiceConfig = {
@ -172,6 +169,7 @@ in
      description = lib.mdDoc "Web interface port.";
    };

+    # FIXME this should become an RFC42-style settings attr
    extraConfig = mkOption {
      type = types.attrs;
      default = { };
@ -180,11 +178,23 @@ in

        See [the documentation](https://paperless-ngx.readthedocs.io/en/latest/configuration.html)
        for available options.
+
+        Note that some options such as `PAPERLESS_CONSUMER_IGNORE_PATTERN` expect JSON values. Use `builtins.toJSON` to ensure proper quoting.
+      '';
+      example = literalExpression ''
+        {
+          PAPERLESS_OCR_LANGUAGE = "deu+eng";
+
+          PAPERLESS_DBHOST = "/run/postgresql";
+
+          PAPERLESS_CONSUMER_IGNORE_PATTERN = builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
+
+          PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
+            optimize = 1;
+            pdfa_image_compression = "lossless";
+          };
+        };
      '';
-      example = {
-        PAPERLESS_OCR_LANGUAGE = "deu+eng";
-        PAPERLESS_DBHOST = "/run/postgresql";
-      };
    };

    user = mkOption {
--- a/nixos/modules/services/monitoring/munin.nix
+++ b/nixos/modules/services/monitoring/munin.nix
@ -375,7 +375,7 @@ in

    # Munin is hardcoded to use DejaVu Mono and the graphs come out wrong if
    # it's not available.
-    fonts.fonts = [ pkgs.dejavu_fonts ];
+    fonts.packages = [ pkgs.dejavu_fonts ];

    systemd.timers.munin-cron = {
      description = "batch Munin master programs";
--- a/nixos/modules/services/networking/xrdp.nix
+++ b/nixos/modules/services/networking/xrdp.nix
@ -121,7 +121,7 @@ in
      icons.enable = true;
    };

-    fonts.enableDefaultFonts = mkDefault true;
+    fonts.enableDefaultPackages = mkDefault true;

    systemd = {
      services.xrdp = {
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@ -111,7 +111,7 @@ in {

    fonts = mkIf (cfg.fonts != null) {
      fontconfig.enable = true;
-      fonts = map (f: f.package) cfg.fonts;
+      packages = map (f: f.package) cfg.fonts;
    };
  };
 }
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@ -156,7 +156,7 @@ in {
      ++ cfg.sessionPath;

    # Fonts.
-    fonts.fonts = mkDefault [
+    fonts.packages = mkDefault [
      pkgs.noto-fonts
      pkgs.hack-font
    ];
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -218,7 +218,7 @@ in
      qt.style = "adwaita";

      # Default Fonts
-      fonts.fonts = with pkgs; [
+      fonts.packages = with pkgs; [
        source-code-pro # Default monospace font in 3.32
        ubuntu_font_family # required for default theme
      ];
--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@ -67,7 +67,7 @@ in
      networking.networkmanager.enable = mkDefault true;
      programs.dconf.enable = mkDefault true;

-      fonts.fonts = with pkgs; [ noto-fonts ];
+      fonts.packages = with pkgs; [ noto-fonts ];
      xdg.mime.enable = true;
      xdg.menus.enable = true;
      xdg.icons.enable = true;
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -92,7 +92,7 @@ in

    environment.etc."X11/xkb".source = xcfg.xkbDir;

-    fonts.fonts = [ pkgs.dejavu_fonts pkgs.ubuntu_font_family ];
+    fonts.packages = [ pkgs.dejavu_fonts pkgs.ubuntu_font_family ];

    services.udisks2.enable = true;
    services.upower.enable = config.powerManagement.enable;
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -432,7 +432,7 @@ in
        isSystem = true;
      };

-      fonts.fonts = with pkgs; [
+      fonts.packages = with pkgs; [
        cantarell-fonts
        dejavu_fonts
        source-code-pro # Default monospace font in 3.32
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -265,7 +265,7 @@ in
      qt.style = "adwaita";

      # Default Fonts
-      fonts.fonts = with pkgs; [
+      fonts.packages = with pkgs; [
        inter
        open-dyslexic
        open-sans
@ -306,7 +306,7 @@ in
      ])) config.environment.pantheon.excludePackages;

      # needed by screenshot
-      fonts.fonts = [
+      fonts.packages = [
        pkgs.pantheon.elementary-redacted-script
      ];
    })
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -332,7 +332,7 @@ in
      # Enable GTK applications to load SVG icons
      services.xserver.gdk-pixbuf.modulePackages = [ pkgs.librsvg ];

-      fonts.fonts = with pkgs; [ cfg.notoPackage hack-font ];
+      fonts.packages = with pkgs; [ cfg.notoPackage hack-font ];
      fonts.fontconfig.defaultFonts = {
        monospace = [ "Hack" "Noto Sans Mono" ];
        sansSerif = [ "Noto Sans" ];
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -1,9 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:

 with lib;

 let
  cfg = config.services.xserver.desktopManager.xfce;
+  excludePackages = config.environment.xfce.excludePackages;

 in
 {
@ -69,10 +70,17 @@ in
        description = lib.mdDoc "Enable the XFCE screensaver.";
      };
    };
+
+    environment.xfce.excludePackages = mkOption {
+      default = [];
+      example = literalExpression "[ pkgs.xfce.xfce4-volumed-pulse ]";
+      type = types.listOf types.package;
+      description = lib.mdDoc "Which packages XFCE should exclude from the default environment";
+    };
  };

  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs.xfce // pkgs; [
+    environment.systemPackages = utils.removePackagesByName (with pkgs.xfce // pkgs; [
      glib # for gsettings
      gtk3.out # gtk-update-icon-cache

@ -121,7 +129,7 @@ in
      ] ++ optionals (!cfg.noDesktop) [
        xfce4-panel
        xfdesktop
-      ] ++ optional cfg.enableScreensaver xfce4-screensaver;
+      ] ++ optional cfg.enableScreensaver xfce4-screensaver) excludePackages;

    programs.xfconf.enable = true;
    programs.thunar.enable = true;
@ -165,9 +173,9 @@ in
    programs.zsh.vteIntegration = mkDefault true;

    # Systemd services
-    systemd.packages = with pkgs.xfce; [
+    systemd.packages = utils.removePackagesByName (with pkgs.xfce; [
      xfce4-notifyd
-    ];
+    ]) excludePackages;

    security.pam.services.xfce4-screensaver.unixAuth = cfg.enableScreensaver;
  };
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix
@ -142,7 +142,7 @@ in
      theme
    ];

-    fonts.fonts = [ font ];
+    fonts.packages = [ font ];

    environment.etc."lightdm/slick-greeter.conf".source = slickGreeterConf;
  };
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -22,7 +22,7 @@ let
  };

  fontsForXServer =
-    config.fonts.fonts ++
+    config.fonts.packages ++
    # We don't want these fonts in fonts.conf, because then modern,
    # fontconfig-based applications will get horrible bitmapped
    # Helvetica fonts.  It's better to get a substitution (like Nimbus
@ -883,8 +883,8 @@ in
        ${cfg.extraConfig}
      '';

-    fonts.enableDefaultFonts = mkDefault true;
-    fonts.fonts = [
+    fonts.enableDefaultPackages = mkDefault true;
+    fonts.packages = [
      (if cfg.upscaleDefaultCursor then fontcursormisc_hidpi else pkgs.xorg.fontcursormisc)
      pkgs.xorg.fontmiscmisc
    ];
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@ -173,7 +173,7 @@ in
          config = {
            target = mkDefault name;
            source = mkIf (config.text != null) (
-              let name' = "etc-" + baseNameOf name;
+              let name' = "etc-" + lib.replaceStrings ["/"] ["-"] name;
              in mkDerivedConfig options.text (pkgs.writeText name')
            );
          };
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
  {
    imports = [ ./common/user-account.nix ];

-    fonts.fonts = with pkgs; [ dejavu_fonts ];
+    fonts.packages = with pkgs; [ dejavu_fonts ];

    services.cage = {
      enable = true;
--- a/nixos/tests/cups-pdf.nix
+++ b/nixos/tests/cups-pdf.nix
@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
  nodes.machine = { pkgs, ... }: {
    imports = [ ./common/user-account.nix ];
    environment.systemPackages = [ pkgs.poppler_utils ];
-    fonts.fonts = [ pkgs.dejavu_fonts ];  # yields more OCR-able pdf
+    fonts.packages = [ pkgs.dejavu_fonts ];  # yields more OCR-able pdf
    services.printing.cups-pdf.enable = true;
    services.printing.cups-pdf.instances = {
      opt = {};
--- a/nixos/tests/fontconfig-default-fonts.nix
+++ b/nixos/tests/fontconfig-default-fonts.nix
@ -7,8 +7,8 @@ import ./make-test-python.nix ({ lib, ... }:
  ];

  nodes.machine = { config, pkgs, ... }: {
-    fonts.enableDefaultFonts = true; # Background fonts
-    fonts.fonts = with pkgs; [
+    fonts.enableDefaultPackages = true; # Background fonts
+    fonts.packages = with pkgs; [
      noto-fonts-emoji
      cantarell-fonts
      twitter-color-emoji
--- a/nixos/tests/miriway.nix
+++ b/nixos/tests/miriway.nix
@ -83,7 +83,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      };
    };

-    fonts.fonts = [ pkgs.inconsolata ];
+    fonts.packages = [ pkgs.inconsolata ];
  };

  enableOCR = true;
--- a/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
+++ b/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
  nodes.machine = {
    imports = [ ./common/x11.nix ];
    fonts = {
-      enableDefaultFonts = false;
+      enableDefaultPackages = false;
      fonts = [ pkgs.noto-fonts-cjk-sans ];
    };
  };
--- a/nixos/tests/noto-fonts.nix
+++ b/nixos/tests/noto-fonts.nix
@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    imports = [ ./common/x11.nix ];
    environment.systemPackages = [ pkgs.gedit ];
    fonts = {
-      enableDefaultFonts = false;
+      enableDefaultPackages = false;
      fonts = with pkgs;[
        noto-fonts
        noto-fonts-cjk-sans
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@ -51,7 +51,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      '';
    };

-    fonts.fonts = [ pkgs.inconsolata ];
+    fonts.packages = [ pkgs.inconsolata ];

    # Automatically configure and start Sway when logging in on tty1:
    programs.bash.loginShellInit = ''
--- a/nixos/tests/vscodium.nix
+++ b/nixos/tests/vscodium.nix
@ -8,7 +8,7 @@ let
      environment.variables.NIXOS_OZONE_WL = "1";
      environment.variables.DISPLAY = "do not use";

-      fonts.fonts = with pkgs; [ dejavu_fonts ];
+      fonts.packages = with pkgs; [ dejavu_fonts ];
    };
    xorg = { pkgs, ... }: {
      imports = [ ./common/user-account.nix ./common/x11.nix ];
--- a/pkgs/applications/audio/soundsource/default.nix
+++ b/pkgs/applications/audio/soundsource/default.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "soundsource";
+  version = "5.6.0";
+
+  src = fetchurl {
+    url = "https://web.archive.org/web/20230707140658/https://rogueamoeba.com/soundsource/download/SoundSource.zip";
+    sha256 = "1avm1jr75mjbps0fad3glshrwl42vnhc0f9sak038ny85f3apyi0";
+  };
+  dontUnpack = true;
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    unzip -d $out/Applications $src
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Sound controller for macOS";
+    homepage = "https://rogueamoeba.com/soundsource";
+    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ emilytrau Enzime ];
+    platforms = platforms.darwin;
+  };
+})
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -436,12 +436,12 @@
  };
  elvish = buildGrammar {
    language = "elvish";
-    version = "0.0.0+rev=f32711e";
+    version = "0.0.0+rev=5e7210d";
    src = fetchFromGitHub {
      owner = "elves";
      repo = "tree-sitter-elvish";
-      rev = "f32711e31e987fd5c2c002f3daba02f25c68672f";
-      hash = "sha256-/3npcIfTH8w5ekLTb//ZCTxuSGhOXkUBaCq3WWcK2J4=";
+      rev = "5e7210d945425b77f82cbaebc5af4dd3e1ad40f5";
+      hash = "sha256-POuQA2Ihi+qDYQ5Pv7hBAzHpPu/FcnuYscW4ItDOCZg=";
    };
    meta.homepage = "https://github.com/elves/tree-sitter-elvish";
  };
@ -458,12 +458,12 @@
  };
  erlang = buildGrammar {
    language = "erlang";
-    version = "0.0.0+rev=5dba13d";
+    version = "0.0.0+rev=7aa24fe";
    src = fetchFromGitHub {
      owner = "WhatsApp";
      repo = "tree-sitter-erlang";
-      rev = "5dba13dcd531c19bf99829e2e0bb31f2e08e16fe";
-      hash = "sha256-FH8DNE03k95ZsRwaiXHkaU9/cdWrWALCEdChN5ZPdog=";
+      rev = "7aa24fe8616072fc1a659f72d5b60bd8c01fb5cc";
+      hash = "sha256-7rhwMBq5u5bVjyCE4j3f5tzY+9jL80Xd5hgkJjlqSr8=";
    };
    meta.homepage = "https://github.com/WhatsApp/tree-sitter-erlang";
  };
@ -513,12 +513,12 @@
  };
  fortran = buildGrammar {
    language = "fortran";
-    version = "0.0.0+rev=31552ac";
+    version = "0.0.0+rev=482bdb8";
    src = fetchFromGitHub {
      owner = "stadelmanma";
      repo = "tree-sitter-fortran";
-      rev = "31552ac43ecaffa443a12ebea68cc526d334892f";
-      hash = "sha256-6ywdhlQGjivA2RV5345A0BiybAJOn9cIM03GMHjVoiM=";
+      rev = "482bdb8b8fb7305b928937379820aa6449e359a7";
+      hash = "sha256-x2Cm1yUfhlkl8zgbQFPe/IxVNGpX050J3wjsqe7uOW8=";
    };
    meta.homepage = "https://github.com/stadelmanma/tree-sitter-fortran";
  };
@ -1151,36 +1151,36 @@
  };
  markdown = buildGrammar {
    language = "markdown";
-    version = "0.0.0+rev=936cc84";
+    version = "0.0.0+rev=aaf7679";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "936cc84289f6de83c263ae8e659fb342867ceb16";
-      hash = "sha256-fDpZs/supQ4Mdlm3+birKodclcwPdsytB3+cRHM4NkM=";
+      rev = "aaf76797aa8ecd9a5e78e0ec3681941de6c945ee";
+      hash = "sha256-4HofUc+OsI3d2CN9mex5ROwuRHyB6fGow8gl0fe5es4=";
    };
    location = "tree-sitter-markdown";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  markdown_inline = buildGrammar {
    language = "markdown_inline";
-    version = "0.0.0+rev=936cc84";
+    version = "0.0.0+rev=aaf7679";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "936cc84289f6de83c263ae8e659fb342867ceb16";
-      hash = "sha256-fDpZs/supQ4Mdlm3+birKodclcwPdsytB3+cRHM4NkM=";
+      rev = "aaf76797aa8ecd9a5e78e0ec3681941de6c945ee";
+      hash = "sha256-4HofUc+OsI3d2CN9mex5ROwuRHyB6fGow8gl0fe5es4=";
    };
    location = "tree-sitter-markdown-inline";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  matlab = buildGrammar {
    language = "matlab";
-    version = "0.0.0+rev=676117e";
+    version = "0.0.0+rev=1558d8f";
    src = fetchFromGitHub {
      owner = "acristoffers";
      repo = "tree-sitter-matlab";
-      rev = "676117eafa64afedc8380a921a77cd9f2244bc6b";
-      hash = "sha256-VB+SO89WAAPh1wj4E1nuHLzNNixBQrF3HcUeqrqV5dk=";
+      rev = "1558d8fc85f7810fa567292ad2a7e64913fa78a1";
+      hash = "sha256-3FKUGmMM3OeRXkS+izu5yrTgiewp5nHN2352t6sYurU=";
    };
    meta.homepage = "https://github.com/acristoffers/tree-sitter-matlab";
  };
@ -1286,24 +1286,24 @@
  };
  ocaml = buildGrammar {
    language = "ocaml";
-    version = "0.0.0+rev=ee871b5";
+    version = "0.0.0+rev=694c577";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "ee871b50b845b6adaa22e85aa3c794a3fd49b1fb";
-      hash = "sha256-2WhK69OGHeQWQZPkBdfrybgxO2oDwHSn1c/AzQe9hAw=";
+      rev = "694c57718fd85d514f8b81176038e7a4cfabcaaf";
+      hash = "sha256-j3Hv2qOMxeBNOW+WIgIYzG3zMIFWPQpoHe94b2rT+A8=";
    };
    location = "ocaml";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
  };
  ocaml_interface = buildGrammar {
    language = "ocaml_interface";
-    version = "0.0.0+rev=ee871b5";
+    version = "0.0.0+rev=694c577";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "ee871b50b845b6adaa22e85aa3c794a3fd49b1fb";
-      hash = "sha256-2WhK69OGHeQWQZPkBdfrybgxO2oDwHSn1c/AzQe9hAw=";
+      rev = "694c57718fd85d514f8b81176038e7a4cfabcaaf";
+      hash = "sha256-j3Hv2qOMxeBNOW+WIgIYzG3zMIFWPQpoHe94b2rT+A8=";
    };
    location = "interface";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
@ -1509,12 +1509,12 @@
  };
  puppet = buildGrammar {
    language = "puppet";
-    version = "0.0.0+rev=8e13a37";
+    version = "0.0.0+rev=9ce9a5f";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-puppet";
-      rev = "8e13a3768091703ac27ef1e5763e542af7f6dead";
-      hash = "sha256-vBxCqFsSF2kwUK5uNWDPvl7F+mcD8rdTzsckcab4vUU=";
+      rev = "9ce9a5f7d64528572aaa8d59459ba869e634086b";
+      hash = "sha256-YEjjy9WLwITERYqoeSVrRYnwVBIAwdc4o0lvAK9wizw=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
  };
@ -1641,12 +1641,12 @@
  };
  robot = buildGrammar {
    language = "robot";
-    version = "0.0.0+rev=f1142bf";
+    version = "0.0.0+rev=51b82cf";
    src = fetchFromGitHub {
      owner = "Hubro";
      repo = "tree-sitter-robot";
-      rev = "f1142bfaa6acfce95e25d2c6d18d218f4f533927";
-      hash = "sha256-Nd38FJZsSEr3R7S6e8nyoJTqZbbDCtlcvwqWrjvz2d4=";
+      rev = "51b82cfd0c824681b6a282663820a5ce54243e55";
+      hash = "sha256-jRLP5LqA/Q3IosK0n5sLJ2SW/wXTo9ia1zpdnos/QN8=";
    };
    meta.homepage = "https://github.com/Hubro/tree-sitter-robot";
  };
@ -1986,12 +1986,12 @@
  };
  tsx = buildGrammar {
    language = "tsx";
-    version = "0.0.0+rev=e5fa28f";
+    version = "0.0.0+rev=b1bf482";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-typescript";
-      rev = "e5fa28f919e0b1ed1961af9adf9a1e7a71271104";
-      hash = "sha256-1kyW5tohk3byP/sWM7Edv8N3tWin65k7h+nkKBMQGAg=";
+      rev = "b1bf4825d9eaa0f3bdeb1e52f099533328acfbdf";
+      hash = "sha256-oZKit8kScXcOptmT2ckywL5JlAVe+wuwhuj6ThEI5OQ=";
    };
    location = "tsx";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@ -2020,12 +2020,12 @@
  };
  typescript = buildGrammar {
    language = "typescript";
-    version = "0.0.0+rev=e5fa28f";
+    version = "0.0.0+rev=b1bf482";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-typescript";
-      rev = "e5fa28f919e0b1ed1961af9adf9a1e7a71271104";
-      hash = "sha256-1kyW5tohk3byP/sWM7Edv8N3tWin65k7h+nkKBMQGAg=";
+      rev = "b1bf4825d9eaa0f3bdeb1e52f099533328acfbdf";
+      hash = "sha256-oZKit8kScXcOptmT2ckywL5JlAVe+wuwhuj6ThEI5OQ=";
    };
    location = "typescript";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@ -2165,12 +2165,12 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=1f8736f";
+    version = "0.0.0+rev=23712ef";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "1f8736fc86204a045644e0086bee68f7171e1967";
-      hash = "sha256-cguDviBdQPOLOwoM/jhGNasQyjN1IfLw5Eg9DVjnU1s=";
+      rev = "23712eff9768576bdd852cb9b989a9cd44af014a";
+      hash = "sha256-IWqclJM3CKsgXIy3e6pUrd2iLfIu8QZT2k6eZXRpITA=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -932,7 +932,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-Xlhy2yfB99Tu0j7rXRC6UkdcV0MW09olyxcC2gjd7h4=";
+        cargoHash = "sha256-KhUCIAGSgf7TxabEzcjo582VgbSU79QSGlaEP7BbJCE=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -346,6 +346,7 @@ https://github.com/edluffy/hologram.nvim/,,
 https://github.com/urbit/hoon.vim/,,
 https://github.com/phaazon/hop.nvim/,,
 https://github.com/rktjmp/hotpot.nvim/,,
+https://github.com/lewis6991/hover.nvim/,HEAD,
 https://github.com/othree/html5.vim/,HEAD,
 https://github.com/anuvyklack/hydra.nvim/,HEAD,
 https://github.com/mboughaba/i3config.vim/,,
@ -665,6 +666,7 @@ https://github.com/RishabhRD/popfix/,,
 https://github.com/nvim-lua/popup.nvim/,,
 https://github.com/andweeb/presence.nvim/,,
 https://github.com/sotte/presenting.vim/,,
+https://github.com/ewilazarus/preto/,HEAD,
 https://github.com/vim-scripts/prev_indent/,,
 https://github.com/ahmedkhalf/project.nvim/,,
 https://github.com/kevinhwang91/promise-async/,HEAD,
@ -741,6 +743,7 @@ https://github.com/chr4/sslsecure.vim/,,
 https://github.com/cshuaimin/ssr.nvim/,HEAD,
 https://github.com/luukvbaal/stabilize.nvim/,,
 https://github.com/eigenfoo/stan-vim/,,
+https://github.com/josegamez82/starrynight/,HEAD,
 https://github.com/darfink/starsearch.vim/,,
 https://github.com/luukvbaal/statuscol.nvim/,,
 https://github.com/teto/stylish.nvim/,HEAD,
@ -1090,6 +1093,7 @@ https://github.com/jistr/vim-nerdtree-tabs/,,
 https://github.com/nfnty/vim-nftables/,,
 https://github.com/kana/vim-niceblock/,,
 https://github.com/nickel-lang/vim-nickel/,main,
+https://github.com/bluz71/vim-nightfly-colors/,,nightfly
 https://github.com/tommcdo/vim-ninja-feet/,,
 https://github.com/LnL7/vim-nix/,,
 https://github.com/symphorien/vim-nixhash/,,
@ -1114,6 +1118,7 @@ https://github.com/lambdalisue/vim-pager/,,
 https://github.com/vim-pandoc/vim-pandoc/,,
 https://github.com/vim-pandoc/vim-pandoc-after/,,
 https://github.com/vim-pandoc/vim-pandoc-syntax/,,
+https://github.com/yorickpeterse/vim-paper/,HEAD,
 https://github.com/bhurlow/vim-parinfer/,,
 https://github.com/sickill/vim-pasta/,,
 https://github.com/tpope/vim-pathogen/,,
@ -1290,6 +1295,7 @@ https://github.com/tweekmonster/wstrip.vim/,,
 https://github.com/drmingdrmer/xptemplate/,,
 https://github.com/guns/xterm-color-table.vim/,,
 https://github.com/HerringtonDarkholme/yats.vim/,,
+https://github.com/lucasew/yescapsquit.vim/,HEAD,
 https://github.com/elkowar/yuck.vim/,HEAD,
 https://github.com/KabbAmine/zeavim.vim/,,
 https://github.com/folke/zen-mode.nvim/,,
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -69,9 +69,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.10";
+    version = "8.13";
    url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-xPNt1zwXbO+OcBbKQTnudvW0mKSv1+21F+FMDVOUc28=";
+    hash = "sha256-JuXTqD0lxUGMbA9USORD0gh2OiZDqrSw8a01KSKkwnU=";
    inherit (stable) patches;

    ## see http://wiki.winehq.org/Gecko
@ -117,7 +117,7 @@ in rec {
  staging = fetchFromGitHub rec {
    # https://github.com/wine-staging/wine-staging/releases
    inherit (unstable) version;
-    hash = "sha256-4EHzverfPu4PoRvbeH/iaGqNoXk6XgneDpKOuMf9P1g=";
+    hash = "sha256-5upC+IWHBJE5DeFv96lD1hr4LYYaqAAzfxIroK9KlOY=";
    owner = "wine-staging";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.7.103";
+  version = "0.7.104";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-yBeaRZH8YVrZATBLpUPheS2SY/rAKaRc3HKtFHKOV8E=";
+    hash = "sha256-Oo8YwCDl2E8wW4NIO2KeGRX3GZ/pDVsnHEzEDXkLkN8=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@ -54,7 +54,7 @@
 , breeze-icons
 , oxygen

-, cudaSupport ? config.cudaSupport or false
+, cudaSupport ? config.cudaSupport
 , cudaPackages ? {}
 }:

--- a/pkgs/applications/graphics/vipsdisp/default.nix
+++ b/pkgs/applications/graphics/vipsdisp/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "vipsdisp";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "jcupitt";
    repo = "vipsdisp";
    rev = "v${version}";
-    hash = "sha256-zAvwT6tlL4+EYxJSjnb3Eud1MVbj7Yz4vJcrqM5jXDQ=";
+    hash = "sha256-hx7daXVarV4JdxZfwnTHsuxxijCRP17gkOjicI3EFlM=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -5,7 +5,7 @@
 , openvdb, libXxf86vm, tbb, alembic
 , zlib, zstd, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
-, cudaSupport ? config.cudaSupport or false, cudaPackages ? {}
+, cudaSupport ? config.cudaSupport, cudaPackages ? { }
 , hipSupport ? false, hip # comes with a significantly larger closure size
 , colladaSupport ? true, opencollada
 , spaceNavSupport ? stdenv.isLinux, libspnav
--- a/pkgs/applications/misc/pop/default.nix
+++ b/pkgs/applications/misc/pop/default.nix
@ -0,0 +1,40 @@
+{ lib, buildGoModule, installShellFiles, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "pop";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "charmbracelet";
+    repo = "pop";
+    rev = "v${version}";
+    sha256 = "VzSPQZfapB44hzGumy8JKe+v+n6af9fRSlAq1F7olCo=";
+  };
+
+  vendorSha256 = "VowqYygRKxpDJPfesJXBp00sBiHb57UMR/ZV//v7+90=";
+
+  GOWORK = "off";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  postInstall = ''
+    $out/bin/pop man > pop.1
+    installManPage pop.1
+    installShellCompletion --cmd pop \
+      --bash <($out/bin/pop completion bash) \
+      --fish <($out/bin/pop completion fish) \
+      --zsh <($out/bin/pop completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Send emails from your terminal";
+    homepage = "https://github.com/charmbracelet/pop";
+    changelog = "https://github.com/charmbracelet/pop/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ caarlos0 maaslalani ];
+  };
+}
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.21.0";
+  version = "2.22.0";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-6Jg56lQR8oK9TaJNqnEu70JkUz9OomvRbm5to2j3NOA=";
+    hash = "sha256-+evDMYNo4Io0RAP5EkjA7h4QCLg21v4vLLloLZiSh0E=";
  };

  vendorHash = "sha256-Ypu3AKnjh2lDh43t1GZMJo7ZyEDyNbPWvoePLp+WQdI=";
--- a/pkgs/applications/misc/ssw/default.nix
+++ b/pkgs/applications/misc/ssw/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ssw";
-  version = "0.6";
+  version = "0.8";

  src = fetchurl {
    url = "https://alpha.gnu.org/gnu/ssw/spread-sheet-widget-${version}.tar.gz";
-    sha256 = "08ck9l697xg8vpya5h07raq837i4pqxjqzx30vhscq4xpps2b8kj";
+    sha256 = "sha256-hYnYKY/PO1hQ0JaLBIAaT0D68FVVRPbMnZVLAWLplUs=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -66,7 +66,7 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    django-storages
    django-tables2
    django-webpack-loader
-    django_treebeard
+    django-treebeard
    djangorestframework
    drf-writable-nested
    gunicorn
--- a/pkgs/applications/misc/wallust/default.nix
+++ b/pkgs/applications/misc/wallust/default.nix
@ -1,16 +1,15 @@
 { lib
-, fetchgit
+, fetchFromGitea
 , rustPlatform
 }:
-let
-  repoUrl = "https://codeberg.org/explosion-mental/wallust";
-in
 rustPlatform.buildRustPackage rec {
  pname = "wallust";
  version = "2.5.1";

-  src = fetchgit {
-    url = "${repoUrl}.git";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "explosion-mental";
+    repo = pname;
    rev = version;
    hash = "sha256-v72ddWKK2TMHKeBihYjMoJvKXiPe/yqJtdh8VQzjmVU=";
  };
@ -19,10 +18,10 @@ rustPlatform.buildRustPackage rec {

  meta = with lib; {
    description = "A better pywal";
-    homepage = repoUrl;
+    homepage = "https://codeberg.org/explosion-mental/wallust";
    license = licenses.mit;
    maintainers = with maintainers; [ onemoresuza ];
-    downloadPage = "${repoUrl}/releases/tag/${version}";
+    downloadPage = "https://codeberg.org/explosion-mental/wallust/releases/tag/${version}";
    platforms = platforms.unix;
    mainProgram = "wallust";
  };
--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubecfg";
-  version = "0.30.0";
+  version = "0.31.4";

  src = fetchFromGitHub {
    owner = "kubecfg";
    repo = "kubecfg";
    rev = "v${version}";
-    hash = "sha256-sIT5vqcKMZvx+6rvUzH3l7aOXMWJq81Lwl9YsGwE66w=";
+    hash = "sha256-1hjSuHGZ7NTsYLeV9Cw3wP5tUdAHRSmGlKkL54G/09U=";
  };

-  vendorHash = "sha256-cJFAI/W5ImWcaU6cf/BFt78qES7wQtYnR863UvGP4aM=";
+  vendorHash = "sha256-0cpb5thhTJ7LPOYSd4WSPnS9OTXU608nk8xX5bsAm5w=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubergrunt";
-  version = "0.11.3";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "kubergrunt";
    rev = "v${version}";
-    sha256 = "sha256-d88IEbsk0bwC9Mzag3UOFVcSblCjaWXhKXC8iZr6V1s=";
+    sha256 = "sha256-C3anYYyhRT+/0jO01uEBX1LLQadovO+Z9JA6nHTNXOo=";
  };

  vendorHash = "sha256-AUw1wJNWjpNVsjw/Hr1ZCePYWQkf1SqRVnQgi8tOFG0=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -264,13 +264,13 @@
    "vendorHash": "sha256-UJHDX/vx3n/RTuQ50Y6TAhpEEFk9yBoaz8yK02E8Fhw="
  },
  "consul": {
-    "hash": "sha256-UaTvFxwbLf9krUdsslFP6MXzpacnj/AKXiyUe7iSRCs=",
+    "hash": "sha256-2oujZd7tqvMnp48m3bs45p5dRC7U5a7hsiS5qBuPUHU=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/consul",
    "owner": "hashicorp",
    "repo": "terraform-provider-consul",
-    "rev": "v2.17.0",
+    "rev": "v2.18.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-v1RHxXYTvpyWzyph6qg3GW75OPYc5qYQ/yyDI8WkbNc="
+    "vendorHash": "sha256-0SRbKFKl1lfiiMDZW20ak9m09T3tSOH/fc+UwGeXmuk="
  },
  "ct": {
    "hash": "sha256-c1cqTfMlZ5fXDNMYLsk4447X0p/qIQYvRTqVY8cSs+E=",
@ -427,11 +427,11 @@
    "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
  },
  "github": {
-    "hash": "sha256-xPxrHOuvOT8VO0D7M1TI39i0B1GIQ4Z2F1UckGsU/1A=",
+    "hash": "sha256-Y70HJEUArUCT1XM3F02bUNPwB1bW4N/Gg/M6aW7XcMM=",
    "homepage": "https://registry.terraform.io/providers/integrations/github",
    "owner": "integrations",
    "repo": "terraform-provider-github",
-    "rev": "v5.31.0",
+    "rev": "v5.32.0",
    "spdx": "MIT",
    "vendorHash": null
  },
@ -445,24 +445,24 @@
    "vendorHash": "sha256-AVTWTS16d8QsPLLAJeAfgcVDzUBMp+b2oAphaCBqhS0="
  },
  "google": {
-    "hash": "sha256-kv9DjEPFDeH2Cag2LAmn4GLbPkKXXij3nPRB2rpTizk=",
+    "hash": "sha256-19oBc9w9/A9f2muBpKf1VvTSfLJc5jyD/wmDfg8o9yY=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.74.0",
+    "rev": "v4.75.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DZmpvDSAace2Rh/BMq49bUJK8g0FCaFebjTJvw3lW8A="
+    "vendorHash": "sha256-2znSaprsw+uroTmLwh5+NXdgnUlkFXu4KbNLHgnGt2s="
  },
  "google-beta": {
-    "hash": "sha256-WZHKmSTF+SS6cqyqhW7Jer9vI79CkNb5CCkO/mjUOVE=",
+    "hash": "sha256-293Q6XSWBEFNiC+JgWi6LPIXAUoCCDXXwwRgsTjtLrE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.74.0",
+    "rev": "v4.75.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DZmpvDSAace2Rh/BMq49bUJK8g0FCaFebjTJvw3lW8A="
+    "vendorHash": "sha256-2znSaprsw+uroTmLwh5+NXdgnUlkFXu4KbNLHgnGt2s="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@ -492,13 +492,13 @@
    "vendorHash": null
  },
  "hcloud": {
-    "hash": "sha256-gb5Mp9LI0wb+oA+lfkEmrVEIJzCRoAhugFfJaOkvLVw=",
+    "hash": "sha256-TbEbqTgzp7pUXrhjxvs5hrFI5u//xIIniOvusZsseiE=",
    "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
    "owner": "hetznercloud",
    "repo": "terraform-provider-hcloud",
-    "rev": "v1.41.0",
+    "rev": "v1.42.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jEzCvhfQTK/1MCODUN4tNrtnNE0yR23QI5Vnx1kYr4E="
+    "vendorHash": "sha256-wrgGxCNa5xLdBEy6RNNCz8ZVracyVsHzHtaQse6Ph+E="
  },
  "helm": {
    "hash": "sha256-mGrQ5YKNsv1+Vkan5ohMXnTYofhCQPuTFjemXF/g+tA=",
@ -1052,11 +1052,11 @@
    "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
  },
  "spotinst": {
-    "hash": "sha256-gScCKmDH8uavJass9Fg9pa6u/ZZfkHEhfBHlyyv3svE=",
+    "hash": "sha256-3NxeqlcodW6n7RbLferdGKMf2iXEEcMtmQgaMa/J4lU=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.127.0",
+    "rev": "v1.128.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-0rWVOVRndC/Y0gSfJoqd65rvBqUnNQb47S6RiBw7q+4="
  },
--- a/pkgs/applications/networking/cyberduck/default.nix
+++ b/pkgs/applications/networking/cyberduck/default.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "cyberduck";
+  version = "8.6.0.39818";
+
+  src = fetchurl {
+    url = "https://update.cyberduck.io/Cyberduck-${finalAttrs.version}.zip";
+    sha256 = "1iqq54n267lmmdlv8wmr9k461p49jindc1mn5wy742k08cqxc5ab";
+  };
+  dontUnpack = true;
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    unzip -d $out/Applications $src
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Libre file transfer client for Mac and Windows";
+    homepage = "https://cyberduck.io";
+    license = licenses.gpl3Plus;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ emilytrau Enzime ];
+    platforms = platforms.darwin;
+  };
+})
--- a/pkgs/applications/networking/instant-messengers/flare-signal/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/flare-signal/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
@ -5,25 +5,28 @@
 , meson
 , ninja
 , pkg-config
+, gst_all_1
 , protobuf
 , libsecret
 , libadwaita
 , rustPlatform
 , rustc
+, appstream-glib
+, blueprint-compiler
 , desktop-file-utils
 , wrapGAppsHook4
 }:

 stdenv.mkDerivation rec {
  pname = "flare";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitLab {
    domain = "gitlab.com";
    owner = "Schmiddiii";
    repo = pname;
    rev = version;
-    hash = "sha256-w4WaWcUsjKiWfNe5StwRcPlcXqWz0427It96L1NsR0U=";
+    hash = "sha256-6p9uuK71fJvJs0U14jJEVb2mfpZWrCZZFE3eoZe9eVo=";
  };

  cargoDeps = rustPlatform.importCargoLock {
@ -31,12 +34,14 @@ stdenv.mkDerivation rec {
    outputHashes = {
      "curve25519-dalek-3.2.1" = "sha256-0hFRhn920tLBpo6ZNCl6DYtTMHMXY/EiDvuhOPVjvC0=";
      "libsignal-protocol-0.1.0" = "sha256-IBhmd3WzkICiADO24WLjDJ8pFILGwWNUHLXKpt+Y0IY=";
-      "libsignal-service-0.1.0" = "sha256-art5O06X4lhp9PoAd23mi6F1wRWkUcyON7AK8uBDoK8=";
-      "presage-0.6.0-dev" = "sha256-DVImXySYL0zlGkwss/5DnQ3skTaBa7l55VWIGCd6kQU=";
+      "libsignal-service-0.1.0" = "sha256-WSRqBNq9jbe6PSeExfmehNZwjlB70GLlHkrDlw59O5c=";
+      "presage-0.6.0-dev" = "sha256-oNDfFLir3XL2UOGrWR/IFO7XTeJKX+vjdrd3qbIomtw=";
    };
  };

  nativeBuildInputs = [
+    appstream-glib # for appstream-util
+    blueprint-compiler
    desktop-file-utils # for update-desktop-database
    meson
    ninja
@ -51,6 +56,12 @@ stdenv.mkDerivation rec {
    libadwaita
    libsecret
    protobuf
+
+    # To reproduce audio messages
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
  ];

  meta = {
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230716";
+  version = "20230723-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-k2QY+7mEXqvDzO0xv3XxQdhDje4iCPVOUybWnONLMTM=";
+    hash = "sha256-EHwQHFKahjpP8OOIY0ZRpkmYZYiDNteeMLkRwJIEp7g=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -17,18 +17,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.2.4";
+  version = "1.2.8";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-x5OYSU396FIgFbs4VchEpKI8Xv0mk2XPraejBgzWta0=";
+    hash = "sha256-5OocTsQjmNZCnzAY1RfrxD6Ad/kZTIkFl/3OmeJl1oI=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-HiNBXDQuPM8MnSkxYS5f+kop5QeUintNPBWtp6uhiz8=";
+    hash = "sha256-XUASMWrH8wWeYsr6gCdQGgV/7E6hLDWkJ0BXHZCepKQ=";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -30,11 +30,11 @@ in
 stdenv.mkDerivation rec {
  pname = "teamspeak-client";

-  version = "3.6.0";
+  version = "3.6.1";

  src = fetchurl {
    url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
-    hash = "sha256-ZbElnFoQmXdtCR9lb6eOz4dMzSwpfjC1DvG3VbDoSEA=";
+    hash = "sha256-j4sgZ+tJpV6ST0yLmbLTLgBxQTcK1LZoEEfMe3TUAC4=";
  };

  # grab the plugin sdk for the desktop icon
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -3,12 +3,12 @@ electron, libsecret }:

 stdenv.mkDerivation rec {
  pname = "tutanota-desktop";
-  version = "3.113.3";
+  version = "3.115.2";

  src = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
    name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-d4yvz0BE0YeZjcH9X/2eGAk5CmJI4CQWblVoU5CO77k=";
+    sha256 = "sha256-PdVvrb+sC8LF4tZXAHt2CevyoXhxTXJB01Fe64YI6BI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildGoModule
 , testers
 , seaweedfs
@ -8,26 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.54";
+  version = "3.55";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-2E2ANJIKWhUUxxSqk5+QROeoKnp1Akl5Bp+i8pPTkuQ=";
+    hash = "sha256-qAyvGisj6GOjyRmqpTsxX/Zy8bx6+cAtmEId5us70+k=";
  };

-  patches = [
-    # Fix build on aarch64-darwin
-    # (remove again when v3.55 is released)
-    # https://github.com/seaweedfs/seaweedfs/pull/4679
-    (fetchpatch {
-      url = "https://github.com/seaweedfs/seaweedfs/commit/1bfc9581e0bc04f394187a0d39f319ad65df5aca.patch";
-      hash = "sha256-znQFtm8BYAjuvXa+vibawBb+uhnjOL9/o0sXNoXwLk8=";
-    })
-  ];
-
-  vendorHash = "sha256-VK7BmApGq+X1oNjcwCSYHcEvVjL87t8fgJXLNQSfy3I=";
+  vendorHash = "sha256-F6Fqv5tUsty/uGwBnKM4r671Gh2T1+9Z2LRGAMF+M2g=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/networking/weather/meteo/default.nix
+++ b/pkgs/applications/networking/weather/meteo/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "meteo";
-  version = "0.9.9.1";
+  version = "0.9.9.2";

  src = fetchFromGitLab {
    owner = "bitseater";
    repo = pname;
    rev = version;
-    sha256 = "sha256-kkUVTxh5svk61oDp/dpe3ILGyexYe3UaS+LgWsy+Z9s=";
+    sha256 = "sha256-9+FNpLjiX0zdsUnbBnNSLt/Ma/cqtclP25tl+faPlpU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/libreoffice/0001-Strip-away-BUILDCONFIG.patch
+++ b/pkgs/applications/office/libreoffice/0001-Strip-away-BUILDCONFIG.patch
@ -0,0 +1,32 @@
+From 982d38084f08950863b55043f36ce5548bd73635 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Mon, 24 Jul 2023 19:12:25 +0200
+Subject: [PATCH] Strip away BUILDCONFIG
+
+The `BuildConfig` field in `libsofficeapp.so` includes the entire
+`PKG_CONFIG_PATH` and subsequently references to a lot of `dev` outputs
+of library dependencies blowing up the closure.
+
+Since this is not strictly needed and the inputs are comprehensible via
+`nix derivation show`, this doesn't bring a real benefit in the case of
+nixpkgs anyways.
+---
+ desktop/source/lib/init.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/desktop/source/lib/init.cxx b/desktop/source/lib/init.cxx
+index 8d830c0cbd00..fbdc86aa7115 100644
+--- a/desktop/source/lib/init.cxx
+++ b/desktop/source/lib/init.cxx
+@@ -7097,7 +7097,7 @@ static char* lo_getVersionInfo(SAL_UNUSED_PARAMETER LibreOfficeKit* /*pThis*/)
+         "\"ProductVersion\": \"%PRODUCTVERSION\", "
+         "\"ProductExtension\": \"%PRODUCTEXTENSION\", "
+         "\"BuildId\": \"%BUILDID\", "
+-        "\"BuildConfig\": \""  BUILDCONFIG  "\" "
+        "\"BuildConfig\": \"removed to avoid runtime dependencies against dev outputs of each dependency. Use 'nix derivation show' against the package to find out details about BuildConfig.\" "
+         "}"));
+ }
+ 
+-- 
+2.40.1
+
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -214,6 +214,22 @@ in
    tar -xf ${srcs.translations}
  '';

+  # Remove build config to reduce the amount of `-dev` outputs in the
+  # runtime closure. This was introduced in upstream commit
+  # cbfac11330882c7d0a817b6c37a08b2ace2b66f4, so the patch doesn't apply
+  # for 7.4.
+  patches = lib.optionals (lib.versionAtLeast version "7.5") [
+    ./0001-Strip-away-BUILDCONFIG.patch
+  ];
+
+  # libreoffice tries to reference the BUILDCONFIG (e.g. PKG_CONFIG_PATH)
+  # in the binary causing the closure size to blow up because of many unnecessary
+  # dependencies to dev outputs. This behavior was patched away in nixpkgs
+  # (see above), make sure these don't leak again by accident.
+  disallowedRequisites = lib.concatMap
+    (x: lib.optional (x?dev) x.dev)
+    buildInputs;
+
  ### QT/KDE
  #
  # configure.ac assumes that the first directory that contains headers and
--- a/pkgs/applications/radio/ax25-tools/default.nix
+++ b/pkgs/applications/radio/ax25-tools/default.nix
@ -17,7 +17,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-kqnLi1iobcufVWMPxUyaRsWKIPyTvtUkuMERGQs2qgY=";
  };

-  configureFlags = [ "--sysconfdir=/etc" ];
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var/lib"
+  ];

  meta = with lib; {
    description = "Non-GUI tools used to configure an AX.25 enabled computer";
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://github.com/jopohl/urh";
    description = "Universal Radio Hacker: investigate wireless protocols like a boss";
    license = licenses.gpl3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ fpletz ];
  };
 }
--- a/pkgs/applications/science/electronics/kingstvis/default.nix
+++ b/pkgs/applications/science/electronics/kingstvis/default.nix
@ -0,0 +1,59 @@
+{ buildFHSEnv
+, dbus
+, fetchzip
+, fontconfig
+, freetype
+, glib
+, lib
+, libGL
+, stdenv
+, xkeyboard_config
+, xorg
+, zlib
+}:
+
+let
+  name = "kingstvis";
+  version = "3.6.1";
+  src = fetchzip {
+    url = "http://res.kingst.site/kfs/KingstVIS_v${version}.tar.gz";
+    hash = "sha256-eZJ3RZWdmNx/El3Hh5kUf44pIwdvwOEkRysYBgUkS18=";
+  };
+in
+
+buildFHSEnv {
+  inherit name;
+
+  targetPkgs = pkgs: (with pkgs; [
+    dbus
+    fontconfig
+    freetype
+    glib
+    libGL
+    xkeyboard_config
+    xorg.libICE
+    xorg.libSM
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libxcb
+    zlib
+  ]);
+
+  extraInstallCommands = ''
+    install -Dvm644 ${src}/Driver/99-Kingst.rules \
+      $out/lib/udev/rules.d/99-Kingst.rules
+  '';
+
+  runScript = "${src}/KingstVIS";
+
+  meta = {
+    description = "Kingst Virtual Instruments Studio, software for logic analyzers";
+    homepage = "http://www.qdkingst.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.luisdaranda ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/science/math/caffe/default.nix
+++ b/pkgs/applications/science/math/caffe/default.nix
@ -13,7 +13,7 @@
 , Accelerate, CoreGraphics, CoreVideo
 , lmdbSupport ? true, lmdb
 , leveldbSupport ? true, leveldb, snappy
-, cudaSupport ? config.cudaSupport or false, cudaPackages ? {}
+, cudaSupport ? config.cudaSupport, cudaPackages ? { }
 , cudnnSupport ? cudaSupport
 , ncclSupport ? false
 , pythonSupport ? false, python ? null, numpy ? null
--- a/pkgs/applications/science/math/cntk/default.nix
+++ b/pkgs/applications/science/math/cntk/default.nix
@ -2,7 +2,8 @@
 , fetchpatch
 , openblas, blas, lapack, opencv3, libzip, boost, protobuf, mpi
 , onebitSGDSupport ? false
-, cudaSupport ? false, cudaPackages ? {}, addOpenGLRunpath, cudatoolkit, nvidia_x11
+, config
+, cudaSupport ? config.cudaSupport, cudaPackages ? { }, addOpenGLRunpath, cudatoolkit, nvidia_x11
 , cudnnSupport ? cudaSupport
 }:

--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@ -2,7 +2,7 @@
 , config
 , lib
 , cudaPackages
-, cudaSupport ? config.cudaSupport or false
+, cudaSupport ? config.cudaSupport
 , lang ? "en"
 , webdoc ? false
 , version ? null
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@ -1,6 +1,6 @@
 { config, stdenv, lib, fetchurl, fetchpatch, bash, cmake
 , opencv3, gtest, blas, gomp, llvmPackages, perl
-, cudaSupport ? config.cudaSupport or false, cudaPackages ? {}, nvidia_x11
+, cudaSupport ? config.cudaSupport, cudaPackages ? { }, nvidia_x11
 , cudnnSupport ? cudaSupport
 }:

--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@ -1,6 +1,7 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, boost179, ceres-solver, eigen,
  freeimage, glog, libGLU, glew, qtbase,
-  cudaSupport ? false, cudaPackages }:
+  config,
+  cudaSupport ? config.cudaSupport, cudaPackages }:

 assert cudaSupport -> cudaPackages != { };

--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -1,7 +1,8 @@
 { lib, stdenv, fetchurl, cmake, hwloc, fftw, perl, blas, lapack, mpi, cudatoolkit
 , singlePrec ? true
+, config
 , enableMpi ? false
-, enableCuda ? false
+, enableCuda ? config.cudaSupport
 , cpuAcceleration ? null
 }:

--- a/pkgs/applications/system/psitop/default.nix
+++ b/pkgs/applications/system/psitop/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "psitop";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jamespwilliams";
+    repo = "psitop";
+    rev = version;
+    hash = "sha256-C8WEbA7XXohKFz7QgII0LPU1eJ4Z7CSlmEOamgo4wQI=";
+  };
+
+  vendorHash = "sha256-oLtKpBvTsM5TbzfWIDfqgb7DL5D3Mldu0oimVeiUeSc=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Top for /proc/pressure";
+    homepage = "https://github.com/jamespwilliams/psitop";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
--- a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -37,6 +37,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-ebwh9WTooJuvYFIygDBn9lYC7+lx9P1HskvKU8EX9jw=";
  };

+  patches = [
+    # Fix closing confirmation dialogs not showing
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/raggesilver/blackbox/-/commit/3978c9b666d27adba835dd47cf55e21515b6d6d9.patch";
+      hash = "sha256-L/Ci4YqYNzb3F49bUwEWSjzr03MIPK9A5FEJCCct+7A=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs build-aux/meson/postinstall.py
  '';
--- a/pkgs/applications/version-management/gex/default.nix
+++ b/pkgs/applications/version-management/gex/default.nix
@ -8,19 +8,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "gex";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "Piturnah";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-//sQ0s8bBQzuu5aO3RjPRjFuVYiGW6BwSPoCWKAx9DQ=";
+    hash = "sha256-J2tmDpt4vRFgD5yfFZOdBLROvyZVEthc+MHM1Yta5jI=";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ libgit2 ];

-  cargoHash = "sha256-rkhkFnRDtMTWFM+E5C4jR7TWtHdy3WUtIzvGDDLHqtE=";
+  cargoHash = "sha256-AsUHswR7+wMyAvOp3rkvRJvThHLH993gQ+/V38vbbNQ=";

  meta = with lib; {
    description = "Git Explorer: cross-platform git workflow improvement tool inspired by Magit";
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.32.0";
+  version = "2.32.1";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-YnIwrx/NEOH3yXkkCq30i9Jt2IXKX5IX8BuM6+u9tvs=";
+    hash = "sha256-DfcafkgauO0mlMEJTfR7hjnkY1QJ4dUyrWv/bqJlVAo=";
  };

-  vendorHash = "sha256-fbf5EKDISdptbiJipvqygfjGWAP6fPXbYsgxVq8eUnM=";
+  vendorHash = "sha256-7Izhqma/zukH9M7EvV9I4axefVaTDoNVXQmLx+GjAt0=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@ -12,13 +12,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.17.6";
+  version = "3.17.8";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-o3Z1xPu5RcspU4m3Bb6ydZkXOMgOMJPN/+TLekwe/wI=";
+    hash = "sha256-d1vbLlGKln/zcuuKZgNOcu/z15co3p8ecrwL5lucIEk=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -151,7 +151,7 @@ stdenv.mkDerivation rec {
      video content, efficiently
    '';
    homepage = "https://obsproject.com";
-    maintainers = with maintainers; [ jb55 MP2E V miangraham ];
+    maintainers = with maintainers; [ jb55 MP2E V ];
    license = licenses.gpl2Plus;
    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
    mainProgram = "obs";
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -40,7 +40,6 @@ let
    runc
    crun
    conmon
-    slirp4netns
    fuse-overlayfs
    util-linux
    iptables
@ -57,18 +56,19 @@ let
      aardvark-dns
      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
      netavark
+      slirp4netns
    ];
  };
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.5.1";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-PG2/iMsr/shLqhuYSvhT1I1kPDh0g0ebnGUHHzA7u5A=";
+    hash = "sha256-8cfEZBYhR5CWkHEpIZ0j011gyV6lnY7z4KgJPJr0MfQ=";
  };

  patches = [
--- a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
+++ b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
@ -1,9 +1,9 @@
 diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
-index 4f25b4d26..8a79862fd 100644
+index a118285f7..d775f0099 100644
 --- a/pkg/machine/qemu/machine.go
 +++ b/pkg/machine/qemu/machine.go
-@@ -1509,11 +1509,6 @@ func (v *MachineVM) waitAPIAndPrintInfo(forwardState apiForwardingState, forward
- 			case notInstalled:
+@@ -1560,11 +1560,6 @@ func (v *MachineVM) waitAPIAndPrintInfo(forwardState machine.APIForwardingState,
+ 			case machine.NotInstalled:
 				fmt.Printf("\nThe system helper service is not installed; the default Docker API socket\n")
 				fmt.Printf("address can't be used by podman. ")
 -				if helper := findClaimHelper(); len(helper) > 0 {
@ -11,6 +11,6 @@ index 4f25b4d26..8a79862fd 100644
 -					fmt.Printf("\n\tsudo %s install\n", helper)
 -					fmt.Printf("\tpodman machine stop%s; podman machine start%s\n\n", suffix, suffix)
 -				}
- 			case machineLocal:
+ 			case machine.MachineLocal:
 				fmt.Printf("\nAnother process was listening on the default Docker API socket address.\n")
- 			case claimUnsupported:
+ 			case machine.ClaimUnsupported:
--- a/pkgs/applications/window-managers/gamescope/default.nix
+++ b/pkgs/applications/window-managers/gamescope/default.nix
@ -33,7 +33,7 @@
 }:
 let
  pname = "gamescope";
-  version = "3.12.0-beta9";
+  version = "3.12.0-beta10";

  vkroots = fetchFromGitHub {
    owner = "Joshua-Ashton";
@ -49,7 +49,7 @@ stdenv.mkDerivation {
    owner = "ValveSoftware";
    repo = "gamescope";
    rev = "refs/tags/${version}";
-    hash = "sha256-nPFHMRp3uq2CIxY3EdaoTltqyb5z0kFwXw5U9ajbrfo=";
+    hash = "sha256-31zGo22Z0+zQ81LmzI+Xif9eREzRpS0S9+nK1i/cBCY=";
  };

  patches = [
--- a/pkgs/build-support/writers/data.nix
+++ b/pkgs/build-support/writers/data.nix
@ -0,0 +1,80 @@
+{ lib, runCommandNoCC, dasel }:
+let
+  daselBin = lib.getExe dasel;
+
+  inherit (lib)
+    last
+    optionalString
+    types
+    ;
+in
+rec {
+  # Creates a transformer function that writes input data to disk, transformed
+  # by both the `input` and `output` arguments.
+  #
+  # Type: makeDataWriter :: input -> output -> nameOrPath -> data -> (any -> string) -> string -> string -> any -> derivation
+  #
+  #   input :: T -> string: function that takes the nix data and returns a string
+  #   output :: string: script that takes the $inputFile and write the result into $out
+  #   nameOrPath :: string: if the name contains a / the files gets written to a sub-folder of $out. The derivation name is the basename of this argument.
+  #   data :: T: the data that will be converted.
+  #
+  # Example:
+  #   writeJSON = makeDataWriter { input = builtins.toJSON; output = "cp $inputPath $out"; };
+  #   myConfig = writeJSON "config.json" { hello = "world"; }
+  #
+  makeDataWriter = { input ? lib.id, output ? "cp $inputPath $out" }: nameOrPath: data:
+    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    let
+      name = last (builtins.split "/" nameOrPath);
+    in
+    runCommandNoCC name
+      {
+        input = input data;
+        passAsFile = [ "input" ];
+      } ''
+      ${output}
+
+      ${optionalString (types.path.check nameOrPath) ''
+        mv $out tmp
+        mkdir -p $out/$(dirname "${nameOrPath}")
+        mv tmp $out/${nameOrPath}
+      ''}
+    '';
+
+  # Writes the content to text.
+  #
+  # Example:
+  #   writeText "filename.txt" "file content"
+  writeText = makeDataWriter {
+    input = toString;
+    output = "cp $inputPath $out";
+  };
+
+  # Writes the content to a JSON file.
+  #
+  # Example:
+  #   writeJSON "data.json" { hello = "world"; }
+  writeJSON = makeDataWriter {
+    input = builtins.toJSON;
+    output = "${daselBin} -f $inputPath -r json -w json > $out";
+  };
+
+  # Writes the content to a TOML file.
+  #
+  # Example:
+  #   writeTOML "data.toml" { hello = "world"; }
+  writeTOML = makeDataWriter {
+    input = builtins.toJSON;
+    output = "${daselBin} -f $inputPath -r json -w toml > $out";
+  };
+
+  # Writes the content to a YAML file.
+  #
+  # Example:
+  #   writeYAML "data.yaml" { hello = "world"; }
+  writeYAML = makeDataWriter {
+    input = builtins.toJSON;
+    output = "${daselBin} -f $inputPath -r json -w yaml > $out";
+  };
+}
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@ -1,367 +1,18 @@
-{ pkgs, config, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gixy }:
+{ pkgs, config, lib }:

 let
  aliases = if config.allowAliases then (import ./aliases.nix lib) else prev: {};

-  writers = with lib; rec {
-  # Base implementation for non-compiled executables.
-  # Takes an interpreter, for example `${pkgs.bash}/bin/bash`
-  #
-  # Examples:
-  #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
-  #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
-  makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
-    assert lib.or (types.path.check content) (types.str.check content);
-    let
-      name = last (builtins.split "/" nameOrPath);
-    in
-
-    pkgs.runCommandLocal name (if (types.str.check content) then {
-      inherit content interpreter;
-      passAsFile = [ "content" ];
-    } else {
-      inherit interpreter;
-      contentPath = content;
-    }) ''
-      # On darwin a script cannot be used as an interpreter in a shebang but
-      # there doesn't seem to be a limit to the size of shebang and multiple
-      # arguments to the interpreter are allowed.
-      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
-      then
-        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
-        # Get first word from the line (note: xargs echo remove leading spaces)
-        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
-
-        if isScript $wrapperInterpreter
-        then
-          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
-          exit 1
-        fi
-
-        # This should work as long as wrapperInterpreter is a shell, which is
-        # the case for programs wrapped with makeWrapper, like
-        # python3.withPackages etc.
-        interpreterLine="$wrapperInterpreterLine $interpreter"
-      else
-        interpreterLine=$interpreter
-      fi
-
-      echo "#! $interpreterLine" > $out
-      cat "$contentPath" >> $out
-      ${optionalString (check != "") ''
-        ${check} $out
-      ''}
-      chmod +x $out
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
-
-  # Base implementation for compiled executables.
-  # Takes a compile script, which in turn takes the name as an argument.
-  #
-  # Examples:
-  #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
-  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
-    assert lib.or (types.path.check content) (types.str.check content);
-    let
-      name = last (builtins.split "/" nameOrPath);
-    in
-    pkgs.runCommand name ((if (types.str.check content) then {
-      inherit content;
-      passAsFile = [ "content" ];
-    } else {
-      contentPath = content;
-    }) // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
-      # post-link-hook expects codesign_allocate to be in PATH
-      # https://github.com/NixOS/nixpkgs/issues/154203
-      # https://github.com/NixOS/nixpkgs/issues/148189
-      nativeBuildInputs = [ stdenv.cc.bintools ];
-    }) ''
-      ${compileScript}
-      ${lib.optionalString strip
-          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
-      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
-      # mach-o executables from the get-go, but need to be corrected somehow
-      # which is done by fixupPhase.
-      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
-
-  # Like writeScript but the first line is a shebang to bash
-  #
-  # Example:
-  #   writeBash "example" ''
-  #     echo hello world
-  #   ''
-  writeBash = makeScriptWriter {
-    interpreter = "${pkgs.bash}/bin/bash";
+  # Writers for JSON-like data structures
+  dataWriters = import ./data.nix {
+    inherit lib; inherit (pkgs) runCommandNoCC dasel;
  };

-  # Like writeScriptBin but the first line is a shebang to bash
-  writeBashBin = name:
-    writeBash "/bin/${name}";
-
-  # Like writeScript but the first line is a shebang to dash
-  #
-  # Example:
-  #   writeDash "example" ''
-  #     echo hello world
-  #   ''
-  writeDash = makeScriptWriter {
-    interpreter = "${pkgs.dash}/bin/dash";
+  # Writers for scripts
+  scriptWriters = import ./scripts.nix {
+    inherit lib pkgs;
  };

-  # Like writeScriptBin but the first line is a shebang to dash
-  writeDashBin = name:
-    writeDash "/bin/${name}";
-
-  # Like writeScript but the first line is a shebang to fish
-  #
-  # Example:
-  #   writeFish "example" ''
-  #     echo hello world
-  #   ''
-  writeFish = makeScriptWriter {
-    interpreter = "${pkgs.fish}/bin/fish --no-config";
-    check = "${pkgs.fish}/bin/fish --no-config --no-execute";  # syntax check only
-  };
-
-  # Like writeScriptBin but the first line is a shebang to fish
-  writeFishBin = name:
-    writeFish "/bin/${name}";
-
-  # writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
-  # and some haskell source code and returns an executable.
-  #
-  # Example:
-  #   writeHaskell "missiles" { libraries = [ pkgs.haskellPackages.acme-missiles ]; } ''
-  #     import Acme.Missiles
-  #
-  #     main = launchMissiles
-  #   '';
-  writeHaskell = name: {
-    libraries ? [],
-    ghc ? pkgs.ghc,
-    ghcArgs ? [],
-    threadedRuntime ? true,
-    strip ? true
-  }:
-    let
-      appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
-      ghcArgs' = if threadedRuntime then appendIfNotSet "-threaded" ghcArgs else ghcArgs;
-
-    in makeBinWriter {
-      compileScript = ''
-        cp $contentPath tmp.hs
-        ${ghc.withPackages (_: libraries )}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
-        mv tmp $out
-      '';
-      inherit strip;
-    } name;
-
-  # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
-  writeHaskellBin = name:
-    writeHaskell "/bin/${name}";
-
-  writeRust = name: {
-      rustc ? pkgs.rustc,
-      rustcArgs ? [],
-      strip ? true
-  }:
-  let
-    darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
-  in
-    makeBinWriter {
-      compileScript = ''
-        cp "$contentPath" tmp.rs
-        PATH=${makeBinPath [pkgs.gcc]} ${lib.getBin rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
-      '';
-      inherit strip;
-    } name;
-
-  writeRustBin = name:
-    writeRust "/bin/${name}";
-
-  # writeJS takes a name an attributeset with libraries and some JavaScript sourcecode and
-  # returns an executable
-  #
-  # Example:
-  #   writeJS "example" { libraries = [ pkgs.nodePackages.uglify-js ]; } ''
-  #     var UglifyJS = require("uglify-js");
-  #     var code = "function add(first, second) { return first + second; }";
-  #     var result = UglifyJS.minify(code);
-  #     console.log(result.code);
-  #   ''
-  writeJS = name: { libraries ? [] }: content:
-  let
-    node-env = pkgs.buildEnv {
-      name = "node";
-      paths = libraries;
-      pathsToLink = [
-        "/lib/node_modules"
-      ];
-    };
-  in writeDash name ''
-    export NODE_PATH=${node-env}/lib/node_modules
-    exec ${pkgs.nodejs}/bin/node ${pkgs.writeText "js" content} "$@"
-  '';
-
-  # writeJSBin takes the same arguments as writeJS but outputs a directory (like writeScriptBin)
-  writeJSBin = name:
-    writeJS "/bin/${name}";
-
-  awkFormatNginx = builtins.toFile "awkFormat-nginx.awk" ''
-    awk -f
-    {sub(/^[ \t]+/,"");idx=0}
-    /\{/{ctx++;idx=1}
-    /\}/{ctx--}
-    {id="";for(i=idx;i<ctx;i++)id=sprintf("%s%s", id, "\t");printf "%s%s\n", id, $0}
-   '';
-
-  writeNginxConfig = name: text: pkgs.runCommandLocal name {
-    inherit text;
-    passAsFile = [ "text" ];
-    nativeBuildInputs = [ gixy ];
-  } /* sh */ ''
-    # nginx-config-formatter has an error - https://github.com/1connect/nginx-config-formatter/issues/16
-    awk -f ${awkFormatNginx} "$textPath" | sed '/^\s*$/d' > $out
-    gixy $out
-  '';
-
-  # writePerl takes a name an attributeset with libraries and some perl sourcecode and
-  # returns an executable
-  #
-  # Example:
-  #   writePerl "example" { libraries = [ pkgs.perlPackages.boolean ]; } ''
-  #     use boolean;
-  #     print "Howdy!\n" if true;
-  #   ''
-  writePerl = name: { libraries ? [] }:
-    makeScriptWriter {
-      interpreter = "${pkgs.perl.withPackages (p: libraries)}/bin/perl";
-    } name;
-
-  # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
-  writePerlBin = name:
-    writePerl "/bin/${name}";
-
-  # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
-  # which validates the script with flake8 at build time. If any libraries are specified,
-  # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
-  let
-    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
-  in
-  makeScriptWriter {
-    interpreter =
-      if libraries == []
-      then python.interpreter
-      else (python.withPackages (ps: libraries)).interpreter
-    ;
-    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
-    '');
-  } name;
-
-  # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
-  # returns an executable
-  #
-  # Example:
-  # writePyPy2 "test_pypy2" { libraries = [ pkgs.pypy2Packages.enum ]; } ''
-  #   from enum import Enum
-  #
-  #   class Test(Enum):
-  #       a = "success"
-  #
-  #   print Test.a
-  # ''
-  writePyPy2 = makePythonWriter pkgs.pypy2 pkgs.pypy2Packages buildPackages.pypy2Packages;
-
-  # writePyPy2Bin takes the same arguments as writePyPy2 but outputs a directory (like writeScriptBin)
-  writePyPy2Bin = name:
-    writePyPy2 "/bin/${name}";
-
-  # writePython3 takes a name an attributeset with libraries and some python3 sourcecode and
-  # returns an executable
-  #
-  # Example:
-  # writePython3 "test_python3" { libraries = [ pkgs.python3Packages.pyyaml ]; } ''
-  #   import yaml
-  #
-  #   y = yaml.load("""
-  #     - test: success
-  #   """)
-  #   print(y[0]['test'])
-  # ''
-  writePython3 = makePythonWriter pkgs.python3 pkgs.python3Packages buildPackages.python3Packages;
-
-  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
-  writePython3Bin = name:
-    writePython3 "/bin/${name}";
-
-  # writePyPy3 takes a name an attributeset with libraries and some pypy3 sourcecode and
-  # returns an executable
-  #
-  # Example:
-  # writePyPy3 "test_pypy3" { libraries = [ pkgs.pypy3Packages.pyyaml ]; } ''
-  #   import yaml
-  #
-  #   y = yaml.load("""
-  #     - test: success
-  #   """)
-  #   print(y[0]['test'])
-  # ''
-  writePyPy3 = makePythonWriter pkgs.pypy3 pkgs.pypy3Packages buildPackages.pypy3Packages;
-
-  # writePyPy3Bin takes the same arguments as writePyPy3 but outputs a directory (like writeScriptBin)
-  writePyPy3Bin = name:
-    writePyPy3 "/bin/${name}";
-
-
-  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
-  let
-    fname = last (builtins.split "/" nameOrPath);
-    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
-    _nugetDeps = mkNugetDeps { name = "${fname}-nuget-deps"; nugetDeps = libraries; };
-
-    nuget-source = mkNugetSource {
-      name = "${fname}-nuget-source";
-      description = "A Nuget source with the dependencies for ${fname}";
-      deps = [ _nugetDeps ];
-    };
-
-    fsi = writeBash "fsi" ''
-      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
-      export DOTNET_CLI_TELEMETRY_OPTOUT=1
-      export DOTNET_NOLOGO=1
-      script="$1"; shift
-      ${dotnet-sdk}/bin/dotnet fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
-    '';
-
-  in content: writers.makeScriptWriter {
-    interpreter = fsi;
-  } path
-  ''
-    #i "nuget: ${nuget-source}/lib"
-    ${ content }
-    exit 0
-  '';
-
-  writeFSharp =
-    makeFSharpWriter {};
-
-  writeFSharpBin = name:
-    writeFSharp "/bin/${name}";
-
-};
+  writers = scriptWriters // dataWriters;
 in
 writers // (aliases writers)
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@ -0,0 +1,383 @@
+{ pkgs, lib }:
+let
+  inherit (lib)
+    concatMapStringsSep
+    elem
+    escapeShellArg
+    last
+    optionalString
+    stringLength
+    strings
+    types
+    ;
+
+  inherit (pkgs)
+    buildPackages
+    gixy
+    libiconv
+    mkNugetDeps
+    mkNugetSource
+    stdenv
+    ;
+in
+rec {
+  # Base implementation for non-compiled executables.
+  # Takes an interpreter, for example `${pkgs.bash}/bin/bash`
+  #
+  # Examples:
+  #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
+  #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
+  makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
+    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    assert lib.or (types.path.check content) (types.str.check content);
+    let
+      name = last (builtins.split "/" nameOrPath);
+    in
+
+    pkgs.runCommandLocal name (if (types.str.check content) then {
+      inherit content interpreter;
+      passAsFile = [ "content" ];
+    } else {
+      inherit interpreter;
+      contentPath = content;
+    }) ''
+      # On darwin a script cannot be used as an interpreter in a shebang but
+      # there doesn't seem to be a limit to the size of shebang and multiple
+      # arguments to the interpreter are allowed.
+      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
+      then
+        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
+        # Get first word from the line (note: xargs echo remove leading spaces)
+        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
+
+        if isScript $wrapperInterpreter
+        then
+          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
+          exit 1
+        fi
+
+        # This should work as long as wrapperInterpreter is a shell, which is
+        # the case for programs wrapped with makeWrapper, like
+        # python3.withPackages etc.
+        interpreterLine="$wrapperInterpreterLine $interpreter"
+      else
+        interpreterLine=$interpreter
+      fi
+
+      echo "#! $interpreterLine" > $out
+      cat "$contentPath" >> $out
+      ${optionalString (check != "") ''
+        ${check} $out
+      ''}
+      chmod +x $out
+      ${optionalString (types.path.check nameOrPath) ''
+        mv $out tmp
+        mkdir -p $out/$(dirname "${nameOrPath}")
+        mv tmp $out/${nameOrPath}
+      ''}
+    '';
+
+  # Base implementation for compiled executables.
+  # Takes a compile script, which in turn takes the name as an argument.
+  #
+  # Examples:
+  #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
+  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
+    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    assert lib.or (types.path.check content) (types.str.check content);
+    let
+      name = last (builtins.split "/" nameOrPath);
+    in
+    pkgs.runCommand name ((if (types.str.check content) then {
+      inherit content;
+      passAsFile = [ "content" ];
+    } else {
+      contentPath = content;
+    }) // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
+      # post-link-hook expects codesign_allocate to be in PATH
+      # https://github.com/NixOS/nixpkgs/issues/154203
+      # https://github.com/NixOS/nixpkgs/issues/148189
+      nativeBuildInputs = [ stdenv.cc.bintools ];
+    }) ''
+      ${compileScript}
+      ${lib.optionalString strip
+          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
+      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
+      # mach-o executables from the get-go, but need to be corrected somehow
+      # which is done by fixupPhase.
+      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
+      ${optionalString (types.path.check nameOrPath) ''
+        mv $out tmp
+        mkdir -p $out/$(dirname "${nameOrPath}")
+        mv tmp $out/${nameOrPath}
+      ''}
+    '';
+
+  # Like writeScript but the first line is a shebang to bash
+  #
+  # Example:
+  #   writeBash "example" ''
+  #     echo hello world
+  #   ''
+  writeBash = makeScriptWriter {
+    interpreter = "${pkgs.bash}/bin/bash";
+  };
+
+  # Like writeScriptBin but the first line is a shebang to bash
+  writeBashBin = name:
+    writeBash "/bin/${name}";
+
+  # Like writeScript but the first line is a shebang to dash
+  #
+  # Example:
+  #   writeDash "example" ''
+  #     echo hello world
+  #   ''
+  writeDash = makeScriptWriter {
+    interpreter = "${pkgs.dash}/bin/dash";
+  };
+
+  # Like writeScriptBin but the first line is a shebang to dash
+  writeDashBin = name:
+    writeDash "/bin/${name}";
+
+  # Like writeScript but the first line is a shebang to fish
+  #
+  # Example:
+  #   writeFish "example" ''
+  #     echo hello world
+  #   ''
+  writeFish = makeScriptWriter {
+    interpreter = "${pkgs.fish}/bin/fish --no-config";
+    check = "${pkgs.fish}/bin/fish --no-config --no-execute";  # syntax check only
+  };
+
+  # Like writeScriptBin but the first line is a shebang to fish
+  writeFishBin = name:
+    writeFish "/bin/${name}";
+
+  # writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
+  # and some haskell source code and returns an executable.
+  #
+  # Example:
+  #   writeHaskell "missiles" { libraries = [ pkgs.haskellPackages.acme-missiles ]; } ''
+  #     import Acme.Missiles
+  #
+  #     main = launchMissiles
+  #   '';
+  writeHaskell = name: {
+    libraries ? [],
+    ghc ? pkgs.ghc,
+    ghcArgs ? [],
+    threadedRuntime ? true,
+    strip ? true
+  }:
+    let
+      appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
+      ghcArgs' = if threadedRuntime then appendIfNotSet "-threaded" ghcArgs else ghcArgs;
+
+    in makeBinWriter {
+      compileScript = ''
+        cp $contentPath tmp.hs
+        ${ghc.withPackages (_: libraries )}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
+        mv tmp $out
+      '';
+      inherit strip;
+    } name;
+
+  # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
+  writeHaskellBin = name:
+    writeHaskell "/bin/${name}";
+
+  writeRust = name: {
+      rustc ? pkgs.rustc,
+      rustcArgs ? [],
+      strip ? true
+  }:
+  let
+    darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
+  in
+    makeBinWriter {
+      compileScript = ''
+        cp "$contentPath" tmp.rs
+        PATH=${lib.makeBinPath [pkgs.gcc]} ${lib.getBin rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
+      '';
+      inherit strip;
+    } name;
+
+  writeRustBin = name:
+    writeRust "/bin/${name}";
+
+  # writeJS takes a name an attributeset with libraries and some JavaScript sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writeJS "example" { libraries = [ pkgs.nodePackages.uglify-js ]; } ''
+  #     var UglifyJS = require("uglify-js");
+  #     var code = "function add(first, second) { return first + second; }";
+  #     var result = UglifyJS.minify(code);
+  #     console.log(result.code);
+  #   ''
+  writeJS = name: { libraries ? [] }: content:
+  let
+    node-env = pkgs.buildEnv {
+      name = "node";
+      paths = libraries;
+      pathsToLink = [
+        "/lib/node_modules"
+      ];
+    };
+  in writeDash name ''
+    export NODE_PATH=${node-env}/lib/node_modules
+    exec ${pkgs.nodejs}/bin/node ${pkgs.writeText "js" content} "$@"
+  '';
+
+  # writeJSBin takes the same arguments as writeJS but outputs a directory (like writeScriptBin)
+  writeJSBin = name:
+    writeJS "/bin/${name}";
+
+  awkFormatNginx = builtins.toFile "awkFormat-nginx.awk" ''
+    awk -f
+    {sub(/^[ \t]+/,"");idx=0}
+    /\{/{ctx++;idx=1}
+    /\}/{ctx--}
+    {id="";for(i=idx;i<ctx;i++)id=sprintf("%s%s", id, "\t");printf "%s%s\n", id, $0}
+   '';
+
+  writeNginxConfig = name: text: pkgs.runCommandLocal name {
+    inherit text;
+    passAsFile = [ "text" ];
+    nativeBuildInputs = [ gixy ];
+  } /* sh */ ''
+    # nginx-config-formatter has an error - https://github.com/1connect/nginx-config-formatter/issues/16
+    awk -f ${awkFormatNginx} "$textPath" | sed '/^\s*$/d' > $out
+    gixy $out
+  '';
+
+  # writePerl takes a name an attributeset with libraries and some perl sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writePerl "example" { libraries = [ pkgs.perlPackages.boolean ]; } ''
+  #     use boolean;
+  #     print "Howdy!\n" if true;
+  #   ''
+  writePerl = name: { libraries ? [] }:
+    makeScriptWriter {
+      interpreter = "${pkgs.perl.withPackages (p: libraries)}/bin/perl";
+    } name;
+
+  # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
+  writePerlBin = name:
+    writePerl "/bin/${name}";
+
+  # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
+  # which validates the script with flake8 at build time. If any libraries are specified,
+  # python.withPackages is used as interpreter, otherwise the "bare" python is used.
+  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
+  let
+    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+  in
+  makeScriptWriter {
+    interpreter =
+      if libraries == []
+      then python.interpreter
+      else (python.withPackages (ps: libraries)).interpreter
+    ;
+    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
+      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '');
+  } name;
+
+  # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePyPy2 "test_pypy2" { libraries = [ pkgs.pypy2Packages.enum ]; } ''
+  #   from enum import Enum
+  #
+  #   class Test(Enum):
+  #       a = "success"
+  #
+  #   print Test.a
+  # ''
+  writePyPy2 = makePythonWriter pkgs.pypy2 pkgs.pypy2Packages buildPackages.pypy2Packages;
+
+  # writePyPy2Bin takes the same arguments as writePyPy2 but outputs a directory (like writeScriptBin)
+  writePyPy2Bin = name:
+    writePyPy2 "/bin/${name}";
+
+  # writePython3 takes a name an attributeset with libraries and some python3 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePython3 "test_python3" { libraries = [ pkgs.python3Packages.pyyaml ]; } ''
+  #   import yaml
+  #
+  #   y = yaml.load("""
+  #     - test: success
+  #   """)
+  #   print(y[0]['test'])
+  # ''
+  writePython3 = makePythonWriter pkgs.python3 pkgs.python3Packages buildPackages.python3Packages;
+
+  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
+  writePython3Bin = name:
+    writePython3 "/bin/${name}";
+
+  # writePyPy3 takes a name an attributeset with libraries and some pypy3 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePyPy3 "test_pypy3" { libraries = [ pkgs.pypy3Packages.pyyaml ]; } ''
+  #   import yaml
+  #
+  #   y = yaml.load("""
+  #     - test: success
+  #   """)
+  #   print(y[0]['test'])
+  # ''
+  writePyPy3 = makePythonWriter pkgs.pypy3 pkgs.pypy3Packages buildPackages.pypy3Packages;
+
+  # writePyPy3Bin takes the same arguments as writePyPy3 but outputs a directory (like writeScriptBin)
+  writePyPy3Bin = name:
+    writePyPy3 "/bin/${name}";
+
+
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
+  let
+    fname = last (builtins.split "/" nameOrPath);
+    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
+    _nugetDeps = mkNugetDeps { name = "${fname}-nuget-deps"; nugetDeps = libraries; };
+
+    nuget-source = mkNugetSource {
+      name = "${fname}-nuget-source";
+      description = "A Nuget source with the dependencies for ${fname}";
+      deps = [ _nugetDeps ];
+    };
+
+    fsi = writeBash "fsi" ''
+      export HOME=$NIX_BUILD_TOP/.home
+      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+      export DOTNET_NOLOGO=1
+      script="$1"; shift
+      ${dotnet-sdk}/bin/dotnet fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
+    '';
+
+  in content: makeScriptWriter {
+    interpreter = fsi;
+  } path
+  ''
+    #i "nuget: ${nuget-source}/lib"
+    ${ content }
+    exit 0
+  '';
+
+  writeFSharp =
+    makeFSharpWriter {};
+
+  writeFSharpBin = name:
+    writeFSharp "/bin/${name}";
+
+}
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@ -12,29 +12,62 @@
 }:
 with writers;
 let
+  expectSuccess = test:
+    runCommand "run-${test.name}" {} ''
+      if [[ "$(${test})" != success ]]; then
+        echo 'test ${test.name} failed'
+        exit 1
+      fi

-  bin = {
-    bash = writeBashBin "test-writers-bash-bin" ''
+      touch $out
+    '';
+
+  expectSuccessBin = test:
+    runCommand "run-${test.name}" {} ''
+      if [[ "$(${lib.getExe test})" != success ]]; then
+        echo 'test ${test.name} failed'
+        exit 1
+      fi
+
+      touch $out
+    '';
+
+  expectDataEqual = { file, expected }:
+    let
+      expectedFile = writeText "${file.name}-expected" expected;
+    in
+    runCommand "run-${file.name}" {} ''
+      if ! diff -u ${file} ${expectedFile}; then
+        echo 'test ${file.name} failed'
+        exit 1
+      fi
+
+      touch $out
+    '';
+in
+lib.recurseIntoAttrs {
+  bin = lib.recurseIntoAttrs {
+    bash = expectSuccessBin (writeBashBin "test-writers-bash-bin" ''
     if [[ "test" == "test" ]]; then echo "success"; fi
-    '';
+    '');

-    dash = writeDashBin "test-writers-dash-bin" ''
+    dash = expectSuccessBin (writeDashBin "test-writers-dash-bin" ''
     test '~' = '~' && echo 'success'
-    '';
+    '');

-    fish = writeFishBin "test-writers-fish-bin" ''
+    fish = expectSuccessBin (writeFishBin "test-writers-fish-bin" ''
      if test "test" = "test"
        echo "success"
      end
-    '';
+    '');

-    rust = writeRustBin "test-writers-rust-bin" {} ''
+    rust = expectSuccessBin (writeRustBin "test-writers-rust-bin" {} ''
      fn main(){
        println!("success")
      }
-    '';
+    '');

-    haskell = writeHaskellBin "test-writers-haskell-bin" { libraries = [ haskellPackages.acme-default ]; } ''
+    haskell = expectSuccessBin (writeHaskellBin "test-writers-haskell-bin" { libraries = [ haskellPackages.acme-default ]; } ''
      import Data.Default

      int :: Int
@ -44,9 +77,9 @@ let
      main = case int of
        18871 -> putStrLn $ id "success"
        _ -> print "fail"
-    '';
+    '');

-    js = writeJSBin "test-writers-js-bin" { libraries = [ nodePackages.semver ]; } ''
+    js = expectSuccessBin (writeJSBin "test-writers-js-bin" { libraries = [ nodePackages.semver ]; } ''
      var semver = require('semver');

      if (semver.valid('1.2.3')) {
@ -54,59 +87,57 @@ let
      } else {
        console.log('fail')
      }
-    '';
+    '');

-    perl = writePerlBin "test-writers-perl-bin" { libraries = [ perlPackages.boolean ]; } ''
+    perl = expectSuccessBin (writePerlBin "test-writers-perl-bin" { libraries = [ perlPackages.boolean ]; } ''
      use boolean;
      print "success\n" if true;
-    '';
+    '');

-    pypy2 = writePyPy2Bin "test-writers-pypy2-bin" { libraries = [ pypy2Packages.enum ]; } ''
+    pypy2 = expectSuccessBin (writePyPy2Bin "test-writers-pypy2-bin" { libraries = [ pypy2Packages.enum ]; } ''
      from enum import Enum

-
      class Test(Enum):
          a = "success"

-
      print Test.a
-    '';
+    '');

-    python3 = writePython3Bin "test-writers-python3-bin" { libraries = [ python3Packages.pyyaml ]; } ''
+    python3 = expectSuccessBin (writePython3Bin "test-writers-python3-bin" { libraries = [ python3Packages.pyyaml ]; } ''
      import yaml

-      y = yaml.load("""
+      y = yaml.safe_load("""
        - test: success
      """)
      print(y[0]['test'])
-    '';
+    '');

-    pypy3 = writePyPy3Bin "test-writers-pypy3-bin" { libraries = [ pypy3Packages.pyyaml ]; } ''
+    pypy3 = expectSuccessBin (writePyPy3Bin "test-writers-pypy3-bin" { libraries = [ pypy3Packages.pyyaml ]; } ''
      import yaml

-      y = yaml.load("""
+      y = yaml.safe_load("""
        - test: success
      """)
      print(y[0]['test'])
-    '';
+    '');
  };

-  simple = {
-    bash = writeBash "test-writers-bash" ''
+  simple = lib.recurseIntoAttrs {
+    bash = expectSuccess (writeBash "test-writers-bash" ''
     if [[ "test" == "test" ]]; then echo "success"; fi
-    '';
+    '');

-    dash = writeDash "test-writers-dash" ''
+    dash = expectSuccess (writeDash "test-writers-dash" ''
     test '~' = '~' && echo 'success'
-    '';
+    '');

-    fish = writeFish "test-writers-fish" ''
+    fish = expectSuccess (writeFish "test-writers-fish" ''
      if test "test" = "test"
        echo "success"
      end
-    '';
+    '');

-    haskell = writeHaskell "test-writers-haskell" { libraries = [ haskellPackages.acme-default ]; } ''
+    haskell = expectSuccess (writeHaskell "test-writers-haskell" { libraries = [ haskellPackages.acme-default ]; } ''
      import Data.Default

      int :: Int
@ -116,9 +147,9 @@ let
      main = case int of
        18871 -> putStrLn $ id "success"
        _ -> print "fail"
-    '';
+    '');

-    js = writeJS "test-writers-js" { libraries = [ nodePackages.semver ]; } ''
+    js = expectSuccess (writeJS "test-writers-js" { libraries = [ nodePackages.semver ]; } ''
      var semver = require('semver');

      if (semver.valid('1.2.3')) {
@ -126,43 +157,41 @@ let
      } else {
        console.log('fail')
      }
-    '';
+    '');

-    perl = writePerl "test-writers-perl" { libraries = [ perlPackages.boolean ]; } ''
+    perl = expectSuccess (writePerl "test-writers-perl" { libraries = [ perlPackages.boolean ]; } ''
      use boolean;
      print "success\n" if true;
-    '';
+    '');

-    pypy2 = writePyPy2 "test-writers-pypy2" { libraries = [ pypy2Packages.enum ]; } ''
+    pypy2 = expectSuccess (writePyPy2 "test-writers-pypy2" { libraries = [ pypy2Packages.enum ]; } ''
      from enum import Enum

-
      class Test(Enum):
          a = "success"

-
      print Test.a
-    '';
+    '');

-    python3 = writePython3 "test-writers-python3" { libraries = [ python3Packages.pyyaml ]; } ''
+    python3 = expectSuccess (writePython3 "test-writers-python3" { libraries = [ python3Packages.pyyaml ]; } ''
      import yaml

-      y = yaml.load("""
+      y = yaml.safe_load("""
        - test: success
      """)
      print(y[0]['test'])
-    '';
+    '');

-    pypy3 = writePyPy3 "test-writers-pypy3" { libraries = [ pypy3Packages.pyyaml ]; } ''
+    pypy3 = expectSuccess (writePyPy3 "test-writers-pypy3" { libraries = [ pypy3Packages.pyyaml ]; } ''
      import yaml

-      y = yaml.load("""
+      y = yaml.safe_load("""
        - test: success
      """)
      print(y[0]['test'])
-    '';
+    '');

-    fsharp = makeFSharpWriter {
+    fsharp = expectSuccess (makeFSharpWriter {
      libraries = { fetchNuGet }: [
        (fetchNuGet { pname = "FSharp.SystemTextJson"; version = "0.17.4"; sha256 = "1bplzc9ybdqspii4q28l8gmfvzpkmgq5l1hlsiyg2h46w881lwg2"; })
      ];
@ -183,31 +212,31 @@ let
      then "success"
      else "failed"
      |> printfn "%s"
-    '';
+    '');

-    pypy2NoLibs = writePyPy2 "test-writers-pypy2-no-libs" {} ''
+    pypy2NoLibs = expectSuccess (writePyPy2 "test-writers-pypy2-no-libs" {} ''
      print("success")
-    '';
+    '');

-    python3NoLibs = writePython3 "test-writers-python3-no-libs" {} ''
+    python3NoLibs = expectSuccess (writePython3 "test-writers-python3-no-libs" {} ''
      print("success")
-    '';
+    '');

-    pypy3NoLibs = writePyPy3 "test-writers-pypy3-no-libs" {} ''
+    pypy3NoLibs = expectSuccess (writePyPy3 "test-writers-pypy3-no-libs" {} ''
      print("success")
-    '';
+    '');

-    fsharpNoNugetDeps = writeFSharp "test-writers-fsharp-no-nuget-deps" ''
+    fsharpNoNugetDeps = expectSuccess (writeFSharp "test-writers-fsharp-no-nuget-deps" ''
      printfn "success"
-    '';
+    '');
  };

-
-  path = {
-    bash = writeBash "test-writers-bash-path" (writeText "test" ''
+  path = lib.recurseIntoAttrs {
+    bash = expectSuccess (writeBash "test-writers-bash-path" (writeText "test" ''
      if [[ "test" == "test" ]]; then echo "success"; fi
-    '');
-    haskell = writeHaskell "test-writers-haskell-path" { libraries = [ haskellPackages.acme-default ]; } (writeText "test" ''
+    ''));
+
+    haskell = expectSuccess (writeHaskell "test-writers-haskell-path" { libraries = [ haskellPackages.acme-default ]; } (writeText "test" ''
      import Data.Default

      int :: Int
@ -217,26 +246,27 @@ let
      main = case int of
        18871 -> putStrLn $ id "success"
        _ -> print "fail"
-    '');
+    ''));
  };

-  writeTest = expectedValue: name: test:
-    writeDash "run-${name}" ''
-      if test "$(${test})" != "${expectedValue}"; then
-        echo 'test ${test} failed'
-        exit 1
-      fi
-    '';
+  data = {
+    json = expectDataEqual {
+      file = writeJSON "data.json" { hello = "world"; };
+      expected = ''
+        {
+          "hello": "world"
+        }
+      '';
+    };

-in runCommand "test-writers" {
-  passthru = { inherit writeTest bin simple path; };
-  meta.platforms = lib.platforms.all;
-} ''
-  ${lib.concatMapStringsSep "\n" (test: writeTest "success" test.name "${test}/bin/${test.name}") (lib.attrValues bin)}
-  ${lib.concatMapStringsSep "\n" (test: writeTest "success" test.name test) (lib.attrValues simple)}
-  ${lib.concatMapStringsSep "\n" (test: writeTest "success" test.name test) (lib.attrValues path)}
-
-  echo 'nix-writers successfully tested' >&2
-  touch $out
-''
+    toml = expectDataEqual {
+      file = writeTOML "data.toml" { hello = "world"; };
+      expected = "hello = 'world'\n";
+    };

+    yaml = expectDataEqual {
+      file = writeYAML "data.yaml" { hello = "world"; };
+      expected = "hello: world\n";
+    };
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "25.1.0";
+  version = "25.1.1";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-hxkdigJYP0bPn1+HWlq7DoL/jTYAO1WCJcQN2WI8j/U=";
+    hash = "sha256-IEP4xxL5rez15FVCKdgNBmCv9yHFqtHz/YKTQciQWMg=";
  };

-  npmDepsHash = "sha256-zIH2rt+uhYO1pwumu6LeIpKX1y4y9ajwxK/vAVwzz9Q=";
+  npmDepsHash = "sha256-E4dC3WCXvnx9qUxOM+f6/HfBxKhUvsD9TEVmPJGwbDs=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@ -24,6 +24,7 @@ args@
 , libkrb5
 , krb5
 , makeWrapper
+, markForCudatoolkitRootHook
 , ncurses5
 , numactl
 , nss
@ -31,6 +32,7 @@ args@
 , python3 # FIXME: CUDAToolkit 10 may still need python27
 , pulseaudio
 , requireFile
+, setupCudaHook
 , stdenv
 , backendStdenv # E.g. gcc11Stdenv, set in extension.nix
 , unixODBC
@ -80,11 +82,15 @@ backendStdenv.mkDerivation rec {
    addOpenGLRunpath
    autoPatchelfHook
    autoAddOpenGLRunpathHook
+    markForCudatoolkitRootHook
  ] ++ lib.optionals (lib.versionOlder version "11") [
    libsForQt5.wrapQtAppsHook
  ] ++ lib.optionals (lib.versionAtLeast version "11.8") [
    qt6Packages.wrapQtAppsHook
  ];
+  depsTargetTargetPropagated = [
+    setupCudaHook
+  ];
  buildInputs = lib.optionals (lib.versionOlder version "11") [
    libsForQt5.qt5.qtwebengine
    freeglut
@ -129,7 +135,7 @@ backendStdenv.mkDerivation rec {
    (lib.getLib libtiff)
    qt6Packages.qtwayland
    rdma-core
-    ucx
+    (ucx.override { enableCuda = false; }) # Avoid infinite recursion
    xorg.libxshmfence
    xorg.libxkbfile
  ] ++ (lib.optionals (lib.versionAtLeast version "12.1") (map lib.getLib ([
@ -280,24 +286,12 @@ backendStdenv.mkDerivation rec {
    sed -i "1 i#define _BITS_FLOATN_H" "$out/include/host_defines.h"
  '' +
  # Point NVCC at a compatible compiler
-  # FIXME: redist cuda_nvcc copy-pastes this code
-  # Refer to comments in the overrides for cuda_nvcc for explanation
  # CUDA_TOOLKIT_ROOT_DIR is legacy,
  # Cf. https://cmake.org/cmake/help/latest/module/FindCUDA.html#input-variables
-  # NOTE: We unconditionally set -Xfatbin=-compress-all, which reduces the size of the compiled
-  #   binaries. If binaries grow over 2GB, they will fail to link. This is a problem for us, as
-  #   the default set of CUDA capabilities we build can regularly cause this to occur (for
-  #   example, with Magma).
  ''
    mkdir -p $out/nix-support
    cat <<EOF >> $out/nix-support/setup-hook
    cmakeFlags+=' -DCUDA_TOOLKIT_ROOT_DIR=$out'
-    cmakeFlags+=' -DCUDA_HOST_COMPILER=${backendStdenv.cc}/bin'
-    cmakeFlags+=' -DCMAKE_CUDA_HOST_COMPILER=${backendStdenv.cc}/bin'
-    if [ -z "\''${CUDAHOSTCXX-}" ]; then
-      export CUDAHOSTCXX=${backendStdenv.cc}/bin;
-    fi
-    export NVCC_PREPEND_FLAGS+=' --compiler-bindir=${backendStdenv.cc}/bin -Xfatbin=-compress-all'
    EOF

    # Move some libraries to the lib output so that programs that
--- a/pkgs/development/compilers/cudatoolkit/extension.nix
+++ b/pkgs/development/compilers/cudatoolkit/extension.nix
@ -38,10 +38,39 @@ final: prev: let

  cudaFlags = final.callPackage ./flags.nix {};

+  # Internal hook, used by cudatoolkit and cuda redist packages
+  # to accommodate automatic CUDAToolkit_ROOT construction
+  markForCudatoolkitRootHook = (final.callPackage
+    ({ makeSetupHook }:
+      makeSetupHook
+        { name = "mark-for-cudatoolkit-root-hook"; }
+        ./hooks/mark-for-cudatoolkit-root-hook.sh)
+    { });
+
+  # Normally propagated by cuda_nvcc or cudatoolkit through their depsHostHostPropagated
+  setupCudaHook = (final.callPackage
+    ({ makeSetupHook, backendStdenv }:
+      makeSetupHook
+        {
+          name = "setup-cuda-hook";
+
+          substitutions.ccRoot = "${backendStdenv.cc}";
+
+          # Required in addition to ccRoot as otherwise bin/gcc is looked up
+          # when building CMakeCUDACompilerId.cu
+          substitutions.ccFullPath = "${backendStdenv.cc}/bin/${backendStdenv.cc.targetPrefix}c++";
+        }
+        ./hooks/setup-cuda-hook.sh)
+    { });
+
 in
 {
  inherit
    backendStdenv
    cudatoolkit
-    cudaFlags;
+    cudaFlags
+    markForCudatoolkitRootHook
+    setupCudaHook;
+
+    saxpy = final.callPackage ./saxpy { };
 }
--- a/pkgs/development/compilers/cudatoolkit/hooks/mark-for-cudatoolkit-root-hook.sh
+++ b/pkgs/development/compilers/cudatoolkit/hooks/mark-for-cudatoolkit-root-hook.sh
@ -0,0 +1,8 @@
+# shellcheck shell=bash
+
+markForCUDAToolkit_ROOT() {
+    mkdir -p "${prefix}/nix-support"
+    touch "${prefix}/nix-support/include-in-cudatoolkit-root"
+}
+
+fixupOutputHooks+=(markForCUDAToolkit_ROOT)
--- a/pkgs/development/compilers/cudatoolkit/hooks/nvcc-setup-hook.sh
+++ b/pkgs/development/compilers/cudatoolkit/hooks/nvcc-setup-hook.sh
@ -0,0 +1,5 @@
+# shellcheck shell=bash
+
+# CMake's enable_language(CUDA) runs a compiler test and it doesn't account for
+# CUDAToolkit_ROOT. We have to help it locate libcudart
+export NVCC_APPEND_FLAGS+=" -L@cudartRoot@/lib -I@cudartRoot@/include"
--- a/pkgs/development/compilers/cudatoolkit/hooks/setup-cuda-hook.sh
+++ b/pkgs/development/compilers/cudatoolkit/hooks/setup-cuda-hook.sh
@ -0,0 +1,68 @@
+# shellcheck shell=bash
+
+echo Sourcing setup-cuda-hook >&2
+
+extendCUDAToolkit_ROOT() {
+    if [[ -f "$1/nix-support/include-in-cudatoolkit-root" ]] ; then
+        addToSearchPathWithCustomDelimiter ";" CUDAToolkit_ROOT "$1"
+
+        if [[ -d "$1/include" ]] ; then
+            addToSearchPathWithCustomDelimiter ";" CUDAToolkit_INCLUDE_DIR "$1/include"
+        fi
+    fi
+}
+
+addEnvHooks "$targetOffset" extendCUDAToolkit_ROOT
+
+setupCUDAToolkitCompilers() {
+    echo Executing setupCUDAToolkitCompilers >&2
+
+    if [[ -n "${dontSetupCUDAToolkitCompilers-}" ]] ; then
+        return
+    fi
+
+    # Point NVCC at a compatible compiler
+
+    # For CMake-based projects:
+    # https://cmake.org/cmake/help/latest/module/FindCUDA.html#input-variables
+    # https://cmake.org/cmake/help/latest/envvar/CUDAHOSTCXX.html
+    # https://cmake.org/cmake/help/latest/variable/CMAKE_CUDA_HOST_COMPILER.html
+
+    export cmakeFlags+=" -DCUDA_HOST_COMPILER=@ccFullPath@"
+    export cmakeFlags+=" -DCMAKE_CUDA_HOST_COMPILER=@ccFullPath@"
+
+    # For non-CMake projects:
+    # We prepend --compiler-bindir to nvcc flags.
+    # Downstream packages can override these, because NVCC
+    # uses the last --compiler-bindir it gets on the command line.
+    # FIXME: this results in "incompatible redefinition" warnings.
+    # https://docs.nvidia.com/cuda/cuda-compiler-driver-nvcc/index.html#compiler-bindir-directory-ccbin
+    if [ -z "${CUDAHOSTCXX-}" ]; then
+      export CUDAHOSTCXX="@ccFullPath@";
+    fi
+
+    export NVCC_PREPEND_FLAGS+=" --compiler-bindir=@ccRoot@/bin"
+
+    # NOTE: We set -Xfatbin=-compress-all, which reduces the size of the compiled
+    #   binaries. If binaries grow over 2GB, they will fail to link. This is a problem for us, as
+    #   the default set of CUDA capabilities we build can regularly cause this to occur (for
+    #   example, with Magma).
+    #
+    # @SomeoneSerge: original comment was made by @ConnorBaker in .../cudatoolkit/common.nix
+    if [[ -z "${dontCompressFatbin-}" ]]; then
+        export NVCC_PREPEND_FLAGS+=" -Xfatbin=-compress-all"
+    fi
+
+    # CMake's enable_language(CUDA) runs a compiler test and it doesn't account for
+    # CUDAToolkit_ROOT. We have to help it locate libcudart
+    if [[ -z "${nvccDontPrependCudartFlags-}" ]] ; then
+        export NVCC_APPEND_FLAGS+=" -L@cudartRoot@/lib -I@cudartRoot@/include"
+    fi
+}
+
+setupCMakeCUDAToolkit_ROOT() {
+    export cmakeFlags+=" -DCUDAToolkit_INCLUDE_DIR=$CUDAToolkit_INCLUDE_DIR -DCUDAToolkit_ROOT=$CUDAToolkit_ROOT"
+}
+
+postHooks+=(setupCUDAToolkitCompilers)
+preConfigureHooks+=(setupCMakeCUDAToolkit_ROOT)
--- a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
+++ b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
@ -4,6 +4,7 @@
 , fetchurl
 , autoPatchelfHook
 , autoAddOpenGLRunpathHook
+, markForCudatoolkitRootHook
 }:

 pname:
@ -28,6 +29,7 @@ backendStdenv.mkDerivation {
    # directory to the rpath of all ELF binaries.
    # Check e.g. with `patchelf --print-rpath path/to/my/binary
    autoAddOpenGLRunpathHook
+    markForCudatoolkitRootHook
  ];

  buildInputs = [
--- a/pkgs/development/compilers/cudatoolkit/redist/overrides.nix
+++ b/pkgs/development/compilers/cudatoolkit/redist/overrides.nix
@ -27,35 +27,27 @@ in
      inherit (prev.backendStdenv) cc;
    in
    {
+      # Required by cmake's enable_language(CUDA) to build a test program
+      # When implementing cross-compilation support: this is
+      # final.pkgs.targetPackages.cudaPackages.cuda_cudart
+      env.cudartRoot = "${prev.lib.getDev final.cuda_cudart}";
+
      # Point NVCC at a compatible compiler
-      # FIXME: non-redist cudatoolkit copy-pastes this code

-      # For CMake-based projects:
-      # https://cmake.org/cmake/help/latest/module/FindCUDA.html#input-variables
-      # https://cmake.org/cmake/help/latest/envvar/CUDAHOSTCXX.html
-      # https://cmake.org/cmake/help/latest/variable/CMAKE_CUDA_HOST_COMPILER.html
-
-      # For non-CMake projects:
-      # We prepend --compiler-bindir to nvcc flags.
-      # Downstream packages can override these, because NVCC
-      # uses the last --compiler-bindir it gets on the command line.
-      # FIXME: this results in "incompatible redefinition" warnings.
-      # https://docs.nvidia.com/cuda/cuda-compiler-driver-nvcc/index.html#compiler-bindir-directory-ccbin
-      # NOTE: We unconditionally set -Xfatbin=-compress-all, which reduces the size of the
-      #   compiled binaries. If binaries grow over 2GB, they will fail to link. This is a problem
-      #   for us, as the default set of CUDA capabilities we build can regularly cause this to
-      #   occur (for example, with Magma).
-      postInstall = (oldAttrs.postInstall or "") + ''
-        mkdir -p $out/nix-support
-        cat <<EOF >> $out/nix-support/setup-hook
-        cmakeFlags+=' -DCUDA_HOST_COMPILER=${cc}/bin'
-        cmakeFlags+=' -DCMAKE_CUDA_HOST_COMPILER=${cc}/bin'
-        if [ -z "\''${CUDAHOSTCXX-}" ]; then
-          export CUDAHOSTCXX=${cc}/bin;
-        fi
-        export NVCC_PREPEND_FLAGS+=' --compiler-bindir=${cc}/bin -Xfatbin=-compress-all'
-        EOF
-      '';
+      # Desiredata: whenever a package (e.g. magma) adds cuda_nvcc to
+      # nativeBuildInputs (offsets `(-1, 0)`), magma should also source the
+      # setupCudaHook, i.e. we want it the hook to be propagated into the
+      # same nativeBuildInputs.
+      #
+      # Logically, cuda_nvcc should include the hook in depsHostHostPropagated,
+      # so that the final offsets for the propagated hook would be `(-1, 0) +
+      # (0, 0) = (-1, 0)`.
+      #
+      # In practice, TargetTarget appears to work:
+      # https://gist.github.com/fd80ff142cd25e64603618a3700e7f82
+      depsTargetTargetPropagated = [
+        final.setupCudaHook
+      ];
    });

  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (oldAttrs: {
--- a/pkgs/development/compilers/cudatoolkit/saxpy/CMakeLists.txt
+++ b/pkgs/development/compilers/cudatoolkit/saxpy/CMakeLists.txt
@ -0,0 +1,12 @@
+cmake_minimum_required(VERSION 3.25)
+project(saxpy LANGUAGES CXX CUDA)
+
+find_package(CUDAToolkit REQUIRED COMPONENTS cudart cublas)
+
+add_executable(saxpy saxpy.cu)
+target_link_libraries(saxpy PUBLIC CUDA::cublas CUDA::cudart m)
+target_compile_features(saxpy PRIVATE cxx_std_14)
+target_compile_options(saxpy PRIVATE $<$<COMPILE_LANGUAGE:CUDA>:
+                                     --expt-relaxed-constexpr>)
+
+install(TARGETS saxpy)
--- a/Show More
+++ b/Show More