dotnet: use unpacked nuget packages

doc/languages-frameworks/dotnet.section.md

@@ -98,13 +98,13 @@ To package Dotnet applications, you can use `buildDotnetModule`. This has simila
 For more detail about managing the `deps.nix` file, see [Generating and updating NuGet dependencies](#generating-and-updating-nuget-dependencies)
 :::
 
-* `packNupkg` is used to pack project as a `nupkg`, and installs it to `$out/share`. If set to `true`, the derivation can be used as a dependency for another dotnet project by adding it to `projectReferences`.
+* `packNupkg` is used to pack project as a `nupkg`, and installs it to `$out/share`. If set to `true`, the derivation can be used as a dependency for another dotnet project by adding it to `buildInputs`.
-* `projectReferences` can be used to resolve `ProjectReference` project items. Referenced projects can be packed with `buildDotnetModule` by setting the `packNupkg = true` attribute and passing a list of derivations to `projectReferences`. Since we are sharing referenced projects as NuGets they must be added to csproj/fsproj files as `PackageReference` as well.
+* `buildInputs` can be used to resolve `ProjectReference` project items. Referenced projects can be packed with `buildDotnetModule` by setting the `packNupkg = true` attribute and passing a list of derivations to `buildInputs`. Since we are sharing referenced projects as NuGets they must be added to csproj/fsproj files as `PackageReference` as well.
  For example, your project has a local dependency:
  ```xml
      <ProjectReference Include="../foo/bar.fsproj" />
  ```
- To enable discovery through `projectReferences` you would need to add:
+ To enable discovery through `buildInputs` you would need to add:
  ```xml
      <ProjectReference Include="../foo/bar.fsproj" />
      <PackageReference Include="bar" Version="*" Condition=" '$(ContinuousIntegrationBuild)'=='true' "/>
@@ -143,7 +143,7 @@ in buildDotnetModule rec {
   projectFile = "src/project.sln";
   nugetDeps = ./deps.nix; # see "Generating and updating NuGet dependencies" section for details
 
-  projectReferences = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
+  buildInputs = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
   dotnet-runtime = dotnetCorePackages.runtime_6_0;

pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix

@@ -28,6 +28,7 @@ buildDotnetModule (args // {
     nugetDeps = { fetchNuGet }: [
       (fetchNuGet { pname = nugetName; inherit version; sha256 = nugetSha256; hash = nugetHash; })
     ] ++ (nugetDeps fetchNuGet);
+    installable = true;
   };
 
   dotnetGlobalTool = true;

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -4,17 +4,14 @@
 , callPackage
 , substituteAll
 , writeShellScript
-, srcOnly
-, linkFarmFromDrvs
-, symlinkJoin
 , makeWrapper
 , dotnetCorePackages
-, mkNugetSource
 , mkNugetDeps
 , nuget-to-nix
 , cacert
-, coreutils
+, unzip
-, runtimeShellPackage
+, yq
+, nix
 }:
 
 { name ? "${_args.pname}-${_args.version}"
@@ -106,11 +103,6 @@ let
     inherit dotnet-sdk dotnet-runtime;
   }) dotnetConfigureHook dotnetBuildHook dotnetCheckHook dotnetInstallHook dotnetFixupHook;
 
-  localDeps =
-    if (projectReferences != [ ])
-    then linkFarmFromDrvs "${name}-project-references" projectReferences
-    else null;
-
   _nugetDeps =
     if (nugetDeps != null) then
       if lib.isDerivation nugetDeps
@@ -121,41 +113,21 @@ let
       }
     else throw "Defining the `nugetDeps` attribute is required, as to lock the NuGet dependencies. This file can be generated by running the `passthru.fetch-deps` script.";
 
-  # contains the actual package dependencies
-  dependenciesSource = mkNugetSource {
-    name = "${name}-dependencies-source";
-    description = "Nuget source with the dependencies for ${name}";
-    deps = [ _nugetDeps ] ++ lib.optional (localDeps != null) localDeps;
-  };
-
-  # this contains all the nuget packages that are implicitly referenced by the dotnet
-  # build system. having them as separate deps allows us to avoid having to regenerate
-  # a packages dependencies when the dotnet-sdk version changes
-  sdkDeps = lib.lists.flatten [ dotnet-sdk.packages ];
-
-  sdkSource = let
-    version = dotnet-sdk.version or (lib.concatStringsSep "-" dotnet-sdk.versions);
-  in mkNugetSource {
-    name = "dotnet-sdk-${version}-source";
-    deps = sdkDeps;
-  };
-
-  nuget-source = symlinkJoin {
-    name = "${name}-nuget-source";
-    paths = [ dependenciesSource sdkSource ];
-  };
-
   nugetDepsFile = _nugetDeps.sourceFile;
+
+  inherit (dotnetCorePackages) systemToDotnetRid;
 in
-stdenvNoCC.mkDerivation (args // {
+stdenvNoCC.mkDerivation (finalAttrs: args // {
   dotnetInstallPath = installPath;
   dotnetExecutables = executables;
   dotnetBuildType = buildType;
   dotnetProjectFiles = projectFiles;
   dotnetTestProjectFiles = testProjectFiles;
   dotnetDisabledTests = disabledTests;
-  dotnetRuntimeId = runtimeId;
+  dotnetRuntimeIds = lib.singleton (
-  nugetSource = nuget-source;
+    if runtimeId != null
+    then runtimeId
+    else systemToDotnetRid stdenvNoCC.hostPlatform.system);
   dotnetRuntimeDeps = map lib.getLib runtimeDeps;
   dotnetSelfContainedBuild = selfContainedBuild;
   dotnetUseAppHost = useAppHost;
@@ -171,8 +143,15 @@ stdenvNoCC.mkDerivation (args // {
     cacert
     makeWrapper
     dotnet-sdk
+    unzip
+    yq
   ];
 
+  buildInputs = args.buildInputs or [] ++ [
+    dotnet-sdk.packages
+    _nugetDeps
+  ] ++ projectReferences;
+
   # Parse the version attr into a format acceptable for the Version msbuild property
   # The actual version attr is saved in InformationalVersion, which accepts an arbitrary string
   versionForDotnet = if !(lib.hasAttr "version" args) || args.version == null
@@ -204,19 +183,21 @@ stdenvNoCC.mkDerivation (args // {
   propagatedSandboxProfile = toString dotnet-runtime.__propagatedSandboxProfile;
 
   passthru = {
-    inherit nuget-source;
+    nugetDeps = _nugetDeps;
   } // lib.optionalAttrs (!lib.isDerivation nugetDeps) {
     fetch-deps = let
-      flagsList = dotnetFlags ++ dotnetRestoreFlags;
+      pkg = finalAttrs.finalPackage.overrideAttrs (old: {
-      flags = lib.concatStringsSep " " (map lib.escapeShellArg flagsList);
+        buildInputs = lib.remove _nugetDeps old.buildInputs;
-      disableParallel =
+        keepNugetConfig = true;
-        lib.optionalString (!enableParallelBuilding) "--disable-parallel";
+      } // lib.optionalAttrs (runtimeId == null) {
-      runtimeIdsList = if runtimeId != null then
+        dotnetRuntimeIds = map (system: systemToDotnetRid system) platforms;
-        [ runtimeId ]
+      });
-      else
+
-        map (system: dotnetCorePackages.systemToDotnetRid system) platforms;
+      drv = builtins.unsafeDiscardOutputDependency pkg.drvPath;
-      runtimeIds =
+
-        lib.concatStringsSep " " (map lib.escapeShellArg runtimeIdsList);
+      innerScript = substituteAll {
+        src = ./fetch-deps.sh;
+        isExecutable = true;
         defaultDepsFile =
           # Wire in the nugetDeps file such that running the script with no args
           # runs it agains the correct deps file by default.
@@ -228,26 +209,13 @@ stdenvNoCC.mkDerivation (args // {
             toString nugetDepsFile
           else
             ''$(mktemp -t "${pname}-deps-XXXXXX.nix")'';
-      storeSrc = srcOnly args;
+        nugetToNix = (nuget-to-nix.override { inherit dotnet-sdk; });
-      projectFileStr = lib.escapeShellArgs projectFiles;
-      testProjectFileStr = lib.escapeShellArgs testProjectFiles;
-      path = lib.makeBinPath [
-        coreutils
-        runtimeShellPackage
-        dotnet-sdk
-        (nuget-to-nix.override { inherit dotnet-sdk; })
-      ];
-      dotnetSdkPath = toString dotnet-sdk;
-      excludedSources =
-        lib.concatStringsSep " " (map lib.escapeShellArg sdkDeps);
-    in substituteAll {
-      name = "fetch-deps";
-      src = ./fetch-deps.sh;
-      isExecutable = true;
-      inherit pname defaultDepsFile runtimeIds storeSrc flags disableParallel
-      projectFileStr testProjectFileStr path dotnetSdkPath excludedSources
-      runtimeShell;
       };
+
+      in writeShellScript "${name}-fetch-deps" ''
+        NIX_BUILD_SHELL="${runtimeShell}" exec ${nix}/bin/nix-shell \
+          --pure --run 'source "${innerScript}"' "${drv}"
+      '';
   } // args.passthru or { };
 
   meta = (args.meta or { }) // { inherit platforms; };

pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh

@@ -1,111 +1,22 @@
-#! @runtimeShell@
+set -e
-# shellcheck shell=bash
-set -euo pipefail
 
-export PATH="@path@"
+tmp=$(mktemp -d)
+trap 'chmod -R +w "$tmp" && rm -fr "$tmp"' EXIT
 
-for arg in "$@"; do
+HOME=$tmp/.home
-    case "$arg" in
+cd "$tmp"
-        --keep-sources|-k)
-            keepSources=1
-            shift
-            ;;
-        --help|-h)
-            echo "usage: $0 [--keep-sources] [--help] <output path>"
-            echo "    <output path>   The path to write the lockfile to. A temporary file is used if this is not set"
-            echo "    --keep-sources  Dont remove temporary directories upon exit, useful for debugging"
-            echo "    --help          Show this help message"
-            exit
-            ;;
-    esac
-done
 
-if [[ ${TMPDIR:-} == /run/user/* ]]; then
+phases="
-   # /run/user is usually a tmpfs in RAM, which may be too small
+    ${prePhases[*]:-}
-   # to store all downloaded dotnet packages
+    unpackPhase
-   unset TMPDIR
+    patchPhase
-fi
+    ${preConfigurePhases[*]:-}
-
+    configurePhase
-export tmp=$(mktemp -td "deps-@pname@-XXXXXX")
+" genericBuild
-HOME=$tmp/home
-
-exitTrap() {
-    test -n "${ranTrap-}" && return
-    ranTrap=1
-
-    if test -n "${keepSources-}"; then
-        echo -e "Path to the source: $tmp/src\nPath to the fake home: $tmp/home"
-    else
-        rm -rf "$tmp"
-    fi
-
-    # Since mktemp is used this will be empty if the script didnt succesfully complete
-    if ! test -s "$depsFile"; then
-      rm -rf "$depsFile"
-    fi
-}
-
-trap exitTrap EXIT INT TERM
-
-dotnetRestore() {
-    local -r project="${1-}"
-    local -r rid="$2"
-
-    dotnet restore ${project-} \
-        -p:ContinuousIntegrationBuild=true \
-        -p:Deterministic=true \
-        --packages "$tmp/nuget_pkgs" \
-        --runtime "$rid" \
-        --no-cache \
-        --force \
-        @disableParallel@ \
-        @flags@
-}
-
-declare -a projectFiles=( @projectFileStr@ )
-declare -a testProjectFiles=( @testProjectFileStr@ )
-
-export DOTNET_NOLOGO=1
-export DOTNET_CLI_TELEMETRY_OPTOUT=1
 
 depsFile=$(realpath "${1:-@defaultDepsFile@}")
-echo Will write lockfile to "$depsFile"
-mkdir -p "$tmp/nuget_pkgs"
-
-storeSrc="@storeSrc@"
-src=$tmp/src
-cp -rT "$storeSrc" "$src"
-chmod -R +w "$src"
-
-cd "$src"
-echo "Restoring project..."
-
-"@dotnetSdkPath@/bin/dotnet" tool restore
-cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
-
-runtimeIds=(@runtimeIds@)
-
-for rid in "${runtimeIds[@]}"; do
-    (( ${#projectFiles[@]} == 0 )) && dotnetRestore "" "$rid"
-
-    for project in ${projectFiles[@]-} ${testProjectFiles[@]-}; do
-        dotnetRestore "$project" "$rid"
-    done
-done
-# Second copy, makes sure packages restored by ie. paket are included
-cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
-
-echo "Succesfully restored project"
-
-echo "Writing lockfile..."
-
-excluded_sources=( @excludedSources@ )
-for excluded_source in ${excluded_sources[@]}; do
-  ls "$excluded_source" >> "$tmp/excluded_list"
-done
 tmpFile="$tmp"/deps.nix
 echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n" > "$tmpFile"
-nuget-to-nix "$tmp/nuget_pkgs" "$tmp/excluded_list" >> "$tmpFile"
+@nugetToNix@/bin/nuget-to-nix "$NUGET_PACKAGES" >> "$tmpFile"
 mv "$tmpFile" "$depsFile"
 echo "Succesfully wrote lockfile to $depsFile"
-

pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix

@@ -5,20 +5,16 @@
 , zlib
 , openssl
 , makeSetupHook
-, dotnetCorePackages
+, zip
   # Passed from ../default.nix
 , dotnet-sdk
 , dotnet-runtime
 }:
-let
-  runtimeId = dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system;
-in
 {
   dotnetConfigureHook = makeSetupHook
     {
       name = "dotnet-configure-hook";
       substitutions = {
-        runtimeId = lib.escapeShellArg runtimeId;
         dynamicLinker = "${stdenv.cc}/nix-support/dynamic-linker";
         libPath = lib.makeLibraryPath [
           stdenv.cc.cc.lib
@@ -34,18 +30,12 @@ in
   dotnetBuildHook = makeSetupHook
     {
       name = "dotnet-build-hook";
-      substitutions = {
-        runtimeId = lib.escapeShellArg runtimeId;
-      };
     }
     ./dotnet-build-hook.sh;
 
   dotnetCheckHook = makeSetupHook
     {
       name = "dotnet-check-hook";
-      substitutions = {
-        runtimeId = lib.escapeShellArg runtimeId;
-      };
     }
     ./dotnet-check-hook.sh;
 
@@ -53,7 +43,7 @@ in
     {
       name = "dotnet-install-hook";
       substitutions = {
-        runtimeId = lib.escapeShellArg runtimeId;
+        inherit zip;
       };
     }
     ./dotnet-install-hook.sh;

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh

@@ -3,20 +3,20 @@ dotnetBuildHook() {
 
     runHook preBuild
 
-    local -r hostRuntimeId=@runtimeId@
     local -r dotnetBuildType="${dotnetBuildType-Release}"
-    local -r dotnetRuntimeId="${dotnetRuntimeId-$hostRuntimeId}"
 
     if [[ -n $__structuredAttrs ]]; then
         local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
         local dotnetTestProjectFilesArray=( "${dotnetTestProjectFiles[@]}" )
         local dotnetFlagsArray=( "${dotnetFlags[@]}" )
         local dotnetBuildFlagsArray=( "${dotnetBuildFlags[@]}" )
+        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
     else
         local dotnetProjectFilesArray=($dotnetProjectFiles)
         local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
         local dotnetFlagsArray=($dotnetFlags)
         local dotnetBuildFlagsArray=($dotnetBuildFlags)
+        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
     fi
 
     if [[ -n "${enableParallelBuilding-}" ]]; then
@@ -49,9 +49,10 @@ dotnetBuildHook() {
     dotnetBuild() {
         local -r projectFile="${1-}"
 
+        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
             local runtimeIdFlagsArray=()
             if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
-            runtimeIdFlagsArray+=("--runtime" "$dotnetRuntimeId")
+                runtimeIdFlagsArray+=("--runtime" "$runtimeId")
             fi
 
             dotnet build ${1+"$projectFile"} \
@@ -59,12 +60,14 @@ dotnetBuildHook() {
                 -p:BuildInParallel="$parallelBuildFlag" \
                 -p:ContinuousIntegrationBuild=true \
                 -p:Deterministic=true \
+                -p:OverwriteReadOnlyFiles=true \
                 --configuration "$dotnetBuildType" \
                 --no-restore \
                 "${versionFlagsArray[@]}" \
                 "${runtimeIdFlagsArray[@]}" \
                 "${dotnetBuildFlagsArray[@]}" \
                 "${dotnetFlagsArray[@]}"
+        done
     }
 
     if (( ${#dotnetProjectFilesArray[@]} == 0 )); then

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-check-hook.sh

@@ -3,9 +3,7 @@ dotnetCheckHook() {
 
     runHook preCheck
 
-    local -r hostRuntimeId=@runtimeId@
     local -r dotnetBuildType="${dotnetBuildType-Release}"
-    local -r dotnetRuntimeId="${dotnetRuntimeId-$hostRuntimeId}"
 
     if [[ -n $__structuredAttrs ]]; then
         local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
@@ -13,12 +11,14 @@ dotnetCheckHook() {
         local dotnetTestFlagsArray=( "${dotnetTestFlags[@]}" )
         local dotnetDisabledTestsArray=( "${dotnetDisabledTests[@]}" )
         local dotnetRuntimeDepsArray=( "${dotnetRuntimeDeps[@]}" )
+        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
     else
         local dotnetProjectFilesArray=($dotnetProjectFiles)
         local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
         local dotnetTestFlagsArray=($dotnetTestFlags)
         local dotnetDisabledTestsArray=($dotnetDisabledTests)
         local dotnetRuntimeDepsArray=($dotnetRuntimeDeps)
+        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
     fi
 
     if (( ${#dotnetDisabledTestsArray[@]} > 0 )); then
@@ -42,11 +42,12 @@ dotnetCheckHook() {
         local -r maxCpuFlag="1"
     fi
 
-    local projectFile
+    local projectFile runtimeId
     for projectFile in "${dotnetTestProjectFilesArray[@]-${dotnetProjectFilesArray[@]}}"; do
+        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
             local runtimeIdFlagsArray=()
             if [[ $projectFile == *.csproj ]]; then
-            runtimeIdFlagsArray=("--runtime" "$dotnetRuntimeId")
+                runtimeIdFlagsArray=("--runtime" "$runtimeId")
             fi
 
             LD_LIBRARY_PATH=$libraryPath \
@@ -61,6 +62,7 @@ dotnetCheckHook() {
                 "${dotnetTestFlagsArray[@]}" \
                 "${dotnetFlagsArray[@]}"
         done
+    done
 
     runHook postCheck
 

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh

@@ -3,35 +3,21 @@ dotnetConfigureHook() {
 
     runHook preConfigure
 
-    if [[ -z ${nugetSource-} ]]; then
-        echo
-        echo "ERROR: no dependencies were specified"
-        echo 'Hint: set `nugetSource` if using these hooks individually. If this is happening with `buildDotnetModule`, please open an issue.'
-        echo
-
-        exit 1
-    fi
-
-    local nugetSourceSedQuoted="${nugetSource//[\/\\&$'\n']/\\&}"
-    local nugetSourceXMLQuoted="$nugetSource"
-    nugetSourceXMLQuoted="${nugetSource//&/\&}"
-    nugetSourceXMLQuoted="${nugetSourceXMLQuoted//\"/\"}"
-
-    local -r hostRuntimeId=@runtimeId@
     local -r dynamicLinker=@dynamicLinker@
     local -r libPath=@libPath@
-    local -r dotnetRuntimeId="${dotnetRuntimeId-$hostRuntimeId}"
 
     if [[ -n $__structuredAttrs ]]; then
         local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
         local dotnetTestProjectFilesArray=( "${dotnetTestProjectFiles[@]}" )
         local dotnetFlagsArray=( "${dotnetFlags[@]}" )
         local dotnetRestoreFlagsArray=( "${dotnetRestoreFlags[@]}" )
+        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
     else
         local dotnetProjectFilesArray=($dotnetProjectFiles)
         local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
         local dotnetFlagsArray=($dotnetFlags)
         local dotnetRestoreFlagsArray=($dotnetRestoreFlags)
+        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
     fi
 
     if [[ -z ${enableParallelBuilding-} ]]; then
@@ -40,37 +26,33 @@ dotnetConfigureHook() {
 
     dotnetRestore() {
         local -r projectFile="${1-}"
+        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
             dotnet restore ${1+"$projectFile"} \
                 -p:ContinuousIntegrationBuild=true \
                 -p:Deterministic=true \
-            --runtime "$dotnetRuntimeId" \
+                -p:NuGetAudit=false \
-            --source "$nugetSource/lib" \
+                --runtime "$runtimeId" \
                 ${parallelFlag-} \
                 "${dotnetRestoreFlagsArray[@]}" \
                 "${dotnetFlagsArray[@]}"
+        done
     }
 
-    # Generate a NuGet.config file to make sure everything,
+    find -iname nuget.config -print0 | while IFS= read -rd "" config; do
-    # including things like <Sdk /> dependencies, is restored from the proper source
+        if [[ -n "${keepNugetConfig-}" ]]; then
-    cat >NuGet.config <<EOF
+            # If we're keeping the existing configs, we'll add _nix everywhere,
-<?xml version="1.0" encoding="utf-8"?>
+            # in case sources are cleared.
-<configuration>
+            dotnet nuget add source "$nugetSource" -n _nix --configfile "$config"
-  <packageSources>
+        else
-    <clear />
+            # This will allow everything to fall through to our config in the
-    <add key="nugetSource" value="$nugetSourceXMLQuoted/lib" />
+            # build root. Deleting them causes some build failures.
-  </packageSources>
+            xq -xi '.configuration={}' "$config"
-</configuration>
+        fi
-EOF
+    done
 
-    # Patch paket.dependencies and paket.lock (if found) to use the proper
+    if [[ -f .config/dotnet-tools.json || -f .dotnet-tools.json ]]; then
-    # source. This ensures paket restore works correctly. Note that the
+        dotnet tool restore
-    # nugetSourceSedQuoted abomination below safely escapes nugetSource string
+    fi
-    # for use as a sed replacement string to avoid issues with slashes and other
-    # special characters ('&', '\\' and '\n').
-    find -name paket.dependencies -exec sed -i "s/source .*/source $nugetSourceSedQuoted\/lib/g" {} \;
-    find -name paket.lock -exec sed -i "s/remote:.*/remote: $nugetSourceSedQuoted\/lib/g" {} \;
-
-    dotnet tool restore --add-source "$nugetSource/lib"
 
     # dotnetGlobalTool is set in buildDotnetGlobalTool to patch dependencies but
     # avoid other project-specific logic. This is a hack, but the old behavior
@@ -90,28 +72,6 @@ EOF
         done
     fi
 
-    echo "Fixing up native binaries..."
-    # Find all native binaries and nuget libraries, and fix them up,
-    # by setting the proper interpreter and rpath to some commonly used libraries
-    local binary
-    for binary in $(find "$HOME/.nuget/packages/" -type f -executable); do
-        if patchelf --print-interpreter "$binary" >/dev/null 2>/dev/null; then
-            echo "Found binary: $binary, fixing it up..."
-            patchelf --set-interpreter "$(cat "$dynamicLinker")" "$binary"
-
-            # This makes sure that if the binary requires some specific runtime dependencies, it can find it.
-            # This fixes dotnet-built binaries like crossgen2
-            patchelf \
-                --add-needed libicui18n.so \
-                --add-needed libicuuc.so \
-                --add-needed libz.so \
-                --add-needed libssl.so \
-                "$binary"
-
-            patchelf --set-rpath "$libPath" "$binary"
-        fi
-    done
-
     runHook postConfigure
 
     echo "Finished dotnetConfigureHook"

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh

@@ -3,21 +3,21 @@ dotnetInstallHook() {
 
     runHook preInstall
 
-    local -r hostRuntimeId=@runtimeId@
     local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"
     local -r dotnetBuildType="${dotnetBuildType-Release}"
-    local -r dotnetRuntimeId="${dotnetRuntimeId-$hostRuntimeId}"
 
     if [[ -n $__structuredAttrs ]]; then
         local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
         local dotnetFlagsArray=( "${dotnetFlags[@]}" )
         local dotnetInstallFlagsArray=( "${dotnetInstallFlags[@]}" )
         local dotnetPackFlagsArray=( "${dotnetPackFlags[@]}" )
+        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
     else
         local dotnetProjectFilesArray=($dotnetProjectFiles)
         local dotnetFlagsArray=($dotnetFlags)
         local dotnetInstallFlagsArray=($dotnetInstallFlags)
         local dotnetPackFlagsArray=($dotnetPackFlags)
+        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
     fi
 
     if [[ -n ${dotnetSelfContainedBuild-} ]]; then
@@ -33,36 +33,53 @@ dotnetInstallHook() {
         dotnetInstallFlagsArray+=("-p:UseAppHost=true")
     fi
 
+    if [[ -n ${enableParallelBuilding-} ]]; then
+        local -r maxCpuFlag="$NIX_BUILD_CORES"
+    else
+        local -r maxCpuFlag="1"
+    fi
+
     dotnetPublish() {
         local -r projectFile="${1-}"
 
+        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
             runtimeIdFlagsArray=()
             if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
-            runtimeIdFlagsArray+=("--runtime" "$dotnetRuntimeId")
+                runtimeIdFlagsArray+=("--runtime" "$runtimeId")
             fi
 
             dotnet publish ${1+"$projectFile"} \
+                -maxcpucount:"$maxCpuFlag" \
                 -p:ContinuousIntegrationBuild=true \
                 -p:Deterministic=true \
+                -p:OverwriteReadOnlyFiles=true \
                 --output "$dotnetInstallPath" \
                 --configuration "$dotnetBuildType" \
                 --no-build \
                 "${runtimeIdFlagsArray[@]}" \
                 "${dotnetInstallFlagsArray[@]}" \
                 "${dotnetFlagsArray[@]}"
+        done
     }
 
+    local -r pkgs=$PWD/.nuget-pack
+
     dotnetPack() {
         local -r projectFile="${1-}"
+
+        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
             dotnet pack ${1+"$projectFile"} \
+                   -maxcpucount:"$maxCpuFlag" \
                    -p:ContinuousIntegrationBuild=true \
                    -p:Deterministic=true \
-            --output "$out/share" \
+                   -p:OverwriteReadOnlyFiles=true \
+                   --output "$pkgs" \
                    --configuration "$dotnetBuildType" \
                    --no-build \
-            --runtime "$dotnetRuntimeId" \
+                   --runtime "$runtimeId" \
                    "${dotnetPackFlagsArray[@]}" \
                    "${dotnetFlagsArray[@]}"
+        done
     }
 
     if (( ${#dotnetProjectFilesArray[@]} == 0 )); then
@@ -85,6 +102,20 @@ dotnetInstallHook() {
         fi
     fi
 
+    local -r unpacked="$pkgs/.unpacked"
+    for nupkg in "$pkgs"/*.nupkg; do
+        rm -rf "$unpacked"
+        unzip -qd "$unpacked" "$nupkg"
+        chmod -R +rw "$unpacked"
+        echo {} > "$unpacked"/.nupkg.metadata
+        local id version
+        id=$(xq -r '.package.metadata.id|ascii_downcase' "$unpacked"/*.nuspec)
+        version=$(xq -r '.package.metadata.version|ascii_downcase' "$unpacked"/*.nuspec)
+        mkdir -p "$out/share/nuget/packages/$id"
+        mv "$unpacked" "$out/share/nuget/packages/$id/$version"
+        # TODO: should we fix executable flags here?
+    done
+
     runHook postInstall
 
     echo "Finished dotnetInstallHook"

pkgs/build-support/dotnet/make-nuget-deps/default.nix

@@ -1,35 +1,71 @@
-{ linkFarmFromDrvs, fetchurl, runCommand, zip }:
+{ symlinkJoin
-{ name, nugetDeps ? import sourceFile, sourceFile ? null }:
+, fetchurl
-linkFarmFromDrvs "${name}-nuget-deps" (nugetDeps {
+, stdenvNoCC
-  fetchNuGet = { pname, version, sha256 ? "", hash ? ""
+, lib
+, unzip
+, patchNupkgs
+, nugetPackageHook
+}:
+lib.makeOverridable(
+  { name
+  , nugetDeps ? import sourceFile
+  , sourceFile ? null
+  , installable ? false
+  }:
+  (symlinkJoin {
+    name = "${name}-nuget-deps";
+    paths = nugetDeps {
+      fetchNuGet =
+        { pname
+        , version
+        , sha256 ? ""
+        , hash ? ""
         , url ? "https://www.nuget.org/api/v2/package/${pname}/${version}" }:
-    let
+        stdenvNoCC.mkDerivation rec {
+          inherit pname version;
+
           src = fetchurl {
             name = "${pname}.${version}.nupkg";
             # There is no need to verify whether both sha256 and hash are
             # valid here, because nuget-to-nix does not generate a deps.nix
             # containing both.
-        inherit url sha256 hash;
+            inherit url sha256 hash version;
           };
-    in
+
-    # NuGet.org edits packages by signing them during upload, which makes
+          nativeBuildInputs = [
-    # those packages nondeterministic depending on which source you
+            unzip
-    # get them from. We fix this by stripping out the signature file.
+            patchNupkgs
-    # Signing logic is https://github.com/NuGet/NuGet.Client/blob/128a5066b1438627ac69a2ffe9de564b2c09ee4d/src/NuGet.Core/NuGet.Packaging/Signing/Archive/SignedPackageArchiveIOUtility.cs#L518
+            nugetPackageHook
-    # Non-NuGet.org sources might not have a signature file; in that case, zip
+          ];
-    # exits with code 12 ("zip has nothing to do", per `man zip`).
+
-    runCommand src.name
+          unpackPhase = ''
-      {
+            unzip -nq $src
-        inherit src;
+            chmod -R +rw .
-        nativeBuildInputs = [ zip ];
-      }
-      ''
-        zip "$src" --temp-path "$TMPDIR" --output-file "$out" --delete .signature.p7s || {
-          (( $? == 12 ))
-          install -Dm644 "$src" "$out"
-        }
           '';
-})
+
-// {
+          prePatch = ''
+            shopt -s nullglob
+            local dir
+            for dir in tools runtimes/*/native; do
+              [[ ! -d "$dir" ]] || chmod -R +x "$dir"
+            done
+            rm -rf .signature.p7s
+          '';
+
+          installPhase = ''
+            dir=$out/share/nuget/packages/${lib.toLower pname}/${lib.toLower version}
+            mkdir -p $dir
+            cp -r . $dir
+            echo {} > "$dir"/.nupkg.metadata
+          '';
+
+          preFixup = ''
+            patch-nupkgs $out/share/nuget/packages
+          '';
+
+          createInstallableNugetSource = installable;
+        };
+    };
+  }) // {
     inherit sourceFile;
-}
+  })

pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh

@@ -56,10 +56,11 @@ for package in *; do
       continue
     fi
 
-    used_source="$(jq -r '.source' "$version"/.nupkg.metadata)"
+    # packages in the nix store should have an empty metadata file
+    used_source="$(jq -r 'if has("source") then .source else "" end' "$version"/.nupkg.metadata)"
     found=false
 
-    if [[ -d "$used_source" ]]; then
+    if [[ -z "$used_source" || -d "$used_source" ]]; then
       continue
     fi
 

pkgs/by-name/to/torrentstream/package.nix

@@ -33,8 +33,6 @@ buildDotnetModule rec {
     ./0001-display-the-message-of-caught-exceptions.patch
   ];
 
-  postInstall = "rm $out/lib/torrentstream/NuGet.config"; # reduce closure size
-
   meta = {
     homepage = "https://github.com/trueromanus/TorrentStream";
     description = "Simple web server for streaming torrent files in video players";

pkgs/development/compilers/dotnet/combine-packages.nix

@@ -1,5 +1,5 @@
 dotnetPackages:
-{ buildEnv, makeWrapper, lib }:
+{ buildEnv, makeWrapper, lib, symlinkJoin }:
 # TODO: Rethink how we determine and/or get the CLI.
 #       Possible options raised in #187118:
 #         1. A separate argument for the CLI (as suggested by IvarWithoutBones
@@ -27,7 +27,10 @@ assert lib.assertMsg ((builtins.length dotnetPackages) > 0)
       inherit (cli) icu;
 
       versions = lib.catAttrs "version" dotnetPackages;
-      packages = lib.remove null (lib.catAttrs "packages" dotnetPackages);
+      packages = symlinkJoin {
+        name = "combined-packages";
+        paths = lib.remove null (lib.catAttrs "packages" dotnetPackages);
+      };
     };
 
     inherit (cli) meta;

pkgs/development/compilers/dotnet/common.nix

@@ -14,6 +14,9 @@
 , swiftPackages
 , darwin
 , icu
+, lndir
+, substituteAll
+, nugetPackageHook
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
   doInstallCheck = true;
 
@@ -23,17 +26,16 @@
     $out/bin/dotnet --info
   '';
 
-  # TODO: move this to sdk section?
+  setupHooks = args.setupHooks or [] ++ [
-  setupHook = writeText "dotnet-setup-hook" (''
+    ./dotnet-setup-hook.sh
-    if [ ! -w "$HOME" ]; then
+  ] ++ lib.optional (type == "sdk") (substituteAll {
-      export HOME=$(mktemp -d) # Dotnet expects a writable home directory for its configuration files
+    src = ./dotnet-sdk-setup-hook.sh;
-    fi
+    inherit lndir;
+  });
 
-    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 # Dont try to expand NuGetFallbackFolder to disk
+  propagatedBuildInputs =
-    export DOTNET_NOLOGO=1 # Disables the welcome message
+    (args.propagatedBuildInputs or [])
-    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    ++ [ nugetPackageHook ];
-    export DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK=1 # Skip integrity check on first run, which fails due to read-only directory
-  '' + args.setupHook or "");
 
   nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ installShellFiles ];
 
@@ -63,23 +65,22 @@
         }:
         let
           sdk = finalAttrs.finalPackage;
-          built = runCommandWith  {
+          built = stdenv.mkDerivation {
             name = "dotnet-test-${name}";
-            inherit stdenv;
+            buildInputs =
-            derivationArgs = {
+              [ sdk ]
-              buildInputs = [ sdk ] ++ buildInputs;
+              ++ buildInputs
+              ++ lib.optional (usePackageSource) sdk.packages;
             # make sure ICU works in a sandbox
             propagatedSandboxProfile = toString sdk.__propagatedSandboxProfile;
+            unpackPhase = ''
+              mkdir test
+              cd test
+              dotnet new ${template} -o .
+            '';
+            buildPhase = build;
+            dontPatchELF = true;
           };
-          } (''
-            HOME=$PWD/.home
-            dotnet new nugetconfig
-            dotnet nuget disable source nuget
-          '' + lib.optionalString usePackageSource ''
-            dotnet nuget add source ${sdk.packages}
-          '' + ''
-            dotnet new ${template} -n test -o .
-          '' + build);
         in
           if run == null
             then built
@@ -87,6 +88,7 @@
             runCommand "${built.name}-run" ({
               src = built;
               nativeBuildInputs = [ built ] ++ runInputs;
+              passthru = { inherit built; };
             } // lib.optionalAttrs (stdenv.isDarwin && runAllowNetworking) {
               sandboxProfile = ''
                 (allow network-inbound (local ip))
@@ -105,9 +107,6 @@
         # yes, older SDKs omit the comma
         [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
       '';
-
-      patchNupkgs = callPackage ./patch-nupkgs.nix {};
-
     in {
       version = testers.testVersion ({
         package = finalAttrs.finalPackage;
@@ -184,8 +183,7 @@
         template = "console";
         usePackageSource = true;
         buildInputs =
-          [ patchNupkgs
+          [ zlib
-            zlib
           ] ++ lib.optional stdenv.isDarwin (with darwin; with apple_sdk.frameworks; [
             swiftPackages.swift
             Foundation
@@ -195,7 +193,6 @@
           ]);
         build = ''
           dotnet restore -p:PublishAot=true
-          patch-nupkgs .home/.nuget/packages
           dotnet publish -p:PublishAot=true -o $out/bin
         '';
         runtime = null;

pkgs/development/compilers/dotnet/default.nix

@@ -5,8 +5,19 @@ dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_6_0 aspnetcore_7
 Hashes and urls are retrieved from:
 https://dotnet.microsoft.com/download/dotnet
 */
-{ lib, config, callPackage, recurseIntoAttrs }:
+{ lib
+, config
+, recurseIntoAttrs
+, generateSplicesForMkScope
+, makeScopeWithSplicing'
+}:
+
+makeScopeWithSplicing' {
+  otherSplices = generateSplicesForMkScope "dotnetCorePackages";
+  f = (self:
     let
+      callPackage = self.callPackage;
+
       buildDotnet = attrs: callPackage (import ./build-dotnet.nix attrs) {};
       buildAttrs = {
         buildAspNetCore = attrs: buildDotnet (attrs // { type = "aspnetcore"; });
@@ -29,14 +40,17 @@ let
         "i686-windows" = "win-x86";
       };
 
+    in {
+      inherit callPackage;
+
       # Convert a "stdenv.hostPlatform.system" to a dotnet RID
       systemToDotnetRid = system: runtimeIdentifierMap.${system} or (throw "unsupported platform ${system}");
-in
-{
-  inherit systemToDotnetRid;
 
       combinePackages = attrs: callPackage (import ./combine-packages.nix attrs) {};
 
+      patchNupkgs = callPackage ./patch-nupkgs.nix {};
+      nugetPackageHook = callPackage ./nuget-package-hook.nix {};
+
       dotnet_8 = recurseIntoAttrs (callPackage ./8 { bootstrapSdk = dotnet_8_0.sdk_8_0_1xx; });
       dotnet_9 = recurseIntoAttrs (callPackage ./9 {});
     } // lib.optionalAttrs config.allowAliases {
@@ -46,4 +60,5 @@ in
       sdk_3_0 = throw "Dotnet SDK 3.0 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
       sdk_3_1 = throw "Dotnet SDK 3.1 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
       sdk_5_0 = throw "Dotnet SDK 5.0 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
-} // dotnet_6_0 // dotnet_7_0 // dotnet_8_0 // dotnet_9_0
+    } // dotnet_6_0 // dotnet_7_0 // dotnet_8_0 // dotnet_9_0);
+}

pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh

@@ -0,0 +1,77 @@
+# shellcheck shell=bash disable=SC2154
+export MSBUILDALWAYSOVERWRITEREADONLYFILES=1
+
+declare -Ag _nugetInputs
+
+addNugetInputs() {
+    if [[ -d "$1/share/nuget" ]]; then
+        _nugetInputs[$1]=1
+    fi
+}
+
+addEnvHooks "$targetOffset" addNugetInputs
+
+_linkPackages() {
+    local -r src="$1"
+    local -r dest="$2"
+    local dir
+
+    for x in "$src"/*/*; do
+        dir=$dest/$(basename "$(dirname "$x")")
+        mkdir -p "$dir"
+        ln -s "$x" "$dir"/
+    done
+}
+
+createNugetDirs() {
+    nugetTemp=$PWD/.nuget-temp
+    export NUGET_PACKAGES=$nugetTemp/packages
+    nugetSource=$nugetTemp/source
+    mkdir -p "$NUGET_PACKAGES" "$nugetSource"
+
+    dotnet new nugetconfig
+    if [[ -z ${keepNugetConfig-} ]]; then
+        dotnet nuget disable source nuget
+    fi
+
+    dotnet nuget add source "$nugetSource" -n _nix
+}
+
+configureNuget() {
+    for x in "${!_nugetInputs[@]}"; do
+        if [[ -d $x/share/nuget/packages ]]; then
+            addToSearchPathWithCustomDelimiter ";" NUGET_FALLBACK_PACKAGES "$x/share/nuget/packages"
+        fi
+
+        if [[ -d $x/share/nuget/source ]]; then
+            _linkPackages "$x/share/nuget/source" "$nugetSource"
+        fi
+    done
+
+    if [[ -n "${linkNugetPackages-}"
+        || -f .config/dotnet-tools.json
+        || -f dotnet-tools.json
+        || -f paket.dependencies ]]; then
+        for x in "${!_nugetInputs[@]}"; do
+            if [[ -d $x/share/nuget/packages ]]; then
+                @lndir@/bin/lndir -silent "$x/share/nuget/packages" "$NUGET_PACKAGES"
+            fi
+        done
+    fi
+
+    if [[ -f paket.dependencies ]]; then
+       sed -i "s:source .*:source $nugetSource:" paket.dependencies
+       sed -i "s:remote\:.*:remote\: $nugetSource:" paket.lock
+
+       for x in "${!_nugetInputs[@]}"; do
+           if [[ -d $x/share/nuget/source ]]; then
+               @lndir@/bin/lndir -silent "$x/share/nuget/source" "$NUGET_PACKAGES"
+           fi
+       done
+    fi
+}
+
+if [[ -z ${dontConfigureNuget-} ]]; then
+    prePhases+=(createNugetDirs)
+    preConfigurePhases+=(configureNuget)
+fi

pkgs/development/compilers/dotnet/dotnet-setup-hook.sh

@@ -0,0 +1,8 @@
+if [ ! -w "$HOME" ]; then
+    export HOME=$(mktemp -d) # Dotnet expects a writable home directory for its configuration files
+fi
+
+export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 # Dont try to expand NuGetFallbackFolder to disk
+export DOTNET_NOLOGO=1 # Disables the welcome message
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+export DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK=1 # Skip integrity check on first run, which fails due to read-only directory

pkgs/development/compilers/dotnet/dotnet.nix

@@ -32,7 +32,6 @@ let
             installPhase = ''
               mkdir -p $out
               cp -r * $out/
-              ln -fs ${old.passthru.packages}/* $out/
             '';
           };
         };

pkgs/development/compilers/dotnet/nuget-package-hook.nix

@@ -0,0 +1,12 @@
+{
+  makeSetupHook,
+  zip,
+  strip-nondeterminism,
+}:
+makeSetupHook {
+  name = "nuget-package-hook";
+  substitutions = {
+    inherit zip;
+    stripNondeterminism = strip-nondeterminism;
+  };
+} ./nuget-package-hook.sh

pkgs/development/compilers/dotnet/nuget-package-hook.sh

@@ -0,0 +1,38 @@
+# shellcheck shell=bash disable=SC2154
+
+_createNugetSourceInOutput() {
+    local package version id dir nupkg content
+    local -a nuspec
+    shopt -s nullglob
+
+    for package in "$prefix"/share/nuget/packages/*/*; do
+        version=$(basename "$package")
+        id=$(basename "$(dirname "$package")")
+        dir="$prefix/share/nuget/source/$id/$version"
+        nupkg=$dir/$id.$version.nupkg
+        nuspec=("$package"/*.nuspec)
+
+        if [[ -n ${createInstallableNugetSource-} ]]; then
+            content=.
+        else
+            content=$(basename "${nuspec[0]}")
+        fi
+
+        mkdir -p "$dir"
+        cp "${nuspec[0]}" "$dir/$id.nuspec"
+        (cd "$package" && @zip@/bin/zip -rq0 "$nupkg" "$content")
+        @stripNondeterminism@/bin/strip-nondeterminism --type zip "$nupkg"
+        touch "$nupkg".sha512
+    done
+}
+
+createNugetSource() {
+    local output
+    for output in $(getAllOutputNames); do
+        prefix="${!output}" _createNugetSourceInOutput
+    done
+}
+
+if [[ -z ${dontCreateNugetSource-} ]]; then
+    postFixupHooks+=(createNugetSource)
+fi

pkgs/development/compilers/dotnet/packages.nix

@@ -1,6 +1,9 @@
 { stdenv
 , callPackage
 , vmr
+, xmlstarlet
+, strip-nondeterminism
+, zip
 }:
 
 let
@@ -16,6 +19,12 @@ in {
     src = vmr;
     dontUnpack = true;
 
+    nativeBuildInputs = [
+      xmlstarlet
+      strip-nondeterminism
+      zip
+    ];
+
     outputs = [ "out" "packages" "artifacts" ];
 
     installPhase = ''
@@ -26,11 +35,47 @@ in {
       mkdir "$out"/bin
       ln -s "$out"/dotnet "$out"/bin/dotnet
 
-      mkdir "$packages"
+      mkdir -p "$packages" "$artifacts"
-      # this roughly corresponds to the {sdk,aspnetcore}_packages in ../update.sh
+      cp -r "$src"/Private.SourceBuilt.Artifacts.*.${targetRid}/* "$artifacts"/
-      cp -r "$src"/Private.SourceBuilt.Artifacts.*.${targetRid}/*Microsoft.{NET.ILLink.Tasks,NETCore,DotNet,AspNetCore}.*.nupkg "$packages"
+      chmod +w -R "$artifacts"
 
-      cp -r "$src"/Private.SourceBuilt.Artifacts.*.${targetRid} "$artifacts"
+      local package
+
+      for package in "$artifacts"/*.nupkg; do
+        local copy
+        case "$(basename "$package")" in
+          *Microsoft.NET.* | \
+          *Microsoft.ILLink.* | \
+          *Microsoft.Tasks.* | \
+          *Microsoft.NETCore.* | \
+          *Microsoft.DotNet.* | \
+          *Microsoft.AspNetCore.*) copy=1 ;;
+          *) copy= ;;
+        esac
+        if [[ -n $copy ]]; then
+          echo copying "$package" to packages
+          xmlstarlet \
+            sel -t \
+            -m /_:package/_:metadata \
+            -v _:id -nl \
+            -v _:version -nl \
+            "$package"/*.nuspec \
+            | tr A-Z a-z | (
+            read id
+            read version
+            mkdir -p "$packages"/share/nuget/packages/"$id"
+            cp -r "$package" "$packages"/share/nuget/packages/"$id"/"$version"
+          )
+        fi
+      done
+
+      for package in "$artifacts"/{,SourceBuildReferencePackages/}*.nupkg; do
+        echo packing "$package" to artifacts
+        (cd "$package" && zip -rq0 "$package.tmp" .)
+        strip-nondeterminism --type zip "$package.tmp"
+        rm -r "$package"
+        mv "$package.tmp" "$package"
+      done
 
       runHook postInstall
     '';

pkgs/development/compilers/dotnet/patch-nupkgs.nix

@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, dotnetCorePackages
 , zlib
 , curl
 , icu
@@ -12,8 +11,6 @@
 }:
 
 let
-  buildRid = dotnetCorePackages.systemToDotnetRid stdenv.buildPlatform.system;
-
   binaryRPath = lib.makeLibraryPath ([
     stdenv.cc.cc
     zlib
@@ -37,13 +34,12 @@ in writeShellScriptBin "patch-nupkgs" (''
       if [ "$magic" = $'\177ELF' ]; then return 0; else return 1; fi
   }
   cd "$1"
-  for x in *.${buildRid}/* *.${buildRid}.*/*; do
+  for x in */* */*; do
     # .nupkg.metadata is written last, so we know the packages is complete
     [[ -d "$x" ]] && [[ -f "$x"/.nupkg.metadata ]] \
       && [[ ! -f "$x"/.nix-patched ]] || continue
     echo "Patching package $x"
-    pushd "$x"
+    find "$x" -type f -print0 | while IFS= read -rd "" p; do
-    for p in $(find -type f); do
       if [[ "$p" != *.nix-patched ]] \
         && isELF "$p" \
         && patchelf --print-interpreter "$p" &>/dev/null; then
@@ -68,19 +64,18 @@ in writeShellScriptBin "patch-nupkgs" (''
         mv "$tmp" "$p"
       fi
     done
-    touch .nix-patched
+    touch "$x"/.nix-patched
-    popd
   done
 '' + lib.optionalString stdenv.isDarwin ''
   for x in microsoft.dotnet.ilcompiler/*; do
     # .nupkg.metadata is written last, so we know the packages is complete
     [[ -d "$x" ]] && [[ -f "$x"/.nupkg.metadata ]] \
-      && [[ ! -f "$x"/.nix-patched ]] || continue
+      && [[ ! -f "$x"/.nix-patched-ilcompiler ]] || continue
     echo "Patching package $x"
     pushd "$x"
     sed -i 's: -no_code_signature_warning::g' build/Microsoft.NETCore.Native.targets
     sed -i 's:Include="-ld_classic"::g' build/Microsoft.NETCore.Native.Unix.targets
-    touch .nix-patched
+    touch .nix-patched-ilcompiler
     popd
   done
 '')

pkgs/development/compilers/dotnet/stage0.nix

@@ -3,13 +3,13 @@
 , callPackage
 , lib
 , writeShellScript
-, pkgsBuildHost
 , mkNugetDeps
 , nix
 , cacert
 , nuget-to-nix
 , dotnetCorePackages
 , xmlstarlet
+, patchNupkgs
 
 , releaseManifestFile
 , tarballHash
@@ -21,21 +21,24 @@ let
   mkPackages = callPackage ./packages.nix;
   mkVMR = callPackage ./vmr.nix;
 
-  dotnetSdk = pkgsBuildHost.callPackage bootstrapSdk {};
+  dotnetSdk = callPackage bootstrapSdk {};
-
-  patchNupkgs = pkgsBuildHost.callPackage ./patch-nupkgs.nix {};
 
   deps = mkNugetDeps {
     name = "dotnet-vmr-deps";
     sourceFile = depsFile;
   };
 
+  sdkPackages = dotnetSdk.packages.override {
+    installable = true;
+  };
+
   vmr = (mkVMR {
     inherit releaseManifestFile tarballHash dotnetSdk;
   }).overrideAttrs (old: rec {
     prebuiltPackages = mkNugetDeps {
       name = "dotnet-vmr-deps";
       sourceFile = depsFile;
+      installable = true;
     };
 
     nativeBuildInputs =
@@ -52,7 +55,9 @@ let
     '';
 
     postConfigure = old.postConfigure or "" + ''
-      [[ ! -v prebuiltPackages ]] || ln -sf "$prebuiltPackages"/* prereqs/packages/prebuilt/
+      [[ ! -v prebuiltPackages ]] || \
+        ln -sf "$prebuiltPackages"/share/nuget/source/*/*/*.nupkg prereqs/packages/prebuilt/
+      ln -sf "${sdkPackages}"/share/nuget/source/*/*/*.nupkg prereqs/packages/prebuilt/
     '';
 
     buildFlags =

pkgs/development/compilers/dotnet/stage1.nix

@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , callPackage
-, pkgsBuildHost
 
 , releaseManifestFile
 , tarballHash
@@ -13,7 +12,7 @@ let
   mkPackages = callPackage ./packages.nix;
   mkVMR = callPackage ./vmr.nix;
 
-  stage0 = pkgsBuildHost.callPackage ./stage0.nix args;
+  stage0 = callPackage ./stage0.nix args;
 
   vmr = (mkVMR {
     inherit releaseManifestFile tarballHash;

pkgs/development/compilers/dotnet/vmr.nix

@@ -25,6 +25,8 @@
 , xmlstarlet
 , nodejs
 , callPackage
+, unzip
+, yq
 
 , dotnetSdk
 , releaseManifestFile
@@ -78,6 +80,8 @@ in stdenv.mkDerivation rec {
     pkg-config
     python3
     xmlstarlet
+    unzip
+    yq
   ]
   ++ lib.optionals (lib.versionAtLeast version "9") [
     nodejs
@@ -353,6 +357,7 @@ in stdenv.mkDerivation rec {
     typeset -f isScript patchShebangs > src/aspnetcore/patch-shebangs.sh
   '';
 
+  dontConfigureNuget = true; # NUGET_PACKAGES breaks the build
   dontUseCmakeConfigure = true;
 
   # https://github.com/NixOS/nixpkgs/issues/38991
@@ -410,6 +415,16 @@ in stdenv.mkDerivation rec {
     done
     popd
 
+    local -r unpacked="$PWD/.unpacked"
+    for nupkg in $out/Private.SourceBuilt.Artifacts.*.${targetRid}/{,SourceBuildReferencePackages/}*.nupkg; do
+        rm -rf "$unpacked"
+        unzip -qd "$unpacked" "$nupkg"
+        chmod -R +rw "$unpacked"
+        rm "$nupkg"
+        mv "$unpacked" "$nupkg"
+        # TODO: should we fix executable flags here? see dotnetInstallHook
+    done
+
     runHook postInstall
   '';
 
@@ -418,7 +433,12 @@ in stdenv.mkDerivation rec {
   stripDebugList = [ "." ];
   # stripping dlls results in:
   # Failed to load System.Private.CoreLib.dll (error code 0x8007000B)
-  stripExclude = [ "*.dll" ];
+  # stripped crossgen2 results in:
+  # Failure processing application bundle; possible file corruption.
+  # this needs to be a bash array
+  preFixup = ''
+    stripExclude=(\*.dll crossgen2)
+  '';
 
   passthru = {
     inherit releaseManifest buildRid targetRid;

pkgs/development/python-modules/clr-loader/default.nix

@@ -36,6 +36,11 @@ buildPythonPackage {
 
   format = "pyproject";
 
+  buildInputs = [
+    dotnetCorePackages.sdk_6_0.packages
+    dotnet-build.nugetDeps
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -59,13 +64,11 @@ buildPythonPackage {
   preConfigure = ''
     dotnet restore "netfx_loader/ClrLoader.csproj" \
       -p:ContinuousIntegrationBuild=true \
-      -p:Deterministic=true \
+      -p:Deterministic=true
-      --source "${dotnet-build.nuget-source}"
 
     dotnet restore "example/example.csproj" \
       -p:ContinuousIntegrationBuild=true \
-      -p:Deterministic=true \
+      -p:Deterministic=true
-      --source "${dotnet-build.nuget-source}"
   '';
 
   passthru.fetch-deps = dotnet-build.fetch-deps;

pkgs/development/python-modules/pythonnet/default.nix

@@ -37,6 +37,8 @@ buildPythonPackage {
       --replace 'dynamic = ["version"]' 'version = "${version}"'
   '';
 
+  buildInputs = [ dotnet-build.nugetDeps ];
+
   nativeBuildInputs = [
     setuptools
     dotnet-sdk
@@ -62,7 +64,7 @@ buildPythonPackage {
     dotnet restore \
       -p:ContinuousIntegrationBuild=true \
       -p:Deterministic=true \
-      --source ${dotnet-build.nuget-source}
+      --source "$nugetSource"
   '';
 
   # Rerun this when updating to refresh Nuget dependencies

pkgs/development/tools/build-managers/msbuild/default.nix

@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
+    unset NUGET_PACKAGES
     # nuget would otherwise try to base itself in /homeless-shelter
     export HOME=$(pwd)/fake-home
 

pkgs/development/tools/fsautocomplete/deps.nix

@@ -54,11 +54,6 @@
   (fetchNuGet { pname = "McMaster.NETCore.Plugins"; version = "1.4.0"; hash = "sha256-PtpD8S74UXyoA80YRDlrp8qR/I7Ws7+4m2EJZzH4WMw="; })
   (fetchNuGet { pname = "MessagePack"; version = "2.5.108"; hash = "sha256-+vMXyEbfutY5WOFuFnNF24uLcKJTTdntVrVlSJH4yjI="; })
   (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.108"; hash = "sha256-u3Qu8UftNIz3oIzQUMa7Z0G6VzmDLcAnAeNQ3lB3YVk="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.32"; hash = "sha256-1mQTxwruzhm20YdlZefrYuy7xrBs17pH4Vo0K3Tl7Fc="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.32"; hash = "sha256-cIe0F+7rgwYSmh0VuFuQsUI9iEW5hn2KCD2H8Cs/k2g="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.32"; hash = "sha256-TkYv7h9NBr3I+FIaXeLU4MawJtgT2RWhs35ewGRDKx8="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-arm64"; version = "6.0.32"; hash = "sha256-RaC37ZQcJn7ykXJrtV7ibxh0GcalRyPKncxlqOLou+I="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.32"; hash = "sha256-vh/e46xM/HbhbBvL5eP5/DCHwCP2Bg7WoMS28nBXWV0="; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "7.0.0"; hash = "sha256-1e031E26iraIqun84ad0fCIR4MJZ1hcQo4yFN+B7UfE="; })
   (fetchNuGet { pname = "Microsoft.Bcl.HashCode"; version = "1.1.0"; hash = "sha256-IFvXCMV2joahytylQ2BGSpZd2tdX0Rss++ZcClVT+r0="; })
   (fetchNuGet { pname = "Microsoft.Build"; version = "17.2.0"; hash = "sha256-JzPqbxFyotNhSr5tokVevdqB9+nJKx4YH2hPkC05GiY="; })
@@ -96,15 +91,6 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; hash = "sha256-AgvysszpQ11AiTBJFkvSy8JnwIWTj15Pfek7T7ThUc4="; })
   (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.4.0"; hash = "sha256-+9uBaUDZ3roUJwyYJUL30Mz+3C6LE16FzfQKgS0Yveo="; })
   (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.4.1"; hash = "sha256-Kl8ZAWCMFZcYEfPDr/YG4zfQEuEzlOuhWI40Zl2S4Qo="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.32"; hash = "sha256-yDOkSHEGuGG6u+rB5u+IC3rc2tQwvbjdqmgHcl7Gkn4="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.32"; hash = "sha256-2aDGkn0QqXXHUUSAwtQQbjKl5I6S0fcQWPciqPnOiM4="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-arm64"; version = "6.0.32"; hash = "sha256-n6hks4j88TRelq1O6SCeUH5GmxoSm5BWXGwnpnYJibI="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.32"; hash = "sha256-nBBq4RYAgimBYOn/bN6JTFvJFYaqYXMHae2pmCzRaS8="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.32"; hash = "sha256-Fm3RUZNcro434rIu3c7unGviGeGBjXj2dGnr2mmrM2g="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.32"; hash = "sha256-kdj8ia/2du2oKGg4MJdO2XytpT3gQ9UOiHVCyfiX2V8="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.32"; hash = "sha256-/Hti30Ba12NDJQcG8pFTg6REVUDIrxZ/hRtEZNDlgxE="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-arm64"; version = "6.0.32"; hash = "sha256-A8MFGOMXFROH1QGUE7xzq5b5EskDyIQCQt7SLfGdSbU="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.32"; hash = "sha256-y5YB62WlMrK10bR/+nNpI8luVRlD9W9ZG3GsX7AXzUM="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.1"; hash = "sha256-8hLiUKvy/YirCWlFwzdejD2Db3DaXhHxT7GSZx/znJg="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.3"; hash = "sha256-WLsf1NuUfRWyr7C7Rl9jiua9jximnVvzy6nk2D2bVRc="; })
   (fetchNuGet { pname = "Microsoft.NETFramework.ReferenceAssemblies"; version = "1.0.3"; hash = "sha256-FBoJP5DHZF0QHM0xLm9yd4HJZVQOuSpSKA+VQRpphEE="; })

pkgs/development/tools/godot/3/mono/default.nix

@@ -1,10 +1,8 @@
 { godot3
 , callPackage
 , mkNugetDeps
-, mkNugetSource
 , mono
 , dotnet-sdk
-, writeText
 , scons
 , python311Packages
 }:
@@ -22,31 +20,15 @@
 
   glue = callPackage ./glue.nix {};
 
-  nugetDeps = mkNugetDeps { name = "deps"; nugetDeps = import ./deps.nix; };
+  buildInputs = base.buildInputs ++ [
-
+    (mkNugetDeps { name = "deps"; nugetDeps = import ./deps.nix; })
-  nugetSource =
+  ];
-    mkNugetSource {
-      name = "${self.pname}-nuget-source";
-      description = "Nuget source with dependencies for ${self.pname}";
-      deps = [ self.nugetDeps ];
-    };
-
-  nugetConfig = writeText "NuGet.Config" ''
-    <?xml version="1.0" encoding="utf-8"?>
-    <configuration>
-      <packageSources>
-        <add key="${self.pname}-deps" value="${self.nugetSource}/lib" />
-      </packageSources>
-    </configuration>
-  '';
 
   sconsFlags = base.sconsFlags ++ [
     "module_mono_enabled=true"
     "mono_prefix=${mono}"
   ];
 
-  shouldConfigureNuget = true;
-
   postConfigure = ''
     echo "Setting up buildhome."
     mkdir buildhome
@@ -54,12 +36,6 @@
 
     echo "Overlaying godot glue."
     cp -R --no-preserve=mode "$glue"/. .
-
-    if [ -n "$shouldConfigureNuget" ]; then
-      echo "Configuring NuGet."
-      mkdir -p ~/.nuget/NuGet
-      ln -s "$nugetConfig" ~/.nuget/NuGet/NuGet.Config
-    fi
   '';
 
   installedGodotShortcutFileName = "org.godotengine.GodotMono3.desktop";

pkgs/development/tools/godot/3/mono/make-deps.nix

@@ -9,7 +9,7 @@ godot3-mono.overrideAttrs (self: base: {
   nugetSource = null;
   nugetConfig = null;
 
-  shouldConfigureNuget = false;
+  keepNugetConfig = true;
 
   outputs = [ "out" ];
   buildPhase = " ";

pkgs/development/tools/ilspycmd/default.nix

@@ -32,6 +32,9 @@ buildDotnetModule rec {
   projectFile = "ICSharpCode.ILSpyCmd/ICSharpCode.ILSpyCmd.csproj";
   nugetDeps = ./deps.nix;
 
+  # see: https://github.com/tunnelvisionlabs/ReferenceAssemblyAnnotator/issues/94
+  linkNugetPackages = true;
+
   meta = with lib; {
     description = "Tool for decompiling .NET assemblies and generating portable PDBs";
     mainProgram = "ilspycmd";

pkgs/servers/nosql/eventstore/default.nix

@@ -42,13 +42,6 @@ buildDotnetModule rec {
     "EventStore.Projections.Core.Tests.Services.grpc_service.ServerFeaturesTests<LogFormat+V3,UInt32>.should_receive_expected_endpoints"
   ];
 
-  postConfigure = ''
-    # Fixes git execution by GitInfo on mac os
-    substituteInPlace "$HOME/.nuget/packages/gitinfo/2.0.26/build/GitInfo.targets" \
-      --replace "<GitExe Condition=\"Exists('/usr/bin/git')\">/usr/bin/git</GitExe>" " " \
-      --replace "<GitExe Condition=\"Exists('/usr/local/bin/git')\">/usr/local/bin/git</GitExe>" ""
-  '';
-
   nugetDeps = ./deps.nix;
 
   projectFile = "src/EventStore.ClusterNode/EventStore.ClusterNode.csproj";

pkgs/top-level/all-packages.nix

@@ -891,7 +891,7 @@ with pkgs;
   buildDotnetModule = callPackage ../build-support/dotnet/build-dotnet-module { };
   nuget-to-nix = callPackage ../build-support/dotnet/nuget-to-nix { };
   mkNugetSource = callPackage ../build-support/dotnet/make-nuget-source { };
-  mkNugetDeps = callPackage ../build-support/dotnet/make-nuget-deps { };
+  mkNugetDeps = (newScope dotnetCorePackages) ../build-support/dotnet/make-nuget-deps { };
 
   buildDotnetGlobalTool = callPackage ../build-support/dotnet/build-dotnet-global-tool { };