Project import generated by Copybara.

GitOrigin-RevId: 6143fc5eeb9c4f00163267708e26191d1e918932

third_party/nixpkgs/.editorconfig

@@ -17,6 +17,10 @@ end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset
 
+# We want readFile .version to return the version without a newline.
+[.version]
+insert_final_newline = false
+
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
 # Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces

third_party/nixpkgs/.git-blame-ignore-revs

@@ -102,3 +102,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 
 # systemd: break too long lines of Nix code
 67643f8ec84bef1482204709073e417c9f07eb87
+
+# {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
+802a1b4d3338f24cbc4efd704616654456d75a94

third_party/nixpkgs/.github/CODEOWNERS

@@ -55,7 +55,7 @@
 /pkgs/pkgs-lib/formats/hocon                     @h7x4
 
 # pkgs/by-name
-/pkgs/test/nixpkgs-check-by-name @infinisil
+/pkgs/test/check-by-name @infinisil
 /pkgs/by-name/README.md @infinisil
 /pkgs/top-level/by-name-overlay.nix @infinisil
 /.github/workflows/check-by-name.yml @infinisil
@@ -131,13 +131,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 /pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
 
 # Haskell
-/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn @ncfavier
+/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
-/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
-/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
-/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
-/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
 
 # Perl
 /pkgs/development/interpreters/perl @stigtsp @zakame @dasJ
@@ -159,7 +159,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 
 # C compilers
 /pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @RaitoBezarius
 /pkgs/development/compilers/emscripten @raitobezarius
 /doc/languages-frameworks/emscripten.section.md @raitobezarius
 
@@ -186,17 +185,17 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses.nix @alyssais
 
 # Qt
-/pkgs/development/libraries/qt-5 @NixOS/qt-kde
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/qt-6 @NixOS/qt-kde
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 5
-/pkgs/applications/kde @NixOS/qt-kde
+/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/desktops/plasma-5 @NixOS/qt-kde
+/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 6
-/pkgs/kde @NixOS/qt-kde
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/maintainers/scripts/kde @NixOS/qt-kde
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
 /pkgs/servers/sql/postgresql @thoughtpolice @marsam
@@ -204,10 +203,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/databases/postgresql.nix @thoughtpolice
 /nixos/tests/postgresql.nix @thoughtpolice
 
-# Linux kernel
-/pkgs/os-specific/linux/kernel    @raitobezarius
-/pkgs/top-level/linux-kernels.nix @raitobezarius
-
 # Hardened profile & related modules
 /nixos/modules/profiles/hardened.nix @joachifm
 /nixos/modules/security/hidepid.nix @joachifm
@@ -237,10 +232,12 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/networking/babeld.nix @mweinelt
 /nixos/modules/services/networking/kea.nix @mweinelt
 /nixos/modules/services/networking/knot.nix @mweinelt
+nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 /nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
 /nixos/tests/babeld.nix @mweinelt
 /nixos/tests/kea.nix @mweinelt
 /nixos/tests/knot.nix @mweinelt
+/nixos/tests/networking/* @Janik-Haag
 
 # Web servers
 /doc/packages/nginx.section.md @raitobezarius
@@ -301,7 +298,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 
 # GNOME
 /pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions       @piegamesde @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
 /pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
@@ -359,3 +356,21 @@ nixos/tests/zfs.nix                       @raitobezarius
 nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
 nixos/tests/buildbot.nix                               @Mic92 @zowoq
 pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+
+# Pretix
+pkgs/by-name/pr/pretix/ @mweinelt
+nixos/modules/services/web-apps/pretix.nix @mweinelt
+nixos/tests/web-apps/pretix.nix @mweinelt
+
+# incus/lxc/lxd
+nixos/maintainers/scripts/lxd/          @adamcstephens
+nixos/modules/virtualisation/incus.nix  @adamcstephens
+nixos/modules/virtualisation/lxc*       @adamcstephens
+nixos/modules/virtualisation/lxd*       @adamcstephens
+nixos/tests/incus/                      @adamcstephens
+nixos/tests/lxd/                        @adamcstephens
+pkgs/by-name/in/incus/                  @adamcstephens
+pkgs/by-name/lx/lxc*                    @adamcstephens
+pkgs/by-name/lx/lxd*                    @adamcstephens
+pkgs/os-specific/linux/lxc/             @adamcstephens
+

third_party/nixpkgs/.github/PULL_REQUEST_TEMPLATE.md

@@ -19,7 +19,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - [ ] `sandbox = true`
 - [ ] Tested, as applicable:
   - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
-  - and/or [package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests)
+  - and/or [package tests](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests)
   - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
@@ -38,7 +38,7 @@ Reviewing helps to reduce the average time-to-merge for everyone.
 Thanks a lot if you do!
 
 List of open PRs: https://github.com/NixOS/nixpkgs/pulls
-Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-contributions
+Reviewing guidelines: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#reviewing-contributions
 -->
 
 ---

third_party/nixpkgs/.github/labeler.yml

@@ -1,216 +1,371 @@
 "6.topic: agda":
-  - doc/languages-frameworks/agda.section.md
+  - any:
-  - nixos/tests/agda.nix
+    - changed-files:
-  - pkgs/build-support/agda/**/*
+      - any-glob-to-any-file:
-  - pkgs/development/libraries/agda/**/*
+        - doc/languages-frameworks/agda.section.md
-  - pkgs/top-level/agda-packages.nix
+        - nixos/tests/agda.nix
+        - pkgs/build-support/agda/**/*
+        - pkgs/development/libraries/agda/**/*
+        - pkgs/top-level/agda-packages.nix
 
 "6.topic: cinnamon":
-  - pkgs/desktops/cinnamon/**/*
+  - any:
-  - nixos/modules/services/x11/desktop-managers/cinnamon.nix
+    - changed-files:
-  - nixos/tests/cinnamon.nix
+      - any-glob-to-any-file:
+        - pkgs/desktops/cinnamon/**/*
+        - nixos/modules/services/x11/desktop-managers/cinnamon.nix
+        - nixos/tests/cinnamon.nix
 
 "6.topic: emacs":
-  - nixos/modules/services/editors/emacs.nix
+  - any:
-  - nixos/modules/services/editors/emacs.xml
+    - changed-files:
-  - nixos/tests/emacs-daemon.nix
+      - any-glob-to-any-file:
-  - pkgs/applications/editors/emacs/elisp-packages/**/*
+        - nixos/modules/services/editors/emacs.nix
-  - pkgs/applications/editors/emacs/**/*
+        - nixos/modules/services/editors/emacs.xml
-  - pkgs/build-support/emacs/**/*
+        - nixos/tests/emacs-daemon.nix
-  - pkgs/top-level/emacs-packages.nix
+        - pkgs/applications/editors/emacs/elisp-packages/**/*
+        - pkgs/applications/editors/emacs/**/*
+        - pkgs/build-support/emacs/**/*
+        - pkgs/top-level/emacs-packages.nix
 
 "6.topic: Enlightenment DE":
-  - nixos/modules/services/x11/desktop-managers/enlightenment.nix
+  - any:
-  - pkgs/desktops/enlightenment/**/*
+    - changed-files:
-  - pkgs/development/python-modules/python-efl/*
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/enlightenment.nix
+        - pkgs/desktops/enlightenment/**/*
+        - pkgs/development/python-modules/python-efl/*
 
 "6.topic: erlang":
-  - doc/languages-frameworks/beam.section.md
+  - any:
-  - pkgs/development/beam-modules/**/*
+    - changed-files:
-  - pkgs/development/interpreters/elixir/**/*
+      - any-glob-to-any-file:
-  - pkgs/development/interpreters/erlang/**/*
+        - doc/languages-frameworks/beam.section.md
-  - pkgs/development/tools/build-managers/rebar/**/*
+        - pkgs/development/beam-modules/**/*
-  - pkgs/development/tools/build-managers/rebar3/**/*
+        - pkgs/development/interpreters/elixir/**/*
-  - pkgs/development/tools/erlang/**/*
+        - pkgs/development/interpreters/erlang/**/*
-  - pkgs/top-level/beam-packages.nix
+        - pkgs/development/tools/build-managers/rebar/**/*
+        - pkgs/development/tools/build-managers/rebar3/**/*
+        - pkgs/development/tools/erlang/**/*
+        - pkgs/top-level/beam-packages.nix
 
 "6.topic: fetch":
-  - pkgs/build-support/fetch*/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/build-support/fetch*/**/*
 
 "6.topic: flakes":
-  - '**/flake.nix'
+  - any:
-  - lib/systems/flake-systems.nix
+    - changed-files:
-  - nixos/modules/config/nix-flakes.nix
+      - any-glob-to-any-file:
+        - '**/flake.nix'
+        - lib/systems/flake-systems.nix
+        - nixos/modules/config/nix-flakes.nix
 
 "6.topic: GNOME":
-  - doc/languages-frameworks/gnome.section.md
+  - any:
-  - nixos/modules/services/desktops/gnome/**/*
+    - changed-files:
-  - nixos/modules/services/x11/desktop-managers/gnome.nix
+      - any-glob-to-any-file:
-  - nixos/tests/gnome-xorg.nix
+        - doc/languages-frameworks/gnome.section.md
-  - nixos/tests/gnome.nix
+        - nixos/modules/services/desktops/gnome/**/*
-  - pkgs/desktops/gnome/**/*
+        - nixos/modules/services/x11/desktop-managers/gnome.nix
+        - nixos/tests/gnome-xorg.nix
+        - nixos/tests/gnome.nix
+        - pkgs/desktops/gnome/**/*
 
 "6.topic: golang":
-  - doc/languages-frameworks/go.section.md
+  - any:
-  - pkgs/build-support/go/**/*
+    - changed-files:
-  - pkgs/development/compilers/go/**/*
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/go.section.md
+        - pkgs/build-support/go/**/*
+        - pkgs/development/compilers/go/**/*
 
 "6.topic: haskell":
-  - doc/languages-frameworks/haskell.section.md
+  - any:
-  - maintainers/scripts/haskell/**/*
+    - changed-files:
-  - pkgs/development/compilers/ghc/**/*
+      - any-glob-to-any-file:
-  - pkgs/development/haskell-modules/**/*
+        - doc/languages-frameworks/haskell.section.md
-  - pkgs/development/tools/haskell/**/*
+        - maintainers/scripts/haskell/**/*
-  - pkgs/test/haskell/**/*
+        - pkgs/development/compilers/ghc/**/*
-  - pkgs/top-level/haskell-packages.nix
+        - pkgs/development/haskell-modules/**/*
-  - pkgs/top-level/release-haskell.nix
+        - pkgs/development/tools/haskell/**/*
+        - pkgs/test/haskell/**/*
+        - pkgs/top-level/haskell-packages.nix
+        - pkgs/top-level/release-haskell.nix
+
+"6.topic: julia":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/julia.section.md
+        - pkgs/development/compilers/julia/**/*
+        - pkgs/development/julia-modules/**/*
 
 "6.topic: jupyter":
-  - pkgs/development/python-modules/jupyter*/**/*
+  - any:
-  - pkgs/development/python-modules/mkdocs-jupyter/*
+    - changed-files:
-  - nixos/modules/services/development/jupyter/**/*
+      - any-glob-to-any-file:
-  - pkgs/applications/editors/jupyter-kernels/**/*
+        - pkgs/development/python-modules/jupyter*/**/*
-  - pkgs/applications/editors/jupyter/**/*
+        - pkgs/development/python-modules/mkdocs-jupyter/*
+        - nixos/modules/services/development/jupyter/**/*
+        - pkgs/applications/editors/jupyter-kernels/**/*
+        - pkgs/applications/editors/jupyter/**/*
 
 "6.topic: kernel":
-  - pkgs/build-support/kernel/**/*
+  - any:
-  - pkgs/os-specific/linux/kernel/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/build-support/kernel/**/*
+        - pkgs/os-specific/linux/kernel/**/*
 
 "6.topic: lib":
-  - lib/**
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - lib/**
 
 "6.topic: lua":
-  - pkgs/development/interpreters/lua-5/**/*
+  - any:
-  - pkgs/development/interpreters/luajit/**/*
+    - changed-files:
-  - pkgs/development/lua-modules/**/*
+      - any-glob-to-any-file:
-  - pkgs/top-level/lua-packages.nix
+        - pkgs/development/tools/misc/luarocks/*
+        - pkgs/development/interpreters/lua-5/**/*
+        - pkgs/development/interpreters/luajit/**/*
+        - pkgs/development/lua-modules/**/*
+        - pkgs/top-level/lua-packages.nix
 
 "6.topic: Lumina DE":
-  - nixos/modules/services/x11/desktop-managers/lumina.nix
+  - any:
-  - pkgs/desktops/lumina/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/lumina.nix
+        - pkgs/desktops/lumina/**/*
 
 "6.topic: LXQt":
-  - nixos/modules/services/x11/desktop-managers/lxqt.nix
+  - any:
-  - pkgs/desktops/lxqt/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/lxqt.nix
+        - pkgs/desktops/lxqt/**/*
 
 "6.topic: mate":
-  - nixos/modules/services/x11/desktop-managers/mate.nix
+  - any:
-  - nixos/tests/mate.nix
+    - changed-files:
-  - pkgs/desktops/mate/**/*
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/mate.nix
+        - nixos/tests/mate.nix
+        - pkgs/desktops/mate/**/*
 
 "6.topic: module system":
-  - lib/modules.nix
+  - any:
-  - lib/types.nix
+    - changed-files:
-  - lib/options.nix
+      - any-glob-to-any-file:
-  - lib/tests/modules.sh
+        - lib/modules.nix
-  - lib/tests/modules/**
+        - lib/types.nix
+        - lib/options.nix
+        - lib/tests/modules.sh
+        - lib/tests/modules/**
 
 "6.topic: nixos":
-  - nixos/**/*
+  - any:
-  - pkgs/os-specific/linux/nixos-rebuild/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/**/*
+        - pkgs/os-specific/linux/nixos-rebuild/**/*
 
 "6.topic: nim":
-  - doc/languages-frameworks/nim.section.md
+  - any:
-  - pkgs/development/compilers/nim/*
+    - changed-files:
-  - pkgs/development/nim-packages/**/*
+      - any-glob-to-any-file:
-  - pkgs/top-level/nim-packages.nix
+        - doc/languages-frameworks/nim.section.md
+        - pkgs/development/compilers/nim/*
+        - pkgs/development/nim-packages/**/*
+        - pkgs/top-level/nim-packages.nix
 
 "6.topic: nodejs":
-  - doc/languages-frameworks/javascript.section.md
+  - any:
-  - pkgs/build-support/node/**/*
+    - changed-files:
-  - pkgs/development/node-packages/**/*
+      - any-glob-to-any-file:
-  - pkgs/development/tools/yarn/*
+        - doc/languages-frameworks/javascript.section.md
-  - pkgs/development/tools/yarn2nix-moretea/**/*
+        - pkgs/build-support/node/**/*
-  - pkgs/development/web/nodejs/*
+        - pkgs/development/node-packages/**/*
+        - pkgs/development/tools/yarn/*
+        - pkgs/development/tools/yarn2nix-moretea/**/*
+        - pkgs/development/web/nodejs/*
 
 "6.topic: ocaml":
-  - doc/languages-frameworks/ocaml.section.md
+  - any:
-  - pkgs/development/compilers/ocaml/**/*
+    - changed-files:
-  - pkgs/development/compilers/reason/**/*
+      - any-glob-to-any-file:
-  - pkgs/development/ocaml-modules/**/*
+        - doc/languages-frameworks/ocaml.section.md
-  - pkgs/development/tools/ocaml/**/*
+        - pkgs/development/compilers/ocaml/**/*
-  - pkgs/top-level/ocaml-packages.nix
+        - pkgs/development/compilers/reason/**/*
+        - pkgs/development/ocaml-modules/**/*
+        - pkgs/development/tools/ocaml/**/*
+        - pkgs/top-level/ocaml-packages.nix
 
 "6.topic: pantheon":
-  - nixos/modules/services/desktops/pantheon/**/*
+  - any:
-  - nixos/modules/services/x11/desktop-managers/pantheon.nix
+    - changed-files:
-  - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+      - any-glob-to-any-file:
-  - nixos/tests/pantheon.nix
+        - nixos/modules/services/desktops/pantheon/**/*
-  - pkgs/desktops/pantheon/**/*
+        - nixos/modules/services/x11/desktop-managers/pantheon.nix
+        - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+        - nixos/tests/pantheon.nix
+        - pkgs/desktops/pantheon/**/*
+
+"6.topic: php":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/php.section.md
+        - pkgs/build-support/php/**/*
+        - pkgs/development/interpreters/php/*
+        - pkgs/development/php-packages/**/*
+        - pkgs/test/php/default.nix
+        - pkgs/top-level/php-packages.nix
 
 "6.topic: policy discussion":
-  - .github/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - .github/**/*
 
 "6.topic: printing":
-  - nixos/modules/services/printing/cupsd.nix
+  - any:
-  - pkgs/misc/cups/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/printing/cupsd.nix
+        - pkgs/misc/cups/**/*
 
 "6.topic: python":
-  - doc/languages-frameworks/python.section.md
+  - any:
-  - pkgs/development/interpreters/python/**/*
+    - changed-files:
-  - pkgs/development/python-modules/**/*
+      - any-glob-to-any-file:
-  - pkgs/top-level/python-packages.nix
+        - doc/languages-frameworks/python.section.md
+        - pkgs/development/interpreters/python/**/*
+        - pkgs/development/python-modules/**/*
+        - pkgs/top-level/python-packages.nix
 
 "6.topic: qt/kde":
-  - doc/languages-frameworks/qt.section.md
+  - any:
-  - nixos/modules/services/x11/desktop-managers/plasma5.nix
+    - changed-files:
-  - nixos/tests/plasma5.nix
+      - any-glob-to-any-file:
-  - pkgs/applications/kde/**/*
+        - doc/languages-frameworks/qt.section.md
-  - pkgs/desktops/plasma-5/**/*
+        - nixos/modules/services/x11/desktop-managers/plasma5.nix
-  - pkgs/development/libraries/kde-frameworks/**/*
+        - nixos/tests/plasma5.nix
-  - pkgs/development/libraries/qt-5/**/*
+        - pkgs/applications/kde/**/*
+        - pkgs/desktops/plasma-5/**/*
+        - pkgs/development/libraries/kde-frameworks/**/*
+        - pkgs/development/libraries/qt-5/**/*
 
 "6.topic: ruby":
-  - doc/languages-frameworks/ruby.section.md
+  - any:
-  - pkgs/development/interpreters/ruby/**/*
+    - changed-files:
-  - pkgs/development/ruby-modules/**/*
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/ruby.section.md
+        - pkgs/development/interpreters/ruby/**/*
+        - pkgs/development/ruby-modules/**/*
 
 "6.topic: rust":
-  - doc/languages-frameworks/rust.section.md
+  - any:
-  - pkgs/build-support/rust/**/*
+    - changed-files:
-  - pkgs/development/compilers/rust/**/*
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/rust.section.md
+        - pkgs/build-support/rust/**/*
+        - pkgs/development/compilers/rust/**/*
 
 "6.topic: stdenv":
-  - pkgs/stdenv/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/stdenv/**/*
 
 "6.topic: steam":
-  - pkgs/games/steam/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/games/steam/**/*
 
 "6.topic: systemd":
-  - pkgs/os-specific/linux/systemd/**/*
+  - any:
-  - nixos/modules/system/boot/systemd*/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/os-specific/linux/systemd/**/*
+        - nixos/modules/system/boot/systemd*/**/*
 
 "6.topic: TeX":
-  - doc/languages-frameworks/texlive.section.md
+  - any:
-  - pkgs/test/texlive/**
+    - changed-files:
-  - pkgs/tools/typesetting/tex/**/*
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/texlive.section.md
+        - pkgs/test/texlive/**
+        - pkgs/tools/typesetting/tex/**/*
+
+"6.topic: testing":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        # NOTE: Let's keep the scope limited to test frameworks that are
+        #       *developed in this repo*;
+        #       - not individual tests
+        #       - not packages for test frameworks
+        - nixos/lib/testing/**
+        - nixos/lib/test-driver/**
+        - nixos/tests/nixos-test-driver/**
+        - nixos/lib/testing-python.nix      # legacy
+        - nixos/tests/make-test-python.nix  # legacy
+        # lib/debug.nix has a test framework (runTests) but it's not the main focus
 
 "6.topic: vim":
-  - doc/languages-frameworks/vim.section.md
+  - any:
-  - pkgs/applications/editors/vim/**/*
+    - changed-files:
-  - pkgs/applications/editors/vim/plugins/**/*
+      - any-glob-to-any-file:
-  - nixos/modules/programs/neovim.nix
+        - doc/languages-frameworks/vim.section.md
-  - pkgs/applications/editors/neovim/**/*
+        - pkgs/applications/editors/vim/**/*
+        - pkgs/applications/editors/vim/plugins/**/*
+        - nixos/modules/programs/neovim.nix
+        - pkgs/applications/editors/neovim/**/*
 
 "6.topic: vscode":
-  - pkgs/applications/editors/vscode/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/applications/editors/vscode/**/*
 
 "6.topic: xfce":
-  - nixos/doc/manual/configuration/xfce.xml
+  - any:
-  - nixos/modules/services/x11/desktop-managers/xfce.nix
+    - changed-files:
-  - nixos/tests/xfce.nix
+      - any-glob-to-any-file:
-  - pkgs/desktops/xfce/**/*
+        - nixos/doc/manual/configuration/xfce.xml
+        - nixos/modules/services/x11/desktop-managers/xfce.nix
+        - nixos/tests/xfce.nix
+        - pkgs/desktops/xfce/**/*
 
 "6.topic: zig":
-  - pkgs/development/compilers/zig/**/*
+  - any:
-  - doc/hooks/zig.section.md
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/development/compilers/zig/**/*
+        - doc/hooks/zig.section.md
 
 "8.has: changelog":
-  - nixos/doc/manual/release-notes/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/doc/manual/release-notes/**/*
 
 "8.has: documentation":
-  - doc/**/*
+  - any:
-  - nixos/doc/**/*
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/**/*
+        - nixos/doc/**/*
 
 "8.has: module (update)":
-  - nixos/modules/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/**/*

third_party/nixpkgs/.github/workflows/backport.yml

@@ -20,11 +20,11 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@08bafb375e6e9a9a2b53a744b987e5d81a133191 # v2.1.1
+        uses: korthout/backport-action@ef20d86abccbac3ee3a73cb2efbdc06344c390e5 # v2.5.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'

third_party/nixpkgs/.github/workflows/basic-eval.yml

@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
         name: nixpkgs-ci
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
     # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
-    - run: nix-build pkgs/top-level/release.nix -A tarball.nixpkgs-basic-release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
+    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

third_party/nixpkgs/.github/workflows/check-by-name.yml

@@ -1,11 +1,9 @@
 # Checks pkgs/by-name (see pkgs/by-name/README.md)
-# using the nixpkgs-check-by-name tool (see pkgs/test/nixpkgs-check-by-name)
+# using the nixpkgs-check-by-name tool (see https://github.com/NixOS/nixpkgs-check-by-name)
 #
-# When you make changes to this workflow, also update pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh adequately
+# When you make changes to this workflow, also update pkgs/test/check-by-name/run-local.sh adequately
 name: Check pkgs/by-name
 
-# The tool is pinned to a pre-built version on Hydra,
-# see pkgs/test/nixpkgs-check-by-name/scripts/README.md
 on:
   # Using pull_request_target instead of pull_request avoids having to approve first time contributors
   pull_request_target:
@@ -24,8 +22,7 @@ permissions:
 
 jobs:
   check:
-    # This is x86_64-linux, for which the tool is always prebuilt on the nixos-* channels,
+    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases
-    # as specified in nixos/release-combined.nix
     runs-on: ubuntu-latest
     # This should take 1 minute at most, but let's be generous.
     # The default of 6 hours is definitely too long
@@ -87,7 +84,7 @@ jobs:
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}
@@ -98,13 +95,16 @@ jobs:
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       - name: Fetching the pinned tool
-        # Update the pinned version using pkgs/test/nixpkgs-check-by-name/scripts/update-pinned-tool.sh
+        # Update the pinned version using pkgs/test/check-by-name/update-pinned-tool.sh
         run: |
-          # Get the direct /nix/store path from the pin to avoid having to evaluate Nixpkgs
+          # The pinned version of the tooling to use
-          toolPath=$(jq -r '."ci-path"' pkgs/test/nixpkgs-check-by-name/scripts/pinned-tool.json)
+          toolVersion=$(<pkgs/test/check-by-name/pinned-version.txt)
-          # This asks the substituter for the path, which should be there because Hydra will have pre-built and pushed it
+          # Fetch the x86_64-linux-specific release artifact containing the Gzipped NAR of the pre-built tool
+          toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-check-by-name/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
+            | gzip -cd | nix-store --import | tail -1)
+          # Adds a result symlink as a GC root
           nix-store --realise "$toolPath" --add-root result
       - name: Running nixpkgs-check-by-name
         run: |

third_party/nixpkgs/.github/workflows/check-cherry-picks.yml

@@ -0,0 +1,24 @@
+name: "Check cherry-picks"
+on:
+  pull_request_target:
+    branches:
+     - 'release-**'
+     - 'staging-**'
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        fetch-depth: 0
+        filter: blob:none
+    - name: Check cherry-picks
+      env:
+        BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      run: |
+        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

third_party/nixpkgs/.github/workflows/check-maintainers-sorted.yaml

@@ -12,11 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+          # Only these directories to perform the check
+          sparse-checkout: |
+            lib
+            maintainers
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

third_party/nixpkgs/.github/workflows/check-nix-format.yml

@@ -0,0 +1,53 @@
+# This file was copied mostly from check-maintainers-sorted.yaml.
+# NOTE: Formatting with the RFC-style nixfmt command is not yet stable. See
+# https://github.com/NixOS/rfcs/pull/166.
+# Because of this, this action is not yet enabled for all files -- only for
+# those who have opted in.
+name: Check that Nix files are formatted
+
+on:
+  pull_request_target:
+permissions:
+  contents: read
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
+      - name: Install nixfmt
+        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
+      - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
+        run: |
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
+            fi
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              echo "Error: nixfmt failed."
+              exit 1
+            fi
+          done

third_party/nixpkgs/.github/workflows/editorconfig.yml

@@ -24,11 +24,11 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

third_party/nixpkgs/.github/workflows/labels.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: true

third_party/nixpkgs/.github/workflows/manual-nixos.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
@@ -26,6 +26,6 @@ jobs:
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
-          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
       - name: Building NixOS manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

third_party/nixpkgs/.github/workflows/manual-nixpkgs.yml

@@ -9,17 +9,18 @@ on:
     paths:
       - 'doc/**'
       - 'lib/**'
+      - 'pkgs/tools/nix/nixdoc/**'
 
 jobs:
   nixpkgs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
@@ -27,6 +28,6 @@ jobs:
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
-          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
       - name: Building Nixpkgs manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

third_party/nixpkgs/.github/workflows/nix-parse.yml

@@ -24,12 +24,12 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
       if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         nix_path: nixpkgs=channel:nixpkgs-unstable
     - name: Parse all changed or added nix files

third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml

@@ -41,7 +41,7 @@ jobs:
             into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml

@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

third_party/nixpkgs/.github/workflows/update-terraform-providers.yml

@@ -16,8 +16,8 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # v6.0.2
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

third_party/nixpkgs/.gitignore

@@ -11,12 +11,12 @@ outputs/
 result-*
 result
 repl-result-*
+tags
 !pkgs/development/python-modules/result
 /doc/NEWS.html
 /doc/NEWS.txt
 /doc/manual.html
 /doc/manual.pdf
-/result
 /source/
 .version-suffix
 

third_party/nixpkgs/CONTRIBUTING.md

@@ -557,7 +557,7 @@ Names of files and directories should be in lowercase, with dashes between words
 
   ```nix
   foo {
-    arg = ...;
+    arg = <...>;
   }
   ```
 
@@ -566,14 +566,14 @@ Names of files and directories should be in lowercase, with dashes between words
   ```nix
   foo
   {
-    arg = ...;
+    arg = <...>;
   }
   ```
 
   Also fine is
 
   ```nix
-  foo { arg = ...; }
+  foo { arg = <...>; }
   ```
 
   if it's a short call.
@@ -581,41 +581,45 @@ Names of files and directories should be in lowercase, with dashes between words
 - In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
 
   ```nix
-  # A long list.
+  {
-  list = [
+    # A long list.
-    elem1
+    list = [
-    elem2
+      elem1
-    elem3
+      elem2
-  ];
+      elem3
+    ];
 
-  # A long attribute set.
+    # A long attribute set.
-  attrs = {
+    attrs = {
-    attr1 = short_expr;
+      attr1 = short_expr;
-    attr2 =
+      attr2 =
-      if true then big_expr else big_expr;
+        if true then big_expr else big_expr;
-  };
+    };
 
-  # Combined
+    # Combined
-  listOfAttrs = [
+    listOfAttrs = [
-    {
+      {
-      attr1 = 3;
+        attr1 = 3;
-      attr2 = "fff";
+        attr2 = "fff";
-    }
+      }
-    {
+      {
-      attr1 = 5;
+        attr1 = 5;
-      attr2 = "ggg";
+        attr2 = "ggg";
-    }
+      }
-  ];
+    ];
+  }
   ```
 
 - Short lists or attribute sets can be written on one line:
 
   ```nix
-  # A short list.
+  {
-  list = [ elem1 elem2 elem3 ];
+    # A short list.
+    list = [ elem1 elem2 elem3 ];
 
-  # A short set.
+    # A short set.
-  attrs = { x = 1280; y = 1024; };
+    attrs = { x = 1280; y = 1024; };
+  }
   ```
 
 - Breaking in the middle of a function argument can give hard-to-read code, like
@@ -649,7 +653,7 @@ Names of files and directories should be in lowercase, with dashes between words
   ```nix
   { arg1, arg2 }:
   assert system == "i686-linux";
-  stdenv.mkDerivation { ...
+  stdenv.mkDerivation { /* ... */ }
   ```
 
   not
@@ -657,41 +661,41 @@ Names of files and directories should be in lowercase, with dashes between words
   ```nix
   { arg1, arg2 }:
     assert system == "i686-linux";
-      stdenv.mkDerivation { ...
+      stdenv.mkDerivation { /* ... */ }
   ```
 
 - Function formal arguments are written as:
 
   ```nix
-  { arg1, arg2, arg3 }:
+  { arg1, arg2, arg3 }: { /* ... */ }
   ```
 
   but if they don't fit on one line they're written as:
 
   ```nix
   { arg1, arg2, arg3
-  , arg4, ...
+  , arg4
-  , # Some comment...
+  # Some comment...
-    argN
+  ,  argN
-  }:
+  }: { }
   ```
 
 - Functions should list their expected arguments as precisely as possible. That is, write
 
   ```nix
-  { stdenv, fetchurl, perl }: ...
+  { stdenv, fetchurl, perl }: <...>
   ```
 
   instead of
 
   ```nix
-  args: with args; ...
+  args: with args; <...>
   ```
 
   or
 
   ```nix
-  { stdenv, fetchurl, perl, ... }: ...
+  { stdenv, fetchurl, perl, ... }: <...>
   ```
 
   For functions that are truly generic in the number of arguments (such as wrappers around `mkDerivation`) that have some required arguments, you should write them using an `@`-pattern:
@@ -700,7 +704,7 @@ Names of files and directories should be in lowercase, with dashes between words
   { stdenv, doCoverageAnalysis ? false, ... } @ args:
 
   stdenv.mkDerivation (args // {
-    ... if doCoverageAnalysis then "bla" else "" ...
+    foo = if doCoverageAnalysis then "bla" else "";
   })
   ```
 
@@ -710,32 +714,40 @@ Names of files and directories should be in lowercase, with dashes between words
   args:
 
   args.stdenv.mkDerivation (args // {
-    ... if args ? doCoverageAnalysis && args.doCoverageAnalysis then "bla" else "" ...
+    foo = if args ? doCoverageAnalysis && args.doCoverageAnalysis then "bla" else "";
   })
   ```
 
 - Unnecessary string conversions should be avoided. Do
 
   ```nix
-  rev = version;
+  {
+    rev = version;
+  }
   ```
 
   instead of
 
   ```nix
-  rev = "${version}";
+  {
+    rev = "${version}";
+  }
   ```
 
 - Building lists conditionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.
 
   ```nix
-  buildInputs = lib.optional stdenv.isDarwin iconv;
+  {
+    buildInputs = lib.optional stdenv.isDarwin iconv;
+  }
   ```
 
   instead of
 
   ```nix
-  buildInputs = if stdenv.isDarwin then [ iconv ] else null;
+  {
+    buildInputs = if stdenv.isDarwin then [ iconv ] else null;
+  }
   ```
 
   As an exception, an explicit conditional expression with null can be used when fixing a important bug without triggering a mass rebuild.

third_party/nixpkgs/README.md

@@ -1,9 +1,10 @@
 <p align="center">
-  <a href="https://nixos.org#gh-light-mode-only">
+  <a href="https://nixos.org">
-    <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/master/logo/nixos-hires.png" width="500px" alt="NixOS logo"/>
+    <picture>
-  </a>
+      <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-  <a href="https://nixos.org#gh-dark-mode-only">
+      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-    <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png" width="500px" alt="NixOS logo"/>
+      <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="500px" alt="NixOS logo">
+    </picture>
   </a>
 </p>
 
@@ -13,7 +14,7 @@
 </p>
 
 [Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over
-80,000 software packages that can be installed with the
+100,000 software packages that can be installed with the
 [Nix](https://nixos.org/nix/) package manager. It also implements
 [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
@@ -28,8 +29,8 @@
 * [Discourse Forum](https://discourse.nixos.org/)
 * [Matrix Chat](https://matrix.to/#/#community:nixos.org)
 * [NixOS Weekly](https://weekly.nixos.org/)
-* [Community-maintained wiki](https://nixos.wiki/)
+* [Official wiki](https://wiki.nixos.org/)
-* [Community-maintained list of ways to get in touch](https://nixos.wiki/wiki/Get_In_Touch#Chat) (Discord, Telegram, IRC, etc.)
+* [Community-maintained list of ways to get in touch](https://wiki.nixos.org/wiki/Get_In_Touch#Chat) (Discord, Telegram, IRC, etc.)
 
 # Other Project Repositories
 

third_party/nixpkgs/doc/README.md

@@ -106,12 +106,12 @@ This is a warning
 
 The following are supported:
 
-- [`caution`](https://tdg.docbook.org/tdg/5.0/caution.html)
+- `caution`
-- [`important`](https://tdg.docbook.org/tdg/5.0/important.html)
+- `important`
-- [`note`](https://tdg.docbook.org/tdg/5.0/note.html)
+- `note`
-- [`tip`](https://tdg.docbook.org/tdg/5.0/tip.html)
+- `tip`
-- [`warning`](https://tdg.docbook.org/tdg/5.0/warning.html)
+- `warning`
-- [`example`](https://tdg.docbook.org/tdg/5.0/example.html)
+- `example`
 
 Example admonitions require a title to work.
 If you don't provide one, the manual won't be built.

third_party/nixpkgs/doc/anchor-use.js

@@ -0,0 +1,3 @@
+document.addEventListener('DOMContentLoaded', function(event) {
+  anchors.add('h1[id]:not(div.note h1, div.warning h1, div.tip h1, div.caution h1, div.important h1), h2[id]:not(div.note h2, div.warning h2, div.tip h2, div.caution h2, div.important h2), h3[id]:not(div.note h3, div.warning h3, div.tip h3, div.caution h3, div.important h3), h4[id]:not(div.note h4, div.warning h4, div.tip h4, div.caution h4, div.important h4), h5[id]:not(div.note h5, div.warning h5, div.tip h5, div.caution h5, div.important h5), h6[id]:not(div.note h6, div.warning h6, div.tip h6, div.caution h6, div.important h6)');
+});

third_party/nixpkgs/doc/build-helpers/fetchers.chapter.md

@@ -1,88 +1,681 @@
 # Fetchers {#chap-pkgs-fetchers}
 
 Building software with Nix often requires downloading source code and other files from the internet.
-To this end, Nixpkgs provides *fetchers*: functions to obtain remote sources via various protocols and services.
+To this end, we use functions that we call _fetchers_, which obtain remote sources via various protocols and services.
+
+Nix provides built-in fetchers such as [`builtins.fetchTarball`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchTarball).
+Nixpkgs provides its own fetchers, which work differently:
 
-Nixpkgs fetchers differ from built-in fetchers such as [`builtins.fetchTarball`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchTarball):
 - A built-in fetcher will download and cache files at evaluation time and produce a [store path](https://nixos.org/manual/nix/stable/glossary#gloss-store-path).
-  A Nixpkgs fetcher will create a ([fixed-output](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation)) [derivation](https://nixos.org/manual/nix/stable/language/derivations), and files are downloaded at build time.
+  A Nixpkgs fetcher will create a ([fixed-output](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation)) [derivation](https://nixos.org/manual/nix/stable/glossary#gloss-derivation), and files are downloaded at build time.
 - Built-in fetchers will invalidate their cache after [`tarball-ttl`](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-tarball-ttl) expires, and will require network activity to check if the cache entry is up to date.
-  Nixpkgs fetchers only re-download if the specified hash changes or the store object is not otherwise available.
+  Nixpkgs fetchers only re-download if the specified hash changes or the store object is not available.
 - Built-in fetchers do not use [substituters](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters).
   Derivations produced by Nixpkgs fetchers will use any configured binary cache transparently.
 
-This significantly reduces the time needed to evaluate the entirety of Nixpkgs, and allows [Hydra](https://nixos.org/hydra) to retain and re-distribute sources used by Nixpkgs in the [public binary cache](https://cache.nixos.org).
+This significantly reduces the time needed to evaluate Nixpkgs, and allows [Hydra](https://nixos.org/hydra) to retain and re-distribute sources used by Nixpkgs in the [public binary cache](https://cache.nixos.org).
-For these reasons, built-in fetchers are not allowed in Nixpkgs source code.
+For these reasons, Nix's built-in fetchers are not allowed in Nixpkgs.
 
-The following table shows an overview of the differences:
+The following table summarises the differences:
 
 | Fetchers | Download | Output | Cache | Re-download when |
 |-|-|-|-|-|
 | `builtins.fetch*` | evaluation time | store path | `/nix/store`, `~/.cache/nix` | `tarball-ttl` expires, cache miss in `~/.cache/nix`, output store object not in local store |
 | `pkgs.fetch*` | build time | derivation | `/nix/store`, substituters | output store object not available |
 
+:::{.tip}
+`pkgs.fetchFrom*` helpers retrieve _snapshots_ of version-controlled sources, as opposed to the entire version history, which is more efficient.
+`pkgs.fetchgit` by default also has the same behaviour, but can be changed through specific attributes given to it.
+:::
+
 ## Caveats {#chap-pkgs-fetchers-caveats}
 
-The fact that the hash belongs to the Nix derivation output and not the file itself can lead to confusion.
+Because Nixpkgs fetchers are fixed-output derivations, an [output hash](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-outputHash) has to be specified, usually indirectly through a `hash` attribute.
-For example, consider the following fetcher:
+This hash refers to the derivation output, which can be different from the remote source itself!
+
+This has the following implications that you should be aware of:
+
+- Use Nix (or Nix-aware) tooling to produce the output hash.
+
+- When changing any fetcher parameters, always update the output hash.
+  Use one of the methods from [](#sec-pkgs-fetchers-updating-source-hashes).
+  Otherwise, existing store objects that match the output hash will be re-used rather than fetching new content.
+
+  :::{.note}
+  A similar problem arises while testing changes to a fetcher's implementation.
+  If the output of the derivation already exists in the Nix store, test failures can go undetected.
+  The [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function helps prevent reusing cached derivations.
+  :::
+
+## Updating source hashes {#sec-pkgs-fetchers-updating-source-hashes}
+
+There are several ways to obtain the hash corresponding to a remote source.
+Unless you understand how the fetcher you're using calculates the hash from the downloaded contents, you should use [the fake hash method](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method).
+
+1. []{#sec-pkgs-fetchers-updating-source-hashes-fakehash-method} The fake hash method: In your package recipe, set the hash to one of
+
+   - `""`
+   - `lib.fakeHash`
+   - `lib.fakeSha256`
+   - `lib.fakeSha512`
+
+   Attempt to build, extract the calculated hashes from error messages, and put them into the recipe.
+
+   :::{.warning}
+   You must use one of these four fake hashes and not some arbitrarily-chosen hash.
+   See [](#sec-pkgs-fetchers-secure-hashes) for details.
+   :::
+
+   :::{.example #ex-fetchers-update-fod-hash}
+   # Update source hash with the fake hash method
+
+   Consider the following recipe that produces a plain file:
+
+   ```nix
+   { fetchurl }:
+   fetchurl {
+     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.05/.version";
+     hash = "sha256-ZHl1emidXVojm83LCVrwULpwIzKE/mYwfztVkvpruOM=";
+   }
+   ```
+
+   A common mistake is to update a fetcher parameter, such as `url`, without updating the hash:
+
+   ```nix
+   { fetchurl }:
+   fetchurl {
+     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
+     hash = "sha256-ZHl1emidXVojm83LCVrwULpwIzKE/mYwfztVkvpruOM=";
+   }
+   ```
+
+   **This will produce the same output as before!**
+   Set the hash to an empty string:
+
+   ```nix
+   { fetchurl }:
+   fetchurl {
+     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
+     hash = "";
+   }
+   ```
+
+   When building the package, use the error message to determine the correct hash:
+
+   ```shell
+   $ nix-build
+   (some output removed for clarity)
+   error: hash mismatch in fixed-output derivation '/nix/store/7yynn53jpc93l76z9zdjj4xdxgynawcw-version.drv':
+           specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+               got:    sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=
+   error: build of '/nix/store/bqdjcw5ij5ymfbm41dq230chk9hdhqff-version.drv' failed
+   ```
+   :::
+
+2. Prefetch the source with [`nix-prefetch-<type> <URL>`](https://search.nixos.org/packages?buckets={%22package_attr_set%22%3A[%22No%20package%20set%22]%2C%22package_license_set%22%3A[]%2C%22package_maintainers_set%22%3A[]%2C%22package_platforms%22%3A[]}&query=nix-prefetch), where `<type>` is one of
+
+   - `url`
+   - `git`
+   - `hg`
+   - `cvs`
+   - `bzr`
+   - `svn`
+
+   The hash is printed to stdout.
+
+3. Prefetch by package source (with `nix-prefetch-url '<nixpkgs>' -A <package>.src`, where `<package>` is package attribute name).
+   The hash is printed to stdout.
+
+   This works well when you've upgraded the existing package version and want to find out new hash, but is useless if the package can't be accessed by attribute or the package has multiple sources (`.srcs`, architecture-dependent sources, etc).
+
+4. Upstream hash: use it when upstream provides `sha256` or `sha512`.
+   Don't use it when upstream provides `md5`, compute `sha256` instead.
+
+   A little nuance is that `nix-prefetch-*` tools produce hashes with the `nix32` encoding (a Nix-specific base32 adaptation), but upstream usually provides hexadecimal (`base16`) encoding.
+   Fetchers understand both formats.
+   Nixpkgs does not standardise on any one format.
+
+   You can convert between hash formats with [`nix-hash`](https://nixos.org/manual/nix/stable/command-ref/nix-hash).
+
+5. Extract the hash from a local source archive with `sha256sum`.
+   Use `nix-prefetch-url file:///path/to/archive` if you want the custom Nix `base32` hash.
+
+## Obtaining hashes securely {#sec-pkgs-fetchers-secure-hashes}
+
+It's always a good idea to avoid Man-in-the-Middle (MITM) attacks when downloading source contents.
+Otherwise, you could unknowingly download malware instead of the intended source, and instead of the actual source hash, you'll end up using the hash of malware.
+Here are security considerations for this scenario:
+
+- `http://` URLs are not secure to prefetch hashes.
+
+- Upstream hashes should be obtained via a secure protocol.
+
+- `https://` URLs give you more protections when using `nix-prefetch-*` or for upstream hashes.
+
+- `https://` URLs are secure when using the [fake hash method](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method) *only if* you use one of the listed fake hashes.
+  If you use any other hash, the download will be exposed to MITM attacks even if you use HTTPS URLs.
+
+  In more concrete terms, if you use any other hash, the [`--insecure` flag](https://curl.se/docs/manpage.html#-k) will be passed to the underlying call to `curl` when downloading content.
+
+[]{#fetchurl}
+## `fetchurl` {#sec-pkgs-fetchers-fetchurl}
+
+`fetchurl` returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads content from a given URL and stores the unaltered contents within the Nix store.
+
+It uses {manpage}`curl(1)` internally, and allows its behaviour to be modified by specifying a few attributes in the argument to `fetchurl` (see the documentation for attributes `curlOpts`, `curlOptsList`, and `netrcPhase`).
+
+The resulting [store path](https://nixos.org/manual/nix/stable/store/store-path) is determined by the hash given to `fetchurl`, and also the `name` (or `pname` and `version`) values.
+
+If neither `name` nor `pname` and `version` are specified when calling `fetchurl`, it will default to using the [basename](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-baseNameOf) of `url` or the first element of `urls`.
+If `pname` and `version` are specified, `fetchurl` will use those values and will ignore `name`, even if it is also specified.
+
+### Inputs {#sec-pkgs-fetchers-fetchurl-inputs}
+
+`fetchurl` requires an attribute set with the following attributes:
+
+`url` (String; _optional_)
+: The URL to download from.
+
+  :::{.note}
+  Either `url` or `urls` must be specified, but not both.
+  :::
+
+  All URLs of the format [specified here](https://curl.se/docs/url-syntax.html#rfc-3986-plus) are supported.
+
+  _Default value:_ `""`.
+
+`urls` (List of String; _optional_)
+: A list of URLs, specifying download locations for the same content.
+  Each URL will be tried in order until one of them succeeds with some content or all of them fail.
+  See [](#ex-fetchers-fetchurl-nixpkgs-version-multiple-urls) to understand how this attribute affects the behaviour of `fetchurl`.
+
+  :::{.note}
+  Either `url` or `urls` must be specified, but not both.
+  :::
+
+  _Default value:_ `[]`.
+
+`hash` (String; _optional_)
+: Hash of the derivation output of `fetchurl`, following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
+  For more information, see [](#chap-pkgs-fetchers-caveats).
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead of the other hash-specific attributes that exist for backwards compatibility.
+
+  If `hash` is not specified, you must specify `outputHash` and `outputHashAlgo`, or one of `sha512`, `sha256`, or `sha1`.
+  :::
+
+  _Default value:_ `""`.
+
+`outputHash` (String; _optional_)
+: Hash of the derivation output of `fetchurl` in the format expected by Nix.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead.
+
+  If `outputHash` is specified, you must also specify `outputHashAlgo`.
+  :::
+
+  _Default value:_ `""`.
+
+`outputHashAlgo` (String; _optional_)
+: Algorithm used to generate the value specified in `outputHash`.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashAlgo) for more information about the values it supports.
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead.
+
+  The value specified in `outputHashAlgo` will be ignored if `outputHash` isn't also specified.
+  :::
+
+  _Default value:_ `""`.
+
+`sha1` (String; _optional_)
+: SHA-1 hash of the derivation output of `fetchurl` in the format expected by Nix.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead.
+  :::
+
+  _Default value:_ `""`.
+
+`sha256` (String; _optional_)
+: SHA-256 hash of the derivation output of `fetchurl` in the format expected by Nix.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead.
+  :::
+
+  _Default value:_ `""`.
+
+`sha512` (String; _optional_)
+: SHA-512 hash of the derivation output of `fetchurl` in the format expected by Nix.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
+
+  :::{.note}
+  It is recommended that you use the `hash` attribute instead.
+  :::
+
+  _Default value:_ `""`.
+
+`name` (String; _optional_)
+: The symbolic name of the downloaded file when saved in the Nix store.
+  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
+
+  _Default value:_ `""`.
+
+`pname` (String; _optional_)
+: A base name, which will be combined with `version` to form the symbolic name of the downloaded file when saved in the Nix store.
+  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
+
+  :::{.note}
+  If `pname` is specified, you must also specify `version`, otherwise `fetchurl` will ignore the value of `pname`.
+  :::
+
+  _Default value:_ `""`.
+
+`version` (String; _optional_)
+: A version, which will be combined with `pname` to form the symbolic name of the downloaded file when saved in the Nix store.
+  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
+
+  _Default value:_ `""`.
+
+`recursiveHash` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash}
+: If set to `true`, will signal to Nix that the hash given to `fetchurl` was calculated using the `"recursive"` mode.
+  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashMode) for more information about the existing modes.
+
+  By default, `fetchurl` uses `"recursive"` mode when the `executable` attribute is set to `true`, so you don't need to specify `recursiveHash` in this case.
+
+  _Default value:_ `false`.
+
+`executable` (Boolean; _optional_)
+: If `true`, sets the executable bit on the downloaded file.
+
+  _Default value_: `false`.
+
+`downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp}
+: If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location.
+  This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output.
+
+  The location of the downloaded file will be set in the `$downloadedFile` variable, which should be used by the script in the `postFetch` attribute.
+  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute.
+
+  _Default value:_ `false`.
+
+`postFetch` (String; _optional_)
+: Script executed after the file has been downloaded successfully, and before `fetchurl` finishes running.
+  Useful for post-processing, to check or transform the file in some way.
+  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute.
+
+  _Default value:_ `""`.
+
+`netrcPhase` (String or Null; _optional_)
+: Script executed to create a {manpage}`netrc(5)` file to be used with {manpage}`curl(1)`.
+  The script should create the `netrc` file (note that it does not begin with a ".") in the directory it's currently running in (`$PWD`).
+
+  The script is executed during the setup done by `fetchurl` before it runs any of its code to download the specified content.
+
+  :::{.note}
+  If specified, `fetchurl` will automatically alter its invocation of {manpage}`curl(1)` to use the `netrc` file, so you don't need to add anything to `curlOpts` or `curlOptsList`.
+  :::
+
+  :::{.caution}
+  Since `netrcPhase` needs to be specified in your source Nix code, any secrets that you put directly in it will be world-readable by design (both in your source code, and when the derivation gets created in the Nix store).
+
+  If you want to avoid this behaviour, see the documentation of `netrcImpureEnvVars` for an alternative way of dealing with these secrets.
+  :::
+
+  _Default value_: `null`.
+
+`netrcImpureEnvVars` (List of String; _optional_)
+: If specified, `fetchurl` will add these environment variable names to the list of [impure environment variables](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-impureEnvVars), which will be passed from the environment of the calling user to the builder running the `fetchurl` code.
+
+  This is useful when used with `netrcPhase` to hide any secrets that are used in it, because the script in `netrcPhase` only needs to reference the environment variables with the secrets in them instead.
+  However, note that these are called _impure_ variables for a reason:
+  the environment that starts the build needs to have these variables declared for everything to work properly, which means that additional setup is required outside what Nix controls.
+
+  _Default value:_ `[]`.
+
+`curlOpts` (String; _optional_)
+: If specified, this value will be appended to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`.
+  Multiple arguments can be separated by spaces normally, but values with whitespaces will be interpreted as multiple arguments (instead of a single value), even if the value is escaped.
+  See `curlOptsList` for a way to pass values with whitespaces in them.
+
+  _Default value:_ `""`.
+
+`curlOptsList` (List of String; _optional_)
+: If specified, each element of this list will be passed as an argument to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`.
+  This allows passing values that contain spaces, with no escaping needed.
+
+  _Default value:_ `[]`.
+
+`showURLs` (Boolean; _optional_)
+: If set to `true`, this will stop `fetchurl` from downloading anything at all.
+  Instead, it will output a list of all the URLs it would've used to download the content (after resolving `mirror://` URLs, for example).
+  This is useful for debugging.
+
+  _Default value:_ `false`.
+
+`meta` (Attribute Set; _optional_)
+: Specifies any [meta-attributes](#chap-meta) for the derivation returned by `fetchurl`.
+
+  _Default value:_ `{}`.
+
+`passthru` (Attribute Set; _optional_)
+: Specifies any extra [passthru](#var-stdenv-passthru) attributes for the derivation returned by `fetchurl`.
+  Note that `fetchurl` defines [passthru attributes of its own](#ssec-pkgs-fetchers-fetchurl-passthru-outputs).
+  Attributes specified in `passthru` can override the default attributes returned by `fetchurl`.
+
+  _Default value:_ `{}`.
+
+`preferLocalBuild` (Boolean; _optional_)
+: This is the same attribute as [defined in the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-preferLocalBuild).
+  It is `true` by default because making a remote machine download the content just duplicates network traffic (since the local machine might download the results from the derivation anyway), but this could be useful in cases where network access is restricted on local machines.
+
+  _Default value:_ `true`.
+
+`nativeBuildInputs` (List of Attribute Set; _optional_)
+: Additional packages needed to download the content.
+  This is useful if you need extra packages for `postFetch` or `netrcPhase`, for example.
+  Has the same semantics as in [](#var-stdenv-nativeBuildInputs).
+  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how this can be used with `postFetch`.
+
+  _Default value:_ `[]`.
+
+### Passthru outputs {#ssec-pkgs-fetchers-fetchurl-passthru-outputs}
+
+`fetchurl` also defines its own [`passthru`](#var-stdenv-passthru) attributes:
+
+`url` (String)
+
+: The same `url` attribute passed in the argument to `fetchurl`.
+
+### Examples {#ssec-pkgs-fetchers-fetchurl-examples}
+
+:::{.example #ex-fetchers-fetchurl-nixpkgs-version}
+# Using `fetchurl` to download a file
+
+The following package downloads a small file from a URL and shows the most common way to use `fetchurl`:
 
 ```nix
+{ fetchurl }:
 fetchurl {
-  url = "http://www.example.org/hello-1.0.tar.gz";
+  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
-  hash = "sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=";
+  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
-};
-```
-
-A common mistake is to update a fetcher’s URL, or a version parameter, without updating the hash.
-
-```nix
-fetchurl {
-  url = "http://www.example.org/hello-1.1.tar.gz";
-  hash = "sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=";
-};
-```
-
-**This will reuse the old contents**.
-Remember to invalidate the hash argument, in this case by setting the `hash` attribute to an empty string.
-
-```nix
-fetchurl {
-  url = "http://www.example.org/hello-1.1.tar.gz";
-  hash = "";
-};
-```
-
-Use the resulting error message to determine the correct hash.
-
-```
-error: hash mismatch in fixed-output derivation '/path/to/my.drv':
-         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-            got:    sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=
-```
-
-A similar problem arises while testing changes to a fetcher's implementation. If the output of the derivation already exists in the Nix store, test failures can go undetected. The [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function helps prevent reusing cached derivations.
-
-## `fetchurl` and `fetchzip` {#fetchurl}
-
-Two basic fetchers are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `hash`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `hash`. This hash will be used by Nix to identify your source. A typical usage of `fetchurl` is provided below.
-
-```nix
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "hello";
-  src = fetchurl {
-    url = "http://www.example.org/hello.tar.gz";
-    hash = "sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=";
-  };
 }
 ```
 
-The main difference between `fetchurl` and `fetchzip` is in how they store the contents. `fetchurl` will store the unaltered contents of the URL within the Nix store. `fetchzip` on the other hand, will decompress the archive for you, making files and directories directly accessible in the future. `fetchzip` can only be used with archives. Despite the name, `fetchzip` is not limited to .zip files and can also be used with any tarball.
+After building the package, the file will be downloaded and place into the Nix store:
 
-Additional parameters to `fetchurl`:
+```shell
-- `downloadToTemp`: Defaults to `false`. If `true`, saves the source to `$downloadedFile`, to be used in conjunction with `postFetch`
+$ nix-build
-- `postFetch`: Shell code executed after the file has been fetched successfully. Use it for postprocessing, to check or transform the file.
+(output removed for clarity)
+/nix/store/4g9y3x851wqrvim4zcz5x2v3zivmsq8n-version
+
+$ cat /nix/store/4g9y3x851wqrvim4zcz5x2v3zivmsq8n-version
+23.11
+```
+:::
+
+:::{.example #ex-fetchers-fetchurl-nixpkgs-version-multiple-urls}
+# Using `fetchurl` to download a file with multiple possible URLs
+
+The following package adapts [](#ex-fetchers-fetchurl-nixpkgs-version) to use multiple URLs.
+The first URL was crafted to intentionally return an error to illustrate how `fetchurl` will try multiple URLs until it finds one that works (or all URLs fail).
+
+```nix
+{ fetchurl }:
+fetchurl {
+  urls = [
+    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist"
+    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version"
+  ];
+  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
+}
+```
+
+After building the package, both URLs will be used to download the file:
+
+```shell
+$ nix-build
+(some output removed for clarity)
+trying https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist
+(some output removed for clarity)
+curl: (22) The requested URL returned error: 404
+
+trying https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version
+(some output removed for clarity)
+/nix/store/n9asny31z32q7sdw6a8r1gllrsfy53kl-does-not-exist
+
+$ cat /nix/store/n9asny31z32q7sdw6a8r1gllrsfy53kl-does-not-exist
+23.11
+```
+
+However, note that the name of the file was derived from the first URL (this is further explained in [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl)).
+To ensure the result will have the same name regardless of which URLs are used, we can modify the package:
+
+```nix
+{ fetchurl }:
+fetchurl {
+  name = "nixpkgs-version";
+  urls = [
+    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist"
+    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version"
+  ];
+  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
+}
+```
+
+After building the package, the result will have the name we specified:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/zczb6wl3al6jm9sm5h3pr6nqn0i5ji9z-nixpkgs-version
+```
+:::
+
+:::{.example #ex-fetchers-fetchurl-nixpkgs-version-postfetch}
+# Manipulating the content downloaded by `fetchurl`
+
+It might be useful to manipulate the content downloaded by `fetchurl` directly in its derivation.
+In this example, we'll adapt [](#ex-fetchers-fetchurl-nixpkgs-version) to append the result of running the `hello` package to the contents we download, purely to illustrate how to manipulate the content.
+
+```nix
+{ fetchurl, hello, lib }:
+fetchurl {
+  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
+
+  nativeBuildInputs = [ hello ];
+
+  downloadToTemp = true;
+  postFetch = ''
+    ${lib.getExe hello} >> $downloadedFile
+    mv $downloadedFile $out
+  '';
+
+  hash = "sha256-ceooQQYmDx5+0nfg40uU3NNI2yKrixP7HZ/xLZUNv+w=";
+}
+```
+
+After building the package, the resulting file will have "Hello, world!" appended to it:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/ifi6pp7q0ag5h7c5v9h1c1c7bhd10c7f-version
+
+$ cat /nix/store/ifi6pp7q0ag5h7c5v9h1c1c7bhd10c7f-version
+23.11
+Hello, world!
+```
+
+Note that the `hash` specified in the package is different than the hash specified in [](#ex-fetchers-fetchurl-nixpkgs-version), because the contents of the output have changed (even though the actual file that was downloaded is the same).
+See [](#chap-pkgs-fetchers-caveats) for more details on how to work with the `hash` attribute when the output changes.
+:::
+
+## `fetchzip` {#sec-pkgs-fetchers-fetchzip}
+
+Returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads an archive from a given URL and decompresses it.
+
+Despite its name, `fetchzip` is not limited to `.zip` files but can also be used with [various compressed tarball formats](#tar-files) by default.
+This can extended by specifying additional attributes, see [](#ex-fetchers-fetchzip-rar-archive) to understand how to do that.
+
+### Inputs {#sec-pkgs-fetchers-fetchzip-inputs}
+
+`fetchzip` requires an attribute set, and most attributes are passed to the underlying call to [`fetchurl`](#sec-pkgs-fetchers-fetchurl).
+
+The attributes below are treated differently by `fetchzip` when compared to what `fetchurl` expects:
+
+`name` (String; _optional_)
+: Works as defined in `fetchurl`, but has a different default value than `fetchurl`.
+
+  _Default value:_ `"source"`.
+
+`nativeBuildInputs` (List of Attribute Set; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented by `fetchzip` to include packages to deal with additional archives (such as `.zip`).
+
+  _Default value:_ `[]`.
+
+`postFetch` (String; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented with the code needed to make `fetchzip` work.
+
+  :::{.caution}
+  It is only safe to modify files in `$out` in `postFetch`.
+  Consult the implementation of `fetchzip` for anything more involved.
+  :::
+
+  _Default value:_ `""`.
+
+`stripRoot` (Boolean; _optional_)
+: If `true`, the decompressed contents are moved one level up the directory tree.
+
+  This is useful for archives that decompress into a single directory which commonly includes some values that change with time, such as version numbers.
+  When this is the case (and `stripRoot` is `true`), `fetchzip` will remove this directory and make the decompressed contents available in the top-level directory.
+
+  [](#ex-fetchers-fetchzip-simple-striproot) shows what this attribute does.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extension` (String or Null; _optional_)
+: If set, the archive downloaded by `fetchzip` will be renamed to a filename with the extension specified in this attribute.
+
+  This is useful when making `fetchzip` support additional types of archives, because the implementation may use the extension of an archive to determine whether they can decompress it.
+  If the URL you're using to download the contents doesn't end with the extension associated with the archive, use this attribute to fix the filename of the archive.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `null`.
+
+`recursiveHash` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`downloadToTemp` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extraPostFetch` **DEPRECATED**
+: This attribute is deprecated.
+  Please use `postFetch` instead.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+### Examples {#sec-pkgs-fetchers-fetchzip-examples}
+
+::::{.example #ex-fetchers-fetchzip-simple-striproot}
+# Using `fetchzip` to output contents directly
+
+The following recipe shows how to use `fetchzip` to decompress a `.tar.gz` archive:
+
+```nix
+{ fetchzip }:
+fetchzip {
+  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
+  hash = "sha256-3ABYlME9R8klcpJ7MQpyFEFwHmxDDEzIYBqu/CpDYmg=";
+}
+```
+
+This archive has all its contents in a directory named `patchelf-0.18.0`.
+This means that after decompressing, you'd have to enter this directory to see the contents of the archive.
+However, `fetchzip` makes this easier through the attribute `stripRoot` (enabled by default).
+
+After building the recipe, the derivation output will show all the files in the archive at the top level:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+
+$ ls /nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+aclocal.m4  completions  configure.ac  m4           Makefile.in  patchelf.spec     README.md  tests
+build-aux   configure    COPYING       Makefile.am  patchelf.1   patchelf.spec.in  src        version
+```
+
+If `stripRoot` is set to `false`, the derivation output will be the decompressed archive as-is:
+
+```nix
+{ fetchzip }:
+fetchzip {
+  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
+  hash = "sha256-uv3FuKE4DqpHT3yfE0qcnq0gYjDNQNKZEZt2+PUAneg=";
+  stripRoot = false;
+}
+```
+
+:::{.caution}
+The hash changed!
+Whenever changing attributes of a Nixpkgs fetcher, [remember to invalidate the hash](#chap-pkgs-fetchers-caveats), otherwise you won't get the results you're expecting!
+:::
+
+After building the recipe:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+
+$ ls /nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+patchelf-0.18.0
+```
+::::
+
+::::{.example #ex-fetchers-fetchzip-rar-archive}
+# Using `fetchzip` to decompress a `.rar` file
+
+The `unrar` package provides a [setup hook](#ssec-setup-hooks) to decompress `.rar` archives during the [unpack phase](#ssec-unpack-phase), which can be used with `fetchzip` to decompress those archives:
+
+```nix
+{ fetchzip, unrar }:
+fetchzip {
+  url = "https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar";
+  hash = "sha256-fC+zsR8BY6vXpUkVd6i1jF0IZZxVKVvNi6VWCKT+pA4=";
+  stripRoot = false;
+  nativeBuildInputs = [ unrar ];
+}
+```
+
+Since this particular `.rar` file doesn't put its contents in a directory inside the archive, `stripRoot` must be set to `false`.
+
+After building the recipe, the derivation output will show the decompressed files:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+
+$ ls /nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+FONT.DAT      PINBALL.DAT  PINBALL.EXE	PINBALL2.MID  TABLE.BMP    WMCONFIG.EXE
+MSCREATE.DIR  PINBALL.DOC  PINBALL.MID	Sounds	     WAVEMIX.INF
+```
+::::
 
 ## `fetchpatch` {#fetchpatch}
 
@@ -123,7 +716,7 @@ Here is an example of `fetchDebianPatch` in action:
 buildPythonPackage rec {
   pname = "pysimplesoap";
   version = "1.16.2";
-  src = ...;
+  src = <...>;
 
   patches = [
     (fetchDebianPatch {
@@ -134,7 +727,7 @@ buildPythonPackage rec {
     })
   ];
 
-  ...
+  # ...
 }
 ```
 
@@ -243,7 +836,7 @@ This is a useful last-resort workaround for license restrictions that prohibit r
 If the requested file is present in the Nix store, the resulting derivation will not be built, because its expected output is already available.
 Otherwise, the builder will run, but fail with a message explaining to the user how to provide the file. The following code, for example:
 
-```
+```nix
 requireFile {
   name = "jdk-${version}_linux-x64_bin.tar.gz";
   url = "https://www.oracle.com/java/technologies/javase-jdk11-downloads.html";
@@ -262,11 +855,15 @@ or
 
 ***
 ```
+
+This function should only be used by non-redistributable software with an unfree license that we need to require the user to download manually.
+It produces packages that cannot be built automatically.
+
 ## `fetchtorrent` {#fetchtorrent}
 
 `fetchtorrent` expects two arguments. `url` which can either be a Magnet URI (Magnet Link) such as `magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c` or an HTTP URL pointing to a `.torrent` file. It can also take a `config` argument which will craft a `settings.json` configuration file and give it to `transmission`, the underlying program that is performing the fetch. The available config options for `transmission` can be found [here](https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md#options)
 
-```
+```nix
 { fetchtorrent }:
 
 fetchtorrent {

third_party/nixpkgs/doc/build-helpers/images.md

@@ -6,7 +6,6 @@ This chapter describes tools for creating various types of images.
 images/appimagetools.section.md
 images/dockertools.section.md
 images/ocitools.section.md
-images/snaptools.section.md
 images/portableservice.section.md
 images/makediskimage.section.md
 images/binarycache.section.md

third_party/nixpkgs/doc/build-helpers/images/dockertools.section.md

@@ -1177,6 +1177,7 @@ dockerTools.buildImage {
     hello
     dockerTools.binSh
   ];
+}
 ```
 
 After building the image and loading it in Docker, we can create a container based on it and enter a shell inside the container.

third_party/nixpkgs/doc/build-helpers/images/snaptools.section.md

@@ -1,71 +0,0 @@
-# pkgs.snapTools {#sec-pkgs-snapTools}
-
-`pkgs.snapTools` is a set of functions for creating Snapcraft images. Snap and Snapcraft is not used to perform these operations.
-
-## The makeSnap Function {#ssec-pkgs-snapTools-makeSnap-signature}
-
-`makeSnap` takes a single named argument, `meta`. This argument mirrors [the upstream `snap.yaml` format](https://docs.snapcraft.io/snap-format) exactly.
-
-The `base` should not be specified, as `makeSnap` will force set it.
-
-Currently, `makeSnap` does not support creating GUI stubs.
-
-## Build a Hello World Snap {#ssec-pkgs-snapTools-build-a-snap-hello}
-
-The following expression packages GNU Hello as a Snapcraft snap.
-
-``` {#ex-snapTools-buildSnap-hello .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools hello;
-in snapTools.makeSnap {
-  meta = {
-    name = "hello";
-    summary = hello.meta.description;
-    description = hello.meta.longDescription;
-    architectures = [ "amd64" ];
-    confinement = "strict";
-    apps.hello.command = "${hello}/bin/hello";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `hello` will now be the Snapcraft version of the package.
-
-## Build a Graphical Snap {#ssec-pkgs-snapTools-build-a-snap-firefox}
-
-Graphical programs require many more integrations with the host. This example uses Firefox as an example because it is one of the most complicated programs we could package.
-
-``` {#ex-snapTools-buildSnap-firefox .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools firefox;
-in snapTools.makeSnap {
-  meta = {
-    name = "nix-example-firefox";
-    summary = firefox.meta.description;
-    architectures = [ "amd64" ];
-    apps.nix-example-firefox = {
-      command = "${firefox}/bin/firefox";
-      plugs = [
-        "pulseaudio"
-        "camera"
-        "browser-support"
-        "avahi-observe"
-        "cups-control"
-        "desktop"
-        "desktop-legacy"
-        "gsettings"
-        "home"
-        "network"
-        "mount-observe"
-        "removable-media"
-        "x11"
-      ];
-    };
-    confinement = "strict";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `nix-example-firefox` will now be the Snapcraft version of the Firefox package.
-
-The specific meaning behind plugs can be looked up in the [Snapcraft interface documentation](https://docs.snapcraft.io/supported-interfaces).

third_party/nixpkgs/doc/build-helpers/special/checkpoint-build.section.md

@@ -9,13 +9,17 @@ However, we can tell Nix explicitly what the previous build state was, by repres
 To change a normal derivation to a checkpoint based build, these steps must be taken:
   - apply `prepareCheckpointBuild` on the desired derivation, e.g.
 ```nix
-checkpointArtifacts = (pkgs.checkpointBuildTools.prepareCheckpointBuild pkgs.virtualbox);
+{
+  checkpointArtifacts = (pkgs.checkpointBuildTools.prepareCheckpointBuild pkgs.virtualbox);
+}
 ```
   - change something you want in the sources of the package, e.g. use a source override:
 ```nix
-changedVBox = pkgs.virtualbox.overrideAttrs (old: {
+{
-  src = path/to/vbox/sources;
+  changedVBox = pkgs.virtualbox.overrideAttrs (old: {
-});
+    src = path/to/vbox/sources;
+  });
+}
 ```
   - use `mkCheckpointBuild changedVBox checkpointArtifacts`
   - enjoy shorter build times

third_party/nixpkgs/doc/build-helpers/testers.chapter.md

@@ -14,11 +14,13 @@ If the `moduleNames` argument is omitted, `hasPkgConfigModules` will use `meta.p
 # Check that `pkg-config` modules are exposed using default values
 
 ```nix
-passthru.tests.pkg-config = testers.hasPkgConfigModules {
+{
-  package = finalAttrs.finalPackage;
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
-};
+    package = finalAttrs.finalPackage;
+  };
 
-meta.pkgConfigModules = [ "libfoo" ];
+  meta.pkgConfigModules = [ "libfoo" ];
+}
 ```
 
 :::
@@ -28,10 +30,12 @@ meta.pkgConfigModules = [ "libfoo" ];
 # Check that `pkg-config` modules are exposed using explicit module names
 
 ```nix
-passthru.tests.pkg-config = testers.hasPkgConfigModules {
+{
-  package = finalAttrs.finalPackage;
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
-  moduleNames = [ "libfoo" ];
+    package = finalAttrs.finalPackage;
-};
+    moduleNames = [ "libfoo" ];
+  };
+}
 ```
 
 :::
@@ -55,7 +59,9 @@ The default argument to the command is `--version`, and the version to be checke
 This example will run the command `hello --version`, and then check that the version of the `hello` package is in the output of the command.
 
 ```nix
-passthru.tests.version = testers.testVersion { package = hello; };
+{
+  passthru.tests.version = testers.testVersion { package = hello; };
+}
 ```
 
 :::
@@ -70,13 +76,15 @@ This means that an output like "leetcode 0.4.21" would fail the tests, and an ou
 A common usage of the `version` attribute is to specify `version = "v${version}"`.
 
 ```nix
-version = "0.4.2";
+{
+  version = "0.4.2";
 
-passthru.tests.version = testers.testVersion {
+  passthru.tests.version = testers.testVersion {
-  package = leetcode-cli;
+    package = leetcode-cli;
-  command = "leetcode -V";
+    command = "leetcode -V";
-  version = "leetcode ${version}";
+    version = "leetcode ${version}";
-};
+  };
+}
 ```
 
 :::
@@ -116,7 +124,7 @@ runCommand "example" {
   grep -F 'failing though' $failed/testBuildFailure.log
   [[ 3 = $(cat $failed/testBuildFailure.exit) ]]
   touch $out
-'';
+''
 ```
 
 :::
@@ -193,12 +201,14 @@ once to get a derivation hash, and again to produce the final fixed output deriv
 # Prevent nix from reusing the output of a fetcher
 
 ```nix
-tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
+{
-  name = "nix-source";
+  tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
-  url = "https://github.com/NixOS/nix";
+    name = "nix-source";
-  rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    url = "https://github.com/NixOS/nix";
-  hash = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
-};
+    hash = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+  };
+}
 ```
 
 :::

third_party/nixpkgs/doc/build-helpers/trivial-build-helpers.chapter.md

@@ -7,7 +7,9 @@ Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers cre
 
 `runCommand :: String -> AttrSet -> String -> Derivation`
 
-`runCommand name drvAttrs buildCommand` returns a derivation that is built by running the specified shell commands.
+The result of `runCommand name drvAttrs buildCommand` is a derivation that is built by running the specified shell commands.
+
+By default `runCommand` runs in a stdenv with no compiler environment, whereas [`runCommandCC`](#trivial-builder-runCommandCC) uses the default stdenv, `pkgs.stdenv`.
 
 `name :: String`
 :   The name that Nix will append to the store path in the same way that `stdenv.mkDerivation` uses its `name` attribute.
@@ -74,12 +76,14 @@ If you need to refer to the resulting files somewhere else in a Nix expression,
 For example, if the file destination is a directory:
 
 ```nix
-my-file = writeTextFile {
+{
-  name = "my-file";
+  my-file = writeTextFile {
-  text = ''
+    name = "my-file";
-    Contents of File
+    text = ''
-  '';
+      Contents of File
-  destination = "/share/my-file";
+    '';
+    destination = "/share/my-file";
+  };
 }
 ```
 
@@ -88,10 +92,111 @@ Remember to append "/share/my-file" to the resulting store path when using it el
 ```nix
 writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
-'';
+''
 ```
 ::::
 
+### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
+
+Write an [XDG desktop file](https://specifications.freedesktop.org/desktop-entry-spec/1.4/) to the Nix store.
+
+This function is usually used to add desktop items to a package through the `copyDesktopItems` hook.
+
+`makeDesktopItem` adheres to version 1.4 of the specification.
+
+#### Inputs {#trivial-builder-makeDesktopItem-inputs}
+
+`makeDesktopItem` takes an attribute set that accepts most values from the [XDG specification](https://specifications.freedesktop.org/desktop-entry-spec/1.4/ar01s06.html).
+
+All recognised keys from the specification are supported with the exception of the "Hidden" field. The keys are converted into camelCase format, but correspond 1:1 to their equivalent in the specification: `genericName`, `noDisplay`, `comment`, `icon`, `onlyShowIn`, `notShowIn`, `dbusActivatable`, `tryExec`, `exec`, `path`, `terminal`, `mimeTypes`, `categories`, `implements`, `keywords`, `startupNotify`, `startupWMClass`, `url`, `prefersNonDefaultGPU`.
+
+The "Version" field is hardcoded to the version `makeDesktopItem` currently adheres to.
+
+The following fields are either required, are of a different type than in the specification, carry specific default values, or are additional fields supported by `makeDesktopItem`:
+
+`name` (String)
+
+: The name of the desktop file in the Nix store.
+
+`type` (String; _optional_)
+
+: Default value: `"Application"`
+
+`desktopName` (String)
+
+: Corresponds to the "Name" field of the specification.
+
+`actions` (List of Attribute set; _optional_)
+
+: A list of attribute sets {name, exec?, icon?}
+
+`extraConfig` (Attribute set; _optional_)
+
+: Additional key/value pairs to be added verbatim to the desktop file. Attributes need to be prefixed with 'X-'.
+
+#### Examples {#trivial-builder-makeDesktopItem-examples}
+
+::: {.example #ex-makeDesktopItem}
+# Usage 1 of `makeDesktopItem`
+
+Write a desktop file `/nix/store/<store path>/my-program.desktop` to the Nix store.
+
+```nix
+{makeDesktopItem}:
+makeDesktopItem {
+  name = "my-program";
+  desktopName = "My Program";
+  genericName = "Video Player";
+  noDisplay = false;
+  comment = "Cool video player";
+  icon = "/path/to/icon";
+  onlyShowIn = [ "KDE" ];
+  dbusActivatable = true;
+  tryExec = "my-program";
+  exec = "my-program --someflag";
+  path = "/some/working/path";
+  terminal = false;
+  actions.example = {
+    name = "New Window";
+    exec = "my-program --new-window";
+    icon = "/some/icon";
+  };
+  mimeTypes = [ "video/mp4" ];
+  categories = [ "Utility" ];
+  implements = [ "org.my-program" ];
+  keywords = [ "Video" "Player" ];
+  startupNotify = false;
+  startupWMClass = "MyProgram";
+  prefersNonDefaultGPU = false;
+  extraConfig.X-SomeExtension = "somevalue";
+}
+```
+
+:::
+
+::: {.example #ex2-makeDesktopItem}
+# Usage 2 of `makeDesktopItem`
+
+Override the `hello` package to add a desktop item.
+
+```nix
+{ copyDesktopItems
+, hello
+, makeDesktopItem }:
+
+hello.overrideAttrs {
+  nativeBuildInputs = [ copyDesktopItems ];
+
+  desktopItems = [(makeDesktopItem {
+    name = "hello";
+    desktopName = "Hello";
+    exec = "hello";
+  })];
+}
+```
+
+:::
+
 ### `writeTextFile` {#trivial-builder-writeTextFile}
 
 Write a text file to the Nix store.
@@ -153,6 +258,12 @@ Write a text file to the Nix store.
 
   Default: `true`
 
+`derivationArgs` (Attribute set, _optional_)
+
+: Extra arguments to pass to the underlying call to `stdenv.mkDerivation`.
+
+  Default: `{}`
+
 The resulting store path will include some variation of the name, and it will be a file unless `destination` is used, in which case it will be a directory.
 
 ::: {.example #ex-writeTextFile}
@@ -178,7 +289,7 @@ writeTextFile {
   };
   allowSubstitutes = true;
   preferLocalBuild = false;
-};
+}
 ```
 :::
 
@@ -242,7 +353,7 @@ Write the string `Contents of File` to `/nix/store/<store path>`:
 writeText "my-file"
   ''
   Contents of File
-  '';
+  ''
 ```
 :::
 
@@ -282,7 +393,7 @@ Write the string `Contents of File` to `/nix/store/<store path>/share/my-file`:
 writeTextDir "share/my-file"
   ''
   Contents of File
-  '';
+  ''
 ```
 :::
 
@@ -324,7 +435,7 @@ Write the string `Contents of File` to `/nix/store/<store path>` and make the fi
 writeScript "my-file"
   ''
   Contents of File
-  '';
+  ''
 ```
 :::
 
@@ -366,7 +477,7 @@ The store path will include the the name, and it will be a directory.
 writeScriptBin "my-script"
   ''
   echo "hi"
-  '';
+  ''
 ```
 :::
 
@@ -379,7 +490,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 
@@ -410,7 +521,7 @@ This function is almost exactly like [](#trivial-builder-writeScript), except th
 writeShellScript "my-script"
   ''
   echo "hi"
-  '';
+  ''
 ```
 :::
 
@@ -453,7 +564,7 @@ This function is a combination of [](#trivial-builder-writeShellScript) and [](#
 writeShellScriptBin "my-script"
   ''
   echo "hi"
-  '';
+  ''
 ```
 :::
 
@@ -467,7 +578,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 
@@ -549,19 +660,23 @@ This creates a derivation with a directory structure like the following:
 
 ## `writeReferencesToFile` {#trivial-builder-writeReferencesToFile}
 
-Writes the closure of transitive dependencies to a file.
+Deprecated. Use [`writeClosure`](#trivial-builder-writeClosure) instead.
 
-This produces the equivalent of `nix-store -q --requisites`.
+## `writeClosure` {#trivial-builder-writeClosure}
+
+Given a list of [store paths](https://nixos.org/manual/nix/stable/glossary#gloss-store-path) (or string-like expressions coercible to store paths), write their collective [closure](https://nixos.org/manual/nix/stable/glossary#gloss-closure) to a text file.
+
+The result is equivalent to the output of `nix-store -q --requisites`.
 
 For example,
 
 ```nix
-writeReferencesToFile (writeScriptBin "hi" ''${hello}/bin/hello'')
+writeClosure [ (writeScriptBin "hi" ''${hello}/bin/hello'') ]
 ```
 
 produces an output path `/nix/store/<hash>-runtime-deps` containing
 
-```nix
+```
 /nix/store/<hash>-hello-2.10
 /nix/store/<hash>-hi
 /nix/store/<hash>-libidn2-2.3.0
@@ -587,7 +702,7 @@ writeDirectReferencesToFile (writeScriptBin "hi" ''${hello}/bin/hello'')
 
 produces an output path `/nix/store/<hash>-runtime-references` containing
 
-```nix
+```
 /nix/store/<hash>-hello-2.10
 ```
 

third_party/nixpkgs/doc/default.nix

@@ -122,16 +122,17 @@ in pkgs.stdenv.mkDerivation {
       ${pkgs.documentation-highlighter}/mono-blue.css \
       ${pkgs.documentation-highlighter}/loader.js
 
-    cp -t out ./overrides.css ./style.css
+    cp -t out ./style.css ./anchor.min.js ./anchor-use.js
 
     nixos-render-docs manual html \
       --manpage-urls ./manpage-urls.json \
       --revision ${pkgs.lib.trivial.revisionWithDefault (pkgs.rev or "master")} \
       --stylesheet style.css \
-      --stylesheet overrides.css \
       --stylesheet highlightjs/mono-blue.css \
       --script ./highlightjs/highlight.pack.js \
       --script ./highlightjs/loader.js \
+      --script ./anchor.min.js \
+      --script ./anchor-use.js \
       --toc-depth 1 \
       --section-toc-depth 1 \
       manual.md \

third_party/nixpkgs/doc/functions/generators.section.md

@@ -6,8 +6,9 @@ All generators follow a similar call interface: `generatorName configFunctions d
 Generators can be fine-tuned to produce exactly the file format required by your application/service. One example is an INI-file format which uses `: ` as separator, the strings `"yes"`/`"no"` as boolean values and requires all string values to be quoted:
 
 ```nix
-with lib;
 let
+  inherit (lib) generators isString;
+
   customToINI = generators.toINI {
     # specifies how to format a key/value pair
     mkKeyValue = generators.mkKeyValueDefault {

third_party/nixpkgs/doc/functions/nix-gitignore.section.md

@@ -7,27 +7,30 @@
 `pkgs.nix-gitignore` exports a number of functions, but you'll most likely need either `gitignoreSource` or `gitignoreSourcePure`. As their first argument, they both accept either 1. a file with gitignore lines or 2. a string with gitignore lines, or 3. a list of either of the two. They will be concatenated into a single big string.
 
 ```nix
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? import <nixpkgs> {} }: {
 
- nix-gitignore.gitignoreSource [] ./source
+ src = nix-gitignore.gitignoreSource [] ./source;
      # Simplest version
 
- nix-gitignore.gitignoreSource "supplemental-ignores\n" ./source
+ src = nix-gitignore.gitignoreSource "supplemental-ignores\n" ./source;
      # This one reads the ./source/.gitignore and concats the auxiliary ignores
 
- nix-gitignore.gitignoreSourcePure "ignore-this\nignore-that\n" ./source
+ src = nix-gitignore.gitignoreSourcePure "ignore-this\nignore-that\n" ./source;
      # Use this string as gitignore, don't read ./source/.gitignore.
 
- nix-gitignore.gitignoreSourcePure ["ignore-this\nignore-that\n", ~/.gitignore] ./source
+ src = nix-gitignore.gitignoreSourcePure ["ignore-this\nignore-that\n" ~/.gitignore] ./source;
      # It also accepts a list (of strings and paths) that will be concatenated
      # once the paths are turned to strings via readFile.
+}
 ```
 
 These functions are derived from the `Filter` functions by setting the first filter argument to `(_: _: true)`:
 
 ```nix
-gitignoreSourcePure = gitignoreFilterSourcePure (_: _: true);
+{
-gitignoreSource = gitignoreFilterSource (_: _: true);
+  gitignoreSourcePure = gitignoreFilterSourcePure (_: _: true);
+  gitignoreSource = gitignoreFilterSource (_: _: true);
+}
 ```
 
 Those filter functions accept the same arguments the `builtins.filterSource` function would pass to its filters, thus `fn: gitignoreFilterSourcePure fn ""` should be extensionally equivalent to `filterSource`. The file is blacklisted if it's blacklisted by either your filter or the gitignoreFilter.
@@ -35,7 +38,9 @@ Those filter functions accept the same arguments the `builtins.filterSource` fun
 If you want to make your own filter from scratch, you may use
 
 ```nix
-gitignoreFilter = ign: root: filterPattern (gitignoreToPatterns ign) root;
+{
+  gitignoreFilter = ign: root: filterPattern (gitignoreToPatterns ign) root;
+}
 ```
 
 ## gitignore files in subdirectories {#sec-pkgs-nix-gitignore-usage-recursive}
@@ -43,7 +48,9 @@ gitignoreFilter = ign: root: filterPattern (gitignoreToPatterns ign) root;
 If you wish to use a filter that would search for .gitignore files in subdirectories, just like git does by default, use this function:
 
 ```nix
-gitignoreFilterRecursiveSource = filter: patterns: root:
+{
-# OR
+  # gitignoreFilterRecursiveSource = filter: patterns: root:
-gitignoreRecursiveSource = gitignoreFilterSourcePure (_: _: true);
+  # OR
+  gitignoreRecursiveSource = gitignoreFilterSourcePure (_: _: true);
+}
 ```

third_party/nixpkgs/doc/hooks/breakpoint.section.md

@@ -3,7 +3,9 @@
 This hook will make a build pause instead of stopping when a failure happens. It prevents nix from cleaning up the build environment immediately and allows the user to attach to a build environment using the `cntr` command. Upon build error it will print instructions on how to use `cntr`, which can be used to enter the environment for debugging. Installing cntr and running the command will provide shell access to the build sandbox of failed build. At `/var/lib/cntr` the sandboxed filesystem is mounted. All commands and files of the system are still accessible within the shell. To execute commands from the sandbox use the cntr exec subcommand. `cntr` is only supported on Linux-based platforms. To use it first add `cntr` to your `environment.systemPackages` on NixOS or alternatively to the root user on non-NixOS systems. Then in the package that is supposed to be inspected, add `breakpointHook` to `nativeBuildInputs`.
 
 ```nix
-nativeBuildInputs = [ breakpointHook ];
+{
+  nativeBuildInputs = [ breakpointHook ];
+}
 ```
 
 When a build failure happens there will be an instruction printed that shows how to attach with `cntr` to the build sandbox.

third_party/nixpkgs/doc/hooks/installShellFiles.section.md

@@ -7,19 +7,21 @@ The `installManPage` function takes one or more paths to manpages to install. Th
 The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh). The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided.
 
 ```nix
-nativeBuildInputs = [ installShellFiles ];
+{
-postInstall = ''
+  nativeBuildInputs = [ installShellFiles ];
-  installManPage doc/foobar.1 doc/barfoo.3
+  postInstall = ''
-  # explicit behavior
+    installManPage doc/foobar.1 doc/barfoo.3
-  installShellCompletion --bash --name foobar.bash share/completions.bash
+    # explicit behavior
-  installShellCompletion --fish --name foobar.fish share/completions.fish
+    installShellCompletion --bash --name foobar.bash share/completions.bash
-  installShellCompletion --zsh --name _foobar share/completions.zsh
+    installShellCompletion --fish --name foobar.fish share/completions.fish
-  # implicit behavior
+    installShellCompletion --zsh --name _foobar share/completions.zsh
-  installShellCompletion share/completions/foobar.{bash,fish,zsh}
+    # implicit behavior
-  # using named fd
+    installShellCompletion share/completions/foobar.{bash,fish,zsh}
-  installShellCompletion --cmd foobar \
+    # using named fd
-    --bash <($out/bin/foobar --bash-completion) \
+    installShellCompletion --cmd foobar \
-    --fish <($out/bin/foobar --fish-completion) \
+      --bash <($out/bin/foobar --bash-completion) \
-    --zsh <($out/bin/foobar --zsh-completion)
+      --fish <($out/bin/foobar --fish-completion) \
-'';
+      --zsh <($out/bin/foobar --zsh-completion)
+  '';
+}
 ```

third_party/nixpkgs/doc/hooks/mpi-check-hook.section.md

@@ -12,13 +12,14 @@ Example:
 
 ```nix
   { mpiCheckPhaseHook, mpi, ... }:
+  {
+    # ...
 
-  ...
+    nativeCheckInputs = [
-
+      openssh
-  nativeCheckInputs = [
+      mpiCheckPhaseHook
-    openssh
+    ];
-    mpiCheckPhaseHook
+  }
-  ];
 ```
 
 

third_party/nixpkgs/doc/languages-frameworks/agda.section.md

@@ -114,7 +114,7 @@ This can be overridden by a different version of `ghc` as follows:
 
 ```nix
 agda.withPackages {
-  pkgs = [ ... ];
+  pkgs = [ /* ... */ ];
   ghc = haskell.compiler.ghcHEAD;
 }
 ```
@@ -180,6 +180,7 @@ To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/d
 
 ```nix
 { mkDerivation, standard-library, fetchFromGitHub }:
+{}
 ```
 
 Note that the derivation function is called with `mkDerivation` set to `agdaPackages.mkDerivation`, therefore you
@@ -193,7 +194,7 @@ mkDerivation {
   version = "1.5.0";
   pname = "iowa-stdlib";
 
-  src = ...
+  src = <...>;
 
   libraryFile = "";
   libraryName = "IAL-1.3";

third_party/nixpkgs/doc/languages-frameworks/android.section.md

@@ -104,18 +104,20 @@ pull from:
   repo.json to the Nix store based on the given repository XMLs.
 
 ```nix
-repoXmls = {
+{
-  packages = [ ./xml/repository2-1.xml ];
+  repoXmls = {
-  images = [
+    packages = [ ./xml/repository2-1.xml ];
-    ./xml/android-sys-img2-1.xml
+    images = [
-    ./xml/android-tv-sys-img2-1.xml
+      ./xml/android-sys-img2-1.xml
-    ./xml/android-wear-sys-img2-1.xml
+      ./xml/android-tv-sys-img2-1.xml
-    ./xml/android-wear-cn-sys-img2-1.xml
+      ./xml/android-wear-sys-img2-1.xml
-    ./xml/google_apis-sys-img2-1.xml
+      ./xml/android-wear-cn-sys-img2-1.xml
-    ./xml/google_apis_playstore-sys-img2-1.xml
+      ./xml/google_apis-sys-img2-1.xml
-  ];
+      ./xml/google_apis_playstore-sys-img2-1.xml
-  addons = [ ./xml/addon2-1.xml ];
+    ];
-};
+    addons = [ ./xml/addon2-1.xml ];
+  };
+}
 ```
 
 When building the above expression with:

third_party/nixpkgs/doc/languages-frameworks/beam.section.md

@@ -117,6 +117,7 @@ If there are git dependencies.
 - From the mix_deps.nix file, remove the dependencies that had git versions and pass them as an override to the import function.
 
 ```nix
+{
   mixNixDeps = import ./mix.nix {
     inherit beamPackages lib;
     overrides = (final: prev: {
@@ -138,8 +139,9 @@ If there are git dependencies.
         # you can re-use the same beamDeps argument as generated
         beamDeps = with final; [ prometheus ];
       };
-  });
+    });
-};
+  };
+}
 ```
 
 You will need to run the build process once to fix the hash to correspond to your new git src.
@@ -153,11 +155,13 @@ Practical steps
 - start with the following argument to mixRelease
 
 ```nix
+{
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
     hash = lib.fakeHash;
   };
+}
 ```
 
 The first build will complain about the hash value, you can replace with the suggested value after that.

third_party/nixpkgs/doc/languages-frameworks/bower.section.md

@@ -28,7 +28,7 @@ buildEnv { name = "bower-env"; ignoreCollisions = true; paths = [
   (fetchbower "angular" "1.5.3" "~1.5.0" "1749xb0firxdra4rzadm4q9x90v6pzkbd7xmcyjk6qfza09ykk9y")
   (fetchbower "bootstrap" "3.3.6" "~3.3.6" "1vvqlpbfcy0k5pncfjaiskj3y6scwifxygfqnw393sjfxiviwmbv")
   (fetchbower "jquery" "2.2.2" "1.9.1 - 2" "10sp5h98sqwk90y4k6hbdviwqzvzwqf47r3r51pakch5ii2y7js1")
-];
+]; }
 ```
 
 Using the `bower2nix` command line arguments, the output can be redirected to a file. A name like `bower-packages.nix` would be fine.
@@ -42,11 +42,13 @@ The function is implemented in [pkgs/development/bower-modules/generic/default.n
 ### Example buildBowerComponents {#ex-buildBowerComponents}
 
 ```nix
-bowerComponents = buildBowerComponents {
+{
-  name = "my-web-app";
+  bowerComponents = buildBowerComponents {
-  generated = ./bower-packages.nix; # note 1
+    name = "my-web-app";
-  src = myWebApp; # note 2
+    generated = ./bower-packages.nix; # note 1
-};
+    src = myWebApp; # note 2
+  };
+}
 ```
 
 In ["buildBowerComponents" example](#ex-buildBowerComponents) the following arguments are of special significance to the function:

third_party/nixpkgs/doc/languages-frameworks/chicken.section.md

@@ -13,10 +13,12 @@ done in the typical Nix fashion. For example, to include support for [SRFI
 might write:
 
 ```nix
+{
   buildInputs = [
     chicken
     chickenPackages.chickenEggs.srfi-189
   ];
+}
 ```
 
 Both `chicken` and its eggs have a setup hook which configures the environment
@@ -67,12 +69,12 @@ let
       chickenEggs = super.chickenEggs.overrideScope' (eggself: eggsuper: {
         srfi-180 = eggsuper.srfi-180.overrideAttrs {
           # path to a local copy of srfi-180
-          src = ...
+          src = <...>;
         };
       });
   });
 in
 # Here, `myChickenPackages.chickenEggs.json-rpc`, which depends on `srfi-180` will use
 # the local copy of `srfi-180`.
-# ...
+<...>
 ```

third_party/nixpkgs/doc/languages-frameworks/coq.section.md

@@ -55,17 +55,18 @@ Here is a simple package example. It is a pure Coq library, thus it depends on C
 ```nix
 { lib, mkCoqDerivation, version ? null
 , coq, mathcomp, mathcomp-finmap, mathcomp-bigenough }:
-with lib; mkCoqDerivation {
+
+mkCoqDerivation {
   /* namePrefix leads to e.g. `name = coq8.11-mathcomp1.11-multinomials-1.5.2` */
   namePrefix = [ "coq" "mathcomp" ];
   pname = "multinomials";
   owner = "math-comp";
   inherit version;
-  defaultVersion =  with versions; switch [ coq.version mathcomp.version ] [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (range "8.7" "8.12")  "1.11.0" ];             out = "1.5.2"; }
+      { cases = [ (range "8.7" "8.12") (isEq "1.11") ];        out = "1.5.2"; }
-      { cases = [ (range "8.7" "8.11")  (range "1.8" "1.10") ]; out = "1.5.0"; }
+      { cases = [ (range "8.7" "8.11") (range "1.8" "1.10") ]; out = "1.5.0"; }
-      { cases = [ (range "8.7" "8.10")  (range "1.8" "1.10") ]; out = "1.4"; }
+      { cases = [ (range "8.7" "8.10") (range "1.8" "1.10") ]; out = "1.4"; }
-      { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
+      { cases = [ (isEq "8.6")         (range "1.6" "1.7") ];  out = "1.1"; }
     ] null;
   release = {
     "1.5.2".sha256 = "15aspf3jfykp1xgsxf8knqkxv8aav2p39c2fyirw7pwsfbsv2c4s";
@@ -84,7 +85,7 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
-    license = licenses.cecill-c;
+    license = lib.licenses.cecill-c;
   };
 }
 ```

third_party/nixpkgs/doc/languages-frameworks/crystal.section.md

@@ -33,22 +33,26 @@ crystal.buildCrystalPackage rec {
   # Insert the path to your shards.nix file here
   shardsFile = ./shards.nix;
 
-  ...
+  # ...
 }
 ```
 
 This won't build anything yet, because we haven't told it what files build. We can specify a mapping from binary names to source files with the `crystalBinaries` attribute. The project's compilation instructions should show this. For Mint, the binary is called "mint", which is compiled from the source file `src/mint.cr`, so we'll specify this as follows:
 
 ```nix
+{
   crystalBinaries.mint.src = "src/mint.cr";
 
   # ...
+}
 ```
 
 Additionally you can override the default `crystal build` options (which are currently `--release --progress --no-debug --verbose`) with
 
 ```nix
+{
   crystalBinaries.mint.options = [ "--release" "--verbose" ];
+}
 ```
 
 Depending on the project, you might need additional steps to get it to compile successfully. In Mint's case, we need to link against openssl, so in the end the Nix file looks as follows:

third_party/nixpkgs/doc/languages-frameworks/cuda.section.md

@@ -16,24 +16,28 @@ To use one or more CUDA packages in an expression, give the expression a `cudaPa
 , cudaSupport ? config.cudaSupport
 , cudaPackages ? { }
 , ...
-}:
+}: {}
 ```
 
 When using `callPackage`, you can choose to pass in a different variant, e.g.
 when a different version of the toolkit suffices
 ```nix
-mypkg = callPackage { cudaPackages = cudaPackages_11_5; }
+{
+  mypkg = callPackage { cudaPackages = cudaPackages_11_5; };
+}
 ```
 
 If another version of say `cudnn` or `cutensor` is needed, you can override the
 package set to make it the default. This guarantees you get a consistent package
 set.
 ```nix
-mypkg = let
+{
-  cudaPackages = cudaPackages_11_5.overrideScope (final: prev: {
+  mypkg = let
-    cudnn = prev.cudnn_8_3;
+    cudaPackages = cudaPackages_11_5.overrideScope (final: prev: {
-  }});
+      cudnn = prev.cudnn_8_3;
-in callPackage { inherit cudaPackages; };
+    });
+  in callPackage { inherit cudaPackages; };
+}
 ```
 
 The CUDA NVCC compiler requires flags to determine which hardware you
@@ -144,4 +148,4 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
 | Find libraries | `configurePhase` | Missing dependency on a `dev` output | Add the missing dependency | The `dev` output typically contain CMake configuration files |
 | Find libraries | `buildPhase` or `patchelf` | Missing dependency on a `lib` or `static` output | Add the missing dependency | The `lib` or `static` output typically contain the libraries |
 
-In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`cudaPackages.autoAddOpenGLRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.autoAddOpenGLRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.
+In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`cudaPackages.autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.autoAddDriverRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.

third_party/nixpkgs/doc/languages-frameworks/cuelang.section.md

@@ -26,7 +26,7 @@ Cuelang schemas are similar to JSON, here is a quick cheatsheet:
 Nixpkgs provides a `pkgs.writeCueValidator` helper, which will write a validation script based on the provided Cuelang schema.
 
 Here is an example:
-```
+```nix
 pkgs.writeCueValidator
   (pkgs.writeText "schema.cue" ''
     #Def1: {
@@ -42,7 +42,7 @@ pkgs.writeCueValidator
 `document` : match your input data against this fragment of structure or definition, e.g. you may use the same schema file but different documents based on the data you are validating.
 
 Another example, given the following `validator.nix` :
-```
+```nix
 { pkgs ? import <nixpkgs> {} }:
 let
   genericValidator = version:

third_party/nixpkgs/doc/languages-frameworks/dhall.section.md

@@ -187,6 +187,7 @@ wish to specify `source = true` for all Dhall packages, then you can amend the
 Dhall overlay like this:
 
 ```nix
+{
   dhallOverrides = self: super: {
     # Enable source for all Dhall packages
     buildDhallPackage =
@@ -194,6 +195,7 @@ Dhall overlay like this:
 
     true = self.callPackage ./true.nix { };
   };
+}
 ```
 
 … and now the Prelude will contain the fully decoded result of interpreting
@@ -429,22 +431,26 @@ $ dhall-to-nixpkgs github https://github.com/dhall-lang/dhall-lang.git \
 the Prelude globally for all packages, like this:
 
 ```nix
+{
   dhallOverrides = self: super: {
     true = self.callPackage ./true.nix { };
 
     Prelude = self.callPackage ./Prelude.nix { };
   };
+}
 ```
 
 … or selectively overriding the Prelude dependency for just the `true` package,
 like this:
 
 ```nix
+{
   dhallOverrides = self: super: {
     true = self.callPackage ./true.nix {
       Prelude = self.callPackage ./Prelude.nix { };
     };
   };
+}
 ```
 
 ## Overrides {#ssec-dhall-overrides}
@@ -454,11 +460,13 @@ You can override any of the arguments to `buildDhallGitHubPackage` or
 For example, suppose we wanted to selectively enable `source = true` just for the Prelude.  We can do that like this:
 
 ```nix
+{
   dhallOverrides = self: super: {
     Prelude = super.Prelude.overridePackage { source = true; };
 
-    …
+    # ...
   };
+}
 ```
 
 [semantic-integrity-checks]: https://docs.dhall-lang.org/tutorials/Language-Tour.html#installing-packages

third_party/nixpkgs/doc/languages-frameworks/dlang.section.md

@@ -0,0 +1,69 @@
+# D (Dlang) {#dlang}
+
+Nixpkgs provides multiple D compilers such as `ldc`, `dmd` and `gdc`.
+These can be used like any other package during build time.
+
+However, Nixpkgs provides a build helper for compiling packages using the `dub` package manager.
+
+Here's an example:
+```nix
+{
+  lib,
+  buildDubPackage,
+  fetchFromGitHub,
+  ncurses,
+  zlib,
+}:
+
+buildDubPackage rec {
+  pname = "btdu";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "CyberShadow";
+    repo = "btdu";
+    rev = "v${version}";
+    hash = "sha256-3sSZq+5UJH02IO0Y1yL3BLHDb4lk8k6awb5ZysBQciE=";
+  };
+
+  # generated by dub-to-nix, see below
+  dubLock = ./dub-lock.json;
+
+  buildInputs = [
+    ncurses
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 btdu -t $out/bin
+    runHook postInstall
+  '';
+}
+```
+
+Note that you need to define `installPhase` because `dub` doesn't know where files should go in `$out`.
+
+Also note that running `dub test` is disabled by default. You can enable it by setting `doCheck = true`.
+
+## Lockfiles {#dub-lockfiles}
+Nixpkgs has its own lockfile format for `dub` dependencies, because `dub`'s official "lockfile" format (`dub.selections.json`) is not hash based.
+
+A lockfile can be generated using the `dub-to-nix` helper package.
+* Firstly, install `dub-to-nix` into your shell session by running `nix-shell -p dub-to-nix`
+* Then navigate to the root of the source of the program you want to package
+* Finally, run `dub-to-nix` and it will print the lockfile to stdout. You could pipe stdout into a text file or just copy the output manually into a file.
+
+## `buildDubPackage` parameters {#builddubpackage-parameters}
+
+The `buildDubPackage` function takes an attrset of parameters that are passed on to `stdenv.mkDerivation`.
+
+The following parameters are specific to `buildDubPackage`:
+
+* `dubLock`: A lockfile generated by `dub-to-nix` from the source of the package. Can be either a path to the file, or an attrset already parsed with `lib.importJSON`.
+  The latter useful if the package uses `dub` dependencies not already in the lockfile. (e.g. if the package calls `dub run some-dub-package` manually)
+* `dubBuildType ? "release"`: The build type to pass to `dub build` as a value for the `--build=` flag.
+* `dubFlags ? []`: The flags to pass to `dub build` and `dub test`.
+* `dubBuildFlags ? []`: The flags to pass to `dub build`.
+* `dubTestFlags ? []`: The flags to pass to `dub test`.
+* `compiler ? ldc`: The D compiler to be used by `dub`.

third_party/nixpkgs/doc/languages-frameworks/dotnet.section.md

@@ -134,7 +134,7 @@ Here is an example `default.nix`, using some of the previously discussed argumen
 { lib, buildDotnetModule, dotnetCorePackages, ffmpeg }:
 
 let
-  referencedProject = import ../../bar { ... };
+  referencedProject = import ../../bar { /* ... */ };
 in buildDotnetModule rec {
   pname = "someDotnetApplication";
   version = "0.1";
@@ -210,11 +210,11 @@ buildDotnetGlobalTool {
 
   nugetSha256 = "sha256-ZG2HFyKYhVNVYd2kRlkbAjZJq88OADe3yjxmLuxXDUo=";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://cmd.petabridge.com/index.html";
     changelog = "https://cmd.petabridge.com/articles/RELEASE_NOTES.html";
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }
 ```
@@ -236,7 +236,7 @@ the packages inside the `out` directory.
 $ nuget-to-nix out > deps.nix
 ```
 Which `nuget-to-nix` will generate an output similar to below
-```
+```nix
 { fetchNuGet }: [
   (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; sha256 = "0pzsdfbsfx28xfqljcwy100xhbs6wyx0z1d5qxgmv3l60di9xkll"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1gjz379y61ag9whi78qxx09bwkwcznkx2mzypgycibxk61g11da1"; })

third_party/nixpkgs/doc/languages-frameworks/gnome.section.md

@@ -47,6 +47,7 @@ When an application uses icons, an icon theme should be available in `XDG_DATA_D
 In the rare case you need to use icons from dependencies (e.g. when an app forces an icon theme), you can use the following to pick them up:
 
 ```nix
+{
   buildInputs = [
     pantheon.elementary-icon-theme
   ];
@@ -56,6 +57,7 @@ In the rare case you need to use icons from dependencies (e.g. when an app force
       --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
     )
   '';
+}
 ```
 
 To avoid costly file system access when locating icons, GTK, [as well as Qt](https://woboq.com/blog/qicon-reads-gtk-icon-cache-in-qt57.html), can rely on `icon-theme.cache` files from the themes' top-level directories. These files are generated using `gtk-update-icon-cache`, which is expected to be run whenever an icon is added or removed to an icon theme (typically an application icon into `hicolor` theme) and some programs do indeed run this after icon installation. However, since packages are installed into their own prefix by Nix, this would lead to conflicts. For that reason, `gtk3` provides a [setup hook](#ssec-gnome-hooks-gtk-drop-icon-theme-cache) that will clean the file from installation. Since most applications only ship their own icon that will be loaded on start-up, it should not affect them too much. On the other hand, icon themes are much larger and more widely used so we need to cache them. Because we recommend installing icon themes globally, we will generate the cache files from all packages in a profile using a NixOS module. You can enable the cache generation using `gtk.iconCache.enable` option if your desktop environment does not already do that.
@@ -85,22 +87,26 @@ If your application uses [GStreamer](https://gstreamer.freedesktop.org/) or [Gri
 Given the requirements above, the package expression would become messy quickly:
 
 ```nix
-preFixup = ''
+{
-  for f in $(find $out/bin/ $out/libexec/ -type f -executable); do
+  preFixup = ''
-    wrapProgram "$f" \
+    for f in $(find $out/bin/ $out/libexec/ -type f -executable); do
-      --prefix GIO_EXTRA_MODULES : "${getLib dconf}/lib/gio/modules" \
+      wrapProgram "$f" \
-      --prefix XDG_DATA_DIRS : "$out/share" \
+        --prefix GIO_EXTRA_MODULES : "${getLib dconf}/lib/gio/modules" \
-      --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/${name}" \
+        --prefix XDG_DATA_DIRS : "$out/share" \
-      --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
+        --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/${name}" \
-      --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
+        --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
-      --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ pango json-glib ]}"
+        --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
-  done
+        --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ pango json-glib ]}"
-'';
+    done
+  '';
+}
 ```
 
-Fortunately, there is [`wrapGAppsHook`]{#ssec-gnome-hooks-wrapgappshook}. It works in conjunction with other setup hooks that populate environment variables, and it will then wrap all executables in `bin` and `libexec` directories using said variables.
+Fortunately, there is [`wrapGAppsHook`]{#ssec-gnome-hooks-wrapgappshook}. It works in conjunction with other setup hooks that populate environment variables, and it will then wrap all executables in `bin` and `libexec` directories using said variables. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
 
-For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure. There is also [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4}, which replaces GTK 3 with GTK 4. And in case you are packaging a program without a graphical interface, you might want to use [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook}, which runs the same script as `wrapGAppsHook` but does not bring `gtk3` and `librsvg` into the closure.
+There is also [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4}, which replaces GTK 3 with GTK 4. Instead of `wrapGAppsHook`, this should be used for all GTK4 applications.
+
+In case you are packaging a program without a graphical interface, you might want to use [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook}, which runs the same script as `wrapGAppsHook` but does not bring `gtk3` and `librsvg` into the closure.
 
 - `wrapGAppsHook` itself will add the package’s `share` directory to `XDG_DATA_DIRS`.
 
@@ -121,14 +127,16 @@ For convenience, it also adds `dconf.lib` for a GIO module implementing a GSetti
 You can also pass additional arguments to `makeWrapper` using `gappsWrapperArgs` in `preFixup` hook:
 
 ```nix
-preFixup = ''
+{
-  gappsWrapperArgs+=(
+  preFixup = ''
-    # Thumbnailers
+    gappsWrapperArgs+=(
-    --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
+      # Thumbnailers
-    --prefix XDG_DATA_DIRS : "${librsvg}/share"
+      --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
-    --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+      --prefix XDG_DATA_DIRS : "${librsvg}/share"
-  )
+      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
-'';
+    )
+  '';
+}
 ```
 
 ## Updating GNOME packages {#ssec-gnome-updating}
@@ -159,7 +167,7 @@ python3.pkgs.buildPythonApplication {
   nativeBuildInputs = [
     wrapGAppsHook
     gobject-introspection
-    ...
+    # ...
   ];
 
   dontWrapGApps = true;
@@ -181,7 +189,7 @@ mkDerivation {
   nativeBuildInputs = [
     wrapGAppsHook
     qmake
-    ...
+    # ...
   ];
 
   dontWrapGApps = true;

third_party/nixpkgs/doc/languages-frameworks/go.section.md

@@ -38,24 +38,26 @@ The `buildGoModule` function accepts the following parameters in addition to the
 The following is an example expression using `buildGoModule`:
 
 ```nix
-pet = buildGoModule rec {
+{
-  pname = "pet";
+  pet = buildGoModule rec {
-  version = "0.3.4";
+    pname = "pet";
+    version = "0.3.4";
 
-  src = fetchFromGitHub {
+    src = fetchFromGitHub {
-    owner = "knqyf263";
+      owner = "knqyf263";
-    repo = "pet";
+      repo = "pet";
-    rev = "v${version}";
+      rev = "v${version}";
-    hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
+      hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
-  };
+    };
 
-  vendorHash = "sha256-ciBIR+a1oaYH+H1PcC8cD8ncfJczk1IiJ8iYNM+R6aA=";
+    vendorHash = "sha256-ciBIR+a1oaYH+H1PcC8cD8ncfJczk1IiJ8iYNM+R6aA=";
 
-  meta = with lib; {
+    meta = {
-    description = "Simple command-line snippet manager, written in Go";
+      description = "Simple command-line snippet manager, written in Go";
-    homepage = "https://github.com/knqyf263/pet";
+      homepage = "https://github.com/knqyf263/pet";
-    license = licenses.mit;
+      license = lib.licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
+      maintainers = with lib.maintainers; [ kalbasit ];
+    };
   };
 }
 ```
@@ -72,20 +74,22 @@ In the following is an example expression using `buildGoPackage`, the following
 - `goDeps` is where the Go dependencies of a Go program are listed as a list of package source identified by Go import path. It could be imported as a separate `deps.nix` file for readability. The dependency data structure is described below.
 
 ```nix
-deis = buildGoPackage rec {
+{
-  pname = "deis";
+  deis = buildGoPackage rec {
-  version = "1.13.0";
+    pname = "deis";
+    version = "1.13.0";
 
-  goPackagePath = "github.com/deis/deis";
+    goPackagePath = "github.com/deis/deis";
 
-  src = fetchFromGitHub {
+    src = fetchFromGitHub {
-    owner = "deis";
+      owner = "deis";
-    repo = "deis";
+      repo = "deis";
-    rev = "v${version}";
+      rev = "v${version}";
-    hash = "sha256-XCPD4LNWtAd8uz7zyCLRfT8rzxycIUmTACjU03GnaeM=";
+      hash = "sha256-XCPD4LNWtAd8uz7zyCLRfT8rzxycIUmTACjU03GnaeM=";
+    };
+
+    goDeps = ./deps.nix;
   };
-
-  goDeps = ./deps.nix;
 }
 ```
 
@@ -138,6 +142,7 @@ Many attributes [controlling the build phase](#variables-controlling-the-build-p
 - [`patchFlags`](#var-stdenv-patchFlags)
 - [`postPatch`](#var-stdenv-postPatch)
 - [`preBuild`](#var-stdenv-preBuild)
+- `env`: useful for passing down variables such as `GOWORK`.
 
 To control test execution of the build derivation, the following attributes are of interest:
 
@@ -153,10 +158,12 @@ A string list of flags to pass to the Go linker tool via the `-ldflags` argument
 The most common use case for this argument is to make the resulting executable aware of its own version by injecting the value of string variable using the `-X` flag. For example:
 
 ```nix
+{
   ldflags = [
     "-X main.Version=${version}"
     "-X main.Commit=${version}"
   ];
+}
 ```
 
 ### `tags` {#var-go-tags}
@@ -164,16 +171,20 @@ The most common use case for this argument is to make the resulting executable a
 A string list of [Go build tags (also called build constraints)](https://pkg.go.dev/cmd/go#hdr-Build_constraints) that are passed via the `-tags` argument of `go build`.  These constraints control whether Go files from the source should be included in the build. For example:
 
 ```nix
+{
   tags = [
     "production"
     "sqlite"
   ];
+}
 ```
 
 Tags can also be set conditionally:
 
 ```nix
+{
   tags = [ "production" ] ++ lib.optionals withSqlite [ "sqlite" ];
+}
 ```
 
 ### `deleteVendor` {#var-go-deleteVendor}
@@ -188,10 +199,12 @@ Many Go projects keep the main package in a `cmd` directory.
 Following example could be used to only build the example-cli and example-server binaries:
 
 ```nix
-subPackages = [
+{
-  "cmd/example-cli"
+  subPackages = [
-  "cmd/example-server"
+    "cmd/example-cli"
-];
+    "cmd/example-server"
+  ];
+}
 ```
 
 ### `excludedPackages` {#var-go-excludedPackages}
@@ -213,10 +226,12 @@ on a per package level using build tags (`tags`). In case CGO is disabled, these
 When a Go program depends on C libraries, place those dependencies in `buildInputs`:
 
 ```nix
+{
   buildInputs = [
     libvirt
     libxml2
   ];
+}
 ```
 
 `CGO_ENABLED` defaults to `1`.
@@ -245,15 +260,18 @@ This is done with the [`-skip` or `-run`](https://pkg.go.dev/cmd/go#hdr-Testing_
 For example, only a selection of tests could be run with:
 
 ```nix
+{
   # -run and -skip accept regular expressions
   checkFlags = [
     "-run=^Test(Simple|Fast)$"
   ];
+}
 ```
 
 If a larger amount of tests should be skipped, the following pattern can be used:
 
 ```nix
+{
   checkFlags =
     let
       # Skip tests that require network access
@@ -264,6 +282,7 @@ If a larger amount of tests should be skipped, the following pattern can be used
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+}
 ```
 
 To disable tests altogether, set `doCheck = false;`.

third_party/nixpkgs/doc/languages-frameworks/haskell.section.md

@@ -113,7 +113,7 @@ Each of those compiler versions has a corresponding attribute set built using
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
 9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` is just an alias
-for `haskell.packages.ghc927`:
+for `haskell.packages.ghc964`:
 
 ```console
 $ nix-env -f '<nixpkgs>' -qaP -A haskell.packages.ghc927
@@ -1020,6 +1020,11 @@ failing because of e.g. a syntax error in the Haddock documentation.
 : Sets `doCheck` to `false` for `drv`. Useful if a package has a broken,
 flaky or otherwise problematic test suite breaking the build.
 
+`dontCheckIf condition drv`
+: Sets `doCheck` to `false` for `drv`, but only if `condition` applies.
+Otherwise it's a no-op. Useful to conditionally disable tests for a package
+without interfering with previous overrides or default values.
+
 <!-- Purposefully omitting the non-list variants here. They are a bit
 ugly, and we may want to deprecate them at some point. -->
 

third_party/nixpkgs/doc/languages-frameworks/idris.section.md

@@ -93,11 +93,11 @@ build-idris-package  {
     hash = "sha256-h28F9EEPuvab6zrfeE+0k1XGQJGwINnsJEG8yjWIl7w=";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Idris YAML lib";
     homepage = "https://github.com/Heather/Idris.Yaml";
-    license = licenses.mit;
+    license = lib.licenses.mit;
-    maintainers = [ maintainers.brainrape ];
+    maintainers = [ lib.maintainers.brainrape ];
   };
 }
 ```
@@ -134,9 +134,9 @@ For example you could set
 
 ```nix
 build-idris-package {
-  idrisBuildOptions = [ "--log" "1" "--verbose" ]
+  idrisBuildOptions = [ "--log" "1" "--verbose" ];
 
-  ...
+  # ...
 }
 ```
 

third_party/nixpkgs/doc/languages-frameworks/index.md

@@ -14,6 +14,7 @@ cuda.section.md
 cuelang.section.md
 dart.section.md
 dhall.section.md
+dlang.section.md
 dotnet.section.md
 emscripten.section.md
 gnome.section.md

third_party/nixpkgs/doc/languages-frameworks/java.section.md

@@ -4,12 +4,31 @@ Ant-based Java packages are typically built from source as follows:
 
 ```nix
 stdenv.mkDerivation {
-  name = "...";
+  pname = "...";
-  src = fetchurl { ... };
+  version = "...";
 
-  nativeBuildInputs = [ jdk ant ];
+  src = fetchurl { /* ... */ };
 
-  buildPhase = "ant";
+  nativeBuildInputs = [
+    ant
+    jdk
+    stripJavaArchivesHook # removes timestamp metadata from jar files
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    ant # build the project using ant
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # copy generated jar file(s) to an appropriate location in $out
+    install -Dm644 build/foo.jar $out/share/java/foo.jar
+
+    runHook postInstall
+  '';
 }
 ```
 
@@ -17,6 +36,10 @@ Note that `jdk` is an alias for the OpenJDK (self-built where available,
 or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs
 (`Aarch32`, `Aarch64`) point to the (unfree) `oraclejdk`.
 
+Also note that not using `stripJavaArchivesHook` will likely cause the
+generated `.jar` files to be non-deterministic, which is not optimal.
+Using it, however, does not always guarantee reproducibility.
+
 JAR files that are intended to be used by other packages should be
 installed in `$out/share/java`. JDKs have a stdenv setup hook that add
 any JARs in the `share/java` directories of the build inputs to the
@@ -25,8 +48,10 @@ installs a JAR named `foo.jar` in its `share/java` directory, and
 another package declares the attribute
 
 ```nix
-buildInputs = [ libfoo ];
+{
-nativeBuildInputs = [ jdk ];
+  buildInputs = [ libfoo ];
+  nativeBuildInputs = [ jdk ];
+}
 ```
 
 then `CLASSPATH` will be set to
@@ -39,13 +64,15 @@ If your Java package provides a program, you need to generate a wrapper
 script to run it using a JRE. You can use `makeWrapper` for this:
 
 ```nix
-nativeBuildInputs = [ makeWrapper ];
+{
+  nativeBuildInputs = [ makeWrapper ];
 
-installPhase = ''
+  installPhase = ''
-  mkdir -p $out/bin
+    mkdir -p $out/bin
-  makeWrapper ${jre}/bin/java $out/bin/foo \
+    makeWrapper ${jre}/bin/java $out/bin/foo \
-    --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
+      --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
-'';
+  '';
+}
 ```
 
 Since the introduction of the Java Platform Module System in Java 9,
@@ -69,16 +96,18 @@ let
   something = (pkgs.something.override { jre = my_jre; });
   other = (pkgs.other.override { jre = my_jre; });
 in
-  ...
+  <...>
 ```
 
 You can also specify what JDK your JRE should be based on, for example
 selecting a 'headless' build to avoid including a link to GTK+:
 
 ```nix
-my_jre = pkgs.jre_minimal.override {
+{
-  jdk = jdk11_headless;
+  my_jre = pkgs.jre_minimal.override {
-};
+    jdk = jdk11_headless;
+  };
+}
 ```
 
 Note all JDKs passthru `home`, so if your application requires
@@ -93,7 +122,9 @@ It is possible to use a different Java compiler than `javac` from the
 OpenJDK. For instance, to use the GNU Java Compiler:
 
 ```nix
-nativeBuildInputs = [ gcj ant ];
+{
+  nativeBuildInputs = [ gcj ant ];
+}
 ```
 
 Here, Ant will automatically use `gij` (the GNU Java Runtime) instead of

third_party/nixpkgs/doc/languages-frameworks/javascript.section.md

@@ -4,11 +4,14 @@
 
 This contains instructions on how to package javascript applications.
 
-The various tools available will be listed in the [tools-overview](#javascript-tools-overview). Some general principles for packaging will follow. Finally some tool specific instructions will be given.
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview).
+Some general principles for packaging will follow.
+Finally some tool specific instructions will be given.
 
 ## Getting unstuck / finding code examples {#javascript-finding-examples}
 
-If you find you are lacking inspiration for packing javascript applications, the links below might prove useful. Searching online for prior art can be helpful if you are running into solved problems.
+If you find you are lacking inspiration for packaging javascript applications, the links below might prove useful.
+Searching online for prior art can be helpful if you are running into solved problems.
 
 ### Github {#javascript-finding-examples-github}
 
@@ -30,23 +33,29 @@ The following principles are given in order of importance with potential excepti
 
 It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
 
-This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node. Some cryptic errors regarding V8 may appear.
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node.
+Some cryptic errors regarding V8 may appear.
 
 ### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
 
-A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of node_modules for each tool.
+A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of `node_modules` for each tool.
 
-Guidelines of package managers, recommend to commit those lock files to the repos. If a particular lock file is present, it is a strong indication of which package manager is used upstream.
+Guidelines of package managers, recommend to commit those lock files to the repos.
+If a particular lock file is present, it is a strong indication of which package manager is used upstream.
 
-It's better to try to use a Nix tool that understand the lock file. Using a different tool might give you hard to understand error because different packages have been installed. An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629). Upstream use NPM, but this is an attempt to package it with `yarn2nix` (that uses yarn.lock).
+It's better to try to use a Nix tool that understand the lock file.
+Using a different tool might give you hard to understand error because different packages have been installed.
+An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629).
+Upstream use npm, but this is an attempt to package it with `yarn2nix` (that uses yarn.lock).
 
-Using a different tool forces to commit a lock file to the repository. Those files are fairly large, so when packaging for nixpkgs, this approach does not scale well.
+Using a different tool forces to commit a lock file to the repository.
+Those files are fairly large, so when packaging for nixpkgs, this approach does not scale well.
 
 Exceptions to this rule are:
 
 - When you encounter one of the bugs from a Nix tool. In each of the tool specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to recreate a lock file and commit it to nixpkgs. In general `yarn2nix` has less known problems and so a simple search in nixpkgs will reveal many yarn.lock files committed.
-- Some lock files contain particular version of a package that has been pulled off NPM for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
-- The only tool that supports workspaces (a feature of NPM that helps manage sub-directories with different package.json from a single top level package.json) is `yarn2nix`. If upstream has workspaces you should try `yarn2nix`.
+- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is `yarn2nix`. If upstream has workspaces you should try `yarn2nix`.
 
 ### Try to use upstream package.json {#javascript-upstream-package-json}
 
@@ -67,28 +76,36 @@ Exceptions to this rule are:
   when you need to override a package.json. It's nice to use the one from the upstream source and do some explicit override. Here is an example:
 
   ```nix
-  patchedPackageJSON = final.runCommand "package.json" { } ''
+  {
-    ${jq}/bin/jq '.version = "0.4.0" |
+    patchedPackageJSON = final.runCommand "package.json" { } ''
-      .devDependencies."@jsdoc/cli" = "^0.2.5"
+      ${jq}/bin/jq '.version = "0.4.0" |
-      ${sonar-src}/package.json > $out
+        .devDependencies."@jsdoc/cli" = "^0.2.5"
-  '';
+        ${sonar-src}/package.json > $out
+    '';
+  }
   ```
 
   You will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
 
 ### Using node_modules directly {#javascript-using-node_modules}
 
-Each tool has an abstraction to just build the node_modules (dependencies) directory. You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command). The node_modules abstraction can be also used to build some web framework frontends. For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. `mkYarnModules` to make the derivation containing node_modules. Then when building the frontend you can just symlink the node_modules directory.
+Each tool has an abstraction to just build the node_modules (dependencies) directory.
+You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
+The node_modules abstraction can be also used to build some web framework frontends.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. `mkYarnModules` to make the derivation containing node_modules.
+Then when building the frontend you can just symlink the node_modules directory.
 
 ## Javascript packages inside nixpkgs {#javascript-packages-nixpkgs}
 
-The [pkgs/development/node-packages](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages) folder contains a generated collection of [NPM packages](https://npmjs.com/) that can be installed with the Nix package manager.
+The [pkgs/development/node-packages](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages) folder contains a generated collection of [npm packages](https://npmjs.com/) that can be installed with the Nix package manager.
 
-As a rule of thumb, the package set should only provide _end user_ software packages, such as command-line utilities. Libraries should only be added to the package set if there is a non-NPM package that requires it.
+As a rule of thumb, the package set should only provide _end user_ software packages, such as command-line utilities.
+Libraries should only be added to the package set if there is a non-npm package that requires it.
 
-When it is desired to use NPM libraries in a development project, use the `node2nix` generator directly on the `package.json` configuration file of the project.
+When it is desired to use npm libraries in a development project, use the `node2nix` generator directly on the `package.json` configuration file of the project.
 
-The package set provides support for the official stable Node.js versions. The latest stable LTS release in `nodePackages`, as well as the latest stable current release in `nodePackages_latest`.
+The package set provides support for the official stable Node.js versions.
+The latest stable LTS release in `nodePackages`, as well as the latest stable current release in `nodePackages_latest`.
 
 If your package uses native addons, you need to examine what kind of native build system it uses. Here are some examples:
 
@@ -96,18 +113,21 @@ If your package uses native addons, you need to examine what kind of native buil
 - `node-gyp-builder`
 - `node-pre-gyp`
 
-After you have identified the correct system, you need to override your package expression while adding in build system as a build input. For example, `dat` requires `node-gyp-build`, so we override its expression in [pkgs/development/node-packages/overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/overrides.nix):
+After you have identified the correct system, you need to override your package expression while adding in build system as a build input.
+For example, `dat` requires `node-gyp-build`, so we override its expression in [pkgs/development/node-packages/overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/overrides.nix):
 
 ```nix
+  {
     dat = prev.dat.override (oldAttrs: {
       buildInputs = [ final.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
       meta = oldAttrs.meta // { broken = since "12"; };
     });
+  }
 ```
 
 ### Adding and Updating Javascript packages in nixpkgs {#javascript-adding-or-updating-packages}
 
-To add a package from NPM to nixpkgs:
+To add a package from npm to nixpkgs:
 
 1. Modify [pkgs/development/node-packages/node-packages.json](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/node-packages.json) to add, update or remove package entries to have it included in `nodePackages` and `nodePackages_latest`.
 2. Run the script:
@@ -134,7 +154,7 @@ To add a package from NPM to nixpkgs:
 
 For more information about the generation process, consult the [README.md](https://github.com/svanderburg/node2nix) file of the `node2nix` tool.
 
-To update NPM packages in nixpkgs, run the same `generate.sh` script:
+To update npm packages in nixpkgs, run the same `generate.sh` script:
 
 ```sh
 ./pkgs/development/node-packages/generate.sh
@@ -159,7 +179,8 @@ git config --global url."https://github.com/".insteadOf git://github.com/
 
 ### buildNpmPackage {#javascript-buildNpmPackage}
 
-`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file (as used in [node2nix](#javascript-node2nix)). It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
+`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file (as used in [node2nix](#javascript-node2nix)).
+It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
 
 Here's an example:
 
@@ -184,16 +205,18 @@ buildNpmPackage rec {
 
   NODE_OPTIONS = "--openssl-legacy-provider";
 
-  meta = with lib; {
+  meta = {
     description = "A modern web UI for various torrent clients with a Node.js backend and React frontend";
     homepage = "https://flood.js.org";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
-    maintainers = with maintainers; [ winter ];
+    maintainers = with lib.maintainers; [ winter ];
   };
 }
 ```
 
-In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`. Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed. If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
+Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed.
+If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
 
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
@@ -233,6 +256,37 @@ sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 
 It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
 
+#### importNpmLock {#javascript-buildNpmPackage-importNpmLock}
+
+`importNpmLock` is a Nix function that requires the following optional arguments:
+
+- `npmRoot`: Path to package directory containing the source tree
+- `package`: Parsed contents of `package.json`
+- `packageLock`: Parsed contents of `package-lock.json`
+- `pname`: Package name
+- `version`: Package version
+
+It returns a derivation with a patched `package.json` & `package-lock.json` with all dependencies resolved to Nix store paths.
+
+This function is analogous to using `fetchNpmDeps`, but instead of specifying `hash` it uses metadata from `package.json` & `package-lock.json`.
+
+Note that `npmHooks.npmConfigHook` cannot be used with `importNpmLock`. You will instead need to use `importNpmLock.npmConfigHook`:
+
+```nix
+{ buildNpmPackage, importNpmLock }:
+
+buildNpmPackage {
+  pname = "hello";
+  version = "0.1.0";
+
+  npmDeps = importNpmLock {
+    npmRoot = ./.;
+  };
+
+  npmConfigHook = importNpmLock.npmConfigHook;
+}
+```
+
 ### corepack {#javascript-corepack}
 
 This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
@@ -253,8 +307,8 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 #### Pitfalls {#javascript-node2nix-pitfalls}
 
 - If upstream package.json does not have a "version" attribute, `node2nix` will crash. You will need to add it like shown in [the package.json section](#javascript-upstream-package-json).
-- `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from NPM distributed with `nodejs_16`.
+- `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
-- `node2nix` does not like missing packages from NPM. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of NPM.
+- `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
 
 ### yarn2nix {#javascript-yarn2nix}
 
@@ -265,10 +319,12 @@ You will need at least a `yarn.lock` file. If upstream does not have one you nee
 If the downloaded files contain the `package.json` and `yarn.lock` files they can be used like this:
 
 ```nix
-offlineCache = fetchYarnDeps {
+{
-  yarnLock = src + "/yarn.lock";
+  offlineCache = fetchYarnDeps {
-  hash = "....";
+    yarnLock = src + "/yarn.lock";
-};
+    hash = "....";
+  };
+}
 ```
 
 #### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
@@ -278,33 +334,41 @@ offlineCache = fetchYarnDeps {
 It's important to use the `--offline` flag. For example if you script is `"build": "something"` in `package.json` use:
 
 ```nix
-buildPhase = ''
+{
-  export HOME=$(mktemp -d)
+  buildPhase = ''
-  yarn --offline build
+    export HOME=$(mktemp -d)
-'';
+    yarn --offline build
+  '';
+}
 ```
 
-The dist phase is also trying to build a binary, the only way to override it is with:
+The `distPhase` is packing the package's dependencies in a tarball using `yarn pack`. You can disable it using:
 
 ```nix
-distPhase = "true";
+{
+  doDist = false;
+}
 ```
 
 The configure phase can sometimes fail because it makes many assumptions which may not always apply. One common override is:
 
 ```nix
-configurePhase = ''
+{
-  ln -s $node_modules node_modules
+  configurePhase = ''
-'';
+    ln -s $node_modules node_modules
+  '';
+}
 ```
 
 or if you need a writeable node_modules directory:
 
 ```nix
-configurePhase = ''
+{
-  cp -r $node_modules node_modules
+  configurePhase = ''
-  chmod +w node_modules
+    cp -r $node_modules node_modules
-'';
+    chmod +w node_modules
+  '';
+}
 ```
 
 #### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
@@ -344,12 +408,14 @@ mkYarnPackage rec {
 - Having trouble with `node-gyp`? Try adding these lines to the `yarnPreBuild` steps:
 
   ```nix
-  yarnPreBuild = ''
+  {
-    mkdir -p $HOME/.node-gyp/${nodejs.version}
+    yarnPreBuild = ''
-    echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
+      mkdir -p $HOME/.node-gyp/${nodejs.version}
-    ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
+      echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
-    export npm_config_nodedir=${nodejs}
+      ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
-  '';
+      export npm_config_nodedir=${nodejs}
+    '';
+  }
   ```
 
   - The `echo 9` steps comes from this answer: <https://stackoverflow.com/a/49139496>

third_party/nixpkgs/doc/languages-frameworks/lisp.section.md

@@ -45,7 +45,7 @@ $ sbcl
 
 Also one can create a `pkgs.mkShell` environment in `shell.nix`/`flake.nix`:
 
-```
+```nix
 let
   sbcl' = sbcl.withPackages (ps: [ ps.alexandria ]);
 in mkShell {
@@ -55,10 +55,12 @@ in mkShell {
 
 Such a Lisp can be now used e.g. to compile your sources:
 
-```
+```nix
-buildPhase = ''
+{
-  ${sbcl'}/bin/sbcl --load my-build-file.lisp
+  buildPhase = ''
-''
+    ${sbcl'}/bin/sbcl --load my-build-file.lisp
+  '';
+}
 ```
 
 ## Importing packages from Quicklisp {#lisp-importing-packages-from-quicklisp}
@@ -173,7 +175,7 @@ into the package scope with `withOverrides`.
 A package defined outside Nixpkgs using `buildASDFSystem` can be woven into the
 Nixpkgs-provided scope like this:
 
-```
+```nix
 let
   alexandria = sbcl.buildASDFSystem rec {
     pname = "alexandria";
@@ -199,7 +201,7 @@ new package with different parameters.
 
 Example of overriding `alexandria`:
 
-```
+```nix
 sbcl.pkgs.alexandria.overrideLispAttrs (oldAttrs: rec {
   version = "1.4";
   src = fetchFromGitLab {
@@ -225,7 +227,7 @@ vice versa.
 
 To package slashy systems, use `overrideLispAttrs`, like so:
 
-```
+```nix
 ecl.pkgs.alexandria.overrideLispAttrs (oldAttrs: {
   systems = oldAttrs.systems ++ [ "alexandria/tests" ];
   lispLibs = oldAttrs.lispLibs ++ [ ecl.pkgs.rt ];
@@ -290,7 +292,7 @@ derivation.
 
 This example wraps CLISP:
 
-```
+```nix
 wrapLisp {
   pkg = clisp;
   faslExt = "fas";

third_party/nixpkgs/doc/languages-frameworks/lua.section.md

@@ -1,8 +1,8 @@
-# User’s Guide to Lua Infrastructure {#users-guide-to-lua-infrastructure}
+# Lua {#lua}
 
-## Using Lua {#using-lua}
+## Using Lua {#lua-userguide}
 
-### Overview of Lua {#overview-of-lua}
+### Overview of Lua {#lua-overview}
 
 Several versions of the Lua interpreter are available: luajit, lua 5.1, 5.2, 5.3.
 The attribute `lua` refers to the default interpreter, it is also possible to refer to specific versions, e.g. `lua5_2` refers to Lua 5.2.
@@ -17,6 +17,9 @@ The main package set contains aliases to these package sets, e.g.
 `luaPackages` refers to `lua5_1.pkgs` and `lua52Packages` to
 `lua5_2.pkgs`.
 
+Note that nixpkgs patches the non-luajit interpreters to avoid referring to
+`/usr` and have `;;` (a [placeholder](https://www.lua.org/manual/5.1/manual.html#pdf-package.path) replaced with the default LUA_PATH) work correctly.
+
 ### Installing Lua and packages {#installing-lua-and-packages}
 
 #### Lua environment defined in separate `.nix` file {#lua-environment-defined-in-separate-.nix-file}
@@ -87,6 +90,7 @@ final: prev:
         pname = "luarocks-nix";
         src = /home/my_luarocks/repository;
       });
+    };
   };
 
   luaPackages = lua.pkgs;
@@ -118,7 +122,7 @@ Again, it is possible to launch the interpreter from the shell.
 The Lua interpreter has the attribute `pkgs` which contains all Lua libraries for that specific interpreter.
 
 
-## Developing with Lua {#developing-with-lua}
+## Developing with lua {#lua-developing}
 
 Now that you know how to get a working Lua environment with Nix, it is time
 to go forward and start actually developing with Lua. There are two ways to
@@ -154,7 +158,9 @@ You can develop your package as you usually would, just don't forget to wrap it
 within a `toLuaModule` call, for instance
 
 ```nix
-mynewlib = toLuaModule ( stdenv.mkDerivation { ... });
+{
+  mynewlib = toLuaModule ( stdenv.mkDerivation { /* ... */ });
+}
 ```
 
 There is also the `buildLuaPackage` function that can be used when lua modules
@@ -182,24 +188,26 @@ Each interpreter has the following attributes:
 The `buildLuarocksPackage` function is implemented in `pkgs/development/interpreters/lua-5/build-luarocks-package.nix`
 The following is an example:
 ```nix
-luaposix = buildLuarocksPackage {
+{
-  pname = "luaposix";
+  luaposix = buildLuarocksPackage {
-  version = "34.0.4-1";
+    pname = "luaposix";
+    version = "34.0.4-1";
 
-  src = fetchurl {
+    src = fetchurl {
-    url    = "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/luaposix-34.0.4-1.src.rock";
+      url    = "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/luaposix-34.0.4-1.src.rock";
-    hash = "sha256-4mLJG8n4m6y4Fqd0meUDfsOb9RHSR0qa/KD5KCwrNXs=";
+      hash = "sha256-4mLJG8n4m6y4Fqd0meUDfsOb9RHSR0qa/KD5KCwrNXs=";
-  };
+    };
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+    disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ bit32 lua std_normalize ];
+    propagatedBuildInputs = [ bit32 lua std_normalize ];
 
-  meta = with lib; {
+    meta = {
-    homepage = "https://github.com/luaposix/luaposix/";
+      homepage = "https://github.com/luaposix/luaposix/";
-    description = "Lua bindings for POSIX";
+      description = "Lua bindings for POSIX";
-    maintainers = with maintainers; [ vyp lblasc ];
+      maintainers = with lib.maintainers; [ vyp lblasc ];
-    license.fullName = "MIT/X11";
+      license.fullName = "MIT/X11";
+    };
   };
-};
+}
 ```
 
 The `buildLuarocksPackage` delegates most tasks to luarocks:
@@ -234,30 +242,20 @@ The `lua.withPackages` takes a function as an argument that is passed the set of
 Using the `withPackages` function, the previous example for the luafilesystem environment can be written like this:
 
 ```nix
-with import <nixpkgs> {};
-
 lua.withPackages (ps: [ps.luafilesystem])
 ```
 
 `withPackages` passes the correct package set for the specific interpreter version as an argument to the function. In the above example, `ps` equals `luaPackages`.
-But you can also easily switch to using `lua5_2`:
+But you can also easily switch to using `lua5_1`:
 
 ```nix
-with import <nixpkgs> {};
+lua5_1.withPackages (ps: [ps.lua])
-
-lua5_2.withPackages (ps: [ps.lua])
 ```
 
-Now, `ps` is set to `lua52Packages`, matching the version of the interpreter.
+Now, `ps` is set to `lua5_1.pkgs`, matching the version of the interpreter.
 
-### Possible Todos {#possible-todos}
+### Lua Contributing guidelines {#lua-contributing}
-
-* export/use version specific variables such as `LUA_PATH_5_2`/`LUAROCKS_CONFIG_5_2`
-* let luarocks check for dependencies via exporting the different rocktrees in temporary config
-
-### Lua Contributing guidelines {#lua-contributing-guidelines}
 
 Following rules should be respected:
 
-* Make sure libraries build for all Lua interpreters.
 * Commit names of Lua libraries should reflect that they are Lua libraries, so write for example `luaPackages.luafilesystem: 1.11 -> 1.12`.

third_party/nixpkgs/doc/languages-frameworks/maven.section.md

@@ -34,13 +34,13 @@ maven.buildMavenPackage rec {
       --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Simple command line wrapper around JD Core Java Decompiler project";
     homepage = "https://github.com/intoolswetrust/jd-cli";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
-    maintainers = with maintainers; [ majiir ];
+    maintainers = with lib.maintainers; [ majiir ];
   };
-}:
+}
 ```
 
 This package calls `maven.buildMavenPackage` to do its work. The primary difference from `stdenv.mkDerivation` is the `mvnHash` variable, which is a hash of all of the Maven dependencies.

third_party/nixpkgs/doc/languages-frameworks/ocaml.section.md

@@ -92,6 +92,7 @@ buildDunePackage rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
+}
 ```
 
 Here is a second example, this time using a source archive generated with `dune-release`. It is a good idea to use this archive when it is available as it will usually contain substituted variables such as a `%%VERSION%%` field. This library does not depend on any other OCaml library and no tests are run after building it.
@@ -110,11 +111,11 @@ buildDunePackage rec {
     hash = "sha256-d5/3KUBAWRj8tntr4RkJ74KWW7wvn/B/m1nx0npnzyc=";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/flowtype/ocaml-wtf8";
     description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates.";
-    license = licenses.mit;
+    license = lib.licenses.mit;
-    maintainers = [ maintainers.eqyiel ];
+    maintainers = [ lib.maintainers.eqyiel ];
   };
 }
 ```

third_party/nixpkgs/doc/languages-frameworks/perl.section.md

@@ -34,23 +34,27 @@ Nixpkgs provides a function `buildPerlPackage`, a generic package builder functi
 Perl packages from CPAN are defined in [pkgs/top-level/perl-packages.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/perl-packages.nix) rather than `pkgs/all-packages.nix`. Most Perl packages are so straight-forward to build that they are defined here directly, rather than having a separate function for each package called from `perl-packages.nix`. However, more complicated packages should be put in a separate file, typically in `pkgs/development/perl-modules`. Here is an example of the former:
 
 ```nix
-ClassC3 = buildPerlPackage rec {
+{
-  pname = "Class-C3";
+  ClassC3 = buildPerlPackage rec {
-  version = "0.21";
+    pname = "Class-C3";
-  src = fetchurl {
+    version = "0.21";
-    url = "mirror://cpan/authors/id/F/FL/FLORA/${pname}-${version}.tar.gz";
+    src = fetchurl {
-    hash = "sha256-/5GE5xHT0uYGOQxroqj6LMU7CtKn2s6vMVoSXxL4iK4=";
+      url = "mirror://cpan/authors/id/F/FL/FLORA/${pname}-${version}.tar.gz";
+      hash = "sha256-/5GE5xHT0uYGOQxroqj6LMU7CtKn2s6vMVoSXxL4iK4=";
+    };
   };
-};
+}
 ```
 
 Note the use of `mirror://cpan/`, and the `pname` and `version` in the URL definition to ensure that the `pname` attribute is consistent with the source that we’re actually downloading. Perl packages are made available in `all-packages.nix` through the variable `perlPackages`. For instance, if you have a package that needs `ClassC3`, you would typically write
 
 ```nix
-foo = import ../path/to/foo.nix {
+{
-  inherit stdenv fetchurl ...;
+  foo = import ../path/to/foo.nix {
-  inherit (perlPackages) ClassC3;
+    inherit stdenv fetchurl /* ... */;
-};
+    inherit (perlPackages) ClassC3;
+  };
+}
 ```
 
 in `all-packages.nix`. You can test building a Perl package as follows:
@@ -91,17 +95,19 @@ buildPerlPackage rec {
 Dependencies on other Perl packages can be specified in the `buildInputs` and `propagatedBuildInputs` attributes. If something is exclusively a build-time dependency, use `buildInputs`; if it’s (also) a runtime dependency, use `propagatedBuildInputs`. For instance, this builds a Perl module that has runtime dependencies on a bunch of other modules:
 
 ```nix
-ClassC3Componentised = buildPerlPackage rec {
+{
-  pname = "Class-C3-Componentised";
+  ClassC3Componentised = buildPerlPackage rec {
-  version = "1.0004";
+    pname = "Class-C3-Componentised";
-  src = fetchurl {
+    version = "1.0004";
-    url = "mirror://cpan/authors/id/A/AS/ASH/${pname}-${version}.tar.gz";
+    src = fetchurl {
-    hash = "sha256-ASO9rV/FzJYZ0BH572Fxm2ZrFLMZLFATJng1NuU4FHc=";
+      url = "mirror://cpan/authors/id/A/AS/ASH/${pname}-${version}.tar.gz";
+      hash = "sha256-ASO9rV/FzJYZ0BH572Fxm2ZrFLMZLFATJng1NuU4FHc=";
+    };
+    propagatedBuildInputs = [
+      ClassC3 ClassInspector TestException MROCompat
+    ];
   };
-  propagatedBuildInputs = [
+}
-    ClassC3 ClassInspector TestException MROCompat
-  ];
-};
 ```
 
 On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:
@@ -109,20 +115,22 @@ On Darwin, if a script has too many `-Idir` flags in its first line (its “sheb
 ```nix
 { lib, stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
 
-ImageExifTool = buildPerlPackage {
+{
-  pname = "Image-ExifTool";
+  ImageExifTool = buildPerlPackage {
-  version = "12.50";
+    pname = "Image-ExifTool";
+    version = "12.50";
 
-  src = fetchurl {
+    src = fetchurl {
-    url = "https://exiftool.org/${pname}-${version}.tar.gz";
+      url = "https://exiftool.org/${pname}-${version}.tar.gz";
-    hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
+      hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
+    };
+
+    nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
+    postInstall = lib.optionalString stdenv.isDarwin ''
+      shortenPerlShebang $out/bin/exiftool
+    '';
   };
-
+}
-  nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    shortenPerlShebang $out/bin/exiftool
-  '';
-};
 ```
 
 This will remove the `-I` flags from the shebang line, rewrite them in the `use lib` form, and put them on the next line instead. This function can be given any number of Perl scripts as arguments; it will modify them in-place.

third_party/nixpkgs/doc/languages-frameworks/php.section.md

@@ -97,7 +97,7 @@ let
   myPhp = php.withExtensions ({ all, ... }: with all; [ imagick opcache ]);
 in {
   services.phpfpm.pools."foo".phpPackage = myPhp;
-};
+}
 ```
 
 ```nix
@@ -108,7 +108,7 @@ let
   };
 in {
   services.phpfpm.pools."foo".phpPackage = myPhp;
-};
+}
 ```
 
 #### Example usage with `nix-shell` {#ssec-php-user-guide-installing-with-extensions-nix-shell}
@@ -149,7 +149,7 @@ php.override {
     extensions = prev.extensions // {
       mysqlnd = prev.extensions.mysqlnd.overrideAttrs (attrs: {
         patches = attrs.patches or [] ++ [
-          …
+          # ...
         ];
       });
     };

third_party/nixpkgs/doc/languages-frameworks/pkg-config.section.md

@@ -12,18 +12,18 @@ Additionally, the [`validatePkgConfig` setup hook](https://nixos.org/manual/nixp
 
 A good example of all these things is zlib:
 
-```
+```nix
 { pkg-config, testers, ... }:
 
 stdenv.mkDerivation (finalAttrs: {
-  ...
+  /* ... */
 
   nativeBuildInputs = [ pkg-config validatePkgConfig ];
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = {
-    ...
+    /* ... */
     pkgConfigModules = [ "zlib" ];
   };
 })

third_party/nixpkgs/doc/languages-frameworks/python.section.md

@@ -7,7 +7,6 @@
 | Package    | Aliases         | Interpreter |
 |------------|-----------------|-------------|
 | python27   | python2, python | CPython 2.7 |
-| python38   |                 | CPython 3.8 |
 | python39   |                 | CPython 3.9 |
 | python310  |                 | CPython 3.10 |
 | python311  | python3         | CPython 3.11 |
@@ -60,7 +59,6 @@ sets are
 
 * `pkgs.python27Packages`
 * `pkgs.python3Packages`
-* `pkgs.python38Packages`
 * `pkgs.python39Packages`
 * `pkgs.python310Packages`
 * `pkgs.python311Packages`
@@ -76,8 +74,9 @@ and the aliases
 
 #### `buildPythonPackage` function {#buildpythonpackage-function}
 
-The `buildPythonPackage` function is implemented in
+The `buildPythonPackage` function has its name binding in
-`pkgs/development/interpreters/python/mk-python-derivation.nix`
+`pkgs/development/interpreters/python/python-packages-base.nix` and is
+implemented in `pkgs/development/interpreters/python/mk-python-derivation.nix`
 using setup hooks.
 
 The following is an example:
@@ -132,12 +131,12 @@ buildPythonPackage rec {
     hypothesis
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pytest-dev/pytest/releases/tag/${version}";
     description = "Framework for writing tests";
     homepage = "https://github.com/pytest-dev/pytest";
-    license = licenses.mit;
+    license = lib.licenses.mit;
-    maintainers = with maintainers; [ domenkozar lovek323 madjar lsix ];
+    maintainers = with lib.maintainers; [ domenkozar lovek323 madjar lsix ];
   };
 }
 ```
@@ -255,17 +254,19 @@ The next example shows a non trivial overriding of the `blas` implementation to
 be used through out all of the Python package set:
 
 ```nix
-python3MyBlas = pkgs.python3.override {
+{
-  packageOverrides = self: super: {
+  python3MyBlas = pkgs.python3.override {
-    # We need toPythonModule for the package set to evaluate this
+    packageOverrides = self: super: {
-    blas = super.toPythonModule(super.pkgs.blas.override {
+      # We need toPythonModule for the package set to evaluate this
-      blasProvider = super.pkgs.mkl;
+      blas = super.toPythonModule(super.pkgs.blas.override {
-    });
+        blasProvider = super.pkgs.mkl;
-    lapack = super.toPythonModule(super.pkgs.lapack.override {
+      });
-      lapackProvider = super.pkgs.mkl;
+      lapack = super.toPythonModule(super.pkgs.lapack.override {
-    });
+        lapackProvider = super.pkgs.mkl;
+      });
+    };
   };
-};
+}
 ```
 
 This is particularly useful for numpy and scipy users who want to gain speed with other blas implementations.
@@ -314,7 +315,7 @@ python3Packages.buildPythonApplication rec {
     python-daemon
   ];
 
-  meta = with lib; {
+  meta = {
     # ...
   };
 }
@@ -323,7 +324,9 @@ python3Packages.buildPythonApplication rec {
 This is then added to `all-packages.nix` just as any other application would be.
 
 ```nix
-luigi = callPackage ../applications/networking/cluster/luigi { };
+{
+  luigi = callPackage ../applications/networking/cluster/luigi { };
+}
 ```
 
 Since the package is an application, a consumer doesn't need to care about
@@ -343,7 +346,9 @@ the attribute in `python-packages.nix`, and the `toPythonApplication` shall be
 applied to the reference:
 
 ```nix
-youtube-dl = with python3Packages; toPythonApplication youtube-dl;
+{
+  youtube-dl = with python3Packages; toPythonApplication youtube-dl;
+}
 ```
 
 #### `toPythonModule` function {#topythonmodule-function}
@@ -355,10 +360,12 @@ bindings should be made available from `python-packages.nix`. The
 modifications.
 
 ```nix
-opencv = toPythonModule (pkgs.opencv.override {
+{
-  enablePython = true;
+  opencv = toPythonModule (pkgs.opencv.override {
-  pythonPackages = self;
+    enablePython = true;
-});
+    pythonPackages = self;
+  });
+}
 ```
 
 Do pay attention to passing in the right Python version!
@@ -490,40 +497,6 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
   with the `pipInstallHook`.
 - `unittestCheckHook` will run tests with `python -m unittest discover`. See [example usage](#using-unittestcheckhook).
 
-### Development mode {#development-mode}
-
-Development or editable mode is supported. To develop Python packages
-[`buildPythonPackage`](#buildpythonpackage-function) has additional logic inside `shellPhase` to run `pip
-install -e . --prefix $TMPDIR/`for the package.
-
-Warning: `shellPhase` is executed only if `setup.py` exists.
-
-Given a `default.nix`:
-
-```nix
-with import <nixpkgs> {};
-
-python3Packages.buildPythonPackage {
-  name = "myproject";
-  buildInputs = with python3Packages; [ pyramid ];
-
-  src = ./.;
-}
-```
-
-Running `nix-shell` with no arguments should give you the environment in which
-the package would be built with `nix-build`.
-
-Shortcut to setup environments with C headers/libraries and Python packages:
-
-```shell
-nix-shell -p python3Packages.pyramid zlib libjpeg git
-```
-
-::: {.note}
-There is a boolean value `lib.inNixShell` set to `true` if nix-shell is invoked.
-:::
-
 ## User Guide {#user-guide}
 
 ### Using Python {#using-python}
@@ -860,8 +833,7 @@ Above, we were mostly just focused on use cases and what to do to get started
 creating working Python environments in nix.
 
 Now that you know the basics to be up and running, it is time to take a step
-back and take a deeper look at how Python packages are packaged on Nix. Then,
+back and take a deeper look at how Python packages are packaged on Nix.
-we will look at how you can use development mode with your code.
 
 #### Python library packages in Nixpkgs {#python-library-packages-in-nixpkgs}
 
@@ -901,12 +873,12 @@ buildPythonPackage rec {
     "toolz.dicttoolz"
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pytoolz/toolz/releases/tag/${version}";
     homepage = "https://github.com/pytoolz/toolz";
     description = "List processing tools and functional utilities";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
-    maintainers = with maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1036,12 +1008,12 @@ buildPythonPackage rec {
     pytest
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/blaze/datashape/releases/tag/${version}";
     homepage = "https://github.com/ContinuumIO/datashape";
     description = "A data description language";
-    license = licenses.bsd2;
+    license = lib.licenses.bsd2;
-    maintainers = with maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1086,12 +1058,12 @@ buildPythonPackage rec {
     libxslt
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/lxml/lxml/releases/tag/lxml-${version}";
     description = "Pythonic binding for the libxml2 and libxslt libraries";
     homepage = "https://lxml.de";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
-    maintainers = with maintainers; [ sjourdois ];
+    maintainers = with lib.maintainers; [ sjourdois ];
   };
 }
 ```
@@ -1157,12 +1129,12 @@ buildPythonPackage rec {
   # Tests cannot import pyfftw. pyfftw works fine though.
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pyFFTW/pyFFTW/releases/tag/v${version}";
     description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
     homepage = "http://hgomersall.github.com/pyFFTW";
-    license = with licenses; [ bsd2 bsd3 ];
+    license = with lib.licenses; [ bsd2 bsd3 ];
-    maintainers = with maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1198,7 +1170,8 @@ a good indication that the package is not in a valid state.
 Pytest is the most common test runner for python repositories. A trivial
 test run would be:
 
-```
+```nix
+{
   nativeCheckInputs = [ pytest ];
   checkPhase = ''
     runHook preCheck
@@ -1207,6 +1180,7 @@ test run would be:
 
     runHook postCheck
   '';
+}
 ```
 
 However, many repositories' test suites do not translate well to nix's build
@@ -1214,7 +1188,8 @@ sandbox, and will generally need many tests to be disabled.
 
 To filter tests using pytest, one can do the following:
 
-```
+```nix
+{
   nativeCheckInputs = [ pytest ];
   # avoid tests which need additional data or touch network
   checkPhase = ''
@@ -1224,6 +1199,7 @@ To filter tests using pytest, one can do the following:
 
     runHook postCheck
   '';
+}
 ```
 
 `--ignore` will tell pytest to ignore that file or directory from being
@@ -1249,7 +1225,8 @@ when a package may need many items disabled to run the test suite.
 
 Using the example above, the analogous `pytestCheckHook` usage would be:
 
-```
+```nix
+{
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -1269,12 +1246,14 @@ Using the example above, the analogous `pytestCheckHook` usage would be:
   disabledTestPaths = [
     "tests/test_failing.py"
   ];
+}
 ```
 
 This is especially useful when tests need to be conditionally disabled,
 for example:
 
-```
+```nix
+{
   disabledTests = [
     # touches network
     "download"
@@ -1286,6 +1265,7 @@ for example:
     # can fail when building with other packages
     "socket"
   ];
+}
 ```
 
 Trying to concatenate the related strings to disable tests in a regular
@@ -1299,20 +1279,24 @@ all packages have test suites that can be run easily, and some have none at all.
 To help ensure the package still works, [`pythonImportsCheck`](#using-pythonimportscheck) can attempt to import
 the listed modules.
 
-```
+```nix
+{
   pythonImportsCheck = [
     "requests"
     "urllib"
   ];
+}
 ```
 
 roughly translates to:
 
-```
+```nix
+{
   postCheck = ''
     PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
     python -c "import requests; import urllib"
   '';
+}
 ```
 
 However, this is done in its own phase, and not dependent on whether [`doCheck = true;`](#var-stdenv-doCheck).
@@ -1343,7 +1327,8 @@ pkg3>=1.0,<=2.0
 
 we can do:
 
-```
+```nix
+{
   nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
@@ -1354,6 +1339,7 @@ we can do:
   pythonRemoveDeps = [
     "pkg2"
   ];
+}
 ```
 
 which would result in the following `requirements.txt` file:
@@ -1366,9 +1352,11 @@ pkg3
 Another option is to pass `true`, that will relax/remove all dependencies, for
 example:
 
-```
+```nix
+{
   nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = true;
+}
 ```
 
 which would result in the following `requirements.txt` file:
@@ -1393,7 +1381,8 @@ work with any of the [existing hooks](#setup-hooks).
 
 `unittestCheckHook` is a hook which will substitute the setuptools `test` command for a [`checkPhase`](#ssec-check-phase) which runs `python -m unittest discover`:
 
-```
+```nix
+{
   nativeCheckInputs = [
     unittestCheckHook
   ];
@@ -1401,6 +1390,7 @@ work with any of the [existing hooks](#setup-hooks).
   unittestFlagsArray = [
     "-s" "tests" "-v"
   ];
+}
 ```
 
 #### Using sphinxHook {#using-sphinxhook}
@@ -1410,7 +1400,8 @@ using the popular Sphinx documentation generator.
 It is setup to automatically find common documentation source paths and
 render them using the default `html` style.
 
-```
+```nix
+{
   outputs = [
     "out"
     "doc"
@@ -1419,13 +1410,15 @@ render them using the default `html` style.
   nativeBuildInputs = [
     sphinxHook
   ];
+}
 ```
 
 The hook will automatically build and install the artifact into the
 `doc` output, if it exists. It also provides an automatic diversion
 for the artifacts of the `man` builder into the `man` target.
 
-```
+```nix
+{
   outputs = [
     "out"
     "doc"
@@ -1437,58 +1430,22 @@ for the artifacts of the `man` builder into the `man` target.
     "singlehtml"
     "man"
   ];
+}
 ```
 
 Overwrite `sphinxRoot` when the hook is unable to find your
 documentation source root.
 
-```
+```nix
+{
   # Configure sphinxRoot for uncommon paths
   sphinxRoot = "weird/docs/path";
+}
 ```
 
 The hook is also available to packages outside the python ecosystem by
 referencing it using `sphinxHook` from top-level.
 
-### Develop local package {#develop-local-package}
-
-As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode)
-(`python setup.py develop`); instead of installing the package this command
-creates a special link to the project code. That way, you can run updated code
-without having to reinstall after each and every change you make. Development
-mode is also available. Let's see how you can use it.
-
-In the previous Nix expression the source was fetched from a url. We can also
-refer to a local source instead using `src = ./path/to/source/tree;`
-
-If we create a `shell.nix` file which calls [`buildPythonPackage`](#buildpythonpackage-function), and if `src`
-is a local source, and if the local source has a `setup.py`, then development
-mode is activated.
-
-In the following example, we create a simple environment that has a Python 3.11
-version of our package in it, as well as its dependencies and other packages we
-like to have in the environment, all specified with `dependencies`.
-
-```nix
-with import <nixpkgs> {};
-with python311Packages;
-
-buildPythonPackage rec {
-  name = "mypackage";
-  src = ./path/to/package/source;
-  dependencies = [
-    pytest
-    numpy
-  ];
-  propagatedBuildInputs = [
-    pkgs.libsndfile
-  ];
-}
-```
-
-It is important to note that due to how development mode is implemented on Nix
-it is not possible to have multiple packages simultaneously in development mode.
-
 ### Organising your packages {#organising-your-packages}
 
 So far we discussed how you can use Python on Nix, and how you can develop with
@@ -1532,12 +1489,12 @@ buildPythonPackage rec {
     wheel
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pytoolz/toolz/releases/tag/${version}";
     homepage = "https://github.com/pytoolz/toolz/";
     description = "List processing tools and functional utilities";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
-    maintainers = with maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1828,6 +1785,7 @@ folder and not downloaded again.
 If you need to change a package's attribute(s) from `configuration.nix` you could do:
 
 ```nix
+{
   nixpkgs.config.packageOverrides = super: {
     python3 = super.python3.override {
       packageOverrides = python-self: python-super: {
@@ -1842,6 +1800,7 @@ If you need to change a package's attribute(s) from `configuration.nix` you coul
       };
     };
   };
+}
 ```
 
 `python3Packages.twisted` is now globally overridden.
@@ -1854,11 +1813,13 @@ To modify only a Python package set instead of a whole Python derivation, use
 this snippet:
 
 ```nix
+{
   myPythonPackages = python3Packages.override {
     overrides = self: super: {
-      twisted = ...;
+      twisted = <...>;
     };
-  }
+  };
+}
 ```
 
 ### How to override a Python package using overlays? {#how-to-override-a-python-package-using-overlays}
@@ -1894,7 +1855,7 @@ final: prev: {
     (
       python-final: python-prev: {
         foo = python-prev.foo.overridePythonAttrs (oldAttrs: {
-          ...
+          # ...
         });
       }
     )
@@ -1921,7 +1882,7 @@ The Python interpreters are by default not built with optimizations enabled, bec
 the builds are in that case not reproducible. To enable optimizations, override the
 interpreter of interest, e.g using
 
-```
+```nix
 let
   pkgs = import ./. {};
   mypython = pkgs.python3.override {
@@ -1939,17 +1900,21 @@ Some packages define optional dependencies for additional features. With
 `extras-require`, while PEP 621 calls these `optional-dependencies`.
 
 ```nix
-optional-dependencies = {
+{
-  complete = [ distributed ];
+  optional-dependencies = {
-};
+    complete = [ distributed ];
+  };
+}
 ```
 
 and letting the package requiring the extra add the list to its dependencies
 
 ```nix
-dependencies = [
+{
-  ...
+  dependencies = [
-] ++ dask.optional-dependencies.complete;
+    # ...
+  ] ++ dask.optional-dependencies.complete;
+}
 ```
 
 This method is using `passthru`, meaning that changing `optional-dependencies` of a package won't cause it to rebuild.
@@ -2016,6 +1981,10 @@ example of such a situation is when `py.test` is used.
 
 * Tests that attempt to access `$HOME` can be fixed by using the following
   work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+* Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.
+  This can be fixed with two changes in the derivation: 1) replacing `pytest` with
+  `pytestCheckHook` and 2) adding a `preCheck` containing `cd $out` to run
+  tests within the built output.
 
 ## Contributing {#contributing}
 

third_party/nixpkgs/doc/languages-frameworks/qt.section.md

@@ -12,7 +12,7 @@ an extra indirection.
 ## Nix expression for a Qt package (default.nix) {#qt-default-nix}
 
 ```nix
-{ stdenv, lib, qt6, wrapQtAppsHook }:
+{ stdenv, qt6 }:
 
 stdenv.mkDerivation {
   pname = "myapp";
@@ -23,10 +23,12 @@ stdenv.mkDerivation {
 }
 ```
 
+The same goes for Qt 5 where libraries and tools are under `libsForQt5`.
+
 Any Qt package should include `wrapQtAppsHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
 
 ::: {.note}
-Graphical Linux applications should also include `qtwayland` in `buildInputs`, to ensure the Wayland platform plugin is available.
+Qt 6 graphical applications should also include `qtwayland` in `buildInputs` on Linux (but not on platforms e.g. Darwin, where `qtwayland` is not available), to ensure the Wayland platform plugin is available.
 
 This may become default in the future, see [NixOS/nixpkgs#269674](https://github.com/NixOS/nixpkgs/pull/269674).
 :::

third_party/nixpkgs/doc/languages-frameworks/ruby.section.md

@@ -124,11 +124,13 @@ mkShell { buildInputs = [ gems (lowPrio gems.wrappedRuby) ]; }
 Sometimes a Gemfile references other files. Such as `.ruby-version` or vendored gems. When copying the Gemfile to the nix store we need to copy those files alongside. This can be done using `extraConfigPaths`. For example:
 
 ```nix
+{
   gems = bundlerEnv {
     name = "gems-for-some-project";
     gemdir = ./.;
     extraConfigPaths = [ "${./.}/.ruby-version" ];
   };
+}
 ```
 
 ### Gem-specific configurations and workarounds {#gem-specific-configurations-and-workarounds}

third_party/nixpkgs/doc/languages-frameworks/rust.section.md

@@ -3,10 +3,12 @@
 To install the rust compiler and cargo put
 
 ```nix
-environment.systemPackages = [
+{
-  rustc
+  environment.systemPackages = [
-  cargo
+    rustc
-];
+    cargo
+  ];
+}
 ```
 
 into your `configuration.nix` or bring them into scope with `nix-shell -p rustc cargo`.
@@ -35,10 +37,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-jtBw4ahSl88L0iuCXxQgZVm1EcboWRJMNtjxLVTtzts=";
 
-  meta = with lib; {
+  meta = {
     description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
-    license = licenses.unlicense;
+    license = lib.licenses.unlicense;
     maintainers = [];
   };
 }
@@ -51,7 +53,9 @@ preferred over `cargoSha256` which was used for traditional Nix SHA-256 hashes.
 For example:
 
 ```nix
+{
   cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
+}
 ```
 
 Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
@@ -67,13 +71,17 @@ then be taken from the failed build. A fake hash can be used for
 `cargoHash` as follows:
 
 ```nix
+{
   cargoHash = lib.fakeHash;
+}
 ```
 
 For `cargoSha256` you can use:
 
 ```nix
+{
   cargoSha256 = lib.fakeSha256;
+}
 ```
 
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
@@ -162,9 +170,11 @@ doesn't add a `Cargo.lock` to your `src`, and a `Cargo.lock` is still
 required to build a rust package. A simple fix is to use:
 
 ```nix
-postPatch = ''
+{
-  ln -s ${./Cargo.lock} Cargo.lock
+  postPatch = ''
-'';
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+}
 ```
 
 The output hash of each dependency that uses a git source must be
@@ -409,7 +419,7 @@ the `cargoPatches` attribute to update or add it.
 
 ```nix
 rustPlatform.buildRustPackage rec {
-  (...)
+  # ...
   cargoPatches = [
     # a patch file to add/update Cargo.lock in the source code
     ./add-Cargo.lock.patch
@@ -433,10 +443,12 @@ containing `Cargo.toml` and `Cargo.lock`, `fetchCargoTarball`
 can be used as follows:
 
 ```nix
-cargoDeps = rustPlatform.fetchCargoTarball {
+{
-  inherit src;
+  cargoDeps = rustPlatform.fetchCargoTarball {
-  hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+    inherit src;
-};
+    hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  };
+}
 ```
 
 The `src` attribute is required, as well as a hash specified through
@@ -458,23 +470,27 @@ function does not require a hash (unless git dependencies are used)
 and fetches every dependency as a separate fixed-output derivation.
 `importCargoLock` can be used as follows:
 
-```
+```nix
-cargoDeps = rustPlatform.importCargoLock {
+{
-  lockFile = ./Cargo.lock;
+  cargoDeps = rustPlatform.importCargoLock {
-};
+    lockFile = ./Cargo.lock;
+  };
+}
 ```
 
 If the `Cargo.lock` file includes git dependencies, then their output
 hashes need to be specified since they are not available through the
 lock file. For example:
 
-```
+```nix
-cargoDeps = rustPlatform.importCargoLock {
+{
-  lockFile = ./Cargo.lock;
+  cargoDeps = rustPlatform.importCargoLock {
-  outputHashes = {
+    lockFile = ./Cargo.lock;
-    "rand-0.8.3" = "0ya2hia3cn31qa8894s3av2s8j5bjwb6yq92k0jsnlx7jid0jwqa";
+    outputHashes = {
+      "rand-0.8.3" = "0ya2hia3cn31qa8894s3av2s8j5bjwb6yq92k0jsnlx7jid0jwqa";
+    };
   };
-};
+}
 ```
 
 If you do not specify an output hash for a git dependency, building
@@ -651,6 +667,66 @@ buildPythonPackage rec {
 }
 ```
 
+#### Rust package built with `meson` {#rust-package-built-with-meson}
+
+Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoTarball` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
+
+```nix
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook4
+, blueprint-compiler
+, libadwaita
+, libsecret
+, tracker
+}:
+
+stdenv.mkDerivation rec {
+  pname = "health";
+  version = "0.95.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "health";
+    rev = version;
+    hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-8fa3fa+sFi5H+49B5sr2vYPkp9C9s6CcE0zv4xB8gww=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    libadwaita
+    libsecret
+    tracker
+  ];
+
+  # ...
+}
+```
+
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}
@@ -732,27 +808,27 @@ general. A number of other parameters can be overridden:
 - The version of `rustc` used to compile the crate:
 
   ```nix
-  (hello {}).override { rust = pkgs.rust; };
+  (hello {}).override { rust = pkgs.rust; }
   ```
 
 - Whether to build in release mode or debug mode (release mode by
   default):
 
   ```nix
-  (hello {}).override { release = false; };
+  (hello {}).override { release = false; }
   ```
 
 - Whether to print the commands sent to `rustc` when building
   (equivalent to `--verbose` in cargo:
 
   ```nix
-  (hello {}).override { verbose = false; };
+  (hello {}).override { verbose = false; }
   ```
 
 - Extra arguments to be passed to `rustc`:
 
   ```nix
-  (hello {}).override { extraRustcOpts = "-Z debuginfo=2"; };
+  (hello {}).override { extraRustcOpts = "-Z debuginfo=2"; }
   ```
 
 - Phases, just like in any other derivation, can be specified using
@@ -768,7 +844,7 @@ general. A number of other parameters can be overridden:
     preConfigure = ''
        echo "pub const PATH=\"${hi.out}\";" >> src/path.rs"
     '';
-  };
+  }
   ```
 
 ### Setting Up `nix-shell` {#setting-up-nix-shell}
@@ -903,8 +979,8 @@ with import <nixpkgs>
 };
 let
   rustPlatform = makeRustPlatform {
-    cargo = rust-bin.stable.latest.minimal;
+    cargo = rust-bin.selectLatestNightlyWith (toolchain: toolchain.default);
-    rustc = rust-bin.stable.latest.minimal;
+    rustc = rust-bin.selectLatestNightlyWith (toolchain: toolchain.default);
   };
 in
 
@@ -923,11 +999,11 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
-    license = with licenses; [ mit unlicense ];
+    license = with lib.licenses; [ mit unlicense ];
-    maintainers = with maintainers; [];
+    maintainers = with lib.maintainers; [];
   };
 }
 ```

third_party/nixpkgs/doc/languages-frameworks/swift.section.md

@@ -112,13 +112,17 @@ stdenv.mkDerivation rec {
 If you'd like to build a different configuration than `release`:
 
 ```nix
-swiftpmBuildConfig = "debug";
+{
+  swiftpmBuildConfig = "debug";
+}
 ```
 
 It is also possible to provide additional flags to `swift build`:
 
 ```nix
-swiftpmFlags = [ "--disable-dead-strip" ];
+{
+  swiftpmFlags = [ "--disable-dead-strip" ];
+}
 ```
 
 The default `buildPhase` already passes `-j` for parallel building.
@@ -132,7 +136,9 @@ Including `swiftpm` in your `nativeBuildInputs` also provides a default
 `checkPhase`, but it must be enabled with:
 
 ```nix
-doCheck = true;
+{
+  doCheck = true;
+}
 ```
 
 This essentially runs: `swift test -c release`
@@ -147,13 +153,15 @@ them, we need to make them writable.
 A special function `swiftpmMakeMutable` is available to replace the symlink
 with a writable copy:
 
-```
+```nix
-configurePhase = generated.configure ++ ''
+{
-  # Replace the dependency symlink with a writable copy.
+  configurePhase = generated.configure ++ ''
-  swiftpmMakeMutable swift-crypto
+    # Replace the dependency symlink with a writable copy.
-  # Now apply a patch.
+    swiftpmMakeMutable swift-crypto
-  patch -p1 -d .build/checkouts/swift-crypto -i ${./some-fix.patch}
+    # Now apply a patch.
-'';
+    patch -p1 -d .build/checkouts/swift-crypto -i ${./some-fix.patch}
+  '';
+}
 ```
 
 ## Considerations for custom build tools {#ssec-swift-considerations-for-custom-build-tools}

third_party/nixpkgs/doc/languages-frameworks/texlive.section.md

@@ -181,11 +181,11 @@ let
       runHook postInstall
     '';
 
-    meta = with lib; {
+    meta = {
       description = "A LaTeX2e class for overhead transparencies";
-      license = licenses.unfreeRedistributable;
+      license = lib.licenses.unfreeRedistributable;
-      maintainers = with maintainers; [ veprbl ];
+      maintainers = with lib.maintainers; [ veprbl ];
-      platforms = platforms.all;
+      platforms = lib.platforms.all;
     };
   };
 

third_party/nixpkgs/doc/languages-frameworks/vim.section.md

@@ -219,9 +219,11 @@ After running the updater, if nvim-treesitter received an update, also run [`nvi
 Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
 
 ```nix
-deoplete-fish = super.deoplete-fish.overrideAttrs(old: {
+{
-  dependencies = with super; [ deoplete-nvim vim-fish ];
+  deoplete-fish = super.deoplete-fish.overrideAttrs(old: {
-});
+    dependencies = with super; [ deoplete-nvim vim-fish ];
+  });
+}
 ```
 
 Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `./update.py` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
@@ -264,8 +266,10 @@ pwntester/octo.nvim,,
 You can then reference the generated vim plugins via:
 
 ```nix
-myVimPlugins = pkgs.vimPlugins.extend (
+{
-  (pkgs.callPackage ./generated.nix {})
+  myVimPlugins = pkgs.vimPlugins.extend (
-);
+    (pkgs.callPackage ./generated.nix {})
+  );
+}
 ```
 

third_party/nixpkgs/doc/manpage-urls.json

@@ -320,5 +320,7 @@
   "login.defs(5)": "https://man.archlinux.org/man/login.defs.5",
   "unshare(1)": "https://man.archlinux.org/man/unshare.1.en",
   "nix-shell(1)": "https://nixos.org/manual/nix/stable/command-ref/nix-shell.html",
-  "mksquashfs(1)": "https://man.archlinux.org/man/extra/squashfs-tools/mksquashfs.1.en"
+  "mksquashfs(1)": "https://man.archlinux.org/man/extra/squashfs-tools/mksquashfs.1.en",
+  "curl(1)": "https://curl.se/docs/manpage.html",
+  "netrc(5)": "https://man.cx/netrc"
 }

third_party/nixpkgs/doc/overrides.css

@@ -1,22 +0,0 @@
-.docbook .xref img[src^=images\/callouts\/],
-.screen img,
-.programlisting img,
-.literallayout img,
-.synopsis img {
-    width: 1em;
-}
-
-.calloutlist img {
-    width: 1.5em;
-}
-
-.prompt,
-.screen img,
-.programlisting img,
-.literallayout img,
-.synopsis img {
-    -moz-user-select: none;
-    -webkit-user-select: none;
-    -ms-user-select: none;
-    user-select: none;
-}

third_party/nixpkgs/doc/packages/darwin-builder.section.md

@@ -81,7 +81,7 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
-```
+```nix
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
@@ -153,7 +153,8 @@ you may use it to build a modified remote builder with additional storage or mem
 To do this, you just need to set the `virtualisation.darwin-builder.*` parameters as
 in the example below and rebuild.
 
-```
+```nix
+  {
     darwin-builder = nixpkgs.lib.nixosSystem {
       system = linuxSystem;
       modules = [
@@ -166,6 +167,8 @@ in the example below and rebuild.
           virtualisation.darwin-builder.workingDirectory = "/var/lib/darwin-builder";
         }
       ];
+    };
+  }
 ```
 
 You may make any other changes to your VM in this attribute set. For example,

third_party/nixpkgs/doc/packages/eclipse.section.md

@@ -13,11 +13,13 @@ Once an Eclipse variant is installed, it can be run using the `eclipse` command,
 If you prefer to install plugins in a more declarative manner, then Nixpkgs also offer a number of Eclipse plugins that can be installed in an _Eclipse environment_. This type of environment is created using the function `eclipseWithPlugins` found inside the `nixpkgs.eclipses` attribute set. This function takes as argument `{ eclipse, plugins ? [], jvmArgs ? [] }` where `eclipse` is a one of the Eclipse packages described above, `plugins` is a list of plugin derivations, and `jvmArgs` is a list of arguments given to the JVM running the Eclipse. For example, say you wish to install the latest Eclipse Platform with the popular Eclipse Color Theme plugin and also allow Eclipse to use more RAM. You could then add:
 
 ```nix
-packageOverrides = pkgs: {
+{
-  myEclipse = with pkgs.eclipses; eclipseWithPlugins {
+  packageOverrides = pkgs: {
-    eclipse = eclipse-platform;
+    myEclipse = with pkgs.eclipses; eclipseWithPlugins {
-    jvmArgs = [ "-Xmx2048m" ];
+      eclipse = eclipse-platform;
-    plugins = [ plugins.color-theme ];
+      jvmArgs = [ "-Xmx2048m" ];
+      plugins = [ plugins.color-theme ];
+    };
   };
 }
 ```
@@ -33,32 +35,34 @@ If there is a need to install plugins that are not available in Nixpkgs then it
 Expanding the previous example with two plugins using the above functions, we have:
 
 ```nix
-packageOverrides = pkgs: {
+{
-  myEclipse = with pkgs.eclipses; eclipseWithPlugins {
+  packageOverrides = pkgs: {
-    eclipse = eclipse-platform;
+    myEclipse = with pkgs.eclipses; eclipseWithPlugins {
-    jvmArgs = [ "-Xmx2048m" ];
+      eclipse = eclipse-platform;
-    plugins = [
+      jvmArgs = [ "-Xmx2048m" ];
-      plugins.color-theme
+      plugins = [
-      (plugins.buildEclipsePlugin {
+        plugins.color-theme
-        name = "myplugin1-1.0";
+        (plugins.buildEclipsePlugin {
-        srcFeature = fetchurl {
+          name = "myplugin1-1.0";
-          url = "http://…/features/myplugin1.jar";
+          srcFeature = fetchurl {
-          hash = "sha256-123…";
+            url = "http://…/features/myplugin1.jar";
-        };
+            hash = "sha256-123…";
-        srcPlugin = fetchurl {
+          };
-          url = "http://…/plugins/myplugin1.jar";
+          srcPlugin = fetchurl {
-          hash = "sha256-123…";
+            url = "http://…/plugins/myplugin1.jar";
-        };
+            hash = "sha256-123…";
-      });
+          };
-      (plugins.buildEclipseUpdateSite {
+        })
-        name = "myplugin2-1.0";
+        (plugins.buildEclipseUpdateSite {
-        src = fetchurl {
+          name = "myplugin2-1.0";
-          stripRoot = false;
+          src = fetchurl {
-          url = "http://…/myplugin2.zip";
+            stripRoot = false;
-          hash = "sha256-123…";
+            url = "http://…/myplugin2.zip";
-        };
+            hash = "sha256-123…";
-      });
+          };
-    ];
+        })
+      ];
+    };
   };
 }
 ```

third_party/nixpkgs/doc/packages/emacs.section.md

@@ -16,7 +16,7 @@ The Emacs package comes with some extra helpers to make it easier to configure.
       projectile
       use-package
     ]));
-  }
+  };
 }
 ```
 
@@ -102,10 +102,12 @@ This provides a fairly full Emacs start file. It will load in addition to the us
 Sometimes `emacs.pkgs.withPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to GNU-devel ELPA, and the highest for packages manually defined in `pkgs/applications/editors/emacs/elisp-packages/manual-packages`). But you can't control these priorities when some package is installed as a dependency. You can override it on a per-package-basis, providing all the required dependencies manually, but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package, you can use `overrideScope`.
 
 ```nix
-overrides = self: super: rec {
+let
-  haskell-mode = self.melpaPackages.haskell-mode;
+  overrides = self: super: rec {
-  ...
+    haskell-mode = self.melpaPackages.haskell-mode;
-};
+    # ...
+  };
+in
 ((emacsPackagesFor emacs).overrideScope overrides).withPackages
   (p: with p; [
     # here both these package will use haskell-mode of our own choice
@@ -113,3 +115,4 @@ overrides = self: super: rec {
     dante
   ])
 ```
+}

third_party/nixpkgs/doc/packages/index.md

@@ -14,6 +14,7 @@ fish.section.md
 fuse.section.md
 ibus.section.md
 kakoune.section.md
+krita.section.md
 linux.section.md
 locales.section.md
 etc-files.section.md

third_party/nixpkgs/doc/packages/krita.section.md

@@ -0,0 +1,37 @@
+# Krita {#sec-krita}
+
+## Python plugins {#krita-python-plugins}
+
+"pykrita" plugins should be installed following
+[Krita's manual](https://docs.krita.org/en/user_manual/python_scripting/install_custom_python_plugin.html).
+This generally involves extracting the extension to `~/.local/share/krita/pykrita/`.
+
+## Binary plugins {#krita-binary-plugins}
+
+Binary plugins are Dynamically Linked Libraries to be loaded by Krita.
+
+_Note: You most likely won't need to deal with binary plugins,
+all known plugins are bundled and enabled by default._
+
+### Installing binary plugins {#krita-install-binary-plugins}
+
+You can choose what plugins are added to Krita by overriding the
+`binaryPlugins` attribute.
+
+If you want to add plugins instead of replacing, you can read the
+list of previous plugins via `pkgs.krita.binaryPlugins`:
+
+```nix
+(pkgs.krita.override (old: {
+    binaryPlugins = old.binaryPlugins ++ [ your-plugin ];
+}))
+```
+
+### Example structure of a binary plugin {#krita-binary-plugin-structure}
+
+```
+/nix/store/00000000000000000000000000000000-krita-plugin-example-1.2.3
+└── lib
+   └── kritaplugins
+      └── krita_example.so
+```

third_party/nixpkgs/doc/packages/steam.section.md

@@ -51,7 +51,7 @@ Use `programs.steam.enable = true;` if you want to add steam to `systemPackages`
     you need to add:
 
     ```nix
-    steam.override { withJava = true; };
+    steam.override { withJava = true; }
     ```
 
 ## steam-run {#sec-steam-run}

third_party/nixpkgs/doc/packages/urxvt.section.md

@@ -65,7 +65,9 @@ A plugin can be any kind of derivation, the only requirement is that it should a
 If the plugin is itself a Perl package that needs to be imported from other plugins or scripts, add the following passthrough:
 
 ```nix
-passthru.perlPackages = [ "self" ];
+{
+  passthru.perlPackages = [ "self" ];
+}
 ```
 
 This will make the urxvt wrapper pick up the dependency and set up the Perl path accordingly.

third_party/nixpkgs/doc/packages/weechat.section.md

@@ -3,9 +3,9 @@
 WeeChat can be configured to include your choice of plugins, reducing its closure size from the default configuration which includes all available plugins. To make use of this functionality, install an expression that overrides its configuration, such as:
 
 ```nix
-weechat.override {configure = {availablePlugins, ...}: {
+weechat.override {configure = ({availablePlugins, ...}: {
     plugins = with availablePlugins; [ python perl ];
-  }
+  });
 }
 ```
 
@@ -59,7 +59,7 @@ weechat.override {
     ];
     init = ''
       /set plugins.var.python.jabber.key "val"
-    '':
+    '';
   };
 }
 ```

third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md

@@ -15,7 +15,9 @@ Nixpkgs follows the [conventions of GNU autoconf](https://gcc.gnu.org/onlinedocs
 In Nixpkgs, these three platforms are defined as attribute sets under the names `buildPlatform`, `hostPlatform`, and `targetPlatform`. They are always defined as attributes in the standard environment. That means one can access them like:
 
 ```nix
-{ stdenv, fooDep, barDep, ... }: ...stdenv.buildPlatform...
+{ stdenv, fooDep, barDep, ... }: {
+  # ...stdenv.buildPlatform...
+}
 ```
 
 `buildPlatform`
@@ -127,7 +129,9 @@ Some frequently encountered problems when packaging for cross-compilation should
 Many packages assume that an unprefixed binutils (`cc`/`ar`/`ld` etc.) is available, but Nix doesn't provide one. It only provides a prefixed one, just as it only does for all the other binutils programs. It may be necessary to patch the package to fix the build system to use a prefix. For instance, instead of `cc`, use `${stdenv.cc.targetPrefix}cc`.
 
 ```nix
-makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+{
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+}
 ```
 
 #### How do I avoid compiling a GCC cross-compiler from source? {#cross-qa-avoid-compiling-gcc-cross-compiler}
@@ -142,7 +146,9 @@ $ nix-build '<nixpkgs>' -A pkgsCross.raspberryPi.hello
 Add the following to your `mkDerivation` invocation.
 
 ```nix
-depsBuildBuild = [ buildPackages.stdenv.cc ];
+{
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+}
 ```
 
 #### My package’s testsuite needs to run host platform code. {#cross-testsuite-runs-host-code}
@@ -150,7 +156,9 @@ depsBuildBuild = [ buildPackages.stdenv.cc ];
 Add the following to your `mkDerivation` invocation.
 
 ```nix
-doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+{
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+}
 ```
 
 #### Package using Meson needs to run binaries for the host platform during build. {#cross-meson-runs-host-code}
@@ -159,12 +167,14 @@ Add `mesonEmulatorHook` to `nativeBuildInputs` conditionally on if the target bi
 
 e.g.
 
-```
+```nix
-nativeBuildInputs = [
+{
-  meson
+  nativeBuildInputs = [
-] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    meson
-  mesonEmulatorHook
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-];
+    mesonEmulatorHook
+  ];
+}
 ```
 
 Example of an error which this fixes.

third_party/nixpkgs/doc/stdenv/meta.chapter.md

@@ -3,17 +3,19 @@
 Nix packages can declare *meta-attributes* that contain information about a package such as a description, its homepage, its license, and so on. For instance, the GNU Hello package has a `meta` declaration like this:
 
 ```nix
-meta = with lib; {
+{
-  description = "A program that produces a familiar, friendly greeting";
+  meta = {
-  longDescription = ''
+    description = "A program that produces a familiar, friendly greeting";
-    GNU Hello is a program that prints "Hello, world!" when you run it.
+    longDescription = ''
-    It is fully customizable.
+      GNU Hello is a program that prints "Hello, world!" when you run it.
-  '';
+      It is fully customizable.
-  homepage = "https://www.gnu.org/software/hello/manual/";
+    '';
-  license = licenses.gpl3Plus;
+    homepage = "https://www.gnu.org/software/hello/manual/";
-  maintainers = with maintainers; [ eelco ];
+    license = lib.licenses.gpl3Plus;
-  platforms = platforms.all;
+    maintainers = with lib.maintainers; [ eelco ];
-};
+    platforms = lib.platforms.all;
+  };
+}
 ```
 
 Meta-attributes are not passed to the builder of the package. Thus, a change to a meta-attribute doesn’t trigger a recompilation of the package.
@@ -82,7 +84,9 @@ The *priority* of the package, used by `nix-env` to resolve file name conflicts
 The list of Nix platform types on which the package is supported. Hydra builds packages according to the platform specified. If no platform is specified, the package does not have prebuilt binaries. An example is:
 
 ```nix
-meta.platforms = lib.platforms.linux;
+{
+  meta.platforms = lib.platforms.linux;
+}
 ```
 
 Attribute Set `lib.platforms` defines [various common lists](https://github.com/NixOS/nixpkgs/blob/master/lib/systems/doubles.nix) of platforms types.
@@ -95,8 +99,10 @@ In general it is preferable to set `meta.platforms = lib.platforms.all` and then
 For example, a package which requires dynamic linking and cannot be linked statically could use this:
 
 ```nix
-meta.platforms = lib.platforms.all;
+{
-meta.badPlatforms = [ lib.systems.inspect.patterns.isStatic ];
+  meta.platforms = lib.platforms.all;
+  meta.badPlatforms = [ lib.systems.inspect.patterns.isStatic ];
+}
 ```
 
 The [`lib.meta.availableOn`](https://github.com/NixOS/nixpkgs/blob/b03ac42b0734da3e7be9bf8d94433a5195734b19/lib/meta.nix#L95-L106) function can be used to test whether or not a package is available (i.e. buildable) on a given platform.
@@ -136,7 +142,7 @@ For more on how to write and run package tests, see [](#sec-package-tests).
 The NixOS tests are available as `nixosTests` in parameters of derivations. For instance, the OpenSMTPD derivation includes lines similar to:
 
 ```nix
-{ /* ... */, nixosTests }:
+{ /* ... , */ nixosTests }:
 {
   # ...
   passthru.tests = {
@@ -194,8 +200,10 @@ To be effective, it must be presented directly to an evaluation process that han
 The list of Nix platform types for which the [Hydra](https://github.com/nixos/hydra) [instance at `hydra.nixos.org`](https://nixos.org/hydra) will build the package. (Hydra is the Nix-based continuous build system.) It defaults to the value of `meta.platforms`. Thus, the only reason to set `meta.hydraPlatforms` is if you want `hydra.nixos.org` to build the package on a subset of `meta.platforms`, or not at all, e.g.
 
 ```nix
-meta.platforms = lib.platforms.linux;
+{
-meta.hydraPlatforms = [];
+  meta.platforms = lib.platforms.linux;
+  meta.hydraPlatforms = [];
+}
 ```
 
 ### `broken` {#var-meta-broken}
@@ -209,13 +217,17 @@ This means that `broken` can be used to express constraints, for example:
 - Does not cross compile
 
   ```nix
-   meta.broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+  {
+    meta.broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
+  }
   ```
 
 - Broken if all of a certain set of its dependencies are broken
 
   ```nix
-  meta.broken = lib.all (map (p: p.meta.broken) [ glibc musl ])
+  {
+    meta.broken = lib.all (map (p: p.meta.broken) [ glibc musl ]);
+  }
   ```
 
 This makes `broken` strictly more powerful than `meta.badPlatforms`.

third_party/nixpkgs/doc/stdenv/multiple-output.chapter.md

@@ -30,7 +30,9 @@ Here you find how to write a derivation that produces multiple outputs.
 In nixpkgs there is a framework supporting multiple-output derivations. It tries to cover most cases by default behavior. You can find the source separated in `<nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh>`; it’s relatively well-readable. The whole machinery is triggered by defining the `outputs` attribute to contain the list of desired output names (strings).
 
 ```nix
-outputs = [ "bin" "dev" "out" "doc" ];
+{
+  outputs = [ "bin" "dev" "out" "doc" ];
+}
 ```
 
 Often such a single line is enough. For each output an equally named environment variable is passed to the builder and contains the path in nix store for that output. Typically you also want to have the main `out` output, as it catches any files that didn’t get elsewhere.

third_party/nixpkgs/doc/stdenv/stdenv.chapter.md

@@ -36,7 +36,7 @@ Many packages have dependencies that are not provided in the standard environmen
 stdenv.mkDerivation {
   pname = "libfoo";
   version = "1.2.3";
-  ...
+  # ...
   buildInputs = [libbar perl ncurses];
 }
 ```
@@ -49,7 +49,7 @@ Often it is necessary to override or modify some aspect of the build. To make th
 stdenv.mkDerivation {
   pname = "fnord";
   version = "4.5";
-  ...
+  # ...
   buildPhase = ''
     gcc foo.c -o foo
   '';
@@ -70,7 +70,7 @@ While the standard environment provides a generic builder, you can still supply
 stdenv.mkDerivation {
   pname = "libfoo";
   version = "1.2.3";
-  ...
+  # ...
   builder = ./builder.sh;
 }
 ```
@@ -449,11 +449,13 @@ Unless set to `false`, some build systems with good support for parallel buildin
 This is an attribute set which can be filled with arbitrary values. For example:
 
 ```nix
-passthru = {
+{
-  foo = "bar";
+  passthru = {
-  baz = {
+    foo = "bar";
-    value1 = 4;
+    baz = {
-    value2 = 5;
+      value1 = 4;
+      value2 = 5;
+    };
   };
 }
 ```
@@ -467,27 +469,33 @@ A script to be run by `maintainers/scripts/update.nix` when the package is match
 - []{#var-passthru-updateScript-command} an executable file, either on the file system:
 
   ```nix
-  passthru.updateScript = ./update.sh;
+  {
+    passthru.updateScript = ./update.sh;
+  }
   ```
 
   or inside the expression itself:
 
   ```nix
-  passthru.updateScript = writeScript "update-zoom-us" ''
+  {
-    #!/usr/bin/env nix-shell
+    passthru.updateScript = writeScript "update-zoom-us" ''
-    #!nix-shell -i bash -p curl pcre2 common-updater-scripts
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre2 common-updater-scripts
 
-    set -eu -o pipefail
+      set -eu -o pipefail
 
-    version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcre2grep -o1 '/(([0-9]\.?)+)/')"
+      version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcre2grep -o1 '/(([0-9]\.?)+)/')"
-    update-source-version zoom-us "$version"
+      update-source-version zoom-us "$version"
-  '';
+    '';
+  }
   ```
 
 - a list, a script followed by arguments to be passed to it:
 
   ```nix
-  passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+  {
+    passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+  }
   ```
 
 - an attribute set containing:
@@ -496,18 +504,22 @@ A script to be run by `maintainers/scripts/update.nix` when the package is match
   - [`supportedFeatures`]{#var-passthru-updateScript-set-supportedFeatures} (optional) – a list of the [extra features](#var-passthru-updateScript-supported-features) the script supports.
 
   ```nix
-  passthru.updateScript = {
+  {
-    command = [ ../../update.sh pname ];
+    passthru.updateScript = {
-    attrPath = pname;
+      command = [ ../../update.sh pname ];
-    supportedFeatures = [ … ];
+      attrPath = pname;
-  };
+      supportedFeatures = [ /* ... */ ];
+    };
+  }
   ```
 
 ::: {.tip}
 A common pattern is to use the [`nix-update-script`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/common-updater/nix-update.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
 
 ```nix
-passthru.updateScript = nix-update-script { };
+{
+  passthru.updateScript = nix-update-script { };
+}
 ```
 
 For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://ryantm.github.io/nixpkgs-update) when a new version is released. The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set. While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
@@ -785,7 +797,7 @@ A shell array containing additional arguments passed to the configure script. Yo
 
 ##### `dontAddPrefix` {#var-stdenv-dontAddPrefix}
 
-By default, the flag `--prefix=$prefix` is added to the configure flags. If this is undesirable, set this variable to true.
+By default, `./configure` is passed the concatenation of [`prefixKey`](#var-stdenv-prefixKey) and [`prefix`](#var-stdenv-prefix) on the command line. Disable this by setting `dontAddPrefix` to `true`.
 
 ##### `prefix` {#var-stdenv-prefix}
 
@@ -793,7 +805,7 @@ The prefix under which the package must be installed, passed via the `--prefix`
 
 ##### `prefixKey` {#var-stdenv-prefixKey}
 
-The key to use when specifying the prefix. By default, this is set to `--prefix=` as that is used by the majority of packages.
+The key to use when specifying the installation [`prefix`](#var-stdenv-prefix). By default, this is set to `--prefix=` as that is used by the majority of packages. Other packages may need `--prefix ` (with a trailing space) or `PREFIX=`.
 
 ##### `dontAddStaticConfigureFlags` {#var-stdenv-dontAddStaticConfigureFlags}
 
@@ -846,7 +858,9 @@ The file name of the Makefile.
 A list of strings passed as additional flags to `make`. These flags are also used by the default install and check phase. For setting make flags specific to the build phase, use `buildFlags` (see below).
 
 ```nix
-makeFlags = [ "PREFIX=$(out)" ];
+{
+  makeFlags = [ "PREFIX=$(out)" ];
+}
 ```
 
 ::: {.note}
@@ -858,9 +872,11 @@ The flags are quoted in bash, but environment variables can be specified by usin
 A shell array containing additional arguments passed to `make`. You must use this instead of `makeFlags` if the arguments contain spaces, e.g.
 
 ```nix
-preBuild = ''
+{
-  makeFlagsArray+=(CFLAGS="-O0 -g" LDFLAGS="-lfoo -lbar")
+  preBuild = ''
-'';
+    makeFlagsArray+=(CFLAGS="-O0 -g" LDFLAGS="-lfoo -lbar")
+  '';
+}
 ```
 
 Note that shell arrays cannot be passed through environment variables, so you cannot set `makeFlagsArray` in a derivation attribute (because those are passed through environment variables): you have to define them in shell code.
@@ -892,7 +908,9 @@ The check phase checks whether the package was built correctly by running its te
 Controls whether the check phase is executed. By default it is skipped, but if `doCheck` is set to true, the check phase is usually executed. Thus you should set
 
 ```nix
-doCheck = true;
+{
+  doCheck = true;
+}
 ```
 
 in the derivation to enable checks. The exception is cross compilation. Cross compiled builds never run tests, no matter how `doCheck` is set, as the newly-built program won’t run on the platform used to build it.
@@ -945,7 +963,9 @@ See the [build phase](#var-stdenv-makeFlags) for details.
 The make targets that perform the installation. Defaults to `install`. Example:
 
 ```nix
-installTargets = "install-bin install-doc";
+{
+  installTargets = "install-bin install-doc";
+}
 ```
 
 ##### `installFlags` / `installFlagsArray` {#var-stdenv-installFlags}
@@ -1024,7 +1044,7 @@ This example prevents all `*.rlib` files from being stripped:
 ```nix
 stdenv.mkDerivation {
   # ...
-  stripExclude = [ "*.rlib" ]
+  stripExclude = [ "*.rlib" ];
 }
 ```
 
@@ -1033,7 +1053,7 @@ This example prevents files within certain paths from being stripped:
 ```nix
 stdenv.mkDerivation {
   # ...
-  stripExclude = [ "lib/modules/*/build/* ]
+  stripExclude = [ "lib/modules/*/build/*" ];
 }
 ```
 
@@ -1134,7 +1154,9 @@ It is often better to add tests that are not part of the source distribution to
 Controls whether the installCheck phase is executed. By default it is skipped, but if `doInstallCheck` is set to true, the installCheck phase is usually executed. Thus you should set
 
 ```nix
-doInstallCheck = true;
+{
+  doInstallCheck = true;
+}
 ```
 
 in the derivation to enable install checks. The exception is cross compilation. Cross compiled builds never run tests, no matter how `doInstallCheck` is set, as the newly-built program won’t run on the platform used to build it.
@@ -1244,9 +1266,11 @@ To use this, add `removeReferencesTo` to `nativeBuildInputs`.
 As `remove-references-to` is an actual executable and not a shell function, it can be used with `find`.
 Example removing all references to the compiler in the output:
 ```nix
-postInstall = ''
+{
-  find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  postInstall = ''
-'';
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+}
 ```
 
 ### `substitute` \<infile\> \<outfile\> \<subs\> {#fun-substitute}

third_party/nixpkgs/doc/style.css

@@ -1,291 +1,441 @@
-/* Copied from http://bakefile.sourceforge.net/, which appears
+html {
-   licensed under the GNU GPL. */
+    line-height: 1.15;
-
+    -webkit-text-size-adjust: 100%;
-
-/***************************************************************************
-                             Basic headers and text:
- ***************************************************************************/
-
-body
-{
-    font-family: "Nimbus Sans L", sans-serif;
-    font-size: 1em;
-    background: white;
-    margin: 2em 1em 2em 1em;
 }
 
-h1, h2, h3, h4
+body {
-{
+    margin: 0;
-    color: #005aa0;
 }
 
-h1 /* title */
+.book {
-{
-    font-size: 200%;
-}
-
-h2 /* chapters, appendices, subtitle */
-{
-    font-size: 180%;
-}
-
-div.book
-{
-    text-align: center;
-}
-
-div.book > div
-{
-    /*
-     * based on https://medium.com/@zkareemz/golden-ratio-62b3b6d4282a
-     * we do 70 characters per line to fit code listings better
-     * 70 * (font-size / 1.618)
-     * expression for emacs:
-     * (* 70 (/ 1 1.618))
-     */
-    max-width: 43.2em;
-    text-align: left;
     margin: auto;
+    width: 100%;
 }
 
-/* Extra space between chapters, appendices. */
+@media screen and (min-width: 768px) {
-div.chapter > div.titlepage h2, div.appendix > div.titlepage h2
+    .book {
-{
+        max-width: 46rem;
-    margin-top: 1.5em;
+    }
 }
 
-div.section > div.titlepage h2 /* sections */
+@media screen and (min-width: 992px) {
-{
+    .book {
-    font-size: 150%;
+        max-width: 60rem;
-    margin-top: 1.5em;
+    }
 }
 
-h3 /* subsections */
+@media screen and (min-width: 1200px) {
-{
+    .book {
-    font-size: 125%;
+        max-width: 73rem;
+    }
 }
 
-div.simplesect h2
+.book .list-of-examples {
-{
+    display: none;
-    font-size: 110%;
 }
 
-div.appendix h3
+h1 {
-{
+    font-size: 2em;
-    font-size: 150%;
+    margin: 0.67em 0;
-    margin-top: 1.5em;
 }
 
-div.refnamediv h2, div.refsynopsisdiv h2, div.refsection h2 /* refentry parts */
+hr {
-{
+    box-sizing: content-box;
-    margin-top: 1.4em;
+    height: 0;
-    font-size: 125%;
+    overflow: visible;
 }
 
-div.refsection h3
+pre {
-{
+    font-family: monospace, monospace;
-    font-size: 110%;
+    font-size: 1em;
 }
 
-
+a {
-/***************************************************************************
+    background-color: transparent;
-                               Examples:
- ***************************************************************************/
-
-div.example
-{
-    border: 1px solid #b0b0b0;
-    padding: 6px 6px;
-    margin-left: 1.5em;
-    margin-right: 1.5em;
-    background: #f4f4f8;
-    border-radius: 0.4em;
-    box-shadow: 0.4em 0.4em 0.5em #e0e0e0;
 }
 
-div.example p.title
+strong {
-{
+    font-weight: bolder;
-    margin-top: 0em;
 }
 
-div.example pre
+code {
-{
+    font-family: monospace, monospace;
-    box-shadow: none;
+    font-size: 1em;
 }
 
-
+sup {
-/***************************************************************************
+    font-size: 75%;
-                            Screen dumps:
+    line-height: 0;
- ***************************************************************************/
+    position: relative;
-
+    vertical-align: baseline;
-pre.screen, pre.programlisting
-{
-    border: 1px solid #b0b0b0;
-    padding: 3px 3px;
-    margin-left: 0.5em;
-    margin-right: 0.5em;
-
-    background: #f4f4f8;
-    font-family: monospace;
-    border-radius: 0.4em;
-    box-shadow: 0.4em 0.4em 0.5em #e0e0e0;
 }
 
-div.example pre.programlisting
+sup {
-{
+    top: -0.5em;
-    border: 0px;
-    padding: 0 0;
-    margin: 0 0 0 0;
 }
 
-/***************************************************************************
+::-webkit-file-upload-button {
-                               Notes, warnings etc:
+    -webkit-appearance: button;
- ***************************************************************************/
+    font: inherit;
-
-.note, .warning
-{
-    border: 1px solid #b0b0b0;
-    padding: 3px 3px;
-    margin-left: 1.5em;
-    margin-right: 1.5em;
-    margin-bottom: 1em;
-    padding: 0.3em 0.3em 0.3em 0.3em;
-    background: #fffff5;
-    border-radius: 0.4em;
-    box-shadow: 0.4em 0.4em 0.5em #e0e0e0;
 }
 
-div.note, div.warning
+pre {
-{
+    overflow: auto;
-    font-style: italic;
 }
 
-div.note h3, div.warning h3
+*,
-{
+*::before,
-    color: red;
+*::after {
+    box-sizing: border-box;
+}
+
+html {
     font-size: 100%;
-    padding-right: 0.5em;
+    line-height: 1.77777778;
-    display: inline;
 }
 
-div.note p, div.warning p
+@media screen and (min-width: 4000px) {
-{
+    html {
-    margin-bottom: 0em;
+        background: #000;
+    }
+
+    html body {
+        margin: auto;
+        max-width: 250rem;
+    }
 }
 
-div.note h3 + p, div.warning h3 + p
+@media screen and (max-width: 320px) {
-{
+    html {
-    display: inline;
+        font-size: calc(16 / 320 * 100vw);
+    }
 }
 
-div.note h3
+body {
-{
+    font-size: 1rem;
-    color: blue;
+    font-family: 'Roboto', sans-serif;
-    font-size: 100%;
+    font-weight: 300;
+    color: #000000;
+    background-color: #ffffff;
+    min-height: 100vh;
+    display: flex;
+    flex-direction: column;
 }
 
-div.navfooter *
+@media screen and (max-width: 767.9px) {
-{
+    body {
-    font-size: 90%;
+        padding-left: 1rem;
+        padding-right: 1rem;
+    }
 }
 
-
+a {
-/***************************************************************************
+    text-decoration: none;
-                        Links colors and highlighting:
+    border-bottom: 1px solid;
- ***************************************************************************/
+    color: #405d99;
-
-a { text-decoration: none; }
-a:hover { text-decoration: underline; }
-a:link { color: #0048b3; }
-a:visited { color: #002a6a; }
-
-
-/***************************************************************************
-                              Table of contents:
- ***************************************************************************/
-
-div.toc
-{
-    font-size: 90%;
 }
 
-div.toc dl
+ul {
-{
+    padding: 0;
-    margin-top: 0em;
+    margin-top: 0;
-    margin-bottom: 0em;
+    margin-right: 0;
+    margin-bottom: 1rem;
+    margin-left: 1rem;
 }
 
-
+table {
-/***************************************************************************
-                               Special elements:
- ***************************************************************************/
-
-tt, code
-{
-    color: #400000;
-}
-
-.term
-{
-    font-weight: bold;
-
-}
-
-div.variablelist dd p, div.glosslist dd p
-{
-    margin-top: 0em;
-}
-
-div.variablelist dd, div.glosslist dd
-{
-    margin-left: 1.5em;
-}
-
-div.glosslist dt
-{
-    font-style: italic;
-}
-
-.varname
-{
-    color: #400000;
-}
-
-span.command strong
-{
-    font-weight: normal;
-    color: #400000;
-}
-
-div.calloutlist table
-{
-    box-shadow: none;
-}
-
-table
-{
     border-collapse: collapse;
-    box-shadow: 0.4em 0.4em 0.5em #e0e0e0;
+    width: 100%;
+    margin-bottom: 1rem;
 }
 
-table.simplelist
+thead th {
-{
     text-align: left;
-    color: #005aa0;
+}
-    border: 0;
+
+hr {
+    margin-top: 1rem;
+    margin-bottom: 1rem;
+}
+
+h1 {
+    font-weight: 800;
+    line-height: 110%;
+    font-size: 200%;
+    margin-bottom: 1rem;
+    color: #6586c8;
+}
+
+h2 {
+    font-weight: 800;
+    line-height: 110%;
+    font-size: 170%;
+    margin-bottom: 0.625rem;
+    color: #6586c8;
+}
+
+h2:not(:first-child) {
+    margin-top: 1rem;
+}
+
+h3 {
+    font-weight: 800;
+    line-height: 110%;
+    margin-bottom: 1rem;
+    font-size: 150%;
+    color: #6586c8;
+}
+
+.note h3,
+.tip h3,
+.warning h3,
+.caution h3,
+.important h3 {
+    font-size: 120%;
+}
+
+h4 {
+    font-weight: 800;
+    line-height: 110%;
+    margin-bottom: 1rem;
+    font-size: 140%;
+    color: #6586c8;
+}
+
+h5 {
+    font-weight: 800;
+    line-height: 110%;
+    margin-bottom: 1rem;
+    font-size: 130%;
+    color: #6a6a6a;
+}
+
+h6 {
+    font-weight: 800;
+    line-height: 110%;
+    margin-bottom: 1rem;
+    font-size: 120%
+}
+
+strong {
+    font-weight: bold;
+}
+
+p {
+    margin-top: 0;
+    margin-bottom: 1rem;
+}
+
+dt>*:first-child,
+dd>*:first-child {
+    margin-top: 0;
+}
+
+dt>*:last-child,
+dd>*:last-child {
+    margin-bottom: 0;
+}
+
+pre,
+code {
+    font-family: monospace;
+}
+
+code {
+    color: #ff8657;
+    background: #f4f4f4;
+    display: inline-block;
+    padding: 0 0.5rem;
+    border: 1px solid #d8d8d8;
+    border-radius: 0.5rem;
+    line-height: 1.57777778;
+}
+
+div.book .programlisting,
+div.appendix .programlisting {
+    border-radius: 0.5rem;
+    padding: 1rem;
+    overflow: auto;
+    background: #f2f8fd;
+    color: #000000;
+}
+
+div.book .note,
+div.book .tip,
+div.book .warning,
+div.book .caution,
+div.book .important,
+div.appendix .note,
+div.appendix .tip,
+div.appendix .warning,
+div.appendix .caution,
+div.appendix .important {
+    margin-bottom: 1rem;
+    border-radius: 0.5rem;
+    padding: 1.5rem;
+    overflow: auto;
+    background: #f4f4f4;
+}
+
+div.book .note>.title,
+div.book .tip>.title,
+div.book .warning>.title,
+div.book .caution>.title,
+div.book .important>.title,
+div.appendix .note>.title,
+div.appendix .tip>.title,
+div.appendix .warning>.title,
+div.appendix .caution>.title,
+div.appendix .important>.title {
+    font-weight: 800;
+    /* font-family: 'Overpass', serif; */
+    line-height: 110%;
+    margin-bottom: 1rem;
+    color: inherit;
+    margin-bottom: 0;
+}
+
+div.book .note> :first-child,
+div.book .tip> :first-child,
+div.book .warning> :first-child,
+div.book .caution> :first-child,
+div.book .important> :first-child,
+div.appendix .note> :first-child,
+div.appendix .tip> :first-child,
+div.appendix .warning> :first-child,
+div.appendix .caution> :first-child,
+div.appendix .important> :first-child {
+    margin-top: 0;
+}
+
+div.book .note> :last-child,
+div.book .tip> :last-child,
+div.book .warning> :last-child,
+div.book .caution> :last-child,
+div.book .important> :last-child,
+div.appendix .note> :last-child,
+div.appendix .tip> :last-child,
+div.appendix .warning> :last-child,
+div.appendix .caution> :last-child,
+div.appendix .important> :last-child {
+    margin-bottom: 0;
+}
+
+div.book .note,
+div.book .tip,
+div.appendix .note,
+div.appendix .tip {
+    color: #5277c3;
+    background: #f2f8fd;
+}
+
+div.book .warning,
+div.book .caution,
+div.appendix .warning,
+div.appendix .caution {
+    color: #cc3900;
+    background-color: #fff5e1;
+}
+
+div.book .section,
+div.appendix .section {
+    margin-top: 2em;
+}
+
+div.book div.example,
+div.appendix div.example {
+    margin-top: 1.5em;
+}
+
+div.book div.example details,
+div.appendix div.example details {
     padding: 5px;
-    background: #fffff5;
-    font-weight: normal;
-    font-style: italic;
-    box-shadow: none;
-    margin-bottom: 1em;
 }
 
-div.navheader table, div.navfooter table {
+div.book div.example details[open],
-    box-shadow: none;
+div.appendix div.example details[open] {
+    border: 1px solid #aaa;
+    border-radius: 4px;
 }
 
-div.affiliation
+div.book div.example details>summary,
-{
+div.appendix div.example details>summary {
-    font-style: italic;
+    cursor: pointer;
+}
+
+div.book br.example-break,
+div.appendix br.example-break {
+    display: none;
+}
+
+div.book div.footnotes>hr,
+div.appendix div.footnotes>hr {
+    border-color: #d8d8d8;
+}
+
+div.book div.footnotes>br,
+div.appendix div.footnotes>br {
+    display: none;
+}
+
+div.book dt,
+div.appendix dt {
+    margin-top: 1em;
+}
+
+div.book .toc dt,
+div.appendix .toc dt {
+    margin-top: 0;
+}
+
+div.book .list-of-examples dt,
+div.appendix .list-of-examples dt {
+    margin-top: 0;
+}
+
+div.book code,
+div.appendix code {
+    padding: 0;
+    border: 0;
+    background-color: inherit;
+    color: inherit;
+    font-size: 100%;
+    -webkit-hyphens: none;
+    -moz-hyphens: none;
+    hyphens: none;
+}
+
+div.book div.toc,
+div.appendix div.toc {
+    margin-bottom: 3em;
+    border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+div.book div.toc dd,
+div.appendix div.toc dd {
+    margin-left: 2em;
+}
+
+div.book span.command,
+div.appendix span.command {
+    font-family: monospace;
+    -webkit-hyphens: none;
+    -moz-hyphens: none;
+    hyphens: none;
+}
+
+div.book .informaltable th,
+div.book .informaltable td,
+div.appendix .informaltable th,
+div.appendix .informaltable td {
+    padding: 0.5rem;
+}
+
+/*
+  This relies on highlight.js applying certain classes on the prompts.
+  For more details, see https://highlightjs.readthedocs.io/en/latest/css-classes-reference.html#stylable-scopes
+*/
+.hljs-meta.prompt_ {
+    user-select: none;
+    -webkit-user-select: none;
 }

third_party/nixpkgs/doc/using/configuration.chapter.md

@@ -1,6 +1,7 @@
 # Global configuration {#chap-packageconfig}
 
-Nix comes with certain defaults about what packages can and cannot be installed, based on a package's metadata. By default, Nix will prevent installation if any of the following criteria are true:
+Nix comes with certain defaults about which packages can and cannot be installed, based on a package's metadata.
+By default, Nix will prevent installation if any of the following criteria are true:
 
 -   The package is thought to be broken, and has had its `meta.broken` set to `true`.
 
@@ -10,23 +11,14 @@ Nix comes with certain defaults about what packages can and cannot be installed,
 
 -   The package has known security vulnerabilities but has not or can not be updated for some reason, and a list of issues has been entered in to the package's `meta.knownVulnerabilities`.
 
-Note that all this is checked during evaluation already, and the check includes any package that is evaluated. In particular, all build-time dependencies are checked. `nix-env -qa` will (attempt to) hide any packages that would be refused.
+Each of these criteria can be altered in the Nixpkgs configuration.
 
-Each of these criteria can be altered in the nixpkgs configuration.
+:::{.note}
+All this is checked during evaluation already, and the check includes any package that is evaluated.
+In particular, all build-time dependencies are checked.
+:::
 
-The nixpkgs configuration for a NixOS system is set in the `configuration.nix`, as in the following example:
+A user's Nixpkgs configuration is stored in a user-specific configuration file located at `~/.config/nixpkgs/config.nix`. For example:
-
-```nix
-{
-  nixpkgs.config = {
-    allowUnfree = true;
-  };
-}
-```
-
-However, this does not allow unfree software for individual users. Their configurations are managed separately.
-
-A user's nixpkgs configuration is stored in a user-specific configuration file located at `~/.config/nixpkgs/config.nix`. For example:
 
 ```nix
 {
@@ -34,7 +26,10 @@ A user's nixpkgs configuration is stored in a user-specific configuration file l
 }
 ```
 
-Note that we are not able to test or build unfree software on Hydra due to policy. Most unfree licenses prohibit us from either executing or distributing the software.
+:::{.caution}
+Unfree software is not tested or built in Nixpkgs continuous integration, and therefore not cached.
+Most unfree licenses prohibit either executing or distributing the software.
+:::
 
 ## Installing broken packages {#sec-allow-broken}
 
@@ -176,7 +171,7 @@ You can define a function called `packageOverrides` in your local `~/.config/nix
 ```nix
 {
   packageOverrides = pkgs: rec {
-    foo = pkgs.foo.override { ... };
+    foo = pkgs.foo.override { /* ... */ };
   };
 }
 ```

third_party/nixpkgs/doc/using/overlays.chapter.md

@@ -141,7 +141,7 @@ For BLAS/LAPACK switching to work correctly, all packages must depend on `blas`
 assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation {
-  ...
+  # ...
 }
 ```
 

third_party/nixpkgs/doc/using/overrides.chapter.md

@@ -13,13 +13,13 @@ It is used to override the arguments passed to a function.
 Example usages:
 
 ```nix
-pkgs.foo.override { arg1 = val1; arg2 = val2; ... }
+pkgs.foo.override { arg1 = val1; arg2 = val2; /* ... */ }
 ```
 
 It's also possible to access the previous arguments.
 
 ```nix
-pkgs.foo.override (previous: { arg1 = previous.arg1; ... })
+pkgs.foo.override (previous: { arg1 = previous.arg1; /* ... */ })
 ```
 
 <!-- TODO: move below programlisting to a new section about extending and overlays and reference it -->
@@ -27,13 +27,15 @@ pkgs.foo.override (previous: { arg1 = previous.arg1; ... })
 ```nix
 import pkgs.path { overlays = [ (self: super: {
   foo = super.foo.override { barSupport = true ; };
-  })]};
+  })];}
 ```
 
 ```nix
-mypkg = pkgs.callPackage ./mypkg.nix {
+{
-  mydep = pkgs.mydep.override { ... };
+  mypkg = pkgs.callPackage ./mypkg.nix {
-  }
+    mydep = pkgs.mydep.override { /* ... */ };
+  };
+}
 ```
 
 In the first example, `pkgs.foo` is the result of a function call with some default arguments, usually a derivation. Using `pkgs.foo.override` will call the same function with the given new arguments.
@@ -45,9 +47,11 @@ The function `overrideAttrs` allows overriding the attribute set passed to a `st
 Example usages:
 
 ```nix
-helloBar = pkgs.hello.overrideAttrs (finalAttrs: previousAttrs: {
+{
-  pname = previousAttrs.pname + "-bar";
+  helloBar = pkgs.hello.overrideAttrs (finalAttrs: previousAttrs: {
-});
+    pname = previousAttrs.pname + "-bar";
+  });
+}
 ```
 
 In the above example, "-bar" is appended to the pname attribute, while all other attributes will be retained from the original `hello` package.
@@ -61,9 +65,11 @@ If only a one-argument function is written, the argument has the meaning of `pre
 Function arguments can be omitted entirely if there is no need to access `previousAttrs` or `finalAttrs`.
 
 ```nix
-helloWithDebug = pkgs.hello.overrideAttrs {
+{
-  separateDebugInfo = true;
+  helloWithDebug = pkgs.hello.overrideAttrs {
-};
+    separateDebugInfo = true;
+  };
+}
 ```
 
 In the above example, the `separateDebugInfo` attribute is overridden to be true, thus building debug info for `helloWithDebug`.
@@ -87,14 +93,16 @@ The function `overrideDerivation` creates a new derivation based on an existing
 Example usage:
 
 ```nix
-mySed = pkgs.gnused.overrideDerivation (oldAttrs: {
+{
-  name = "sed-4.2.2-pre";
+  mySed = pkgs.gnused.overrideDerivation (oldAttrs: {
-  src = fetchurl {
+    name = "sed-4.2.2-pre";
-    url = "ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2";
+    src = fetchurl {
-    hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
+      url = "ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2";
-  };
+      hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
-  patches = [];
+    };
-});
+    patches = [];
+  });
+}
 ```
 
 In the above example, the `name`, `src`, and `patches` of the derivation will be overridden, while all other attributes will be retained from the original derivation.
@@ -112,8 +120,10 @@ The function `lib.makeOverridable` is used to make the result of a function easi
 Example usage:
 
 ```nix
-f = { a, b }: { result = a+b; };
+{
-c = lib.makeOverridable f { a = 1; b = 2; };
+  f = { a, b }: { result = a+b; };
+  c = lib.makeOverridable f { a = 1; b = 2; };
+}
 ```
 
 The variable `c` is the value of the `f` function applied with some default arguments. Hence the value of `c.result` is `3`, in this example.

third_party/nixpkgs/lib/.version

@@ -0,0 +1 @@
+24.05

third_party/nixpkgs/lib/asserts.nix

@@ -2,47 +2,87 @@
 
 rec {
 
-  /* Throw if pred is false, else return pred.
+  /**
-     Intended to be used to augment asserts with helpful error messages.
+    Throw if pred is false, else return pred.
+    Intended to be used to augment asserts with helpful error messages.
 
-     Example:
+    # Inputs
-       assertMsg false "nope"
-       stderr> error: nope
 
-       assert assertMsg ("foo" == "bar") "foo is not bar, silly"; ""
+    `pred`
-       stderr> error: foo is not bar, silly
 
-     Type:
+    : Predicate that needs to succeed, otherwise `msg` is thrown
-       assertMsg :: Bool -> String -> Bool
+
+    `msg`
+
+    : Message to throw in case `pred` fails
+
+    # Type
+
+    ```
+    assertMsg :: Bool -> String -> Bool
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.asserts.assertMsg` usage example
+
+    ```nix
+    assertMsg false "nope"
+    stderr> error: nope
+    assert assertMsg ("foo" == "bar") "foo is not bar, silly"; ""
+    stderr> error: foo is not bar, silly
+    ```
+
+    :::
   */
   # TODO(Profpatsch): add tests that check stderr
   assertMsg =
-    # Predicate that needs to succeed, otherwise `msg` is thrown
     pred:
-    # Message to throw in case `pred` fails
     msg:
     pred || builtins.throw msg;
 
-  /* Specialized `assertMsg` for checking if `val` is one of the elements
+  /**
-     of the list `xs`. Useful for checking enums.
+    Specialized `assertMsg` for checking if `val` is one of the elements
+    of the list `xs`. Useful for checking enums.
 
-     Example:
+    # Inputs
-       let sslLibrary = "libressl";
-       in assertOneOf "sslLibrary" sslLibrary [ "openssl" "bearssl" ]
-       stderr> error: sslLibrary must be one of [
-       stderr>   "openssl"
-       stderr>   "bearssl"
-       stderr> ], but is: "libressl"
 
-     Type:
+    `name`
-       assertOneOf :: String -> ComparableVal -> List ComparableVal -> Bool
+
+    : The name of the variable the user entered `val` into, for inclusion in the error message
+
+    `val`
+
+    : The value of what the user provided, to be compared against the values in `xs`
+
+    `xs`
+
+    : The list of valid values
+
+    # Type
+
+    ```
+    assertOneOf :: String -> ComparableVal -> List ComparableVal -> Bool
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.asserts.assertOneOf` usage example
+
+    ```nix
+    let sslLibrary = "libressl";
+    in assertOneOf "sslLibrary" sslLibrary [ "openssl" "bearssl" ]
+    stderr> error: sslLibrary must be one of [
+    stderr>   "openssl"
+    stderr>   "bearssl"
+    stderr> ], but is: "libressl"
+    ```
+
+    :::
   */
   assertOneOf =
-    # The name of the variable the user entered `val` into, for inclusion in the error message
     name:
-    # The value of what the user provided, to be compared against the values in `xs`
     val:
-    # The list of valid values
     xs:
     assertMsg
     (lib.elem val xs)
@@ -50,29 +90,51 @@ rec {
       lib.generators.toPretty {} xs}, but is: ${
         lib.generators.toPretty {} val}";
 
-  /* Specialized `assertMsg` for checking if every one of `vals` is one of the elements
+  /**
-     of the list `xs`. Useful for checking lists of supported attributes.
+    Specialized `assertMsg` for checking if every one of `vals` is one of the elements
+    of the list `xs`. Useful for checking lists of supported attributes.
 
-     Example:
+    # Inputs
-       let sslLibraries = [ "libressl" "bearssl" ];
-       in assertEachOneOf "sslLibraries" sslLibraries [ "openssl" "bearssl" ]
-       stderr> error: each element in sslLibraries must be one of [
-       stderr>   "openssl"
-       stderr>   "bearssl"
-       stderr> ], but is: [
-       stderr>   "libressl"
-       stderr>   "bearssl"
-       stderr> ]
 
-     Type:
+    `name`
-       assertEachOneOf :: String -> List ComparableVal -> List ComparableVal -> Bool
+
+    : The name of the variable the user entered `val` into, for inclusion in the error message
+
+    `vals`
+
+    : The list of values of what the user provided, to be compared against the values in `xs`
+
+    `xs`
+
+    : The list of valid values
+
+    # Type
+
+    ```
+    assertEachOneOf :: String -> List ComparableVal -> List ComparableVal -> Bool
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.asserts.assertEachOneOf` usage example
+
+    ```nix
+    let sslLibraries = [ "libressl" "bearssl" ];
+    in assertEachOneOf "sslLibraries" sslLibraries [ "openssl" "bearssl" ]
+    stderr> error: each element in sslLibraries must be one of [
+    stderr>   "openssl"
+    stderr>   "bearssl"
+    stderr> ], but is: [
+    stderr>   "libressl"
+    stderr>   "bearssl"
+    stderr> ]
+    ```
+
+    :::
   */
   assertEachOneOf =
-    # The name of the variable the user entered `val` into, for inclusion in the error message
     name:
-    # The list of values of what the user provided, to be compared against the values in `xs`
     vals:
-    # The list of valid values
     xs:
     assertMsg
     (lib.all (val: lib.elem val xs) vals)

third_party/nixpkgs/lib/cli.nix

@@ -1,43 +1,64 @@
 { lib }:
 
 rec {
-  /* Automatically convert an attribute set to command-line options.
+  /**
+    Automatically convert an attribute set to command-line options.
 
-     This helps protect against malformed command lines and also to reduce
+    This helps protect against malformed command lines and also to reduce
-     boilerplate related to command-line construction for simple use cases.
+    boilerplate related to command-line construction for simple use cases.
 
-     `toGNUCommandLine` returns a list of nix strings.
+    `toGNUCommandLine` returns a list of nix strings.
-     `toGNUCommandLineShell` returns an escaped shell string.
 
-     Example:
+    `toGNUCommandLineShell` returns an escaped shell string.
-       cli.toGNUCommandLine {} {
-         data = builtins.toJSON { id = 0; };
-         X = "PUT";
-         retry = 3;
-         retry-delay = null;
-         url = [ "https://example.com/foo" "https://example.com/bar" ];
-         silent = false;
-         verbose = true;
-       }
-       => [
-         "-X" "PUT"
-         "--data" "{\"id\":0}"
-         "--retry" "3"
-         "--url" "https://example.com/foo"
-         "--url" "https://example.com/bar"
-         "--verbose"
-       ]
 
-       cli.toGNUCommandLineShell {} {
+
-         data = builtins.toJSON { id = 0; };
+    # Inputs
-         X = "PUT";
+
-         retry = 3;
+    `options`
-         retry-delay = null;
+
-         url = [ "https://example.com/foo" "https://example.com/bar" ];
+    : 1\. Function argument
-         silent = false;
+
-         verbose = true;
+    `attrs`
-       }
+
-       => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+    : 2\. Function argument
+
+
+    # Examples
+    :::{.example}
+    ## `lib.cli.toGNUCommandLineShell` usage example
+
+    ```nix
+    cli.toGNUCommandLine {} {
+      data = builtins.toJSON { id = 0; };
+      X = "PUT";
+      retry = 3;
+      retry-delay = null;
+      url = [ "https://example.com/foo" "https://example.com/bar" ];
+      silent = false;
+      verbose = true;
+    }
+    => [
+      "-X" "PUT"
+      "--data" "{\"id\":0}"
+      "--retry" "3"
+      "--url" "https://example.com/foo"
+      "--url" "https://example.com/bar"
+      "--verbose"
+    ]
+
+    cli.toGNUCommandLineShell {} {
+      data = builtins.toJSON { id = 0; };
+      X = "PUT";
+      retry = 3;
+      retry-delay = null;
+      url = [ "https://example.com/foo" "https://example.com/bar" ];
+      silent = false;
+      verbose = true;
+    }
+    => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+    ```
+
+    :::
   */
   toGNUCommandLineShell =
     options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);

third_party/nixpkgs/lib/customisation.nix

@@ -15,42 +15,64 @@ in
 rec {
 
 
-  /* `overrideDerivation drv f` takes a derivation (i.e., the result
+  /**
-     of a call to the builtin function `derivation`) and returns a new
+    `overrideDerivation drv f` takes a derivation (i.e., the result
-     derivation in which the attributes of the original are overridden
+    of a call to the builtin function `derivation`) and returns a new
-     according to the function `f`.  The function `f` is called with
+    derivation in which the attributes of the original are overridden
-     the original derivation attributes.
+    according to the function `f`.  The function `f` is called with
+    the original derivation attributes.
 
-     `overrideDerivation` allows certain "ad-hoc" customisation
+    `overrideDerivation` allows certain "ad-hoc" customisation
-     scenarios (e.g. in ~/.config/nixpkgs/config.nix).  For instance,
+    scenarios (e.g. in ~/.config/nixpkgs/config.nix).  For instance,
-     if you want to "patch" the derivation returned by a package
+    if you want to "patch" the derivation returned by a package
-     function in Nixpkgs to build another version than what the
+    function in Nixpkgs to build another version than what the
-     function itself provides.
+    function itself provides.
 
-     For another application, see build-support/vm, where this
+    For another application, see build-support/vm, where this
-     function is used to build arbitrary derivations inside a QEMU
+    function is used to build arbitrary derivations inside a QEMU
-     virtual machine.
+    virtual machine.
 
-     Note that in order to preserve evaluation errors, the new derivation's
+    Note that in order to preserve evaluation errors, the new derivation's
-     outPath depends on the old one's, which means that this function cannot
+    outPath depends on the old one's, which means that this function cannot
-     be used in circular situations when the old derivation also depends on the
+    be used in circular situations when the old derivation also depends on the
-     new one.
+    new one.
 
-     You should in general prefer `drv.overrideAttrs` over this function;
+    You should in general prefer `drv.overrideAttrs` over this function;
-     see the nixpkgs manual for more information on overriding.
+    see the nixpkgs manual for more information on overriding.
 
-     Example:
-       mySed = overrideDerivation pkgs.gnused (oldAttrs: {
-         name = "sed-4.2.2-pre";
-         src = fetchurl {
-           url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
-           hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
-         };
-         patches = [];
-       });
 
-     Type:
+    # Inputs
-       overrideDerivation :: Derivation -> ( Derivation -> AttrSet ) -> Derivation
+
+    `drv`
+
+    : 1\. Function argument
+
+    `f`
+
+    : 2\. Function argument
+
+    # Type
+
+    ```
+    overrideDerivation :: Derivation -> ( Derivation -> AttrSet ) -> Derivation
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.customisation.overrideDerivation` usage example
+
+    ```nix
+    mySed = overrideDerivation pkgs.gnused (oldAttrs: {
+      name = "sed-4.2.2-pre";
+      src = fetchurl {
+        url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
+        hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
+      };
+      patches = [];
+    });
+    ```
+
+    :::
   */
   overrideDerivation = drv: f:
     let
@@ -67,26 +89,44 @@ rec {
       });
 
 
-  /* `makeOverridable` takes a function from attribute set to attribute set and
+  /**
-     injects `override` attribute which can be used to override arguments of
+    `makeOverridable` takes a function from attribute set to attribute set and
-     the function.
+    injects `override` attribute which can be used to override arguments of
+    the function.
 
-     Please refer to  documentation on [`<pkg>.overrideDerivation`](#sec-pkg-overrideDerivation) to learn about `overrideDerivation` and caveats
+    Please refer to  documentation on [`<pkg>.overrideDerivation`](#sec-pkg-overrideDerivation) to learn about `overrideDerivation` and caveats
-     related to its use.
+    related to its use.
 
-     Example:
-       nix-repl> x = {a, b}: { result = a + b; }
 
-       nix-repl> y = lib.makeOverridable x { a = 1; b = 2; }
+    # Inputs
 
-       nix-repl> y
+    `f`
-       { override = «lambda»; overrideDerivation = «lambda»; result = 3; }
 
-       nix-repl> y.override { a = 10; }
+    : 1\. Function argument
-       { override = «lambda»; overrideDerivation = «lambda»; result = 12; }
 
-     Type:
+    # Type
-       makeOverridable :: (AttrSet -> a) -> AttrSet -> a
+
+    ```
+    makeOverridable :: (AttrSet -> a) -> AttrSet -> a
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.customisation.makeOverridable` usage example
+
+    ```nix
+    nix-repl> x = {a, b}: { result = a + b; }
+
+    nix-repl> y = lib.makeOverridable x { a = 1; b = 2; }
+
+    nix-repl> y
+    { override = «lambda»; overrideDerivation = «lambda»; result = 3; }
+
+    nix-repl> y.override { a = 10; }
+    { override = «lambda»; overrideDerivation = «lambda»; result = 12; }
+    ```
+
+    :::
   */
   makeOverridable = f:
     let
@@ -120,7 +160,8 @@ rec {
       else result);
 
 
-  /* Call the package function in the file `fn` with the required
+  /**
+    Call the package function in the file `fn` with the required
     arguments automatically.  The function is called with the
     arguments `args`, but any missing arguments are obtained from
     `autoArgs`.  This function is intended to be partially
@@ -147,8 +188,26 @@ rec {
 
     <!-- TODO: Apply "Example:" tag to the examples above -->
 
-    Type:
+
-      callPackageWith :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
+    # Inputs
+
+    `autoArgs`
+
+    : 1\. Function argument
+
+    `fn`
+
+    : 2\. Function argument
+
+    `args`
+
+    : 3\. Function argument
+
+    # Type
+
+    ```
+    callPackageWith :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
+    ```
   */
   callPackageWith = autoArgs: fn: args:
     let
@@ -210,20 +269,40 @@ rec {
        else abort "lib.customisation.callPackageWith: ${error}";
 
 
-  /* Like callPackage, but for a function that returns an attribute
+  /**
-     set of derivations. The override function is added to the
+    Like callPackage, but for a function that returns an attribute
-     individual attributes.
+    set of derivations. The override function is added to the
+    individual attributes.
 
-     Type:
+
-       callPackagesWith :: AttrSet -> ((AttrSet -> AttrSet) | Path) -> AttrSet -> AttrSet
+    # Inputs
+
+    `autoArgs`
+
+    : 1\. Function argument
+
+    `fn`
+
+    : 2\. Function argument
+
+    `args`
+
+    : 3\. Function argument
+
+    # Type
+
+    ```
+    callPackagesWith :: AttrSet -> ((AttrSet -> AttrSet) | Path) -> AttrSet -> AttrSet
+    ```
   */
   callPackagesWith = autoArgs: fn: args:
     let
       f = if isFunction fn then fn else import fn;
       auto = intersectAttrs (functionArgs f) autoArgs;
+      mirrorArgs = mirrorFunctionArgs f;
       origArgs = auto // args;
       pkgs = f origArgs;
-      mkAttrOverridable = name: _: makeOverridable (newArgs: (f newArgs).${name}) origArgs;
+      mkAttrOverridable = name: _: makeOverridable (mirrorArgs (newArgs: (f newArgs).${name})) origArgs;
     in
       if isDerivation pkgs then throw
         ("function `callPackages` was called on a *single* derivation "
@@ -232,11 +311,30 @@ rec {
       else mapAttrs mkAttrOverridable pkgs;
 
 
-  /* Add attributes to each output of a derivation without changing
+  /**
-     the derivation itself and check a given condition when evaluating.
+    Add attributes to each output of a derivation without changing
+    the derivation itself and check a given condition when evaluating.
 
-     Type:
+
-       extendDerivation :: Bool -> Any -> Derivation -> Derivation
+    # Inputs
+
+    `condition`
+
+    : 1\. Function argument
+
+    `passthru`
+
+    : 2\. Function argument
+
+    `drv`
+
+    : 3\. Function argument
+
+    # Type
+
+    ```
+    extendDerivation :: Bool -> Any -> Derivation -> Derivation
+    ```
   */
   extendDerivation = condition: passthru: drv:
     let
@@ -268,13 +366,24 @@ rec {
       outPath = assert condition; drv.outPath;
     };
 
-  /* Strip a derivation of all non-essential attributes, returning
+  /**
-     only those needed by hydra-eval-jobs. Also strictly evaluate the
+    Strip a derivation of all non-essential attributes, returning
-     result to ensure that there are no thunks kept alive to prevent
+    only those needed by hydra-eval-jobs. Also strictly evaluate the
-     garbage collection.
+    result to ensure that there are no thunks kept alive to prevent
+    garbage collection.
 
-     Type:
+
-       hydraJob :: (Derivation | Null) -> (Derivation | Null)
+    # Inputs
+
+    `drv`
+
+    : 1\. Function argument
+
+    # Type
+
+    ```
+    hydraJob :: (Derivation | Null) -> (Derivation | Null)
+    ```
   */
   hydraJob = drv:
     let
@@ -305,18 +414,129 @@ rec {
     in if drv == null then null else
       deepSeq drv' drv';
 
-  /* Make a set of packages with a common scope. All packages called
+  /**
-     with the provided `callPackage` will be evaluated with the same
+    Make an attribute set (a "scope") from functions that take arguments from that same attribute set.
-     arguments. Any package in the set may depend on any other. The
+    See [](#ex-makeScope) for how to use it.
-     `overrideScope'` function allows subsequent modification of the package
-     set in a consistent way, i.e. all packages in the set will be
-     called with the overridden packages. The package sets may be
-     hierarchical: the packages in the set are called with the scope
-     provided by `newScope` and the set provides a `newScope` attribute
-     which can form the parent scope for later package sets.
 
-     Type:
+    # Inputs
-       makeScope :: (AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a) -> (AttrSet -> AttrSet) -> AttrSet
+
+    1. `newScope` (`AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a`)
+
+       A function that takes an attribute set `attrs` and returns what ends up as `callPackage` in the output.
+
+       Typical values are `callPackageWith` or the output attribute `newScope`.
+
+    2. `f` (`AttrSet -> AttrSet`)
+
+       A function that takes an attribute set as returned by `makeScope newScope f` (a "scope") and returns any attribute set.
+
+       This function is used to compute the fixpoint of the resulting scope using `callPackage`.
+       Its argument is the lazily evaluated reference to the value of that fixpoint, and is typically called `self` or `final`.
+
+       See [](#ex-makeScope) for how to use it.
+       See [](#sec-functions-library-fixedPoints) for details on fixpoint computation.
+
+    # Output
+
+    `makeScope` returns an attribute set of a form called `scope`, which also contains the final attributes produced by `f`:
+
+    ```
+    scope :: {
+      callPackage :: ((AttrSet -> a) | Path) -> AttrSet -> a
+      newScope = AttrSet -> scope
+      overrideScope = (scope -> scope -> AttrSet) -> scope
+      packages :: AttrSet -> AttrSet
+    }
+    ```
+
+    - `callPackage` (`((AttrSet -> a) | Path) -> AttrSet -> a`)
+
+      A function that
+
+      1. Takes a function `p`, or a path to a Nix file that contains a function `p`, which takes an attribute set and returns value of arbitrary type `a`,
+      2. Takes an attribute set `args` with explicit attributes to pass to `p`,
+      3. Calls `f` with attributes from the original attribute set `attrs` passed to `newScope` updated with `args, i.e. `attrs // args`, if they match the attributes in the argument of `p`.
+
+      All such functions `p` will be called with the same value for `attrs`.
+
+      See [](#ex-makeScope-callPackage) for how to use it.
+
+    - `newScope` (`AttrSet -> scope`)
+
+      Takes an attribute set `attrs` and returns a scope that extends the original scope.
+
+    - `overrideScope` (`(scope -> scope -> AttrSet) -> scope`)
+
+      Takes a function `g` of the form `final: prev: { # attributes }` to act as an overlay on `f`, and returns a new scope with values determined by `extends g f`.
+      See [](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.extends) for details.
+
+      This allows subsequent modification of the final attribute set in a consistent way, i.e. all functions `p` invoked with `callPackage` will be called with the modified values.
+
+    - `packages` (`AttrSet -> AttrSet`)
+
+      The value of the argument `f` to `makeScope`.
+
+    - final attributes
+
+      The final values returned by `f`.
+
+    # Examples
+
+    :::{#ex-makeScope .example}
+    # Create an interdependent package set on top of `pkgs`
+
+    The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
+
+    ```nix
+    let
+      pkgs = import <nixpkgs> { };
+    in
+    pkgs.lib.makeScope pkgs.newScope (self: {
+      foo = self.callPackage ./foo.nix { };
+      bar = self.callPackage ./bar.nix { };
+    })
+    ```
+
+    evaluates to
+
+    ```nix
+    {
+      callPackage = «lambda»;
+      newScope = «lambda»;
+      overrideScope = «lambda»;
+      packages = «lambda»;
+      foo = «derivation»;
+      bar = «derivation»;
+    }
+    ```
+    :::
+
+    :::{#ex-makeScope-callPackage .example}
+    # Using `callPackage` from a scope
+
+    ```nix
+    let
+      pkgs = import <nixpkgs> { };
+      inherit (pkgs) lib;
+      scope = lib.makeScope lib.callPackageWith (self: { a = 1; b = 2; });
+      three = scope.callPackage ({ a, b }: a + b) { };
+      four = scope.callPackage ({ a, b }: a + b) { a = 2; };
+    in
+    [ three four ]
+    ```
+
+    evaluates to
+
+    ```nix
+    [ 3 4 ]
+    ```
+    :::
+
+    # Type
+
+    ```
+    makeScope :: (AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a) -> (AttrSet -> AttrSet) -> scope
+    ```
   */
   makeScope = newScope: f:
     let self = f self // {
@@ -331,32 +551,65 @@ rec {
         };
     in self;
 
-  /* backward compatibility with old uncurried form; deprecated */
+  /**
+    backward compatibility with old uncurried form; deprecated
+
+
+    # Inputs
+
+    `splicePackages`
+
+    : 1\. Function argument
+
+    `newScope`
+
+    : 2\. Function argument
+
+    `otherSplices`
+
+    : 3\. Function argument
+
+    `keep`
+
+    : 4\. Function argument
+
+    `extra`
+
+    : 5\. Function argument
+
+    `f`
+
+    : 6\. Function argument
+  */
   makeScopeWithSplicing =
     splicePackages: newScope: otherSplices: keep: extra: f:
     makeScopeWithSplicing'
     { inherit splicePackages newScope; }
     { inherit otherSplices keep extra f; };
 
-  /* Like makeScope, but aims to support cross compilation. It's still ugly, but
+  /**
-     hopefully it helps a little bit.
+    Like makeScope, but aims to support cross compilation. It's still ugly, but
+    hopefully it helps a little bit.
 
-     Type:
+    # Type
-       makeScopeWithSplicing' ::
-         { splicePackages :: Splice -> AttrSet
-         , newScope :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
-         }
-         -> { otherSplices :: Splice, keep :: AttrSet -> AttrSet, extra :: AttrSet -> AttrSet }
-         -> AttrSet
 
-       Splice ::
+    ```
-         { pkgsBuildBuild :: AttrSet
+    makeScopeWithSplicing' ::
-         , pkgsBuildHost :: AttrSet
+      { splicePackages :: Splice -> AttrSet
-         , pkgsBuildTarget :: AttrSet
+      , newScope :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
-         , pkgsHostHost :: AttrSet
+      }
-         , pkgsHostTarget :: AttrSet
+      -> { otherSplices :: Splice, keep :: AttrSet -> AttrSet, extra :: AttrSet -> AttrSet }
-         , pkgsTargetTarget :: AttrSet
+      -> AttrSet
-         }
+
+    Splice ::
+      { pkgsBuildBuild :: AttrSet
+      , pkgsBuildHost :: AttrSet
+      , pkgsBuildTarget :: AttrSet
+      , pkgsHostHost :: AttrSet
+      , pkgsHostTarget :: AttrSet
+      , pkgsTargetTarget :: AttrSet
+      }
+    ```
   */
   makeScopeWithSplicing' =
     { splicePackages

third_party/nixpkgs/lib/default.nix

@@ -69,7 +69,7 @@ let
       hasAttr head isAttrs isBool isInt isList isPath isString length
       lessThan listToAttrs pathExists readFile replaceStrings seq
       stringLength sub substring tail trace;
-    inherit (self.trivial) id const pipe concat or and bitAnd bitOr bitXor
+    inherit (self.trivial) id const pipe concat or and xor bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum
       info showWarnings nixpkgsVersion version isInOldestRelease
@@ -86,8 +86,8 @@ let
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
       recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
       getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
-      recurseIntoAttrs dontRecurseIntoAttrs cartesianProductOfSets
+      recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
-      updateManyAttrsByPath;
+      mapCartesianProduct updateManyAttrsByPath;
     inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
       concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
@@ -97,7 +97,7 @@ let
     inherit (self.strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath optionalString
+      makeLibraryPath makeIncludePath makeBinPath optionalString
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs
       isStorePath isStringLike
@@ -128,7 +128,7 @@ let
       canCleanSource pathIsGitRepo;
     inherit (self.modules) evalModules setDefaultModuleLocation
       unifyModuleSyntax applyModuleArgsIfFunction mergeModules
-      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
+      mergeModules' mergeOptionDecls mergeDefinitions
       pushDownProperties dischargeProperties filterOverrides
       sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
       mkOptionDefault mkDefault mkImageMediaOverride mkForce mkVMOverride
@@ -138,6 +138,7 @@ let
       mkMergedOptionModule mkChangedOptionModule
       mkAliasOptionModule mkDerivedConfig doRename
       mkAliasOptionModuleMD;
+    evalOptionValue = lib.warn "External use of `lib.evalOptionValue` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/." self.modules.evalOptionValue;
     inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
       mergeDefaultOption mergeOneOption mergeEqualOption mergeUniqueOption
       getValues getFiles

third_party/nixpkgs/lib/deprecated.nix

@@ -1,14 +1,37 @@
 { lib }:
+
 let
-    inherit (builtins) head tail isList isAttrs isInt attrNames;
+  inherit (lib)
+    and
+    any
+    attrByPath
+    attrNames
+    compare
+    concat
+    concatMap
+    elem
+    filter
+    foldl
+    foldr
+    genericClosure
+    head
+    imap1
+    init
+    isAttrs
+    isFunction
+    isInt
+    isList
+    lists
+    listToAttrs
+    mapAttrs
+    mergeAttrs
+    meta
+    nameValuePair
+    tail
+    toList
+    ;
 
-in
+  inherit (lib.attrsets) removeAttrs;
-
-with lib.lists;
-with lib.attrsets;
-with lib.strings;
-
-rec {
 
   # returns default if env var is not set
   maybeEnv = name: default:
@@ -26,7 +49,7 @@ rec {
         base = (setAttrMerge "passthru" {} (f arg)
                         ( z: z // {
                             function = foldArgs merger f arg;
-                            args = (lib.attrByPath ["passthru" "args"] {} z) // x;
+                            args = (attrByPath ["passthru" "args"] {} z) // x;
                           } ));
         withStdOverrides = base // {
           override = base.passthru.function;
@@ -77,11 +100,11 @@ rec {
   # Output : are reqs satisfied? It's asserted.
   checkReqs = attrSet: argList: condList:
   (
-    foldr lib.and true
+    foldr and true
       (map (x: let name = (head x); in
 
         ((checkFlag attrSet name) ->
-        (foldr lib.and true
+        (foldr and true
         (map (y: let val=(getValue attrSet argList y); in
                 (val!=null) && (val!=false))
         (tail x))))) condList));
@@ -159,11 +182,11 @@ rec {
 
   closePropagationSlow = list: (uniqList {inputList = (innerClosePropagation [] list);});
 
-  # This is an optimisation of lib.closePropagation which avoids the O(n^2) behavior
+  # This is an optimisation of closePropagation which avoids the O(n^2) behavior
   # Using a list of derivations, it generates the full closure of the propagatedXXXBuildInputs
   # The ordering / sorting / comparison is done based on the `outPath`
   # attribute of each derivation.
-  # On some benchmarks, it performs up to 15 times faster than lib.closePropagation.
+  # On some benchmarks, it performs up to 15 times faster than closePropagation.
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast = list:
     builtins.map (x: x.val) (builtins.genericClosure {
@@ -250,10 +273,10 @@ rec {
   # foldArgs, composedArgsAndFun or applyAndFun. Example: composableDerivation in all-packages.nix
   mergeAttrByFunc = x: y:
     let
-          mergeAttrBy2 = { mergeAttrBy = lib.mergeAttrs; }
+          mergeAttrBy2 = { mergeAttrBy = mergeAttrs; }
                       // (maybeAttr "mergeAttrBy" {} x)
                       // (maybeAttr "mergeAttrBy" {} y); in
-    foldr lib.mergeAttrs {} [
+    foldr mergeAttrs {} [
       x y
       (mapAttrs ( a: v: # merge special names using given functions
           if x ? ${a}
@@ -273,9 +296,9 @@ rec {
 
   # sane defaults (same name as attr name so that inherit can be used)
   mergeAttrBy = # { buildInputs = concatList; [...]; passthru = mergeAttr; [..]; }
-    listToAttrs (map (n: nameValuePair n lib.concat)
+    listToAttrs (map (n: nameValuePair n concat)
       [ "nativeBuildInputs" "buildInputs" "propagatedBuildInputs" "configureFlags" "prePhases" "postAll" "patches" ])
-    // listToAttrs (map (n: nameValuePair n lib.mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
+    // listToAttrs (map (n: nameValuePair n mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
     // listToAttrs (map (n: nameValuePair n (a: b: "${a}\n${b}") ) [ "preConfigure" "postInstall" ])
   ;
 
@@ -283,7 +306,7 @@ rec {
       if isAttrs x then
           if x ? outPath then "derivation"
           else "attrs"
-      else if lib.isFunction x then "function"
+      else if isFunction x then "function"
       else if isList x then "list"
       else if x == true then "bool"
       else if x == false then "bool"
@@ -291,12 +314,13 @@ rec {
       else if isInt x then "int"
       else "string";
 
-  /* deprecated:
+  /**
+    # Deprecated
 
-     For historical reasons, imap has an index starting at 1.
+    For historical reasons, imap has an index starting at 1.
 
-     But for consistency with the rest of the library we want an index
+    But for consistency with the rest of the library we want an index
-     starting at zero.
+    starting at zero.
   */
   imap = imap1;
 
@@ -304,4 +328,47 @@ rec {
   fakeHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   fakeSha256 = "0000000000000000000000000000000000000000000000000000000000000000";
   fakeSha512 = "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    checkFlag
+    checkReqs
+    closePropagation
+    closePropagationFast
+    closePropagationSlow
+    condConcat
+    defaultMerge
+    defaultMergeArg
+    fakeHash
+    fakeSha256
+    fakeSha512
+    foldArgs
+    getValue
+    ifEnable
+    imap
+    innerClosePropagation
+    innerModifySumArgs
+    lazyGenericClosure
+    mapAttrsFlatten
+    maybeAttr
+    maybeAttrNullable
+    maybeEnv
+    mergeAttrBy
+    mergeAttrByFunc
+    mergeAttrsByFuncDefaults
+    mergeAttrsByFuncDefaultsClean
+    mergeAttrsConcatenateValues
+    mergeAttrsNoOverride
+    mergeAttrsWithFunc
+    modifySumArgs
+    nixType
+    nvs
+    setAttr
+    setAttrMerge
+    uniqList
+    uniqListExt
+    ;
 }

third_party/nixpkgs/lib/derivations.nix

@@ -1,7 +1,20 @@
 { lib }:
 
 let
-  inherit (lib) throwIfNot;
+  inherit (lib)
+    genAttrs
+    isString
+    throwIfNot
+    ;
+
+  showMaybeAttrPosPre = prefix: attrName: v:
+    let pos = builtins.unsafeGetAttrPos attrName v;
+    in if pos == null then "" else "${prefix}${pos.file}:${toString pos.line}:${toString pos.column}";
+
+  showMaybePackagePosPre = prefix: pkg:
+    if pkg?meta.position && isString pkg.meta.position
+    then "${prefix}${pkg.meta.position}"
+    else "";
 in
 {
   /*
@@ -64,6 +77,11 @@ in
       #
       # This can be used for adding package attributes, such as `tests`.
       passthru ? { }
+    , # Optional list of assumed outputs. Default: ["out"]
+      #
+      # This must match the set of outputs that the returned derivation has.
+      # You must use this when the derivation has multiple outputs.
+      outputs ? [ "out" ]
     }:
     let
       # These checks are strict in `drv` and some `drv` attributes, but the
@@ -71,11 +89,40 @@ in
       # Instead, the individual derivation attributes do depend on it.
       checked =
         throwIfNot (derivation.type or null == "derivation")
-          "lazySimpleDerivation: input must be a derivation."
+          "lazyDerivation: input must be a derivation."
           throwIfNot
-          (derivation.outputs == [ "out" ])
+          # NOTE: Technically we could require our outputs to be a subset of the
-          # Supporting multiple outputs should be a matter of inheriting more attrs.
+          # actual ones, or even leave them unchecked and fail on a lazy basis.
-          "The derivation ${derivation.name or "<unknown>"} has multiple outputs. This is not supported by lazySimpleDerivation yet. Support could be added, and be useful as long as the set of outputs is known in advance, without evaluating the actual derivation."
+          # However, consider the case where an output is added in the underlying
+          # derivation, such as dev. lazyDerivation would remove it and cause it
+          # to fail as a buildInputs item, without any indication as to what
+          # happened. Hence the more stringent condition. We could consider
+          # adding a flag to control this behavior if there's a valid case for it,
+          # but the documentation must have a note like this.
+          (derivation.outputs == outputs)
+          ''
+            lib.lazyDerivation: The derivation ${derivation.name or "<unknown>"} has outputs that don't match the assumed outputs.
+
+            Assumed outputs passed to lazyDerivation${showMaybeAttrPosPre ",\n    at " "outputs" args}:
+                ${lib.generators.toPretty { multiline = false; } outputs};
+
+            Actual outputs of the derivation${showMaybePackagePosPre ",\n    defined at " derivation}:
+                ${lib.generators.toPretty { multiline = false; } derivation.outputs}
+
+            If the outputs are known ahead of evaluating the derivation,
+            then update the lazyDerivation call to match the actual outputs, in the same order.
+            If lazyDerivation is passed a literal value, just change it to the actual outputs.
+            As a result it will work as before / as intended.
+
+            Otherwise, when the outputs are dynamic and can't be known ahead of time, it won't
+            be possible to add laziness, but lib.lazyDerivation may still be useful for trimming
+            the attributes.
+            If you want to keep trimming the attributes, make sure that the package is in a
+            variable (don't evaluate it twice!) and pass the variable and its outputs attribute
+            to lib.lazyDerivation. This largely defeats laziness, but keeps the trimming.
+            If none of the above works for you, replace the lib.lazyDerivation call by the
+            expression in the derivation argument.
+          ''
           derivation;
     in
     {
@@ -92,12 +139,15 @@ in
       # A fixed set of derivation values, so that `lazyDerivation` can return
       # its attrset before evaluating `derivation`.
       # This must only list attributes that are available on _all_ derivations.
-      inherit (checked) outputs out outPath outputName drvPath name system;
+      inherit (checked) outPath outputName drvPath name system;
+      inherit outputs;
 
       # The meta attribute can either be taken from the derivation, or if the
       # `lazyDerivation` caller knew a shortcut, be taken from there.
       meta = args.meta or checked.meta;
-    } // passthru;
+    }
+    // genAttrs outputs (outputName: checked.${outputName})
+    // passthru;
 
   /* Conditionally set a derivation attribute.
 

third_party/nixpkgs/lib/fileset/default.nix

@@ -1,5 +1,5 @@
 /*
-  <!-- This anchor is here for backwards compatibity -->
+  <!-- This anchor is here for backwards compatibility -->
   []{#sec-fileset}
 
   The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.

third_party/nixpkgs/lib/generators.nix

@@ -14,15 +14,58 @@
  * Documentation in the manual, #sec-generators
  */
 { lib }:
-with (lib).trivial;
+
 let
-  libStr = lib.strings;
+  inherit (lib)
-  libAttr = lib.attrsets;
+    addErrorContext
+    assertMsg
+    attrNames
+    concatLists
+    concatMapStringsSep
+    concatStrings
+    concatStringsSep
+    const
+    elem
+    escape
+    filter
+    flatten
+    foldl
+    functionArgs  # Note: not the builtin; considers `__functor` in attrsets.
+    gvariant
+    hasInfix
+    head
+    id
+    init
+    isAttrs
+    isBool
+    isDerivation
+    isFloat
+    isFunction    # Note: not the builtin; considers `__functor` in attrsets.
+    isInt
+    isList
+    isPath
+    isString
+    last
+    length
+    mapAttrs
+    mapAttrsToList
+    optionals
+    recursiveUpdate
+    replaceStrings
+    reverseList
+    splitString
+    tail
+    toList
+    ;
 
-  inherit (lib) isFunction;
+  inherit (lib.strings)
-in
+    escapeNixIdentifier
-
+    floatToString
-rec {
+    match
+    split
+    toJSON
+    typeOf
+    ;
 
   ## -- HELPER FUNCTIONS & DEFAULTS --
 
@@ -30,13 +73,13 @@ rec {
    * The builtin `toString` function has some strange defaults,
    * suitable for bash scripts but not much else.
    */
-  mkValueStringDefault = {}: v: with builtins;
+  mkValueStringDefault = {}: v:
     let err = t: v: abort
           ("generators.mkValueStringDefault: " +
            "${t} not supported: ${toPretty {} v}");
     in   if isInt      v then toString v
     # convert derivations to store paths
-    else if lib.isDerivation v then toString v
+    else if isDerivation v then toString v
     # we default to not quoting strings
     else if isString   v then v
     # isString returns "1", which is not a good default
@@ -53,7 +96,7 @@ rec {
     # Floats currently can't be converted to precise strings,
     # condition warning on nix version once this isn't a problem anymore
     # See https://github.com/NixOS/nix/pull/3480
-    else if isFloat    v then libStr.floatToString v
+    else if isFloat    v then floatToString v
     else err "this value is" (toString v);
 
 
@@ -69,7 +112,7 @@ rec {
   mkKeyValueDefault = {
     mkValueString ? mkValueStringDefault {}
   }: sep: k: v:
-    "${libStr.escape [sep] k}${sep}${mkValueString v}";
+    "${escape [sep] k}${sep}${mkValueString v}";
 
 
   ## -- FILE FORMAT GENERATORS --
@@ -86,9 +129,9 @@ rec {
   }:
   let mkLine = k: v: indent + mkKeyValue k v + "\n";
       mkLines = if listsAsDuplicateKeys
-        then k: v: map (mkLine k) (if lib.isList v then v else [v])
+        then k: v: map (mkLine k) (if isList v then v else [v])
         else k: v: [ (mkLine k v) ];
-  in attrs: libStr.concatStrings (lib.concatLists (libAttr.mapAttrsToList mkLines attrs));
+  in attrs: concatStrings (concatLists (mapAttrsToList mkLines attrs));
 
 
   /* Generate an INI-style config file from an
@@ -113,7 +156,7 @@ rec {
    */
   toINI = {
     # apply transformations (e.g. escapes) to section names
-    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
+    mkSectionName ? (name: escape [ "[" "]" ] name),
     # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
     # allow lists as values for duplicate keys
@@ -122,8 +165,8 @@ rec {
     let
         # map function to string for each key val
         mapAttrsToStringsSep = sep: mapFn: attrs:
-          libStr.concatStringsSep sep
+          concatStringsSep sep
-            (libAttr.mapAttrsToList mapFn attrs);
+            (mapAttrsToList mapFn attrs);
         mkSection = sectName: sectValues: ''
           [${mkSectionName sectName}]
         '' + toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues;
@@ -164,7 +207,7 @@ rec {
    */
   toINIWithGlobalSection = {
     # apply transformations (e.g. escapes) to section names
-    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
+    mkSectionName ? (name: escape [ "[" "]" ] name),
     # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
     # allow lists as values for duplicate keys
@@ -195,12 +238,11 @@ rec {
    *>   name = "edolstra"
    */
   toGitINI = attrs:
-    with builtins;
     let
       mkSectionName = name:
         let
-          containsQuote = libStr.hasInfix ''"'' name;
+          containsQuote = hasInfix ''"'' name;
-          sections = libStr.splitString "." name;
+          sections = splitString "." name;
           section = head sections;
           subsections = tail sections;
           subsection = concatStringsSep "." subsections;
@@ -220,19 +262,19 @@ rec {
       # generation for multiple ini values
       mkKeyValue = k: v:
         let mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = " k;
-        in concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (lib.toList v));
+        in concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (toList v));
 
       # converts { a.b.c = 5; } to { "a.b".c = 5; } for toINI
       gitFlattenAttrs = let
         recurse = path: value:
-          if isAttrs value && !lib.isDerivation value then
+          if isAttrs value && !isDerivation value then
-            lib.mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
+            mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
           else if length path > 1 then {
-            ${concatStringsSep "." (lib.reverseList (tail path))}.${head path} = value;
+            ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
           } else {
             ${head path} = value;
           };
-      in attrs: lib.foldl lib.recursiveUpdate { } (lib.flatten (recurse [ ] attrs));
+      in attrs: foldl recursiveUpdate { } (flatten (recurse [ ] attrs));
 
       toINI_ = toINI { inherit mkKeyValue mkSectionName; };
     in
@@ -240,25 +282,12 @@ rec {
 
   # mkKeyValueDefault wrapper that handles dconf INI quirks.
   # The main differences of the format is that it requires strings to be quoted.
-  mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (lib.gvariant.mkValue v); } "=";
+  mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (gvariant.mkValue v); } "=";
 
   # Generates INI in dconf keyfile style. See https://help.gnome.org/admin/system-admin-guide/stable/dconf-keyfiles.html.en
   # for details.
   toDconfINI = toINI { mkKeyValue = mkDconfKeyValue; };
 
-  /* Generates JSON from an arbitrary (non-function) value.
-    * For more information see the documentation of the builtin.
-    */
-  toJSON = {}: builtins.toJSON;
-
-
-  /* YAML has been a strict superset of JSON since 1.2, so we
-    * use toJSON. Before it only had a few differences referring
-    * to implicit typing rules, so it should work with older
-    * parsers as well.
-    */
-  toYAML = toJSON;
-
   withRecursion =
     {
       /* If this option is not null, the given value will stop evaluating at a certain depth */
@@ -266,7 +295,7 @@ rec {
       /* If this option is true, an error will be thrown, if a certain given depth is exceeded */
     , throwOnDepthLimit ? true
     }:
-      assert builtins.isInt depthLimit;
+      assert isInt depthLimit;
       let
         specialAttrs = [
           "__functor"
@@ -275,7 +304,7 @@ rec {
           "__pretty"
         ];
         stepIntoAttr = evalNext: name:
-          if builtins.elem name specialAttrs
+          if elem name specialAttrs
             then id
             else evalNext;
         transform = depth:
@@ -284,7 +313,7 @@ rec {
               then throw "Exceeded maximum eval-depth limit of ${toString depthLimit} while trying to evaluate with `generators.withRecursion'!"
               else const "<unevaluated>"
           else id;
-        mapAny = with builtins; depth: v:
+        mapAny = depth: v:
           let
             evalNext = x: mapAny (depth + 1) (transform (depth + 1) x);
           in
@@ -311,9 +340,8 @@ rec {
     indent ? ""
   }:
     let
-    go = indent: v: with builtins;
+    go = indent: v:
-    let     isPath   = v: typeOf v == "path";
+    let     introSpace = if multiline then "\n${indent}  " else " ";
-            introSpace = if multiline then "\n${indent}  " else " ";
             outroSpace = if multiline then "\n${indent}" else " ";
     in if   isInt      v then toString v
     # toString loses precision on floats, so we use toJSON instead. This isn't perfect
@@ -322,16 +350,16 @@ rec {
     else if isFloat    v then builtins.toJSON v
     else if isString   v then
       let
-        lines = filter (v: ! isList v) (builtins.split "\n" v);
+        lines = filter (v: ! isList v) (split "\n" v);
-        escapeSingleline = libStr.escape [ "\\" "\"" "\${" ];
+        escapeSingleline = escape [ "\\" "\"" "\${" ];
-        escapeMultiline = libStr.replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
+        escapeMultiline = replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
         singlelineResult = "\"" + concatStringsSep "\\n" (map escapeSingleline lines) + "\"";
         multilineResult = let
           escapedLines = map escapeMultiline lines;
           # The last line gets a special treatment: if it's empty, '' is on its own line at the "outer"
           # indentation level. Otherwise, '' is appended to the last line.
-          lastLine = lib.last escapedLines;
+          lastLine = last escapedLines;
-        in "''" + introSpace + concatStringsSep introSpace (lib.init escapedLines)
+        in "''" + introSpace + concatStringsSep introSpace (init escapedLines)
                 + (if lastLine == "" then outroSpace else introSpace + lastLine) + "''";
       in
         if multiline && length lines > 1 then multilineResult else singlelineResult
@@ -342,11 +370,11 @@ rec {
     else if isList     v then
       if v == [] then "[ ]"
       else "[" + introSpace
-        + libStr.concatMapStringsSep introSpace (go (indent + "  ")) v
+        + concatMapStringsSep introSpace (go (indent + "  ")) v
         + outroSpace + "]"
     else if isFunction v then
-      let fna = lib.functionArgs v;
+      let fna = functionArgs v;
-          showFnas = concatStringsSep ", " (libAttr.mapAttrsToList
+          showFnas = concatStringsSep ", " (mapAttrsToList
                        (name: hasDefVal: if hasDefVal then name + "?" else name)
                        fna);
       in if fna == {}    then "<function>"
@@ -359,10 +387,10 @@ rec {
       else if v ? type && v.type == "derivation" then
         "<derivation ${v.name or "???"}>"
       else "{" + introSpace
-          + libStr.concatStringsSep introSpace (libAttr.mapAttrsToList
+          + concatStringsSep introSpace (mapAttrsToList
               (name: value:
-                "${libStr.escapeNixIdentifier name} = ${
+                "${escapeNixIdentifier name} = ${
-                  builtins.addErrorContext "while evaluating an attribute `${name}`"
+                  addErrorContext "while evaluating an attribute `${name}`"
                     (go (indent + "  ") value)
                 };") v)
         + outroSpace + "}"
@@ -371,9 +399,7 @@ rec {
 
   # PLIST handling
   toPlist = {}: v: let
-    isFloat = builtins.isFloat or (x: false);
+    expr = ind: x:
-    isPath = x: builtins.typeOf x == "path";
-    expr = ind: x:  with builtins;
       if x == null  then "" else
       if isBool x   then bool ind x else
       if isInt x    then int ind x else
@@ -394,23 +420,23 @@ rec {
 
     indent = ind: expr "\t${ind}";
 
-    item = ind: libStr.concatMapStringsSep "\n" (indent ind);
+    item = ind: concatMapStringsSep "\n" (indent ind);
 
-    list = ind: x: libStr.concatStringsSep "\n" [
+    list = ind: x: concatStringsSep "\n" [
       (literal ind "<array>")
       (item ind x)
       (literal ind "</array>")
     ];
 
-    attrs = ind: x: libStr.concatStringsSep "\n" [
+    attrs = ind: x: concatStringsSep "\n" [
       (literal ind "<dict>")
       (attr ind x)
       (literal ind "</dict>")
     ];
 
     attr = let attrFilter = name: value: name != "_module" && value != null;
-    in ind: x: libStr.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList
+    in ind: x: concatStringsSep "\n" (flatten (mapAttrsToList
-      (name: value: lib.optionals (attrFilter name value) [
+      (name: value: optionals (attrFilter name value) [
       (key "\t${ind}" name)
       (expr "\t${ind}" value)
     ]) x));
@@ -426,11 +452,10 @@ ${expr "" v}
    * the Natural type.
   */
   toDhall = { }@args: v:
-    with builtins;
+    let concatItems = concatStringsSep ", ";
-    let concatItems = lib.strings.concatStringsSep ", ";
     in if isAttrs v then
       "{ ${
-        concatItems (lib.attrsets.mapAttrsToList
+        concatItems (mapAttrsToList
           (key: value: "${key} = ${toDhall args value}") v)
       } }"
     else if isList v then
@@ -444,7 +469,7 @@ ${expr "" v}
     else if v == null then
       abort "generators.toDhall: cannot convert a null to Dhall"
     else
-      builtins.toJSON v;
+      toJSON v;
 
   /*
    Translate a simple Nix expression to Lua representation with occasional
@@ -488,7 +513,6 @@ ${expr "" v}
     /* Interpret as variable bindings */
     asBindings ? false,
   }@args: v:
-    with builtins;
     let
       innerIndent = "${indent}  ";
       introSpace = if multiline then "\n${innerIndent}" else " ";
@@ -501,9 +525,9 @@ ${expr "" v}
       isLuaInline = { _type ? null, ... }: _type == "lua-inline";
 
       generatedBindings =
-          assert lib.assertMsg (badVarNames == []) "Bad Lua var names: ${toPretty {} badVarNames}";
+          assert assertMsg (badVarNames == []) "Bad Lua var names: ${toPretty {} badVarNames}";
-          libStr.concatStrings (
+          concatStrings (
-            lib.attrsets.mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v
+            mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v
             );
 
       # https://en.wikibooks.org/wiki/Lua_Programming/variable#Variable_names
@@ -515,7 +539,7 @@ ${expr "" v}
     else if v == null then
       "nil"
     else if isInt v || isFloat v || isString v || isBool v then
-      builtins.toJSON v
+      toJSON v
     else if isList v then
       (if v == [ ] then "{}" else
       "{${introSpace}${concatItems (map (value: "${toLua innerArgs value}") v)}${outroSpace}}")
@@ -525,11 +549,11 @@ ${expr "" v}
           "(${v.expr})"
         else if v == { } then
           "{}"
-        else if libAttr.isDerivation v then
+        else if isDerivation v then
           ''"${toString v}"''
         else
           "{${introSpace}${concatItems (
-            lib.attrsets.mapAttrsToList (key: value: "[${builtins.toJSON key}] = ${toLua innerArgs value}") v
+            mapAttrsToList (key: value: "[${toJSON key}] = ${toLua innerArgs value}") v
             )}${outroSpace}}"
       )
     else
@@ -542,4 +566,37 @@ ${expr "" v}
      mkLuaInline :: String -> AttrSet
   */
   mkLuaInline = expr: { _type = "lua-inline"; inherit expr; };
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    mkDconfKeyValue
+    mkKeyValueDefault
+    mkLuaInline
+    mkValueStringDefault
+    toDconfINI
+    toDhall
+    toGitINI
+    toINI
+    toINIWithGlobalSection
+    toKeyValue
+    toLua
+    toPlist
+    toPretty
+    withRecursion
+    ;
+
+  /* Generates JSON from an arbitrary (non-function) value.
+    * For more information see the documentation of the builtin.
+    */
+  toJSON = {}: toJSON;
+
+  /* YAML has been a strict superset of JSON since 1.2, so we
+    * use toJSON. Before it only had a few differences referring
+    * to implicit typing rules, so it should work with older
+    * parsers as well.
+    */
+  toYAML = {}: toJSON;
 }

third_party/nixpkgs/lib/kernel.nix

@@ -1,6 +1,8 @@
 { lib }:
 
-with lib;
+let
+  inherit (lib) mkIf versionAtLeast versionOlder;
+in
 {
 
 
@@ -14,9 +16,8 @@ with lib;
   unset    = { tristate    = null; optional = false; };
   freeform = x: { freeform = x; optional = false; };
 
-  /*
+
-    Common patterns/legacy used in common-config/hardened/config.nix
+  #  Common patterns/legacy used in common-config/hardened/config.nix
-   */
   whenHelpers = version: {
     whenAtLeast = ver: mkIf (versionAtLeast version ver);
     whenOlder   = ver: mkIf (versionOlder version ver);