Merge staging-next into staging

.git-blame-ignore-revs

@@ -209,3 +209,6 @@ ce21e97a1f20dee15da85c084f9d1148d84f853b
 
 # treewide: migrate packages to pkgs/by-name, take 1
 571c71e6f73af34a229414f51585738894211408
+
+# format files with nixfmt (#347275)
+adb9714bd909df283c66bbd641bd631ff50a4260

.github/workflows/check-shell.yml

@@ -2,6 +2,9 @@ name: "Check shell"
 
 on:
   pull_request_target:
+    paths:
+      - 'shell.nix'
+      - './ci/**'
 
 permissions: {}
 

.github/workflows/eval.yml

@@ -1,6 +1,16 @@
 name: Eval
 
-on: pull_request_target
+on:
+  pull_request_target:
+  push:
+    # Keep this synced with ci/request-reviews/dev-branches.txt
+    branches:
+      - master
+      - staging
+      - release-*
+      - staging-*
+      - haskell-updates
+      - python-updates
 
 permissions:
   contents: read
@@ -11,6 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       mergedSha: ${{ steps.merged.outputs.mergedSha }}
+      baseSha: ${{ steps.baseSha.outputs.baseSha }}
       systems: ${{ steps.systems.outputs.systems }}
     steps:
       # Important: Because of `pull_request_target`, this doesn't check out the PR,
@@ -24,7 +35,13 @@ jobs:
         id: merged
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_EVENT: ${{ github.event_name }}
         run: |
+          case "$GH_EVENT" in
+            push)
+              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+              ;;
+            pull_request_target)
               if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
                 echo "Checking the merge commit $mergedSha"
                 echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
@@ -32,6 +49,8 @@ jobs:
                 # Skipping so that no notifications are sent
                 echo "Skipping the rest..."
               fi
+              ;;
+          esac
           rm -rf base
       - name: Check out the PR at the test merge commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -39,8 +58,16 @@ jobs:
         if: steps.merged.outputs.mergedSha
         with:
           ref: ${{ steps.merged.outputs.mergedSha }}
+          fetch-depth: 2
           path: nixpkgs
 
+      - name: Determine base commit
+        if: github.event_name == 'pull_request_target' && steps.merged.outputs.mergedSha
+        id: baseSha
+        run: |
+          baseSha=$(git -C nixpkgs rev-parse HEAD^1)
+          echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"
+
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         if: steps.merged.outputs.mergedSha
@@ -105,6 +132,8 @@ jobs:
     name: Process
     runs-on: ubuntu-latest
     needs: [ outpaths, attrs ]
+    outputs:
+      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}
     steps:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -124,18 +153,93 @@ jobs:
       - name: Combine all output paths and eval stats
         run: |
           nix-build nixpkgs/ci -A eval.combine \
-            --arg resultsDir ./intermediate
+            --arg resultsDir ./intermediate \
+            -o prResult
 
       - name: Upload the combined results
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: result
-          path: result/*
+          path: prResult/*
 
+      - name: Get base run id
+        if: needs.attrs.outputs.baseSha
+        id: baseRunId
+        run: |
+          # Get the latest eval.yml workflow run for the PR's base commit
+          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
+            -f head_sha="$BASE_SHA" \
+            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
+            || [[ -z "$run" ]]; then
+            echo "Could not find an eval.yml workflow run for $BASE_SHA, cannot make comparison"
+            exit 0
+          fi
+          echo "Comparing against $(jq .html_url <<< "$run")"
+          runId=$(jq .id <<< "$run")
+          conclusion=$(jq -r .conclusion <<< "$run")
 
-      # TODO: Run this workflow also on `push` (on at least the main development branches)
+          while [[ "$conclusion" == null ]]; do
-      # Then add an extra step here that waits for the base branch (not the merge base, because that could be very different)
+            echo "Workflow not done, waiting 10 seconds before checking again"
-      # to have completed the eval, then use
+            sleep 10
-      # gh api --method GET /repos/NixOS/nixpkgs/actions/workflows/eval.yml/runs -f head_sha=<BASE>
+            conclusion=$(gh api /repos/"$REPOSITORY"/actions/runs/"$runId" --jq '.conclusion')
-      # and follow it to the artifact results, where you can then download the outpaths.json from the base branch
+          done
-      # That can then be used to compare the number of changed paths, get evaluation stats and ping appropriate reviewers
+
+          if [[ "$conclusion" != "success" ]]; then
+            echo "Workflow was not successful, cannot make comparison"
+            exit 0
+          fi
+
+          echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"
+        env:
+          REPOSITORY: ${{ github.repository }}
+          BASE_SHA: ${{ needs.attrs.outputs.baseSha }}
+          GH_TOKEN: ${{ github.token }}
+
+      - uses: actions/download-artifact@v4
+        if: steps.baseRunId.outputs.baseRunId
+        with:
+          name: result
+          path: baseResult
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.baseRunId.outputs.baseRunId }}
+
+      - name: Compare against the base branch
+        if: steps.baseRunId.outputs.baseRunId
+        run: |
+          nix-build nixpkgs/ci -A eval.compare \
+            --arg beforeResultDir ./baseResult \
+            --arg afterResultDir ./prResult \
+            -o comparison
+
+          # TODO: Request reviews from maintainers for packages whose files are modified in the PR
+
+      - name: Upload the combined results
+        if: steps.baseRunId.outputs.baseRunId
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: comparison
+          path: comparison/*
+
+  # Separate job to have a very tightly scoped PR write token
+  tag:
+    name: Tag
+    runs-on: ubuntu-latest
+    needs: process
+    if: needs.process.outputs.baseRunId
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download process result
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: comparison
+          path: comparison
+
+      - name: Tagging pull request
+        run: |
+          gh api \
+            --method POST \
+            /repos/${{ github.repository }}/issues/${{ github.event.number }}/labels \
+            --input <(jq -c '{ labels: .labels }' comparison/changed-paths.json)
+        env:
+          GH_TOKEN: ${{ github.token }}

ci/eval/compare.jq

@@ -0,0 +1,152 @@
+# Turns
+#
+#   {
+#     "hello.aarch64-linux": "a",
+#     "hello.x86_64-linux": "b",
+#     "hello.aarch64-darwin": "c",
+#     "hello.x86_64-darwin": "d"
+#   }
+#
+# into
+#
+#   {
+#     "hello": {
+#       "linux": {
+#         "aarch64": "a",
+#         "x86_64": "b"
+#       },
+#       "darwin": {
+#         "aarch64": "c",
+#         "x86_64": "d"
+#       }
+#     }
+#   }
+#
+# while filtering out any attribute paths that don't match this pattern
+def expand_system:
+  to_entries
+  | map(
+    .key |= split(".")
+    | select(.key | length > 1)
+    | .double = (.key[-1] | split("-"))
+    | select(.double | length == 2)
+  )
+  | group_by(.key[0:-1])
+  | map(
+    {
+      key: .[0].key[0:-1] | join("."),
+      value:
+        group_by(.double[1])
+        | map(
+          {
+            key: .[0].double[1],
+            value: map(.key = .double[0]) | from_entries
+          }
+        )
+        | from_entries
+    })
+  | from_entries
+  ;
+
+# Transposes
+#
+#   {
+#     "a": [ "x", "y" ],
+#     "b": [ "x" ],
+#   }
+#
+# into
+#
+#   {
+#     "x": [ "a", "b" ],
+#     "y": [ "a" ]
+#   }
+def transpose:
+  [
+    to_entries[]
+    | {
+      key: .key,
+      value: .value[]
+    }
+  ]
+  | group_by(.value)
+  | map({
+    key: .[0].value,
+    value: map(.key)
+  })
+  | from_entries
+  ;
+
+# Computes the key difference for two objects:
+# {
+#   added: [ <keys only in the second object> ],
+#   removed: [ <keys only in the first object> ],
+#   changed: [ <keys with different values between the two objects> ],
+# }
+#
+def diff($before; $after):
+  {
+    added: $after | delpaths($before | keys | map([.])) | keys,
+    removed: $before | delpaths($after | keys | map([.])) | keys,
+    changed:
+      $before
+      | to_entries
+      | map(
+        $after."\(.key)" as $after2
+        | select(
+          # Filter out attributes that don't exist anymore
+          ($after2 != null)
+          and
+          # Filter out attributes that are the same as the new value
+          (.value != $after2)
+        )
+        | .key
+      )
+  }
+  ;
+
+($before[0] | expand_system) as $before
+| ($after[0] | expand_system) as $after
+| .attrdiff = diff($before; $after)
+| .rebuildsByKernel = (
+  .attrdiff.changed
+  | map({
+    key: .,
+    value: diff($before."\(.)"; $after."\(.)").changed
+  })
+  | from_entries
+  | transpose
+)
+| .rebuildCountByKernel = (
+  .rebuildsByKernel
+  | with_entries(.value |= length)
+  | pick(.linux, .darwin)
+  | {
+    linux: (.linux // 0),
+    darwin: (.darwin // 0),
+  }
+)
+| .labels = (
+  .rebuildCountByKernel
+  | to_entries
+  | map(
+    "10.rebuild-\(.key): " +
+      if .value == 0 then
+        "0"
+      elif .value <= 10 then
+        "1-10"
+      elif .value <= 100 then
+        "11-100"
+      elif .value <= 500 then
+        "101-500"
+      elif .value <= 1000 then
+        "501-1000"
+      elif .value <= 2500 then
+        "1001-2500"
+      elif .value <= 5000 then
+        "2501-5000"
+      else
+        "5000+"
+      end
+  )
+)

ci/eval/default.nix

@@ -50,7 +50,11 @@ let
         export GC_INITIAL_HEAP_SIZE=4g
         command time -v \
           nix-instantiate --eval --strict --json --show-trace \
-          $src/pkgs/top-level/release-attrpaths-superset.nix -A paths \
+            "$src/pkgs/top-level/release-attrpaths-superset.nix" \
+            -A paths \
+            -I "$src" \
+            --option restrict-eval true \
+            --option allow-import-from-derivation false \
             --arg enableWarnings false > $out/paths.json
         mv "$supportedSystemsPath" $out/systems.json
       '';
@@ -84,6 +88,8 @@ let
         set +e
         command time -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
           nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
+          --option restrict-eval true \
+          --option allow-import-from-derivation false \
           --query --available \
           --no-name --attr-path --out-path \
           --show-trace \
@@ -93,6 +99,8 @@ let
           --arg systems "[ \"$system\" ]" \
           --arg checkMeta ${lib.boolToString checkMeta} \
           --arg includeBroken ${lib.boolToString includeBroken} \
+          -I ${nixpkgs} \
+          -I ${attrpathFile} \
           > "$outputDir/result/$myChunk"
         exitCode=$?
         set -e
@@ -238,6 +246,24 @@ let
           jq -s from_entries > $out/stats.json
       '';
 
+  compare =
+    { beforeResultDir, afterResultDir }:
+    runCommand "compare"
+      {
+        nativeBuildInputs = [
+          jq
+        ];
+      }
+      ''
+        mkdir $out
+        jq -n -f ${./compare.jq} \
+          --slurpfile before ${beforeResultDir}/outpaths.json \
+          --slurpfile after ${afterResultDir}/outpaths.json \
+          > $out/changed-paths.json
+
+        # TODO: Compare eval stats
+      '';
+
   full =
     {
       # Whether to evaluate just a single system, by default all are evaluated
@@ -268,6 +294,7 @@ in
     attrpathsSuperset
     singleSystem
     combine
+    compare
     # The above three are used by separate VMs in a GitHub workflow,
     # while the below is intended for testing on a single local machine
     full

ci/request-reviews/dev-branches.txt

@@ -1,5 +1,6 @@
 # Trusted development branches:
 # These generally require PRs to update and are built by Hydra.
+# Keep this synced with the branches in .github/workflows/eval.yml
 master
 staging
 release-*

lib/systems/default.nix

@@ -6,9 +6,9 @@ let
     filterAttrs
     foldl
     hasInfix
+    isAttrs
     isFunction
     isList
-    isString
     mapAttrs
     optional
     optionalAttrs
@@ -55,24 +55,34 @@ let
   */
   flakeExposed = import ./flake-systems.nix { };
 
+  # Turn localSystem or crossSystem, which could be system-string or attrset, into
+  # attrset.
+  systemToAttrs = systemOrArgs:
+    if isAttrs systemOrArgs then systemOrArgs else { system = systemOrArgs; };
+
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
   #
   # `parsed` is inferred from args, both because there are two options with one
   # clearly preferred, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
-  elaborate = args': let
+  elaborate = systemOrArgs: let
-    args = if isString args' then { system = args'; }
+    allArgs = systemToAttrs systemOrArgs;
-           else args';
+
+    # Those two will always be derived from "config", if given, so they should NOT
+    # be overridden further down with "// args".
+    args = builtins.removeAttrs allArgs [ "parsed" "system" ];
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
     rust = args.rust or args.rustc or {};
 
     final = {
       # Prefer to parse `config` as it is strictly more informative.
-      parsed = parse.mkSystemFromString (if args ? config then args.config else args.system);
+      parsed = parse.mkSystemFromString (args.config or allArgs.system);
-      # Either of these can be losslessly-extracted from `parsed` iff parsing succeeds.
+      # This can be losslessly-extracted from `parsed` iff parsing succeeds.
       system = parse.doubleFromSystem final.parsed;
+      # TODO: This currently can't be losslessly-extracted from `parsed`, for example
+      # because of -mingw32.
       config = parse.tripleFromSystem final.parsed;
       # Determine whether we can execute binaries built for the provided platform.
       canExecute = platform:
@@ -435,5 +445,6 @@ in
     inspect
     parse
     platforms
+    systemToAttrs
     ;
 }

lib/tests/systems.nix

@@ -78,6 +78,18 @@ lib.runTests (
     expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux" // { something = "extra"; });
     expected = null;
   };
+  test_elaborate_config_over_system = {
+    expr = (lib.systems.elaborate { config = "i686-unknown-linux-gnu"; system = "x86_64-linux"; }).system;
+    expected = "i686-linux";
+  };
+  test_elaborate_config_over_parsed = {
+    expr = (lib.systems.elaborate { config = "i686-unknown-linux-gnu"; parsed = (lib.systems.elaborate "x86_64-linux").parsed; }).parsed.cpu.arch;
+    expected = "i686";
+  };
+  test_elaborate_system_over_parsed = {
+    expr = (lib.systems.elaborate { system = "i686-linux"; parsed = (lib.systems.elaborate "x86_64-linux").parsed; }).parsed.cpu.arch;
+    expected = "i686";
+  };
 }
 
 # Generate test cases to assert that a change in any non-function attribute makes a platform unequal

nixos/doc/manual/redirects.json

@@ -1871,6 +1871,18 @@
   "sec-release-24.11-wiki": [
     "release-notes.html#sec-release-24.11-wiki"
   ],
+  "sec-release-24.11-lib": [
+    "release-notes.html#sec-release-24.11-lib"
+  ],
+  "sec-release-24.11-lib-breaking": [
+    "release-notes.html#sec-release-24.11-lib-breaking"
+  ],
+  "sec-release-24.11-lib-additions-improvements": [
+    "release-notes.html#sec-release-24.11-lib-additions-improvements"
+  ],
+  "sec-release-24.11-lib-deprecations": [
+    "release-notes.html#sec-release-24.11-lib-deprecations"
+  ],
   "sec-release-24.05": [
     "release-notes.html#sec-release-24.05"
   ],

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -797,10 +797,6 @@
   not the `hare` package, should be added to `nativeBuildInputs` when building
   Hare programs.
 
-- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
-
-- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
-
 - `virtualisation.docker.liveRestore` has been renamed to `virtualisation.docker.daemon.settings."live-restore"` and turned off by default for state versions of at least 24.11.
 
 - Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
@@ -977,6 +973,57 @@ To provide some examples:
 
 Note that this also allows writing overlays that explicitly apply to multiple boards.
 
+## Nixpkgs Library {#sec-release-24.11-lib}
+
+### Breaking changes {#sec-release-24.11-lib-breaking}
+
+- [`lib.escapeShellArg`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.escapeShellArg) and [`lib.escapeShellArgs`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.escapeShellArgs): Arguments that don't need to be escaped won't be anymore, which is not breaking according to the functions documentation, but it can cause breakages if used for the non-intended use cases.
+- [`lib.warn msg val`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warn) (and its relatives [`lib.warnIf`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warnIf) and [`lib.warnIfNot`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warnIfNot)) now require `msg` to be a string to match the behavior of the new [`builtins.warn`](https://nix.dev/manual/nix/2.25/language/builtins.html?highlight=warn#builtins-warn).
+- `lib.mdDoc`: Removed after deprecation in the previous release.
+
+### Additions and Improvements {#sec-release-24.11-lib-additions-improvements}
+
+New and extended interfaces:
+- [`lib.fromHexString`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.fromHexString): Convert a hexadecimal string to it's integer representation.
+- `lib.network.ipv6.fromString`: Parse an IPv6 address.
+- [`lib.getLicenseFromSpdxIdOr`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.getLicenseFromSpdxIdOr): Get the corresponding attribute in `lib.licenses` from an SPDX ID or fall back to the given default value.
+- [`lib.licensesSpdx`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.licensesSpdx): Mapping of SPDX ID to the attributes in `lib.licenses`.
+- [`lib.getFirstOutput`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getFirstOutput): Like `getOutput` but with a list of fallback output names.
+- [`lib.getInclude`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getInclude) and [`lib.getStatic`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getStatic): Get a package’s `include`/`static` output.
+- [`lib.trim`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.trim) and [`lib.trimWith`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.trimWith): Remove leading and trailing whitespace from a string.
+- [`lib.meta.defaultPriority`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.defaultPriority): The default priority of packages in Nix.
+- [`lib.toExtension`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.toExtension): Convert to an extending function (overlay).
+- `lib.fetchers.normalizeHash`: Convert an attrset containing one of `hash`, `sha256` or `sha512` into one containing `outputHash{,Algo}` as accepted by `mkDerivation`.
+- `lib.fetchers.withNormalizedHash`: Wraps a function which accepts `outputHash{,Algo}` into one which accepts `hash`, `sha256` or `sha512`.
+- Various builtins are now reexported in a more standard way:
+  - `lib.map` -> `lib.lists.map` -> `builtins.map`
+  - `lib.intersectAttrs` -> `lib.attrsets.intersectAttrs` -> `builtins.intersectAttrs`
+  - `lib.removeAttrs` -> `lib.attrsets.removeAttrs` -> `builtins.removeAttrs`
+  - `lib.match` -> `lib.strings.match` -> `builtins.match`
+  - `lib.split` -> `lib.strings.split` -> `builtins.split`
+  - `lib.typeOf` -> `builtins.typeOf`
+  - `lib.unsafeGetAttrPos` -> `builtins.unsafeGetAttrPos`
+- [`lib.cli.toGNUCommandLine`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.cli.toGNUCommandLine) now supports the `optionValueSeparator` argument attribute to control the key-value separator for arguments.
+
+Documentation improvements:
+- Much of the documentation has been migrated to the [standard doc-comment format](https://github.com/NixOS/rfcs/pull/145), including [`lib.derivations`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-derivations), [`lib.fixedPoints`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-fixedPoints), [`lib.gvariant`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-gvariant), [`lib.filesystem`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-filesystem), [`lib.strings`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-strings), [`lib.meta`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-meta).
+- [`lib.generators` documentation](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-generators) is now improved and rendered in the manual.
+- [`lib.cli` documentation](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-cli) is now improved and rendered in the manual.
+- [`lib.composeExtensions`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.composeExtensions) and [`lib.composeManyExtensions`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.composeManyExtensions) documentation is now improved.
+- [`lib.importTOML`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.importTOML) and [`lib.importJSON`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.importJSON)'s documentation now have an example.
+
+Module System:
+- `lib.importApply`: New function, imports a Nix expression file much like the module system would, after passing an extra positional argument to the function in the file.
+- Improve error message when accessing an option that isn't defined.
+- `lib.types.anything`: Don't fail to merge when specifying the same list multiple times.
+- Improve error when loading a flake as a module.
+
+### Deprecations {#sec-release-24.11-lib-deprecations}
+
+- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
+- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
+- `lib.isInOldestRelease`: Renamed to [`oldestSupportedReleaseIsAtLeast`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.oldestSupportedReleaseIsAtLeast) and deprecated.
+
 ## NixOS Wiki {#sec-release-24.11-wiki}
 
 The official NixOS Wiki at [wiki.nixos.org](https://wiki.nixos.org/) was launched in April 2024, featuring

nixos/modules/image/images.nix

@@ -8,7 +8,21 @@
 let
   inherit (lib) types;
 
-  imageModules = { };
+  imageModules = {
+    azure = [ ../virtualisation/azure-image.nix ];
+    digital-ocean = [ ../virtualisation/digital-ocean-image.nix ];
+    google-compute = [ ../virtualisation/google-compute-image.nix ];
+    hyperv = [ ../virtualisation/hyperv-image.nix ];
+    linode = [ ../virtualisation/linode-image.nix ];
+    lxc = [ ../virtualisation/lxc-container.nix ];
+    lxc-metadata = [ ../virtualisation/lxc-image-metadata.nix ];
+    oci = [ ../virtualisation/oci-image.nix ];
+    proxmox = [ ../virtualisation/proxmox-image.nix ];
+    kubevirt = [ ../virtualisation/kubevirt.nix ];
+    vagrant-virtualbox = [ ../virtualisation/vagrant-virtualbox-image.nix ];
+    virtualbox = [ ../virtualisation/virtualbox-image.nix ];
+    vmware = [ ../virtualisation/vmware-image.nix ];
+  };
   imageConfigs = lib.mapAttrs (
     name: modules:
     extendModules {

nixos/modules/misc/version.nix

@@ -36,14 +36,13 @@ let
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
-      ANSI_COLOR = optionalString isNixos "1;34";
+      ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
       IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
-      DEFAULT_HOSTNAME = config.networking.fqdnOrHostName;
+      DEFAULT_HOSTNAME = config.system.nixos.distroId;
-      SUPPORT_END = "2025-06-30";
+    } // cfg.extraOSReleaseArgs;
-    };
 
   initrdReleaseContents = (removeAttrs osReleaseContents [ "BUILD_ID" ]) // {
     PRETTY_NAME = "${osReleaseContents.PRETTY_NAME} (Initrd)";
@@ -143,6 +142,26 @@ in
         default = "NixOS";
         description = "The name of the operating system vendor";
       };
+
+      extraOSReleaseArgs = mkOption {
+        internal = true;
+        type = types.attrsOf types.str;
+        default = { };
+        description = "Additional attributes to be merged with the /etc/os-release generator.";
+        example = {
+          ANSI_COLOR = "1;31";
+        };
+      };
+
+      extraLSBReleaseArgs = mkOption {
+        internal = true;
+        type = types.attrsOf types.str;
+        default = { };
+        description = "Additional attributes to be merged with the /etc/lsb-release generator.";
+        example = {
+          LSB_VERSION = "1.0";
+        };
+      };
     };
 
     image = {
@@ -237,13 +256,13 @@ in
     # https://www.freedesktop.org/software/systemd/man/os-release.html for the
     # format.
     environment.etc = {
-      "lsb-release".text = attrsToText {
+      "lsb-release".text = attrsToText ({
         LSB_VERSION = "${cfg.release} (${cfg.codeName})";
         DISTRIB_ID = "${cfg.distroId}";
         DISTRIB_RELEASE = cfg.release;
         DISTRIB_CODENAME = toLower cfg.codeName;
         DISTRIB_DESCRIPTION = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
-      };
+      } // cfg.extraLSBReleaseArgs);
 
       "os-release".text = attrsToText osReleaseContents;
     };

nixos/modules/services/databases/mysql.nix

@@ -314,7 +314,7 @@ in
         binlog-ignore-db = [ "information_schema" "performance_schema" "mysql" ];
       })
       (lib.mkIf (!isMariaDB) {
-        plugin-load-add = "auth_socket.so";
+        plugin-load-add = [ "auth_socket.so" ];
       })
     ];
 

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -89,7 +89,6 @@ let
     "surfboard"
     "systemd"
     "unbound"
-    "unifi"
     "unpoller"
     "v2ray"
     "varnish"

nixos/modules/services/monitoring/prometheus/exporters/unifi.nix

@@ -1,71 +0,0 @@
-{ config, lib, pkgs, options, ... }:
-
-let
-  cfg = config.services.prometheus.exporters.unifi;
-  inherit (lib)
-    mkOption
-    types
-    escapeShellArg
-    optionalString
-    concatStringsSep
-    ;
-in
-{
-  port = 9130;
-  extraOpts = {
-    unifiAddress = mkOption {
-      type = types.str;
-      example = "https://10.0.0.1:8443";
-      description = ''
-        URL of the UniFi Controller API.
-      '';
-    };
-
-    unifiInsecure = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        If enabled skip the verification of the TLS certificate of the UniFi Controller API.
-        Use with caution.
-      '';
-    };
-
-    unifiUsername = mkOption {
-      type = types.str;
-      example = "ReadOnlyUser";
-      description = ''
-        username for authentication against UniFi Controller API.
-      '';
-    };
-
-    unifiPassword = mkOption {
-      type = types.str;
-      description = ''
-        Password for authentication against UniFi Controller API.
-      '';
-    };
-
-    unifiTimeout = mkOption {
-      type = types.str;
-      default = "5s";
-      example = "2m";
-      description = ''
-        Timeout including unit for UniFi Controller API requests.
-      '';
-    };
-  };
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
-          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
-          -unifi.addr ${cfg.unifiAddress} \
-          -unifi.username ${escapeShellArg cfg.unifiUsername} \
-          -unifi.password ${escapeShellArg cfg.unifiPassword} \
-          -unifi.timeout ${cfg.unifiTimeout} \
-          ${optionalString cfg.unifiInsecure "-unifi.insecure" } \
-          ${concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}

nixos/modules/virtualisation/azure-image.nix

@@ -13,6 +13,7 @@ in
   imports = [
     ./azure-common.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -61,10 +62,14 @@ in
   };
 
   config = {
+    image.extension = "vhd";
+    system.nixos.tags = [ "azure" ];
+    system.build.image = config.system.build.azureImage;
     system.build.azureImage = import ../../lib/make-disk-image.nix {
       name = "azure-image";
+      inherit (config.image) baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=fixed,force_size -O vpc $diskImage $out/disk.vhd
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=fixed,force_size -O vpc $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       configFile = ./azure-config-user.nix;

nixos/modules/virtualisation/digital-ocean-image.nix

@@ -14,6 +14,7 @@ in
   imports = [
     ./digital-ocean-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -57,10 +58,33 @@ in
   };
 
   #### implementation
-  config = {
+  config =
+    let
+      format = "qcow2";
+    in
+    {
+      image.extension = lib.concatStringsSep "." [
+        format
+        (
+          {
+            "gzip" = "gz";
+            "bzip2" = "bz2";
+          }
+          .${cfg.compressionMethod}
+        )
+      ];
+      system.nixos.tags = [ "digital-ocean" ];
+      system.build.image = config.system.build.digitalOceanImage;
       system.build.digitalOceanImage = import ../../lib/make-disk-image.nix {
         name = "digital-ocean-image";
-      format = "qcow2";
+        inherit (config.image) baseName;
+        inherit (config.virtualisation) diskSize;
+        inherit
+          config
+          lib
+          pkgs
+          format
+          ;
         postVM =
           let
             compress =
@@ -78,8 +102,6 @@ in
             config.virtualisation.digitalOcean.defaultConfigFile
           else
             cfg.configFile;
-      inherit (config.virtualisation) diskSize;
-      inherit config lib pkgs;
       };
 
     };

nixos/modules/virtualisation/google-compute-image.nix

@@ -22,6 +22,7 @@ in
   imports = [
     ./google-compute-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -72,8 +73,12 @@ in
       fsType = "vfat";
     };
 
+    system.nixos.tags = [ "google-compute" ];
+    image.extension = "raw.tar.gz";
+    system.build.image = config.system.build.googleComputeImage;
     system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
       name = "google-compute-image";
+      inherit (config.image) baseName;
       postVM = ''
         PATH=$PATH:${
           with pkgs;
@@ -83,10 +88,9 @@ in
           ]
         }
         pushd $out
-        mv $diskImage disk.raw
+        tar -Sc $diskImage | gzip -${toString cfg.compressionLevel} > \
-        tar -Sc disk.raw | gzip -${toString cfg.compressionLevel} > \
+          ${config.image.fileName}
-          nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz
+        rm $diskImage
-        rm $out/disk.raw
         popd
       '';
       format = "raw";

nixos/modules/virtualisation/hyperv-image.nix

@@ -14,6 +14,7 @@ in
 
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -25,6 +26,18 @@ in
         "diskSize"
       ];
     })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "hyperv"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options = {
@@ -36,13 +49,6 @@ in
           The name of the derivation for the hyper-v appliance.
         '';
       };
-      vmFileName = mkOption {
-        type = types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vhdx";
-        description = ''
-          The file name of the hyper-v appliance.
-        '';
-      };
     };
   };
 
@@ -51,10 +57,14 @@ in
     # to avoid breaking existing configs using that.
     virtualisation.diskSize = lib.mkOverride 1490 (4 * 1024);
 
+    system.nixos.tags = [ "hyperv" ];
+    image.extension = "vhdx";
+    system.build.image = config.system.build.hypervImage;
     system.build.hypervImage = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${cfg.vmFileName}
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

nixos/modules/virtualisation/kubevirt.nix

@@ -1,8 +1,14 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ../profiles/qemu-guest.nix
+    ../image/file-options.nix
   ];
 
   config = {
@@ -22,8 +28,12 @@
     services.cloud-init.enable = true;
     systemd.services."serial-getty@ttyS0".enable = true;
 
+    system.nixos.tags = [ "kubevirt" ];
+    image.extension = "qcow2";
+    system.build.image = config.system.build.kubevirtImage;
     system.build.kubevirtImage = import ../../lib/make-disk-image.nix {
       inherit lib config pkgs;
+      inherit (config.image) baseName;
       format = "qcow2";
     };
   };

nixos/modules/virtualisation/linode-image.nix

@@ -20,6 +20,7 @@ in
   imports = [
     ./linode-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -57,13 +58,17 @@ in
   };
 
   config = {
+    system.nixos.tags = [ "linode" ];
+    image.extension = "img.gz";
+    system.build.image = config.system.build.linodeImage;
     system.build.linodeImage = import ../../lib/make-disk-image.nix {
       name = "linode-image";
+      baseName = config.image.baseName;
       # NOTE: Linode specifically requires images to be `gzip`-ed prior to upload
       # See: https://www.linode.com/docs/products/tools/images/guides/upload-an-image/#requirements-and-considerations
       postVM = ''
         ${pkgs.gzip}/bin/gzip -${toString cfg.compressionLevel} -c -- $diskImage > \
-        $out/nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.img.gz
+        $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

nixos/modules/virtualisation/lxc-container.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
   meta = {
@@ -8,18 +13,27 @@
   imports = [
     ./lxc-instance-common.nix
 
-    (lib.mkRemovedOptionModule [ "virtualisation" "lxc" "nestedContainer" ] "")
+    (lib.mkRemovedOptionModule [
-    (lib.mkRemovedOptionModule [ "virtualisation" "lxc" "privilegedContainer" ] "")
+      "virtualisation"
+      "lxc"
+      "nestedContainer"
+    ] "")
+    (lib.mkRemovedOptionModule [
+      "virtualisation"
+      "lxc"
+      "privilegedContainer"
+    ] "")
   ];
 
   options = { };
 
-  config = let
+  config =
+    let
       initScript = if config.boot.initrd.systemd.enable then "prepare-root" else "init";
-  in {
+    in
+    {
       boot.isContainer = true;
-    boot.postBootCommands =
+      boot.postBootCommands = ''
-      ''
         # After booting, register the contents of the Nix store in the Nix
         # database.
         if [ -f /nix-path-registration ]; then
@@ -47,7 +61,13 @@
         };
       };
 
+      system.nixos.tags = lib.mkOverride 99 [ "lxc" ];
+      image.extension = "tar.xz";
+      image.filePath = "tarball/${config.image.fileName}";
+      system.build.image = lib.mkOverride 99 config.system.build.tarball;
+
       system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+        fileName = config.image.baseName;
         extraArgs = "--owner=0";
 
         storeContents = [
@@ -80,7 +100,7 @@
         noStrip = true; # keep directory structure
         comp = "zstd -Xcompression-level 6";
 
-      storeContents = [config.system.build.toplevel];
+        storeContents = [ config.system.build.toplevel ];
 
         pseudoFiles = [
           "/sbin d 0755 0 0"
@@ -97,7 +117,7 @@
       '';
 
       # networkd depends on this, but systemd module disables this for containers
-    systemd.additionalUpstreamSystemUnits = ["systemd-udev-trigger.service"];
+      systemd.additionalUpstreamSystemUnits = [ "systemd-udev-trigger.service" ];
 
       systemd.packages = [ pkgs.distrobuilder.generator ];
 

nixos/modules/virtualisation/lxc-image-metadata.nix

@@ -46,6 +46,10 @@ let
   else { files = []; properties = {}; };
 
 in {
+  imports = [
+    ../image/file-options.nix
+  ];
+
   meta = {
     maintainers = lib.teams.lxc.members;
   };
@@ -87,7 +91,12 @@ in {
   };
 
   config = {
+    system.nixos.tags = [ "lxc" "metadata" ];
+    image.extension = "tar.xz";
+    image.filePath = "tarball/${config.image.fileName}";
+    system.build.image = config.system.build.metadata;
     system.build.metadata = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      fileName = config.image.baseName;
       contents = [
         {
           source = toYAML "metadata.yaml" {

nixos/modules/virtualisation/oci-image.nix

@@ -9,7 +9,10 @@ let
   cfg = config.oci;
 in
 {
-  imports = [ ./oci-common.nix ];
+  imports = [
+    ./oci-common.nix
+    ../image/file-options.nix
+  ];
 
   config = {
     # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
@@ -17,10 +20,14 @@ in
     virtualisation.diskSize = lib.mkOverride 1490 (8 * 1024);
     virtualisation.diskSizeAutoSupported = false;
 
+    system.nixos.tags = [ "oci" ];
+    image.extension = "qcow2";
+    system.build.image = config.system.build.OCIImage;
     system.build.OCIImage = import ../../lib/make-disk-image.nix {
       inherit config lib pkgs;
       inherit (config.virtualisation) diskSize;
       name = "oci-image";
+      baseName = config.image.baseName;
       configFile = ./oci-config-user.nix;
       format = "qcow2";
       partitionTableType = if cfg.efi then "efi" else "legacy";

nixos/modules/virtualisation/proxmox-image.nix

@@ -9,6 +9,7 @@ with lib;
 {
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -250,8 +251,12 @@ with lib;
           message = "'legacy+gpt' disk partitioning requires 'seabios' bios";
         }
       ];
+      image.baseName = lib.mkDefault "vzdump-qemu-${cfg.filenameSuffix}";
+      image.extension = "vma.zst";
+      system.build.image = config.system.build.VMA;
       system.build.VMA = import ../../lib/make-disk-image.nix {
         name = "proxmox-${cfg.filenameSuffix}";
+        baseName = config.image.baseName;
         inherit (cfg) partitionTableType;
         postVM =
           let
@@ -299,16 +304,16 @@ with lib;
                 });
           in
           ''
-            ${vma}/bin/vma create "vzdump-qemu-${cfg.filenameSuffix}.vma" \
+            ${vma}/bin/vma create "${config.image.baseName}.vma" \
               -c ${
                 cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)
               }/qemu-server.conf drive-virtio0=$diskImage
             rm $diskImage
-            ${pkgs.zstd}/bin/zstd "vzdump-qemu-${cfg.filenameSuffix}.vma"
+            ${pkgs.zstd}/bin/zstd "${config.image.baseName}.vma"
-            mv "vzdump-qemu-${cfg.filenameSuffix}.vma.zst" $out/
+            mv "${config.image.fileName}" $out/
 
             mkdir -p $out/nix-support
-            echo "file vma $out/vzdump-qemu-${cfg.filenameSuffix}.vma.zst" > $out/nix-support/hydra-build-products
+            echo "file vma $out/${config.image.fileName}" > $out/nix-support/hydra-build-products
           '';
         inherit (cfg.qemuConf) additionalSpace bootSize;
         inherit (config.virtualisation) diskSize;

nixos/modules/virtualisation/proxmox-lxc.nix

@@ -8,6 +8,10 @@
 with lib;
 
 {
+  imports = [
+    ../image/file-options.nix
+  ];
+
   options.proxmoxLXC = {
     enable = mkOption {
       default = true;
@@ -46,7 +50,15 @@ with lib;
       cfg = config.proxmoxLXC;
     in
     mkIf cfg.enable {
+      system.nixos.tags = [
+        "proxmox"
+        "lxc"
+      ];
+      image.extension = "tar.xz";
+      image.filePath = "tarball/${config.image.fileName}";
+      system.build.image = config.system.build.tarball;
       system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+        fileName = config.image.baseName;
         storeContents = [
           {
             object = config.system.build.toplevel;

nixos/modules/virtualisation/vagrant-virtualbox-image.nix

@@ -1,6 +1,6 @@
 # Vagrant + VirtualBox
 
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports = [
@@ -22,8 +22,11 @@
 
   # generate the box v1 format which is much easier to generate
   # https://www.vagrantup.com/docs/boxes/format.html
+  image.extension = lib.mkOverride 999 "${config.image.baseName}.box";
+  system.nixos.tags = [ "vagrant"];
+  system.build.image = lib.mkOverride 999 config.system.build.vagrantVirtualbox;
   system.build.vagrantVirtualbox = pkgs.runCommand
-    "virtualbox-vagrant.box"
+    config.image.fileName
     {}
     ''
       mkdir workdir

nixos/modules/virtualisation/virtualbox-image.nix

@@ -11,6 +11,7 @@ in
 {
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -22,6 +23,18 @@ in
         "diskSize"
       ];
     })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "virtualbox"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options = {
@@ -54,13 +67,6 @@ in
           The name of the VirtualBox appliance.
         '';
       };
-      vmFileName = lib.mkOption {
-        type = lib.types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.ova";
-        description = ''
-          The file name of the VirtualBox appliance.
-        '';
-      };
       params = lib.mkOption {
         type =
           with lib.types;
@@ -207,8 +213,12 @@ in
       (lib.mkIf (pkgs.stdenv.hostPlatform.system == "i686-linux") { pae = "on"; })
     ];
 
+    system.nixos.tags = [ "virtualbox" ];
+    image.extension = "ova";
+    system.build.image = lib.mkDefault config.system.build.virtualBoxOVA;
     system.build.virtualBoxOVA = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
 
       inherit pkgs lib config;
       partitionTableType = "legacy";
@@ -253,7 +263,7 @@ in
 
         echo "exporting VirtualBox VM..."
         mkdir -p $out
-        fn="$out/${cfg.vmFileName}"
+        fn="$out/${config.image.fileName}"
         VBoxManage export "$vmName" --output "$fn" --options manifest ${lib.escapeShellArgs cfg.exportParams}
         ${cfg.postExportCommands}
 

nixos/modules/virtualisation/vmware-image.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   boolToStr = value: if value then "on" else "off";
   cfg = config.vmware;
@@ -12,6 +17,23 @@ let
   ];
 
 in {
+  imports = [
+    ../image/file-options.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "vmware"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
+
+  ];
+
   options = {
     vmware = {
       baseImageSize = lib.mkOption {
@@ -29,13 +51,6 @@ in {
           The name of the derivation for the VMWare appliance.
         '';
       };
-      vmFileName = lib.mkOption {
-        type = lib.types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vmdk";
-        description = ''
-          The file name of the VMWare appliance.
-        '';
-      };
       vmSubformat = lib.mkOption {
         type = lib.types.enum subformats;
         default = "monolithicSparse";
@@ -51,10 +66,14 @@ in {
   };
 
   config = {
+    system.nixos.tags = [ "vmware" ];
+    image.extension = "vmdk";
+    system.build.image = config.system.build.vmwareImage;
     system.build.vmwareImage = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${cfg.vmFileName}
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

pkgs/applications/editors/android-studio-for-platform/common.nix

@@ -130,7 +130,8 @@ let
   # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
   # environment is used as a work around for that.
   fhsEnv = buildFHSEnv {
-    name = "${drvName}-fhs-env";
+    pname = "${drvName}-fhs-env";
+    inherit version;
     multiPkgs = pkgs: [
       zlib
       ncurses5

pkgs/applications/editors/android-studio/common.nix

@@ -208,7 +208,8 @@ let
   # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
   # environment is used as a work around for that.
   fhsEnv = buildFHSEnv {
-    name = "${drvName}-fhs-env";
+    pname = "${drvName}-fhs-env";
+    inherit version;
     multiPkgs = pkgs: [
       ncurses5
 

pkgs/applications/graphics/unigine-superposition/default.nix

@@ -28,11 +28,12 @@
 }:
 
 let
-
-  superposition = stdenv.mkDerivation rec{
   pname = "unigine-superposition";
   version = "1.1";
 
+  superposition = stdenv.mkDerivation rec{
+    inherit pname version;
+
     src = fetchurl {
       url = "https://assets.unigine.com/d/Unigine_Superposition-${version}.run";
       sha256 = "12hzlz792pf8pvxf13fww3qhahqzwzkxq9q3mq20hbhvaphbg7nd";
@@ -97,7 +98,7 @@ in
 # For that we need use a buildFHSEnv.
 
 buildFHSEnv {
-  name = "Superposition";
+  inherit pname version;
 
   targetPkgs = pkgs: [
     superposition

pkgs/applications/networking/instant-messengers/bluejeans/default.nix

@@ -1,137 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, rpmextract
-, libnotify
-, libuuid
-, cairo
-, cups
-, pango
-, fontconfig
-, udev
-, dbus
-, gtk3
-, atk
-, at-spi2-atk
-, expat
-, gdk-pixbuf
-, freetype
-, nspr
-, glib
-, nss
-, libX11
-, libXrandr
-, libXrender
-, libXtst
-, libXdamage
-, libxcb
-, libXcursor
-, libXi
-, libXext
-, libXfixes
-, libXft
-, libXcomposite
-, libXScrnSaver
-, alsa-lib
-, pulseaudio
-, makeWrapper
-, xdg-utils
-}:
-
-let
-  getFirst = n: v: builtins.concatStringsSep "." (lib.take n (lib.splitString "." v));
-in
-
-stdenv.mkDerivation rec {
-  pname = "bluejeans";
-  version = "2.32.1.3";
-
-  src = fetchurl {
-    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
-    sha256 = "sha256-lsUS7JymCMOa5wlWJOwLFm4KRnAYixi9Kk5CYHB17Ac=";
-  };
-
-  nativeBuildInputs = [ rpmextract makeWrapper ];
-
-  libPath =
-    lib.makeLibraryPath
-      [
-        libnotify
-        libuuid
-        cairo
-        cups
-        pango
-        fontconfig
-        gtk3
-        atk
-        at-spi2-atk
-        expat
-        gdk-pixbuf
-        dbus
-        (lib.getLib udev)
-        freetype
-        nspr
-        glib
-        stdenv.cc.cc
-        nss
-        libX11
-        libXrandr
-        libXrender
-        libXtst
-        libXdamage
-        libxcb
-        libXcursor
-        libXi
-        libXext
-        libXfixes
-        libXft
-        libXcomposite
-        libXScrnSaver
-        alsa-lib
-        pulseaudio
-      ];
-
-  localtime64_stub = ./localtime64_stub.c;
-
-  buildCommand = ''
-    mkdir -p $out/bin/
-    cd $out
-    rpmextract $src
-    mv usr/share share
-    rmdir usr
-
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      --replace-needed libudev.so.0 libudev.so.1 \
-      opt/BlueJeans/bluejeans-v2
-
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      opt/BlueJeans/resources/BluejeansHelper
-
-    cc $localtime64_stub -shared -o "${placeholder "out"}"/opt/BlueJeans/liblocaltime64_stub.so
-
-    # make xdg-open overrideable at runtime
-    makeWrapper $out/opt/BlueJeans/bluejeans-v2 $out/bin/bluejeans \
-      --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
-      --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-
-    substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
-      --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
-
-    patchShebangs "$out"
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day";
-    homepage = "https://www.bluejeans.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = [ ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
-

pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c

@@ -1,12 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-
-void *localtime64() {
-  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
-  abort();
-}
-
-void *localtime64_r() {
-  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
-  abort();
-}

pkgs/applications/networking/instant-messengers/bluejeans/update.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl pup common-updater-scripts
-
-set -eu -o pipefail
-
-version="$(curl -Ls https://www.bluejeans.com/downloads | \
-    pup 'a[href$=".rpm"] attr{href}' | \
-    # output contains app and events
-    grep "desktop-app" | \
-    awk -F'[ ._ ]' '{printf $6"."$7"."$8"."$9"\n"}')"
-
-update-source-version bluejeans-gui "$version"

pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix

@@ -0,0 +1,58 @@
+{
+  buildLua,
+  fetchFromGitHub,
+  lib,
+  unstableGitUpdater,
+}:
+let
+  mkScript =
+    pname: args:
+    let
+      self = {
+        inherit pname;
+        version = "0-unstable-2023-03-03";
+        src = fetchFromGitHub {
+          owner = "occivink";
+          repo = "mpv-image-viewer";
+          rev = "efc82147cba4809f22e9afae6ed7a41ad9794ffd";
+          hash = "sha256-H7uBwrIb5uNEr3m+rHED/hO2CHypGu7hbcRpC30am2Q=";
+        };
+
+        sourceRoot = "source/scripts";
+
+        passthru = {
+          updateScript = unstableGitUpdater { };
+        };
+
+        meta = {
+          description = "Configuration, scripts and tips for using mpv as an image viewer";
+          longDescription = ''
+            ${pname} is a component of mpv-image-viewer.
+
+            mpv-image-viewer aggregates configurations, scripts and tips for using
+            mpv as an image viewer. The affectionate nickname mvi is given to mpv in
+            such case.
+
+            Each mpv-image-viewer script can be used on its own without depending on
+            any of the others. Refer to the README and script-opts/ directory for
+            additional configuration tips or examples.
+          '';
+          homepage = "https://github.com/occivink/mpv-image-viewer";
+          license = lib.licenses.unlicense;
+          maintainers = with lib.maintainers; [ colinsane ];
+        };
+      };
+    in
+    buildLua (lib.attrsets.recursiveUpdate self args);
+in
+lib.recurseIntoAttrs (
+  lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
+    detect-image.meta.description = "Allows you to run specific commands when images are being displayed. Does not do anything by default, needs to be configured through detect_image.conf";
+    equalizer = { };
+    freeze-window.meta.description = "By default, mpv automatically resizes the window when the current file changes to fit its size. This script freezes the window so that this does not happen. There is no configuration";
+    image-positioning.meta.description = "Adds several high-level commands to zoom and pan";
+    minimap.meta.description = "Adds a minimap that displays the position of the image relative to the view";
+    ruler.meta.description = "Adds a ruler command that lets you measure positions, distances and angles in the image. Can be configured through ruler.conf";
+    status-line.meta.description = "Adds a status line that can show different properties in the corner of the window. By default it shows filename [positon/total] in the bottom left";
+  }
+)

pkgs/by-name/ar/arduino-cli/package.nix

@@ -94,15 +94,11 @@ if stdenv.hostPlatform.isLinux then
   # toolchains from the internet that have their interpreters pointed at
   # /lib64/ld-linux-x86-64.so.2
   buildFHSEnv {
-    inherit (pkg) name meta;
+    inherit (pkg) pname version meta;
 
     runScript = "${pkg.outPath}/bin/arduino-cli";
 
-    extraInstallCommands =
+    extraInstallCommands = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      ''
-        mv $out/bin/$name $out/bin/arduino-cli
-      ''
-      + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       cp -r ${pkg.outPath}/share $out/share
     '';
     passthru.pureGoPkg = pkg;

pkgs/by-name/em/emulationstation-de/package.nix

@@ -15,13 +15,13 @@
   SDL2
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "emulationstation-de";
-  version = "2.2.1";
+  version = "3.0.2";
 
   src = fetchzip {
-    url = "https://gitlab.com/es-de/emulationstation-de/-/archive/v2.2.1/emulationstation-de-v2.2.1.tar.gz";
+    url = "https://gitlab.com/es-de/emulationstation-de/-/archive/v${finalAttrs.version}/emulationstation-de-v${finalAttrs.version}.tar.gz";
-    hash = "sha256:1kp9p3fndnx4mapgfvy742zwisyf0y5k57xkqkis0kxyibx0z8i6";
+    hash = "sha256:RGlXFybbXYx66Hpjp2N3ovK4T5VyS4w0DWRGNvbwugs=";
   };
 
   patches = [ ./001-add-nixpkgs-retroarch-cores.patch ];
@@ -44,8 +44,25 @@ stdenv.mkDerivation {
   ];
 
   installPhase = ''
-    install -D ../emulationstation $out/bin/emulationstation
+    # Binary
-    cp -r ../resources/ $out/bin/resources/
+    install -D ../es-de $out/bin/es-de
+
+    # Resources
+    mkdir -p $out/share/es-de/
+    cp -r ../resources/ $out/share/es-de/resources/
+
+    # Desktop file
+    mkdir -p $out/share/applications
+    cp ../es-app/assets/org.es_de.frontend.desktop $out/share/applications/
+
+    # Icon
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp ../es-app/assets/org.es_de.frontend.svg $out/share/icons/hicolor/scalable/apps/
+  '';
+
+  postInstall = ''
+    substituteInPlace $out/share/applications/org.es_de.frontend.desktop \
+      --replace "Exec=es-de" "Exec=$out/bin/es-de"
   '';
 
   meta = {
@@ -54,6 +71,6 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [ ivarmedi ];
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    mainProgram = "emulationstation";
+    mainProgram = "es-de";
   };
-}
+})

pkgs/by-name/fl/flatpak/package.nix

@@ -265,6 +265,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/flatpak/flatpak/releases/tag/${finalAttrs.version}";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "flatpak";
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/hy/hyprgui/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprgui";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "hyprutils";
     repo = "hyprgui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bg1S/FhduRSSXc3Yd7SkyrmMKff7oh0jw781jTB0J60=";
+    hash = "sha256-VP+6qWu4nv8h9LLjTnl8Mh1aAlIA+zuufRYoouxl2Tc=";
   };
 
-  cargoHash = "sha256-bhtmU0vGptUYrPN/BbbSvSa27Ykma8UI6TS17eiQkyU=";
+  cargoHash = "sha256-t0HqraCA4q7K4EEtPS8J0ZmnhBB+Zf0aX+yXSUdKJzo=";
 
   strictDeps = true;
 
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     wrapGAppsHook4
   ];
+
   buildInputs = [
     glib
     cairo
@@ -36,9 +37,15 @@ rustPlatform.buildRustPackage rec {
     gtk4
   ];
 
+  prePatch = ''
+    substituteInPlace hyprgui.desktop \
+    --replace-fail "/usr/bin/" ""
+  '';
+
   postInstall = ''
     install -Dm644 -t $out/usr/share/icons hyprgui.png
     install -Dm644 -t $out/usr/share/applications hyprgui.desktop
+    install -Dm644 -t $out/usr/share/licenses/${pname} LICENSE
   '';
 
   meta = {

pkgs/by-name/mu/mutt/package.nix

@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, fetchpatch, ncurses, which, perl
-, gdbm ? null
+, gdbm
-, openssl ? null
+, openssl
-, cyrus_sasl ? null
+, cyrus_sasl
-, gnupg ? null
+, gnupg
-, gpgme ? null
+, gpgme
-, libkrb5 ? null
+, libkrb5
 , headerCache  ? true
 , sslSupport   ? true
 , saslSupport  ? true

pkgs/by-name/we/webdav/package.nix

@@ -2,16 +2,16 @@
 
 buildGo123Module rec {
   pname = "webdav";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     rev = "v${version}";
-    sha256 = "sha256-ASc+ioVBpCFESEryI0EwKYZln1JzPCOKLJJWmh7L8oA=";
+    sha256 = "sha256-8T/CRIVB4jW9kJ26om6fcm/khfzqdYCWbhJIIRZlMC0=";
   };
 
-  vendorHash = "sha256-d8WauJ1i429dr79iHgrbFRZCmx+W6OobSINy8aNGG6w=";
+  vendorHash = "sha256-f/Og0FkuaeUJ4bjqeUXVacIWnp6uiod7s146iKDSMgU=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/development/python-modules/huggingface-hub/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.26.2";
+  version = "0.26.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F2E8P0Hq3Ee+RXUEN4t2JtfBtK36aMsHQCnid9VWdLk=";
+    hash = "sha256-GTxtz9UuyvT1C5sba1Nz58xfTsIczEVe9X8gkpztRvQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/rmsd/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "rmsd";
-  version = "1.5.1";
+  version = "1.6.0";
   format = "setuptools";
 
   propagatedBuildInputs = [ scipy ];
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wDQoIUMqrBDpgImHeHWizYu/YkFjlxB22TaGpA8Q0Sc=";
+    hash = "sha256-9bALeHmdw6OJGxp3aabkDfCxo4fGv2etKzpBDhmZOrI=";
   };
 
   pythonImportsCheck = [ "rmsd" ];

pkgs/os-specific/bsd/freebsd/package-set.nix

@@ -8,6 +8,7 @@
   buildFreebsd,
   patchesRoot,
   writeText,
+  buildPackages,
 }:
 
 self:
@@ -64,16 +65,32 @@ lib.packagesFromDirectoryRecursive {
     inherit (self) libmd libnetbsd;
   };
 
-  libc = self.callPackage ./pkgs/libc/package.nix {
+  libcMinimal = self.callPackage ./pkgs/libcMinimal.nix {
     inherit (buildFreebsd)
-      makeMinimal
-      install
-      gencat
       rpcgen
-      mkcsmapper
+      gencat
-      mkesdb
       ;
-    inherit (self) csu include;
+    inherit (buildPackages)
+      flex
+      byacc
+      ;
+  };
+
+  libc = self.callPackage ./pkgs/libc/package.nix {
+    inherit (self) libcMinimal librpcsvc libelf;
+  };
+
+  librpcsvc = self.callPackage ./pkgs/librpcsvc.nix {
+    inherit (buildFreebsd) rpcgen;
+  };
+
+  i18n = self.callPackage ./pkgs/i18n.nix { inherit (buildFreebsd) mkcsmapper mkesdb; };
+
+  libelf = self.callPackage ./pkgs/libelf.nix { inherit (buildPackages) m4; };
+
+  rtld-elf = self.callPackage ./pkgs/rtld-elf.nix {
+    inherit (buildFreebsd) rpcgen;
+    inherit (buildPackages) flex byacc;
   };
 
   libnetbsd = self.callPackage ./pkgs/libnetbsd/package.nix { inherit (buildFreebsd) makeMinimal; };

pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch

@@ -1,81 +0,0 @@
-From 197b10de54b53a089ad549f2e00787b4fa719210 Mon Sep 17 00:00:00 2001
-From: Artemis Tosini <me@artem.ist>
-Date: Sat, 2 Nov 2024 07:50:13 +0000
-Subject: [PATCH] HACK: bsd.lib.mk: Treat empty SHLIB_NAME as nonexistant
-
-Unsetting SHLIB_NAME in nix package definitions is a pain
-but we can easily set it to be empty. This is useful when
-building static libraries without unneeded static libraries.
----
- share/mk/bsd.lib.mk | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
-index 5f328d5378ca..89d16dc6fa41 100644
---- a/share/mk/bsd.lib.mk
-+++ b/share/mk/bsd.lib.mk
-@@ -242,7 +242,7 @@ PO_FLAG=-pg
- _LIBDIR:=${LIBDIR}
- _SHLIBDIR:=${SHLIBDIR}
- 
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- .if ${MK_DEBUG_FILES} != "no"
- SHLIB_NAME_FULL=${SHLIB_NAME}.full
- # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
-@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
- .endif
- .endif
- 
--.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
-+.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
- OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
- BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
- LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
-@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
- CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
- .endif
- 
--.if defined(SHLIB_NAME) || \
-+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
-     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
- SOBJS+=		${OBJS:.o=.pico}
- DEPENDOBJS+=	${SOBJS}
- CLEANFILES+=	${SOBJS}
- .endif
- 
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- _LIBS+=		${SHLIB_NAME}
- 
- SOLINKOPTS+=	-shared -Wl,-x
-@@ -435,7 +435,7 @@ all: all-man
- CLEANFILES+=	${_LIBS}
- 
- _EXTRADEPEND:
--.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
-+.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- .if defined(DPADD) && !empty(DPADD)
- 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
- .endif
-@@ -501,7 +501,7 @@ _libinstall:
- 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
- .endif
- .endif
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- 	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
- 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
- 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
-@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
- OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
- .endfor
- .endif
--.if defined(SHLIB_NAME) || \
-+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
-     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
- .for _S in ${SRCS:N*.[hly]}
- OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
--- 
-2.46.1
-

pkgs/os-specific/bsd/freebsd/patches/14.1/libelf-bootstrapping.patch

@@ -0,0 +1,13 @@
+diff --git a/lib/libelf/Makefile b/lib/libelf/Makefile
+index c15ce2798a91..d6d8754e2b4f 100644
+--- a/lib/libelf/Makefile
++++ b/lib/libelf/Makefile
+@@ -80,7 +80,7 @@ INCS=		libelf.h gelf.h
+ SRCS+=	sys/elf32.h sys/elf64.h sys/elf_common.h
+ 
+ # Allow bootstrapping elftoolchain on Linux:
+-.if defined(BOOTSTRAPPING) && ${.MAKE.OS} == "Linux"
++.if defined(BOOTSTRAPPING)
+ native-elf-format.h:
+ 	${ELFTCDIR}/common/native-elf-format > ${.TARGET} || rm ${.TARGET}
+ SRCS+=	native-elf-format.h

pkgs/os-specific/bsd/freebsd/patches/14.1/mk.patch

@@ -0,0 +1,154 @@
+diff --git a/share/mk/bsd.incs.mk b/share/mk/bsd.incs.mk
+index df4cf4641141..a87c7f9db03a 100644
+--- a/share/mk/bsd.incs.mk
++++ b/share/mk/bsd.incs.mk
+@@ -63,8 +63,8 @@ stage_includes: stage_as.${header:T}
+ 
+ installincludes: _${group}INS_${header:T}
+ _${group}INS_${header:T}: ${header}
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -C -o ${${group}OWN_${.ALLSRC:T}} \
+-	    -g ${${group}GRP_${.ALLSRC:T}} -m ${${group}MODE_${.ALLSRC:T}} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -C \
++	    -m ${${group}MODE_${.ALLSRC:T}} \
+ 	    ${.ALLSRC} \
+ 	    ${DESTDIR}${${group}DIR_${.ALLSRC:T}}/${${group}NAME_${.ALLSRC:T}}
+ .else
+@@ -78,10 +78,10 @@ stage_includes: stage_files.${group}
+ installincludes: _${group}INS
+ _${group}INS: ${_${group}INCS}
+ .if defined(${group}NAME)
+-	${INSTALL} ${${group}TAG_ARGS} -C -o ${${group}OWN} -g ${${group}GRP} -m ${${group}MODE} \
++	${INSTALL} ${${group}TAG_ARGS} -C -m ${${group}MODE} \
+ 	    ${.ALLSRC} ${DESTDIR}${${group}DIR}/${${group}NAME}
+ .else
+-	${INSTALL} ${${group}TAG_ARGS} -C -o ${${group}OWN} -g ${${group}GRP} -m ${${group}MODE} \
++	${INSTALL} ${${group}TAG_ARGS} -C -m ${${group}MODE} \
+ 	    ${.ALLSRC} ${DESTDIR}${${group}DIR}/
+ .endif
+ .endif # !empty(_${group}INCS)
+diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
+index 5f328d5378ca..264bbcc84ffb 100644
+--- a/share/mk/bsd.lib.mk
++++ b/share/mk/bsd.lib.mk
+@@ -242,7 +242,7 @@ PO_FLAG=-pg
+ _LIBDIR:=${LIBDIR}
+ _SHLIBDIR:=${SHLIBDIR}
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if ${MK_DEBUG_FILES} != "no"
+ SHLIB_NAME_FULL=${SHLIB_NAME}.full
+ # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
+@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
+ .endif
+ .endif
+ 
+-.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
++.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
+ OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
+ BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
+ LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
+@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
+ CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
+ .endif
+ 
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ SOBJS+=		${OBJS:.o=.pico}
+ DEPENDOBJS+=	${SOBJS}
+ CLEANFILES+=	${SOBJS}
+ .endif
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ _LIBS+=		${SHLIB_NAME}
+ 
+ SOLINKOPTS+=	-shared -Wl,-x
+@@ -435,7 +435,7 @@ all: all-man
+ CLEANFILES+=	${_LIBS}
+ 
+ _EXTRADEPEND:
+-.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
++.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if defined(DPADD) && !empty(DPADD)
+ 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
+ .endif
+@@ -482,7 +482,7 @@ _SHLINSTALLFLAGS:=	${_SHLINSTALLFLAGS${ie}}
+ installpcfiles: installpcfiles-${pcfile}
+ 
+ installpcfiles-${pcfile}: ${pcfile}
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} \
+ 	    ${.ALLSRC} ${DESTDIR}${LIBDATADIR}/pkgconfig/
+ .endfor
+@@ -494,28 +494,28 @@ realinstall: _libinstall installpcfiles
+ .ORDER: beforeinstall _libinstall
+ _libinstall:
+ .if defined(LIB) && !empty(LIB) && ${MK_INSTALLLIB} != "no"
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}${_STATICLIB_SUFFIX}.a ${DESTDIR}${_LIBDIR}/
+ .if ${MK_PROFILE} != "no"
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif
+-.if defined(SHLIB_NAME)
+-	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
++	${INSTALL} ${TAG_ARGS} ${STRIP} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
+ 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
+ .if ${MK_DEBUG_FILES} != "no"
+ .if defined(DEBUGMKDIR)
+ 	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -d ${DESTDIR}${DEBUGFILEDIR}/
+ .endif
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -o ${LIBOWN} -g ${LIBGRP} -m ${DEBUGMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -m ${DEBUGMODE} \
+ 	    ${_INSTALLFLAGS} \
+ 	    ${SHLIB_NAME}.debug ${DESTDIR}${DEBUGFILEDIR}/
+ .endif
+ .if defined(SHLIB_LINK)
+ .if commands(${SHLIB_LINK:R}.ld)
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -S -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -S -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${SHLIB_LINK:R}.ld \
+ 	    ${DESTDIR}${_LIBDIR}/${SHLIB_LINK}
+ .for _SHLIB_LINK_LINK in ${SHLIB_LDSCRIPT_LINKS}
+@@ -548,7 +548,7 @@ _libinstall:
+ .endif # SHLIB_LINK
+ .endif # SHIB_NAME
+ .if defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB}_pic.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif # !defined(INTERNALLIB)
+@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
+ .endfor
+ .endif
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ .for _S in ${SRCS:N*.[hly]}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
+diff --git a/share/mk/bsd.man.mk b/share/mk/bsd.man.mk
+index 04316c46b705..9ad3c8ce70e7 100644
+--- a/share/mk/bsd.man.mk
++++ b/share/mk/bsd.man.mk
+@@ -50,9 +50,9 @@
+ .endif
+ 
+ .if ${MK_MANSPLITPKG} == "no"
+-MINSTALL?=	${INSTALL} ${TAG_ARGS} -o ${MANOWN} -g ${MANGRP} -m ${MANMODE}
++MINSTALL?=	${INSTALL} ${TAG_ARGS} -m ${MANMODE}
+ .else
+-MINSTALL?=	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},man} -o ${MANOWN} -g ${MANGRP} -m ${MANMODE}
++MINSTALL?=	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},man} -m ${MANMODE}
+ .endif
+ 
+ CATDIR=		${MANDIR:H:S/$/\/cat/}

pkgs/os-specific/bsd/freebsd/patches/14.1/rtld-elf-symlink.patch

@@ -0,0 +1,13 @@
+diff --git a/libexec/rtld-elf/Makefile b/libexec/rtld-elf/Makefile
+index 0dbd2b8aa935..241d7a78e208 100644
+--- a/libexec/rtld-elf/Makefile
++++ b/libexec/rtld-elf/Makefile
+@@ -54,7 +54,7 @@ NO_WCAST_ALIGN=	yes
+ INSTALLFLAGS=	-C -b
+ PRECIOUSPROG=
+ BINDIR=		/libexec
+-SYMLINKS=	../..${BINDIR}/${PROG} ${LIBEXECDIR}/${PROG}
++SYMLINKS=	${BINDIR}/${PROG} ${LIBEXECDIR}/${PROG}
+ MLINKS?=	rtld.1 ld-elf.so.1.1 \
+ 		rtld.1 ld.so.1
+ 

pkgs/os-specific/bsd/freebsd/pkgs/bin.nix

@@ -2,11 +2,9 @@
   mkDerivation,
   pkgsBuildBuild,
   libjail,
-  libmd,
   libnetbsd,
   libcapsicum,
   libcasper,
-  libelf,
   libxo,
   libncurses-tinfo,
   libedit,
@@ -36,11 +34,9 @@ mkDerivation {
   ];
   buildInputs = [
     libjail
-    libmd
     libnetbsd
     libcapsicum
     libcasper
-    libelf
     libxo
     libncurses-tinfo
     libedit

pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix

@@ -174,4 +174,6 @@ mkDerivation {
   # build build-time dependencies for building FreeBSD packages). It is
   # not needed when building for FreeBSD.
   meta.broken = stdenv.hostPlatform.isFreeBSD;
+
+  alwaysKeepStatic = true;
 }

pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix

@@ -0,0 +1,20 @@
+{
+  mkDerivation,
+  mkcsmapper,
+  mkesdb,
+}:
+
+mkDerivation {
+  path = "share/i18n";
+
+  noLibc = true;
+
+  extraNativeBuildInputs = [
+    mkcsmapper
+    mkesdb
+  ];
+
+  preBuild = ''
+    export makeFlags="$makeFlags ESDBDIR=$out/share/i18n/esdb CSMAPPERDIR=$out/share/i18n/csmapper"
+  '';
+}

pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix

@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   mkDerivation,
   buildPackages,

pkgs/os-specific/bsd/freebsd/pkgs/install.nix

@@ -26,6 +26,9 @@ let
       @out@/bin/xinstall "''${args[@]}"
     ''
   );
+  libmd' = libmd.override {
+    bootstrapInstallation = true;
+  };
 in
 mkDerivation {
   path = "usr.bin/xinstall";
@@ -39,8 +42,12 @@ mkDerivation {
     (if stdenv.hostPlatform == stdenv.buildPlatform then boot-install else install)
   ];
   skipIncludesPhase = true;
-  buildInputs = compatIfNeeded ++ [
+  buildInputs =
-    libmd
+    compatIfNeeded
+    ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
+      libmd'
+    ]
+    ++ [
       libnetbsd
     ];
   makeFlags =

pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix

@@ -1,12 +1,14 @@
 {
+  lib,
+  stdenv,
   mkDerivation,
-  libelf,
   compatIfNeeded,
+  libelf,
 }:
 mkDerivation {
   path = "usr.sbin/kldxref";
 
-  buildInputs = [ libelf ] ++ compatIfNeeded;
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [ libelf ] ++ compatIfNeeded;
 
   # We symlink in our modules, make it follow symlinks
   postPatch = ''

pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   mkDerivation,
-  libelf,
 }:
 mkDerivation {
   path = "usr.bin/ldd";
@@ -11,8 +10,6 @@ mkDerivation {
     "contrib/elftoolchain/libelf"
   ];
 
-  buildInputs = [ libelf ];
-
   env = {
     NIX_CFLAGS_COMPILE = "-D_RTLD_PATH=${lib.getLib stdenv.cc.libc}/libexec/ld-elf.so.1";
   };

pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix

@@ -1,303 +1,56 @@
 {
-  lib,
+  symlinkJoin,
-  buildPackages,
-  stdenv,
-  mkDerivation,
-
-  bsdSetupHook,
-  freebsdSetupHook,
-  makeMinimal,
-  install,
-  flex,
-  byacc,
-  gencat,
-  rpcgen,
-  mkcsmapper,
-  mkesdb,
-
-  csu,
   include,
-  versionData,
+  csu,
-}:
+  libcMinimal,
-
+  libssp_nonshared,
-mkDerivation {
+  libgcc,
-  noLibc = true;
+  libmd,
-  pname = "libc";
+  libthr,
-  path = "lib/libc";
+  msun,
-  extraPaths =
+  librpcsvc,
-    [
+  libutil,
-      "lib/libc_nonshared"
+  librt,
-      "etc/group"
+  libcrypt,
-      "etc/master.passwd"
+  libelf,
-      "etc/shells"
+  libexecinfo,
-      "lib/libmd"
+  libkvm,
-      "lib/libutil"
+  libmemstat,
-      "lib/msun"
+  libprocstat,
-      "sys/kern"
+  libdevstat,
-      "sys/libkern"
+  libiconvModules,
-      "sys/sys"
+  libdl,
-      "sys/crypto/chacha20"
+  i18n,
-      "include/rpcsvc"
+  rtld-elf,
-      "contrib/jemalloc"
+  baseModules ? [
-      "contrib/gdtoa"
-      "contrib/libc-pwcache"
-      "contrib/libc-vis"
-    ]
-    ++ lib.optionals (versionData.major == 13) [ "contrib/tzcode/stdtime" ]
-    ++ lib.optionals (versionData.major >= 14) [ "contrib/tzcode" ]
-    ++ [
-
-      # libthr
-      "lib/libthr"
-      "lib/libthread_db"
-      "libexec/rtld-elf"
-      "lib/csu/common/crtbrand.S"
-      "lib/csu/common/notes.h"
-
-      # librpcsvc
-      "lib/librpcsvc"
-
-      # librt
-      "lib/librt"
-
-      # libcrypt
-      "lib/libcrypt"
-      "lib/libmd"
-      "sys/crypto/sha2"
-      "sys/crypto/skein"
-
-      # libgcc and friends
-      "lib/libgcc_eh"
-      "lib/libgcc_s"
-      "lib/libcompiler_rt"
-      "contrib/llvm-project/libunwind"
-      "contrib/llvm-project/compiler-rt"
-      #"contrib/llvm-project/libcxx"
-
-      # terminfo
-      "lib/ncurses"
-      "contrib/ncurses"
-      "lib/Makefile.inc"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isx86_32) [ "lib/libssp_nonshared" ]
-    ++ [
-      "lib/libexecinfo"
-      "contrib/libexecinfo"
-
-      "lib/libkvm"
-      "sys" # ummmmmmmmmm libkvm wants arch-specific headers from the kernel tree
-
-      "lib/libmemstat"
-
-      "lib/libprocstat"
-      "sys/contrib/openzfs"
-      "sys/contrib/pcg-c"
-      "sys/opencrypto"
-      "sys/contrib/ck"
-      "sys/crypto"
-
-      "lib/libdevstat"
-
-      "lib/libelf"
-      "contrib/elftoolchain"
-
-      "lib/libiconv_modules"
-      "share/i18n"
-      "include/paths.h"
-
-      "lib/libdl"
-
-      # Used for aarch64-freebsd
-      "contrib/arm-optimized-routines"
-    ];
-
-  postPatch = ''
-    substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
-
-    substituteInPlace $BSDSRCDIR/include/paths.h \
-        --replace '/usr/lib/i18n' '${builtins.placeholder "out"}/lib/i18n' \
-        --replace '/usr/share/i18n' '${builtins.placeholder "out"}/share/i18n'
-  '';
-
-  # NIX_CFLAGS_LINK is empty at this point except when building static,
-  # in which case the stdenv adapter adds the `-static` flag.
-  # Building with `-static` set causes linker errors.
-  postConfigure = ''
-    export NIX_CFLAGS_LINK=
-  '';
-
-  nativeBuildInputs = [
-    bsdSetupHook
-    freebsdSetupHook
-    makeMinimal
-    install
-
-    flex
-    byacc
-    gencat
-    rpcgen
-    mkcsmapper
-    mkesdb
-  ];
-  buildInputs = [
     include
     csu
-  ];
+    libcMinimal
-  env.NIX_CFLAGS_COMPILE = toString [
+    libssp_nonshared
-    "-B${csu}/lib"
+    libgcc
-    # These are supposed to have _RTLD_COMPAT_LIB_SUFFIX so we can get things like "lib32"
+    libmd
-    # but that's unnecessary
+    libthr
-    "-DSTANDARD_LIBRARY_PATH=\"${builtins.placeholder "out"}/lib\""
+    msun
-    "-D_PATH_RTLD=\"${builtins.placeholder "out"}/libexec/ld-elf.so.1\""
+    librpcsvc
-  ];
+    libutil
+    librt
+    libcrypt
+    libelf
+    libexecinfo
+    libkvm
+    libmemstat
+    libprocstat
+    libdevstat
+    libiconvModules
+    libdl
+    i18n
+    rtld-elf
+  ],
+  extraModules ? [ ],
+}:
 
-  makeFlags = [
+symlinkJoin {
-    "STRIP=-s" # flag to install, not command
+  pname = "libc";
-    # lib/libc/gen/getgrent.c has sketchy cast from `void *` to enum
+  inherit (libcMinimal) version;
-    "MK_WERROR=no"
+  paths = baseModules ++ extraModules;
-  ];
-
-  MK_SYMVER = "yes";
-  MK_SSP = "yes";
-  MK_NLS = "yes";
-  MK_ICONV = "yes";
-  MK_NS_CACHING = "yes";
-  MK_INET6_SUPPORT = "yes";
-  MK_HESIOD = "yes";
-  MK_NIS = "yes";
-  MK_HYPERV = "yes";
-  MK_FP_LIBC = "yes";
-
-  MK_TCSH = "no";
-  MK_MALLOC_PRODUCTION = "yes";
-
-  MK_TESTS = "no";
-  MACHINE_ABI = "";
-  MK_DETECT_TZ_CHANGES = "no";
-  MK_MACHDEP_OPTIMIZATIONS = "yes";
-  MK_ASAN = "no";
-  MK_UBSAN = "no";
-
-  NO_FSCHG = "yes";
-
-  preBuild = lib.optionalString (stdenv.hostPlatform.isx86_32) ''
-    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags
-    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags install
-  '';
-
-  postInstall =
-    ''
-      pushd ${include}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      pushd ${csu}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      mkdir $BSDSRCDIR/lib/libcompiler_rt/i386 $BSDSRCDIR/lib/libcompiler_rt/cpu_model
-      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags
-      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags
-      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags install
-
-      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # otherwise these dynamic libraries try to link with libc.a
-      mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
-      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
-      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
-
-      NIX_CFLAGS_COMPILE+=" -B$out/lib"
-      NIX_CFLAGS_COMPILE+=" -I$out/include"
-      NIX_LDFLAGS+=" -L$out/lib"
-
-      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags
-      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags install
-
-      mkdir $BSDSRCDIR/lib/libmd/sys
-      make -C $BSDSRCDIR/lib/libmd $makeFlags
-      make -C $BSDSRCDIR/lib/libmd $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libthr $makeFlags
-      make -C $BSDSRCDIR/lib/libthr $makeFlags install
-
-      make -C $BSDSRCDIR/lib/msun $makeFlags
-      make -C $BSDSRCDIR/lib/msun $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libutil $makeFlags
-      make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librt $makeFlags
-      make -C $BSDSRCDIR/lib/librt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libelf $makeFlags
-      make -C $BSDSRCDIR/lib/libelf $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags
-      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libkvm $makeFlags
-      make -C $BSDSRCDIR/lib/libkvm $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libmemstat $makeFlags
-      make -C $BSDSRCDIR/lib/libmemstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libprocstat $makeFlags
-      make -C $BSDSRCDIR/lib/libprocstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libdevstat $makeFlags
-      make -C $BSDSRCDIR/lib/libdevstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags
-      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags SHLIBDIR=${builtins.placeholder "out"}/lib/i18n install
-
-      make -C $BSDSRCDIR/lib/libdl $makeFlags
-      make -C $BSDSRCDIR/lib/libdl $makeFlags install
-
-      make -C $BSDSRCDIR/share/i18n $makeFlags
-      make -C $BSDSRCDIR/share/i18n $makeFlags ESDBDIR=${builtins.placeholder "out"}/share/i18n/esdb CSMAPPERDIR=${builtins.placeholder "out"}/share/i18n/csmapper install
-
-    ''
-    + lib.optionalString stdenv.hostPlatform.isx86_32 ''
-      $CC -c $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.c -o $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o
-      ORIG_NIX_LDFLAGS="$NIX_LDFLAGS"
-      NIX_LDFLAGS+=" $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o"
-    ''
-    + ''
-      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags
-      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags install
-      rm -f $out/libexec/ld-elf.so.1
-      mv $out/bin/ld-elf.so.1 $out/libexec
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
-      mkdir $out/lib/keep_static
-      mv $out/lib/*_nonshared.a $out/lib/libgcc*.a $out/lib/libcompiler_rt.a $out/lib/keep_static
-      rm $out/lib/*.a
-      mv $out/lib/keep_static/* $out/lib
-      rmdir $out/lib/keep_static
-    '';
-
-  # libc should not be allowed to refer to anything other than itself
-  postFixup = ''
-    find $out -type f | xargs -n1 ${buildPackages.patchelf}/bin/patchelf --shrink-rpath --allowed-rpath-prefixes $out || true
-  '';
-
-  meta.platforms = lib.platforms.freebsd;
-
-  # definitely a bad idea to enable stack protection on the stack protection initializers
-  hardeningDisable = [ "stackprotector" ];
-
-  outputs = [
-    "out"
-    "man"
-    "debug"
-  ];
 }

pkgs/os-specific/bsd/freebsd/pkgs/libcMinimal.nix

@@ -0,0 +1,92 @@
+{
+  mkDerivation,
+  include,
+  rpcgen,
+  flex,
+  byacc,
+  gencat,
+  csu,
+}:
+
+mkDerivation {
+  pname = "libcMinimal";
+  path = "lib/libc";
+  extraPaths = [
+    "lib/libc_nonshared"
+    "lib/msun"
+    "lib/libmd"
+    "lib/libutil"
+    "libexec/rtld-elf"
+    "include/rpcsvc"
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "contrib/tzcode"
+    "contrib/gdtoa"
+    "contrib/jemalloc"
+    "sys/sys"
+    "sys/kern"
+    "sys/libkern"
+    "sys/crypto"
+    "sys/opencrypto"
+    "etc/group"
+    "etc/master.passwd"
+    "etc/shells"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  extraNativeBuildInputs = [
+    rpcgen
+    flex
+    byacc
+    gencat
+  ];
+
+  # this target is only used in the rtld-elf derivation. build it there instead.
+  postPatch = ''
+    sed -E -i -e '/BUILD_NOSSP_PIC_ARCHIVE=/d' $BSDSRCDIR/lib/libc/Makefile
+  '';
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  postBuild = ''
+    make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags
+  '';
+
+  postInstall = ''
+    make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags install
+  '';
+
+  alwaysKeepStatic = true;
+
+  env = {
+    MK_TESTS = "no";
+    MK_SYMVER = "yes";
+    MK_SSP = "yes";
+    MK_NLS = "yes";
+    MK_ICONV = "yes";
+    MK_NS_CACHING = "yes";
+    MK_INET6_SUPPORT = "yes";
+    MK_HESIOD = "yes";
+    MK_NIS = "yes";
+    MK_HYPERV = "yes";
+    MK_FP_LIBC = "yes";
+    MK_MALLOC_PRODUCTION = "yes";
+    MK_MACHDEP_OPTIMIZATIONS = "yes";
+  };
+
+  # definitely a bad idea to enable stack protection on the stack protection initializers
+  hardeningDisable = [ "stackprotector" ];
+}

pkgs/os-specific/bsd/freebsd/pkgs/libcrypt.nix

@@ -0,0 +1,37 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libcrypt";
+  extraPaths = [
+    "sys/kern"
+    "sys/crypto"
+    "lib/libmd"
+    "secure/lib/libcrypt"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix

@@ -12,14 +12,16 @@ mkDerivation {
   pname = "libcxxrt";
   path = "lib/libcxxrt";
   extraPaths = [ "contrib/libcxxrt" ];
-  outputs =
+  outputs = [
-    [
     "out"
     "dev"
-    ]
-    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
     "debug"
   ];
   noLibcxx = true;
   libName = "cxxrt";
+
+  # they already fixed the undefined symbols in the version map upstream. it'll be released probably in 15.0
+  preBuild = ''
+    export NIX_LDFLAGS="$NIX_LDFLAGS --undefined-version"
+  '';
 }

pkgs/os-specific/bsd/freebsd/pkgs/libdevstat.nix

@@ -0,0 +1,44 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  libprocstat,
+  libutil,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libdevstat";
+  extraPaths = [
+    "lib/libc/Versions.def"
+    "sys/contrib/openzfs"
+    "sys/contrib/pcg-c"
+    "sys/opencrypto"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+    libprocstat
+    libutil
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}

pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix

@@ -1,9 +1,34 @@
-{ mkDerivation, ... }:
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
 mkDerivation {
   path = "lib/libdl";
   extraPaths = [
-    "lib/libc"
     "libexec/rtld-elf"
+    "lib/libc/gen"
+    "lib/libc/include"
+    "lib/libc/Versions.def"
   ];
-  buildInputs = [ ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
 }

pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix

@@ -1,26 +1,44 @@
 {
+  lib,
   stdenv,
   mkDerivation,
-  bsdSetupHook,
-  freebsdSetupHook,
-  makeMinimal,
-  install,
   m4,
+  include,
+  libcMinimal,
+  libgcc,
+  compatIfNeeded,
+  csu,
 }:
+
 mkDerivation {
   path = "lib/libelf";
   extraPaths = [
     "lib/libc"
     "contrib/elftoolchain"
-    "sys/sys/elf32.h"
+    "sys/sys"
-    "sys/sys/elf64.h"
-    "sys/sys/elf_common.h"
   ];
-  nativeBuildInputs = [
+
-    bsdSetupHook
+  outputs = [
-    freebsdSetupHook
+    "out"
-    makeMinimal
+    "man"
-    install
+    "debug"
+  ];
+
+  noLibc = stdenv.hostPlatform.isFreeBSD;
+
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isFreeBSD [
+      include
+      libcMinimal
+      libgcc
+    ]
+    ++ compatIfNeeded;
+
+  extraNativeBuildInputs = [
     m4
   ];
+
+  preBuild = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
 }

pkgs/os-specific/bsd/freebsd/pkgs/libexecinfo.nix

@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libelf,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libexecinfo";
+  extraPaths = [
+    "contrib/libexecinfo"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libelf
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix

@@ -0,0 +1,49 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libgcc_eh";
+  extraPaths = [
+    "lib/libgcc_s"
+    "lib/libcompiler_rt"
+    "lib/msun"
+    "lib/libc" # needs arch-specific fpmath files
+    "contrib/llvm-project/compiler-rt"
+    "contrib/llvm-project/libunwind"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  postBuild = ''
+    mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
+    make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
+
+    mkdir $BSDSRCDIR/lib/libcompiler_rt/i386 $BSDSRCDIR/lib/libcompiler_rt/cpu_model
+    make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags
+  '';
+
+  postInstall = ''
+    make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
+    make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags install
+  '';
+
+  alwaysKeepStatic = true;
+}

pkgs/os-specific/bsd/freebsd/pkgs/libiconvModules.nix

@@ -0,0 +1,32 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libiconv_modules";
+  extraPaths = [
+    "lib/libc/iconv"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    export makeFlags="$makeFlags SHLIBDIR=$out/lib/i18n"
+  '';
+}

pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix

@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libkvm";
+  extraPaths = [
+    "sys" # wants sys/${arch}
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix

@@ -2,33 +2,56 @@
   lib,
   stdenv,
   mkDerivation,
-  freebsdSetupHook,
+  libcMinimal,
-  bsdSetupHook,
+  include,
+  libgcc,
   makeMinimal,
+  bsdSetupHook,
+  freebsdSetupHook,
+  compatIfNeeded,
+  csu,
+  # this is set to true when used as the dependency of install
+  # this is set to false when used as the dependency of libc
+  bootstrapInstallation ? false,
 }:
-mkDerivation {
+
+mkDerivation (
+  {
     path = "lib/libmd";
     extraPaths = [
-    "sys/sys/md5.h"
+      "sys/crypto"
-    "sys/crypto/sha2"
+      "sys/sys"
-    "sys/crypto/skein"
-  ];
-  nativeBuildInputs = [
-    makeMinimal
-    bsdSetupHook
-    freebsdSetupHook
     ];
 
-  makeFlags = [
+    outputs = [
-    "STRIP=-s" # flag to install, not command
+      "out"
-    "RELDIR=."
+      "man"
-  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+      "debug"
+    ];
 
-  preBuild = ''
+    noLibc = !bootstrapInstallation;
-    mkdir sys
+
+    buildInputs =
+      lib.optionals (!bootstrapInstallation) [
+        libcMinimal
+        include
+        libgcc
+      ]
+      ++ compatIfNeeded;
+
+    preBuild =
+      ''
+        mkdir $BSDSRCDIR/lib/libmd/sys
+      ''
+      + lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
       '';
 
-  installPhase = ''
+    installPhase =
+      if (!bootstrapInstallation) then
+        null
+      else
+        ''
           # libmd is used by install. do it yourself!
           mkdir -p $out/include $out/lib $man/share/man
           cp libmd.a $out/lib/libmd.a
@@ -41,9 +64,12 @@ mkDerivation {
             cp "$f" "$man/share/man/$f"
           done
         '';
-
+  }
-  outputs = [
+  // lib.optionalAttrs bootstrapInstallation {
-    "out"
+    nativeBuildInputs = [
-    "man"
+      makeMinimal
+      bsdSetupHook
+      freebsdSetupHook
     ];
-}
+  }
+)

pkgs/os-specific/bsd/freebsd/pkgs/libmemstat.nix

@@ -0,0 +1,31 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libmemstat";
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}

pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix

@@ -25,4 +25,6 @@ mkDerivation {
     "STRIP=-s" # flag to install, not command
     "MK_WERROR=no"
   ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+
+  alwaysKeepStatic = true;
 }

pkgs/os-specific/bsd/freebsd/pkgs/libprocstat.nix

@@ -0,0 +1,42 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  libutil,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libprocstat";
+  extraPaths = [
+    "lib/libc/Versions.def"
+    "sys/contrib/openzfs"
+    "sys/contrib/pcg-c"
+    "sys/opencrypto"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+    libutil
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}

pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix

@@ -1,12 +1,10 @@
 {
   mkDerivation,
   openssl,
-  libmd,
 }:
 mkDerivation {
   path = "lib/libradius";
   buildInputs = [
-    libmd
     openssl
   ];
 

pkgs/os-specific/bsd/freebsd/pkgs/librpcsvc.nix

@@ -0,0 +1,30 @@
+{
+  mkDerivation,
+  rpcgen,
+  include,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/librpcsvc";
+  extraPaths = [
+    "sys/nlm"
+    "include/rpcsvc"
+  ];
+  noLibc = true;
+
+  extraNativeBuildInputs = [
+    rpcgen
+  ];
+
+  buildInputs = [
+    include
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${include}/include/rpcsvc"
+  '';
+
+  alwaysKeepStatic = true;
+}

pkgs/os-specific/bsd/freebsd/pkgs/librt.nix

@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libthr,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/librt";
+  extraPaths = [
+    "lib/libc/include" # private headers
+    "lib/libc/Versions.def"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libthr
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix

@@ -3,5 +3,5 @@
 mkDerivation {
   path = "lib/libsbuf";
   extraPaths = [ "sys/kern" ];
-  MK_TESTS = "no";
+  env.MK_TESTS = "no";
 }

pkgs/os-specific/bsd/freebsd/pkgs/libssp_nonshared.nix

@@ -0,0 +1,15 @@
+{
+  mkDerivation,
+  include,
+}:
+
+mkDerivation {
+  path = "lib/libssp_nonshared";
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  alwaysKeepStatic = true;
+}

pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix

@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  libcMinimal,
+  include,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libthr";
+  extraPaths = [
+    "lib/libthread_db"
+    "lib/libc" # needs /include + arch-specific files
+    "libexec/rtld-elf"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    libcMinimal
+    include
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix

@@ -1,6 +1,31 @@
-{ mkDerivation }:
+{
+  mkDerivation,
+  include,
+  libgcc,
+  libcMinimal,
+  csu,
+}:
 mkDerivation {
   path = "lib/libutil";
   extraPaths = [ "lib/libc/gen" ];
-  MK_TESTS = "no";
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libgcc
+    libcMinimal
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
 }

pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix

@@ -75,6 +75,9 @@ lib.makeOverridable (
           MACHINE_CPUARCH = freebsd-lib.mkBsdCpuArch stdenv';
 
           COMPONENT_PATH = attrs.path or null;
+
+          # don't set filesystem flags that require root
+          NO_FSCHG = "yes";
         }
         // lib.optionalAttrs stdenv'.hasCC {
           # TODO should CC wrapper set this?
@@ -129,5 +132,21 @@ lib.makeOverridable (
         ))
         ++ attrs.patches or [ ];
     }
+    //
+      lib.optionalAttrs
+        (!stdenv.hostPlatform.isStatic && !attrs.alwaysKeepStatic or false && stdenv.hostPlatform.isFreeBSD)
+        {
+          postInstall =
+            (attrs.postInstall or "")
+            + ''
+              rm -f $out/lib/*.a
+            '';
+        }
+    //
+      lib.optionalAttrs
+        ((stdenv.hostPlatform.isStatic || !stdenv.hostPlatform.isFreeBSD) && attrs ? outputs)
+        {
+          outputs = lib.lists.remove "debug" attrs.outputs;
+        }
   )
 )

pkgs/os-specific/bsd/freebsd/pkgs/msun.nix

@@ -0,0 +1,34 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/msun";
+  extraPaths = [
+    "lib/libc" # wants arch headers
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}

pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix

@@ -4,21 +4,27 @@
   mkDerivation,
   compatIfNeeded,
   compatIsNeeded,
-  libmd,
   libnetbsd,
-  libutil,
+  libmd,
 }:
 
+let
+  libmd' = libmd.override {
+    bootstrapInstallation = true;
+  };
+
+in
 mkDerivation {
   path = "contrib/mtree";
   extraPaths = [ "contrib/mknod" ];
   buildInputs =
     compatIfNeeded
-    ++ [
+    ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
-      libmd
+      libmd'
-      libnetbsd
     ]
-    ++ lib.optional (stdenv.hostPlatform.isFreeBSD) libutil;
+    ++ [
+      libnetbsd
+    ];
 
   postPatch = ''
     ln -s $BSDSRCDIR/contrib/mknod/*.c $BSDSRCDIR/contrib/mknod/*.h $BSDSRCDIR/contrib/mtree

pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix

@@ -2,7 +2,6 @@
   lib,
   mkDerivation,
   stdenv,
-  patchesRoot,
 }:
 
 mkDerivation {

pkgs/os-specific/bsd/freebsd/pkgs/rtld-elf.nix

@@ -0,0 +1,58 @@
+{
+  mkDerivation,
+  include,
+  rpcgen,
+  flex,
+  byacc,
+  csu,
+}:
+
+mkDerivation {
+  path = "libexec/rtld-elf";
+  extraPaths = [
+    "lib/csu"
+    "lib/libc"
+    "lib/libmd"
+    "lib/msun"
+    "lib/libutil"
+    "lib/libc_nonshared"
+    "include/rpcsvc"
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "contrib/tzcode"
+    "contrib/gdtoa"
+    "contrib/jemalloc"
+    "sys/sys"
+    "sys/kern"
+    "sys/libkern"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  extraNativeBuildInputs = [
+    rpcgen
+    flex
+    byacc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    make -C $BSDSRCDIR/lib/libc $makeFlags libc_nossp_pic.a
+  '';
+
+  # definitely a bad idea to enable stack protection on the stack protection initializers
+  hardeningDisable = [ "stackprotector" ];
+
+  env.MK_TESTS = "no";
+}

pkgs/servers/matrix-synapse/default.nix

@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.119.0";
+  version = "1.120.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-+3FrxSfQteIga5uiRNzAlV+xNESB9PUX/UkkL6UMETQ=";
+    hash = "sha256-3gPeit2r3q1WF72WUINS7gD8X9/DGQBmZYlUnaU7mvc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-c/19RaBmtfKkFFQyDBwH+yqHp4YNQSqCu23WYbpOc98=";
+    hash = "sha256-ceIRDYHKpkw/H+ts5dXb5s4Eb8btbt/yHqOYqepWG/s=";
   };
 
   postPatch = ''

pkgs/servers/sql/percona-server/8_0.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.0.37-29";
+  version = "8.0.39-30";
 
   src = fetchurl {
     url = "https://www.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-zZgq3AxCRYdte3dTUJiuMvVGdl9U01s8jxcAqDxZiNM=";
+    hash = "sha256-Ag+9tzmWpdF5vxWOFUsn65oJXIkb0HmoMbif7HcSoP8=";
   };
 
   nativeBuildInputs = [

pkgs/servers/sql/percona-server/8_4.nix

@@ -50,11 +50,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.0-1";
+  version = "8.4.2-2";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-76PXXqTNBVsD7RX2vhp7RyESiFpJL0h0zG9ucNfy3uQ=";
+    hash = "sha256-KdaF2+vZfWf6fW8HWi+c97SHW+WqmlcpdPzUUgX94EY=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/all-packages.nix

@@ -13368,8 +13368,6 @@ with pkgs;
     gtk = gtk3;
   };
 
-  bluejeans-gui = callPackage ../applications/networking/instant-messengers/bluejeans { };
-
   breezy = with python3Packages; toPythonApplication breezy;
 
   cage = callPackage ../applications/window-managers/cage {

pkgs/top-level/stage.nix

@@ -246,7 +246,7 @@ let
       })] ++ overlays;
       ${if stdenv.hostPlatform == stdenv.buildPlatform
         then "localSystem" else "crossSystem"} = {
-        parsed = makeMuslParsedPlatform stdenv.hostPlatform.parsed;
+        config = lib.systems.parse.tripleFromSystem (makeMuslParsedPlatform stdenv.hostPlatform.parsed);
       };
     } else throw "Musl libc only supports 64-bit Linux systems.";
 
@@ -258,9 +258,9 @@ let
       })] ++ overlays;
       ${if stdenv.hostPlatform == stdenv.buildPlatform
         then "localSystem" else "crossSystem"} = {
-        parsed = stdenv.hostPlatform.parsed // {
+        config = lib.systems.parse.tripleFromSystem (stdenv.hostPlatform.parsed // {
           cpu = lib.systems.parse.cpuTypes.i686;
-        };
+        });
       };
     } else throw "i686 Linux package set can only be used with the x86 family.";
 
@@ -270,9 +270,9 @@ let
         pkgsx86_64Darwin = super';
       })] ++ overlays;
       localSystem = {
-        parsed = stdenv.hostPlatform.parsed // {
+        config = lib.systems.parse.tripleFromSystem (stdenv.hostPlatform.parsed // {
           cpu = lib.systems.parse.cpuTypes.x86_64;
-        };
+        });
       };
     } else throw "x86_64 Darwin package set can only be used on Darwin systems.";
 
@@ -311,10 +311,11 @@ let
       })] ++ overlays;
       crossSystem = {
         isStatic = true;
-        parsed =
+        config = lib.systems.parse.tripleFromSystem (
           if stdenv.hostPlatform.isLinux
           then makeMuslParsedPlatform stdenv.hostPlatform.parsed
-          else stdenv.hostPlatform.parsed;
+          else stdenv.hostPlatform.parsed
+        );
         gcc = lib.optionalAttrs (stdenv.hostPlatform.system == "powerpc64-linux") { abi = "elfv2"; } //
           stdenv.hostPlatform.gcc or {};
       };