Merge release-24.11 into staging-next-24.11

2025-07-14 14:10:33 +03:00 · 2024-12-17 00:19:05 +00:00 · 2024-12-17 00:19:05 +00:00 · aad8a41e2c
commit aad8a41e2c
parent f2858db365 03b200fa3d
42 changed files with 511 additions and 2584 deletions
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -13,15 +13,19 @@ permissions:
  contents: read

 jobs:
+  get-merge-commit:
+    uses: ./.github/workflows/get-merge-commit.yml
+
  nixos:
    name: nixfmt-check
    runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
+    needs: get-merge-commit
+    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          # Fetches the merge commit and its parents
          fetch-depth: 2
      - name: Checking out base branch
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@ -33,10 +33,15 @@ env:
  DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}

 jobs:
+  get-merge-commit:
+    uses: ./.github/workflows/get-merge-commit.yml
+
  # Check that code owners is valid
  check:
    name: Check
    runs-on: ubuntu-latest
+    needs: get-merge-commit
+    if: needs.get-merge-commit.outputs.mergedSha
    steps:
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

@ -65,7 +70,7 @@ jobs:

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
-        ref: refs/pull/${{ github.event.number }}/merge
+        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
        path: pr

    - name: Validate codeowners
--- a/.github/workflows/editorconfig-v2.yml
+++ b/.github/workflows/editorconfig-v2.yml
@ -11,10 +11,14 @@ on:
      - 'release-**'

 jobs:
+  get-merge-commit:
+    uses: ./.github/workflows/get-merge-commit.yml
+
  tests:
    name: editorconfig-check
    runs-on: ubuntu-latest
-    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    needs: get-merge-commit
+    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
    - name: Get list of changed files from PR
      env:
@ -30,7 +34,7 @@ jobs:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        # pull_request_target checks out the base branch by default
-        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
      with:
        # nixpkgs commit is pinned so that it doesn't break
--- a/.github/workflows/eval-lib-tests.yml
+++ b/.github/workflows/eval-lib-tests.yml
@ -15,9 +15,9 @@ jobs:
    name: nixpkgs-lib-tests
    runs-on: ubuntu-latest
    needs: get-merge-commit
+    if: needs.get-merge-commit.outputs.mergedSha
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        if: needs.get-merge-commit.outputs.mergedSha
        with:
          # pull_request_target checks out the base branch by default
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@ -23,22 +23,21 @@ jobs:
    name: Attributes
    runs-on: ubuntu-latest
    needs: get-merge-commit
+    # Skip this and dependent steps if the PR can't be merged
+    if: needs.get-merge-commit.outputs.mergedSha
    outputs:
-      mergedSha: ${{ needs.get-merge-commit.outputs.mergedSha }}
      baseSha: ${{ steps.baseSha.outputs.baseSha }}
      systems: ${{ steps.systems.outputs.systems }}
    steps:
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        # Add this to _all_ subsequent steps to skip them
-        if: needs.get-merge-commit.outputs.mergedSha
        with:
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          fetch-depth: 2
          path: nixpkgs

      - name: Determine base commit
-        if: github.event_name == 'pull_request_target' && needs.get-merge-commit.outputs.mergedSha
+        if: github.event_name == 'pull_request_target'
        id: baseSha
        run: |
          baseSha=$(git -C nixpkgs rev-parse HEAD^1)
@ -46,18 +45,15 @@ jobs:

      - name: Install Nix
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-        if: needs.get-merge-commit.outputs.mergedSha

      - name: Evaluate the list of all attributes and get the systems matrix
        id: systems
-        if: needs.get-merge-commit.outputs.mergedSha
        run: |
          nix-build nixpkgs/ci -A eval.attrpathsSuperset
          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"

      - name: Upload the list of all attributes
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
-        if: needs.get-merge-commit.outputs.mergedSha
        with:
          name: paths
          path: result/*
@ -65,12 +61,12 @@ jobs:
  eval-aliases:
    name: Eval nixpkgs with aliases enabled
    runs-on: ubuntu-latest
-    needs: attrs
+    needs: [ attrs, get-merge-commit ]
    steps:
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.attrs.outputs.mergedSha }}
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          path: nixpkgs

      - name: Install Nix
@ -83,9 +79,7 @@ jobs:
  outpaths:
    name: Outpaths
    runs-on: ubuntu-latest
-    needs: attrs
-    # Skip this and future steps if the PR can't be merged
-    if: needs.attrs.outputs.mergedSha
+    needs: [ attrs, get-merge-commit ]
    strategy:
      matrix:
        system: ${{ fromJSON(needs.attrs.outputs.systems) }}
@ -99,7 +93,7 @@ jobs:
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.attrs.outputs.mergedSha }}
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          path: nixpkgs

      - name: Install Nix
@ -117,7 +111,6 @@ jobs:

      - name: Upload the output paths and eval stats
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
-        if: needs.attrs.outputs.mergedSha
        with:
          name: intermediate-${{ matrix.system }}
          path: result/*
@ -125,7 +118,7 @@ jobs:
  process:
    name: Process
    runs-on: ubuntu-latest
-    needs: [ outpaths, attrs ]
+    needs: [ outpaths, attrs, get-merge-commit ]
    outputs:
      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}
    steps:
@ -138,7 +131,7 @@ jobs:
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.attrs.outputs.mergedSha }}
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          path: nixpkgs

      - name: Install Nix
--- a/.github/workflows/nix-parse-v2.yml
+++ b/.github/workflows/nix-parse-v2.yml
@ -11,10 +11,14 @@ on:
      - 'release-**'

 jobs:
+  get-merge-commit:
+    uses: ./.github/workflows/get-merge-commit.yml
+
  tests:
    name: nix-files-parseable-check
    runs-on: ubuntu-latest
-    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    needs: get-merge-commit
+    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
    - name: Get list of changed files from PR
      env:
@ -30,7 +34,7 @@ jobs:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        # pull_request_target checks out the base branch by default
-        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
      with:
--- a/.github/workflows/nixpkgs-vet.yml
+++ b/.github/workflows/nixpkgs-vet.yml
@ -29,24 +29,21 @@ jobs:
    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
    timeout-minutes: 10
    needs: get-merge-commit
+    if: needs.get-merge-commit.outputs.mergedSha
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        if: needs.get-merge-commit.outputs.mergedSha
        with:
          # pull_request_target checks out the base branch by default
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
          # Fetches the merge commit and its parents
          fetch-depth: 2
      - name: Checking out base branch
-        if: needs.get-merge-commit.outputs.mergedSha
        run: |
          base=$(mktemp -d)
          git worktree add "$base" "$(git rev-parse HEAD^1)"
          echo "base=$base" >> "$GITHUB_ENV"
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-        if: needs.get-merge-commit.outputs.mergedSha
      - name: Fetching the pinned tool
-        if: needs.get-merge-commit.outputs.mergedSha
        # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
        run: |
          # The pinned version of the tooling to use.
@ -59,7 +56,6 @@ jobs:
          # Adds a result symlink as a GC root.
          nix-store --realise "$toolPath" --add-root result
      - name: Running nixpkgs-vet
-        if: needs.get-merge-commit.outputs.mergedSha
        env:
          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
          CLICOLOR_FORCE: 1
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -249,7 +249,8 @@ in
            ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
            Restart = "always";
            AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
-            ReadWritePaths = [ "/proc/sys/net/ipv4" "/proc/sys/net/ipv6" ]
+            ReadWritePaths = [ "/proc/sys/net/ipv4" ]
+              ++ lib.optional cfgN.enableIPv6 "/proc/sys/net/ipv6"
              ++ lib.optionals useResolvConf ([ "/run/resolvconf" ] ++ config.networking.resolvconf.subscriberFiles);
            DeviceAllow = "";
            LockPersonality = true;
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@ -41,6 +41,7 @@ let
      linux_6_1_hardened
      linux_6_6_hardened
      linux_6_11_hardened
+      linux_6_12_hardened
      linux_rt_5_4
      linux_rt_5_10
      linux_rt_5_15
--- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
@ -1,18 +1,18 @@
 {
  "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1fcdhhixxcbqxd8varz3vwz1qrkjpmxmwq74g14z7qafr7nqm757"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "09czfci3c37phn89zzqnsxgxwclmzf03mxlh88v0d7fk4qjlqa4i"
  },
  "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "04d79m0lp8l53lgrpvhl6drn5jzdgjvaj32mcjq9y175f4knhiaw"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1wdnfc0f17rjz5gd1gfngax9ghjxv4gpzq73gyd745j53f64wv7n"
  },
  "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "1grhh38x3mpj86fn487dfmhgdvbjf61mz8fg8sc9dcqhvpi8rr3w"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "04i8j4x26bia3sqc5ra23p0nyy1ncd57mifwakm8nrk8dayigm8d"
  },
  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-images.txt",
-    "sha256": "1l71xhcj2z9fz3mn89iyyxznrgk59qgng549iq3zc8w3l0hl0qry"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-images.txt",
+    "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.30.5+k3s1";
-  k3sCommit = "9b586704a211264ca86b22f2a0b4617b00412235";
-  k3sRepoSha256 = "1fzpkfbk2x9xw9js9ns15g84c7q93knwx7fdmdj4af3830kplnnr";
-  k3sVendorHash = "sha256-fs9p6ywS5XCeJSF5ovDG40o+H4p4QmEJ0cvU5T9hwuA=";
+  k3sVersion = "1.30.7+k3s1";
+  k3sCommit = "00f901803ada2af4adb0439804f98b6fb6379992";
+  k3sRepoSha256 = "0jvbd4g1kisyjs2hrz4aqwrg08b13pvdf10dyyavvw1bmzki26ih";
+  k3sVendorHash = "sha256-3kLD2oyeo1cC0qRD48sFbsARuD034wilcNQpGRa65aQ=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.14.0";
-  k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
-  k3sCNIVersion = "1.5.1-k3s1";
-  k3sCNISha256 = "1bkz78p77aiw64hdvmlgc5zir9x8zha8qprfaab48jxbcsj3dfi7";
-  containerdVersion = "1.7.21-k3s2";
-  containerdSha256 = "0kp93fhmw2kiy46hw3ag05z8xwhw7kqp4wcbhsxshsdf0929g539";
+  k3sRootVersion = "0.14.1";
+  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
+  k3sCNIVersion = "1.6.0-k3s1";
+  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  containerdVersion = "1.7.23-k3s2";
+  containerdSha256 = "0lp9vxq7xj74wa7hbivvl5hwg2wzqgsxav22wa0p1l7lc1dqw8dm";
  criCtlVersion = "1.29.0-k3s1";
 }
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -58,7 +58,7 @@ assert withQt -> qt6 != null;

 stdenv.mkDerivation rec {
  pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.2.8";
+  version = "4.2.9";

  outputs = [
    "out"
@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
    repo = "wireshark";
    owner = "wireshark";
    rev = "v${version}";
-    hash = "sha256-QnBETFkYoeBTQFV8g2c/dZjgCXaMtFi1MQUgmkOool8=";
+    hash = "sha256-4GnDHGfd2FUOhel8/ZCzAH1iuUz1nTPdAAUCTcY0R5E=";
  };

  patches = [
--- a/pkgs/by-name/da/davfs2/package.nix
+++ b/pkgs/by-name/da/davfs2/package.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "davfs2";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchurl {
    url = "mirror://savannah/davfs2/davfs2-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-JR23Wic4DMoTMLG5cXAMXl3MDJDlpHYiKF8BQO3+Oi8=";
+    sha256 = "sha256-KY7dDGdzy+JY4VUqQxrK6msu7bcIeImnNdrviIX8saw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/lirc/package.nix
+++ b/pkgs/by-name/li/lirc/package.nix
@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
    # Add a workaround for linux-headers-5.18 until upstream adapts:
    #   https://sourceforge.net/p/lirc/git/merge-requests/45/
    ./linux-headers-5.18.patch
+
+    # remove check for `Ubuntu` in /proc/version which will override
+    # --with-systemdsystemunitdir
+    # https://sourceforge.net/p/lirc/tickets/385/
+    ./ubuntu.diff
  ];

  postPatch = ''
--- a/pkgs/by-name/li/lirc/ubuntu.diff
+++ b/pkgs/by-name/li/lirc/ubuntu.diff
@ -0,0 +1,22 @@
+diff --git a/configure.ac b/configure.ac
+index d28c673..1cd0548 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -434,16 +434,7 @@ AC_CHECK_LIB([udev], [udev_device_new_from_device_id], [
+   LIBS="$LIBS $LIBUDEV_LIBS"
+ ])
+ 
+-dnl Ubuntu's systemd pkg-config seems broken beyond repair. So:
+-kernelversion=`cat /proc/version || echo "non-linux"`
+-AS_CASE([$kernelversion],
+-  [*Ubuntu*],[
+-    AC_MSG_NOTICE([Hardwiring Ubuntu systemd setup])
+-    AC_SUBST([systemdsystemunitdir], [/lib/systemd/system])
+-    AM_CONDITIONAL([WITH_SYSTEMDSYSTEMUNITDIR], [true])
+-  ],[*],[
+-    SYSTEMD_SYSTEMUNITDIR
+-])
+SYSTEMD_SYSTEMUNITDIR
+ 
+ AC_ARG_WITH(lockdir,
+   [  --with-lockdir=DIR      Old-school device lock files in DIR (/var/lock{/lockdev})],
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@ -20,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "nfs-ganesha";
-  version = "6.3";
+  version = "6.4";

  outputs = [
    "out"
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    owner = "nfs-ganesha";
    repo = "nfs-ganesha";
    rev = "V${version}";
-    hash = "sha256-4gPhmBC42uCcaEhdJj9ZWw4ECB9UYwP+c2ndBFbBK0k=";
+    hash = "sha256-iT/6p4T4xrGsK2zBs5TDfEIhcCwNfUalQFLlCOODp24=";
  };

  preConfigure = "cd src";
--- a/pkgs/by-name/os/oscavmgr/Cargo.lock
+++ b/pkgs/by-name/os/oscavmgr/Cargo.lock
--- a/pkgs/by-name/os/oscavmgr/package.nix
+++ b/pkgs/by-name/os/oscavmgr/package.nix
@ -20,14 +20,8 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-05dNBzf1f92bVNLbRaUB6KUae+wY3V8mUxDgAb+g1T4=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "alvr_common-20.11.1" = "sha256-d4KldPii8W1HcfnMSD8Fn+IGO/a3r8747APPjRCnbe8=";
-      "openxr-0.19.0" = "sha256-kbEYoN4UvUEaZA9LJWEKx1X1r+l91GjTWs1hNXhr7cw=";
-      "settings-schema-0.2.0" = "sha256-luEdAKDTq76dMeo5kA+QDTHpRMFUg3n0qvyQ7DkId0k=";
-    };
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-fw26EbdCnz7KtDmCDpvfy4fjYORL2KcnhzQBJDdNEuI=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sl/sla2pdf/package.nix
+++ b/pkgs/by-name/sl/sla2pdf/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  scribus,
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "sla2pdf";
+  version = "0.0.1-unstable-2023-05-17";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sla2pdf-team";
+    repo = "sla2pdf";
+    rev = "1524e6ca490da71eb201ff13bf32ef7206b0e4ef";
+    hash = "sha256-mvZ6Es8TLJmNwdacRJ3Gw5z0nI6xW1igz50yjIFBUds=";
+  };
+
+  build-system = [ python3.pkgs.setuptools ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ scribus ]}"
+  ];
+
+  meta = {
+    description = "Convert Scribus SLA files to PDF from the command line";
+    homepage = "https://github.com/sla2pdf-team/sla2pdf";
+    license = with lib.licenses; [
+      cc-by-40
+      mpl20
+    ];
+    maintainers = with lib.maintainers; [ ob7 ];
+    mainProgram = "sla2pdf";
+  };
+}
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -167,6 +167,10 @@ in
    stdlib
  ];

+  preConfigure = ''
+    make elpi/dune || true
+  '';
+
  meta = {
    description = "Coq plugin embedding ELPI";
    maintainers = [ lib.maintainers.cohencyril ];
--- a/pkgs/development/ocaml-modules/elpi/default.nix
+++ b/pkgs/development/ocaml-modules/elpi/default.nix
@ -8,7 +8,7 @@
 , ppxlib, ppx_deriving
 , ppxlib_0_15, ppx_deriving_0_15
 , coqPackages
-, version ? if lib.versionAtLeast ocaml.version "4.13" then "2.0.5"
+, version ? if lib.versionAtLeast ocaml.version "4.13" then "2.0.6"
    else if lib.versionAtLeast ocaml.version "4.08" then "1.20.0"
    else "1.15.2"
 }:
@ -17,6 +17,7 @@ let p5 = camlp5; in
 let camlp5 = p5.override { legacy = true; }; in

 let fetched = coqPackages.metaFetch ({
+    release."2.0.6".sha256 = "sha256-tRUYXQZ0VXrjIZBZ1skdzieUsww4rSNEe5ik+iKpk3U=";
    release."2.0.5".sha256 = "sha256-cHgERFqrfSg5WtUX3UxR6L+QkzS7+t6n4V+wweiEacc=";
    release."1.20.0".sha256 = "sha256-lctZAIQgOg5d+LfILtWsBVcsemV3zTZYfJfDlCxHtcA=";
    release."1.19.2".sha256 = "sha256-dBj5Ek7PWq/8Btq/dggJUqa8cUtfvbi6EWo/lJEDOU4=";
--- a/pkgs/development/ocaml-modules/hxd/default.nix
+++ b/pkgs/development/ocaml-modules/hxd/default.nix
@ -23,6 +23,10 @@ buildDunePackage rec {

  doCheck = true;

+  preCheck = ''
+    export DUNE_CACHE=disabled
+  '';
+
  meta = with lib; {
    description = "Hexdump in OCaml";
    homepage = "https://github.com/dinosaure/hxd";
--- a/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
+++ b/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, logs, zarith }:
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, logs, zarith }:

 buildDunePackage rec {
  pname = "ocplib-simplex";
@ -11,6 +11,13 @@ buildDunePackage rec {
    hash = "sha256-fLTht+TlyJIsIAsRLmmkFKsnbSeW3BgyAyURFdnGfko=";
  };

+  # Fix tests with dune 3.17.0
+  # See https://github.com/OCamlPro/ocplib-simplex/issues/35
+  patches = (fetchpatch {
+    url = "https://github.com/OCamlPro/ocplib-simplex/commit/456a744bddd397daade7959d4a49cfadafdadd33.patch";
+    hash = "sha256-tQUXOoRGe1AIzHcm6j2MopROxn75OE9YUP+CwcKUbVg=";
+  });
+
  propagatedBuildInputs = [ logs zarith ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/reason-react/default.nix
+++ b/pkgs/development/ocaml-modules/reason-react/default.nix
@ -17,6 +17,11 @@ buildDunePackage {
    melange
  ];
  doCheck = true;
+  # Fix tests with dune 3.17.0
+  # See https://github.com/reasonml/reason-react/issues/870
+  preCheck = ''
+    export DUNE_CACHE=disabled
+  '';
  meta = reason-react-ppx.meta // {
    description = "Reason bindings for React.js";
  };
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@ -2,11 +2,10 @@
  lib,
  stdenv,
  buildPythonPackage,
-  fetchurl,
+  fetchPypi,
  pkg-config,
  dbus,
  lndir,
-  setuptools,
  dbus-python,
  sip,
  pyqt6-sip,
@ -25,15 +24,15 @@

 buildPythonPackage rec {
  pname = "pyqt6";
-  version = "6.8.0.dev2410141303";
-  format = "pyproject";
+  version = "6.8.0";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

-  # This is dangerous, how can we get web archive to archive the URL?
-  src = fetchurl {
-    url = "https://riverbankcomputing.com/pypi/packages/PyQt6/PyQt6-${version}.tar.gz";
-    hash = "sha256-eHYqj22us07uFkErJD2d0y0wueZxtQTwTFW9cI7yoK4=";
+  src = fetchPypi {
+    pname = "PyQt6";
+    inherit version;
+    hash = "sha256-bYYo3kwqBQ8LdEYuTJy5f4Ob9v+rvKkXEXIv+ygVcNk=";
  };

  patches = [
@ -45,6 +44,16 @@ buildPythonPackage rec {
    ./pyqt5-confirm-license.patch
  ];

+  build-system = [
+    sip
+    pyqt-builder
+  ];
+
+  dependencies = [
+    pyqt6-sip
+    dbus-python
+  ];
+
  # be more verbose
  # and normalize version
  postPatch = ''
@ -53,11 +62,8 @@ buildPythonPackage rec {
    verbose = true
    EOF

-    # pythonRelaxDeps doesn't work and the wanted versions are not released AFAIK
    substituteInPlace pyproject.toml \
-      --replace-fail 'version = "${version}"' 'version = "${lib.versions.pad 3 version}"' \
-      --replace-fail "sip >=6.9, <7" "sip >=6.8.6, <7" \
-      --replace-fail 'PyQt-builder >=1.17, <2' "PyQt-builder >=1.16, <2"
+      --replace-fail 'version = "${version}"' 'version = "${lib.versions.pad 3 version}"'
  '';

  enableParallelBuilding = true;
@ -83,7 +89,6 @@ buildPythonPackage rec {
    [
      pkg-config
      lndir
-      sip
      qtbase
      qtsvg
      qtdeclarative
@ -104,7 +109,6 @@ buildPythonPackage rec {
      qtbase
      qtsvg
      qtdeclarative
-      pyqt-builder
      qtquick3d
      qtquicktimeline
    ]
@ -113,13 +117,8 @@ buildPythonPackage rec {
    ++ lib.optional withLocation qtlocation;

  propagatedBuildInputs =
-    [
-      dbus-python
-      pyqt6-sip
-      setuptools
-    ]
    # ld: library not found for -lcups
-    ++ lib.optionals (withPrintSupport && stdenv.hostPlatform.isDarwin) [ cups ];
+    lib.optionals (withPrintSupport && stdenv.hostPlatform.isDarwin) [ cups ];

  passthru = {
    inherit sip pyqt6-sip;
--- a/pkgs/development/python-modules/pyqt6-charts/default.nix
+++ b/pkgs/development/python-modules/pyqt6-charts/default.nix
@ -13,15 +13,15 @@

 buildPythonPackage rec {
  pname = "pyqt6-charts";
-  version = "6.7.0";
-  format = "pyproject";
+  version = "6.8.0";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

  src = fetchPypi {
    pname = "PyQt6_Charts";
    inherit version;
-    hash = "sha256-xPfPNpko978DLk4z9xjTuP5m2hdtSVn+MHNalw2G81w=";
+    hash = "sha256-+GcFuHQOMEFmfOIRrqogW3UOtrr0yQj04/bcjHINEPE=";
  };

  # fix include path and increase verbosity
@ -46,16 +46,21 @@ buildPythonPackage rec {

  dontWrapQtApps = true;

-  nativeBuildInputs = with qt6Packages; [
-    qtcharts
+  build-system = [
    sip
-    qmake
    pyqt-builder
  ];

-  buildInputs = with qt6Packages; [ qtcharts ];
+  dependencies = [
+    pyqt6
+  ];

-  propagatedBuildInputs = [ pyqt6 ];
+  nativeBuildInputs = with qt6Packages; [
+    qtcharts
+    qmake
+  ];
+
+  buildInputs = with qt6Packages; [ qtcharts ];

  dontConfigure = true;

@ -64,11 +69,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "PyQt6.QtCharts" ];

-  meta = with lib; {
+  meta = {
    description = "Python bindings for Qt6 QtCharts";
    homepage = "https://riverbankcomputing.com/";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
    inherit (mesa.meta) platforms;
-    maintainers = with maintainers; [ dandellion ];
+    maintainers = with lib.maintainers; [ dandellion ];
  };
 }
--- a/pkgs/development/python-modules/pyqt6-webengine/default.nix
+++ b/pkgs/development/python-modules/pyqt6-webengine/default.nix
@ -15,17 +15,21 @@

 buildPythonPackage rec {
  pname = "pyqt6-webengine";
-  version = "6.7.0";
-  format = "pyproject";
+  version = "6.8.0";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

  src = fetchPypi {
    pname = "PyQt6_WebEngine";
    inherit version;
-    hash = "sha256-aO3HrbbZ4nX13pVogeecyg1x+tQ5q+qhDYI7/1rFUAE=";
+    hash = "sha256-ZARepiK2pBiCwrGPVa6XFLhmCs/walTpEOtygiwvP/I=";
  };

+  patches = [
+    ./qvariant.patch
+  ];
+
  # fix include path and increase verbosity
  postPatch = ''
    sed -i \
@ -53,18 +57,23 @@ buildPythonPackage rec {

  dontWrapQtApps = true;

-  nativeBuildInputs = with qt6Packages; [
-    pkg-config
-    lndir
+  build-system = [
    sip
-    qtwebengine
-    qmake
    pyqt-builder
  ];

-  buildInputs = with qt6Packages; [ qtwebengine ];
+  dependencies = [
+    pyqt6
+  ];

-  propagatedBuildInputs = [ pyqt6 ];
+  nativeBuildInputs = with qt6Packages; [
+    pkg-config
+    lndir
+    qtwebengine
+    qmake
+  ];
+
+  buildInputs = with qt6Packages; [ qtwebengine ];

  passthru = {
    inherit sip;
@ -80,12 +89,12 @@ buildPythonPackage rec {
    "PyQt6.QtWebEngineWidgets"
  ];

-  meta = with lib; {
+  meta = {
    description = "Python bindings for Qt6 WebEngine";
    homepage = "https://riverbankcomputing.com/";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
    inherit (mesa.meta) platforms;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      LunNova
      nrdxp
    ];
--- a/pkgs/development/python-modules/pyqt6-webengine/qvariant.patch
+++ b/pkgs/development/python-modules/pyqt6-webengine/qvariant.patch
@ -0,0 +1,12 @@
+diff --git a/sip/QtWebEngineCore/qwebengineframe.sip b/sip/QtWebEngineCore/qwebengineframe.sip
+index d5420e6..5a29f29 100644
+--- a/sip/QtWebEngineCore/qwebengineframe.sip
+++ b/sip/QtWebEngineCore/qwebengineframe.sip
+@@ -26,6 +26,7 @@ class QWebEngineFrame /NoDefaultCtors/
+ {
+ %TypeHeaderCode
+ #include <qwebengineframe.h>
+#include <QVariant>
+ %End
+ 
+ public:
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "scapy";
-  version = "2.6.0";
+  version = "2.6.1";
  format = "setuptools";

  disabled = isPyPy;
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "secdev";
    repo = "scapy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-k/wfY5nq/txdiqj5gyHT9FSjnFzazDBawE3+aNe9zrQ=";
+    hash = "sha256-m2L30aEpPp9cfW652yd+0wFkNlMij6FF1RzWZbwJ79A=";
  };

  patches = [ ./find-library.patch ];
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@ -16,12 +16,12 @@

 buildPythonPackage rec {
  pname = "sip";
-  version = "6.9.0";
+  version = "6.9.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-CT/Q4V2Zri+Kg91/fbqj/yUMWCp3644IRc2aytsfCTQ=";
+    hash = "sha256-eQS+UZDXh5lSVjt4o68OWPon2VJa9/U/k+rHqDtDPns=";
  };

  build-system = [
--- a/pkgs/development/python-modules/wrf-python/default.nix
+++ b/pkgs/development/python-modules/wrf-python/default.nix
@ -49,6 +49,9 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "wrf" ];

  meta = with lib; {
+    # `ModuleNotFoundError: No module named 'distutils.msvccompiler'` on Python 3.11
+    # `ModuleNotFoundError: No module named 'numpy.distutils'` on Python 3.12
+    broken = true;
    description = "WRF postprocessing library for Python";
    homepage = "http://wrf-python.rtfd.org";
    license = licenses.asl20;
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@ -6,11 +6,11 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "3.16.1";
+  version = "3.17.0";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-t4GuIPh2E8KhG9BxeAngBHDILWFeFSZPmmTgMwUaw94=";
+    hash = "sha256-LDqmxB7Tnj1sGiktdfSAa9gDEIQa/FFnOqWc6cgWUHw=";
  };

  nativeBuildInputs = [ ocaml findlib ];
--- a/pkgs/development/tools/ocaml/melange/default.nix
+++ b/pkgs/development/tools/ocaml/melange/default.nix
@ -31,6 +31,8 @@ let
        version = "4.0.0-51";
        hash = "sha256-940Yzp1ZXnN6mKVWY+nqKjn4qtBUJR5eHE55OTjGvdU=";
      }
+    else if lib.versionAtLeast ocaml.version "5.0" then
+      throw "melange is not available for OCaml ${ocaml.version}"
    else
      {
        version = "4.0.0-414";
@ -57,7 +59,7 @@ buildDunePackage {
    menhirLib
    ppxlib
  ];
-  doCheck = true;
+  doCheck = false;
  nativeCheckInputs = [
    jq
    merlin
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -526,15 +526,16 @@ let
      };

    # Enable Rust and features that depend on it
+    # Use a lower priority to allow these options to be overridden in hardened/config.nix
    rust = lib.optionalAttrs withRust {
-      RUST = yes;
+      RUST = lib.mkDefault yes;

      # These don't technically require Rust but we probably want to get some more testing
      # on the whole DRM panic setup before shipping it by default.
      DRM_PANIC = whenAtLeast "6.12" yes;
      DRM_PANIC_SCREEN = whenAtLeast "6.12" (freeform "kmsg");

-      DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" yes;
+      DRM_PANIC_SCREEN_QR_CODE = lib.mkDefault (whenAtLeast "6.12" yes);
    };

    sound =
@ -1250,7 +1251,7 @@ let
        LIRC = yes;

        SCHED_CORE = whenAtLeast "5.14" yes;
-        SCHED_CLASS_EXT = whenAtLeast "6.12" yes;
+        SCHED_CLASS_EXT = lib.mkDefault (whenAtLeast "6.12" yes);

        LRU_GEN = whenAtLeast "6.1" yes;
        LRU_GEN_ENABLED = whenAtLeast "6.1" yes;
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@ -38,6 +38,8 @@ assert (lib.versionAtLeast version "4.9");
  DEBUG_PLIST = whenAtLeast "5.2" yes;
  DEBUG_SG = yes;
  DEBUG_VIRTUAL = yes;
+  # Set in common config as whenAtLeast "6.12" yes; Currently errors during config
+  SCHED_CLASS_EXT = whenAtLeast "6.12" (option yes);
  SCHED_STACK_END_CHECK = yes;

  REFCOUNT_FULL = whenOlder "5.4.208" yes;
@ -116,4 +118,7 @@ assert (lib.versionAtLeast version "4.9");

  # not needed for less than a decade old glibc versions
  LEGACY_VSYSCALL_NONE = yes;
+
+  RUST = option yes; # Yes currently erros on 6.12
+  DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" (option yes);
 }
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -42,21 +42,31 @@
    "6.11": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.11.10-hardened1.patch",
-            "sha256": "10m3xkanix9yhj95p1qr5dk3gydq1hbnbnibrlp4ag9yqd5ki7d4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.11.10-hardened1/linux-hardened-v6.11.10-hardened1.patch"
+            "name": "linux-hardened-v6.11.11-hardened1.patch",
+            "sha256": "09y9bglln7br53pwzb3yqafkaklfwn1hx5qpwp6x1s817bj7bhxx",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.11.11-hardened1/linux-hardened-v6.11.11-hardened1.patch"
        },
-        "sha256": "0xzynjyyr16my0wrla4ggpjbh4g7nsqixaimz5hrsqlhaa8q9hab",
-        "version": "6.11.10"
+        "sha256": "1z2913y38clnlmhvwj49h7p4pic24s4d8np7nmd4lk7m2xz8w532",
+        "version": "6.11.11"
+    },
+    "6.12": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-v6.12.4-hardened1.patch",
+            "sha256": "0807n36inzq82m8m279q6sfnh7cn2nwkqnf6hi5kw9k9z0x20a8l",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.4-hardened1/linux-hardened-v6.12.4-hardened1.patch"
+        },
+        "sha256": "0lhisw9sy0b38j1nifcgjm8w9864qx3hg6b7f6z2311x8chzhdbg",
+        "version": "6.12.4"
    },
    "6.6": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.63-hardened1.patch",
-            "sha256": "1nsg9f6fgh1yfa95gwrdh8g8kwywbczl2rv8j06qsk0y6b79kmw1",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.63-hardened1/linux-hardened-v6.6.63-hardened1.patch"
+            "name": "linux-hardened-v6.6.64-hardened1.patch",
+            "sha256": "12zm0irxdl9iqihpnk9vwxqrraak3mf894s5pa7y62qan3xghc57",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.64-hardened1/linux-hardened-v6.6.64-hardened1.patch"
        },
-        "sha256": "0d8q0vwv3lcix3wiq2n53rir3h298flg2l0ghpify4rlh2s4l1fi",
-        "version": "6.6.63"
+        "sha256": "1cbag4wzv5fpjdcl0rpp158ch1q17rfz2qxm1xjjyhnblqzxjpq6",
+        "version": "6.6.64"
    }
 }
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -124,6 +124,7 @@ let
            PSI = lib.mkForce (option no);
            RT_GROUP_SCHED = lib.mkForce (option no);
            SCHED_AUTOGROUP = lib.mkForce (option no);
+            SCHED_CLASS_EXT = lib.mkForce (option no);
            SCHED_CORE = lib.mkForce (option no);
            UCLAMP_TASK = lib.mkForce (option no);
            UCLAMP_TASK_GROUP = lib.mkForce (option no);
--- a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
@ -50,6 +50,8 @@
 , hasManpages ? false
 , hasRunfiles ? false
 , hasTlpkg ? false
+, hasCatalogue ? true
+, catalogue ? pname
 , extraNativeBuildInputs ? [ ]
 , ...
 }@args:
@ -73,6 +75,8 @@ let
    hydraPlatforms = [ ];
  } // lib.optionalAttrs (args ? shortdesc) {
    description = args.shortdesc;
+  } // lib.optionalAttrs hasCatalogue {
+    homepage = "https://ctan.org/pkg/${catalogue}";
  };

  hasBinfiles = args ? binfiles && args.binfiles != [ ];
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@ -40,38 +40,56 @@ $a}
  # number of path components to strip, defaulting to 1 ("texmf-dist/")
  /^relocated 1/i\  stripPrefix = 0;

-  # extract version and clean unwanted chars from it
-  /^catalogue-version/y/ \/~/_--/
-  /^catalogue-version/s/[\#,:\(\)]//g
-  s/^catalogue-version_(.*)/  version = "\1";/p
+  /^catalogue(-| )/{
+    :next-cat

-  /^catalogue-license/{
-    # wrap licenses in quotes
-    s/ ([^ ]+)/ "\1"/g
-    # adjust naming as in nixpkgs, the full texts of the licenses are available at https://www.ctan.org/license/${licenseName}
-    s/"(cc-by(-sa)?-[1-4])"/"\10"/g
-    s/"apache2"/"asl20"/g
-    s/"artistic"/"artistic1-cl8"/g
-    s/"bsd"/"bsd3"/g          # license text does not match exactly, but is pretty close
-    s/"bsd4"/"bsdOriginal"/g
-    s/"collection"/"free"/g   # used for collections of individual packages with distinct licenses. As TeXlive only contains free software, we can use "free" as a catchall
-    s/"fdl"/"fdl13Only"/g
-    s/"gpl"/"gpl1Only"/g
-    s/"gpl([1-3])"/"gpl\1Only"/g
-    s/"gpl2\+"/"gpl2Plus"/g
-    s/"gpl3\+"/"gpl3Plus"/g
-    s/"lgpl"/"lgpl2"/g
-    s/"lgpl2\.1"/"lgpl21"/g
-    s/"lppl"/"lppl13c"/g      # not used consistently, sometimes "lppl" refers to an older version of the license
-    s/"lppl1\.2"/"lppl12"/g
-    s/"lppl1\.3"/"lppl13c"/g  # If a work refers to LPPL 1.3 as its license, this is interpreted as the latest version of the 1.3 license (https://www.latex-project.org/lppl/)
-    s/"lppl1\.3a"/"lppl13a"/g
-    s/"lppl1\.3c"/"lppl13c"/g
-    s/"other-free"/"free"/g
-    s/"opl"/"opubl"/g
-    s/"pd"/"publicDomain"/g
+    s/^catalogue (.*)/  catalogue = "\1";/p

-    s/^catalogue-license (.*)/  license = [ \1 ];/p
+    # extract version and clean unwanted chars from it
+    /^catalogue-version/y/ \/~/_--/
+    /^catalogue-version/s/[\#,:\(\)]//g
+    s/^catalogue-version_(.*)/  version = "\1";/p
+
+    # extract license
+    /^catalogue-license/{
+      # wrap licenses in quotes
+      s/ ([^ ]+)/ "\1"/g
+      # adjust naming as in nixpkgs, the full texts of the licenses are available at https://www.ctan.org/license/${licenseName}
+      s/"(cc-by(-sa)?-[1-4])"/"\10"/g
+      s/"apache2"/"asl20"/g
+      s/"artistic"/"artistic1-cl8"/g
+      s/"bsd"/"bsd3"/g          # license text does not match exactly, but is pretty close
+      s/"bsd4"/"bsdOriginal"/g
+      s/"collection"/"free"/g   # used for collections of individual packages with distinct licenses. As TeXlive only contains free software, we can use "free" as a catchall
+      s/"fdl"/"fdl13Only"/g
+      s/"gpl"/"gpl1Only"/g
+      s/"gpl([1-3])"/"gpl\1Only"/g
+      s/"gpl2\+"/"gpl2Plus"/g
+      s/"gpl3\+"/"gpl3Plus"/g
+      s/"lgpl"/"lgpl2"/g
+      s/"lgpl2\.1"/"lgpl21"/g
+      s/"lppl"/"lppl13c"/g      # not used consistently, sometimes "lppl" refers to an older version of the license
+      s/"lppl1\.2"/"lppl12"/g
+      s/"lppl1\.3"/"lppl13c"/g  # If a work refers to LPPL 1.3 as its license, this is interpreted as the latest version of the 1.3 license (https://www.latex-project.org/lppl/)
+      s/"lppl1\.3a"/"lppl13a"/g
+      s/"lppl1\.3c"/"lppl13c"/g
+      s/"other-free"/"free"/g
+      s/"opl"/"opubl"/g
+      s/"pd"/"publicDomain"/g
+
+      s/^catalogue-license (.*)/  license = [ \1 ];/p
+    }
+
+    s/^.*$//
+    N
+    s/^\ncatalogue(-| )/catalogue\1/
+    t next-cat
+
+    # flag existence of catalogue info in hold space
+    x ; s/$/\n  hasCatalogue = true;/ ; x
+
+    # restart cycle
+    D
  }

  # extract deps
@ -222,7 +240,25 @@ $a}
  }

  # close attrmap
-  /^$/i};
+  /^$/{
+    # process content of hold space
+    x
+
+    # change hasCatalogue default from false to true
+    s/^  hasCatalogue = true;$//Mg
+    t had-catalogue
+    s/(\n?)$/\1  hasCatalogue = false;/
+    :had-catalogue
+
+    # print hold space if not empty
+    /./Mp
+
+    # erase hold space
+    s/.*//
+    x
+
+    i};
+  }
 }

 # add list of binaries from one of the architecture-specific packages
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -12595,6 +12595,8 @@ with pkgs;
  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
  linuxPackages_6_11_hardened = linuxKernel.packages.linux_6_11_hardened;
  linux_6_11_hardened = linuxKernel.kernels.linux_6_11_hardened;
+  linuxPackages_6_12_hardened = linuxKernel.packages.linux_6_12_hardened;
+  linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened;

  # GNU Linux-libre kernels
  linuxPackages-libre = linuxKernel.packages.linux_libre;
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -276,6 +276,7 @@ in {
    linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
    linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
    linux_6_11_hardened = hardenedKernelFor kernels.linux_6_11 { };
+    linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };

  } // lib.optionalAttrs config.allowAliases {
    linux_4_14 = throw "linux 4.14 was removed because it will reach its end of life within 23.11";
@ -675,6 +676,7 @@ in {
    linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
    linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
    linux_6_11_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_11_hardened);
+    linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);

    linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
    linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);