Merge remote-tracking branch 'origin/master' into staging-next

26 files changed, 568 insertions, 6 deletions

diff --git a/pkgs/applications/version-management/git-and-tools/delta/default.nix b/pkgs/applications/version-management/git-and-tools/delta/default.nix
index 0bd1e2a51217f..1bdd028d8101b 100644
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.14.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hB8qpVXsAVJvtrdTnbPYcL9K4gL2nkZLo6vunjOP/7o=";
+    sha256 = "sha256-rPtLvO6raBY6BfrP0erBaXD86W1JL8g4XC4VbkR4Pww=";
   };
 
-  cargoSha256 = "sha256-19ZGWM8vPbIEYaCxrAZ2HWgSqbeLu3hEb8eLL4a7fAI=";
+  cargoSha256 = "sha256-raT8a8K05ZpiGuZdM1hNikGxqY6w0g8G1DohfybXD9s=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-aggregator/default.nix b/pkgs/applications/version-management/git-and-tools/git-aggregator/default.nix
new file mode 100644
index 0000000000000..9b2465366f672
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-aggregator/default.nix
@@ -0,0 +1,43 @@
+{ lib, git, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "git-aggregator";
+  version = "2.1.0";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-79xNPzYP1j71sU5wZM5e2xTqQExqQEdxXPxbk4T/Scw=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    argcomplete
+    colorama
+    git
+    kaptan
+    requests
+  ];
+
+  checkInputs = [
+    git
+  ];
+
+  preCheck = ''
+    export HOME="$(mktemp -d)"
+    git config --global user.name John
+    git config --global user.email john@localhost
+    git config --global init.defaultBranch master
+    git config --global pull.rebase false
+  '';
+
+  meta = with lib; {
+    description = "Manage the aggregation of git branches from different remotes to build a consolidated one";
+    homepage = "https://github.com/acsone/git-aggregator";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ lourkeur ];
+    mainProgram = "gitaggregate";
+  };
+}
diff --git a/pkgs/applications/version-management/git-backup/default.nix b/pkgs/applications/version-management/git-and-tools/git-backup/default.nix
index 8c45fdef3f7d7..8c45fdef3f7d7 100644
--- a/pkgs/applications/version-management/git-backup/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-backup/default.nix
diff --git a/pkgs/applications/version-management/git-crecord/default.nix b/pkgs/applications/version-management/git-and-tools/git-crecord/default.nix
index 1ad75e75b7bfd..1ad75e75b7bfd 100644
--- a/pkgs/applications/version-management/git-crecord/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crecord/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/git-fire/default.nix b/pkgs/applications/version-management/git-and-tools/git-fire/default.nix
new file mode 100644
index 0000000000000..bc7e9f4840b71
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-fire/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "git-fire";
+  version = "unstable-2017-08-27";
+
+  src = fetchFromGitHub {
+    owner = "qw3rtman";
+    repo = "git-fire";
+    rev = "d72b68ed356f726c77c60294f9220275f16c9931";
+    sha256 = "1hdwkhyjjx31y0lpjkhbb4f5y9f7g70fnd4c2246cmk2rbsvj5b2";
+  };
+
+  installPhase = ''
+    install -D -m755 $src/git-fire $out/bin/git-fire
+  '';
+
+  meta = with lib; {
+    description = ''
+      Push ALL changes in a git repository
+    '';
+    longDescription = ''
+      In the event of an emergency (fire, etc.), automatically commit all changes/files in a repository, pushing to all known remotes all commits and stashes.
+    '';
+    homepage = "https://github.com/qw3rtman/git-fire";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ swflint ];
+    mainProgram = "git-fire";
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-ftp/default.nix b/pkgs/applications/version-management/git-and-tools/git-ftp/default.nix
new file mode 100644
index 0000000000000..57b5e3c463724
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-ftp/default.nix
@@ -0,0 +1,99 @@
+{ lib
+, resholve
+, fetchFromGitHub
+, fetchpatch
+, bash
+, coreutils
+, git
+, gnugrep
+, gawk
+, curl
+, hostname
+, gnused
+, findutils
+, lftp
+, pandoc
+, man
+}:
+
+resholve.mkDerivation rec {
+  pname = "git-ftp";
+  version = "1.6.0";
+  src = fetchFromGitHub {
+    owner = "git-ftp";
+    repo = "git-ftp";
+    rev = version;
+    sha256 = "1hxkqf7jbrx24q18yxpnd3dxzh4xk6asymwkylp1x7zg6mcci87d";
+  };
+
+  dontBuild = true;
+
+  # fix bug/typo; PRed upstream @
+  # https://github.com/git-ftp/git-ftp/pull/628
+  patches = [
+    (fetchpatch {
+      name = "fix-function-invocation-typo.patch";
+      url = "https://github.com/git-ftp/git-ftp/commit/cddf7cbba80e710758f6aac0ec0d77552ea8cd75.patch";
+      sha256 = "sha256-2B0QaMJi78Bg3bA1jp41aiyql1/LCryoaDs7+xmS1HY=";
+    })
+  ];
+
+  installPhase = ''
+    make install-all prefix=$out
+  '';
+
+  nativeBuildInputs = [ pandoc man ];
+
+  solutions = {
+    git-ftp = {
+      scripts = [ "bin/git-ftp" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = [
+        coreutils
+        git
+        gnugrep
+        gawk
+        curl
+        hostname
+        gnused
+        findutils
+        lftp
+      ];
+      fake = {
+        # don't resolve impure system macOS security
+        # caution: will still be fragile if PATH is bad
+        # TODO: fixable once we figure out how to handle
+        # this entire class of problem...
+        "external" = [ "security" ];
+      };
+      keep = {
+        # looks like run-time user/env/git-config controlled
+        "$GIT_PAGER" = true;
+        "$hook" = true; # presumably git hooks given context
+      };
+      execer = [
+        # TODO: rm when binlore/resholve handle git; manually
+        # checked and see no obvious subexec for now
+        "cannot:${git}/bin/git"
+        /*
+        Mild uncertainty here. There *are* commandlikes in
+        the arguments (especially wait & cd), but I think they are
+        fine as-is, because I'm reading them as:
+        1. ftp commands
+        2. running on the remote anyways
+
+        See https://github.com/git-ftp/git-ftp/blob/057f7d8e9f00ffc5a8c6ceaa4be30af2939df41a/git-ftp#L1214-L1221
+        */
+        "cannot:${lftp}/bin/lftp"
+      ];
+    };
+  };
+
+  meta = with lib; {
+    description = "Git powered FTP client written as shell script";
+    homepage = "https://git-ftp.github.io/";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ tweber ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-hound/default.nix b/pkgs/applications/version-management/git-and-tools/git-hound/default.nix
new file mode 100644
index 0000000000000..463d550cbcabb
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-hound/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "git-hound";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "tillson";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-HD5OK8HjnLDbyC/TmVI2HfBRIUCyyHTbA3JvKoeXV5E=";
+  };
+
+  vendorSha256 = null; #vendorSha256 = "";
+
+  meta = with lib; {
+    description = "Reconnaissance tool for GitHub code search";
+    longDescription = ''
+      GitHound pinpoints exposed API keys and other sensitive information
+      across all of GitHub using pattern matching, commit history searching,
+      and a unique result scoring system.
+    '';
+    homepage = "https://github.com/tillson/git-hound";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
+  };
+}
diff --git a/pkgs/applications/version-management/git-lfs/default.nix b/pkgs/applications/version-management/git-and-tools/git-lfs/default.nix
index bbb7d29422aa7..bbb7d29422aa7 100644
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-lfs/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
new file mode 100644
index 0000000000000..c17654174382a
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, fetchFromGitHub
+, git
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "git-privacy";
+  version = "2.1.0";
+  format = "setuptools";
+
+  disabled = python3.pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "EMPRI-DEVOPS";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0hfy43fip1l81672xfwqrz1jryzkjy7h9f2lyikxgibibil0p444";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    click
+    git-filter-repo
+    GitPython
+    pynacl
+    setuptools
+  ];
+
+  checkInputs = with python3.pkgs; [
+    git
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Tests want to interact with a git repo
+    "TestGitPrivacy"
+  ];
+
+  pythonImportsCheck = [
+    "gitprivacy"
+  ];
+
+  meta = with lib; {
+    description = "Tool to redact Git author and committer dates";
+    homepage = "https://github.com/EMPRI-DEVOPS/git-privacy";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-quick-stats/default.nix b/pkgs/applications/version-management/git-and-tools/git-quick-stats/default.nix
new file mode 100644
index 0000000000000..336c24819baf0
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-quick-stats/default.nix
@@ -0,0 +1,51 @@
+{ lib, stdenv
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, gawk
+, git
+, gnugrep
+, ncurses
+, util-linux
+}:
+
+stdenv.mkDerivation rec {
+  pname = "git-quick-stats";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    repo = "git-quick-stats";
+    owner = "arzzen";
+    rev = version;
+    sha256 = "sha256-QmHb5MWZpbZjc93XgdPFabgzT7S522ZN27p6tdL46Y0=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installFlags = [
+    "PREFIX=${builtins.placeholder "out"}"
+  ];
+
+  postInstall =
+    let
+      path = lib.makeBinPath [
+        coreutils
+        gawk
+        git
+        gnugrep
+        ncurses
+        util-linux
+      ];
+    in
+    ''
+      wrapProgram $out/bin/git-quick-stats --suffix PATH : ${path}
+    '';
+
+  meta = with lib; {
+    homepage = "https://github.com/arzzen/git-quick-stats";
+    description = "A simple and efficient way to access various statistics in git repository";
+    platforms = platforms.all;
+    maintainers = [ maintainers.kmein ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
new file mode 100644
index 0000000000000..d78972aa07bdf
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonApplication, fetchPypi
+, colorama, GitPython }:
+
+buildPythonApplication rec {
+  pname = "gitup";
+  version = "0.5.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
+  };
+
+  propagatedBuildInputs = [ colorama GitPython ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Easily update multiple Git repositories at once";
+    homepage = "https://github.com/earwig/git-repo-updater";
+    license = licenses.mit;
+    maintainers = [ maintainers.bdesham ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-and-tools/git-repo/default.nix
index e47ea6b12dbef..e47ea6b12dbef 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-repo/default.nix
diff --git a/pkgs/applications/version-management/git-repo/import-ssl-module.patch b/pkgs/applications/version-management/git-and-tools/git-repo/import-ssl-module.patch
index efc3d2b1f8a5e..efc3d2b1f8a5e 100644
--- a/pkgs/applications/version-management/git-repo/import-ssl-module.patch
+++ b/pkgs/applications/version-management/git-and-tools/git-repo/import-ssl-module.patch
diff --git a/pkgs/applications/version-management/git-review/default.nix b/pkgs/applications/version-management/git-and-tools/git-review/default.nix
index 2650f330c0a99..2650f330c0a99 100644
--- a/pkgs/applications/version-management/git-review/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-review/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/git-series/default.nix b/pkgs/applications/version-management/git-and-tools/git-series/default.nix
new file mode 100644
index 0000000000000..31d1c635512c4
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-series/default.nix
@@ -0,0 +1,40 @@
+{ lib, rustPlatform, fetchFromGitHub
+, pkg-config, openssl, zlib, curl, libgit2, libssh2
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "git-series";
+  version = "unstable-2019-10-15";
+
+  src = fetchFromGitHub {
+    owner = "git-series";
+    repo = "git-series";
+    rev = "c570a015e15214be46a7fd06ba08526622738e20";
+    sha256 = "1i0m2b7ma6xvkg95k57gaj1wpc1rfvka6h8jr5hglxmqqbz6cb6w";
+  };
+
+  cargoSha256 = "1hmx14z3098c98achgii0jkcm4474iw762rmib77amcsxj73zzdh";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl zlib curl libgit2 libssh2 ];
+
+  LIBGIT2_SYS_USE_PKG_CONFIG = true;
+  LIBSSH2_SYS_USE_PKG_CONFIG = true;
+
+  postInstall = ''
+    install -D "$src/git-series.1" "$out/man/man1/git-series.1"
+  '';
+
+  meta = with lib; {
+    description = "A tool to help with formatting git patches for review on mailing lists";
+    longDescription = ''
+      git series tracks changes to a patch series over time. git
+      series also tracks a cover letter for the patch series,
+      formats the series for email, and prepares pull requests.
+    '';
+    homepage = "https://github.com/git-series/git-series";
+
+    license = licenses.mit;
+    maintainers = with maintainers; [ edef vmandela ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-sizer/default.nix b/pkgs/applications/version-management/git-and-tools/git-sizer/default.nix
index ed7239b80cb33..ed7239b80cb33 100644
--- a/pkgs/applications/version-management/git-sizer/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-sizer/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/git-town/default.nix b/pkgs/applications/version-management/git-and-tools/git-town/default.nix
new file mode 100644
index 0000000000000..abca61358d99b
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-town/default.nix
@@ -0,0 +1,77 @@
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles, git, testers, git-town, makeWrapper }:
+
+buildGoModule rec {
+  pname = "git-town";
+  version = "7.8.0";
+
+  src = fetchFromGitHub {
+    owner = "git-town";
+    repo = "git-town";
+    rev = "v${version}";
+    sha256 = "sha256-g9ooMIMN8DN2FcWYkDC1hICCleQYdHf30PYMCit/NMI=";
+  };
+
+  patches = [
+    # Fix "go vet" when building using Go 1.18.
+    (fetchpatch {
+      name = "fix-go-vet-in-go-1.18.patch";
+      url = "https://github.com/git-town/git-town/commit/23eb0aca7b28c6a0afc21db553aa0e35d35891aa.patch";
+      sha256 = "sha256-EyfhKVrQxRJNrYqaZI04dJogaXs1J+bbOIu7p8g2Clc=";
+    })
+  ];
+
+  vendorSha256 = null;
+
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
+
+  buildInputs = [ git ];
+
+  ldflags =
+    let
+      modulePath = "github.com/git-town/git-town/v${lib.versions.major version}"; in
+    [
+      "-s"
+      "-w"
+      "-X ${modulePath}/src/cmd.version=v${version}"
+      "-X ${modulePath}/src/cmd.buildDate=nix"
+    ];
+
+  checkInputs = [ git ];
+  preCheck =
+    let
+      skippedTests = [
+        "TestGodog"
+        "TestRunner_CreateChildFeatureBranch"
+        "TestShellRunner_RunStringWith_Dir"
+        "TestMockingShell_MockCommand"
+        "TestShellRunner_RunStringWith_Input"
+      ];
+    in
+    ''
+      HOME=$(mktemp -d)
+      # Disable tests requiring local operations
+      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
+    '';
+
+  postInstall = ''
+    installShellCompletion --cmd git-town \
+      --bash <($out/bin/git-town completion bash) \
+      --fish <($out/bin/git-town completion fish) \
+      --zsh <($out/bin/git-town completion zsh)
+
+    wrapProgram $out/bin/git-town --prefix PATH : ${lib.makeBinPath [ git ]}
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = git-town;
+    command = "git-town version";
+    version = "v${version}";
+  };
+
+  meta = with lib; {
+    description = "Generic, high-level git support for git-flow workflows";
+    homepage = "https://www.git-town.com/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ allonsy blaggacao ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-up/default.nix b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
index 0a366827e40d5..0a366827e40d5 100644
--- a/pkgs/applications/version-management/git-up/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
diff --git a/pkgs/applications/version-management/gitless/default.nix b/pkgs/applications/version-management/git-and-tools/gitless/default.nix
index 31ab40d79478f..31ab40d79478f 100644
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitless/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/gitlint/default.nix b/pkgs/applications/version-management/git-and-tools/gitlint/default.nix
new file mode 100644
index 0000000000000..626739864c713
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitlint/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, gitMinimal
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gitlint";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "jorisroovers";
+    repo = "gitlint";
+    rev = "v${version}";
+    sha256 = "sha256-MmXzrooN+C9MUaAz4+IEGkGJWHbgvPMSLHgssM0wyN8=";
+  };
+
+  # Upstream splitted the project into gitlint and gitlint-core to
+  # simplify the dependency handling
+  sourceRoot = "source/gitlint-core";
+
+  propagatedBuildInputs = with python3.pkgs; [
+    arrow
+    click
+    sh
+  ];
+
+  checkInputs = with python3.pkgs; [
+    gitMinimal
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    # We don't need gitlint-core
+    substituteInPlace setup.py \
+      --replace "'gitlint-core[trusted-deps]==' + version," ""
+  '';
+
+  pythonImportsCheck = [
+    "gitlint"
+  ];
+
+  meta = with lib; {
+    description = "Linting for your git commit messages";
+    homepage = "https://jorisroovers.com/gitlint/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ethancedwards8 fab ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/gitls/default.nix b/pkgs/applications/version-management/git-and-tools/gitls/default.nix
new file mode 100644
index 0000000000000..4cda10b380575
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitls/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, gitls
+, fetchFromGitHub
+, testers
+}:
+
+buildGoModule rec {
+  pname = "gitls";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "hahwul";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-kLkH/nNidd1QNPKvo7fxZwMhTgd4AVB8Ofw0Wo0z6c0=";
+  };
+
+  vendorSha256 = null;
+
+  passthru.tests.version = testers.testVersion {
+    package = gitls;
+    command = "gitls -version";
+    version = "v${version}";
+  };
+
+  meta = with lib; {
+    description = "Tools to enumerate git repository URL";
+    homepage = "https://github.com/hahwul/gitls";
+    changelog = "https://github.com/hahwul/gitls/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/applications/version-management/gitoxide/default.nix b/pkgs/applications/version-management/git-and-tools/gitoxide/default.nix
index d2a51c94727a2..d2a51c94727a2 100644
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitoxide/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/gitsign/default.nix b/pkgs/applications/version-management/git-and-tools/gitsign/default.nix
new file mode 100644
index 0000000000000..11a8394a63c49
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitsign/default.nix
@@ -0,0 +1,32 @@
+{ lib, buildGoModule, fetchFromGitHub, stdenv, makeWrapper, gitMinimal }:
+
+buildGoModule rec {
+  pname = "gitsign";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "sigstore";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-lSE4BLwtxicngvnDCcMa6F6c3+Okn9NKAOnT2FGi7kU=";
+  };
+  vendorSha256 = "sha256-WrVunAxOXXGSbs9OyKydeg4N/s871mt2O3t2e5DxXQo=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
+
+  postInstall = ''
+    for f in $out/bin/*; do
+      wrapProgram $f --prefix PATH : ${lib.makeBinPath [ gitMinimal ]}
+    done
+  '';
+
+  meta = {
+    homepage = "https://github.com/sigstore/gitsign";
+    changelog = "https://github.com/sigstore/gitsign/releases/tag/v${version}";
+    description = "Keyless Git signing using Sigstore";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lesuisse ];
+  };
+}
diff --git a/pkgs/applications/version-management/gitstats/default.nix b/pkgs/applications/version-management/git-and-tools/gitstats/default.nix
index 6cfcb0077427f..6cfcb0077427f 100644
--- a/pkgs/applications/version-management/gitstats/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstats/default.nix
diff --git a/pkgs/applications/version-management/josh/default.nix b/pkgs/applications/version-management/git-and-tools/josh/default.nix
index acf2b24c0794e..acf2b24c0794e 100644
--- a/pkgs/applications/version-management/josh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/josh/default.nix
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index 6b019e50887cf..e73d4de6dc41c 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "evilmartians";
     repo = "lefthook";
-    sha256 = "sha256-66exuMb0dUQWRhcDUU7mAJ06yD/acKX96KIQwMEU6xM=";
+    sha256 = "sha256-tns/JUOYlgG+oiFACnXlCwHBF4enctV4GPlpEZCM/nM=";
   };
 
-  vendorSha256 = "sha256-NTZz0EDIjGdh8dD9jxbNVdWb7NFJsdtnMp7H6Ni0EbQ=";
+  vendorSha256 = "sha256-sBcgt2YsV9RQhSjPN6N54tRk7nNvcOVhPEsEP+0Dtco=";
 
   nativeBuildInputs = [ installShellFiles ];