about summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix112
-rw-r--r--pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix11
-rw-r--r--pkgs/os-specific/bsd/freebsd/lib/default.nix20
-rw-r--r--pkgs/os-specific/bsd/freebsd/package-set.nix96
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/compat-fix-typedefs-locations.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/compat-install-dirs.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch)4
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/libc-msun-arch-subdir.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/libc-no-force--lcompiler-rt.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/libnetbsd-do-install.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/librpcsvc-include-subdir.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/mtree-Makefile.patch13
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/no-perms-BSD.include.dist.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/sys-gnu-date.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/13.1/sys-no-explicit-intrinsics-dep.patch (renamed from pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/bmake-no-compiler-rt.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/compat-fix-typedefs-locations.patch32
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/compat-install-dirs.patch40
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/install-bootstrap-Makefile.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libc-msun-arch-subdir.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libc-no-force--lcompiler-rt.patch10
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libnetbsd-do-install.patch32
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/librpcsvc-include-subdir.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/localedef.patch158
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/mtree-Makefile.patch13
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/no-perms-BSD.include.dist.patch11
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/rtld-no-force--lcompiler-rt.patch10
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/sys-gnu-date.patch13
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/sys-no-explicit-intrinsics-dep.patch42
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/tinfo-host-cc.patch15
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/bin.nix92
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix24
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix241
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/config.nix36
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/cp.nix10
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/csu.nix25
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix25
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/filterSource.nix34
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix4
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh11
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix4
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/iconv.nix12
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix33
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/install.nix76
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix315
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libcapsicum.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libcasper.nix26
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix18
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libedit.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix29
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libjail.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix49
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libncurses-tinfo.nix15
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libncurses.nix25
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix32
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix4
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix23
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libxo.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/locale.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/localedef.nix39
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/locales.nix51
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix19
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/make.nix27
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix231
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkcsmapper.nix22
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkesdb.nix19
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix4
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix37
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix11
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sed.nix3
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/source.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/stat.nix19
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix16
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix148
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix28
-rwxr-xr-xpkgs/os-specific/bsd/freebsd/update.py22
-rw-r--r--pkgs/os-specific/bsd/freebsd/versions.json59
-rw-r--r--pkgs/os-specific/bsd/lib/install-wrapper.sh (renamed from pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh)1
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix310
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/column.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/common.nix3
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix181
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/config.nix29
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/csu.nix50
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/dict.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix20
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/headers.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix19
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/include.nix34
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix89
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix26
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libc.nix116
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcMinimal.nix85
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix10
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix26
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix50
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libm.nix16
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix10
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix5
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix42
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix14
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix44
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librt.nix25
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix36
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix55
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/make-rules.nix70
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/make.nix64
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix24
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/man.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/misc.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix194
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix4
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix4
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh11
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/source.nix12
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix17
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix56
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix46
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix46
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tic.nix36
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix9
-rw-r--r--pkgs/os-specific/bsd/openbsd/default.nix50
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/csu.nix23
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/include/package.nix57
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/libc/disable-librebuild.patch12
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/libc/netbsd-make-to-lower.patch16
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix121
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix21
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/make-rules/netbsd-make-sinclude.patch15
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix35
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix98
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/package.nix3
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/setup-hook.sh21
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/source.nix8
-rw-r--r--pkgs/os-specific/bsd/setup-hook.sh1
-rw-r--r--pkgs/os-specific/darwin/apparency/default.nix13
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h129
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix86
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix38
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix1
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix118
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build9
-rw-r--r--pkgs/os-specific/darwin/bartender/default.nix12
-rw-r--r--pkgs/os-specific/darwin/coconutbattery/default.nix2
-rw-r--r--pkgs/os-specific/darwin/dockutil/default.nix116
-rw-r--r--pkgs/os-specific/darwin/dockutil/generated/default.nix7
-rw-r--r--pkgs/os-specific/darwin/dockutil/generated/workspace-state.json25
-rw-r--r--pkgs/os-specific/darwin/duti/default.nix2
-rw-r--r--pkgs/os-specific/darwin/iproute2mac/default.nix2
-rw-r--r--pkgs/os-specific/darwin/karabiner-elements/default.nix2
-rw-r--r--pkgs/os-specific/darwin/khd/default.nix2
-rw-r--r--pkgs/os-specific/darwin/macfuse/default.nix4
-rw-r--r--pkgs/os-specific/darwin/moltenvk/default.nix6
-rw-r--r--pkgs/os-specific/darwin/noah/default.nix2
-rw-r--r--pkgs/os-specific/darwin/openwith/default.nix6
-rw-r--r--pkgs/os-specific/darwin/osx-cpu-temp/default.nix4
-rw-r--r--pkgs/os-specific/darwin/osxsnarf/default.nix2
-rw-r--r--pkgs/os-specific/darwin/raycast/default.nix45
-rw-r--r--pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix2
-rw-r--r--pkgs/os-specific/darwin/rectangle/default.nix4
-rw-r--r--pkgs/os-specific/darwin/sigtool/default.nix2
-rw-r--r--pkgs/os-specific/darwin/smimesign/default.nix2
-rw-r--r--pkgs/os-specific/darwin/spacebar/default.nix2
-rw-r--r--pkgs/os-specific/darwin/utm/default.nix6
-rw-r--r--pkgs/os-specific/linux/915resolution/default.nix2
-rw-r--r--pkgs/os-specific/linux/acpi-call/default.nix2
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix2
-rw-r--r--pkgs/os-specific/linux/acpitool/default.nix2
-rw-r--r--pkgs/os-specific/linux/adcli/default.nix2
-rw-r--r--pkgs/os-specific/linux/afuse/default.nix2
-rw-r--r--pkgs/os-specific/linux/amdctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix222
-rw-r--r--pkgs/os-specific/linux/anbox/default.nix7
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix4
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix2
-rw-r--r--pkgs/os-specific/linux/asus-ec-sensors/default.nix2
-rw-r--r--pkgs/os-specific/linux/asus-wmi-sensors/default.nix2
-rw-r--r--pkgs/os-specific/linux/audit/default.nix2
-rw-r--r--pkgs/os-specific/linux/autofs/default.nix28
-rw-r--r--pkgs/os-specific/linux/ax99100/default.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/alfred.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix3
-rw-r--r--pkgs/os-specific/linux/batman-adv/version.nix10
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix2
-rw-r--r--pkgs/os-specific/linux/bcc/absolute-ausyscall.patch43
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix122
-rw-r--r--pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch14
-rw-r--r--pkgs/os-specific/linux/bcc/libbcc-path.patch11
-rw-r--r--pkgs/os-specific/linux/beefi/default.nix2
-rw-r--r--pkgs/os-specific/linux/below/default.nix2
-rw-r--r--pkgs/os-specific/linux/bionic-prebuilt/default.nix2
-rw-r--r--pkgs/os-specific/linux/bpftools/default.nix2
-rw-r--r--pkgs/os-specific/linux/bpftrace/default.nix71
-rw-r--r--pkgs/os-specific/linux/bpftune/default.nix24
-rw-r--r--pkgs/os-specific/linux/bridge-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/btfs/default.nix2
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix4
-rw-r--r--pkgs/os-specific/linux/can-isotp/default.nix2
-rw-r--r--pkgs/os-specific/linux/cannelloni/default.nix2
-rw-r--r--pkgs/os-specific/linux/catfs/default.nix1
-rw-r--r--pkgs/os-specific/linux/consoletools/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix4
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix2
-rw-r--r--pkgs/os-specific/linux/cramfsprogs/default.nix2
-rw-r--r--pkgs/os-specific/linux/criu/default.nix2
-rw-r--r--pkgs/os-specific/linux/cryptodev/default.nix15
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix2
-rw-r--r--pkgs/os-specific/linux/cshatag/default.nix2
-rw-r--r--pkgs/os-specific/linux/dcgm/default.nix2
-rw-r--r--pkgs/os-specific/linux/ddcci/default.nix13
-rw-r--r--pkgs/os-specific/linux/digimend/default.nix15
-rw-r--r--pkgs/os-specific/linux/directvnc/default.nix2
-rw-r--r--pkgs/os-specific/linux/disk-indicator/default.nix2
-rw-r--r--pkgs/os-specific/linux/dmidecode/default.nix2
-rw-r--r--pkgs/os-specific/linux/dpdk-kmods/default.nix2
-rw-r--r--pkgs/os-specific/linux/dpdk/default.nix2
-rw-r--r--pkgs/os-specific/linux/dracut/default.nix2
-rw-r--r--pkgs/os-specific/linux/dstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/e1000e/default.nix2
-rw-r--r--pkgs/os-specific/linux/ebtables/default.nix4
-rw-r--r--pkgs/os-specific/linux/edac-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/ena/default.nix10
-rw-r--r--pkgs/os-specific/linux/ena/override-features-api-detection.patch55
-rw-r--r--pkgs/os-specific/linux/esdm/default.nix1
-rw-r--r--pkgs/os-specific/linux/ethq/default.nix4
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/exfat/default.nix4
-rw-r--r--pkgs/os-specific/linux/facetimehd/default.nix2
-rw-r--r--pkgs/os-specific/linux/fan2go/default.nix2
-rw-r--r--pkgs/os-specific/linux/fbterm/default.nix2
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--pkgs/os-specific/linux/firejail/default.nix1
-rw-r--r--pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix7
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd-efi/default.nix3
-rw-r--r--pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/source.nix8
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix10
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/default.nix9
-rw-r--r--pkgs/os-specific/linux/firmware/zd1211/default.nix2
-rw-r--r--pkgs/os-specific/linux/fnotifystat/default.nix4
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/forktty/default.nix2
-rw-r--r--pkgs/os-specific/linux/framework-laptop-kmod/default.nix4
-rw-r--r--pkgs/os-specific/linux/freeipa/default.nix4
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix6
-rw-r--r--pkgs/os-specific/linux/fsverity-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/fswebcam/default.nix2
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/fwts/default.nix6
-rw-r--r--pkgs/os-specific/linux/g15daemon/default.nix10
-rw-r--r--pkgs/os-specific/linux/game-devices-udev-rules/default.nix6
-rw-r--r--pkgs/os-specific/linux/gasket/default.nix4
-rw-r--r--pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix2
-rw-r--r--pkgs/os-specific/linux/gobi_loader/default.nix2
-rw-r--r--pkgs/os-specific/linux/gt/default.nix2
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix6
-rw-r--r--pkgs/os-specific/linux/hdapsd/default.nix2
-rw-r--r--pkgs/os-specific/linux/hdparm/default.nix2
-rw-r--r--pkgs/os-specific/linux/health-check/default.nix2
-rw-r--r--pkgs/os-specific/linux/hibernate/default.nix2
-rw-r--r--pkgs/os-specific/linux/hid-t150/default.nix40
-rw-r--r--pkgs/os-specific/linux/hid-tmff2/default.nix2
-rw-r--r--pkgs/os-specific/linux/hostapd/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/i7z/default.nix4
-rw-r--r--pkgs/os-specific/linux/i810switch/default.nix4
-rw-r--r--pkgs/os-specific/linux/ifenslave/default.nix2
-rw-r--r--pkgs/os-specific/linux/ima-evm-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/input-utils/default.nix30
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-speed-select/default.nix2
-rw-r--r--pkgs/os-specific/linux/iomelt/default.nix2
-rw-r--r--pkgs/os-specific/linux/iotop/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix12
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix2
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipu6-drivers/default.nix4
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipvsadm/default.nix2
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix4
-rw-r--r--pkgs/os-specific/linux/ivsc-driver/default.nix4
-rw-r--r--pkgs/os-specific/linux/iw/default.nix31
-rw-r--r--pkgs/os-specific/linux/ixgbevf/default.nix2
-rw-r--r--pkgs/os-specific/linux/jool/cli.nix2
-rw-r--r--pkgs/os-specific/linux/jujuutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/kbdlight/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix41
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/gpio-utils.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json86
-rwxr-xr-xpkgs/os-specific/linux/kernel/hardened/update.py1
-rw-r--r--pkgs/os-specific/linux/kernel/htmldocs.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json36
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix36
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.15.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.6.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix47
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix16
-rw-r--r--pkgs/os-specific/linux/kernel/perf/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/rust-1.77-6.8.patch799
-rw-r--r--pkgs/os-specific/linux/kernel/rust-1.77.patch159
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix15
-rw-r--r--pkgs/os-specific/linux/kexec-tools/default.nix9
-rw-r--r--pkgs/os-specific/linux/kexec-tools/fix-purgatory-llvm-libunwind.patch11
-rw-r--r--pkgs/os-specific/linux/ksmbd-tools/default.nix3
-rw-r--r--pkgs/os-specific/linux/kvdo/default.nix4
-rw-r--r--pkgs/os-specific/linux/kvmfr/default.nix3
-rw-r--r--pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch16
-rw-r--r--pkgs/os-specific/linux/latencytop/default.nix2
-rw-r--r--pkgs/os-specific/linux/ldm/default.nix2
-rw-r--r--pkgs/os-specific/linux/ledger-udev-rules/default.nix8
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/app.nix2
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/default.nix2
-rw-r--r--pkgs/os-specific/linux/libaio/default.nix2
-rw-r--r--pkgs/os-specific/linux/libbpf/0.x.nix4
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/libnvme/default.nix7
-rw-r--r--pkgs/os-specific/linux/libpsm2/default.nix4
-rw-r--r--pkgs/os-specific/linux/libratbag/default.nix4
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix2
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix4
-rw-r--r--pkgs/os-specific/linux/libsmbios/default.nix2
-rw-r--r--pkgs/os-specific/linux/libvolume_id/default.nix2
-rw-r--r--pkgs/os-specific/linux/libwebcam/default.nix2
-rw-r--r--pkgs/os-specific/linux/libzbc/default.nix4
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix2
-rw-r--r--pkgs/os-specific/linux/liquidtux/default.nix2
-rw-r--r--pkgs/os-specific/linux/lksctp-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/lockdep/default.nix2
-rw-r--r--pkgs/os-specific/linux/lsscsi/default.nix2
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix2
-rw-r--r--pkgs/os-specific/linux/macchanger/default.nix2
-rw-r--r--pkgs/os-specific/linux/mba6x_bl/default.nix2
-rw-r--r--pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix2
-rw-r--r--pkgs/os-specific/linux/mceinject/default.nix4
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix11
-rw-r--r--pkgs/os-specific/linux/mdevctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/metastore/default.nix2
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--pkgs/os-specific/linux/microcode/iucode-tool.nix2
-rw-r--r--pkgs/os-specific/linux/mingetty/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix2
-rw-r--r--pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/mm-tools/default.nix (renamed from pkgs/os-specific/linux/vm-tools/default.nix)4
-rw-r--r--pkgs/os-specific/linux/msr-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/mstflint_access/default.nix8
-rw-r--r--pkgs/os-specific/linux/mstpd/default.nix2
-rw-r--r--pkgs/os-specific/linux/multipath-tools/default.nix33
-rw-r--r--pkgs/os-specific/linux/musl-fts/default.nix2
-rw-r--r--pkgs/os-specific/linux/musl/default.nix2
-rw-r--r--pkgs/os-specific/linux/net-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/netatop/default.nix2
-rw-r--r--pkgs/os-specific/linux/nfs-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix18
-rw-r--r--pkgs/os-specific/linux/nftables/fix-py-libnftables.patch13
-rw-r--r--pkgs/os-specific/linux/nftables/python.nix26
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/default.nix2
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.882
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh2
-rw-r--r--pkgs/os-specific/linux/nsncd/default.nix10
-rw-r--r--pkgs/os-specific/linux/nss_ldap/default.nix2
-rw-r--r--pkgs/os-specific/linux/numactl/default.nix2
-rw-r--r--pkgs/os-specific/linux/numad/default.nix2
-rw-r--r--pkgs/os-specific/linux/numworks-udev-rules/default.nix2
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix55
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared-3xx.patch24
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared.patch21
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix52
-rw-r--r--pkgs/os-specific/linux/nvidiabl/default.nix2
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix4
-rw-r--r--pkgs/os-specific/linux/open-iscsi/default.nix6
-rw-r--r--pkgs/os-specific/linux/openrazer/driver.nix2
-rw-r--r--pkgs/os-specific/linux/otpw/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam/default.nix22
-rw-r--r--pkgs/os-specific/linux/pam_ccreds/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam_mount/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam_u2f/default.nix2
-rw-r--r--pkgs/os-specific/linux/paxctl/default.nix4
-rw-r--r--pkgs/os-specific/linux/paxtest/default.nix2
-rw-r--r--pkgs/os-specific/linux/pcm/default.nix4
-rw-r--r--pkgs/os-specific/linux/pcmciautils/default.nix2
-rw-r--r--pkgs/os-specific/linux/phc-intel/default.nix2
-rw-r--r--pkgs/os-specific/linux/piper/default.nix6
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix1
-rw-r--r--pkgs/os-specific/linux/pm-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix2
-rw-r--r--pkgs/os-specific/linux/policycoreutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/pommed-light/default.nix4
-rw-r--r--pkgs/os-specific/linux/power-calibrate/default.nix2
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix9
-rw-r--r--pkgs/os-specific/linux/powerstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/procdump/default.nix2
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix2
-rw-r--r--pkgs/os-specific/linux/projecteur/default.nix2
-rw-r--r--pkgs/os-specific/linux/pscircle/default.nix2
-rw-r--r--pkgs/os-specific/linux/psmisc/default.nix2
-rw-r--r--pkgs/os-specific/linux/r8168/default.nix12
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix2
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/os-specific/linux/rewritefs/default.nix2
-rw-r--r--pkgs/os-specific/linux/rt-tests/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8189es/default.nix10
-rw-r--r--pkgs/os-specific/linux/rtl8189fs/default.nix10
-rw-r--r--pkgs/os-specific/linux/rtl8192eu/default.nix8
-rw-r--r--pkgs/os-specific/linux/rtl8723ds/default.nix8
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtl8821cu/default.nix8
-rw-r--r--pkgs/os-specific/linux/rtl8852au/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix14
-rw-r--r--pkgs/os-specific/linux/rust-out-of-tree-module/default.nix2
-rw-r--r--pkgs/os-specific/linux/ryzen-smu/default.nix2
-rw-r--r--pkgs/os-specific/linux/ryzenadj/default.nix2
-rw-r--r--pkgs/os-specific/linux/sasutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/schedtool/default.nix2
-rw-r--r--pkgs/os-specific/linux/sd-switch/default.nix18
-rw-r--r--pkgs/os-specific/linux/sdparm/default.nix2
-rw-r--r--pkgs/os-specific/linux/selinux-python/default.nix3
-rw-r--r--pkgs/os-specific/linux/selinux-sandbox/default.nix3
-rw-r--r--pkgs/os-specific/linux/semodule-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/service-wrapper/default.nix2
-rw-r--r--pkgs/os-specific/linux/setools/default.nix6
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix12
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix38
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix21
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch8
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix10
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/default.nix14
-rw-r--r--pkgs/os-specific/linux/shufflecake/default.nix2
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix2
-rw-r--r--pkgs/os-specific/linux/smem/default.nix2
-rw-r--r--pkgs/os-specific/linux/smemstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/sssd/default.nix22
-rw-r--r--pkgs/os-specific/linux/statifier/default.nix2
-rw-r--r--pkgs/os-specific/linux/swapview/default.nix2
-rw-r--r--pkgs/os-specific/linux/sydbox/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix40
-rw-r--r--pkgs/os-specific/linux/sysfsutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysklogd/default.nix4
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix51
-rw-r--r--pkgs/os-specific/linux/syslinux/define-wchar_t.patch11
-rw-r--r--pkgs/os-specific/linux/syslinux/import-efisetjmp.patch22
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix38
-rw-r--r--pkgs/os-specific/linux/targetcli/default.nix9
-rw-r--r--pkgs/os-specific/linux/tbs/default.nix14
-rw-r--r--pkgs/os-specific/linux/tiptop/default.nix2
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix8
-rw-r--r--pkgs/os-specific/linux/tmon/default.nix2
-rw-r--r--pkgs/os-specific/linux/tp_smapi/default.nix2
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix20
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix2
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix5
-rw-r--r--pkgs/os-specific/linux/tunctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/turbostat/default.nix2
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix2
-rw-r--r--pkgs/os-specific/linux/uhk-agent/default.nix4
-rw-r--r--pkgs/os-specific/linux/ulogd/default.nix2
-rw-r--r--pkgs/os-specific/linux/undervolt/default.nix4
-rw-r--r--pkgs/os-specific/linux/untie/default.nix2
-rw-r--r--pkgs/os-specific/linux/upower/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbip/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbtop/default.nix2
-rw-r--r--pkgs/os-specific/linux/usermount/default.nix2
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix9
-rw-r--r--pkgs/os-specific/linux/uvcdynctrl/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l2-relayd/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix2
-rw-r--r--pkgs/os-specific/linux/v86d/default.nix4
-rw-r--r--pkgs/os-specific/linux/vdo/default.nix2
-rw-r--r--pkgs/os-specific/linux/virtio_vmmci/default.nix4
-rw-r--r--pkgs/os-specific/linux/vmm_clock/default.nix2
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix4
-rw-r--r--pkgs/os-specific/linux/wireless-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/wiringpi/default.nix72
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix3
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/gui.nix2
-rw-r--r--pkgs/os-specific/linux/x86_energy_perf_policy/default.nix2
-rw-r--r--pkgs/os-specific/linux/x86info/default.nix2
-rw-r--r--pkgs/os-specific/linux/xf86-video-nested/default.nix2
-rw-r--r--pkgs/os-specific/linux/xone/default.nix4
-rw-r--r--pkgs/os-specific/linux/xsensors/default.nix2
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix4
-rw-r--r--pkgs/os-specific/linux/zenpower/default.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/2_2.nix8
-rw-r--r--pkgs/os-specific/linux/zfs/generic.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix10
-rw-r--r--pkgs/os-specific/windows/cygwin-setup/default.nix2
-rw-r--r--pkgs/os-specific/windows/default.nix4
-rw-r--r--pkgs/os-specific/windows/mcfgthreads/default.nix2
-rw-r--r--pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix24
-rw-r--r--pkgs/os-specific/windows/mingw-w64/default.nix16
-rw-r--r--pkgs/os-specific/windows/mingw-w64/headers.nix18
-rw-r--r--pkgs/os-specific/windows/mingw-w64/pthreads.nix6
543 files changed, 6235 insertions, 3507 deletions
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index b7cf5484c9e94..cfe6080b020a0 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -1,72 +1,52 @@
-{ stdenv, lib, stdenvNoCC
-, makeScopeWithSplicing', generateSplicesForMkScope
-, buildPackages
-, fetchgit, fetchzip
+{
+  lib,
+  makeScopeWithSplicing',
+  generateSplicesForMkScope,
+  callPackage,
+  attributePathToSplice ? [ "freebsd" ],
+  branch ? "release/14.0.0",
 }:
 
 let
-  inherit (buildPackages.buildPackages) rsync;
-
   versions = builtins.fromJSON (builtins.readFile ./versions.json);
 
-  version = "13.1.0";
-  branch = "release/${version}";
-
-in makeScopeWithSplicing' {
-  otherSplices = generateSplicesForMkScope "freebsd";
-  f = (self: lib.packagesFromDirectoryRecursive {
-    callPackage = self.callPackage;
-    directory = ./pkgs;
-  } // {
-    sourceData = versions.${branch};
-
-    ports = fetchzip {
-      url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
-      sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
-    };
-
-    compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
-    freebsd-lib = import ./lib { inherit version; };
-
-    # The manual callPackages below should in principle be unnecessary, but are
-    # necessary. See note in ../netbsd/default.nix
-
-    compat = self.callPackage ./pkgs/compat/package.nix {
-      inherit stdenv;
-      inherit (buildPackages.freebsd) makeMinimal boot-install;
-    };
-
-    csu = self.callPackage ./pkgs/csu.nix {
-      inherit (buildPackages.freebsd) makeMinimal install gencat;
-      inherit (self) include;
-    };
-
-    include = self.callPackage ./pkgs/include/package.nix {
-      inherit (buildPackages.freebsd) makeMinimal install rpcgen;
-    };
-
-    install = self.callPackage ./pkgs/install.nix {
-      inherit (buildPackages.freebsd) makeMinimal;
-      inherit (self) mtree libnetbsd;
-    };
-
-    libc = self.callPackage ./pkgs/libc/package.nix {
-      inherit (buildPackages.freebsd) makeMinimal install gencat rpcgen;
-      inherit (self) csu include;
-    };
-
-    libnetbsd = self.callPackage ./pkgs/libnetbsd/package.nix {
-      inherit (buildPackages.freebsd) makeMinimal;
-    };
-
-    mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
-      inherit stdenv;
-      inherit (buildPackages.freebsd) makeMinimal install tsort;
-    };
-
-    makeMinimal = self.callPackage ./pkgs/makeMinimal.nix {
-      inherit (self) make;
-    };
-
-  });
+  badBranchError =
+    branch:
+    throw ''
+      Unknown FreeBSD branch ${branch}!
+      FreeBSD branches normally look like one of:
+      * `release/<major>.<minor>.0` for tagged releases without security updates
+      * `releng/<major>.<minor>` for release update branches with security updates
+      * `stable/<major>` for stable versions working towards the next minor release
+      * `main` for the latest development version
+
+      Branches can be selected by overriding the `branch` attribute on the freebsd package set.
+    '';
+
+  # we do not include the branch in the splice here because the branch
+  # parameter to this file will only ever take on one value - more values
+  # are provided through overrides.
+  otherSplices = generateSplicesForMkScope attributePathToSplice;
+in
+# `./package-set.nix` should never know the name of the package set we
+# are constructing; just this function is allowed to know that. This
+# is why we:
+#
+#  - do the splicing for cross compilation here
+#
+#  - construct the *anonymized* `buildFreebsd` attribute to be passed
+#    to `./package-set.nix`.
+makeScopeWithSplicing' {
+  inherit otherSplices;
+  f =
+    self:
+    {
+      inherit branch;
+    }
+    // callPackage ./package-set.nix ({
+      sourceData = versions.${self.branch} or (throw (badBranchError self.branch));
+      versionData = self.sourceData.version;
+      buildFreebsd = otherSplices.selfBuildHost;
+      patchesRoot = ./patches + "/${self.versionData.revision}";
+    }) self;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
index d62c01f5eb887..6696d12912e68 100644
--- a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, linuxHeaders, freebsd, runCommandCC, buildPackages }:
+{
+  lib,
+  stdenv,
+  linuxHeaders,
+  freebsd,
+  runCommandCC,
+  buildPackages,
+}:
 
 stdenv.mkDerivation {
   pname = "evdev-proto";
@@ -28,7 +35,7 @@ stdenv.mkDerivation {
   TOUCH = "touch";
   XARGS = "xargs";
 
-  ABI_FILE = runCommandCC "abifile" {} "$CC -shared -o $out";
+  ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
   CLEAN_FETCH_ENV = true;
   INSTALL_AS_USER = true;
   NO_CHECKSUM = true;
diff --git a/pkgs/os-specific/bsd/freebsd/lib/default.nix b/pkgs/os-specific/bsd/freebsd/lib/default.nix
index 30fea7e17dce6..d022f7cfa14c6 100644
--- a/pkgs/os-specific/bsd/freebsd/lib/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/lib/default.nix
@@ -3,14 +3,16 @@
 {
   inherit version;
 
-  mkBsdArch = stdenv':  {
-    x86_64 = "amd64";
-    aarch64 = "arm64";
-    i486 = "i386";
-    i586 = "i386";
-    i686 = "i386";
-  }.${stdenv'.hostPlatform.parsed.cpu.name}
-    or stdenv'.hostPlatform.parsed.cpu.name;
+  mkBsdArch =
+    stdenv':
+    {
+      x86_64 = "amd64";
+      aarch64 = "arm64";
+      i486 = "i386";
+      i586 = "i386";
+      i686 = "i386";
+    }
+    .${stdenv'.hostPlatform.parsed.cpu.name} or stdenv'.hostPlatform.parsed.cpu.name;
 
-  install-wrapper = builtins.readFile ./install-wrapper.sh;
+  install-wrapper = builtins.readFile ../../lib/install-wrapper.sh;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/package-set.nix b/pkgs/os-specific/bsd/freebsd/package-set.nix
new file mode 100644
index 0000000000000..4ff6cb2102490
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/package-set.nix
@@ -0,0 +1,96 @@
+{
+  stdenv,
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  sourceData,
+  versionData,
+  buildFreebsd,
+  patchesRoot,
+}:
+
+self:
+
+lib.packagesFromDirectoryRecursive {
+  callPackage = self.callPackage;
+  directory = ./pkgs;
+}
+// {
+  inherit sourceData patchesRoot versionData;
+  patches = ./patches + "/${self.versionData.revision}";
+
+  # Keep the crawled portion of Nixpkgs finite.
+  buildFreebsd = lib.dontRecurseIntoAttrs buildFreebsd;
+
+  ports = fetchzip {
+    url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
+    sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
+  };
+
+  compatIsNeeded = !stdenvNoCC.hostPlatform.isFreeBSD;
+  compatIfNeeded = lib.optional self.compatIsNeeded self.compat;
+  freebsd-lib = import ./lib {
+    version = lib.concatStringsSep "." (
+      map toString (
+        lib.filter (x: x != null) [
+          self.versionData.major
+          self.versionData.minor
+          self.versionData.patch or null
+        ]
+      )
+    );
+  };
+
+  # The manual callPackages below should in principle be unnecessary, but are
+  # necessary. See note in ../netbsd/default.nix
+
+  compat = self.callPackage ./pkgs/compat/package.nix {
+    inherit stdenv;
+    inherit (buildFreebsd) makeMinimal;
+  };
+
+  csu = self.callPackage ./pkgs/csu.nix {
+    inherit (buildFreebsd) makeMinimal install gencat;
+    inherit (self) include;
+  };
+
+  include = self.callPackage ./pkgs/include/package.nix { inherit (buildFreebsd) rpcgen mtree; };
+
+  install = self.callPackage ./pkgs/install.nix {
+    inherit (buildFreebsd) makeMinimal;
+    inherit (self) libmd libnetbsd;
+  };
+
+  libc = self.callPackage ./pkgs/libc/package.nix {
+    inherit (buildFreebsd)
+      makeMinimal
+      install
+      gencat
+      rpcgen
+      mkcsmapper
+      mkesdb
+      ;
+    inherit (self) csu include;
+  };
+
+  libnetbsd = self.callPackage ./pkgs/libnetbsd/package.nix { inherit (buildFreebsd) makeMinimal; };
+
+  libmd = self.callPackage ./pkgs/libmd.nix { inherit (buildFreebsd) makeMinimal; };
+
+  mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+    inherit stdenv;
+    inherit (buildFreebsd)
+      freebsdSetupHook
+      makeMinimal
+      install
+      tsort
+      lorder
+      ;
+  };
+
+  makeMinimal = self.callPackage ./pkgs/makeMinimal.nix { inherit (self) make; };
+
+  mtree = self.callPackage ./pkgs/mtree.nix { inherit (self) libnetbsd libmd; };
+
+  tsort = self.callPackage ./pkgs/tsort.nix { inherit (buildFreebsd) makeMinimal install; };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/compat-fix-typedefs-locations.patch
index 3336a2504e584..3336a2504e584 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/compat-fix-typedefs-locations.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/compat-install-dirs.patch
index 9bb2bea32ee98..4bc21cf8eb147 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/compat-install-dirs.patch
@@ -2,12 +2,11 @@ diff --git a/tools/build/Makefile b/tools/build/Makefile
 index 948a5f9dfdb..592af84eeae 100644
 --- a/tools/build/Makefile
 +++ b/tools/build/Makefile
-@@ -327,15 +327,15 @@ host-symlinks:
+@@ -327,14 +327,14 @@ host-symlinks:
  # and cross-tools stages. We do this here using mkdir since mtree may not exist
  # yet (this happens if we are crossbuilding from Linux/Mac).
  INSTALLDIR_LIST= \
 -	bin \
--	lib/casper \
 -	lib/geom \
 -	usr/include/casper \
 -	usr/include/private/ucl \
@@ -16,7 +15,6 @@ index 948a5f9dfdb..592af84eeae 100644
 -	usr/libdata/pkgconfig \
 -	usr/libexec
 +	${BINDIR} \
-+	${LIBDIR}/casper \
 +	${LIBDIR}/geom \
 +	${INCLUDEDIR}/casper \
 +	${INCLUDEDIR}/private/ucl \
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/libc-msun-arch-subdir.patch
index 4a69e85a986a0..4a69e85a986a0 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/libc-msun-arch-subdir.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/libc-no-force--lcompiler-rt.patch
index 60176fb73cf76..60176fb73cf76 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/libc-no-force--lcompiler-rt.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/libnetbsd-do-install.patch
index a7bd032d2be54..a7bd032d2be54 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/libnetbsd-do-install.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/librpcsvc-include-subdir.patch
index 38e06682869fb..38e06682869fb 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/librpcsvc-include-subdir.patch
diff --git a/pkgs/os-specific/bsd/freebsd/patches/13.1/mtree-Makefile.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/mtree-Makefile.patch
new file mode 100644
index 0000000000000..2a6e560d1d287
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/mtree-Makefile.patch
@@ -0,0 +1,13 @@
+--- a/contrib/mtree/Makefile	2023-12-04 23:02:13.919144141 -0700
++++ b/contrib/mtree/Makefile		2023-12-04 23:02:58.371810109 -0700
+@@ -10,8 +10,8 @@
+ SRCS=  compare.c crc.c create.c excludes.c misc.c mtree.c spec.c specspec.c \
+        verify.c getid.c pack_dev.c only.c
+ .if (${HOSTPROG:U} == "")
+-DPADD+= ${LIBUTIL}
+-LDADD+= -lutil
++LIBADD+= ${LIBUTIL}
++#LIBADD+= -lutil
+ .endif
+
+ CPPFLAGS+=	-I${NETBSDSRCDIR}/sbin/mknod
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/no-perms-BSD.include.dist.patch
index 985617ee0f457..985617ee0f457 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/no-perms-BSD.include.dist.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/sys-gnu-date.patch
index 2356446baf853..2356446baf853 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/sys-gnu-date.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch b/pkgs/os-specific/bsd/freebsd/patches/13.1/sys-no-explicit-intrinsics-dep.patch
index edf44de5bb0d7..edf44de5bb0d7 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/13.1/sys-no-explicit-intrinsics-dep.patch
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/bmake-no-compiler-rt.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/bmake-no-compiler-rt.patch
new file mode 100644
index 0000000000000..f43d87c01e549
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/bmake-no-compiler-rt.patch
@@ -0,0 +1,11 @@
+--- a/share/mk/src.libnames.mk	2023-12-21 23:56:50.767042385 -0800
++++ b/share/mk/src.libnames.mk	2023-12-21 23:56:39.671089506 -0800
+@@ -392,7 +392,7 @@
+ _DP_ztest=	geom m nvpair umem zpool pthread avl zfs_core spl zutil zfs uutil icp
+ # The libc dependencies are not strictly needed but are defined to make the
+ # assert happy.
+-_DP_c=		compiler_rt
++_DP_c=		
+ # Use libssp_nonshared only on i386 and power*.  Other archs emit direct calls
+ # to __stack_chk_fail, not __stack_chk_fail_local provided by libssp_nonshared.
+ .if ${MK_SSP} != "no" && \
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-fix-typedefs-locations.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-fix-typedefs-locations.patch
new file mode 100644
index 0000000000000..3336a2504e584
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-fix-typedefs-locations.patch
@@ -0,0 +1,32 @@
+--- a/tools/build/cross-build/include/common/sys/_types.h
++++ b/tools/build/cross-build/include/common/sys/_types.h
+@@ -47,3 +47,6 @@
+  * Neither GLibc nor macOS define __va_list but many FreeBSD headers require it.
+  */
+ typedef __builtin_va_list __va_list;
++
++typedef __UINTPTR_TYPE__ __uintptr_t;
++typedef __INTPTR_TYPE__ __intptr_t;
+--- a/tools/build/cross-build/include/common/sys/types.h
++++ b/tools/build/cross-build/include/common/sys/types.h
+@@ -49,9 +49,6 @@
+ #include <sys/sysmacros.h>
+ #endif
+ 
+-typedef __UINTPTR_TYPE__ __uintptr_t;
+-typedef __INTPTR_TYPE__ __intptr_t;
+-
+ /* needed for gencat */
+ typedef int __nl_item;
+ 
+--- a/tools/build/cross-build/include/linux/sys/types.h
++++ b/tools/build/cross-build/include/linux/sys/types.h
+@@ -39,6 +39,8 @@
+ 
+ #include_next <sys/types.h>
+ 
++#include <sys/_types.h>
++
+ #ifndef __size_t
+ typedef __SIZE_TYPE__ __size_t;
+ #endif
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-install-dirs.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-install-dirs.patch
new file mode 100644
index 0000000000000..4bc21cf8eb147
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/compat-install-dirs.patch
@@ -0,0 +1,40 @@
+diff --git a/tools/build/Makefile b/tools/build/Makefile
+index 948a5f9dfdb..592af84eeae 100644
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -327,14 +327,14 @@ host-symlinks:
+ # and cross-tools stages. We do this here using mkdir since mtree may not exist
+ # yet (this happens if we are crossbuilding from Linux/Mac).
+ INSTALLDIR_LIST= \
+-	bin \
+-	lib/geom \
+-	usr/include/casper \
+-	usr/include/private/ucl \
+-	usr/include/private/zstd \
+-	usr/lib \
+-	usr/libdata/pkgconfig \
+-	usr/libexec
++	${BINDIR} \
++	${LIBDIR}/geom \
++	${INCLUDEDIR}/casper \
++	${INCLUDEDIR}/private/ucl \
++	${INCLUDEDIR}/private/zstd \
++	${LIBDIR} \
++	${LIBDIR}/libdata/pkgconfig \
++	${LIBEXECDIR}
+ 
+ installdirs:
+ 	mkdir -p ${INSTALLDIR_LIST:S,^,${DESTDIR}/,}
+@@ -352,9 +352,9 @@ installdirs:
+ 	    rm -rf "${DESTDIR}/${_dir}"; \
+ 	fi
+ .endfor
+-	ln -sfn bin ${DESTDIR}/sbin
+-	ln -sfn ../bin ${DESTDIR}/usr/bin
+-	ln -sfn ../bin ${DESTDIR}/usr/sbin
++	ln -sfn bin ${DESTDIR}/${SBINDIR}
++	ln -sfn ../bin ${DESTDIR}/${BINDIR}
++	ln -sfn ../bin ${DESTDIR}/${SBINDIR}
+ .for _group in ${INCSGROUPS:NINCS}
+ 	mkdir -p "${DESTDIR}/${${_group}DIR}"
+ .endfor
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/install-bootstrap-Makefile.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/install-bootstrap-Makefile.patch
new file mode 100644
index 0000000000000..a69c5501ddd16
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/install-bootstrap-Makefile.patch
@@ -0,0 +1,11 @@
+--- a/usr.bin/xinstall/Makefile	2023-09-23 19:18:49.165192183 -0700
++++ b/usr.bin/xinstall/Makefile	2023-12-06 17:06:57.836888028 -0700
+@@ -14,7 +14,7 @@
+ CFLAGS+=	-I${SRCTOP}/lib/libnetbsd
+ 
+ LIBADD=		md
+-CFLAGS+=	-DWITH_MD5 -DWITH_RIPEMD160
++CFLAGS+=		-I${BSDSRCDIR}/contrib/libc-vis -I${BSDSRCDIR}/lib/libnetbsd
+ 
+ .ifdef BOOTSTRAPPING
+ # For the bootstrap we disable copy_file_range()
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-msun-arch-subdir.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-msun-arch-subdir.patch
new file mode 100644
index 0000000000000..4a69e85a986a0
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-msun-arch-subdir.patch
@@ -0,0 +1,11 @@
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -194,7 +194,7 @@ SUBDIR.${MK_TESTS}+= tests
+ # recording a build dependency
+ CFLAGS+= -I${SRCTOP}/lib/libutil
+ # Same issue with libm
+-MSUN_ARCH_SUBDIR != ${MAKE} -B -C ${SRCTOP}/lib/msun -V ARCH_SUBDIR
++MSUN_ARCH_SUBDIR = ${MACHINE_CPUARCH:S/i386/i387/}
+ # unfortunately msun/src contains both private and public headers
+ CFLAGS+= -I${SRCTOP}/lib/msun/${MSUN_ARCH_SUBDIR}
+ .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64"
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-no-force--lcompiler-rt.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-no-force--lcompiler-rt.patch
new file mode 100644
index 0000000000000..60176fb73cf76
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libc-no-force--lcompiler-rt.patch
@@ -0,0 +1,10 @@
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -58,7 +58,6 @@ CFLAGS+=${CANCELPOINTS_CFLAGS}
+ # Link with static libcompiler_rt.a.
+ #
+ LDFLAGS+= -nodefaultlibs
+-LIBADD+=	compiler_rt
+ 
+ .if ${MK_SSP} != "no" && \
+     (${LIBC_ARCH} == "i386" || ${MACHINE_ARCH:Mpower*} != "")
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch
new file mode 100644
index 0000000000000..256db9e2d9cf4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch
@@ -0,0 +1,11 @@
+--- freebsd/lib/libcxxrt/Makefile	2024-05-30 14:27:42.328086005 -0700
++++ freebsd/lib/libcxxrt/Makefile.mod	2024-05-30 14:27:48.048014581 -0700
+@@ -19,6 +19,8 @@
+ SRCS+=		terminate.cc
+ SRCS+=		typeinfo.cc
+ 
++INCS+=cxxabi.h unwind.h unwind-arm.h unwind-itanium.h
++
+ WARNS?=		0
+ CFLAGS+=	-isystem ${SRCDIR} -nostdinc++
+ CXXSTD?=	c++14
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libnetbsd-do-install.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libnetbsd-do-install.patch
new file mode 100644
index 0000000000000..a7bd032d2be54
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libnetbsd-do-install.patch
@@ -0,0 +1,32 @@
+diff --git a/Makefile b/Makefile
+index 22710f3d933..22effc848cf 100644
+--- a/lib/libnetbsd/Makefile
++++ b/lib/libnetbsd/Makefile
+@@ -9,6 +9,26 @@ CFLAGS+=	-I${.CURDIR}
+ 
+ SRCS+=	efun.c sockaddr_snprintf.c strsuftoll.c util.c util.h
+ 
+-INTERNALLIB=
++INCSGROUPS= INCS SYSINCS NETINETINCS
++
++INCS+= \
++	glob.h \
++	pthread.h \
++	rmd160.h \
++	sha1.h \
++	sha2.h \
++	stdlib.h \
++	util.h
++
++SYSINCSDIR= ${INCLUDEDIR}/sys
++SYSINCS+= \
++	sys/cdefs.h \
++	sys/event.h \
++	sys/types.h \
++	sys/wait.h
++
++NETINETINCSDIR= ${INCLUDEDIR}/netinet
++NETINETINCS+= \
++	netinet/in.h
+ 
+ .include <bsd.lib.mk>
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/librpcsvc-include-subdir.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/librpcsvc-include-subdir.patch
new file mode 100644
index 0000000000000..38e06682869fb
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/librpcsvc-include-subdir.patch
@@ -0,0 +1,11 @@
+--- a/lib/librpcsvc/Makefile
++++ b/lib/librpcsvc/Makefile
+@@ -20,7 +20,7 @@ OTHERSRCS+= yp_passwd.c yp_update.c
+ 
+ RPCCOM=	RPCGEN_CPP=${CPP:Q} rpcgen -C
+ 
+-INCDIRS= -I${SYSROOT:U${DESTDIR}}/usr/include/rpcsvc
++INCDIRS= -I${INCLUDEDIR}/rpcsvc
+ 
+ CFLAGS+= -DYP ${INCDIRS}
+ 
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/localedef.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/localedef.patch
new file mode 100644
index 0000000000000..73a0341bd3240
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/localedef.patch
@@ -0,0 +1,158 @@
+diff --git a/include/_ctype.h b/include/_ctype.h
+index 91e6b1d14f6b..a6896b598da3 100644
+--- a/include/_ctype.h
++++ b/include/_ctype.h
+@@ -44,7 +44,7 @@
+ #define	__CTYPE_H_
+ 
+ #include <sys/cdefs.h>
+-#include <sys/_types.h>
++#include <sys/types.h>
+ 
+ #define	_CTYPE_A	0x00000100L		/* Alpha */
+ #define	_CTYPE_C	0x00000200L		/* Control */
+diff --git a/lib/libc/locale/collate.h b/lib/libc/locale/collate.h
+index 2d3723b49f5b..6bbff732b9d7 100644
+--- a/lib/libc/locale/collate.h
++++ b/lib/libc/locale/collate.h
+@@ -36,6 +36,7 @@
+ #ifndef _COLLATE_H_
+ #define	_COLLATE_H_
+ 
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <sys/types.h>
+ #include <limits.h>
+diff --git a/usr.bin/localedef/charmap.c b/usr.bin/localedef/charmap.c
+index 44b7e3292eae..79c30b7cf372 100644
+--- a/usr.bin/localedef/charmap.c
++++ b/usr.bin/localedef/charmap.c
+@@ -31,6 +31,7 @@
+ /*
+  * CHARMAP file handling for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <sys/types.h>
+ #include <sys/tree.h>
+diff --git a/usr.bin/localedef/collate.c b/usr.bin/localedef/collate.c
+index 2a080773a95e..3f0030c638f5 100644
+--- a/usr.bin/localedef/collate.c
++++ b/usr.bin/localedef/collate.c
+@@ -31,6 +31,7 @@
+ /*
+  * LC_COLLATE database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <sys/types.h>
+ #include <sys/tree.h>
+diff --git a/usr.bin/localedef/ctype.c b/usr.bin/localedef/ctype.c
+index ab7b76e57b2d..846c6d6480a8 100644
+--- a/usr.bin/localedef/ctype.c
++++ b/usr.bin/localedef/ctype.c
+@@ -32,6 +32,7 @@
+ /*
+  * LC_CTYPE database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <sys/tree.h>
+ 
+diff --git a/usr.bin/localedef/localedef.c b/usr.bin/localedef/localedef.c
+index 5ff146d6f655..ed69aa1f0c0e 100644
+--- a/usr.bin/localedef/localedef.c
++++ b/usr.bin/localedef/localedef.c
+@@ -32,7 +32,7 @@
+  * POSIX localedef.
+  */
+ #include <sys/cdefs.h>
+-#include <sys/endian.h>
++#include <endian.h>
+ #include <sys/stat.h>
+ #include <sys/types.h>
+ 
+diff --git a/usr.bin/localedef/messages.c b/usr.bin/localedef/messages.c
+index 6b8eb9d684dd..0155821d0e56 100644
+--- a/usr.bin/localedef/messages.c
++++ b/usr.bin/localedef/messages.c
+@@ -31,6 +31,7 @@
+ /*
+  * LC_MESSAGES database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/usr.bin/localedef/monetary.c b/usr.bin/localedef/monetary.c
+index 7a77ac7e256c..7636c4deca1f 100644
+--- a/usr.bin/localedef/monetary.c
++++ b/usr.bin/localedef/monetary.c
+@@ -31,6 +31,7 @@
+ /*
+  * LC_MONETARY database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/usr.bin/localedef/numeric.c b/usr.bin/localedef/numeric.c
+index 5533b7c10e1a..9c47494f815c 100644
+--- a/usr.bin/localedef/numeric.c
++++ b/usr.bin/localedef/numeric.c
+@@ -31,6 +31,7 @@
+ /*
+  * LC_NUMERIC database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/usr.bin/localedef/parser.y b/usr.bin/localedef/parser.y
+index 23b3b54f8a6e..e01330f0152d 100644
+--- a/usr.bin/localedef/parser.y
++++ b/usr.bin/localedef/parser.y
+@@ -33,6 +33,7 @@
+  * POSIX localedef grammar.
+  */
+ 
++#include <stdint.h>
+ #include <wchar.h>
+ #include <stdio.h>
+ #include <limits.h>
+diff --git a/usr.bin/localedef/scanner.c b/usr.bin/localedef/scanner.c
+index c6d45a993f28..b17670ef4b4a 100644
+--- a/usr.bin/localedef/scanner.c
++++ b/usr.bin/localedef/scanner.c
+@@ -32,6 +32,7 @@
+  * This file contains the "scanner", which tokenizes the input files
+  * for localedef for processing by the higher level grammar processor.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/usr.bin/localedef/time.c b/usr.bin/localedef/time.c
+index 7a56e244c921..0e409a742d0a 100644
+--- a/usr.bin/localedef/time.c
++++ b/usr.bin/localedef/time.c
+@@ -31,6 +31,7 @@
+ /*
+  * LC_TIME database generation routines for localedef.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/usr.bin/localedef/wide.c b/usr.bin/localedef/wide.c
+index 062e120e6912..a199cddb198d 100644
+--- a/usr.bin/localedef/wide.c
++++ b/usr.bin/localedef/wide.c
+@@ -34,6 +34,7 @@
+  * to the wide character forms used internally by libc.  Unfortunately,
+  * this approach means that we need a method for each and every encoding.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ #include <ctype.h>
+ #include <stdlib.h>
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/mtree-Makefile.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/mtree-Makefile.patch
new file mode 100644
index 0000000000000..2a6e560d1d287
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/mtree-Makefile.patch
@@ -0,0 +1,13 @@
+--- a/contrib/mtree/Makefile	2023-12-04 23:02:13.919144141 -0700
++++ b/contrib/mtree/Makefile		2023-12-04 23:02:58.371810109 -0700
+@@ -10,8 +10,8 @@
+ SRCS=  compare.c crc.c create.c excludes.c misc.c mtree.c spec.c specspec.c \
+        verify.c getid.c pack_dev.c only.c
+ .if (${HOSTPROG:U} == "")
+-DPADD+= ${LIBUTIL}
+-LDADD+= -lutil
++LIBADD+= ${LIBUTIL}
++#LIBADD+= -lutil
+ .endif
+
+ CPPFLAGS+=	-I${NETBSDSRCDIR}/sbin/mknod
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/no-perms-BSD.include.dist.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/no-perms-BSD.include.dist.patch
new file mode 100644
index 0000000000000..985617ee0f457
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/no-perms-BSD.include.dist.patch
@@ -0,0 +1,11 @@
+--- a/etc/mtree/BSD.include.dist
++++ b/etc/mtree/BSD.include.dist
+@@ -3,7 +3,7 @@
+ # Please see the file src/etc/mtree/README before making changes to this file.
+ #
+ 
+-/set type=dir uname=root gname=wheel mode=0755
++/set type=dir
+ .
+     arpa
+     ..
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/rtld-no-force--lcompiler-rt.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/rtld-no-force--lcompiler-rt.patch
new file mode 100644
index 0000000000000..45f0d0c51eec0
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/rtld-no-force--lcompiler-rt.patch
@@ -0,0 +1,10 @@
+--- a/libexec/rtld-elf/Makefile
++++ b/libexec/rtld-elf/Makefile
+@@ -86,7 +86,6 @@ 
+ 
+ # Some of the required math functions (div & mod) are implemented in
+ # libcompiler_rt on some architectures.
+-LIBADD+=	compiler_rt
+ 
+ .include <bsd.prog.mk>
+ ${PROG_FULL}:  ${VERSION_MAP}
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-gnu-date.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-gnu-date.patch
new file mode 100644
index 0000000000000..2356446baf853
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-gnu-date.patch
@@ -0,0 +1,13 @@
+diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
+index c594724d814..d5287c7b992 100644
+--- a/sys/conf/newvers.sh
++++ b/sys/conf/newvers.sh
+@@ -177,7 +177,7 @@ u=${USER:-root}
+ d=$(pwd)
+ h=${HOSTNAME:-$(hostname)}
+ if [ -n "$SOURCE_DATE_EPOCH" ]; then
+-	if ! t=$(date -r $SOURCE_DATE_EPOCH 2>/dev/null); then
++	if ! t=$(date -d @$SOURCE_DATE_EPOCH 2>/dev/null); then
+ 		echo "Invalid SOURCE_DATE_EPOCH" >&2
+ 		exit 1
+ 	fi
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-no-explicit-intrinsics-dep.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-no-explicit-intrinsics-dep.patch
new file mode 100644
index 0000000000000..5cf926d4519b2
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/sys-no-explicit-intrinsics-dep.patch
@@ -0,0 +1,42 @@
+--- a/sys/modules/aesni/Makefile	2023-12-16 09:19:28.454892154 -0700
++++ b/sys/Modules/aesni/Makefile	2023-12-16 09:19:41.975047684 -0700
+@@ -1,6 +1,5 @@
+ 
+ .PATH: ${SRCTOP}/sys/crypto/aesni
+-.PATH: ${SRCTOP}/contrib/llvm-project/clang/lib/Headers
+ 
+ KMOD=	aesni
+ SRCS=	aesni.c
+@@ -39,8 +38,8 @@
+ aesni_ghash.o: aesni.h
+ aesni_wrap.o: aesni.h
+ aesni_ccm.o: aesni.h
+-intel_sha1.o: sha_sse.h immintrin.h shaintrin.h tmmintrin.h xmmintrin.h
+-intel_sha256.o: sha_sse.h immintrin.h shaintrin.h tmmintrin.h xmmintrin.h
++intel_sha1.o: sha_sse.h
++intel_sha256.o: sha_sse.h
+ 
+ .include <bsd.kmod.mk>
+ 
+diff --git a/sys/modules/blake2/Makefile b/sys/modules/blake2/Makefile
+index e4b3fb9f126..5bfd9c2ae02 100644
+--- a/sys/modules/blake2/Makefile
++++ b/sys/modules/blake2/Makefile
+@@ -3,7 +3,6 @@
+ .PATH:	${SRCTOP}/sys/contrib/libb2
+ .PATH:	${SRCTOP}/sys/crypto/blake2
+ .PATH:	${SRCTOP}/sys/opencrypto
+-.PATH:	${SRCTOP}/contrib/llvm-project/clang/lib/Headers
+ 
+ KMOD	= blake2
+ 
+@@ -64,8 +63,7 @@ ${src:S/.c/.o/}: ${src}
+ 	    -D_MM_MALLOC_H_INCLUDED -Wno-unused-function ${.IMPSRC}
+ 	${CTFCONVERT_CMD}
+ 
+-${src:S/.c/.o/}: intrin.h emmintrin.h tmmintrin.h smmintrin.h immintrin.h \
+-    x86intrin.h ${SRCS:M*.h}
++${src:S/.c/.o/}: ${SRCS:M*.h}
+ .endfor
+ 
+ # FreeBSD-specific sources:
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/tinfo-host-cc.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/tinfo-host-cc.patch
new file mode 100644
index 0000000000000..6446322a8a0a3
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/tinfo-host-cc.patch
@@ -0,0 +1,15 @@
+--- a/lib/ncurses/tinfo/Makefile	2023-12-26 23:02:07.827892619 -0800
++++ b/lib/ncurses/tinfo/Makefile	2023-12-26 23:01:24.175546100 -0800
+@@ -282,10 +282,10 @@
+ build-tools: make_hash make_keys
+ 
+ make_keys: make_keys.c names.c ncurses_def.h ${HEADERS} ${BUILD_TOOLS_META}
+-	${CC:N${CCACHE_BIN}} -o $@ ${CFLAGS} ${NCURSES_DIR}/ncurses/tinfo/make_keys.c
++	${CC_HOST:N${CCACHE_BIN}} -o $@ ${CFLAGS} ${NCURSES_DIR}/ncurses/tinfo/make_keys.c
+ 
+ make_hash: make_hash.c hashsize.h ncurses_def.h ${HEADERS} ${BUILD_TOOLS_META}
+-	${CC:N${CCACHE_BIN}} -o $@ ${CFLAGS} -DMAIN_PROGRAM \
++	${CC_HOST:N${CCACHE_BIN}} -o $@ ${CFLAGS} -DMAIN_PROGRAM \
+ 		${NCURSES_DIR}/ncurses/tinfo/make_hash.c
+ .endif
+ .if ${MK_DIRDEPS_BUILD} == "yes" && ${MACHINE} != "host"
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix b/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix
new file mode 100644
index 0000000000000..2b2738ec5794a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix
@@ -0,0 +1,92 @@
+{
+  mkDerivation,
+  pkgsBuildBuild,
+  libjail,
+  libmd,
+  libnetbsd,
+  libcapsicum,
+  libcasper,
+  libelf,
+  libxo,
+  libncurses-tinfo,
+  libedit,
+  lib,
+  stdenv,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  groff,
+  byacc,
+  gencat,
+}:
+mkDerivation {
+  pname = "bins";
+  path = "bin";
+  extraPaths = [
+    "sys/conf"
+    "sys/sys/param.h"
+    "contrib/sendmail"
+    "contrib/tcsh"
+    "usr.bin/printf"
+    "lib/libsm"
+  ];
+  buildInputs = [
+    libjail
+    libmd
+    libnetbsd
+    libcapsicum
+    libcasper
+    libelf
+    libxo
+    libncurses-tinfo
+    libedit
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    install
+    tsort
+    lorder
+    mandoc
+    groff
+
+    byacc
+    gencat
+  ];
+
+  MK_TESTS = "no";
+
+  postPatch = ''
+    sed -E -i -e '/#define\tBSD.*/d' $BSDSRCDIR/sys/sys/param.h
+    sed -E -i -e '/^SYMLINKS.*/d' $BSDSRCDIR/bin/*/Makefile
+    sed -E -i -e 's/mktemp -t ka/mktemp -t kaXXXXXX/' $BSDSRCDIR/bin/sh/mkbuiltins $BSDSRCDIR/bin/sh/mktokens
+  '';
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="-I$BSDSRCDIR/sys $NIX_CFLAGS_COMPILE"
+
+    make -C $BSDSRCDIR/lib/libsm $makeFlags
+
+    make -C $BSDSRCDIR/bin/sh $makeFlags "CC=${pkgsBuildBuild.stdenv.cc}/bin/cc" CFLAGS="-D__unused= -D__printf0like\(a,b\)= -D__dead2=" ${
+      lib.optionalString (!stdenv.buildPlatform.isFreeBSD) "MK_PIE=no "
+    }mkbuiltins mksyntax mktokens mknodes
+    make -C $BSDSRCDIR/bin/csh $makeFlags "CC=${pkgsBuildBuild.stdenv.cc}/bin/cc" CFLAGS="-D__unused= -D__printf0like\(a,b\)= -D__dead2= -I$BSDSRCDIR/contrib/tcsh -I." ${
+      lib.optionalString (!stdenv.buildPlatform.isFreeBSD) "MK_PIE=no "
+    }gethost
+  '';
+
+  preInstall = ''
+    makeFlags="$makeFlags ROOTDIR=$out/root"
+  '';
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix b/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix
index 71ecef1bcae47..79dab282e3f3f 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix
@@ -1,7 +1,23 @@
 { buildPackages, freebsd-lib }:
 
-# Wrap NetBSD's install
-buildPackages.writeShellScriptBin "boot-install" (freebsd-lib.install-wrapper + ''
+# Wrap GNU coreutils' install
+# The -l flag causes a symlink instead of a copy to be installed, so
+# it is safe to discard during bootstrap since coreutils does not support it.
 
-  ${buildPackages.netbsd.install}/bin/xinstall "''${args[@]}"
-'')
+buildPackages.writeShellScriptBin "boot-install" (
+  freebsd-lib.install-wrapper
+  + ''
+    fixed_args=()
+    while [[ ''${#args[0]} > 0 ]]; do
+      case "''${args[0]}" in
+        -l)
+          args=("''${args[@]:2}")
+          continue
+      esac
+      fixed_args+=("''${args[0]}")
+      args=("''${args[@]:1}")
+    done
+
+    ${buildPackages.coreutils}/bin/install "''${fixed_args[@]}"
+  ''
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
index 5e4528fbf46a1..f597d6e3705b4 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
@@ -1,102 +1,129 @@
-{ lib, stdenv, mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, boot-install
-, which
-, freebsd-lib
-, expat, zlib,
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  versionData,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  boot-install,
+  which,
+  freebsd-lib,
+  expat,
+  zlib,
 }:
 
 let
   inherit (freebsd-lib) mkBsdArch;
 in
 
-mkDerivation rec {
+mkDerivation {
   pname = "compat";
   path = "tools/build";
-  extraPaths = [
-    "lib/libc/db"
-    "lib/libc/stdlib" # getopt
-    "lib/libc/gen" # getcap
-    "lib/libc/locale" # rpmatch
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    "lib/libc/string" # strlcpy
-    "lib/libutil"
-  ] ++ [
-    "contrib/libc-pwcache"
-    "contrib/libc-vis"
-    "sys/libkern"
-    "sys/kern/subr_capability.c"
-
-    # Take only individual headers, or else we will clobber native libc, etc.
-
-    "sys/rpc/types.h"
-
-    # Listed in Makekfile as INC
-    "include/mpool.h"
-    "include/ndbm.h"
-    "include/err.h"
-    "include/stringlist.h"
-    "include/a.out.h"
-    "include/nlist.h"
-    "include/db.h"
-    "include/getopt.h"
-    "include/nl_types.h"
-    "include/elf.h"
-    "sys/sys/ctf.h"
-
-    # Listed in Makekfile as SYSINC
-
-    "sys/sys/capsicum.h"
-    "sys/sys/caprights.h"
-    "sys/sys/imgact_aout.h"
-    "sys/sys/nlist_aout.h"
-    "sys/sys/nv.h"
-    "sys/sys/dnv.h"
-    "sys/sys/cnv.h"
-
-    "sys/sys/elf32.h"
-    "sys/sys/elf64.h"
-    "sys/sys/elf_common.h"
-    "sys/sys/elf_generic.h"
-    "sys/${mkBsdArch stdenv}/include"
-  ] ++ lib.optionals stdenv.hostPlatform.isx86 [
-    "sys/x86/include"
-  ] ++ [
-
-    "sys/sys/queue.h"
-    "sys/sys/md5.h"
-    "sys/sys/sbuf.h"
-    "sys/sys/tree.h"
-    "sys/sys/font.h"
-    "sys/sys/consio.h"
-    "sys/sys/fnv_hash.h"
-
-    "sys/crypto/chacha20/_chacha.h"
-    "sys/crypto/chacha20/chacha.h"
-    # included too, despite ".c"
-    "sys/crypto/chacha20/chacha.c"
-
-    "sys/fs"
-    "sys/ufs"
-    "sys/sys/disk"
-
-    "lib/libcapsicum"
-    "lib/libcasper"
-  ];
-
-  patches = [
-    ./compat-install-dirs.patch
-    ./compat-fix-typedefs-locations.patch
-  ];
-
-  preBuild = ''
-    NIX_CFLAGS_COMPILE+=' -I../../include -I../../sys'
-
-    cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys
-    cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys/${mkBsdArch stdenv}
-  '' + lib.optionalString stdenv.hostPlatform.isx86 ''
-    cp ../../sys/x86/include/elf.h ../../sys/x86
-  '';
+  extraPaths =
+    [
+      "lib/libc/db"
+      "lib/libc/stdlib" # getopt
+      "lib/libc/gen" # getcap
+      "lib/libc/locale" # rpmatch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "lib/libc/string" # strlcpy
+      "lib/libutil"
+    ]
+    ++ [
+      "contrib/libc-pwcache"
+      "contrib/libc-vis"
+      "sys/libkern"
+      "sys/kern/subr_capability.c"
+
+      # Take only individual headers, or else we will clobber native libc, etc.
+
+      "sys/rpc/types.h"
+    ]
+    ++ lib.optionals (versionData.major == 14) [ "sys/sys/bitcount.h" ]
+    ++ [
+
+      # Listed in Makekfile as INC
+      "include/mpool.h"
+      "include/ndbm.h"
+      "include/err.h"
+      "include/stringlist.h"
+      "include/a.out.h"
+      "include/nlist.h"
+      "include/db.h"
+      "include/getopt.h"
+      "include/nl_types.h"
+      "include/elf.h"
+      "sys/sys/ctf.h"
+    ]
+    ++ lib.optionals (versionData.major == 14) [
+      "include/bitstring.h"
+      "sys/sys/bitstring.h"
+      "sys/sys/nv_namespace.h"
+    ]
+    ++ [
+
+      # Listed in Makekfile as SYSINC
+
+      "sys/sys/capsicum.h"
+      "sys/sys/caprights.h"
+      "sys/sys/imgact_aout.h"
+      "sys/sys/nlist_aout.h"
+      "sys/sys/nv.h"
+      "sys/sys/dnv.h"
+      "sys/sys/cnv.h"
+
+      "sys/sys/elf32.h"
+      "sys/sys/elf64.h"
+      "sys/sys/elf_common.h"
+      "sys/sys/elf_generic.h"
+      "sys/${mkBsdArch stdenv}/include"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isx86 [ "sys/x86/include" ]
+    ++ [
+
+      "sys/sys/queue.h"
+      "sys/sys/md5.h"
+      "sys/sys/sbuf.h"
+      "sys/sys/tree.h"
+      "sys/sys/font.h"
+      "sys/sys/consio.h"
+      "sys/sys/fnv_hash.h"
+      #"sys/sys/cdefs.h"
+      #"sys/sys/param.h"
+      "sys/sys/_null.h"
+      #"sys/sys/types.h"
+      "sys/sys/_pthreadtypes.h"
+      "sys/sys/_stdint.h"
+
+      "sys/crypto/chacha20/_chacha.h"
+      "sys/crypto/chacha20/chacha.h"
+      # included too, despite ".c"
+      "sys/crypto/chacha20/chacha.c"
+
+      "sys/fs"
+      "sys/ufs"
+      "sys/sys/disk"
+
+      "lib/libcapsicum"
+      "lib/libcasper"
+      "lib/libmd"
+
+      # idk bro
+      "sys/sys/kbio.h"
+    ];
+
+  preBuild =
+    ''
+      NIX_CFLAGS_COMPILE+=' -I../../include -I../../sys'
+
+      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys
+      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys/${mkBsdArch stdenv}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isx86 ''
+      cp ../../sys/x86/include/elf.h ../../sys/x86
+    '';
 
   setupHooks = [
     ../../../../../build-support/setup-hooks/role.bash
@@ -109,13 +136,17 @@ mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
+    bsdSetupHook
+    freebsdSetupHook
     makeMinimal
     boot-install
 
     which
   ];
-  buildInputs = [ expat zlib ];
+  buildInputs = [
+    expat
+    zlib
+  ];
 
   makeFlags = [
     "STRIP=-s" # flag to install, not command
@@ -124,12 +155,20 @@ mkDerivation rec {
     "INSTALL=boot-install"
   ];
 
-  preIncludes = ''
-    mkdir -p $out/{0,1}-include
-    cp --no-preserve=mode -r cross-build/include/common/* $out/0-include
-  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
-    cp --no-preserve=mode -r cross-build/include/linux/* $out/1-include
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    cp --no-preserve=mode -r cross-build/include/darwin/* $out/1-include
-  '';
+  preIncludes =
+    ''
+      mkdir -p $out/{0,1}-include
+      cp --no-preserve=mode -r cross-build/include/common/* $out/0-include
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      cp --no-preserve=mode -r cross-build/include/linux/* $out/1-include
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      cp --no-preserve=mode -r cross-build/include/darwin/* $out/1-include
+    '';
+
+  # Compat is for making other platforms look like FreeBSD (e.g. to
+  # build build-time dependencies for building FreeBSD packages). It is
+  # not needed when building for FreeBSD.
+  meta.broken = stdenv.hostPlatform.isFreeBSD;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/config.nix b/pkgs/os-specific/bsd/freebsd/pkgs/config.nix
index 641cfc46b4e9b..f7ba273ed5583 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/config.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/config.nix
@@ -1,17 +1,35 @@
-{ mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
-, flex, byacc, file2c
-, compatIfNeeded, libnv, libsbuf
+{
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  flex,
+  byacc,
+  file2c,
+  compatIfNeeded,
+  libnv,
+  libsbuf,
 }:
 
 mkDerivation {
   path = "usr.sbin/config";
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    install
+    mandoc
+    groff
 
-    flex byacc file2c
+    flex
+    byacc
+    file2c
+  ];
+  buildInputs = compatIfNeeded ++ [
+    libnv
+    libsbuf
   ];
-  buildInputs = compatIfNeeded ++ [ libnv libsbuf ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/cp.nix b/pkgs/os-specific/bsd/freebsd/pkgs/cp.nix
new file mode 100644
index 0000000000000..3ebfd91a4e153
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/cp.nix
@@ -0,0 +1,10 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "bin/cp";
+
+  extraPaths = [ "sys" ];
+
+  postPatch = ''
+    substituteInPlace $BSDSRCDIR/bin/cp/Makefile --replace 'tests' ""
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix b/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix
index 0b17cb1c8481d..020a08c1d01ef 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix
@@ -1,23 +1,32 @@
-{ lib, mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal
-, install
-, flex, byacc, gencat
-, include
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  flex,
+  byacc,
+  gencat,
+  include,
 }:
 
 mkDerivation {
+  noLibc = true;
   path = "lib/csu";
   extraPaths = [
     "lib/Makefile.inc"
     "lib/libc/include/libc_private.h"
   ];
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
+    bsdSetupHook
+    freebsdSetupHook
     makeMinimal
     install
 
-    flex byacc gencat
+    flex
+    byacc
+    gencat
   ];
   buildInputs = [ include ];
   MK_TESTS = "no";
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix
index 0aebc9b3d0b93..9e653bb4f51ef 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix
@@ -1,7 +1,10 @@
-{ lib, stdenv, mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
-, compatIfNeeded, libelf, libdwarf, zlib, libspl
+{
+  lib,
+  mkDerivation,
+  compatIfNeeded,
+  libdwarf,
+  zlib,
+  libspl,
 }:
 
 mkDerivation {
@@ -15,14 +18,18 @@ mkDerivation {
   ];
   OPENSOLARIS_USR_DISTDIR = "$(SRCTOP)/cddl/contrib/opensolaris";
   OPENSOLARIS_SYS_DISTDIR = "$(SRCTOP)/sys/cddl/contrib/opensolaris";
-  nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
 
-    # flex byacc file2c
+  makeFlags = [
+    "STRIP=-s"
+    "MK_WERROR=no"
+    "MK_TESTS=no"
   ];
+
   buildInputs = compatIfNeeded ++ [
-    libelf libdwarf zlib libspl
+    libdwarf
+    zlib
+    libspl
   ];
+
   meta.license = lib.licenses.cddl;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/filterSource.nix b/pkgs/os-specific/bsd/freebsd/pkgs/filterSource.nix
new file mode 100644
index 0000000000000..09674056d9cd8
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/filterSource.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  pkgsBuildBuild,
+  runCommand,
+  writeText,
+  source,
+}:
+
+{
+  pname,
+  path,
+  extraPaths ? [ ],
+}:
+
+let
+  sortedPaths = lib.naturalSort ([ path ] ++ extraPaths);
+  filterText = writeText "${pname}-src-include" (
+    lib.concatMapStringsSep "\n" (path: "/${path}") sortedPaths
+  );
+in
+runCommand "${pname}-filtered-src"
+  {
+    nativeBuildInputs = [
+      (pkgsBuildBuild.rsync.override {
+        enableZstd = false;
+        enableXXHash = false;
+        enableOpenSSL = false;
+        enableLZ4 = false;
+      })
+    ];
+  }
+  ''
+    rsync -a -r --files-from=${filterText} ${source}/ $out
+  ''
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix
index 430c4c5c43ac1..ef4a14ccf4aa9 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix
@@ -1,5 +1,3 @@
 { makeSetupHook }:
 
-makeSetupHook {
-  name = "freebsd-setup-hook";
-} ./setup-hook.sh
+makeSetupHook { name = "freebsd-setup-hook"; } ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh
index 929782954ba77..96a3d14c80f7b 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh
@@ -5,7 +5,18 @@ setFreeBSDSrcTop() {
 addFreeBSDMakeFlags() {
   makeFlags="SBINDIR=${!outputBin}/bin $makeFlags"
   makeFlags="LIBEXECDIR=${!outputLib}/libexec $makeFlags"
+  makeFlags="LIBDATADIR=${!outputLib}/data $makeFlags"
   makeFlags="INCLUDEDIR=${!outputDev}/include $makeFlags"
+  makeFlags="CONFDIR=${!outputBin}/etc $makeFlags"
+  makeFlags="MANDIR=${!outputMan}/share/man/man $makeFlags"
+
+  if [ -n "$debug" ]; then
+    makeFlags="DEBUGFILEDIR=${debug}/lib/debug $makeFlags"
+  else
+    makeFlags="DEBUGFILEDIR=${out}/lib/debug $makeFlags"
+  fi
+
+  echo $makeFlags
 }
 
 postUnpackHooks+=(setFreeBSDSrcTop)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix
index e9ae9f27cc05b..ea701b6404ecc 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix
@@ -1,5 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/gencat";
-}
+mkDerivation { path = "usr.bin/gencat"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/iconv.nix b/pkgs/os-specific/bsd/freebsd/pkgs/iconv.nix
new file mode 100644
index 0000000000000..9c1ba1835c145
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/iconv.nix
@@ -0,0 +1,12 @@
+{
+  mkDerivation,
+  libcapsicum,
+  libcasper,
+}:
+mkDerivation {
+  path = "usr.bin/iconv";
+  buildInputs = [
+    libcapsicum
+    libcasper
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
index 73fa887c51231..a7ceb0cdf384f 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
@@ -1,12 +1,13 @@
-{ lib, mkDerivation
-, buildPackages
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal
-, install
-, mandoc, groff, rsync /*, nbperf*/, rpcgen
+{
+  lib,
+  mkDerivation,
+  buildPackages,
+  rpcgen,
+  mtree,
 }:
 
 mkDerivation {
+  noLibc = true;
   path = "include";
 
   extraPaths = [
@@ -15,18 +16,9 @@ mkDerivation {
     "sys"
   ];
 
-  nativeBuildInputs =  [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal
-    install
-    mandoc groff rsync /*nbperf*/ rpcgen
-
-    # HACK use NetBSD's for now
-    buildPackages.netbsd.mtree
-  ];
-
-  patches = [
-    ./no-perms-BSD.include.dist.patch
+  extraNativeBuildInputs = [
+    rpcgen
+    mtree
   ];
 
   # The makefiles define INCSDIR per subdirectory, so we have to set
@@ -37,11 +29,10 @@ mkDerivation {
       sed -i -E \
         -e 's_/usr/include_''${INCSDIR0}_' \
         {} \;
+    sed -E -i -e "/_PATH_LOGIN/d" $BSDSRCDIR/include/paths.h
   '';
 
-  makeFlags = [
-    "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp"
-  ];
+  makeFlags = [ "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp" ];
 
   # multiple header dirs, see above
   postConfigure = ''
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/install.nix b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
index 3db6cd3633d49..b8e59adb09c5f 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
@@ -1,41 +1,67 @@
-{ lib, stdenv, mkDerivation, writeShellScript
-, freebsd-lib
-, mtree
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, mandoc, groff
-, boot-install, install
-, compatIfNeeded, libmd, libnetbsd
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  writeShellScript,
+  freebsd-lib,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  mandoc,
+  groff,
+  boot-install,
+  install,
+  compatIfNeeded,
+  libmd,
+  libnetbsd,
 }:
 
 # HACK: to ensure parent directories exist. This emulates GNU
 # install’s -D option. No alternative seems to exist in BSD install.
 let
-  binstall = writeShellScript "binstall" (freebsd-lib.install-wrapper + ''
+  binstall = writeShellScript "binstall" (
+    freebsd-lib.install-wrapper
+    + ''
 
-    @out@/bin/xinstall "''${args[@]}"
-  '');
-in mkDerivation {
+      @out@/bin/xinstall "''${args[@]}"
+    ''
+  );
+in
+mkDerivation {
   path = "usr.bin/xinstall";
-  extraPaths = [ mtree.path ];
+  extraPaths = [ "contrib/mtree" ];
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal mandoc groff
-    (if stdenv.hostPlatform == stdenv.buildPlatform
-     then boot-install
-     else install)
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    mandoc
+    groff
+    (if stdenv.hostPlatform == stdenv.buildPlatform then boot-install else install)
   ];
   skipIncludesPhase = true;
-  buildInputs = compatIfNeeded ++ [ libmd libnetbsd ];
-  makeFlags = [
-    "STRIP=-s" # flag to install, not command
-    "MK_WERROR=no"
-    "TESTSDIR=${builtins.placeholder "test"}"
-  ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+  buildInputs = compatIfNeeded ++ [
+    libmd
+    libnetbsd
+  ];
+  makeFlags =
+    [
+      "STRIP=-s" # flag to install, not command
+      "MK_WERROR=no"
+      "TESTSDIR=${builtins.placeholder "test"}"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform) [
+      "BOOTSTRAPPING=1"
+      "INSTALL=boot-install"
+    ];
   postInstall = ''
-    install -D -m 0550 ${binstall} $out/bin/binstall
+    install -C -m 0550 ${binstall} $out/bin/binstall
     substituteInPlace $out/bin/binstall --subst-var out
     mv $out/bin/install $out/bin/xinstall
     ln -s ./binstall $out/bin/install
   '';
-  outputs = [ "out" "man" "test" ];
+  outputs = [
+    "out"
+    "man"
+    "test"
+  ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix
new file mode 100644
index 0000000000000..406e37402b2bb
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  libelf,
+}:
+mkDerivation {
+  path = "usr.bin/ldd";
+  extraPaths = [
+    "libexec/rtld-elf"
+    "contrib/elftoolchain/libelf"
+  ];
+
+  buildInputs = [ libelf ];
+
+  env = {
+    NIX_CFLAGS_COMPILE = "-D_RTLD_PATH=${lib.getLib stdenv.cc.libc}/libexec/ld-elf.so.1";
+  };
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
index 0225d44be4c3b..a991e69265823 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
@@ -1,79 +1,145 @@
-{ lib, stdenv, mkDerivation
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkDerivation,
 
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal
-, install
-, flex, byacc, gencat, rpcgen
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  flex,
+  byacc,
+  gencat,
+  rpcgen,
+  mkcsmapper,
+  mkesdb,
 
-, csu, include
+  csu,
+  include,
+  versionData,
 }:
 
-mkDerivation rec {
+mkDerivation {
+  noLibc = true;
   pname = "libc";
   path = "lib/libc";
-  extraPaths = [
-    "etc/group"
-    "etc/master.passwd"
-    "etc/shells"
-    "lib/libmd"
-    "lib/libutil"
-    "lib/msun"
-    "sys/kern"
-    "sys/libkern"
-    "sys/sys"
-    "sys/crypto/chacha20"
-    "include/rpcsvc"
-    "contrib/jemalloc"
-    "contrib/gdtoa"
-    "contrib/libc-pwcache"
-    "contrib/libc-vis"
-    "contrib/tzcode/stdtime"
-
-    # libthr
-    "lib/libthr"
-    "lib/libthread_db"
-    "libexec/rtld-elf"
-
-    # librpcsvc
-    "lib/librpcsvc"
-
-    # librt
-    "lib/librt"
-
-    # libcrypt
-    "lib/libcrypt"
-    "lib/libmd"
-    "sys/crypto/sha2"
-  ];
+  extraPaths =
+    [
+      "lib/libc_nonshared"
+      "etc/group"
+      "etc/master.passwd"
+      "etc/shells"
+      "lib/libmd"
+      "lib/libutil"
+      "lib/msun"
+      "sys/kern"
+      "sys/libkern"
+      "sys/sys"
+      "sys/crypto/chacha20"
+      "include/rpcsvc"
+      "contrib/jemalloc"
+      "contrib/gdtoa"
+      "contrib/libc-pwcache"
+      "contrib/libc-vis"
+    ]
+    ++ lib.optionals (versionData.major == 13) [ "contrib/tzcode/stdtime" ]
+    ++ lib.optionals (versionData.major == 14) [ "contrib/tzcode" ]
+    ++ [
 
-  patches = [
-    # Hack around broken propogating MAKEFLAGS to submake, just inline logic
-    ./libc-msun-arch-subdir.patch
+      # libthr
+      "lib/libthr"
+      "lib/libthread_db"
+      "libexec/rtld-elf"
+      "lib/csu/common/crtbrand.S"
+      "lib/csu/common/notes.h"
 
-    # Don't force -lcompiler-rt, we don't actually call it that
-    ./libc-no-force--lcompiler-rt.patch
+      # librpcsvc
+      "lib/librpcsvc"
 
-    # Fix extra include dir to get rpcsvc headers.
-    ./librpcsvc-include-subdir.patch
-  ];
+      # librt
+      "lib/librt"
+
+      # libcrypt
+      "lib/libcrypt"
+      "lib/libmd"
+      "sys/crypto/sha2"
+      "sys/crypto/skein"
+
+      # libgcc and friends
+      "lib/libgcc_eh"
+      "lib/libgcc_s"
+      "lib/libcompiler_rt"
+      "contrib/llvm-project/libunwind"
+      "contrib/llvm-project/compiler-rt"
+      #"contrib/llvm-project/libcxx"
+
+      # terminfo
+      "lib/ncurses"
+      "contrib/ncurses"
+      "lib/Makefile.inc"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isx86_32) [ "lib/libssp_nonshared" ]
+    ++ [
+      "lib/libexecinfo"
+      "contrib/libexecinfo"
+
+      "lib/libkvm"
+      "sys" # ummmmmmmmmm libkvm wants arch-specific headers from the kernel tree
+
+      "lib/libmemstat"
+
+      "lib/libprocstat"
+      "sys/contrib/openzfs"
+      "sys/contrib/pcg-c"
+      "sys/opencrypto"
+      "sys/contrib/ck"
+      "sys/crypto"
+
+      "lib/libdevstat"
+
+      "lib/libelf"
+      "contrib/elftoolchain"
+
+      "lib/libiconv_modules"
+      "share/i18n"
+      "include/paths.h"
+
+      "lib/libdl"
+    ];
 
   postPatch = ''
     substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
+
+    substituteInPlace $BSDSRCDIR/include/paths.h \
+        --replace '/usr/lib/i18n' '${builtins.placeholder "out"}/lib/i18n' \
+        --replace '/usr/share/i18n' '${builtins.placeholder "out"}/share/i18n'
   '';
 
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
+    bsdSetupHook
+    freebsdSetupHook
     makeMinimal
     install
 
-    flex byacc gencat rpcgen
+    flex
+    byacc
+    gencat
+    rpcgen
+    mkcsmapper
+    mkesdb
+  ];
+  buildInputs = [
+    include
+    csu
+  ];
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-B${csu}/lib"
+    # These are supposed to have _RTLD_COMPAT_LIB_SUFFIX so we can get things like "lib32"
+    # but that's unnecessary
+    "-DSTANDARD_LIBRARY_PATH=\"${builtins.placeholder "out"}/lib\""
+    "-D_PATH_RTLD=\"${builtins.placeholder "out"}/libexec/ld-elf.so.1\""
   ];
-  buildInputs = [ include csu ];
-  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib";
-
-  # Suppress lld >= 16 undefined version errors
-  # https://github.com/freebsd/freebsd-src/commit/2ba84b4bcdd6012e8cfbf8a0d060a4438623a638
-  env.NIX_LDFLAGS = lib.optionalString (stdenv.targetPlatform.linker == "lld") "--undefined-version";
 
   makeFlags = [
     "STRIP=-s" # flag to install, not command
@@ -84,7 +150,7 @@ mkDerivation rec {
   MK_SYMVER = "yes";
   MK_SSP = "yes";
   MK_NLS = "yes";
-  MK_ICONV = "no"; # TODO make srctop
+  MK_ICONV = "yes";
   MK_NS_CACHING = "yes";
   MK_INET6_SUPPORT = "yes";
   MK_HESIOD = "yes";
@@ -96,44 +162,125 @@ mkDerivation rec {
   MK_MALLOC_PRODUCTION = "yes";
 
   MK_TESTS = "no";
+  MACHINE_ABI = "";
+  MK_DETECT_TZ_CHANGES = "no";
+  MK_MACHDEP_OPTIMIZATIONS = "yes";
+  MK_ASAN = "no";
+  MK_UBSAN = "no";
+
+  NO_FSCHG = "yes";
+
+  preBuild = lib.optionalString (stdenv.hostPlatform.isx86_32) ''
+    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags
+    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags install
+  '';
+
+  postInstall =
+    ''
+      pushd ${include}
+      find . -type d -exec mkdir -p $out/\{} \;
+      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+      popd
+
+      pushd ${csu}
+      find . -type d -exec mkdir -p $out/\{} \;
+      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+      popd
+
+      mkdir $BSDSRCDIR/lib/libcompiler_rt/i386
+      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags
+      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags install
+
+      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags
+      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags install
+
+      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # not sure
+      mkdir $BSDSRCDIR/lib/libgcc_s/i386
+      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
+      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
+
+      NIX_CFLAGS_COMPILE+=" -B$out/lib"
+      NIX_CFLAGS_COMPILE+=" -I$out/include"
+      NIX_LDFLAGS+=" -L$out/lib"
+
+      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags
+      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags install
+
+      mkdir $BSDSRCDIR/lib/libmd/sys
+      make -C $BSDSRCDIR/lib/libmd $makeFlags
+      make -C $BSDSRCDIR/lib/libmd $makeFlags install
 
-  postInstall = ''
-    pushd ${include}
-    find . -type d -exec mkdir -p $out/\{} \;
-    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-    popd
+      make -C $BSDSRCDIR/lib/libthr $makeFlags
+      make -C $BSDSRCDIR/lib/libthr $makeFlags install
 
-    pushd ${csu}
-    find . -type d -exec mkdir -p $out/\{} \;
-    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-    popd
+      make -C $BSDSRCDIR/lib/msun $makeFlags
+      make -C $BSDSRCDIR/lib/msun $makeFlags install
 
-    sed -i -e 's| [^ ]*/libc_nonshared.a||' $out/lib/libc.so
+      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
 
-    $CC -nodefaultlibs -lgcc -shared -o $out/lib/libgcc_s.so
+      make -C $BSDSRCDIR/lib/libutil $makeFlags
+      make -C $BSDSRCDIR/lib/libutil $makeFlags install
 
-    NIX_CFLAGS_COMPILE+=" -B$out/lib"
-    NIX_CFLAGS_COMPILE+=" -I$out/include"
-    NIX_LDFLAGS+=" -L$out/lib"
+      make -C $BSDSRCDIR/lib/librt $makeFlags
+      make -C $BSDSRCDIR/lib/librt $makeFlags install
 
-    make -C $BSDSRCDIR/lib/libthr $makeFlags
-    make -C $BSDSRCDIR/lib/libthr $makeFlags install
+      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
+      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
 
-    make -C $BSDSRCDIR/lib/msun $makeFlags
-    make -C $BSDSRCDIR/lib/msun $makeFlags install
+      make -C $BSDSRCDIR/lib/libelf $makeFlags
+      make -C $BSDSRCDIR/lib/libelf $makeFlags install
 
-    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags
+      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags install
 
-    make -C $BSDSRCDIR/lib/libutil $makeFlags
-    make -C $BSDSRCDIR/lib/libutil $makeFlags install
+      make -C $BSDSRCDIR/lib/libkvm $makeFlags
+      make -C $BSDSRCDIR/lib/libkvm $makeFlags install
 
-    make -C $BSDSRCDIR/lib/librt $makeFlags
-    make -C $BSDSRCDIR/lib/librt $makeFlags install
+      make -C $BSDSRCDIR/lib/libmemstat $makeFlags
+      make -C $BSDSRCDIR/lib/libmemstat $makeFlags install
 
-    make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-    make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+      make -C $BSDSRCDIR/lib/libprocstat $makeFlags
+      make -C $BSDSRCDIR/lib/libprocstat $makeFlags install
+
+      make -C $BSDSRCDIR/lib/libdevstat $makeFlags
+      make -C $BSDSRCDIR/lib/libdevstat $makeFlags install
+
+      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags
+      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags SHLIBDIR=${builtins.placeholder "out"}/lib/i18n install
+
+      make -C $BSDSRCDIR/lib/libdl $makeFlags
+      make -C $BSDSRCDIR/lib/libdl $makeFlags install
+
+      make -C $BSDSRCDIR/share/i18n $makeFlags
+      make -C $BSDSRCDIR/share/i18n $makeFlags ESDBDIR=${builtins.placeholder "out"}/share/i18n/esdb CSMAPPERDIR=${builtins.placeholder "out"}/share/i18n/csmapper install
+
+    ''
+    + lib.optionalString stdenv.hostPlatform.isx86_32 ''
+      $CC -c $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.c -o $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o
+      ORIG_NIX_LDFLAGS="$NIX_LDFLAGS"
+      NIX_LDFLAGS+=" $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o"
+    ''
+    + ''
+      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags
+      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags install
+      rm -f $out/libexec/ld-elf.so.1
+      mv $out/bin/ld-elf.so.1 $out/libexec
+    '';
+
+  # libc should not be allowed to refer to anything other than itself
+  postFixup = ''
+    find $out -type f | xargs -n1 ${buildPackages.patchelf}/bin/patchelf --shrink-rpath --allowed-rpath-prefixes $out || true
   '';
 
   meta.platforms = lib.platforms.freebsd;
+
+  # definitely a bad idea to enable stack protection on the stack protection initializers
+  hardeningDisable = [ "stackprotector" ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcapsicum.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcapsicum.nix
new file mode 100644
index 0000000000000..3cb1560df77aa
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcapsicum.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "lib/libcapsicum"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcasper.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcasper.nix
new file mode 100644
index 0000000000000..df27f72bc8cb0
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcasper.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  libnv,
+}:
+mkDerivation {
+  path = "lib/libcasper/libcasper";
+  extraPaths = [
+    "lib/Makefile.inc"
+    "lib/libcasper"
+  ];
+  buildInputs = [ libnv ];
+
+  MK_TESTS = "no";
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "CFLAGS=-DWITH_CASPER"
+  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+
+  postInstall = ''
+    make -C $BSDSRCDIR/lib/libcasper/services $makeFlags CFLAGS="-DWITH_CASPER -I$out/include"
+    make -C $BSDSRCDIR/lib/libcasper/services $makeFlags install
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
new file mode 100644
index 0000000000000..fd5591c0ffb8a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
@@ -0,0 +1,18 @@
+{ mkDerivation }:
+# this package is quite different from stock libcxxrt.
+# as of FreeBSD 14.0, it is vendored from APPROXIMATELY libcxxrt
+# 5d8a15823a103bbc27f1bfdcf2b5aa008fab57dd, though the vendoring mechanism is
+# extremely ad-hoc. Moreover, the build mechanism is totally custom, and adds
+# symbol versions not specified on any version of libcxxrt.
+mkDerivation {
+  pname = "libcxxrt";
+  path = "lib/libcxxrt";
+  extraPaths = [ "contrib/libcxxrt" ];
+  outputs = [
+    "out"
+    "dev"
+    "debug"
+  ];
+  noLibcxx = true;
+  libName = "cxxrt";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix
new file mode 100644
index 0000000000000..2b77a0f716624
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, ... }:
+mkDerivation {
+  path = "lib/libdl";
+  extraPaths = [
+    "lib/libc"
+    "libexec/rtld-elf"
+  ];
+  buildInputs = [ ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix
index 9fc8fc5f9a624..ee4d57b021b1d 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
-, m4
-, compatIfNeeded, libelf
+{
+  mkDerivation,
+  m4,
+  compatIfNeeded,
+  zlib,
 }:
 
 mkDerivation {
@@ -14,14 +14,7 @@ mkDerivation {
     "sys/sys/elf64.h"
     "sys/sys/elf_common.h"
   ];
-  nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
-
-    m4
-  ];
-  buildInputs = compatIfNeeded ++ [
-    libelf
-  ];
+  extraNativeBuildInputs = [ m4 ];
+  buildInputs = compatIfNeeded ++ [ zlib ];
   MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libedit.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libedit.nix
new file mode 100644
index 0000000000000..50b1c9f58333f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libedit.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, libncurses-tinfo }:
+mkDerivation {
+  path = "lib/libedit";
+  extraPaths = [ "contrib/libedit" ];
+  buildInputs = [ libncurses-tinfo ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
index a44ce1685e57d..a116aff81f397 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
@@ -1,24 +1,29 @@
-{ lib, stdenv, mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
-, m4
+{
+  mkDerivation,
+  lib,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  m4,
 }:
-
 mkDerivation {
   path = "lib/libelf";
   extraPaths = [
-    "contrib/elftoolchain/libelf"
-    "contrib/elftoolchain/common"
+    "lib/libc"
+    "contrib/elftoolchain"
     "sys/sys/elf32.h"
     "sys/sys/elf64.h"
     "sys/sys/elf_common.h"
   ];
-  BOOTSTRAPPING = !stdenv.isFreeBSD;
+  buildInputs = [ ];
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
-
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    install
     m4
   ];
-  MK_TESTS = "no";
+
+  meta.platforms = lib.platforms.freebsd;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libjail.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libjail.nix
new file mode 100644
index 0000000000000..9150be559c650
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libjail.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libjail";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix
new file mode 100644
index 0000000000000..71d0c1e50d5ea
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  freebsdSetupHook,
+  bsdSetupHook,
+  makeMinimal,
+}:
+mkDerivation {
+  path = "lib/libmd";
+  extraPaths = [
+    "sys/sys/md5.h"
+    "sys/crypto/sha2"
+    "sys/crypto/skein"
+  ];
+  nativeBuildInputs = [
+    makeMinimal
+    bsdSetupHook
+    freebsdSetupHook
+  ];
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "RELDIR=."
+  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+
+  preBuild = ''
+    mkdir sys
+  '';
+
+  installPhase = ''
+    # libmd is used by install. do it yourself!
+    mkdir -p $out/include $out/lib $man/share/man
+    cp libmd.a $out/lib/libmd.a
+    for f in $(make $makeFlags -V INCS); do
+      if [ -e "$f" ]; then cp "$f" "$out/include/$f"; fi
+      if [ -e "$BSDSRCDIR/sys/crypto/sha2/$f" ]; then cp "$BSDSRCDIR/sys/crypto/sha2/$f" "$out/include/$f"; fi
+      if [ -e "$BSDSRCDIR/sys/crypto/skein/$f" ]; then cp "$BSDSRCDIR/sys/crypto/skein/$f" "$out/include/$f"; fi
+    done
+    for f in $(make $makeFlags -V MAN); do
+      cp "$f" "$man/share/man/$f"
+    done
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libncurses-tinfo.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libncurses-tinfo.nix
new file mode 100644
index 0000000000000..f86f78dbc2914
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libncurses-tinfo.nix
@@ -0,0 +1,15 @@
+{ mkDerivation, pkgsBuildBuild }:
+mkDerivation {
+  path = "lib/ncurses/tinfo";
+  extraPaths = [
+    "lib/ncurses"
+    "contrib/ncurses"
+    "lib/Makefile.inc"
+  ];
+  CC_HOST = "${pkgsBuildBuild.stdenv.cc}/bin/cc";
+  MK_TESTS = "no";
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -D_VA_LIST -D_VA_LIST_DECLARED -Dva_list=__builtin_va_list -D_SIZE_T -D_WCHAR_T"
+    make $makeFlags "CFLAGS=-D_VA_LIST -D_VA_LIST_DECLARED -Dva_list=__builtin_va_list -I$BSDSRCDIR/contrib/ncurses/ncurses -I$BSDSRCDIR/contrib/ncurses/include -I." ncurses_dll.h make_hash make_keys
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libncurses.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libncurses.nix
new file mode 100644
index 0000000000000..2dd1ee2fe57de
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libncurses.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  versionData,
+  mkDerivation,
+  libncurses-tinfo,
+  ...
+}:
+mkDerivation {
+  path = "lib/ncurses/ncurses";
+  extraPaths = [
+    "lib/ncurses"
+    "contrib/ncurses"
+    "lib/Makefile.inc"
+  ];
+  MK_TESTS = "no";
+  preBuild = lib.optionalString (versionData.major == 14) ''
+    make -C ../tinfo $makeFlags curses.h ncurses_dll.h ncurses_def.h
+  '';
+  buildInputs = lib.optionals (versionData.major == 14) [ libncurses-tinfo ];
+
+  # some packages depend on libncursesw.so.8
+  postInstall = ''
+    ln -s $out/lib/libncursesw.so.9 $out/lib/libncursesw.so.8
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
index 4011e4d8a6490..82a9e140102f6 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
@@ -1,26 +1,28 @@
-{ lib, stdenv
-, mkDerivation
-, bsdSetupHook, freebsdSetupHook, makeMinimal, mandoc, groff
-, boot-install, install
-, compatIfNeeded
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  mandoc,
+  groff,
+  boot-install,
+  install,
 }:
 
 mkDerivation {
   path = "lib/libnetbsd";
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal mandoc groff
-    (if stdenv.hostPlatform == stdenv.buildPlatform
-     then boot-install
-     else install)
-  ];
-  patches = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
-    ./libnetbsd-do-install.patch
-    #./libnetbsd-define-__va_list.patch
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    mandoc
+    groff
+    (if stdenv.hostPlatform == stdenv.buildPlatform then boot-install else install)
   ];
   makeFlags = [
     "STRIP=-s" # flag to install, not command
     "MK_WERROR=no"
   ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
-  buildInputs = compatIfNeeded;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
index 719474dbb11ac..242492a3f2f23 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
@@ -2,8 +2,6 @@
 
 mkDerivation {
   path = "lib/libsbuf";
-  extraPaths = [
-    "sys/kern"
-  ];
+  extraPaths = [ "sys/kern" ];
   MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix
index da5445a09fcda..c444975549ad6 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix
@@ -3,19 +3,20 @@
 mkDerivation {
   path = "cddl/lib/libspl";
   extraPaths = [
-    "sys/contrib/openzfs/lib/libspl"
-    "sys/contrib/openzfs/include"
-
     "cddl/compat/opensolaris/include"
+    "sys/contrib/openzfs/include"
+    "sys/contrib/openzfs/lib/libspl"
     "sys/contrib/openzfs/module/icp/include"
-    "sys/modules/zfs"
+    "sys/modules/zfs/zfs_config.h"
   ];
-  # nativeBuildInputs = [
-  #   bsdSetupHook freebsdSetupHook
-  #   makeMinimal install mandoc groff
 
-  #   flex byacc file2c
-  # ];
-  # buildInputs = compatIfNeeded ++ [ libnv libsbuf ];
-  meta.license = lib.licenses.cddl;
+  # Without a prefix it will try to put object files in nonexistant directories
+  preBuild = ''
+    export MAKEOBJDIRPREFIX=$TMP/obj
+  '';
+
+  meta = with lib; {
+    platform = platforms.freebsd;
+    license = licenses.cddl;
+  };
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
index c420d0daf8520..6df6fa740f45e 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
@@ -1,7 +1,10 @@
-{ mkDerivation, lib, stdenv }:
+{
+  mkDerivation,
+  lib,
+  stdenv,
+}:
 mkDerivation {
   path = "lib/libutil";
-  extraPaths = ["lib/libc/gen"];
-  clangFixup = true;
+  extraPaths = [ "lib/libc/gen" ];
   MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libxo.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libxo.nix
new file mode 100644
index 0000000000000..a4882ea1970c3
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libxo.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libxo";
+  extraPaths = [ "contrib/libxo" ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/locale.nix b/pkgs/os-specific/bsd/freebsd/pkgs/locale.nix
new file mode 100644
index 0000000000000..b661a7cee853f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/locale.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, libsbuf }:
+mkDerivation {
+  path = "usr.bin/locale";
+  buildInputs = [ libsbuf ];
+  extraPaths = [ "lib/libc/locale" ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/localedef.nix b/pkgs/os-specific/bsd/freebsd/pkgs/localedef.nix
new file mode 100644
index 0000000000000..2e4902860c8d9
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/localedef.nix
@@ -0,0 +1,39 @@
+{
+  mkDerivation,
+  lib,
+  stdenv,
+  compat,
+  bsdSetupHook,
+  byacc,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+}:
+mkDerivation (
+  {
+    path = "usr.bin/localedef";
+
+    extraPaths = [
+      "lib/libc/locale"
+      "lib/libc/stdtime"
+    ] ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [ "." ];
+
+    nativeBuildInputs = [
+      bsdSetupHook
+      byacc
+      freebsdSetupHook
+      makeMinimal
+      install
+    ];
+
+    buildInputs = [ ];
+
+    preBuild = lib.optionalString (!stdenv.hostPlatform.isFreeBSD) ''
+      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${compat}/include -D__unused= -D__pure= -Wno-strict-aliasing"
+      export NIX_LDFLAGS="$NIX_LDFLAGS -L${compat}/lib"
+    '';
+
+    MK_TESTS = "no";
+  }
+  // lib.optionalAttrs (!stdenv.hostPlatform.isFreeBSD) { BOOTSTRAPPING = 1; }
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/locales.nix b/pkgs/os-specific/bsd/freebsd/pkgs/locales.nix
new file mode 100644
index 0000000000000..d8d3de93d5ec7
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/locales.nix
@@ -0,0 +1,51 @@
+{
+  mkDerivation,
+  lib,
+  symlinkJoin,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  groff,
+  localedef,
+  allLocales ? true,
+  locales ? [ "en_US.UTF-8" ],
+}:
+let
+  build =
+    name: needsLocaledef:
+    mkDerivation {
+      path = "share/${name}";
+
+      extraPaths = lib.optional needsLocaledef "tools/tools/locale/etc/final-maps";
+      nativeBuildInputs = [
+        bsdSetupHook
+        freebsdSetupHook
+        makeMinimal
+        install
+        tsort
+        lorder
+        mandoc
+        groff
+      ] ++ lib.optional needsLocaledef localedef;
+    };
+  directories = {
+    colldef = true;
+    colldef_unicode = true;
+    ctypedef = true;
+    monetdef = false;
+    monetdef_unicode = false;
+    msgdef = false;
+    msgdef_unicode = false;
+    numericdef = false;
+    numericdef_unicode = false;
+    timedef = false;
+  };
+in
+symlinkJoin {
+  name = "freebsd-locales";
+  paths = lib.mapAttrsToList build directories;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix
index d1fd86ab5e463..25e7f491a1c94 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix
@@ -1,8 +1,9 @@
-{ mkDerivation
-, bsdSetupHook, freebsdSetupHook
+{
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
 }:
-
-mkDerivation rec {
+mkDerivation {
   path = "usr.bin/lorder";
   noCC = true;
   dontBuild = true;
@@ -13,8 +14,12 @@ mkDerivation rec {
     mv "lorder.1" "$man/share/man"
   '';
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
+    bsdSetupHook
+    freebsdSetupHook
+  ];
+  buildInputs = [ ];
+  outputs = [
+    "out"
+    "man"
   ];
-  buildInputs = [];
-  outputs = [ "out" "man" ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/make.nix b/pkgs/os-specific/bsd/freebsd/pkgs/make.nix
index fa1722cfec22c..ecf231c304145 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/make.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/make.nix
@@ -1,20 +1,25 @@
-{ lib, mkDerivation, stdenv }:
+{
+  lib,
+  mkDerivation,
+  stdenv,
+}:
 
 mkDerivation {
   path = "contrib/bmake";
   version = "9.2";
-  postPatch = ''
-    # make needs this to pick up our sys make files
-    export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+  postPatch =
+    ''
+      # make needs this to pick up our sys make files
+      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
 
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
-      --replace '-Wl,--fatal-warnings' "" \
-      --replace '-Wl,--warn-shared-textrel' ""
-  '';
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' "" \
+        --replace '-Wl,--warn-shared-textrel' ""
+    '';
   postInstall = ''
     make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
   '';
-  extraPaths = [ "share/mk" ]
-    ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "tools/build/mk";
+  extraPaths = [ "share/mk" ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "tools/build/mk";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix b/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix
index e6a8e38a4acec..069e74474852a 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix
@@ -1,25 +1,32 @@
-{ lib, stdenv, mkDerivation
-, make
-, bsdSetupHook, freebsdSetupHook
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  make,
+  bsdSetupHook,
+  freebsdSetupHook,
 }:
 
-mkDerivation rec {
+mkDerivation {
   inherit (make) path;
 
-  buildInputs = [];
+  buildInputs = [ ];
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
+    bsdSetupHook
+    freebsdSetupHook
   ];
 
   skipIncludesPhase = true;
 
-  makeFlags = [];
+  makeFlags = [ ];
 
   postPatch = ''
     patchShebangs configure
     ${make.postPatch}
   '';
 
+  configureFlags = [ "--with-filemon=no" ];
+
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
index 79428626b8ec2..a085367ac68e6 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -1,78 +1,177 @@
-{ lib, stdenv, stdenvNoCC
-, compatIfNeeded
-, runCommand, rsync
-, freebsd-lib
-, source
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal
-, install, tsort, lorder, mandoc, groff
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  stdenvNoLibs,
+  overrideCC,
+  buildPackages,
+  versionData,
+  writeText,
+  patches,
+  compatIfNeeded,
+  freebsd-lib,
+  filterSource,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  groff,
 }:
 
-lib.makeOverridable (attrs: let
-  stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
-in stdenv'.mkDerivation (rec {
-  pname = "${attrs.pname or (baseNameOf attrs.path)}-freebsd";
-  inherit (freebsd-lib) version;
-  src = runCommand "${pname}-filtered-src" {
-    nativeBuildInputs = [ rsync ];
-  } ''
-    for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [])}; do
-      set -x
-      path="$out/$p"
-      mkdir -p "$(dirname "$path")"
-      src_path="${source}/$p"
-      if [[ -d "$src_path" ]]; then src_path+=/; fi
-      rsync --chmod="+w" -r "$src_path" "$path"
-      set +x
-    done
-  '';
+lib.makeOverridable (
+  attrs:
+  let
+    stdenv' =
+      if attrs.noCC or false then
+        stdenvNoCC
+      else if attrs.noLibc or false then
+        stdenvNoLibs
+      else if attrs.noLibcxx or false then
+        overrideCC stdenv buildPackages.llvmPackages.clangNoLibcxx
+      else
+        stdenv;
+  in
+  stdenv'.mkDerivation (
+    rec {
+      inherit (freebsd-lib) version;
+      pname = "${attrs.pname or (baseNameOf attrs.path)}";
+      src = filterSource {
+        inherit pname;
+        inherit (attrs) path;
+        extraPaths = attrs.extraPaths or [ ];
+      };
 
-  extraPaths = [ ];
+      nativeBuildInputs = [
+        bsdSetupHook
+        freebsdSetupHook
+        makeMinimal
+        install
+        tsort
+        lorder
+        mandoc
+        groff
+      ] ++ attrs.extraNativeBuildInputs or [ ];
+      buildInputs = compatIfNeeded;
 
-  nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal
-    install tsort lorder mandoc groff #statHook
-  ];
-  buildInputs = compatIfNeeded;
+      HOST_SH = stdenv'.shell;
 
-  HOST_SH = stdenv'.shell;
+      makeFlags = [
+        "STRIP=-s" # flag to install, not command
+      ] ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no";
 
-  # Since STRIP below is the flag
-  STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
+      # amd64 not x86_64 for this on unlike NetBSD
+      MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';
 
-  makeFlags = [
-    "STRIP=-s" # flag to install, not command
-  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+      MACHINE = freebsd-lib.mkBsdArch stdenv';
 
-  # amd64 not x86_64 for this on unlike NetBSD
-  MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';
+      MACHINE_CPUARCH = MACHINE_ARCH;
 
-  MACHINE = freebsd-lib.mkBsdArch stdenv';
+      COMPONENT_PATH = attrs.path or null;
 
-  MACHINE_CPUARCH = MACHINE_ARCH;
+      strictDeps = true;
 
-  COMPONENT_PATH = attrs.path or null;
+      meta =
+        with lib;
+        {
+          maintainers = with maintainers; [
+            rhelmot
+            artemist
+          ];
+          platforms = platforms.unix;
+          license = licenses.bsd2;
+        }
+        // attrs.meta or { };
+    }
+    // lib.optionalAttrs stdenv'.hasCC {
+      # TODO should CC wrapper set this?
+      CPP = "${stdenv'.cc.targetPrefix}cpp";
 
-  strictDeps = true;
-
-  meta = with lib; {
-    maintainers = with maintainers; [ ericson2314 ];
-    platforms = platforms.unix;
-    license = licenses.bsd2;
-  };
-} // lib.optionalAttrs stdenv'.hasCC {
-  # TODO should CC wrapper set this?
-  CPP = "${stdenv'.cc.targetPrefix}cpp";
-} // lib.optionalAttrs stdenv'.isDarwin {
-  MKRELRO = "no";
-} // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-  HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-} // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-  HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-} // lib.optionalAttrs (stdenv'.isx86_32) {
-  USE_SSP = "no";
-} // lib.optionalAttrs (attrs.headersOnly or false) {
-  installPhase = "includesPhase";
-  dontBuild = true;
-} // attrs))
+      # Since STRIP in `makeFlags` has to be a flag, not the binary itself
+      STRIPBIN = "${stdenv'.cc.bintools.targetPrefix}strip";
+    }
+    // lib.optionalAttrs stdenv'.isDarwin { MKRELRO = "no"; }
+    // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+      HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+    }
+    // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+      HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+    }
+    // lib.optionalAttrs (stdenv'.isx86_32) { USE_SSP = "no"; }
+    // lib.optionalAttrs (attrs.headersOnly or false) {
+      installPhase = "includesPhase";
+      dontBuild = true;
+    }
+    // attrs
+    // lib.optionalAttrs (stdenv'.hasCC && stdenv'.cc.isClang or false && attrs.clangFixup or true) {
+      preBuild =
+        ''
+          export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -D_VA_LIST -D_VA_LIST_DECLARED -Dva_list=__builtin_va_list -D_SIZE_T_DECLARED -D_SIZE_T -Dsize_t=__SIZE_TYPE__ -D_WCHAR_T"
+        ''
+        + lib.optionalString (versionData.major == 13) ''
+          export NIX_LDFLAGS="$NIX_LDFLAGS --undefined-version"
+        ''
+        + (attrs.preBuild or "");
+    }
+    // {
+      patches =
+        let
+          isDir =
+            file:
+            let
+              base = baseNameOf file;
+              type = (builtins.readDir (dirOf file)).${base} or null;
+            in
+            file == /. || type == "directory";
+          consolidatePatches =
+            patches:
+            if (lib.isDerivation patches) then
+              [ patches ]
+            else if (builtins.isPath patches) then
+              (if (isDir patches) then (lib.filesystem.listFilesRecursive patches) else [ patches ])
+            else if (builtins.isList patches) then
+              (lib.flatten (builtins.map consolidatePatches patches))
+            else
+              throw "Bad patches - must be path or derivation or list thereof";
+          consolidated = consolidatePatches patches;
+          splitPatch =
+            patchFile:
+            let
+              allLines' = lib.strings.splitString "\n" (builtins.readFile patchFile);
+              allLines = builtins.filter (
+                line: !((lib.strings.hasPrefix "diff --git" line) || (lib.strings.hasPrefix "index " line))
+              ) allLines';
+              foldFunc =
+                a: b:
+                if ((lib.strings.hasPrefix "--- " b) || (lib.strings.hasPrefix "diff --git " b)) then
+                  (a ++ [ [ b ] ])
+                else
+                  ((lib.lists.init a) ++ (lib.lists.singleton ((lib.lists.last a) ++ [ b ])));
+              partitionedPatches' = lib.lists.foldl foldFunc [ [ ] ] allLines;
+              partitionedPatches =
+                if (builtins.length partitionedPatches' > 1) then
+                  (lib.lists.drop 1 partitionedPatches')
+                else
+                  (throw "${patchFile} does not seem to be a unified patch (diff -u). this is required for FreeBSD.");
+              filterFunc =
+                patchLines:
+                let
+                  prefixedPath = builtins.elemAt (builtins.split " |\t" (builtins.elemAt patchLines 1)) 2;
+                  unfixedPath = lib.path.subpath.join (lib.lists.drop 1 (lib.path.subpath.components prefixedPath));
+                in
+                lib.lists.any (included: lib.path.hasPrefix (/. + ("/" + included)) (/. + ("/" + unfixedPath))) (
+                  (attrs.extraPaths or [ ]) ++ [ attrs.path ]
+                );
+              filteredLines = builtins.filter filterFunc partitionedPatches;
+              derive = patchLines: writeText "freebsd-patch" (lib.concatLines patchLines);
+              derivedPatches = builtins.map derive filteredLines;
+            in
+            derivedPatches;
+          picked = lib.lists.concatMap splitPatch consolidated;
+        in
+        picked ++ attrs.patches or [ ];
+    }
+  )
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkcsmapper.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkcsmapper.nix
new file mode 100644
index 0000000000000..60cef347446ec
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkcsmapper.nix
@@ -0,0 +1,22 @@
+{
+  stdenv,
+  mkDerivation,
+  byacc,
+  flex,
+}:
+
+mkDerivation {
+  path = "usr.bin/mkcsmapper";
+
+  extraPaths = [
+    "lib/libc/iconv"
+    "lib/libiconv_modules/mapper_std"
+  ];
+
+  BOOTSTRAPPING = !stdenv.hostPlatform.isFreeBSD;
+
+  extraNativeBuildInputs = [
+    byacc
+    flex
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkesdb.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkesdb.nix
new file mode 100644
index 0000000000000..a503af529f274
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkesdb.nix
@@ -0,0 +1,19 @@
+{
+  stdenv,
+  mkDerivation,
+  byacc,
+  flex,
+}:
+
+mkDerivation {
+  path = "usr.bin/mkesdb";
+
+  extraPaths = [ "lib/libc/iconv" ];
+
+  BOOTSTRAPPING = !stdenv.hostPlatform.isFreeBSD;
+
+  extraNativeBuildInputs = [
+    byacc
+    flex
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix
index 56dff7d606bd9..bf7d8b7db689b 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix
@@ -1,5 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "sbin/mknod";
-}
+mkDerivation { path = "sbin/mknod"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
index 23a4672069e6a..bbcaff3a1c6a8 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
@@ -1,6 +1,39 @@
-{ mkDerivation, mknod }:
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  compatIfNeeded,
+  compatIsNeeded,
+  libmd,
+  libnetbsd,
+  libutil,
+}:
 
 mkDerivation {
   path = "contrib/mtree";
-  extraPaths = [ mknod.path ];
+  extraPaths = [ "contrib/mknod" ];
+  buildInputs =
+    compatIfNeeded
+    ++ [
+      libmd
+      libnetbsd
+    ]
+    ++ lib.optional (stdenv.isFreeBSD) libutil;
+
+  postPatch = ''
+    ln -s $BSDSRCDIR/contrib/mknod/*.c $BSDSRCDIR/contrib/mknod/*.h $BSDSRCDIR/contrib/mtree
+  '';
+
+  preBuild = ''
+    export NIX_LDFLAGS="$NIX_LDFLAGS ${
+      toString (
+        [
+          "-lmd"
+          "-lnetbsd"
+        ]
+        ++ lib.optional compatIsNeeded "-legacy"
+        ++ lib.optional stdenv.isFreeBSD "-lutil"
+      )
+    }"
+  '';
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
index 56141255af5e1..e187cacbb0d05 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
@@ -1,6 +1,11 @@
-{ lib, mkDerivation, stdenv }:
+{
+  lib,
+  mkDerivation,
+  stdenv,
+  patchesRoot,
+}:
 
-mkDerivation rec {
+mkDerivation {
   path = "usr.bin/rpcgen";
   patches = lib.optionals (stdenv.hostPlatform.libc == "glibc") [
     # `WUNTRACED` is defined privately `bits/waitflags.h` in glibc.
@@ -12,7 +17,7 @@ mkDerivation rec {
     # those headers ends up included other headers...which ends up
     # including the other one, this means by the first time we reach
     # `#include `<bits/waitflags.h>`, both `_SYS_WAIT_H` and
-    # `_STDLIB_H` are already defined! Thus, we never ned up including
+    # `_STDLIB_H` are already defined! Thus, we never end up including
     # `<bits/waitflags.h>` and defining `WUNTRACED`.
     #
     # This hacks around this by manually including `WUNTRACED` until
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix
index 07b55afe133fc..ec5bfee17d2c1 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix
@@ -1,7 +1,6 @@
-{ mkDerivation, source }:
+{ mkDerivation }:
 
 mkDerivation {
   path = "usr.bin/sed";
-  TESTSRC = "${source}/contrib/netbsd-tests";
   MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/source.nix b/pkgs/os-specific/bsd/freebsd/pkgs/source.nix
index 5e31f900e8216..c14d26559047b 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/source.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/source.nix
@@ -4,7 +4,6 @@
 # If you want you could fetchgit from "https://git.FreeBSD.org/src.git" instead.
 # The update script still pulls directly from git.freebsd.org
 fetchFromGitHub {
-  name = "src"; # Want to rename this next rebuild
   owner = "freebsd";
   repo = "freebsd-src";
   inherit (sourceData) rev hash;
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
index c730f00869f8e..a801ab895441c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
@@ -1,13 +1,22 @@
-{ mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
+{
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
 }:
 
 # Don't add this to nativeBuildInputs directly.  Use statHook instead.
 mkDerivation {
   path = "usr.bin/stat";
   nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    install
+    mandoc
+    groff
   ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix b/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix
index 07129938b0953..4609c004e6f51 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix
@@ -1,12 +1,16 @@
-{ makeSetupHook, writeText, stat }:
+{
+  makeSetupHook,
+  writeText,
+  stat,
+}:
 
 # stat isn't in POSIX, and NetBSD stat supports a completely
 # different range of flags than GNU stat, so including it in PATH
 # breaks stdenv.  Work around that with a hook that will point
 # NetBSD's build system and NetBSD stat without including it in
 # PATH.
-makeSetupHook {
-  name = "netbsd-stat-hook";
-} (writeText "netbsd-stat-hook-impl" ''
-  makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
-'')
+makeSetupHook { name = "netbsd-stat-hook"; } (
+  writeText "netbsd-stat-hook-impl" ''
+    makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
+  ''
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
index 81cf4114e8737..86f847cbd45cf 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
@@ -1,67 +1,85 @@
-{ lib, stdenv, mkDerivation, freebsd-lib
-, buildPackages
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
-, config, rpcgen, file2c, gawk, uudecode, xargs-j #, ctfconvert
+{
+  stdenv,
+  mkDerivation,
+  freebsd-lib,
+  buildPackages,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  config,
+  rpcgen,
+  file2c,
+  gawk,
+  uudecode,
+  xargs-j,
 }:
 
-mkDerivation (let
-  cfg = "MINIMAL";
-in rec {
-  path = "sys";
-
-  nativeBuildInputs = [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
-
-    config rpcgen file2c gawk uudecode xargs-j
-    #ctfconvert
-  ];
-
-  patches = [
-    ./sys-gnu-date.patch
-    ./sys-no-explicit-intrinsics-dep.patch
-  ];
-
-  # --dynamic-linker /red/herring is used when building the kernel.
-  NIX_ENFORCE_PURITY = 0;
-
-  AWK = "${buildPackages.gawk}/bin/awk";
-
-  CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
-
-  MK_CTF = "no";
-
-  KODIR = "${builtins.placeholder "out"}/kernel";
-  KMODDIR = "${builtins.placeholder "out"}/kernel";
-  DTBDIR = "${builtins.placeholder"out"}/dbt";
-
-  KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
-  KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
-  KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
-
-  skipIncludesPhase = true;
-
-  configurePhase = ''
-    runHook preConfigure
-
-    for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
-      substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
-    done
-
-    for f in conf/*.mk; do
-      substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
-    done
-
-    cd ${freebsd-lib.mkBsdArch stdenv}/conf
-    sed -i ${cfg} \
-      -e 's/WITH_CTF=1/WITH_CTF=0/' \
-      -e '/KDTRACE/d'
-    config ${cfg}
-
-    runHook postConfigure
-  '';
-  preBuild = ''
-    cd ../compile/${cfg}
-  '';
-})
+mkDerivation (
+  let
+    cfg = "MINIMAL";
+  in
+  rec {
+    path = "sys";
+
+    nativeBuildInputs = [
+      bsdSetupHook
+      freebsdSetupHook
+      makeMinimal
+      install
+      mandoc
+      groff
+
+      config
+      rpcgen
+      file2c
+      gawk
+      uudecode
+      xargs-j
+    ];
+
+    # --dynamic-linker /red/herring is used when building the kernel.
+    NIX_ENFORCE_PURITY = 0;
+
+    AWK = "${buildPackages.gawk}/bin/awk";
+
+    CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
+
+    MK_CTF = "no";
+
+    KODIR = "${builtins.placeholder "out"}/kernel";
+    KMODDIR = "${builtins.placeholder "out"}/kernel";
+    DTBDIR = "${builtins.placeholder "out"}/dbt";
+
+    KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
+    KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
+    KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+
+    skipIncludesPhase = true;
+
+    configurePhase = ''
+      runHook preConfigure
+
+      for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
+        substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
+      done
+
+      for f in conf/*.mk; do
+        substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
+      done
+
+      cd ${freebsd-lib.mkBsdArch stdenv}/conf
+      sed -i ${cfg} \
+        -e 's/WITH_CTF=1/WITH_CTF=0/' \
+        -e '/KDTRACE/d'
+      config ${cfg}
+
+      runHook postConfigure
+    '';
+    preBuild = ''
+      cd ../compile/${cfg}
+    '';
+  }
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix b/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix
index cdc1b27ce8fed..04a45ff980cba 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix
@@ -1,12 +1,28 @@
-{ mkDerivation
-, bsdSetupHook, freebsdSetupHook
-, makeMinimal, install, mandoc, groff
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  freebsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
 }:
 
 mkDerivation {
   path = "usr.bin/tsort";
-  nativeBuildInputs =  [
-    bsdSetupHook freebsdSetupHook
-    makeMinimal install mandoc groff
+  extraPaths = [ ];
+  outputs = [ "out" ];
+  MK_TESTS = "no";
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook
+    freebsdSetupHook
+    makeMinimal
+    install
+    mandoc
+    groff
   ];
 }
diff --git a/pkgs/os-specific/bsd/freebsd/update.py b/pkgs/os-specific/bsd/freebsd/update.py
index cd20f67148fa7..533a871a4b04d 100755
--- a/pkgs/os-specific/bsd/freebsd/update.py
+++ b/pkgs/os-specific/bsd/freebsd/update.py
@@ -16,6 +16,7 @@ import typing
 import urllib.request
 
 _QUERY_VERSION_PATTERN = re.compile('^([A-Z]+)="(.+)"$')
+_RELEASE_PATCH_PATTERN = re.compile('^RELEASE-p([0-9]+)$')
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 MIN_VERSION = packaging.version.Version("13.0.0")
 MAIN_BRANCH = "main"
@@ -60,7 +61,16 @@ def query_version(repo: git.Repo) -> dict[str, typing.Any]:
             continue
         fields[m[1].lower()] = m[2]
 
-    fields["major"] = packaging.version.parse(fields["revision"]).major
+    parsed = packaging.version.parse(fields["revision"])
+    fields["major"] = parsed.major
+    fields["minor"] = parsed.minor
+
+    # Extract the patch number from `RELAESE-p<patch>`, which is used
+    # e.g. in the "releng" branches.
+    m = _RELEASE_PATCH_PATTERN.match(fields["branch"])
+    if m is not None:
+        fields["patch"] = m[1]
+
     return fields
 
 
@@ -95,7 +105,7 @@ def handle_commit(
         "ref": ref_name,
         "refType": ref_type,
         "supported": ref_name in supported_refs,
-        "version": query_version(repo),
+        "version": version,
     }
 
 
@@ -151,6 +161,14 @@ def main() -> None:
         result = handle_commit(
             repo, tag.commit, tag.name, "tag", supported_refs, old_versions
         )
+
+        # Hack in the patch version from parsing the tag, if we didn't
+        # get one from the "branch" field (from newvers). This is
+        # probably 0.
+        versionObj = result["version"]
+        if "patch" not in versionObj:
+            versionObj["patch"] = version.micro
+
         versions[tag.name] = result
 
     for branch in repo.remote("origin").refs:
diff --git a/pkgs/os-specific/bsd/freebsd/versions.json b/pkgs/os-specific/bsd/freebsd/versions.json
index 736c4c3a3e3c1..3f781b4eeaf23 100644
--- a/pkgs/os-specific/bsd/freebsd/versions.json
+++ b/pkgs/os-specific/bsd/freebsd/versions.json
@@ -1,14 +1,15 @@
 {
   "main": {
-    "hash": "sha256-C5ucT9BK/eK8a9HNSDDi8S1uhpPmiqV22XEooxAqbPw=",
+    "hash": "sha256-3aUsD2yRqVvb12z2XPmhE5/u4d9bqyD2ZHH3xNmwYwU=",
     "ref": "main",
     "refType": "branch",
-    "rev": "125c4560bc70971b950d035cfcd2255b89984011",
+    "rev": "aa34b1d20e44141749ffdecf16908fc1e5db4db6",
     "supported": false,
     "version": {
       "branch": "CURRENT",
       "major": 15,
-      "reldate": "1500017",
+      "minor": 0,
+      "reldate": "1500018",
       "release": "15.0-CURRENT",
       "revision": "15.0",
       "type": "FreeBSD",
@@ -24,6 +25,8 @@
     "version": {
       "branch": "RELEASE",
       "major": 13,
+      "minor": 0,
+      "patch": 0,
       "reldate": "1300139",
       "release": "13.0-RELEASE",
       "revision": "13.0",
@@ -40,6 +43,8 @@
     "version": {
       "branch": "RELEASE",
       "major": 13,
+      "minor": 1,
+      "patch": 0,
       "reldate": "1301000",
       "release": "13.1-RELEASE",
       "revision": "13.1",
@@ -56,6 +61,8 @@
     "version": {
       "branch": "RELEASE",
       "major": 13,
+      "minor": 2,
+      "patch": 0,
       "reldate": "1302001",
       "release": "13.2-RELEASE",
       "revision": "13.2",
@@ -72,6 +79,8 @@
     "version": {
       "branch": "RELEASE",
       "major": 13,
+      "minor": 3,
+      "patch": 0,
       "reldate": "1303001",
       "release": "13.3-RELEASE",
       "revision": "13.3",
@@ -88,6 +97,8 @@
     "version": {
       "branch": "RELEASE",
       "major": 14,
+      "minor": 0,
+      "patch": 0,
       "reldate": "1400097",
       "release": "14.0-RELEASE",
       "revision": "14.0",
@@ -104,6 +115,8 @@
     "version": {
       "branch": "RELEASE-p13",
       "major": 13,
+      "minor": 0,
+      "patch": "13",
       "reldate": "1300139",
       "release": "13.0-RELEASE-p13",
       "revision": "13.0",
@@ -120,6 +133,8 @@
     "version": {
       "branch": "RELEASE-p9",
       "major": 13,
+      "minor": 1,
+      "patch": "9",
       "reldate": "1301000",
       "release": "13.1-RELEASE-p9",
       "revision": "13.1",
@@ -136,6 +151,8 @@
     "version": {
       "branch": "RELEASE-p11",
       "major": 13,
+      "minor": 2,
+      "patch": "11",
       "reldate": "1302001",
       "release": "13.2-RELEASE-p11",
       "revision": "13.2",
@@ -144,19 +161,21 @@
     }
   },
   "releng/13.3": {
-    "hash": "sha256-huzUiMZHfyK/mgLD3hW+DaSGgAaTUIuM51xDp+IE3qE=",
+    "hash": "sha256-g3i9q9XihesdfQxGy3oC7IMGtbWaLNwFlNzbdvS/4ng=",
     "ref": "releng/13.3",
     "refType": "branch",
-    "rev": "7a0d63c9093222938f26cd63ff742e555168de77",
+    "rev": "be4f1894ef399f421bab451e8cf8557e27e5a948",
     "supported": true,
     "version": {
-      "branch": "RELEASE-p1",
+      "branch": "RELEASE-p2",
       "major": 13,
+      "minor": 3,
+      "patch": "2",
       "reldate": "1303001",
-      "release": "13.3-RELEASE-p1",
+      "release": "13.3-RELEASE-p2",
       "revision": "13.3",
       "type": "FreeBSD",
-      "version": "FreeBSD 13.3-RELEASE-p1"
+      "version": "FreeBSD 13.3-RELEASE-p2"
     }
   },
   "releng/14.0": {
@@ -168,6 +187,8 @@
     "version": {
       "branch": "RELEASE-p6",
       "major": 14,
+      "minor": 0,
+      "patch": "6",
       "reldate": "1400097",
       "release": "14.0-RELEASE-p6",
       "revision": "14.0",
@@ -176,15 +197,16 @@
     }
   },
   "stable/13": {
-    "hash": "sha256-XateLKKs2A/HCP9Lx/nBm1cybB3otrbeXQvyCL40S0M=",
+    "hash": "sha256-ItC8haDdxMSZt1thpCrn8p0xxvs7Uqh/uNo1OwMalj8=",
     "ref": "stable/13",
     "refType": "branch",
-    "rev": "e0a58ef24a3baf5ed4cc09a798b9fe2d85408052",
+    "rev": "825cb4c850f2b97cfd1b24ed421d7938bf37eee7",
     "supported": true,
     "version": {
       "branch": "STABLE",
       "major": 13,
-      "reldate": "1303502",
+      "minor": 3,
+      "reldate": "1303503",
       "release": "13.3-STABLE",
       "revision": "13.3",
       "type": "FreeBSD",
@@ -192,19 +214,20 @@
     }
   },
   "stable/14": {
-    "hash": "sha256-tIKnK/SYBDk9UnE5AfhjeDpqHnzspYbor0678ye/mrs=",
+    "hash": "sha256-iAj75IXJi4Oium6BqFvsyQipDP2crBZIGg0Dac8Zf1g=",
     "ref": "stable/14",
     "refType": "branch",
-    "rev": "ab872ab0bf195e872ed8d955aab3b2a537a230cd",
+    "rev": "a3b8266f5420601e231bc08c5402d9a4929fbdc0",
     "supported": true,
     "version": {
-      "branch": "STABLE",
+      "branch": "PRERELEASE",
       "major": 14,
-      "reldate": "1400510",
-      "release": "14.0-STABLE",
-      "revision": "14.0",
+      "minor": 1,
+      "reldate": "1400511",
+      "release": "14.1-PRERELEASE",
+      "revision": "14.1",
       "type": "FreeBSD",
-      "version": "FreeBSD 14.0-STABLE"
+      "version": "FreeBSD 14.1-PRERELEASE"
     }
   }
 }
diff --git a/pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh b/pkgs/os-specific/bsd/lib/install-wrapper.sh
index 91a7a2679f209..97a2aaab22c0e 100644
--- a/pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh
+++ b/pkgs/os-specific/bsd/lib/install-wrapper.sh
@@ -14,7 +14,6 @@ while (( $# )); do
   case $1 in
     -C) ;;
     -o | -g) shift ;;
-    -s) ;;
     -m | -l)
       # handle next arg so not counted as path arg
       args+=("$1" "$2")
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index fd5e24aa7102a..eeccd0fa07eab 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,137 +1,181 @@
-{ stdenv, lib, stdenvNoCC
-, makeScopeWithSplicing', generateSplicesForMkScope
-, buildPackages
-, fetchcvs
+{
+  lib,
+  crossLibcStdenv,
+  stdenvNoCC,
+  makeScopeWithSplicing',
+  generateSplicesForMkScope,
+  buildPackages,
+  fetchcvs,
 }:
 
-makeScopeWithSplicing' {
+let
   otherSplices = generateSplicesForMkScope "netbsd";
-  f = (self: lib.packagesFromDirectoryRecursive {
-    callPackage = self.callPackage;
-    directory = ./pkgs;
-  } // (let inherit (self) mkDerivation; in {
-
-    fetchNetBSD = path: version: sha256: fetchcvs {
-      cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
-      module = "src/${path}";
-      inherit sha256;
-      tag = "netbsd-${lib.replaceStrings ["."] ["-"] version}-RELEASE";
-    };
-
-    defaultMakeFlags = [
-      "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
-        then "yes"
-        else "no"}"
-    ];
-
-    compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
-
-    # The manual callPackages below should in principle be unnecessary because
-    # they're just selecting arguments that would be selected anyway. However,
-    # if we don't perform these manual calls, we get infinite recursion issues
-    # because of the splices.
-
-    mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
-      inherit stdenv stdenvNoCC;
-      inherit (buildPackages.netbsd) netbsdSetupHook makeMinimal install tsort lorder;
-      inherit (buildPackages) mandoc;
-      inherit (buildPackages.buildPackages) rsync;
-
-    };
-
-    makeMinimal = self.callPackage ./pkgs/makeMinimal.nix {
-      inherit (self) make;
-    };
-
-    compat = self.callPackage ./pkgs/compat/package.nix {
-      inherit (buildPackages) coreutils;
-      inherit (buildPackages.darwin) cctools-port;
-      inherit (buildPackages.buildPackages) rsync;
-      inherit (buildPackages.netbsd) makeMinimal;
-      inherit (self) install include libc libutil;
-    };
-
-    install = self.callPackage ./pkgs/install/package.nix {
-      inherit (self) fts mtree make compatIfNeeded;
-      inherit (buildPackages.buildPackages) rsync;
-      inherit (buildPackages.netbsd) makeMinimal;
-    };
-
-    # See note in pkgs/stat/package.nix
-    stat = self.callPackage ./pkgs/stat/package.nix {
-      inherit (buildPackages.netbsd) makeMinimal install;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    # See note in pkgs/stat/hook.nix
-    statHook = self.callPackage ./pkgs/stat/hook.nix {
-      inherit (self) stat;
-    };
-
-    tsort = self.callPackage ./pkgs/tsort.nix {
-      inherit (buildPackages.netbsd) makeMinimal install;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    lorder = self.callPackage ./pkgs/lorder.nix {
-      inherit (buildPackages.netbsd) makeMinimal install;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    config = self.callPackage ./pkgs/config.nix {
-      inherit (buildPackages.netbsd) makeMinimal install;
-      inherit (buildPackages.buildPackages) rsync;
-      inherit (self) cksum;
-    };
-
-    include = self.callPackage ./pkgs/include.nix {
-      inherit (buildPackages.netbsd)
-        makeMinimal install nbperf rpcgen;
-      inherit (buildPackages) stdenv;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    sys-headers = self.callPackage ./pkgs/sys/headers.nix {
-      inherit (buildPackages.netbsd)
-        makeMinimal install tsort lorder statHook uudecode config genassym;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    libutil = self.callPackage ./pkgs/libutil.nix {
-      inherit (self) libc sys;
-    };
-
-    libpthread-headers = self.callPackage ./pkgs/libpthread/headers.nix { };
-
-    csu = self.callPackage ./pkgs/csu.nix {
-      inherit (self) headers sys ld_elf_so;
-      inherit (buildPackages.netbsd)
-        netbsdSetupHook
-        makeMinimal
-        install
-        genassym gencat lorder tsort statHook;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    _mainLibcExtraPaths = with self; [
-        common i18n_module.src sys.src
-        ld_elf_so.src libpthread.src libm.src libresolv.src
-        librpcsvc.src libutil.src librt.src libcrypt.src
-    ];
-
-    libc = self.callPackage ./pkgs/libc.nix {
-      inherit (self) headers csu librt;
-      inherit (buildPackages.netbsd)
-        netbsdSetupHook
-        makeMinimal
-        install
-        genassym gencat lorder tsort statHook rpcgen;
-      inherit (buildPackages.buildPackages) rsync;
-    };
-
-    mtree = self.callPackage ./pkgs/mtree.nix {
-      inherit (self) mknod;
-    };
-
-  }));
+  buildNetbsd = otherSplices.selfBuildHost;
+in
+
+makeScopeWithSplicing' {
+  inherit otherSplices;
+  f = (
+    self:
+    lib.packagesFromDirectoryRecursive {
+      callPackage = self.callPackage;
+      directory = ./pkgs;
+    }
+    // {
+      version = "9.2";
+
+      defaultMakeFlags = [
+        "MKSOFTFLOAT=${
+          if
+            stdenvNoCC.hostPlatform.gcc.float or (stdenvNoCC.hostPlatform.parsed.abi.float or "hard") == "soft"
+          then
+            "yes"
+          else
+            "no"
+        }"
+      ];
+
+      compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
+
+      stdenvLibcMinimal = crossLibcStdenv.override (old: {
+        cc = old.cc.override {
+          libc = self.libcMinimal;
+          bintools = old.cc.bintools.override {
+            libc = self.libcMinimal;
+            sharedLibraryLoader = null;
+          };
+        };
+      });
+
+      # The manual callPackages below should in principle be unnecessary because
+      # they're just selecting arguments that would be selected anyway. However,
+      # if we don't perform these manual calls, we get infinite recursion issues
+      # because of the splices.
+
+      compat = self.callPackage ./pkgs/compat/package.nix {
+        inherit (buildPackages) coreutils;
+        inherit (buildPackages.darwin) cctools-port;
+        inherit (buildNetbsd) makeMinimal;
+        inherit (self) install;
+      };
+
+      config = self.callPackage ./pkgs/config.nix {
+        inherit (buildNetbsd) makeMinimal install;
+        inherit (self) cksum;
+      };
+
+      csu = self.callPackage ./pkgs/csu.nix {
+        inherit (self) headers sys-headers ld_elf_so;
+        inherit (buildNetbsd)
+          netbsdSetupHook
+          makeMinimal
+          install
+          genassym
+          gencat
+          lorder
+          tsort
+          statHook
+          ;
+      };
+
+      include = self.callPackage ./pkgs/include.nix {
+        inherit (buildNetbsd)
+          makeMinimal
+          install
+          nbperf
+          rpcgen
+          ;
+        inherit (buildPackages) stdenv;
+      };
+
+      install = self.callPackage ./pkgs/install/package.nix {
+        inherit (self)
+          fts
+          mtree
+          make
+          compatIfNeeded
+          ;
+        inherit (buildNetbsd) makeMinimal;
+      };
+
+      libcMinimal = self.callPackage ./pkgs/libcMinimal.nix {
+        inherit (self) headers csu;
+        inherit (buildNetbsd)
+          netbsdSetupHook
+          makeMinimal
+          install
+          genassym
+          gencat
+          lorder
+          tsort
+          statHook
+          rpcgen
+          ;
+      };
+
+      libpthread-headers = self.callPackage ./pkgs/libpthread/headers.nix { };
+
+      librpcsvc = self.callPackage ./pkgs/librpcsvc.nix {
+        inherit (buildNetbsd)
+          netbsdSetupHook
+          makeMinimal
+          install
+          lorder
+          tsort
+          statHook
+          rpcgen
+          ;
+      };
+
+      libutil = self.callPackage ./pkgs/libutil.nix {
+        inherit (buildNetbsd)
+          netbsdSetupHook
+          makeMinimal
+          install
+          lorder
+          tsort
+          statHook
+          ;
+      };
+
+      lorder = self.callPackage ./pkgs/lorder.nix { inherit (buildNetbsd) makeMinimal install; };
+
+      mtree = self.callPackage ./pkgs/mtree.nix { inherit (self) mknod; };
+
+      mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+        inherit (buildNetbsd)
+          netbsdSetupHook
+          makeMinimal
+          install
+          tsort
+          lorder
+          ;
+        inherit (buildPackages) mandoc;
+        inherit (buildPackages.buildPackages) rsync;
+      };
+
+      makeMinimal = self.callPackage ./pkgs/makeMinimal.nix { inherit (self) make; };
+
+      # See note in pkgs/stat/package.nix
+      stat = self.callPackage ./pkgs/stat/package.nix { inherit (buildNetbsd) makeMinimal install; };
+
+      # See note in pkgs/stat/hook.nix
+      statHook = self.callPackage ./pkgs/stat/hook.nix { inherit (self) stat; };
+
+      sys-headers = self.callPackage ./pkgs/sys/headers.nix {
+        inherit (buildNetbsd)
+          makeMinimal
+          install
+          tsort
+          lorder
+          statHook
+          uudecode
+          config
+          genassym
+          ;
+      };
+
+      tsort = self.callPackage ./pkgs/tsort.nix { inherit (buildNetbsd) makeMinimal install; };
+    }
+  );
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
index a2ec387501ae1..a95df55874e42 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
@@ -2,7 +2,5 @@
 
 mkDerivation {
   path = "usr.bin/cksum";
-  version = "9.2";
-  sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/column.nix b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
index f3cebfa9ab261..a51369433f6c2 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/column";
-  version = "9.2";
-  sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
-}
+mkDerivation { path = "usr.bin/column"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/common.nix b/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
deleted file mode 100644
index 464fc1c9e0c26..0000000000000
--- a/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{ fetchNetBSD }:
-
-fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9"
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
index 3aadabe508822..086dd62303e96 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
@@ -1,7 +1,7 @@
 prefix=@out@
 exec_prefix=${prefix}
 libdir=${exec_prefix}/lib
-includedir=${prefix}/include
+includedir=@includedir@
 
 Name: nbcompat
 Description: NetBSD compatibility framework
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
index a1336ad52f6dc..0f7483ce55ad1 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
@@ -1,24 +1,29 @@
-{ lib, mkDerivation, stdenv
-, zlib
-, defaultMakeFlags
-, coreutils
-, cctools-port
-, include, libc, libutil
-, install
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, rsync
-, fetchNetBSD
-, _mainLibcExtraPaths
+{
+  lib,
+  mkDerivation,
+  stdenv,
+  zlib,
+  defaultMakeFlags,
+  coreutils,
+  cctools-port,
+  install,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  version,
 }:
 
-mkDerivation (let
-    version = "9.2";
+mkDerivation (
+  let
     commonDeps = [ zlib ];
-  in {
+  in
+  {
     path = "tools/compat";
-    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
-    inherit version;
+
+    outputs = [
+      "out"
+      "dev"
+    ];
 
     setupHooks = [
       ../../../../../build-support/setup-hooks/role.bash
@@ -29,43 +34,51 @@ mkDerivation (let
       make include/.stamp configure nbtool_config.h.in defs.mk.in
     '';
 
-    configurePlatforms = [ "build" "host" ];
-    configureFlags = [
-      "--cache-file=config.cache"
-    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-      # We include this header in our musl package only for legacy
-      # compatibility, and compat works fine without it (and having it
-      # know about sys/cdefs.h breaks packages like glib when built
-      # statically).
-      "ac_cv_header_sys_cdefs_h=no"
+    configurePlatforms = [
+      "build"
+      "host"
     ];
+    configureFlags =
+      [ "--cache-file=config.cache" ]
+      ++ lib.optionals stdenv.hostPlatform.isMusl [
+        # We include this header in our musl package only for legacy
+        # compatibility, and compat works fine without it (and having it
+        # know about sys/cdefs.h breaks packages like glib when built
+        # statically).
+        "ac_cv_header_sys_cdefs_h=no"
+      ];
 
     nativeBuildInputs = commonDeps ++ [
-      bsdSetupHook netbsdSetupHook
+      bsdSetupHook
+      netbsdSetupHook
       makeMinimal
-      rsync
     ];
 
     buildInputs = commonDeps;
 
     # temporarily use gnuinstall for bootstrapping
     # bsdinstall will be built later
-    makeFlags = defaultMakeFlags ++ [
-      "INSTALL=${coreutils}/bin/install"
-      "DATADIR=$(out)/share"
-      # Can't sort object files yet
-      "LORDER=echo"
-      "TSORT=cat"
-      # Can't process man pages yet
-      "MKSHARE=no"
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # GNU objcopy produces broken .a libs which won't link into dependers.
-      # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
-      "OBJCOPY=${cctools-port}/bin/strip"
-    ];
+    makeFlags =
+      defaultMakeFlags
+      ++ [
+        "INSTALL=${coreutils}/bin/install"
+        "DATADIR=$(dev)/share"
+        # Can't sort object files yet
+        "LORDER=echo"
+        "TSORT=cat"
+        # Can't process man pages yet
+        "MKSHARE=no"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        # GNU objcopy produces broken .a libs which won't link into dependers.
+        # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
+        "OBJCOPY=${cctools-port}/bin/strip"
+      ];
     RENAME = "-D";
 
-    passthru.tests = { netbsd-install = install; };
+    passthru.tests = {
+      netbsd-install = install;
+    };
 
     patches = [
       ./compat-cxx-safe-header.patch
@@ -79,42 +92,50 @@ mkDerivation (let
       makeFlagsArray+=('INSTALL_SYMLINK=''${INSTALL} ''${SYMLINK} ''${RENAME}')
     '';
 
-    postInstall = ''
-      # why aren't these installed by netbsd?
-      install -D compat_defs.h $out/include/compat_defs.h
-      install -D $BSDSRCDIR/include/cdbw.h $out/include/cdbw.h
-      install -D $BSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
-      install -D $BSDSRCDIR/sys/sys/featuretest.h \
-                 $out/include/sys/featuretest.h
-      install -D $BSDSRCDIR/sys/sys/md5.h $out/include/md5.h
-      install -D $BSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
-      install -D $BSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
-      install -D $BSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
-      install -D $BSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
-      install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
-      install -D $BSDSRCDIR/include/db.h $out/include/db.h
-      install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
-      install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
-      install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
-      install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
-      install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
-      install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
+    postInstall =
+      ''
+        # why aren't these installed by netbsd?
+        install -D compat_defs.h $dev/include/compat_defs.h
+        install -D $BSDSRCDIR/include/cdbw.h $dev/include/cdbw.h
+        install -D $BSDSRCDIR/sys/sys/cdbr.h $dev/include/cdbr.h
+        install -D $BSDSRCDIR/sys/sys/featuretest.h \
+                   $dev/include/sys/featuretest.h
+        install -D $BSDSRCDIR/sys/sys/md5.h $dev/include/md5.h
+        install -D $BSDSRCDIR/sys/sys/rmd160.h $dev/include/rmd160.h
+        install -D $BSDSRCDIR/sys/sys/sha1.h $dev/include/sha1.h
+        install -D $BSDSRCDIR/sys/sys/sha2.h $dev/include/sha2.h
+        install -D $BSDSRCDIR/sys/sys/queue.h $dev/include/sys/queue.h
+        install -D $BSDSRCDIR/include/vis.h $dev/include/vis.h
+        install -D $BSDSRCDIR/include/db.h $dev/include/db.h
+        install -D $BSDSRCDIR/include/netconfig.h $dev/include/netconfig.h
+        install -D $BSDSRCDIR/include/utmpx.h $dev/include/utmpx.h
+        install -D $BSDSRCDIR/include/tzfile.h $dev/include/tzfile.h
+        install -D $BSDSRCDIR/sys/sys/tree.h $dev/include/sys/tree.h
+        install -D $BSDSRCDIR/include/nl_types.h $dev/include/nl_types.h
+        install -D $BSDSRCDIR/include/stringlist.h $dev/include/stringlist.h
 
-      # Collapse includes slightly to fix dangling reference
-      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
-      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
-   '' + lib.optionalString stdenv.isDarwin ''
-      mkdir -p $out/include/ssp
-      touch $out/include/ssp/ssp.h
-   '' + ''
-      mkdir -p $out/lib/pkgconfig
-      substitute ${./libbsd-overlay.pc} $out/lib/pkgconfig/libbsd-overlay.pc \
-        --subst-var-by out $out \
-        --subst-var-by version ${version}
-    '';
-    extraPaths = [ include.src libc.src libutil.src
-      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
-      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
-      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
-    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
-  })
+        # Collapse includes slightly to fix dangling reference
+        install -D $BSDSRCDIR/common/include/rpc/types.h $dev/include/rpc/types.h
+        sed -i '1s;^;#include "nbtool_config.h"\n;' $dev/include/rpc/types.h
+      ''
+      + lib.optionalString stdenv.isDarwin ''
+        mkdir -p $dev/include/ssp
+        touch $dev/include/ssp/ssp.h
+      ''
+      + ''
+        mkdir -p $dev/lib/pkgconfig
+        substitute ${./libbsd-overlay.pc} $dev/lib/pkgconfig/libbsd-overlay.pc \
+          --subst-var-by out "$out" \
+          --subst-var-by includedir "$dev/include" \
+          --subst-var-by version ${version}
+      '';
+    extraPaths = [
+      "common"
+      "include"
+      "lib/libc"
+      "lib/libutil"
+      "external/bsd/flex"
+      "sys/sys"
+    ];
+  }
+)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/config.nix b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
index 277d70129e6f7..94a014a189cf4 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
@@ -1,18 +1,27 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal, install, mandoc, byacc, flex, rsync
-, compatIfNeeded
-, cksum
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  byacc,
+  flex,
+  compatIfNeeded,
+  cksum,
 }:
 mkDerivation {
   path = "usr.bin/config";
-  version = "9.2";
-  sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
   env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
-    makeMinimal install mandoc byacc flex rsync
+    bsdSetupHook
+    netbsdSetupHook
+    makeMinimal
+    install
+    mandoc
+    byacc
+    flex
   ];
   buildInputs = compatIfNeeded;
-  extraPaths = [ cksum.src ];
+  extraPaths = [ cksum.path ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
index 2d13ced6d5ed5..c6e0de8edd117 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
@@ -1,24 +1,46 @@
-{ lib, mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, flex
-, byacc, genassym, gencat, lorder, tsort, statHook, rsync
-, headers
-, sys
-, ld_elf_so
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  flex,
+  byacc,
+  genassym,
+  gencat,
+  lorder,
+  tsort,
+  statHook,
+  headers,
+  sys-headers,
+  ld_elf_so,
 }:
 
 mkDerivation {
+  noLibc = true;
   path = "lib/csu";
-  version = "9.2";
-  sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
   meta.platforms = lib.platforms.netbsd;
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff flex
-    byacc genassym gencat lorder tsort statHook rsync
+    install
+    mandoc
+    groff
+    flex
+    byacc
+    genassym
+    gencat
+    lorder
+    tsort
+    statHook
   ];
   buildInputs = [ headers ];
-  extraPaths = [ sys.src ld_elf_so.src ];
+  extraPaths = [
+    sys-headers.path
+    ld_elf_so.path
+  ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
index 0d7d026dd21d2..8d27f29a75e57 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
@@ -3,7 +3,5 @@
 mkDerivation {
   path = "share/dict";
   noCC = true;
-  version = "9.2";
-  sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
   makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
index 0393d36357f6e..3201a1c0e082a 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
@@ -1,22 +1,22 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook, rsync
-, compatIfNeeded
-, fetchNetBSD
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  compatIfNeeded,
 }:
 
 mkDerivation {
   pname = "fts";
   path = "include/fts.h";
-  sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
-  version = "9.2";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook rsync
+    bsdSetupHook
+    netbsdSetupHook
   ];
   propagatedBuildInputs = compatIfNeeded;
   extraPaths = [
-    (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
-    (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
-    (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+    "lib/libc/gen/fts.c"
+    "lib/libc/include/namespace.h"
+    "lib/libc/gen/fts.3"
   ];
   skipIncludesPhase = true;
   buildPhase = ''
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
index 7f81a77a02dd2..9eed584b29ae4 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/genassym";
-  version = "9.2";
-  sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
-}
+mkDerivation { path = "usr.bin/genassym"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
index 411be85e91e2f..ea701b6404ecc 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/gencat";
-  version = "9.2";
-  sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
-}
+mkDerivation { path = "usr.bin/gencat"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
index c8483d454b877..2feb6495ccf86 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/getconf";
-  sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
-  version = "9.2";
-}
+mkDerivation { path = "usr.bin/getconf"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
index 7a9acb1e0a9e8..b6a4efad4ac9c 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
@@ -2,7 +2,5 @@
 
 mkDerivation {
   path = "usr.bin/getent";
-  sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
-  version = "9.2";
   patches = [ ./getent.patch ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
index 646e5675130bb..40615b2722d5d 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
@@ -1,4 +1,10 @@
-{ lib, symlinkJoin, include, sys-headers, libpthread-headers }:
+{
+  lib,
+  symlinkJoin,
+  include,
+  sys-headers,
+  libpthread-headers,
+}:
 
 symlinkJoin {
   name = "netbsd-headers-9.2";
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
index 60b091ef0b718..9504ac22a74ed 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
@@ -1,9 +1,20 @@
-{ lib, mkDerivation, libc }:
+{
+  lib,
+  stdenvLibcMinimal,
+  mkDerivation,
+  libcMinimal,
+}:
 
 mkDerivation {
   path = "lib/i18n_module";
-  version = "9.2";
-  sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
+
+  libcMinimal = true;
+
+  # Hack around GCC's limits.h missing the include_next we want See
+  # https://gcc.gnu.org/legacy-ml/gcc/2003-10/msg01278.html
+  NIX_CFLAGS_COMPILE_BEFORE = "-isystem ${stdenvLibcMinimal.cc.libc.dev}/include";
+
+  extraPaths = [ libcMinimal.path ];
+
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ libc.src ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
index 1ecdec90ae095..1048016b81e2f 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
@@ -1,20 +1,30 @@
-{ lib, mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, rsync, nbperf, rpcgen
-, common
-, defaultMakeFlags
-, stdenv
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  nbperf,
+  rpcgen,
+  defaultMakeFlags,
+  stdenv,
 }:
 
 mkDerivation {
+  noLibc = true;
   path = "include";
-  version = "9.2";
-  sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff rsync nbperf rpcgen
+    install
+    mandoc
+    groff
+    nbperf
+    rpcgen
   ];
 
   # The makefiles define INCSDIR per subdirectory, so we have to set
@@ -32,7 +42,7 @@ mkDerivation {
     makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
   '';
 
-  extraPaths = [ common ];
+  extraPaths = [ "common" ];
   headersOnly = true;
   noCC = true;
   meta.platforms = lib.platforms.netbsd;
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
index 991517ac2d486..fa8bb690075f1 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
@@ -1,49 +1,58 @@
-{ mkDerivation
-, writeShellScript
-, mtree, make
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, mandoc, groff, rsync
-, compatIfNeeded, fts
+{
+  mkDerivation,
+  writeShellScript,
+  mtree,
+  make,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  mandoc,
+  groff,
+  compatIfNeeded,
+  fts,
 
 }:
 
 # HACK: to ensure parent directories exist. This emulates GNU
 # install’s -D option. No alternative seems to exist in BSD install.
 let
-  binstall = writeShellScript "binstall" ''
-    set -eu
-    for last in "$@"; do true; done
-    mkdir -p $(dirname $last)
-    @out@/bin/xinstall "$@"
-  '';
+  binstall = writeShellScript "binstall" (
+    builtins.readFile ../../../lib/install-wrapper.sh
+    + ''
+      @out@/bin/xinstall "''${args[@]}"
+    ''
+  );
 in
-  mkDerivation {
-    path = "usr.bin/xinstall";
-    version = "9.2";
-    sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
-    extraPaths = [ mtree.src make.src ];
-    nativeBuildInputs = [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      mandoc groff rsync
-    ];
-    skipIncludesPhase = true;
-    buildInputs = compatIfNeeded
-      # fts header is needed. glibc already has this header, but musl doesn't,
-      # so make sure pkgsMusl.netbsd.install still builds in case you want to
-      # remove it!
-      ++ [ fts ];
-    installPhase = ''
-      runHook preInstall
+mkDerivation {
+  path = "usr.bin/xinstall";
+  extraPaths = [
+    mtree.path
+    make.path
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook
+    netbsdSetupHook
+    makeMinimal
+    mandoc
+    groff
+  ];
+  skipIncludesPhase = true;
+  buildInputs =
+    compatIfNeeded
+    # fts header is needed. glibc already has this header, but musl doesn't,
+    # so make sure pkgsMusl.netbsd.install still builds in case you want to
+    # remove it!
+    ++ [ fts ];
+  installPhase = ''
+    runHook preInstall
 
-      install -D install.1 $out/share/man/man1/install.1
-      install -D xinstall $out/bin/xinstall
-      install -D -m 0550 ${binstall} $out/bin/binstall
-      substituteInPlace $out/bin/binstall --subst-var out
-      ln -s $out/bin/binstall $out/bin/install
+    install -D install.1 $out/share/man/man1/install.1
+    install -D xinstall $out/bin/xinstall
+    install -D -m 0550 ${binstall} $out/bin/binstall
+    substituteInPlace $out/bin/binstall --subst-var out
+    ln -s $out/bin/binstall $out/bin/install
 
-      runHook postInstall
-    '';
-    setupHook = ./install-setup-hook.sh;
-  }
+    runHook postInstall
+  '';
+  setupHook = ./install-setup-hook.sh;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
index 1496ad6a0e884..900b87967927c 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
@@ -1,18 +1,24 @@
-{ lib
-, mkDerivation
-, libc
-, defaultMakeFlags
+{
+  lib,
+  mkDerivation,
+  libcMinimal,
+  defaultMakeFlags,
 }:
 
 mkDerivation {
-  path  = "libexec/ld.elf_so";
-  version = "9.2";
-  sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
+  noLibc = true;
+  path = "libexec/ld.elf_so";
   meta.platforms = lib.platforms.netbsd;
-  LIBC_PIC = "${libc}/lib/libc_pic.a";
+  LIBC_PIC = "${libcMinimal}/lib/libc_pic.a";
   # Hack to prevent a symlink being installed here for compatibility.
   SHLINKINSTALLDIR = "/usr/libexec";
   USE_FORT = "yes";
-  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/libexec" "CLIBOBJ=${libc}/lib" ];
-  extraPaths = [ libc.src ] ++ libc.extraPaths;
+  makeFlags = defaultMakeFlags ++ [
+    "BINDIR=$(out)/libexec"
+    "CLIBOBJ=${libcMinimal}/lib"
+  ];
+  extraPaths = [
+    libcMinimal.path
+    "sys"
+  ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
index 93ea02f8a17c1..457ea6fa48d91 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
@@ -2,7 +2,5 @@
 
 mkDerivation {
   path = "lib/libarch";
-  version = "9.2";
-  sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
index ebc01a11668a6..665c9ce8ec8be 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -1,76 +1,52 @@
-{ lib
-, mkDerivation
-, defaultMakeFlags
-, _mainLibcExtraPaths
-, fetchNetBSD
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, flex
-, byacc, genassym, gencat, lorder, tsort, statHook, rsync, rpcgen
-, csu, headers
-, librt
+{
+  lib,
+  symlinkJoin,
+  libcMinimal,
+  libpthread,
+  libm,
+  libresolv,
+  librpcsvc,
+  i18n_module,
+  libutil,
+  librt,
+  libcrypt,
+  version,
 }:
 
-mkDerivation {
-  path = "lib/libc";
-  version = "9.2";
-  sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
-  USE_FORT = "yes";
-  MKPROFILE = "no";
-  extraPaths = _mainLibcExtraPaths ++ [
-    (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
-  ];
-  nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
-    makeMinimal
-    install mandoc groff flex
-    byacc genassym gencat lorder tsort statHook rsync rpcgen
-  ];
-  buildInputs = [ headers csu ];
-  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib -fcommon";
-  meta.platforms = lib.platforms.netbsd;
-  SHLIBINSTALLDIR = "$(out)/lib";
-  MKPICINSTALL = "yes";
-  NLSDIR = "$(out)/share/nls";
-  makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db"];
-  postInstall = ''
-    pushd ${headers}
-    find . -type d -exec mkdir -p $out/\{} \;
-    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-    popd
-
-    pushd ${csu}
-    find . -type d -exec mkdir -p $out/\{} \;
-    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-    popd
-
-    NIX_CFLAGS_COMPILE+=" -B$out/lib"
-    NIX_CFLAGS_COMPILE+=" -I$out/include"
-    NIX_LDFLAGS+=" -L$out/lib"
-
-    make -C $BSDSRCDIR/lib/libpthread $makeFlags
-    make -C $BSDSRCDIR/lib/libpthread $makeFlags install
-
-    make -C $BSDSRCDIR/lib/libm $makeFlags
-    make -C $BSDSRCDIR/lib/libm $makeFlags install
+symlinkJoin rec {
+  name = "${pname}-${version}";
+  pname = "libc-netbsd";
+  inherit version;
 
-    make -C $BSDSRCDIR/lib/libresolv $makeFlags
-    make -C $BSDSRCDIR/lib/libresolv $makeFlags install
-
-    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
-
-    make -C $BSDSRCDIR/lib/i18n_module $makeFlags
-    make -C $BSDSRCDIR/lib/i18n_module $makeFlags install
-
-    make -C $BSDSRCDIR/lib/libutil $makeFlags
-    make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-    make -C $BSDSRCDIR/lib/librt $makeFlags
-    make -C $BSDSRCDIR/lib/librt $makeFlags install
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
 
-    make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-    make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+  paths =
+    lib.concatMap
+      (p: [
+        (lib.getDev p)
+        (lib.getLib p)
+        (lib.getMan p)
+      ])
+      [
+        libcMinimal
+        libm
+        libpthread
+        libresolv
+        librpcsvc
+        i18n_module
+        libutil
+        librt
+        libcrypt
+      ];
+
+  postBuild = ''
+    rm -r "$out/nix-support"
+    fixupPhase
   '';
-  inherit (librt) postPatch;
+
+  meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcMinimal.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcMinimal.nix
new file mode 100644
index 0000000000000..bbab20d53d51e
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcMinimal.nix
@@ -0,0 +1,85 @@
+{
+  lib,
+  mkDerivation,
+  defaultMakeFlags,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  flex,
+  byacc,
+  genassym,
+  gencat,
+  lorder,
+  tsort,
+  statHook,
+  rpcgen,
+  csu,
+  headers,
+}:
+
+mkDerivation {
+  noLibc = true;
+  path = "lib/libc";
+  pname = "libcMinimal-netbsd";
+  outputs = [
+    "out"
+    "dev"
+    "man"
+    "tags"
+  ];
+  USE_FORT = "yes";
+  MKPROFILE = "no";
+  extraPaths = [
+    "common"
+    "lib/i18n_module"
+    "libexec/ld.elf_so"
+    "sys"
+    "external/bsd/jemalloc"
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook
+    netbsdSetupHook
+    makeMinimal
+    install
+    mandoc
+    groff
+    flex
+    byacc
+    genassym
+    gencat
+    lorder
+    tsort
+    statHook
+    rpcgen
+  ];
+  buildInputs = [
+    headers
+    csu
+  ];
+  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib -fcommon";
+  meta.platforms = lib.platforms.netbsd;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  MKPICINSTALL = "yes";
+  NLSDIR = "$(out)/share/nls";
+  makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db" ];
+  postInstall = ''
+    pushd ${headers}
+    find include -type d -exec mkdir -p "$dev/{}" ';'
+    find include '(' -type f -o -type l ')' -exec cp -pr "{}" "$dev/{}" ';'
+    popd
+
+    pushd ${csu}
+    find lib -type d -exec mkdir -p "$out/{}" ';'
+    find lib '(' -type f -o -type l ')' -exec cp -pr "{}" "$out/{}" ';'
+    popd
+
+    moveToOutput var/db/libc.tags "$tags"
+  '';
+
+  postPatch = ''
+    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' lib/lib*/sys/Makefile.inc
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
index c5f9deff589c4..f51dec0f68af2 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
@@ -2,8 +2,14 @@
 
 mkDerivation {
   path = "lib/libcrypt";
-  version = "9.2";
-  sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   SHLIBINSTALLDIR = "$(out)/lib";
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
index 2409879640a90..8d61bcfdf7d97 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
@@ -1,19 +1,23 @@
-{ lib, mkDerivation, stdenv
-, libterminfo
-, compatIfNeeded
-, defaultMakeFlags
+{
+  lib,
+  mkDerivation,
+  stdenv,
+  libterminfo,
+  compatIfNeeded,
+  defaultMakeFlags,
 }:
 
 mkDerivation {
   path = "lib/libcurses";
-  version = "9.2";
-  sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
   buildInputs = [ libterminfo ];
-  env.NIX_CFLAGS_COMPILE = toString ([
-    "-D__scanflike(a,b)="
-    "-D__va_list=va_list"
-    "-D__warn_references(a,b)="
-  ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+      "-D__warn_references(a,b)="
+    ]
+    ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)="
+  );
   propagatedBuildInputs = compatIfNeeded;
   MKDOC = "no"; # missing vfontedpr
   makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
index eb734f34c3d49..cb9951cb8cf10 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
@@ -1,26 +1,30 @@
-{ lib, mkDerivation
-, libterminfo, libcurses
-, compatIfNeeded
-, defaultMakeFlags
+{
+  lib,
+  mkDerivation,
+  libterminfo,
+  libcurses,
+  compatIfNeeded,
+  defaultMakeFlags,
 }:
 
 mkDerivation {
-    path = "lib/libedit";
-    version = "9.2";
-    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
-    buildInputs = [ libterminfo libcurses ];
-    propagatedBuildInputs = compatIfNeeded;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
-    postPatch = ''
-      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
-      substituteInPlace $COMPONENT_PATH/config.h \
-        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
-      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
-    '';
-    env.NIX_CFLAGS_COMPILE = toString [
-      "-D__noinline="
-      "-D__scanflike(a,b)="
-      "-D__va_list=va_list"
-    ];
-  }
+  path = "lib/libedit";
+  buildInputs = [
+    libterminfo
+    libcurses
+  ];
+  propagatedBuildInputs = compatIfNeeded;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
+  postPatch = ''
+    sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
+    substituteInPlace $COMPONENT_PATH/config.h \
+      --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
+    substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
+  '';
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-D__noinline="
+    "-D__scanflike(a,b)="
+    "-D__va_list=va_list"
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
index 86990088adf28..f010c808c4843 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
@@ -1,10 +1,18 @@
-{ lib, mkDerivation, sys }:
+{ lib, mkDerivation }:
 
 mkDerivation {
   path = "lib/libm";
-  version = "9.2";
-  sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   SHLIBINSTALLDIR = "$(out)/lib";
+
+  extraPaths = [ "sys" ];
+
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ sys.src ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
index 51bbc216e2046..a74176db68cdf 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
@@ -2,7 +2,5 @@
 
 mkDerivation {
   path = "lib/libossaudio";
-  version = "9.2";
-  sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
index 21ca0f62fd4e4..69d1ff5accca4 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
@@ -1,11 +1,13 @@
-{ lib, mkDerivation, sys }:
+{
+  lib,
+  mkDerivation,
+  sys,
+}:
 
 mkDerivation {
   pname = "libpci";
   path = "lib/libpci";
-  version = "9.2";
-  sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
   env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ sys.src ];
+  extraPaths = [ sys.path ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
deleted file mode 100644
index 485a12837bcb4..0000000000000
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  path = "lib/libpthread";
-  version = "9.2";
-  sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
-}
-
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
index 3896562501fc5..41a447e2b4083 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
@@ -1,9 +1,10 @@
 { lib, mkDerivation }:
 
-mkDerivation (import ./base.nix // {
+mkDerivation {
+  path = "lib/libpthread";
   pname = "libpthread-headers";
   installPhase = "includesPhase";
   dontBuild = true;
   noCC = true;
   meta.platforms = lib.platforms.netbsd;
-})
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
index c2a0d407718e9..8e0ef5fd1b74e 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
@@ -1,15 +1,35 @@
-{ lib, mkDerivation
-, headers
-, common, libc, librt, sys
+{
+  lib,
+  stdenvLibcMinimal,
+  mkDerivation,
+  headers,
+  libcMinimal,
+  librt,
 }:
 
-mkDerivation (import ./base.nix // {
-  pname = "libpthread";
-  installPhase = null;
-  noCC = false;
-  dontBuild = false;
-  buildInputs = [ headers ];
+mkDerivation {
+  path = "lib/libpthread";
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
   SHLIBINSTALLDIR = "$(out)/lib";
-  extraPaths = [ common libc.src librt.src sys.src ];
+
+  # Hack around GCC's limits.h missing the include_next we want See
+  # https://gcc.gnu.org/legacy-ml/gcc/2003-10/msg01278.html
+  NIX_CFLAGS_COMPILE_BEFORE = "-isystem ${stdenvLibcMinimal.cc.libc.dev}/include";
+
+  extraPaths = [
+    "common"
+    libcMinimal.path
+    librt.path
+    "sys"
+  ];
+
   meta.platforms = lib.platforms.netbsd;
-})
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
index 2427592e4aa9a..63e95de850c09 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
@@ -1,9 +1,15 @@
-{ lib, mkDerivation, libc }:
+{
+  lib,
+  mkDerivation,
+  libcMinimal,
+}:
 
 mkDerivation {
   path = "lib/libresolv";
-  version = "9.2";
-  sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
+
+  libcMinimal = true;
+
+  extraPaths = [ libcMinimal.path ];
+
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ libc.src ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
index 87524339e268f..60609ed134fb7 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
@@ -1,21 +1,39 @@
-{ lib
-, mkDerivation
-, defaultMakeFlags
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, tsort, lorder, rpcgen, statHook
+{
+  lib,
+  mkDerivation,
+  defaultMakeFlags,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  rpcgen,
+  statHook,
 }:
 
 mkDerivation {
   path = "lib/librpcsvc";
-  version = "9.2";
-  sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
-  makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(out)/include/rpcsvc" ];
-  meta.platforms = lib.platforms.netbsd;
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install tsort lorder rpcgen statHook
+    install
+    tsort
+    lorder
+    rpcgen
+    statHook
   ];
-}
 
+  makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(dev)/include/rpcsvc" ];
+
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
index 2ffe0787004a5..c69062d9e87df 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
@@ -1,13 +1,22 @@
-{ lib, mkDerivation, libc, headers }:
+{
+  lib,
+  mkDerivation,
+  libcMinimal,
+}:
 
 mkDerivation {
   path = "lib/librt";
-  version = "9.2";
-  sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  extraPaths = [ libcMinimal.path ] ++ libcMinimal.extraPaths;
+
+  inherit (libcMinimal) postPatch;
+
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ libc.src ] ++ libc.extraPaths;
-  postPatch = ''
-    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' \
-      $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
-  '';
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
index b9268cc7ba333..c02410a52ed2a 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
@@ -1,17 +1,31 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal, install, tsort, lorder, mandoc, statHook, nbperf, tic, rsync
-, compatIfNeeded
-, fetchNetBSD
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  statHook,
+  nbperf,
+  tic,
+  compatIfNeeded,
 }:
 
 mkDerivation {
   path = "lib/libterminfo";
-  version = "9.2";
-  sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
-    makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
+    bsdSetupHook
+    netbsdSetupHook
+    makeMinimal
+    install
+    tsort
+    lorder
+    mandoc
+    statHook
+    nbperf
+    tic
   ];
   buildInputs = compatIfNeeded;
   SHLIBINSTALLDIR = "$(out)/lib";
@@ -26,7 +40,5 @@ mkDerivation {
   postInstall = ''
     make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
   '';
-  extraPaths = [
-    (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
-  ];
+  extraPaths = [ "share/terminfo" ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
index 4aaf8f0e7ab63..c217f6a7ce465 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
@@ -1,21 +1,52 @@
-{ mkDerivation
-, common, libc, sys
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, byacc, install, tsort, lorder, mandoc, statHook, rsync
-, headers
+{
+  lib,
+  stdenvLibcMinimal,
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  byacc,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  statHook,
+  headers,
 }:
 
 mkDerivation {
   path = "lib/libutil";
-  version = "9.2";
-  sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
-  extraPaths = [ common libc.src sys.src ];
+
+  libcMinimal = true;
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    byacc install tsort lorder mandoc statHook rsync
+    byacc
+    install
+    tsort
+    lorder
+    mandoc
+    statHook
   ];
-  buildInputs = [ headers ];
+
   SHLIBINSTALLDIR = "$(out)/lib";
+
+  # Hack around GCC's limits.h missing the include_next we want See
+  # https://gcc.gnu.org/legacy-ml/gcc/2003-10/msg01278.html
+  NIX_CFLAGS_COMPILE_BEFORE = "-isystem ${stdenvLibcMinimal.cc.libc.dev}/include";
+
+  extraPaths = [
+    "common"
+    "lib/libc"
+    "sys"
+  ];
+
+  meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
index 3c61e8517b35b..e3e06ba1a152c 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
@@ -2,8 +2,6 @@
 
 mkDerivation {
   path = "usr.bin/locale";
-  version = "9.2";
-  sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
   patches = [ ./locale.patch ];
   env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
index d3109601382a0..b10b8caee2ff2 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
@@ -1,16 +1,21 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, rsync
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
 }:
 
 mkDerivation {
   path = "usr.bin/lorder";
-  version = "9.2";
-  sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff rsync
+    install
+    mandoc
+    groff
   ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/make-rules.nix b/pkgs/os-specific/bsd/netbsd/pkgs/make-rules.nix
new file mode 100644
index 0000000000000..e16027b535fca
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/make-rules.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  mkDerivation,
+  stdenv,
+  bsdSetupHook,
+  netbsdSetupHook,
+}:
+
+mkDerivation {
+  path = "share/mk";
+  noCC = true;
+
+  buildInputs = [ ];
+  nativeBuildInputs = [
+    bsdSetupHook
+    netbsdSetupHook
+  ];
+
+  dontBuild = true;
+
+  postPatch =
+    ''
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
+        --replace '-o ''${DOCOWN}' "" \
+        --replace '-g ''${DOCGRP}' ""
+      for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
+        substituteInPlace $mk \
+          --replace '-o ''${BINOWN}' "" \
+          --replace '-g ''${BINGRP}' ""
+      done
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
+        --replace '-o ''${KMODULEOWN}' "" \
+        --replace '-g ''${KMODULEGRP}' ""
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace '-o ''${LIBOWN}' "" \
+        --replace '-g ''${LIBGRP}' "" \
+        --replace '-o ''${DEBUGOWN}' "" \
+        --replace '-g ''${DEBUGGRP}' ""
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
+        --replace '-o ''${LIBOWN}' "" \
+        --replace '-g ''${LIBGRP}' ""
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
+        --replace '-o ''${MANOWN}' "" \
+        --replace '-g ''${MANGRP}' ""
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
+        --replace '-o ''${NLSOWN}' "" \
+        --replace '-g ''${NLSGRP}' ""
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
+        --replace '-o ''${BINOWN}' "" \
+        --replace '-g ''${BINGRP}' "" \
+        --replace '-o ''${RUMPBINOWN}' "" \
+        --replace '-g ''${RUMPBINGRP}' "" \
+        --replace '-o ''${DEBUGOWN}' "" \
+        --replace '-g ''${DEBUGGRP}' ""
+
+       substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+         --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
+       substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
+         --replace /bin/rm rm
+    ''
+    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' "" \
+        --replace '-Wl,--warn-shared-textrel' ""
+    '';
+
+  installPhase = ''
+    cp -r . $out
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
index dcd80ef004678..9612ca7ff4893 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
@@ -1,60 +1,22 @@
-{ lib, mkDerivation, fetchNetBSD, stdenv }:
+{
+  lib,
+  mkDerivation,
+  stdenv,
+  make-rules,
+}:
 
 mkDerivation {
   path = "usr.bin/make";
-  sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
-  version = "9.2";
 
- postPatch = ''
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
-     --replace '-o ''${DOCOWN}' "" \
-     --replace '-g ''${DOCGRP}' ""
-   for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
-     substituteInPlace $mk \
-       --replace '-o ''${BINOWN}' "" \
-       --replace '-g ''${BINGRP}' ""
-   done
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
-     --replace '-o ''${KMODULEOWN}' "" \
-     --replace '-g ''${KMODULEGRP}' ""
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-     --replace '-o ''${LIBOWN}' "" \
-     --replace '-g ''${LIBGRP}' "" \
-     --replace '-o ''${DEBUGOWN}' "" \
-     --replace '-g ''${DEBUGGRP}' ""
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
-     --replace '-o ''${LIBOWN}' "" \
-     --replace '-g ''${LIBGRP}' ""
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
-     --replace '-o ''${MANOWN}' "" \
-     --replace '-g ''${MANGRP}' ""
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
-     --replace '-o ''${NLSOWN}' "" \
-     --replace '-g ''${NLSGRP}' ""
-   substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
-     --replace '-o ''${BINOWN}' "" \
-     --replace '-g ''${BINGRP}' "" \
-     --replace '-o ''${RUMPBINOWN}' "" \
-     --replace '-g ''${RUMPBINGRP}' "" \
-     --replace '-o ''${DEBUGOWN}' "" \
-     --replace '-g ''${DEBUGGRP}' ""
+  postPatch =
+    make-rules.postPatch
+    + ''
+      # make needs this to pick up our sys make files
+      appendToVar NIX_CFLAGS_COMPILE "-D_PATH_DEFSYSPATH=\"$out/share/mk\""
+    '';
 
-    # make needs this to pick up our sys make files
-    export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
-
-    substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-      --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
-    substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
-      --replace /bin/rm rm
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
-      --replace '-Wl,--fatal-warnings' "" \
-      --replace '-Wl,--warn-shared-textrel' ""
-  '';
   postInstall = ''
     make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
   '';
-  extraPaths = [
-    (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
-  ];
+  extraPaths = [ "share/mk" ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
index 18655b3bf863e..aab6e7f2b0dfe 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
@@ -1,23 +1,27 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook, rsync
-, make
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  make,
+  make-rules,
 }:
 
 mkDerivation {
   path = "tools/make";
-  sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
-  version = "9.2";
 
-  buildInputs = [];
+  buildInputs = [ ];
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook rsync
+    bsdSetupHook
+    netbsdSetupHook
   ];
 
   skipIncludesPhase = true;
 
   postPatch = ''
     patchShebangs $COMPONENT_PATH/configure
-    ${make.postPatch}
+
+    # make needs this to pick up our sys make files
+    appendToVar NIX_CFLAGS_COMPILE "-D_PATH_DEFSYSPATH=\"$out/share/mk\""
   '';
 
   buildPhase = ''
@@ -34,10 +38,10 @@ mkDerivation {
     install -D nbmake $out/bin/nbmake
     ln -s $out/bin/nbmake $out/bin/make
     mkdir -p $out/share
-    cp -r $BSDSRCDIR/share/mk $out/share/mk
+    cp -r ${make-rules} $out/share/mk
 
     runHook postInstall
   '';
 
-  extraPaths = [ make.src ] ++ make.extraPaths;
+  extraPaths = [ make.path ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/man.nix b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
index bce5bcee66946..527c547fdaad0 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
@@ -3,8 +3,6 @@
 mkDerivation {
   path = "share/man";
   noCC = true;
-  version = "9.2";
-  sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
   # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
   # so we can avoid the dependency on ghostscript
   postPatch = ''
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
index 7f96f4d1495ad..726acf27d50b0 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
@@ -3,7 +3,5 @@
 mkDerivation {
   path = "share/misc";
   noCC = true;
-  version = "9.2";
-  sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
   makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
index 82e8889f6cf4d..8605bfbfcebe2 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
@@ -1,82 +1,134 @@
-{ lib
-, stdenvNoCC, stdenv
-, fetchNetBSD
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, tsort, lorder
-, mandoc, groff, statHook, rsync
-, compatIfNeeded
-, defaultMakeFlags
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  crossLibcStdenv,
+  stdenvLibcMinimal,
+  runCommand,
+  rsync,
+  source,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  mandoc,
+  groff,
+  statHook,
+  compatIfNeeded,
+  defaultMakeFlags,
+  version,
 }:
 
-lib.makeOverridable (attrs: let
-  stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
-in stdenv'.mkDerivation ({
-  pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
-  inherit (attrs) version;
-  src = fetchNetBSD attrs.path attrs.version attrs.sha256;
+lib.makeOverridable (
+  attrs:
+  let
+    stdenv' =
+      if attrs.noCC or false then
+        stdenvNoCC
+      else if attrs.noLibc or false then
+        crossLibcStdenv
+      else if attrs.libcMinimal or false then
+        stdenvLibcMinimal
+      else
+        stdenv;
+  in
+  stdenv'.mkDerivation (
+    rec {
+      pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
+      inherit version;
+      src = runCommand "${pname}-filtered-src" { nativeBuildInputs = [ rsync ]; } ''
+        for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [ ])}; do
+          set -x
+          path="$out/$p"
+          mkdir -p "$(dirname "$path")"
+          src_path="${source}/$p"
+          if [[ -d "$src_path" ]]; then src_path+=/; fi
+          rsync --chmod="+w" -r "$src_path" "$path"
+          set +x
+        done
+      '';
 
-  extraPaths = [ ];
+      extraPaths = [ ];
 
-  nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
-    makeMinimal
-    install tsort lorder mandoc groff statHook rsync
-  ];
-  buildInputs = compatIfNeeded;
+      nativeBuildInputs = [
+        bsdSetupHook
+        netbsdSetupHook
+        makeMinimal
+        install
+        tsort
+        lorder
+        mandoc
+        groff
+        statHook
+      ];
+      buildInputs = compatIfNeeded;
 
-  HOST_SH = stdenv'.shell;
+      HOST_SH = stdenv'.shell;
 
-  MACHINE_ARCH = {
-    i486 = "i386";
-    i586 = "i386";
-    i686 = "i386";
-  }.${stdenv'.hostPlatform.parsed.cpu.name}
-    or stdenv'.hostPlatform.parsed.cpu.name;
+      MACHINE_ARCH =
+        {
+          i486 = "i386";
+          i586 = "i386";
+          i686 = "i386";
+        }
+        .${stdenv'.hostPlatform.parsed.cpu.name} or stdenv'.hostPlatform.parsed.cpu.name;
 
-  MACHINE = {
-    x86_64 = "amd64";
-    aarch64 = "evbarm64";
-    i486 = "i386";
-    i586 = "i386";
-    i686 = "i386";
-  }.${stdenv'.hostPlatform.parsed.cpu.name}
-    or stdenv'.hostPlatform.parsed.cpu.name;
+      MACHINE =
+        {
+          x86_64 = "amd64";
+          aarch64 = "evbarm64";
+          i486 = "i386";
+          i586 = "i386";
+          i686 = "i386";
+        }
+        .${stdenv'.hostPlatform.parsed.cpu.name} or stdenv'.hostPlatform.parsed.cpu.name;
 
-  COMPONENT_PATH = attrs.path;
+      COMPONENT_PATH = attrs.path;
 
-  makeFlags = defaultMakeFlags;
+      makeFlags = defaultMakeFlags;
 
-  strictDeps = true;
+      strictDeps = true;
 
-  meta = with lib; {
-    maintainers = with maintainers; [ matthewbauer qyliss ];
-    platforms = platforms.unix;
-    license = licenses.bsd2;
-  };
-
-} // lib.optionalAttrs stdenv'.hasCC {
-  # TODO should CC wrapper set this?
-  CPP = "${stdenv'.cc.targetPrefix}cpp";
-} // lib.optionalAttrs stdenv'.isDarwin {
-  MKRELRO = "no";
-} // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-  HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-} // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-  HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-} // lib.optionalAttrs (stdenv'.isx86_32) {
-  USE_SSP = "no";
-} // lib.optionalAttrs (attrs.headersOnly or false) {
-  installPhase = "includesPhase";
-  dontBuild = true;
-} // attrs // {
-  # Files that use NetBSD-specific macros need to have nbtool_config.h
-  # included ahead of them on non-NetBSD platforms.
-  postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
-    set +e
-    grep -Zlr "^__RCSID
-    ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
-        xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
-    set -e
-  '' + attrs.postPatch or "";
-}))
+      meta = with lib; {
+        maintainers = with maintainers; [
+          matthewbauer
+          qyliss
+        ];
+        platforms = platforms.unix;
+        license = licenses.bsd2;
+      };
+    }
+    // lib.optionalAttrs stdenv'.hasCC {
+      # TODO should CC wrapper set this?
+      CPP = "${stdenv'.cc.targetPrefix}cpp";
+    }
+    // lib.optionalAttrs stdenv'.isDarwin { MKRELRO = "no"; }
+    // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+      HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+    }
+    // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+      HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+    }
+    // lib.optionalAttrs (stdenv'.isx86_32) { USE_SSP = "no"; }
+    // lib.optionalAttrs (attrs.headersOnly or false) {
+      installPhase = "includesPhase";
+      dontBuild = true;
+    }
+    // attrs
+    // {
+      # Files that use NetBSD-specific macros need to have nbtool_config.h
+      # included ahead of them on non-NetBSD platforms.
+      postPatch =
+        lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
+          set +e
+          grep -Zlr "^__RCSID
+          ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
+              xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
+          set -e
+        ''
+        + attrs.postPatch or "";
+    }
+  )
+)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
index 5c4c172e40a7d..bf7d8b7db689b 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "sbin/mknod";
-  version = "9.2";
-  sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
-}
+mkDerivation { path = "sbin/mknod"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
index 723da3ad891bc..8310941c7cb22 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
@@ -2,7 +2,5 @@
 
 mkDerivation {
   path = "usr.sbin/mtree";
-  version = "9.2";
-  sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
-  extraPaths = [ mknod.src ];
+  extraPaths = [ mknod.path ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
index 02ce7cf6ce5eb..3b52eae96c3b2 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
@@ -1,8 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/nbperf";
-  version = "9.2";
-  sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
-}
-
+mkDerivation { path = "usr.bin/nbperf"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
index e80571f2bf9a2..31368523ee6fc 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
@@ -1,5 +1,3 @@
 { makeSetupHook }:
 
-makeSetupHook {
-    name = "netbsd-setup-hook";
-  } ./setup-hook.sh
+makeSetupHook { name = "netbsd-setup-hook"; } ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
index fa8b19e7d8ce4..8c3742a76534b 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
@@ -1,15 +1,6 @@
-mergeNetBSDSourceDir() {
-  # merge together all extra paths
-  # there should be a better way to do this
-  chmod -R u+w $BSDSRCDIR
-  for path in $extraPaths; do
-    rsync -Er --chmod u+w $path/ $BSDSRCDIR/
-  done
-}
-
 addNetBSDMakeFlags() {
   makeFlags="INCSDIR=${!outputDev}/include $makeFlags"
+  makeFlags="MANDIR=${!outputMan}/share/man $makeFlags"
 }
 
-postUnpackHooks+=(mergeNetBSDSourceDir)
 preConfigureHooks+=(addNetBSDMakeFlags)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
index b1482d4dff112..dc6ceb7bd634d 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
@@ -1,7 +1,3 @@
 { mkDerivation }:
 
-mkDerivation {
-  path = "usr.bin/rpcgen";
-  version = "9.2";
-  sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
-}
+mkDerivation { path = "usr.bin/rpcgen"; }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/source.nix b/pkgs/os-specific/bsd/netbsd/pkgs/source.nix
new file mode 100644
index 0000000000000..432de84ffb3e1
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/source.nix
@@ -0,0 +1,12 @@
+{
+  lib,
+  fetchcvs,
+  version,
+}:
+
+fetchcvs {
+  cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+  module = "src";
+  tag = "netbsd-${lib.replaceStrings [ "." ] [ "-" ] version}-RELEASE";
+  sha256 = "sha256-+onT/ajWayaKALucaZBqoiEkvBBI400Fs2OCtMf/bYU=";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
index 78186f55cd455..e38c53a3aac57 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
@@ -1,4 +1,8 @@
-{ makeSetupHook, writeText, stat }:
+{
+  makeSetupHook,
+  writeText,
+  stat,
+}:
 
 # stat isn't in POSIX, and NetBSD stat supports a completely
 # different range of flags than GNU stat, so including it in PATH
@@ -6,9 +10,8 @@
 # NetBSD's build system and NetBSD stat without including it in
 # PATH.
 
-makeSetupHook {
-  name = "netbsd-stat-hook";
-} (writeText "netbsd-stat-hook-impl" ''
-  makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
-'')
-
+makeSetupHook { name = "netbsd-stat-hook"; } (
+  writeText "netbsd-stat-hook-impl" ''
+    makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
+  ''
+)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
index fa4d5cb3e21f6..f55bab160bc2c 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
@@ -1,7 +1,11 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, rsync
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
 }:
 
 # Don't add this to nativeBuildInputs directly.
@@ -9,11 +13,12 @@
 
 mkDerivation {
   path = "usr.bin/stat";
-  version = "9.2";
-  sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff rsync
+    install
+    mandoc
+    groff
   ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
index ba458ef5c712f..116aa46e73503 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
@@ -1,14 +1,21 @@
-{ lib, mkDerivation
-, include
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
-, defaultMakeFlags
-, common
+{
+  lib,
+  mkDerivation,
+  include,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  statHook,
+  uudecode,
+  config,
+  genassym,
+  defaultMakeFlags,
 }:
 {
   path = "sys";
-  version = "9.2";
-  sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
 
   # Make the build ignore linker warnings
   prePatch = ''
@@ -29,23 +36,33 @@
     ''
       substituteInPlace sys/arch/i386/stand/efiboot/Makefile.efiboot \
         --replace "-nocombreloc" "-z nocombreloc"
-    '' +
-    # multiple header dirs, see above
-    include.postPatch;
+    ''
+    +
+      # multiple header dirs, see above
+      include.postPatch;
 
   CONFIG = "GENERIC";
 
   propagatedBuildInputs = [ include ];
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
-    makeMinimal install tsort lorder statHook rsync uudecode config genassym
+    bsdSetupHook
+    netbsdSetupHook
+    makeMinimal
+    install
+    tsort
+    lorder
+    statHook
+    uudecode
+    config
+    genassym
   ];
 
-  postConfigure = ''
-    pushd arch/$MACHINE/conf
-    config $CONFIG
-    popd
-  ''
+  postConfigure =
+    ''
+      pushd arch/$MACHINE/conf
+      config $CONFIG
+      popd
+    ''
     # multiple header dirs, see above
     + include.postConfigure;
 
@@ -67,6 +84,5 @@
   '';
 
   meta.platforms = lib.platforms.netbsd;
-  extraPaths = [ common ];
-
+  extraPaths = [ "common" ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
index a3f20d772a3e7..d19d9d86cb382 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
@@ -1,21 +1,45 @@
-{ lib, mkDerivation
-, include
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
-, defaultMakeFlags
-, common
+{
+  lib,
+  mkDerivation,
+  include,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  statHook,
+  uudecode,
+  config,
+  genassym,
+  defaultMakeFlags,
 }:
 let
   base = import ./base.nix {
     inherit
-      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
-      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
-      common;
+      lib
+      mkDerivation
+      include
+      bsdSetupHook
+      netbsdSetupHook
+      makeMinimal
+      install
+      tsort
+      lorder
+      statHook
+      uudecode
+      config
+      genassym
+      defaultMakeFlags
+      ;
   };
 in
-  mkDerivation (base // {
+mkDerivation (
+  base
+  // {
     pname = "sys-headers";
     installPhase = "includesPhase";
     dontBuild = true;
     noCC = true;
-  })
+  }
+)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
index 87031a50346ea..0bdd83126bcf7 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
@@ -1,21 +1,45 @@
-{ lib, mkDerivation
-, include
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
-, defaultMakeFlags
-, common
+{
+  lib,
+  mkDerivation,
+  include,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  tsort,
+  lorder,
+  statHook,
+  uudecode,
+  config,
+  genassym,
+  defaultMakeFlags,
 }:
 let
   base = import ./base.nix {
     inherit
-      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
-      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
-      common;
+      lib
+      mkDerivation
+      include
+      bsdSetupHook
+      netbsdSetupHook
+      makeMinimal
+      install
+      tsort
+      lorder
+      statHook
+      uudecode
+      config
+      genassym
+      defaultMakeFlags
+      ;
   };
 in
-  mkDerivation (base // {
+mkDerivation (
+  base
+  // {
     pname = "sys";
     installPhase = null;
     noCC = false;
     dontBuild = false;
-  })
+  }
+)
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
index 2a7e3644b6be9..42772d1d71285 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
@@ -1,28 +1,34 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, nbperf, rsync
-, compatIfNeeded
-, defaultMakeFlags
-, libterminfo
-, fetchNetBSD
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
+  nbperf,
+  compatIfNeeded,
+  defaultMakeFlags,
+  libterminfo,
 }:
 
 mkDerivation {
   path = "tools/tic";
-  version = "9.2";
-  sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
   HOSTPROG = "tic";
   buildInputs = compatIfNeeded;
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff nbperf rsync
+    install
+    mandoc
+    groff
+    nbperf
   ];
   makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
   extraPaths = [
-    libterminfo.src
-    (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
-    (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+    libterminfo.path
+    "usr.bin/tic"
+    "tools/Makefile.host"
   ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
index 334eccc64c551..c844e48b4412a 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
@@ -1,16 +1,21 @@
-{ mkDerivation
-, bsdSetupHook, netbsdSetupHook
-, makeMinimal
-, install, mandoc, groff, rsync
+{
+  mkDerivation,
+  bsdSetupHook,
+  netbsdSetupHook,
+  makeMinimal,
+  install,
+  mandoc,
+  groff,
 }:
 
 mkDerivation {
   path = "usr.bin/tsort";
-  version = "9.2";
-  sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
   nativeBuildInputs = [
-    bsdSetupHook netbsdSetupHook
+    bsdSetupHook
+    netbsdSetupHook
     makeMinimal
-    install mandoc groff rsync
+    install
+    mandoc
+    groff
   ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
index dac9674f9d6f3..1e58df16ceeec 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
@@ -1,10 +1,11 @@
-{ lib, mkDerivation, stdenv }:
+{
+  lib,
+  mkDerivation,
+  stdenv,
+}:
 
 mkDerivation {
   path = "usr.bin/uudecode";
-  version = "9.2";
-  sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
   NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
 }
-
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
new file mode 100644
index 0000000000000..bfc88f097865f
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  makeScopeWithSplicing',
+  generateSplicesForMkScope,
+  buildPackages,
+}:
+
+let
+  otherSplices = generateSplicesForMkScope "openbsd";
+  buildOpenbsd = otherSplices.selfBuildHost;
+in
+
+makeScopeWithSplicing' {
+  inherit otherSplices;
+  f = (
+    self:
+    lib.packagesFromDirectoryRecursive {
+      callPackage = self.callPackage;
+      directory = ./pkgs;
+    }
+    // {
+      libc = self.callPackage ./pkgs/libc/package.nix {
+        inherit (self) csu include;
+        inherit (buildOpenbsd) makeMinimal;
+        inherit (buildPackages.netbsd)
+          install
+          gencat
+          rpcgen
+          tsort
+          ;
+      };
+      makeMinimal = buildPackages.netbsd.makeMinimal.override { inherit (self) make-rules; };
+      mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+        inherit (buildPackages.netbsd) install;
+        inherit (buildPackages.buildPackages) rsync;
+      };
+      include = self.callPackage ./pkgs/include/package.nix {
+        inherit (buildOpenbsd) makeMinimal;
+        inherit (buildPackages.netbsd) install rpcgen mtree;
+      };
+      csu = self.callPackage ./pkgs/csu.nix {
+        inherit (self) include;
+        inherit (buildOpenbsd) makeMinimal;
+        inherit (buildPackages.netbsd) install;
+      };
+      make-rules = self.callPackage ./pkgs/make-rules/package.nix { };
+      lorder = self.callPackage ./pkgs/lorder.nix { inherit (buildPackages.netbsd) install; };
+    }
+  );
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
new file mode 100644
index 0000000000000..03a7180425684
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  openbsdSetupHook,
+  makeMinimal,
+  install,
+  include,
+}:
+
+mkDerivation {
+  noLibc = true;
+  path = "lib/csu";
+  nativeBuildInputs = [
+    bsdSetupHook
+    openbsdSetupHook
+    makeMinimal
+    install
+  ];
+  buildInputs = [ include ];
+  meta.platforms = lib.platforms.openbsd;
+  extraPaths = [ "libexec/ld.so" ];
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/include/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/include/package.nix
new file mode 100644
index 0000000000000..481e302065fc4
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/include/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  mkDerivation,
+  makeMinimal,
+  bsdSetupHook,
+  openbsdSetupHook,
+  install,
+  rpcgen,
+  mtree,
+  pax,
+  buildPackages,
+}:
+mkDerivation {
+  path = "include";
+  noCC = true;
+
+  extraPaths = [
+    "lib"
+    #"sys"
+    "sys/arch"
+    # LDIRS from the mmakefile
+    "sys/crypto"
+    "sys/ddb"
+    "sys/dev"
+    "sys/isofs"
+    "sys/miscfs"
+    "sys/msdosfs"
+    "sys/net"
+    "sys/netinet"
+    "sys/netinet6"
+    "sys/netmpls"
+    "sys/net80211"
+    "sys/nfs"
+    "sys/ntfs"
+    "sys/scsi"
+    "sys/sys"
+    "sys/ufs"
+    "sys/uvm"
+  ];
+
+  nativeBuildInputs = [
+    bsdSetupHook
+    install
+    makeMinimal
+    mtree
+    openbsdSetupHook
+    pax
+    rpcgen
+  ];
+
+  makeFlags = [
+    "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp"
+    "-B"
+  ];
+
+  headersOnly = true;
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libc/disable-librebuild.patch b/pkgs/os-specific/bsd/openbsd/pkgs/libc/disable-librebuild.patch
new file mode 100644
index 0000000000000..58633861a826f
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libc/disable-librebuild.patch
@@ -0,0 +1,12 @@
+diff --git a/lib/libc/Makefile b/lib/libc/Makefile
+index 4bb4b67fcbb..1c8a8e08e60 100644
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -6,7 +6,6 @@
+ .include <bsd.own.mk>
+
+ LIB=c
+-LIBREBUILD=y
+ CLEANFILES+=tags Symbols.map
+ CFLAGS+=-Wimplicit
+ #CFLAGS+=-Werror
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libc/netbsd-make-to-lower.patch b/pkgs/os-specific/bsd/openbsd/pkgs/libc/netbsd-make-to-lower.patch
new file mode 100644
index 0000000000000..e8d016ceead5a
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libc/netbsd-make-to-lower.patch
@@ -0,0 +1,16 @@
+NetBSD's make uses `${variable:tl}` not `${variable:L}`.
+
+diff --git a/lib/libc/Makefile b/lib/libc/Makefile
+index 4bb4b67fcbb..ffb35c196ea 100644
+--- a/lib/libc/Makefile
++++ b/lib/libc/Makefile
+@@ -11,8 +11,8 @@ CLEANFILES+=tags Symbols.map
+ CFLAGS+=-Wimplicit
+ #CFLAGS+=-Werror
+ LDADD=-nostdlib
+-.if ${COMPILER_VERSION:L} == "clang"
++.if ${COMPILER_VERSION:tl} == "clang"
+ LDADD+=-lcompiler_rt
+ .else
+ LDADD+=-lgcc
+ .endif
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix
new file mode 100644
index 0000000000000..1a6b6d06a1936
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix
@@ -0,0 +1,121 @@
+{
+  lib,
+  crossLibcStdenv,
+  mkDerivation,
+  bsdSetupHook,
+  openbsdSetupHook,
+  makeMinimal,
+  install,
+  flex,
+  byacc,
+  gencat,
+  rpcgen,
+  csu,
+  include,
+  ctags,
+  tsort,
+  llvmPackages,
+  fetchpatch,
+}:
+
+mkDerivation {
+  noLibc = true;
+  pname = "libc";
+  path = "lib/libc";
+  extraPaths = [
+    "lib/csu/os-note-elf.h"
+    "sys/arch"
+
+    "lib/libm"
+    "lib/libpthread"
+    "lib/librpcsvc"
+    "lib/librpcsvc"
+    "lib/librthread"
+    "lib/libutil"
+  ];
+
+  patches = [
+    ./netbsd-make-to-lower.patch
+    ./disable-librebuild.patch
+    (fetchpatch {
+      url = "https://marc.info/?l=openbsd-tech&m=171575286706032&q=raw";
+      sha256 = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    bsdSetupHook
+    openbsdSetupHook
+    makeMinimal
+    install
+    flex
+    byacc
+    gencat
+    rpcgen
+    ctags
+    tsort
+  ];
+
+  buildInputs = [
+    include
+    csu
+  ];
+
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
+    "-B${csu}/lib"
+    "-Wno-error"
+  ];
+
+  # Suppress lld >= 16 undefined version errors
+  # https://github.com/freebsd/freebsd-src/commit/2ba84b4bcdd6012e8cfbf8a0d060a4438623a638
+  env.NIX_LDFLAGS = lib.optionalString (
+    crossLibcStdenv.hostPlatform.linker == "lld"
+  ) "--undefined-version";
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "COMPILER_VERSION=clang"
+    "LIBC_TAGS=no"
+  ];
+
+  postInstall = ''
+    symlink_so () {
+      pushd $out/lib
+      ln -s "lib$1".so.* "lib$1.so"
+      popd
+    }
+
+    symlink_so c
+
+    pushd ${include}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+    substituteInPlace $out/include/sys/time.h --replace "defined (_LIBC)" "true"
+
+    pushd ${csu}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    NIX_CFLAGS_COMPILE+=" -B$out/lib"
+    NIX_CFLAGS_COMPILE+=" -I$out/include"
+    NIX_LDFLAGS+=" -L$out/lib"
+
+    make -C $BSDSRCDIR/lib/libm $makeFlags
+    make -C $BSDSRCDIR/lib/libm $makeFlags install
+    symlink_so m
+
+    make -C $BSDSRCDIR/lib/librthread $makeFlags
+    make -C $BSDSRCDIR/lib/librthread $makeFlags install
+    symlink_so pthread
+
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+    symlink_so rpcsv
+
+    make -C $BSDSRCDIR/lib/libutil $makeFlags
+    make -C $BSDSRCDIR/lib/libutil $makeFlags install
+    symlink_so util
+  '';
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix
new file mode 100644
index 0000000000000..c923a84317682
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  mkDerivation,
+  bsdSetupHook,
+  openbsdSetupHook,
+  makeMinimal,
+  install,
+}:
+
+mkDerivation {
+  noCC = true;
+  path = "usr.bin/lorder";
+  nativeBuildInputs = [
+    bsdSetupHook
+    openbsdSetupHook
+    makeMinimal
+    install
+  ];
+
+  meta.platforms = lib.platforms.unix;
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/netbsd-make-sinclude.patch b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/netbsd-make-sinclude.patch
new file mode 100644
index 0000000000000..daaaff56e9b7d
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/netbsd-make-sinclude.patch
@@ -0,0 +1,15 @@
+NetBSD make prefers `.-include` to `sinclude` (without a dot)
+
+diff --git a/share/mk/bsd.dep.mk b/share/mk/bsd.dep.mk
+index 7019adb57f7..277064eb5c2 100644
+--- a/share/mk/bsd.dep.mk
++++ b/share/mk/bsd.dep.mk
+@@ -11,7 +11,7 @@ depend:
+ # catch22: don't include potentially bogus files we are going to clean
+ .  if !(make(clean) || make(cleandir) || make(obj))
+ .    for o in ${DEPS}
+-       sinclude $o
++.      -include "$o"
+ .    endfor
+ .  endif
+ .endif
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
new file mode 100644
index 0000000000000..fefa1136eb76d
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
@@ -0,0 +1,35 @@
+{
+  fetchpatch,
+  lib,
+  mkDerivation,
+}:
+
+mkDerivation {
+  path = "share/mk";
+  noCC = true;
+
+  buildInputs = [ ];
+  nativeBuildInputs = [ ];
+
+  dontBuild = true;
+
+  patches = [
+    (fetchpatch {
+      url = "https://marc.info/?l=openbsd-tech&m=171575284906018&q=raw";
+      sha256 = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";
+    })
+    ./netbsd-make-sinclude.patch
+  ];
+
+  postPatch = ''
+    sed -i -E \
+      -e 's|/usr/lib|\$\{LIBDIR\}|' \
+      share/mk/bsd.prog.mk
+  '';
+
+  installPhase = ''
+    cp -r share/mk $out
+  '';
+
+  meta.platforms = lib.platforms.unix;
+}
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
new file mode 100644
index 0000000000000..371c6c58b91fb
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
@@ -0,0 +1,98 @@
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  crossLibcStdenv,
+  runCommand,
+  rsync,
+  source,
+  bsdSetupHook,
+  openbsdSetupHook,
+  makeMinimal,
+  install,
+}:
+
+lib.makeOverridable (
+  attrs:
+  let
+    stdenv' =
+      if attrs.noCC or false then
+        stdenvNoCC
+      else if attrs.noLibc or false then
+        crossLibcStdenv
+      else
+        stdenv;
+  in
+  stdenv'.mkDerivation (
+    rec {
+      pname = "${attrs.pname or (baseNameOf attrs.path)}-openbsd";
+      version = "0";
+      src = runCommand "${pname}-filtered-src" { nativeBuildInputs = [ rsync ]; } ''
+        for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [ ])}; do
+          set -x
+          path="$out/$p"
+          mkdir -p "$(dirname "$path")"
+          src_path="${source}/$p"
+          if [[ -d "$src_path" ]]; then src_path+=/; fi
+          rsync --chmod="+w" -r "$src_path" "$path"
+          set +x
+        done
+      '';
+
+      extraPaths = [ ];
+
+      nativeBuildInputs = [
+        bsdSetupHook
+        openbsdSetupHook
+        makeMinimal
+        install
+      ];
+
+      HOST_SH = stdenv'.shell;
+
+      makeFlags = [
+        "STRIP=-s" # flag to install, not command
+        "-B"
+      ];
+
+      MACHINE_ARCH =
+        {
+          # amd64 not x86_64 for this on unlike NetBSD
+          x86_64 = "amd64";
+          aarch64 = "arm64";
+          i486 = "i386";
+          i586 = "i386";
+          i686 = "i386";
+        }
+        .${stdenv'.hostPlatform.parsed.cpu.name} or stdenv'.hostPlatform.parsed.cpu.name;
+
+      MACHINE = MACHINE_ARCH;
+
+      MACHINE_CPU = MACHINE_ARCH;
+
+      MACHINE_CPUARCH = MACHINE_ARCH;
+
+      COMPONENT_PATH = attrs.path or null;
+
+      strictDeps = true;
+
+      meta = with lib; {
+        maintainers = with maintainers; [ ericson2314 ];
+        platforms = platforms.openbsd;
+        license = licenses.bsd2;
+      };
+    }
+    // lib.optionalAttrs stdenv'.hasCC {
+      # TODO should CC wrapper set this?
+      CPP = "${stdenv'.cc.targetPrefix}cpp";
+
+      # Since STRIP in `makeFlags` has to be a flag, not the binary itself
+      STRIPBIN = "${stdenv'.cc.bintools.targetPrefix}strip";
+    }
+    // lib.optionalAttrs (attrs.headersOnly or false) {
+      installPhase = "includesPhase";
+      dontBuild = true;
+    }
+    // attrs
+  )
+)
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/package.nix
new file mode 100644
index 0000000000000..61147954812fd
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/package.nix
@@ -0,0 +1,3 @@
+{ makeSetupHook }:
+
+makeSetupHook { name = "openbsd-setup-hook"; } ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/setup-hook.sh b/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/setup-hook.sh
new file mode 100644
index 0000000000000..50e79bc2928a9
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/openbsdSetupHook/setup-hook.sh
@@ -0,0 +1,21 @@
+addOpenBSDMakeFlags() {
+  makeFlags="INCSDIR=${!outputDev}/include $makeFlags"
+  makeFlags="MANDIR=${!outputMan}/share/man $makeFlags"
+}
+
+fixOpenBSDInstallDirs() {
+  find "$BSDSRCDIR" -name Makefile -exec \
+    sed -i -E \
+      -e 's|/usr/include|${INCSDIR}|' \
+      -e 's|/usr/bin|${BINDIR}|' \
+      -e 's|/usr/lib|${LIBDIR}|' \
+      {} \;
+}
+
+setBinownBingrp() {
+  export BINOWN=$(id -u)
+  export BINGRP=$(id -g)
+}
+
+preConfigureHooks+=(addOpenBSDMakeFlags)
+postPatchHooks+=(fixOpenBSDInstallDirs setBinownBingrp)
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/source.nix b/pkgs/os-specific/bsd/openbsd/pkgs/source.nix
new file mode 100644
index 0000000000000..359c3f2fbc919
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/source.nix
@@ -0,0 +1,8 @@
+{ fetchcvs }:
+
+fetchcvs {
+  cvsRoot = "anoncvs@anoncvs.fr.openbsd.org/cvs";
+  module = "src";
+  tag = "OPENBSD_7_5";
+  sha256 = "sha256-hzdATew6h/FQV72SWtg3YvUXdPoGjm2SoUS7m3c3fSU=";
+}
diff --git a/pkgs/os-specific/bsd/setup-hook.sh b/pkgs/os-specific/bsd/setup-hook.sh
index e0afefcd73f71..f9453708ab5db 100644
--- a/pkgs/os-specific/bsd/setup-hook.sh
+++ b/pkgs/os-specific/bsd/setup-hook.sh
@@ -49,7 +49,6 @@ addMakeFlags() {
   makeFlags="LIBDIR=${!outputLib}/lib $makeFlags"
   makeFlags="SHLIBDIR=${!outputLib}/lib $makeFlags"
   makeFlags="SHAREDIR=${!outputLib}/share $makeFlags"
-  makeFlags="MANDIR=${!outputMan}/share/man $makeFlags"
   makeFlags="INFODIR=${!outputInfo}/share/info $makeFlags"
   makeFlags="DOCDIR=${!outputDoc}/share/doc $makeFlags"
   makeFlags="LOCALEDIR=${!outputLib}/share/locale $makeFlags"
diff --git a/pkgs/os-specific/darwin/apparency/default.nix b/pkgs/os-specific/darwin/apparency/default.nix
index 0bae99c14b37e..d5f9a7be172b1 100644
--- a/pkgs/os-specific/darwin/apparency/default.nix
+++ b/pkgs/os-specific/darwin/apparency/default.nix
@@ -4,13 +4,18 @@
 , undmg
 }:
 
+let
+  snapshot = "20240601172844";
+in
 stdenv.mkDerivation {
   pname = "apparency";
-  version = "1.5.1";
+  version = "2.0";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20230815073821/https://www.mothersruin.com/software/downloads/Apparency.dmg";
-    hash = "sha256-JpaBdlt8kTNFzK/yZVZ+ZFJ3DnPQbogJC7QBmtSVkoQ=";
+   # Use externally archived download URL because
+   # upstream does not provide stable URLs for versioned releases
+    url = "https://web.archive.org/web/${snapshot}/https://www.mothersruin.com/software/downloads/Apparency.dmg";
+    hash = "sha256-XKxWxqfxy9AQneILLrN9XqLt4/k2N8yumZ5mrSvczFk=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -28,7 +33,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    description = "The App That Opens Apps";
+    description = "App That Opens Apps";
     homepage = "https://www.mothersruin.com/software/Apparency/";
     license = lib.licenses.unfreeRedistributable;
     maintainers = with lib.maintainers; [ Enzime ];
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 87fb8512fb646..206f46125b9bf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -167,7 +167,7 @@ appleDerivation' stdenv {
   appleHeaders = builtins.readFile ./headers.txt;
 
   meta = with lib; {
-    description = "The Mac OS libc/libSystem (tapi library with pure headers)";
+    description = "Mac OS libc/libSystem (tapi library with pure headers)";
     maintainers = with maintainers; [ copumpkin gridaphobe ];
     platforms   = platforms.darwin;
     license     = licenses.apple-psl20;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 1bd574fe46a49..3eae8749c4e4d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -11,7 +11,6 @@ let
     };
     "osx-10.12.6" = {
       xnu           = "3789.70.16";
-      libiconv      = "50";
       Libnotify     = "165.20.1";
       objc4         = "709.1";
       dyld          = "433.5";
@@ -38,7 +37,6 @@ let
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
-      libiconv      = "44";
       Libnotify     = "150.40.1";
       objc4         = "680";
       eap8021x      = "222.40.1";
@@ -106,7 +104,6 @@ let
     };
     "osx-10.9.5" = {
       launchd            = "842.92.1";
-      libauto            = "185.5";
       Libc               = "997.90.3"; # We use this, but not from here
       Libsystem          = "1197.1.1";
       Security           = "55471.14.18";
@@ -229,7 +226,7 @@ let
       pname = builtins.head (lib.splitString "/" namePath);
       appleDerivation' = stdenv: appleDerivation'' stdenv pname version sdkName sha256;
       appleDerivation = appleDerivation' stdenv;
-      callPackage = self.newScope { inherit appleDerivation' appleDerivation; };
+      callPackage = self.newScope { inherit appleDerivation' appleDerivation; python3 = pkgs.buildPackages.python3Minimal; };
     in callPackage (./. + "/${namePath}");
 
   applePackage = namePath: sdkName: sha256: let
@@ -261,7 +258,6 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "sha256-54P3+YhVhOanoZQoqswDnr/GbR/AdEERse135nyuIQo=" {};
     IOKit           = applePackage "IOKit"             "osx-10.11.6"     "" { inherit IOKitSrcs; };
     launchd         = applePackage "launchd"           "osx-10.9.5"      "sha256-dmV0UK7hG9wvTr+F4Z47nCFXcVZCV+cQ46WbE0DBtJs=" {};
-    libauto         = applePackage "libauto"           "osx-10.9.5"      "sha256-GnRcKq8jRbEsI/PSDphwUjWtpEIEcnLlQL9yxYLgSsU=" {};
     Libc            = applePackage "Libc"              "osx-10.12.6"     "sha256-LSsL7S3KFgGU9qjK4atu/4wBh8ftgfsk6JOvg+ZTZOY=" {
       Libc_10-9 = fetchFromGitHub {
         owner  = "apple-oss-distributions";
@@ -272,7 +268,6 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     };
     libclosure      = applePackage "libclosure"        "osx-10.11.6"     "sha256-L5rQ+UBpf3B+W1U+gZKk7fXulslHsc8lxnCsplV+nr0=" {};
     libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "sha256-jfAEk0OLrJa9AIZVikIoHomd+l+4rCfc320Xh50qK5M=" {};
-    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "sha256-ZzPFkchK3EU95UQUVVrR0t8iilhi/VnIkjjtP6KT2oI=" {};
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
     Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
@@ -292,9 +287,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     ppp             = applePackage "ppp"               "osx-10.12.6"     "sha256-M1zoEjjeKIDUEP6ACbpUJk3OXjobw4g/qzUmxGdX1J0=" {};
     removefile      = applePackage "removefile"        "osx-10.12.6"     "sha256-UpNk27kGXnZss1ZXWVJU9jLz/NW63ZAZEDLhyCYoi9M=" {};
     xnu             = if stdenv.isx86_64 then
-    applePackage "xnu"               "osx-10.12.6"     "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {
-      python3 = pkgs.buildPackages.buildPackages.python3; # TODO(@Ericson2314) this shouldn't be needed.
-    }
+      applePackage "xnu" "osx-10.12.6" "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {}
     else macosPackages_11_0_1.xnu;
     hfs             = applePackage "hfs"               "osx-10.12.6"     "sha256-eGi18HQFJrU5UHoBOE0LqO5gQ0xOf8+OJuAWQljfKE4=" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "sha256-YHbGws901xONzAbo6sB5zSea4Wp0sgYUJ8YgwVfWxnE=" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index e4431c68c9aad..b642b993df0e3 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -1,5 +1,5 @@
 { lib, appleDerivation, xcbuildHook, Libc, stdenv, macosPackages_11_0_1, xnu
-, fetchurl, libutil }:
+, libutil }:
 
 let
   xnu-src = if stdenv.isAarch64 then macosPackages_11_0_1.xnu.src else xnu.src;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h b/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h
deleted file mode 100644
index bf367a3cabb3f..0000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Generated by dtrace(1M).
- */
-
-#ifndef _AUTO_DTRACE_H
-#define _AUTO_DTRACE_H
-
-#include <unistd.h>
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-#define GARBAGE_COLLECTION_STABILITY "___dtrace_stability$garbage_collection$v1$1_1_0_1_1_0_1_1_0_1_1_0_1_1_0"
-
-#define GARBAGE_COLLECTION_TYPEDEFS "___dtrace_typedefs$garbage_collection$v2$6175746f5f636f6c6c656374696f6e5f70686173655f74$6175746f5f636f6c6c656374696f6e5f747970655f74$6d616c6c6f635f7a6f6e655f74"
-
-#if !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED
-
-#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY(arg0, arg1) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$auto_block_lost_thread_locality$v1$766f6964202a$75696e7436345f74(arg0, arg1); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$auto_block_lost_thread_locality$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION(arg0) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$auto_refcount_one_allocation$v1$75696e7436345f74(arg0); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$auto_refcount_one_allocation$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-#define GARBAGE_COLLECTION_COLLECTION_BEGIN(arg0, arg1) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$collection_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f747970655f74(arg0, arg1); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_COLLECTION_BEGIN_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$collection_begin$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-#define GARBAGE_COLLECTION_COLLECTION_END(arg0, arg1, arg2, arg3, arg4) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$collection_end$v1$6d616c6c6f635f7a6f6e655f74202a$75696e7436345f74$75696e7436345f74$75696e7436345f74$75696e7436345f74(arg0, arg1, arg2, arg3, arg4); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_COLLECTION_END_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$collection_end$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN(arg0, arg1) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$collection_phase_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74(arg0, arg1); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$collection_phase_begin$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_END(arg0, arg1, arg2, arg3) \
-do { \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
-  __dtrace_probe$garbage_collection$collection_phase_end$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74$75696e7436345f74$75696e7436345f74(arg0, arg1, arg2, arg3); \
-  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
-} while (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_END_ENABLED() \
-  ({ int _r = __dtrace_isenabled$garbage_collection$collection_phase_end$v1(); \
-    __asm__ volatile(""); \
-    _r; })
-
-
-extern void __dtrace_probe$garbage_collection$auto_block_lost_thread_locality$v1$766f6964202a$75696e7436345f74(const void *, uint64_t);
-extern int __dtrace_isenabled$garbage_collection$auto_block_lost_thread_locality$v1(void);
-extern void __dtrace_probe$garbage_collection$auto_refcount_one_allocation$v1$75696e7436345f74(uint64_t);
-extern int __dtrace_isenabled$garbage_collection$auto_refcount_one_allocation$v1(void);
-extern void __dtrace_probe$garbage_collection$collection_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f747970655f74(const malloc_zone_t *, auto_collection_type_t);
-extern int __dtrace_isenabled$garbage_collection$collection_begin$v1(void);
-extern void __dtrace_probe$garbage_collection$collection_end$v1$6d616c6c6f635f7a6f6e655f74202a$75696e7436345f74$75696e7436345f74$75696e7436345f74$75696e7436345f74(const malloc_zone_t *, uint64_t, uint64_t, uint64_t, uint64_t);
-extern int __dtrace_isenabled$garbage_collection$collection_end$v1(void);
-extern void __dtrace_probe$garbage_collection$collection_phase_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74(const malloc_zone_t *, auto_collection_phase_t);
-extern int __dtrace_isenabled$garbage_collection$collection_phase_begin$v1(void);
-extern void __dtrace_probe$garbage_collection$collection_phase_end$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74$75696e7436345f74$75696e7436345f74(const malloc_zone_t *, auto_collection_phase_t, uint64_t, uint64_t);
-extern int __dtrace_isenabled$garbage_collection$collection_phase_end$v1(void);
-
-#else
-
-#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY(arg0, arg1) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY_ENABLED() (0)
-#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION(arg0) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION_ENABLED() (0)
-#define GARBAGE_COLLECTION_COLLECTION_BEGIN(arg0, arg1) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_COLLECTION_BEGIN_ENABLED() (0)
-#define GARBAGE_COLLECTION_COLLECTION_END(arg0, arg1, arg2, arg3, arg4) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_COLLECTION_END_ENABLED() (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN(arg0, arg1) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN_ENABLED() (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_END(arg0, arg1, arg2, arg3) \
-do { \
-  } while (0)
-#define GARBAGE_COLLECTION_COLLECTION_PHASE_END_ENABLED() (0)
-
-#endif /* !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED */
-
-
-#ifdef  __cplusplus
-}
-#endif
-
-#endif  /* _AUTO_DTRACE_H */
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
deleted file mode 100644
index 8a551dcc892ca..0000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ lib, stdenv, appleDerivation, libdispatch, Libsystem }:
-
-appleDerivation {
-  # these are included in the pure libc
-  buildInputs = lib.optionals stdenv.cc.nativeLibc [ libdispatch Libsystem ];
-
-  buildPhase = ''
-    cp ${./auto_dtrace.h} ./auto_dtrace.h
-
-    substituteInPlace ThreadLocalCollector.h --replace SubZone.h Subzone.h
-
-    substituteInPlace auto_zone.cpp \
-      --replace "#include <msgtracer_client.h>" ''$'#include <asl.h>\nstatic void msgtracer_log_with_keys(...) { };'
-
-    substituteInPlace Definitions.h \
-      --replace "#include <System/pthread_machdep.h>" "" \
-      --replace 'void * const, void * const' 'void * const, void *'
-
-    # getspecific_direct is more efficient, but this should be equivalent...
-    substituteInPlace Zone.h \
-      --replace "_pthread_getspecific_direct" "pthread_getspecific" \
-      --replace "_pthread_has_direct_tsd()" "0" \
-      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
-      --replace "__PTK_FRAMEWORK_GC_KEY1" "111" \
-      --replace "__PTK_FRAMEWORK_GC_KEY2" "112" \
-      --replace "__PTK_FRAMEWORK_GC_KEY3" "113" \
-      --replace "__PTK_FRAMEWORK_GC_KEY4" "114" \
-      --replace "__PTK_FRAMEWORK_GC_KEY5" "115" \
-      --replace "__PTK_FRAMEWORK_GC_KEY6" "116" \
-      --replace "__PTK_FRAMEWORK_GC_KEY7" "117" \
-      --replace "__PTK_FRAMEWORK_GC_KEY8" "118" \
-      --replace "__PTK_FRAMEWORK_GC_KEY9" "119"
-
-    substituteInPlace auto_zone.cpp \
-      --replace "__PTK_FRAMEWORK_GC_KEY9" "119" \
-      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
-
-    substituteInPlace Zone.cpp \
-      --replace "_pthread_getspecific_direct" "pthread_getspecific" \
-      --replace "__PTK_FRAMEWORK_GC_KEY9" "119" \
-      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
-      --replace "__PTK_LIBDISPATCH_KEY0"  "20" \
-      --replace "struct auto_zone_cursor {" ''$'extern "C" int pthread_key_init_np(int, void (*)(void *));\nstruct auto_zone_cursor {'
-
-    substituteInPlace auto_impl_utilities.c \
-      --replace "#   include <CrashReporterClient.h>" "void CRSetCrashLogMessage(void *msg) { };"
-
-    c++ -I. -O3 -c -Wno-c++11-extensions auto_zone.cpp
-    cc  -I. -O3 -Iauto_tester -c auto_impl_utilities.c
-    c++ -I. -O3 -c auto_weak.cpp
-    c++ -I. -O3 -c Admin.cpp
-    c++ -I. -O3 -c Bitmap.cpp
-    c++ -I. -O3 -c Definitions.cpp
-    c++ -I. -O3 -c Environment.cpp
-    c++ -I. -O3 -c Large.cpp
-    c++ -I. -O3 -c Region.cpp
-    c++ -I. -O3 -c Subzone.cpp
-    c++ -I. -O3 -c WriteBarrier.cpp
-    c++ -I. -O3 -c Zone.cpp
-    c++ -I. -O3 -c Thread.cpp
-    c++ -I. -O3 -c InUseEnumerator.cpp
-    c++ -I. -O3 -c auto_gdb_interface.cpp
-    c++ -I. -O3 -c PointerHash.cpp
-    c++ -I. -O3 -c ThreadLocalCollector.cpp
-    c++ -I. -O3 -c ZoneDump.cpp
-    c++ -I. -O3 -c ZoneCollectors.cpp
-    c++ -I. -O3 -c SubzonePartition.cpp
-    c++ -I. -O3 -c ZoneCollectionChecking.cpp
-    c++ -I. -O3 -c ZoneCompaction.cpp
-    c++ -I. -O3 -c BlockRef.cpp
-
-    c++ -Wl,-no_dtrace_dof --stdlib=libc++ -dynamiclib -install_name $out/lib/libauto.dylib -o libauto.dylib *.o
-  '';
-
-  installPhase = ''
-    mkdir -p $out/lib $out/include
-    cp auto_zone.h auto_weak.h auto_tester/auto_tester.h auto_gdb_interface.h $out/include
-    cp libauto.dylib $out/lib
-  '';
-
-  meta = {
-    # libauto is only used by objc4/pure.nix , but objc4 is now using the impure approach, so we don't bother to fix this.
-    broken = true;
-    platforms = lib.platforms.darwin;
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
deleted file mode 100644
index 6a3bddc211e95..0000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ stdenv, appleDerivation, lib
-, enableStatic ? stdenv.hostPlatform.isStatic
-, enableShared ? !stdenv.hostPlatform.isStatic
-}:
-
-appleDerivation {
-  postUnpack = "sourceRoot=$sourceRoot/libiconv";
-
-  preConfigure = lib.optionalString stdenv.hostPlatform.isiOS ''
-    sed -i 's/darwin\*/ios\*/g' configure libcharset/configure
-  '';
-
-  configureFlags = [
-    (lib.enableFeature enableStatic "static")
-    (lib.enableFeature enableShared "shared")
-  ];
-
-  postInstall = lib.optionalString enableShared ''
-    mv $out/lib/libiconv.dylib $out/lib/libiconv-nocharset.dylib
-    ${stdenv.cc.bintools.targetPrefix}install_name_tool -id $out/lib/libiconv-nocharset.dylib $out/lib/libiconv-nocharset.dylib
-
-    # re-export one useless symbol; ld will reject a dylib that only reexports other dylibs
-    echo 'void dont_use_this(){}' | ${stdenv.cc.bintools.targetPrefix}clang -dynamiclib -x c - -current_version 2.4.0 \
-      -compatibility_version 7.0.0 -current_version 7.0.0 -o $out/lib/libiconv.dylib \
-      -Wl,-reexport_library -Wl,$out/lib/libiconv-nocharset.dylib \
-      -Wl,-reexport_library -Wl,$out/lib/libcharset.dylib
-  '';
-
-  setupHooks = [
-    ../../../../build-support/setup-hooks/role.bash
-    ../../../../development/libraries/libiconv/setup-hook.sh
-  ];
-
-  meta = {
-    mainProgram = "iconv";
-    platforms = lib.platforms.darwin;
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
index b4a7bbc4df243..2de90a0236761 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
@@ -27,7 +27,6 @@ file_cmds = applePackage' "file_cmds" "321.40.3" "macos-11.0.1" "0p077lnbcy8266m
 hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "0a0s6b12b0q07wslfifna0bj51dml9v098i4crr2m1vivnx4xj75" {};
 libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "0vf9n0k3m8dbprv1bf45zqg0g43bidy2i5z1v9a826bsf8lv7am7" {};
 libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "1ck5srcjapg18vqb8wl08gacs7ndc6xr067qjn3ngx39q1jdcywz" {};
-libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0lwa4brdwm4lvrdnxylzsn1yph4m7csgri2zkc4xb4xiisz32pwp" {};
 libmalloc = applePackage' "libmalloc" "317.40.8" "macos-11.0.1" "sha256-Tdhb0mq3w4Hwvp3xHB79Vr22hCOQK6h28HCsd7jvITI=" {};
 libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1qf3ri0yd8b1xjln1j1gyx7ks6k3a2jhd63blyvfby75y9s7flky" {};
 libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "0zljbw8mpb80n1if65hhi9lkgwbgjr8vc9wvf7q1nl3mzyl35f8p" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix
deleted file mode 100644
index 6a0c819a0a31a..0000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ stdenv, fetchapplesource, libauto, launchd, libc_old, libunwind }:
-
-stdenv.mkDerivation rec {
-  version = "551.1";
-  pname = "objc4";
-
-  src = fetchapplesource {
-    inherit version;
-    name   = "objc4";
-    sha256 = "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg";
-  };
-
-  patches = [ ./spinlocks.patch ];
-
-  buildInputs = [ libauto launchd libc_old libunwind ];
-
-  buildPhase = ''
-    cp ${./objc-probes.h} runtime/objc-probes.h
-
-    mkdir -p build/include/objc
-
-    cp runtime/hashtable.h               build/include/objc/hashtable.h
-    cp runtime/OldClasses.subproj/List.h build/include/objc/List.h
-    cp runtime/hashtable2.h              build/include/objc/hashtable2.h
-    cp runtime/message.h                 build/include/objc/message.h
-    cp runtime/objc-api.h                build/include/objc/objc-api.h
-    cp runtime/objc-auto.h               build/include/objc/objc-auto.h
-    cp runtime/objc-class.h              build/include/objc/objc-class.h
-    cp runtime/objc-exception.h          build/include/objc/objc-exception.h
-    cp runtime/objc-load.h               build/include/objc/objc-load.h
-    cp runtime/objc-sync.h               build/include/objc/objc-sync.h
-    cp runtime/objc.h                    build/include/objc/objc.h
-    cp runtime/objc-runtime.h            build/include/objc/objc-runtime.h
-    cp runtime/Object.h                  build/include/objc/Object.h
-    cp runtime/Protocol.h                build/include/objc/Protocol.h
-    cp runtime/runtime.h                 build/include/objc/runtime.h
-    cp runtime/NSObject.h                build/include/objc/NSObject.h
-    cp runtime/NSObjCRuntime.h           build/include/objc/NSObjCRuntime.h
-
-    # These would normally be in local/include but we don't do local, so they're
-    # going in with the others
-    cp runtime/maptable.h                build/include/objc/maptable.h
-    cp runtime/objc-abi.h                build/include/objc/objc-abi.h
-    cp runtime/objc-auto-dump.h          build/include/objc/objc-auto-dump.h
-    cp runtime/objc-gdb.h                build/include/objc/objc-gdb.h
-    cp runtime/objc-internal.h           build/include/objc/objc-internal.h
-
-    cc -o markgc markgc.c
-
-    FLAGS="-Wno-deprecated-register -Wno-unknown-pragmas -Wno-deprecated-objc-isa-usage -Wno-invalid-offsetof -Wno-inline-new-delete  -Wno-cast-of-sel-type -Iruntime -Ibuild/include -Iruntime/Accessors.subproj -D_LIBCPP_VISIBLE= -DOS_OBJECT_USE_OBJC=0 -DNDEBUG=1"
-
-    cc -std=gnu++11 $FLAGS -c runtime/hashtable2.mm
-    cc -std=gnu++11 $FLAGS -c runtime/maptable.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-auto.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-cache.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-class-old.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-class.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-errors.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-exception.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-file.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-initialize.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-layout.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-load.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-loadmethod.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-lockdebug.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime-new.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime-old.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-sel-set.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-sel.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-sync.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-typeencoding.mm
-    cc -std=gnu++11 $FLAGS -c runtime/Object.mm
-    cc -std=gnu++11 $FLAGS -c runtime/Protocol.mm
-
-    cc -std=gnu++11 $FLAGS -c runtime/objc-references.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-os.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-auto-dump.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-file-old.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-block-trampolines.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-externalref.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-weak.mm
-    cc -std=gnu++11 $FLAGS -c runtime/NSObject.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-opt.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-cache-old.mm
-    cc -std=gnu++11 $FLAGS -c runtime/objc-sel-old.mm
-
-    cc -std=gnu++11 $FLAGS -c runtime/Accessors.subproj/objc-accessors.mm
-
-    cc $FLAGS -c runtime/objc-sel-table.s
-
-    cc $FLAGS -c runtime/OldClasses.subproj/List.m
-    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-arm.s
-    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-i386.s
-    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-x86_64.s
-    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-simulator-i386.s
-
-    cc $FLAGS -c runtime/a1a2-blocktramps-i386.s
-    cc $FLAGS -c runtime/a2a3-blocktramps-i386.s
-
-    cc $FLAGS -c runtime/a1a2-blocktramps-x86_64.s
-    cc $FLAGS -c runtime/a2a3-blocktramps-x86_64.s
-
-    cc $FLAGS -c runtime/a1a2-blocktramps-arm.s
-    cc $FLAGS -c runtime/a2a3-blocktramps-arm.s
-
-    c++ -Wl,-no_dtrace_dof --stdlib=libc++ -dynamiclib -lauto -install_name $out/lib/libobjc.dylib -o libobjc.dylib *.o
-
-    ./markgc -p libobjc.dylib
-  '';
-
-  installPhase = ''
-    mkdir -p $out/include $out/lib
-
-    mv build/include/objc $out/include
-    mv libobjc.dylib $out/lib
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build
index de73e88f5d4d3..af08b5074bef1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build
@@ -88,6 +88,7 @@ install_man('accton/accton.8')
 executable(
     'arch',
     build_by_default : sdk_version.version_compare('>=11'),
+    dependencies : [ core_foundation ],
     install : sdk_version.version_compare('>=11'),
     sources : 'arch/arch.c'
 )
@@ -145,7 +146,7 @@ install_man('chkpasswd/chkpasswd.8')
 
 executable(
     'chpass',
-    dependencies : [ cfopen_directory, directory_service, open_directory ],
+    dependencies : [ core_foundation, cfopen_directory, directory_service, open_directory ],
     install : true,
     sources : [
         'chpass/chpass.c',
@@ -358,7 +359,7 @@ install_man(
 executable(
     'nvram',
     c_args : '-DTARGET_OS_BRIDGE=0',
-    dependencies : [ iokit, libc_private, xnu_private ],
+    dependencies : [ core_foundation, iokit, libc_private, xnu_private ],
     install : true,
     sources : 'nvram/nvram.c'
 )
@@ -377,7 +378,7 @@ install_man('pagesize/pagesize.1')
 
 executable(
     'passwd',
-    dependencies : [ cfopen_directory, directory_service, open_directory, pam ],
+    dependencies : [ core_foundation, cfopen_directory, directory_service, open_directory, pam ],
     install : true,
     sources : [
         'passwd/file_passwd.c',
@@ -521,7 +522,7 @@ executable(
     'zlog',
     build_by_default : sdk_version.version_compare('>=11'),
     c_args : '-DKERN_NOT_FOUND=56',
-    dependencies : core_symbolication,
+    dependencies : [ core_foundation, core_symbolication ],
     install : sdk_version.version_compare('>=11'),
     sources : [
         'zlog/SymbolicationHelper.c',
diff --git a/pkgs/os-specific/darwin/bartender/default.nix b/pkgs/os-specific/darwin/bartender/default.nix
index 011a356e54124..3650d0dcaf3cf 100644
--- a/pkgs/os-specific/darwin/bartender/default.nix
+++ b/pkgs/os-specific/darwin/bartender/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bartender";
-  version = "5.0.49";
+  version = "5.0.52";
 
   src = fetchurl {
     name = "Bartender ${lib.versions.major finalAttrs.version}.dmg";
     url = "https://www.macbartender.com/B2/updates/${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}/Bartender%20${lib.versions.major finalAttrs.version}.dmg";
-    hash = "sha256-DOQLtdbwYFyRri3GBdjLfFNII65QJMvAQu9Be4ATBx0=";
+    hash = "sha256-gKsDD/4z397ZpT+8xu7BI1c9r+nledzrPfD/ACexFvQ=";
   };
 
   dontPatch = true;
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Take control of your menu bar";
     longDescription = ''
       Bartender is an award-winning app for macOS that superpowers your menu bar, giving you total control over your menu bar items, what's displayed, and when, with menu bar items only showing when you need them.
@@ -40,9 +40,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     homepage = "https://www.macbartender.com";
     changelog = "https://www.macbartender.com/Bartender${lib.versions.major finalAttrs.version}/release_notes/";
-    license = with licenses; [ unfree ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ stepbrobd ];
+    license = [ lib.licenses.unfree ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ stepbrobd ];
     platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
 })
diff --git a/pkgs/os-specific/darwin/coconutbattery/default.nix b/pkgs/os-specific/darwin/coconutbattery/default.nix
index 4850b2b4c04ed..d3e67c96cfddf 100644
--- a/pkgs/os-specific/darwin/coconutbattery/default.nix
+++ b/pkgs/os-specific/darwin/coconutbattery/default.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   meta = with lib; {
-    description = "The standard for battery reading since 2005";
+    description = "Standard for battery reading since 2005";
     longDescription = ''
       With coconutBattery you are always aware of your current battery health.
       It shows you live information about the battery quality in your Mac, iPhone and iPad.
diff --git a/pkgs/os-specific/darwin/dockutil/default.nix b/pkgs/os-specific/darwin/dockutil/default.nix
index 5e4187f07280f..64a8a98443886 100644
--- a/pkgs/os-specific/darwin/dockutil/default.nix
+++ b/pkgs/os-specific/darwin/dockutil/default.nix
@@ -1,37 +1,99 @@
-{ lib, stdenv, fetchurl, libarchive, p7zip }:
-stdenv.mkDerivation rec {
-  pname = "dockutil";
-  version = "3.0.2";
-
-  src = fetchurl {
-    url =
-      "https://github.com/kcrawford/dockutil/releases/download/${version}/dockutil-${version}.pkg";
-    sha256 = "175137ea747e83ed221d60b18b712b256ed31531534cde84f679487d337668fd";
-  };
-
-  dontBuild = true;
-
-  nativeBuildInputs = [ libarchive p7zip ];
+{ lib
+, stdenv
+, stdenvNoCC
+, fetchFromGitHub
+, fetchurl
+, swift
+, swiftpm
+, swiftpm2nix
+, swiftPackages
+, darwin
+, libarchive
+, p7zip
+# Building from source on x86_64 fails (among other things) due to:
+# error: cannot load underlying module for 'Darwin'
+, fromSource ? (stdenv.system != "x86_64-darwin")
+}:
 
-  unpackPhase = ''
-    7z x $src
-    bsdtar -xf Payload~
-  '';
+let
+  generated = swiftpm2nix.helpers ./generated;
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mkdir -p $out/usr/local/bin
-    install -Dm755 usr/local/bin/dockutil -t $out/usr/local/bin
-    ln -rs $out/usr/local/bin/dockutil $out/bin/dockutil
-    runHook postInstall
-  '';
+  pname = "dockutil";
+  version = "3.1.3";
 
   meta = with lib; {
     description = "Tool for managing dock items";
     homepage = "https://github.com/kcrawford/dockutil";
     license = licenses.asl20;
     maintainers = with maintainers; [ tboerger ];
+    mainProgram = "dockutil";
     platforms = platforms.darwin;
   };
-}
+
+  buildFromSource = swiftPackages.stdenv.mkDerivation (finalAttrs: {
+    inherit pname version meta;
+
+    src = fetchFromGitHub {
+      owner = "kcrawford";
+      repo = "dockutil";
+      rev = finalAttrs.version;
+      hash = "sha256-mmk4vVZhq4kt05nI/dDM1676FDWyf4wTSwY2YzqKsLU=";
+    };
+
+    postPatch = ''
+      # Patch sources so that they build with Swift CoreFoundation
+      # which differs ever so slightly from Apple's implementation.
+      substituteInPlace Sources/DockUtil/DockUtil.swift \
+        --replace-fail "URL(filePath:" \
+                       "URL(fileURLWithPath:" \
+        --replace-fail "path(percentEncoded: false)" \
+                       "path"
+    '';
+
+    nativeBuildInputs = [ swift swiftpm ];
+
+    buildInputs = with darwin.apple_sdk.frameworks; [ Cocoa ];
+
+    configurePhase = generated.configure;
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm755 .build/${stdenv.hostPlatform.darwinArch}-apple-macosx/release/dockutil -t $out/bin
+      runHook postInstall
+    '';
+  });
+
+  installBinary = stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit pname version;
+
+    src = fetchurl {
+      url = "https://github.com/kcrawford/dockutil/releases/download/${finalAttrs.version}/dockutil-${finalAttrs.version}.pkg";
+      hash = "sha256-9g24Jz/oDXxIJFiL7bU4pTh2dcORftsAENq59S0/JYI=";
+    };
+
+    dontPatch = true;
+    dontConfigure = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ libarchive p7zip ];
+
+    unpackPhase = ''
+      7z x $src
+      bsdtar -xf Payload~
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      install -Dm755 usr/local/bin/dockutil -t $out/bin
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    };
+  });
+in
+if fromSource
+  then buildFromSource
+  else installBinary
diff --git a/pkgs/os-specific/darwin/dockutil/generated/default.nix b/pkgs/os-specific/darwin/dockutil/generated/default.nix
new file mode 100644
index 0000000000000..32ffc68e4d2c9
--- /dev/null
+++ b/pkgs/os-specific/darwin/dockutil/generated/default.nix
@@ -0,0 +1,7 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "1fpdgivmwdszggvx0ligs3vidv9kpp9777v649hs8w7vpcifc2ji";
+  };
+}
diff --git a/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json b/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json
new file mode 100644
index 0000000000000..e24a74517af07
--- /dev/null
+++ b/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json
@@ -0,0 +1,25 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "82905286cc3f0fa8adc4674bf49437cab65a8373",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      }
+    ]
+  },
+  "version": 6
+}
diff --git a/pkgs/os-specific/darwin/duti/default.nix b/pkgs/os-specific/darwin/duti/default.nix
index db0b1e1dcbae1..033591c1fec35 100644
--- a/pkgs/os-specific/darwin/duti/default.nix
+++ b/pkgs/os-specific/darwin/duti/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "A command-line tool to select default applications for document types and URL schemes on Mac OS X";
+    description = "Command-line tool to select default applications for document types and URL schemes on Mac OS X";
     longDescription = ''
       duti is a command-line utility capable of setting default applications for
       various document types on Mac OS X, using Apple's Uniform Type Identifiers. A
diff --git a/pkgs/os-specific/darwin/iproute2mac/default.nix b/pkgs/os-specific/darwin/iproute2mac/default.nix
index a7f1f0b773d87..c7582de3352a1 100644
--- a/pkgs/os-specific/darwin/iproute2mac/default.nix
+++ b/pkgs/os-specific/darwin/iproute2mac/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/brona/iproute2mac";
-    description = "CLI wrapper for basic network utilites on Mac OS X inspired with iproute2 on Linux systems - ip command.";
+    description = "CLI wrapper for basic network utilites on Mac OS X inspired with iproute2 on Linux systems - ip command";
     license = licenses.mit;
     maintainers = with maintainers; [ jiegec ];
     platforms = platforms.darwin;
diff --git a/pkgs/os-specific/darwin/karabiner-elements/default.nix b/pkgs/os-specific/darwin/karabiner-elements/default.nix
index f42ce5b5be2fc..53847c75fccca 100644
--- a/pkgs/os-specific/darwin/karabiner-elements/default.nix
+++ b/pkgs/os-specific/darwin/karabiner-elements/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   passthru.updateScript = ./updater.sh;
 
   meta = with lib; {
-    description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later.";
+    description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later";
     homepage = "https://karabiner-elements.pqrs.org/";
     platforms = platforms.darwin;
     maintainers = with maintainers; [ Enzime ];
diff --git a/pkgs/os-specific/darwin/khd/default.nix b/pkgs/os-specific/darwin/khd/default.nix
index 87e1a8bf6ae6e..9c10dc89a69d3 100644
--- a/pkgs/os-specific/darwin/khd/default.nix
+++ b/pkgs/os-specific/darwin/khd/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A simple modal hotkey daemon for OSX";
+    description = "Simple modal hotkey daemon for OSX";
     homepage = "https://github.com/koekeishiya/khd";
     downloadPage = "https://github.com/koekeishiya/khd/releases";
     platforms = platforms.darwin;
diff --git a/pkgs/os-specific/darwin/macfuse/default.nix b/pkgs/os-specific/darwin/macfuse/default.nix
index c63b536f248b5..4de9600e79108 100644
--- a/pkgs/os-specific/darwin/macfuse/default.nix
+++ b/pkgs/os-specific/darwin/macfuse/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "macfuse-stubs";
-  version = "4.4.1";
+  version = "4.8.0";
 
   src = fetchurl {
     url = "https://github.com/osxfuse/osxfuse/releases/download/macfuse-${version}/macfuse-${version}.dmg";
-    sha256 = "2a2d0f37ec5fcff547c5efa7d08539103a0b46bc16080c2b41a7e749f6e65c61";
+    hash = "sha256-ucTzO2qdN4QkowMVvC3+4pjEVjbwMsB0xFk+bvQxwtQ=";
   };
 
   nativeBuildInputs = [ cpio xar undmg libtapi ];
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 1324bdeb7f217..5e5747b1b4fbb 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -28,7 +28,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.8";
+  version = "1.2.9";
 
   buildInputs = [
     AppKit
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nsNN2iCSjXzfarSdaNmeNbfDliUBMQMsb0rXEENWJqw=";
+    hash = "sha256-9k7NMw2M6IqCUQNBekzDaS6VYAOKwPmuCfJkENQ7oiI=";
   };
 
   postPatch = ''
@@ -198,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    description = "A Vulkan Portability implementation built on top of Apple’s Metal API";
+    description = "Vulkan Portability implementation built on top of Apple’s Metal API";
     homepage = "https://github.com/KhronosGroup/MoltenVK";
     changelog = "https://github.com/KhronosGroup/MoltenVK/releases";
     maintainers = [ lib.maintainers.reckenrode ];
diff --git a/pkgs/os-specific/darwin/noah/default.nix b/pkgs/os-specific/darwin/noah/default.nix
index ad63b796f1838..502a165c33d44 100644
--- a/pkgs/os-specific/darwin/noah/default.nix
+++ b/pkgs/os-specific/darwin/noah/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Bash on Ubuntu on macOS";
     homepage = "https://github.com/linux-noah/noah";
-    license = [ licenses.mit licenses.gpl2 ];
+    license = [ licenses.mit licenses.gpl2Only ];
     maintainers = [ ];
     platforms = platforms.darwin;
     # never built on aarch64-darwin since first introduction in nixpkgs
diff --git a/pkgs/os-specific/darwin/openwith/default.nix b/pkgs/os-specific/darwin/openwith/default.nix
index eb78f7a1344c4..d28ed4942821c 100644
--- a/pkgs/os-specific/darwin/openwith/default.nix
+++ b/pkgs/os-specific/darwin/openwith/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, swift, AppKit, Foundation, UniformTypeIdentifiers }:
+{ lib, swiftPackages, fetchFromGitHub }:
 
 let
+  inherit (swiftPackages) apple_sdk stdenv swift;
   arch = if stdenv.isAarch64 then "arm64" else "x86_64";
 in
 stdenv.mkDerivation rec {
@@ -16,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ swift ];
 
-  buildInputs = [ AppKit Foundation UniformTypeIdentifiers ];
+  buildInputs = with apple_sdk.frameworks; [ AppKit Foundation UniformTypeIdentifiers ];
 
   makeFlags = [ "openwith_${arch}" ];
 
@@ -32,6 +33,5 @@ stdenv.mkDerivation rec {
     license = licenses.unlicense;
     maintainers = with maintainers; [ zowoq ];
     platforms = [ "aarch64-darwin" "x86_64-darwin" ];
-    broken = stdenv.isx86_64; # https://hydra.nixos.org/build/219354133/nixlog/3
   };
 }
diff --git a/pkgs/os-specific/darwin/osx-cpu-temp/default.nix b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
index ea9d8399667ac..2f3154fe9ea41 100644
--- a/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
+++ b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Outputs current CPU temperature for OSX.";
+    description = "Outputs current CPU temperature for OSX";
     homepage = "https://github.com/lavoiesl/osx-cpu-temp";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ virusdave ];
     platforms = platforms.darwin;
   };
diff --git a/pkgs/os-specific/darwin/osxsnarf/default.nix b/pkgs/os-specific/darwin/osxsnarf/default.nix
index e31271ed2b97e..534c8bd5b3a60 100644
--- a/pkgs/os-specific/darwin/osxsnarf/default.nix
+++ b/pkgs/os-specific/darwin/osxsnarf/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {
-    description = "A Plan 9-inspired way to share your OS X clipboard";
+    description = "Plan 9-inspired way to share your OS X clipboard";
     homepage = "https://github.com/eraserhd/osxsnarf";
     license = licenses.unlicense;
     platforms = platforms.darwin;
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index b6626c4d4eade..a49f1a305ce4a 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, writeShellApplication
-, curl
-, jq
-, common-updater-scripts
-, undmg
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  writeShellApplication,
+  curl,
+  jq,
+  common-updater-scripts,
+  undmg,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.72.0";
+  version = "1.77.1";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-L6CXWRmBfit+uWODEWt7u71shFAadPOqtNifMnSp0BU=";
+    hash = "sha256-+Itz6U1DHV9ZsgjzuvrfVtCJ1yiGSpVOkD28BmHibIQ=";
   };
 
   dontPatch = true;
@@ -38,21 +39,31 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   passthru.updateScript = lib.getExe (writeShellApplication {
     name = "raycast-update-script";
-    runtimeInputs = [ curl jq common-updater-scripts ];
+    runtimeInputs = [
+      curl
+      jq
+      common-updater-scripts
+    ];
     text = ''
-      set -eo pipefail
       url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
       version=$(echo "$url" | jq -r '.version')
       update-source-version raycast "$version" --file=./pkgs/os-specific/darwin/raycast/default.nix
     '';
   });
 
-  meta = with lib; {
+  meta = {
     description = "Control your tools with a few keystrokes";
     homepage = "https://raycast.app/";
-    license = with licenses; [ unfree ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ lovesegfault stepbrobd donteatoreo ];
-    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      lovesegfault
+      stepbrobd
+      donteatoreo
+    ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
index b4d26327bdcd4..ea3dd694962e4 100644
--- a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
+++ b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A wrapper that provides access to the Mac OS X pasteboard service";
+    description = "Wrapper that provides access to the Mac OS X pasteboard service";
     license = licenses.bsd2;
     maintainers = with maintainers; [ lnl7 ];
     platforms = platforms.darwin;
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index ca83bb7db4c00..1e7be272d6ab9 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.77";
+  version = "0.80";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-wViFngw6iwlOG7KsW+zqxjm9ZRJahscX0TYz7/7T5nw=";
+    hash = "sha256-CmYhMnEhn3UK82RXuT1KQhAoK/0ewcUU6h73el2Lpw8=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/os-specific/darwin/sigtool/default.nix b/pkgs/os-specific/darwin/sigtool/default.nix
index eb323a899d19f..62474fdc78d21 100644
--- a/pkgs/os-specific/darwin/sigtool/default.nix
+++ b/pkgs/os-specific/darwin/sigtool/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
-    description = "A tool for working with embedded signatures in Mach-O files";
+    description = "Tool for working with embedded signatures in Mach-O files";
     homepage = "https://github.com/thefloweringash/sigtool";
     license = licenses.mit;
     platforms = platforms.unix;
diff --git a/pkgs/os-specific/darwin/smimesign/default.nix b/pkgs/os-specific/darwin/smimesign/default.nix
index 48164d387fa98..812d6a24d2bd8 100644
--- a/pkgs/os-specific/darwin/smimesign/default.nix
+++ b/pkgs/os-specific/darwin/smimesign/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "An S/MIME signing utility for macOS and Windows that is compatible with Git";
+    description = "S/MIME signing utility for macOS and Windows that is compatible with Git";
     homepage = "https://github.com/github/smimesign";
     license = licenses.mit;
     platforms = platforms.darwin ++ platforms.windows;
diff --git a/pkgs/os-specific/darwin/spacebar/default.nix b/pkgs/os-specific/darwin/spacebar/default.nix
index 2656c10f6dc3b..051bbfc46c15d 100644
--- a/pkgs/os-specific/darwin/spacebar/default.nix
+++ b/pkgs/os-specific/darwin/spacebar/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A minimal status bar for macOS";
+    description = "Minimal status bar for macOS";
     homepage = "https://github.com/cmacrae/spacebar";
     platforms = platforms.darwin;
     maintainers = [ maintainers.cmacrae ];
diff --git a/pkgs/os-specific/darwin/utm/default.nix b/pkgs/os-specific/darwin/utm/default.nix
index 50f84a254dfc2..050a725b2cb8b 100644
--- a/pkgs/os-specific/darwin/utm/default.nix
+++ b/pkgs/os-specific/darwin/utm/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "utm";
-  version = "4.4.5";
+  version = "4.5.3";
 
   src = fetchurl {
     url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
-    hash = "sha256-FlIPSWqY2V1akd/InS6BPEBfc8pomJ8jgDns7wvaOm8=";
+    hash = "sha256-7hpWTe6TvnNodFt1rSRGougeZuEjvSeuVzBWFfYo53Y=";
   };
 
   nativeBuildInputs = [ undmg makeWrapper ];
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation rec {
       See https://docs.getutm.app/ for more information.
     '';
     homepage = "https://mac.getutm.app/";
-    changelog = "https://github.com/utmapp/${pname}/releases/tag/v${version}";
+    changelog = "https://github.com/utmapp/utm/releases/tag/v${version}";
     mainProgram = "UTM";
     license = licenses.asl20;
     platforms = platforms.darwin; # 11.3 is the minimum supported version as of UTM 4.
diff --git a/pkgs/os-specific/linux/915resolution/default.nix b/pkgs/os-specific/linux/915resolution/default.nix
index 6966a76cfa971..8a6732d8737fa 100644
--- a/pkgs/os-specific/linux/915resolution/default.nix
+++ b/pkgs/os-specific/linux/915resolution/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "http://915resolution.mango-lang.org/";
-    description = "A tool to modify Intel 800/900 video BIOS";
+    description = "Tool to modify Intel 800/900 video BIOS";
     mainProgram = "915resolution";
     platforms = [ "i686-linux" "x86_64-linux" ];
     license = licenses.publicDomain;
diff --git a/pkgs/os-specific/linux/acpi-call/default.nix b/pkgs/os-specific/linux/acpi-call/default.nix
index 0da824b169e63..f812316fd7749 100644
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin mic92 ];
     homepage = "https://github.com/nix-community/acpi_call";
     platforms = platforms.linux;
-    description = "A module allowing arbitrary ACPI calls; use case: hybrid video";
+    description = "Module allowing arbitrary ACPI calls; use case: hybrid video";
     mainProgram = "test_discrete_video_off.sh";
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index 8f981ec401bcb..5326ba578f75e 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/acpid2/";
-    description = "A daemon for delivering ACPI events to userspace programs";
+    description = "Daemon for delivering ACPI events to userspace programs";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/acpitool/default.nix b/pkgs/os-specific/linux/acpitool/default.nix
index 317ca54b7cde4..86b028697bb62 100644
--- a/pkgs/os-specific/linux/acpitool/default.nix
+++ b/pkgs/os-specific/linux/acpitool/default.nix
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
   ];
 
   meta = {
-    description = "A small, convenient command-line ACPI client with a lot of features";
+    description = "Small, convenient command-line ACPI client with a lot of features";
     mainProgram = "acpitool";
     homepage = "https://sourceforge.net/projects/acpitool/";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/adcli/default.nix b/pkgs/os-specific/linux/adcli/default.nix
index 5f94da21f2074..2f81c12977dc3 100644
--- a/pkgs/os-specific/linux/adcli/default.nix
+++ b/pkgs/os-specific/linux/adcli/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
-    description = "A helper library and tools for Active Directory client operations.";
+    description = "Helper library and tools for Active Directory client operations";
     mainProgram = "adcli";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ SohamG anthonyroussel ];
diff --git a/pkgs/os-specific/linux/afuse/default.nix b/pkgs/os-specific/linux/afuse/default.nix
index 6d8bb81b99c29..df64c0d1f56c7 100644
--- a/pkgs/os-specific/linux/afuse/default.nix
+++ b/pkgs/os-specific/linux/afuse/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Automounter in userspace";
     homepage = "https://github.com/pcarrier/afuse";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.marcweber ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/os-specific/linux/amdctl/default.nix b/pkgs/os-specific/linux/amdctl/default.nix
index abc26aabf7843..f95d54e64b3ea 100644
--- a/pkgs/os-specific/linux/amdctl/default.nix
+++ b/pkgs/os-specific/linux/amdctl/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux.";
+    description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux";
     mainProgram = "amdctl";
     homepage = "https://github.com/kevinlekiller/amdctl";
     license = licenses.gpl3Plus;
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
deleted file mode 100644
index ade6da99810b2..0000000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ /dev/null
@@ -1,222 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, elfutils
-, xorg
-, patchelf
-, libxcb
-, libxshmfence
-, perl
-, zlib
-, expat
-, libffi_3_3
-, libselinux
-, libdrm
-, udev
-, kernel ? null
-}:
-
-with lib;
-
-let
-
-  bitness = if stdenv.is64bit then "64" else "32";
-
-  libArch =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      "i386-linux-gnu"
-    else if stdenv.hostPlatform.system == "x86_64-linux" then
-      "x86_64-linux-gnu"
-    else throw "amdgpu-pro is Linux only. Sorry ${stdenv.hostPlatform.system}.";
-
-in stdenv.mkDerivation rec {
-
-  version = "21.30";
-  pname = "amdgpu-pro";
-  build = "${version}-1290604";
-
-  src = fetchurl {
-    url = "https://drivers.amd.com/drivers/linux/amdgpu-pro-${build}-ubuntu-20.04.tar.xz";
-    sha256 = "sha256-WECqxjo2WLP3kMWeVyJgYufkvHTzwGaj57yeMGXiQ4I=";
-    curlOpts = "--referer https://www.amd.com/en/support/kb/release-notes/rn-amdgpu-unified-linux-21-30";
-  };
-
-  postUnpack = ''
-    mkdir root
-    pushd $sourceRoot
-    for deb in *_all.deb *_${if stdenv.is64bit then "amd64" else "i386"}.deb
-    do
-      ar p $deb data.tar.xz | tar -C ../root -xJ
-    done
-    popd
-    # if we don't use a short sourceRoot, compilation can fail due to command
-    # line length
-    sourceRoot=root
-  '';
-
-  passthru = optionalAttrs (kernel != null) {
-    kmod = stdenv.mkDerivation rec {
-      inherit version src postUnpack;
-      name = "${pname}-${version}-kmod-${kernel.dev.version}";
-
-      postPatch = ''
-        pushd usr/src/amdgpu-*
-        patchShebangs amd/dkms/*.sh
-        substituteInPlace amd/dkms/pre-build.sh --replace "./configure" "./configure --with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source --with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-        popd
-      '';
-
-      preConfigure = ''
-        pushd usr/src/amdgpu-*
-        makeFlags="$makeFlags M=$(pwd)"
-        amd/dkms/pre-build.sh ${kernel.version}
-        popd
-      '';
-
-      postBuild = ''
-        pushd usr/src/amdgpu-*
-        find -name \*.ko -exec xz {} \;
-        popd
-      '';
-
-      makeFlags = optionalString (kernel != null) "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
-
-      installPhase = ''
-        runHook preInstall
-
-        pushd usr/src/amdgpu-*
-        find -name \*.ko.xz -exec install -Dm444 {} $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/{} \;
-        popd
-
-        runHook postInstall
-      '';
-
-      # without this we get a collision with the ttm module from linux
-      meta.priority = 4;
-    };
-
-    fw = stdenv.mkDerivation rec {
-      inherit version src postUnpack;
-      name = "${pname}-${version}-fw";
-
-      installPhase = ''
-        runHook preInstall
-
-        mkdir -p $out/lib
-        cp -r usr/src/amdgpu-*/firmware $out/lib/firmware
-
-        runHook postInstall
-      '';
-    };
-  };
-
-  outputs = [ "out" "vulkan" ];
-
-  depLibPath = makeLibraryPath [
-    stdenv.cc.cc.lib
-    zlib
-    libxcb
-    libxshmfence
-    elfutils
-    expat
-    libffi_3_3
-    libselinux
-    # libudev is not listed in any dependencies, but is loaded dynamically
-    udev
-    xorg.libXext
-    xorg.libX11
-    xorg.libXfixes
-    xorg.libXdamage
-    xorg.libXxf86vm
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-
-    cp -r usr/lib/${libArch} $out/lib
-    cp -r usr/share $out/share
-
-    mkdir -p $out/opt/amdgpu{,-pro}
-    cp -r opt/amdgpu-pro/lib/${libArch} $out/opt/amdgpu-pro/lib
-    cp -r opt/amdgpu/lib/${libArch} $out/opt/amdgpu/lib
-
-    pushd $out/lib
-    ln -s ../opt/amdgpu-pro/lib/libGL.so* .
-    ln -s ../opt/amdgpu-pro/lib/libEGL.so* .
-    popd
-
-    # short name to allow replacement below
-    ln -s lib/dri $out/dri
-
-  '' + optionalString (stdenv.is64bit) ''
-    mkdir -p $out/etc
-    pushd etc
-    cp -r modprobe.d udev amd $out/etc
-    popd
-
-    cp -r lib/udev/rules.d/* $out/etc/udev/rules.d
-    cp -r opt/amdgpu/lib/xorg $out/lib/xorg
-    cp -r opt/amdgpu-pro/lib/xorg/* $out/lib/xorg
-    cp -r opt/amdgpu/share $out/opt/amdgpu/share
-  '' + ''
-
-    mkdir -p $vulkan/share/vulkan/icd.d
-    install opt/amdgpu-pro/etc/vulkan/icd.d/amd_icd${bitness}.json $vulkan/share/vulkan/icd.d
-
-    runHook postInstall
-  '';
-
-  preFixup = (if stdenv.is64bit
-    # this could also be done with LIBGL_DRIVERS_PATH, but it would need to be
-    # set in the user session and for Xorg
-    then ''
-      expr1='s:/opt/amdgpu/lib/x86_64-linux-gnu/dri\0:/run/opengl-driver/lib/dri\0\0\0\0\0\0\0\0\0\0\0:g'
-      expr2='s:/usr/lib/x86_64-linux-gnu/dri[\0\:]:/run/opengl-driver/lib/dri\0\0\0\0:g'
-      perl -pi -e "$expr2" $out/lib/xorg/modules/extensions/libglx.so
-    ''
-    else ''
-      expr1='s:/opt/amdgpu/lib/i386-linux-gnu/dri\0:/run/opengl-driver-32/lib/dri\0\0\0\0\0\0:g'
-      # we replace a different path on 32-bit because it's the only one long
-      # enough to fit the target path :(
-      expr2='s:/usr/lib/i386-linux-gnu/dri[\0\:]:/run/opengl-driver-32/dri\0\0\0:g'
-    '') + ''
-    perl -pi -e "$expr1" \
-      $out/opt/amdgpu/lib/libEGL.so.1.0.0 \
-      $out/opt/amdgpu/lib/libgbm.so.1.0.0 \
-      $out/opt/amdgpu/lib/libGL.so.1.2.0
-
-    perl -pi -e "$expr2" \
-      $out/opt/amdgpu-pro/lib/libEGL.so.1 \
-      $out/opt/amdgpu-pro/lib/libGL.so.1.2 \
-      $out/opt/amdgpu-pro/lib/libGLX_amd.so.0
-
-    find $out -type f -exec perl -pi -e 's:/opt/amdgpu-pro/:/run/amdgpu-pro/:g' {} \;
-    find $out -type f -exec perl -pi -e 's:/opt/amdgpu/:/run/amdgpu/:g' {} \;
-
-    substituteInPlace $vulkan/share/vulkan/icd.d/*.json --replace /opt/amdgpu-pro/lib/${libArch} "$out/opt/amdgpu-pro/lib"
-  '';
-
-  # doing this in post because shrinking breaks things that dynamically load
-  postFixup = ''
-    libPath="$out/opt/amdgpu/lib:$out/opt/amdgpu-pro/lib:$depLibPath"
-    find "$out" -name '*.so*' -type f -exec patchelf --set-rpath "$libPath" {} \;
-  '';
-
-  buildInputs = [
-    libdrm
-    patchelf
-    perl
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "AMDGPU-PRO drivers";
-    homepage =  "https://www.amd.com/en/support";
-    license = licenses.unfree;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ corngood ];
-  };
-}
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index a3724c792482e..8f963f34136ac 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl
+{ lib, stdenv, fetchFromGitHub
 , callPackage
 , fetchpatch
 , cmake, pkg-config, dbus, makeWrapper
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     makeWrapper
+    protobufc
   ];
 
   buildInputs = [
@@ -74,7 +75,7 @@ stdenv.mkDerivation rec {
     lxc
     mesa
     properties-cpp
-    protobuf protobufc
+    protobuf
     python3
     SDL2 SDL2_image
     systemd
@@ -164,7 +165,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://anbox.io";
     description = "Android in a box";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ edwtjo ];
     platforms = [ "armv7l-linux" "aarch64-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index 68265f9f826c4..8d34d57d4f24c 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  tag = "0.3.8";
+  tag = "0.3.9";
 in
 stdenv.mkDerivation {
   pname = "apfs";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
     rev = "v${tag}";
-    hash = "sha256-I/wuS4//bUiUW8NGW6aNVPzDtuY2lMUeFiv5y2c7TYY=";
+    hash = "sha256-KZ/B3sR9x58DTUeHUI0ZPW6bb7vFkPMVXaEZ25m3cP0=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index cebae9b8402dd..4c06ea352ee03 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -26,7 +26,7 @@ let
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
-    description = "A mandatory access control system - ${component}";
+    description = "Mandatory access control system - ${component}";
     license = with licenses; [ gpl2Only lgpl21Only ];
     maintainers = with maintainers; [ julm thoughtpolice ] ++ teams.helsinki-systems.members;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/asus-ec-sensors/default.nix b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
index c80f18a78ecea..ae5c370ed21f6 100644
--- a/pkgs/os-specific/linux/asus-ec-sensors/default.nix
+++ b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux HWMON sensors driver for ASUS motherboards to read sensor data from the embedded controller";
     homepage = "https://github.com/zeule/asus-ec-sensors";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ nickhu ];
     broken = kernel.kernelOlder "5.11";
diff --git a/pkgs/os-specific/linux/asus-wmi-sensors/default.nix b/pkgs/os-specific/linux/asus-wmi-sensors/default.nix
index 3098cbb72538e..074b2e4ff25af 100644
--- a/pkgs/os-specific/linux/asus-wmi-sensors/default.nix
+++ b/pkgs/os-specific/linux/asus-wmi-sensors/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux HWMON (lmsensors) sensors driver for various ASUS Ryzen and Threadripper motherboards";
     homepage = "https://github.com/electrified/asus-wmi-sensors";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ Frostman ];
     broken = versionOlder kernel.version "4.12";
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 1e941a13767ed..d5e38ea62fb8b 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,11 +1,9 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , autoreconfHook
 , bash
 , buildPackages
-, libtool
 , linuxHeaders
 , python3
 , swig
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index db0e7b48383f3..d308ba6594e23 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,28 +1,33 @@
 { lib, stdenv, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
-, libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto
+, libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto, pkgconf
 , fetchpatch
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.1.6";
+  version = "5.1.9";
   pname = "autofs";
 
   src = fetchurl {
     url = "mirror://kernel/linux/daemons/autofs/v5/autofs-${version}.tar.xz";
-    sha256 = "1vya21mb4izj3khcr3flibv7xc15vvx2v0rjfk5yd31qnzcy7pnx";
+    sha256 = "sha256-h+avagN5S5Ri6lGXgeUOfSO198ks1Z4RQshdJJOzwks=";
   };
-
   patches = [
-    # glibc 2.34 compat
     (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/autofs/raw/cc745af5e42396d540d5b3b92fae486e232bf6bd/f/autofs-5.1.7-use-default-stack-size-for-threads.patch";
-      sha256 = "sha256-6ETDFbW7EhHR03xFWF+6OJBgn9NX3WW3bGhTNGodaOc=";
-      excludes = [ "CHANGELOG" ];
+      url = "mirror://kernel/linux/daemons/autofs/v5/patches-5.2.0/autofs-5.1.9-update-configure.patch";
+      hash = "sha256-BomhNw+lMHcgs5gQlzapZ6p/Ji3gJUVkrLpZssBmwbg=";
+    })
+    (fetchpatch {
+      url = "mirror://kernel/linux/daemons/autofs/v5/patches-5.2.0/autofs-5.1.9-fix-ldap_parse_page_control-check.patch";
+      hash = "sha256-W757LU9r9kuzLeThif2a1olRtxNrJy5suemLS7yfbIU=";
+    })
+   (fetchpatch {
+      url = "mirror://kernel/linux/daemons/autofs/v5/patches-5.2.0/autofs-5.1.9-fix-crash-in-make_options_string.patch";
+      hash = "sha256-YjTdJ50iNhJ2UjFdrKYEFNt04z0PfmElbFa4GuSskLA=";
     })
   ];
 
   preConfigure = ''
-    configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH"
+    configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH --with-libtirpc"
     export sssldir="${sssd}/lib/sssd/modules"
     export HAVE_SSS_AUTOFS=1
 
@@ -37,9 +42,6 @@ stdenv.mkDerivation rec {
     unset STRIP # Makefile.rules defines a usable STRIP only without the env var.
   '';
 
-  # configure script is not finding the right path
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
-
   installPhase = ''
     make install SUBDIRS="lib daemon modules man" # all but samples
     #make install SUBDIRS="samples" # impure!
@@ -48,7 +50,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ linuxHeaders libtirpc libxml2 libkrb5 kmod openldap sssd
                   openssl cyrus_sasl rpcsvc-proto ];
 
-  nativeBuildInputs = [ flex bison ];
+  nativeBuildInputs = [ flex bison pkgconf ];
 
   meta = {
     description = "Kernel-based automounter";
diff --git a/pkgs/os-specific/linux/ax99100/default.nix b/pkgs/os-specific/linux/ax99100/default.nix
index 761800cfd7ba9..0e99d9390c15f 100644
--- a/pkgs/os-specific/linux/ax99100/default.nix
+++ b/pkgs/os-specific/linux/ax99100/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     description = "ASIX AX99100 Serial and Parallel Port driver";
     homepage = "https://www.asix.com.tw/en/product/Interface/PCIe_Bridge/AX99100";
     # According to the source code in the tarball, the license is gpl2.
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
 
     # Older Linux versions need more patches to work.
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index ae7d784591d2b..26c433b8a06d9 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, information distribution tool";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fpletz ];
     platforms = with lib.platforms; linux;
   };
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index bb44ac5e99f56..e42b1b18d5841 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, control tool";
     mainProgram = "batctl";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fpletz ];
     platforms = with lib.platforms; linux;
   };
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index b825cfc0a9624..8fa54664fb4dd 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch2
 , kernel
 }:
 
@@ -31,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fpletz philiptaron ];
     platforms = with lib.platforms; linux;
   };
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index 545285a6cf422..6f0cab252b926 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,16 +1,16 @@
 {
-  version = "2024.0";
+  version = "2024.2";
 
   # To get these, run:
   #
   # ```
   # for tool in alfred batctl batman-adv; do
-  #   nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2024.0/$tool-2024.0.tar.gz --type sha256 | xargs nix hash to-sri --type sha256
+  #   nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2024.2/$tool-2024.2.tar.gz --type sha256 | xargs nix hash to-sri --type sha256
   # done
   # ```
   sha256 = {
-    alfred = "sha256-0CmkNjirFnceX3HhNLyEPRcT10BBxlvNoYox0Y9VMb0=";
-    batctl = "sha256-doU+hyAa9jxBHbFS/QxiWnKalzMRWJfRMxYE4sWmfH0=";
-    batman-adv = "sha256-YREGl7V5n2RqKoKk3Pl/rtS7EqfMQ79Gg9LE3k9rQOc=";
+    alfred = "sha256-Kpvr62fIh1n+31fRjm79qtDECPIGikYlIBfCJ8sQlnI=";
+    batctl = "sha256-ywKVMJP/wscA0SLAOj2eTYZ/ZG0wOPMdCpAeWP+ZXQc=";
+    batman-adv = "sha256-dpKm3uei8/ZnMumuyMcWTgwYGBZ/OvBjv/P/+7AZlkM=";
   };
 }
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 8312d64acddc6..a65bcab50ee25 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "A module for powering off hybrid GPUs";
+    description = "Module for powering off hybrid GPUs";
     platforms = [ "x86_64-linux" "i686-linux" ];
     homepage = "https://github.com/Bumblebee-Project/bbswitch";
     maintainers = with maintainers; [ abbradar ];
diff --git a/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch b/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch
deleted file mode 100644
index 7480e9c5d97b3..0000000000000
--- a/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 01e793163231c5085afced37471df32b94a313f5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Thu, 30 Dec 2021 06:34:41 +0100
-Subject: [PATCH] absolute ausyscall
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- libbpf-tools/syscall_helpers.c | 2 +-
- src/python/bcc/syscall.py      | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libbpf-tools/syscall_helpers.c b/libbpf-tools/syscall_helpers.c
-index e114a08f..62adea78 100644
---- a/libbpf-tools/syscall_helpers.c
-+++ b/libbpf-tools/syscall_helpers.c
-@@ -47,7 +47,7 @@ void init_syscall_names(void)
- 	int err;
- 	FILE *f;
- 
--	f = popen("ausyscall --dump 2>/dev/null", "r");
-+	f = popen("@ausyscall@ --dump 2>/dev/null", "r");
- 	if (!f) {
- 		warn("popen: ausyscall --dump: %s\n", strerror(errno));
- 		return;
-diff --git a/src/python/bcc/syscall.py b/src/python/bcc/syscall.py
-index 1346b4e8..e7e29a11 100644
---- a/src/python/bcc/syscall.py
-+++ b/src/python/bcc/syscall.py
-@@ -376,7 +376,7 @@ def _parse_syscall(line):
- try:
-     # Skip the first line, which is a header. The rest of the lines are simply
-     # SYSCALL_NUM\tSYSCALL_NAME pairs.
--    out = subprocess.check_output(['ausyscall', '--dump'], stderr=subprocess.STDOUT)
-+    out = subprocess.check_output(['@ausyscall@', '--dump'], stderr=subprocess.STDOUT)
-     # remove the first line of expected output
-     out = out.split(b'\n',1)[1]
-     syscalls = dict(map(_parse_syscall, out.strip().split(b'\n')))
--- 
-2.34.0
-
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
deleted file mode 100644
index 3cf9b26f4fdda..0000000000000
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ /dev/null
@@ -1,122 +0,0 @@
-{ audit
-, bash
-, bison
-, cmake
-, elfutils
-, fetchFromGitHub
-, flex
-, iperf
-, lib
-, libbpf
-, llvmPackages
-, luajit
-, makeWrapper
-, netperf
-, nixosTests
-, python3
-, stdenv
-, zip
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "bcc";
-  version = "0.30.0";
-
-  disabled = !stdenv.isLinux;
-
-  src = fetchFromGitHub {
-    owner = "iovisor";
-    repo = "bcc";
-    rev = "v${version}";
-    hash = "sha256-ngGLGfLv2prnjhgaRPf8ea3oyy4129zGodR0Yz1QtCw=";
-  };
-  format = "other";
-
-  buildInputs = with llvmPackages; [
-    llvm llvm.dev libclang
-    elfutils luajit netperf iperf
-    flex bash libbpf
-  ];
-
-  patches = [
-    # This is needed until we fix
-    # https://github.com/NixOS/nixpkgs/issues/40427
-    ./fix-deadlock-detector-import.patch
-  ];
-
-  propagatedBuildInputs = [ python3.pkgs.netaddr ];
-  nativeBuildInputs = [
-    bison
-    cmake
-    flex
-    llvmPackages.llvm.dev
-    makeWrapper
-    python3.pkgs.setuptools
-    zip
-  ];
-
-  cmakeFlags = [
-    "-DBCC_KERNEL_MODULES_DIR=/run/booted-system/kernel-modules/lib/modules"
-    "-DREVISION=${version}"
-    "-DENABLE_USDT=ON"
-    "-DENABLE_CPP_API=ON"
-    "-DCMAKE_USE_LIBBPF_PACKAGE=ON"
-    "-DENABLE_LIBDEBUGINFOD=OFF"
-  ];
-
-  # to replace this executable path:
-  # https://github.com/iovisor/bcc/blob/master/src/python/bcc/syscall.py#L384
-  ausyscall = "${audit}/bin/ausyscall";
-
-  postPatch = ''
-    substituteAll ${./libbcc-path.patch} ./libbcc-path.patch
-    patch -p1 < libbcc-path.patch
-
-    substituteAll ${./absolute-ausyscall.patch} ./absolute-ausyscall.patch
-    patch -p1 < absolute-ausyscall.patch
-
-    # https://github.com/iovisor/bcc/issues/3996
-    substituteInPlace src/cc/libbcc.pc.in \
-      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
-  '';
-
-  preInstall = ''
-    # required for setuptool during install
-    export PYTHONPATH=$out/${python3.sitePackages}:$PYTHONPATH
-  '';
-  postInstall = ''
-    mkdir -p $out/bin $out/share
-    rm -r $out/share/bcc/tools/old
-    mv $out/share/bcc/tools/doc $out/share
-    mv $out/share/bcc/man $out/share/
-
-    find $out/share/bcc/tools -type f -executable -print0 | \
-    while IFS= read -r -d ''$'\0' f; do
-      bin=$out/bin/$(basename $f)
-      if [ ! -e $bin ]; then
-        ln -s $f $bin
-      fi
-      substituteInPlace "$f" \
-        --replace '$(dirname $0)/lib' "$out/share/bcc/tools/lib"
-    done
-
-    sed -i -e "s!lib=.*!lib=$out/bin!" $out/bin/{java,ruby,node,python}gc
-  '';
-
-  postFixup = ''
-    wrapPythonProgramsIn "$out/share/bcc/tools" "$out $pythonPath"
-  '';
-
-  outputs = [ "out" "man" ];
-
-  passthru.tests = {
-    bpf = nixosTests.bpf;
-  };
-
-  meta = with lib; {
-    description = "Dynamic Tracing Tools for Linux";
-    homepage    = "https://iovisor.github.io/bcc/";
-    license     = licenses.asl20;
-    maintainers = with maintainers; [ ragge mic92 thoughtpolice martinetd ];
-  };
-}
diff --git a/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch b/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch
deleted file mode 100644
index 1c422635f4fef..0000000000000
--- a/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- source.org/tools/deadlock.py	1980-01-02 00:00:00.000000000 +0000
-+++ source/tools/deadlock.py	2018-05-29 13:57:11.807126673 +0100
-@@ -44,9 +44,8 @@
- #
- # 01-Feb-2017   Kenny Yu   Created this.
- 
--from __future__ import (
--    absolute_import, division, unicode_literals, print_function
--)
-+from __future__ import absolute_import, division, unicode_literals, print_function
-+
- from bcc import BPF
- from collections import defaultdict
- import argparse
diff --git a/pkgs/os-specific/linux/bcc/libbcc-path.patch b/pkgs/os-specific/linux/bcc/libbcc-path.patch
deleted file mode 100644
index 187bb3aadd00d..0000000000000
--- a/pkgs/os-specific/linux/bcc/libbcc-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- source.org/src/python/bcc/libbcc.py	2018-05-13 08:35:06.850522883 +0100
-+++ source/src/python/bcc/libbcc.py	2018-05-13 08:36:24.602733151 +0100
-@@ -14,7 +14,7 @@
- 
- import ctypes as ct
- 
--lib = ct.CDLL("libbcc.so.0", use_errno=True)
-+lib = ct.CDLL("@out@/lib/libbcc.so.0", use_errno=True)
- 
- # keep in sync with bpf_common.h
- lib.bpf_module_create_b.restype = ct.c_void_p
diff --git a/pkgs/os-specific/linux/beefi/default.nix b/pkgs/os-specific/linux/beefi/default.nix
index 39300b948976d..57ab2d7c8574c 100644
--- a/pkgs/os-specific/linux/beefi/default.nix
+++ b/pkgs/os-specific/linux/beefi/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A small script to create bootable EFISTUB kernel images";
+    description = "Small script to create bootable EFISTUB kernel images";
     mainProgram = "beefi";
     license = licenses.gpl3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/below/default.nix b/pkgs/os-specific/linux/below/default.nix
index 5efc80357d8f1..286a92f0eb88d 100644
--- a/pkgs/os-specific/linux/below/default.nix
+++ b/pkgs/os-specific/linux/below/default.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     platforms = platforms.linux;
     maintainers = with maintainers; [ globin ];
-    description = "A time traveling resource monitor for modern Linux systems";
+    description = "Time traveling resource monitor for modern Linux systems";
     license = licenses.asl20;
     homepage = "https://github.com/facebookincubator/below";
     mainProgram = "below";
diff --git a/pkgs/os-specific/linux/bionic-prebuilt/default.nix b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
index 3ce10735f1de8..6aad7ebcacb37 100644
--- a/pkgs/os-specific/linux/bionic-prebuilt/default.nix
+++ b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
@@ -139,7 +139,7 @@ stdenvNoCC.mkDerivation rec {
   passthru.linuxHeaders = kernelHeaders;
 
   meta = with lib; {
-    description = "The Android libc implementation";
+    description = "Android libc implementation";
     homepage    = "https://android.googlesource.com/platform/bionic/";
     license     = licenses.mit;
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index 9ec4778ca38ce..eda3fe62fa804 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage    = "https://github.com/libbpf/bpftool";
     description = "Debugging/program analysis tools for the eBPF subsystem";
-    license     = [ licenses.gpl2 licenses.bsd2 ];
+    license     = [ licenses.gpl2Only licenses.bsd2 ];
     platforms   = platforms.linux;
     maintainers = with maintainers; [ thoughtpolice ];
   };
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
deleted file mode 100644
index 068f4532451b0..0000000000000
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
-, llvmPackages, elfutils, bcc
-, libbpf, libbfd, libopcodes
-, cereal, asciidoctor
-, cmake, pkg-config, flex, bison
-, util-linux
-, nixosTests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "bpftrace";
-  version = "0.20.3";
-
-  src = fetchFromGitHub {
-    owner = "iovisor";
-    repo  = "bpftrace";
-    rev   = "v${version}";
-    hash  = "sha256-B4BxoZSPSpDWLUgcYgQEmuhVr2mX04hrFCLu04vp1so=";
-  };
-
-
-  buildInputs = with llvmPackages; [
-    llvm libclang
-    elfutils bcc
-    libbpf libbfd libopcodes
-    cereal asciidoctor
-  ];
-
-  nativeBuildInputs = [
-    cmake pkg-config flex bison
-    llvmPackages.llvm.dev
-    util-linux
-  ];
-
-  # tests aren't built, due to gtest shenanigans. see:
-  #
-  #     https://github.com/iovisor/bpftrace/issues/161#issuecomment-453606728
-  #     https://github.com/iovisor/bpftrace/pull/363
-  #
-  cmakeFlags = [
-    "-DBUILD_TESTING=FALSE"
-    "-DLIBBCC_INCLUDE_DIRS=${bcc}/include"
-    "-DINSTALL_TOOL_DOCS=OFF"
-    "-DUSE_SYSTEM_BPF_BCC=ON"
-  ];
-
-
-  # Pull BPF scripts into $PATH (next to their bcc program equivalents), but do
-  # not move them to keep `${pkgs.bpftrace}/share/bpftrace/tools/...` working.
-  postInstall = ''
-    ln -sr $out/share/bpftrace/tools/*.bt $out/bin/
-    # do not use /usr/bin/env for shipped tools
-    # If someone can get patchShebangs to work here please fix.
-    sed -i -e "1s:#!/usr/bin/env bpftrace:#!$out/bin/bpftrace:" $out/share/bpftrace/tools/*.bt
-  '';
-
-  outputs = [ "out" "man" ];
-
-  passthru.tests = {
-    bpf = nixosTests.bpf;
-  };
-
-  meta = with lib; {
-    description = "High-level tracing language for Linux eBPF";
-    homepage    = "https://github.com/iovisor/bpftrace";
-    changelog   = "https://github.com/iovisor/bpftrace/releases/tag/v${version}";
-    mainProgram = "bpftrace";
-    license     = licenses.asl20;
-    maintainers = with maintainers; [ rvl thoughtpolice martinetd mfrw ];
-  };
-}
diff --git a/pkgs/os-specific/linux/bpftune/default.nix b/pkgs/os-specific/linux/bpftune/default.nix
index 517cd04a455d8..cc97ed16faea1 100644
--- a/pkgs/os-specific/linux/bpftune/default.nix
+++ b/pkgs/os-specific/linux/bpftune/default.nix
@@ -12,31 +12,28 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftune";
-  version = "unstable-2023-12-20";
+  version = "0-unstable-2024-06-07";
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "bpftune";
-    rev = "0e6bca2e5880fcbaac6478c4042f5f9314e61463";
-    hash = "sha256-y9WQrQb9U5YdzKAR63FzC8V1+jZL027pzAmQPpgM3jM=";
+    rev = "04bab5dd306b55b3e4e13e261af2480b7ccff9fc";
+    hash = "sha256-kVjvupZ6HxJocwXWOrxUNqEGl0welJRlZwvOmMKqeBA=";
   };
 
   postPatch = ''
     # otherwise shrink rpath would drop $out/lib from rpath
     substituteInPlace src/Makefile \
-      --replace /lib64   /lib \
-      --replace /sbin    /bin \
-      --replace ldconfig true
+      --replace-fail /lib64   /lib \
+      --replace-fail /sbin    /bin \
+      --replace-fail ldconfig true
     substituteInPlace src/bpftune.service \
-      --replace /usr/sbin/bpftune "$out/bin/bpftune"
+      --replace-fail /usr/sbin/bpftune "$out/bin/bpftune"
     substituteInPlace include/bpftune/libbpftune.h \
-      --replace /usr/lib64/bpftune/       "$out/lib/bpftune/" \
-      --replace /usr/local/lib64/bpftune/ "$out/lib/bpftune/"
+      --replace-fail /usr/lib64/bpftune/       "$out/lib/bpftune/" \
+      --replace-fail /usr/local/lib64/bpftune/ "$out/lib/bpftune/"
     substituteInPlace src/libbpftune.c \
-      --replace /lib/modules /run/booted-system/kernel-modules/lib/modules
-
-    substituteInPlace src/Makefile sample_tuner/Makefile \
-      --replace 'BPF_INCLUDE := /usr/include' 'BPF_INCLUDE := ${lib.getDev libbpf}/include' \
+      --replace-fail /lib/modules /run/booted-system/kernel-modules/lib/modules
   '';
 
   nativeBuildInputs = [
@@ -56,6 +53,7 @@ stdenv.mkDerivation rec {
     "confprefix=${placeholder "out"}/etc"
     "BPFTUNE_VERSION=${version}"
     "NL_INCLUDE=${lib.getDev libnl}/include/libnl3"
+    "BPF_INCLUDE=${lib.getDev libbpf}/include"
   ];
 
   hardeningDisable = [
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index 1753be599380d..b10cca4cc592d 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   meta = {
-    description = "An userspace tool to configure linux bridges (deprecated in favour or iproute2).";
+    description = "Userspace tool to configure linux bridges (deprecated in favour or iproute2)";
     mainProgram = "brctl";
     homepage = "https://wiki.linuxfoundation.org/networking/bridge";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index 342272f42861b..04a3e104c1cf2 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "A bittorrent filesystem based on FUSE";
+    description = "Bittorrent filesystem based on FUSE";
     homepage    = "https://github.com/johang/btfs";
     license     = licenses.gpl3;
     maintainers = with maintainers; [ rnhmjoj ];
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 33fa7663f46dd..4a291cc03b8f6 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -121,6 +121,10 @@ stdenv.mkDerivation rec {
     # Bump from 4KB, much faster I/O
     CONFIG_FEATURE_COPYBUF_KB 64
 
+    # Doesn't build with current kernel headers.
+    # https://bugs.busybox.net/show_bug.cgi?id=15934
+    CONFIG_TC n
+
     # Set the path for the udhcpc script
     CONFIG_UDHCPC_DEFAULT_SCRIPT "${outDispatchPath}"
 
diff --git a/pkgs/os-specific/linux/can-isotp/default.nix b/pkgs/os-specific/linux/can-isotp/default.nix
index 7c20b74e54cb4..06329478ded46 100644
--- a/pkgs/os-specific/linux/can-isotp/default.nix
+++ b/pkgs/os-specific/linux/can-isotp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     broken = kernel.kernelAtLeast "5.16";
     description = "Kernel module for ISO-TP (ISO 15765-2)";
     homepage = "https://github.com/hartkopp/can-isotp";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.evck ];
   };
diff --git a/pkgs/os-specific/linux/cannelloni/default.nix b/pkgs/os-specific/linux/cannelloni/default.nix
index 86107d4f7aa03..9d2c199a23403 100644
--- a/pkgs/os-specific/linux/cannelloni/default.nix
+++ b/pkgs/os-specific/linux/cannelloni/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = with lib; {
-    description = "A SocketCAN over Ethernet tunnel";
+    description = "SocketCAN over Ethernet tunnel";
     mainProgram = "cannelloni";
     homepage = "https://github.com/mguentner/cannelloni";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/catfs/default.nix b/pkgs/os-specific/linux/catfs/default.nix
index 107dce2123db9..af804262f20bc 100644
--- a/pkgs/os-specific/linux/catfs/default.nix
+++ b/pkgs/os-specific/linux/catfs/default.nix
@@ -1,5 +1,4 @@
 { lib, rustPlatform, fetchFromGitHub
-, fetchpatch
 , fuse
 , pkg-config
 }:
diff --git a/pkgs/os-specific/linux/consoletools/default.nix b/pkgs/os-specific/linux/consoletools/default.nix
index 61ddd5203cdc2..c5138e12fe469 100644
--- a/pkgs/os-specific/linux/consoletools/default.nix
+++ b/pkgs/os-specific/linux/consoletools/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/linuxconsole/";
-    description = "A set of tools for joysticks and serial peripherals";
+    description = "Set of tools for joysticks and serial peripherals";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ pSub ebzzry ];
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 02a781d1f0cf0..754f8e1396152 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -19,7 +19,7 @@
 , pygobject3
 , pyxdg
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -55,7 +55,7 @@ buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
 
     # Python packages
     dbus-python
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index 7c1b031d83349..f714ce54dd58d 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Tool to examine and tune power saving features";
     homepage = "https://www.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     mainProgram = "cpupower";
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/cramfsprogs/default.nix b/pkgs/os-specific/linux/cramfsprogs/default.nix
index 59fbfed1b7287..bde2686624d3c 100644
--- a/pkgs/os-specific/linux/cramfsprogs/default.nix
+++ b/pkgs/os-specific/linux/cramfsprogs/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tools to create, check, and extract content of CramFs images";
     homepage = "https://packages.debian.org/jessie/cramfsprogs";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ pamplemousse ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 66e3303890b03..bdae94f78b4de 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Userspace checkpoint/restore for Linux";
     homepage    = "https://criu.org";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Plus;
     platforms   = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
     maintainers = [ maintainers.thoughtpolice ];
   };
diff --git a/pkgs/os-specific/linux/cryptodev/default.nix b/pkgs/os-specific/linux/cryptodev/default.nix
index cacef99afd748..bb3c0cdd3891c 100644
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -1,4 +1,10 @@
-{ fetchFromGitHub, lib, stdenv, kernel ? false }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  kernel ? false,
+}:
 
 stdenv.mkDerivation rec {
   pname = "cryptodev-linux-1.13";
@@ -11,6 +17,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-EzTPoKYa+XWOAa/Dk7ru02JmlymHeXVX7RMmEoJ1OT0=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/cryptodev-linux/cryptodev-linux/compare/cryptodev-linux-1.13...5e7121e45ff283d30097da381fd7e97c4bb61364.patch";
+      hash = "sha256-GLWpiInBrUcVhpvEjTmD5KLCrrFZnlJGnmLU0QYz+4A=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 0e32966615ac1..fb5a6ce28e1d8 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
     description = "LUKS for dm-crypt";
     changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "cryptsetup";
     maintainers = with lib.maintainers; [ raitobezarius ];
     platforms = with lib.platforms; linux;
diff --git a/pkgs/os-specific/linux/cshatag/default.nix b/pkgs/os-specific/linux/cshatag/default.nix
index 70fd5ccbb6954..09bea7ebdd3ad 100644
--- a/pkgs/os-specific/linux/cshatag/default.nix
+++ b/pkgs/os-specific/linux/cshatag/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    description = "A tool to detect silent data corruption";
+    description = "Tool to detect silent data corruption";
     mainProgram = "cshatag";
     homepage = "https://github.com/rfjakob/cshatag";
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/dcgm/default.nix b/pkgs/os-specific/linux/dcgm/default.nix
index a7f3511b3f4ba..5e03e19bf26d2 100644
--- a/pkgs/os-specific/linux/dcgm/default.nix
+++ b/pkgs/os-specific/linux/dcgm/default.nix
@@ -130,7 +130,7 @@ in gcc11Stdenv.mkDerivation rec {
   disallowedReferences = lib.concatMap (x: x.pkgSet) cudaPackageSetByVersion;
 
   meta = with lib; {
-    description = "Data Center GPU Manager (DCGM) is a daemon that allows users to monitor NVIDIA data-center GPUs.";
+    description = "Data Center GPU Manager (DCGM) is a daemon that allows users to monitor NVIDIA data-center GPUs";
     homepage = "https://developer.nvidia.com/dcgm";
     license = licenses.asl20;
     maintainers = teams.deshaw.members;
diff --git a/pkgs/os-specific/linux/ddcci/default.nix b/pkgs/os-specific/linux/ddcci/default.nix
index ce435b3874f3f..4d1c9bd935581 100644
--- a/pkgs/os-specific/linux/ddcci/default.nix
+++ b/pkgs/os-specific/linux/ddcci/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, kernel }:
+{ lib, stdenv, fetchFromGitLab, kernel, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ddcci-driver";
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-4pCfXJcteWwU6cK8OOSph4XlhKTk289QqLxsSWY7cac=";
   };
 
+  patches = [
+    # See https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/merge_requests/15
+    (fetchpatch {
+      name = "fix-build-with-linux68.patch";
+      url = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/commit/3eb20df68a545d07b8501f13fa9d20e9c6f577ed.patch";
+      hash = "sha256-Y1ktYaJTd9DtT/mwDqtjt/YasW9cVm0wI43wsQhl7Bg=";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -36,7 +45,7 @@ stdenv.mkDerivation rec {
     description = "Kernel module driver for DDC/CI monitors";
     homepage = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ kiike ];
     platforms = platforms.linux;
     broken = kernel.kernelOlder "5.1";
   };
diff --git a/pkgs/os-specific/linux/digimend/default.nix b/pkgs/os-specific/linux/digimend/default.nix
index 11756dcbe85cd..31d68acc53166 100644
--- a/pkgs/os-specific/linux/digimend/default.nix
+++ b/pkgs/os-specific/linux/digimend/default.nix
@@ -1,14 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+}:
 
 stdenv.mkDerivation rec {
   pname = "digimend";
-  version = "unstable-2023-05-03";
+  version = "13";
 
   src = fetchFromGitHub {
     owner = "digimend";
     repo = "digimend-kernel-drivers";
-    rev = "eca6e1b701bffb80a293234a485ebf6b4bc85562";
-    hash = "sha256-0mjIUgHvbNcVQVzU3xzaloe5R41a4eknDhdhruJH+6c=";
+    rev = "v${version}";
+    hash = "sha256-YYCxTyoZGMnqC2nKkRi5Z1uofldGvJDGY2/sO9iMNIo=";
   };
 
   postPatch = ''
@@ -38,7 +43,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "DIGImend graphics tablet drivers for the Linux kernel";
     homepage = "https://digimend.github.io/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ gebner ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/directvnc/default.nix b/pkgs/os-specific/linux/directvnc/default.nix
index 78ccb67725713..5ec40370bbbaa 100644
--- a/pkgs/os-specific/linux/directvnc/default.nix
+++ b/pkgs/os-specific/linux/directvnc/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "DirectFB VNC client";
     homepage = "http://drinkmilk.github.io/directvnc/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index e0e238fd35602..4eef4fdb11200 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://github.com/MeanEYE/Disk-Indicator";
-    description = "A program that will turn a LED into a hard disk indicator";
+    description = "Program that will turn a LED into a hard disk indicator";
     mainProgram = "disk_indicator";
     longDescription = ''
       Small program for Linux that will turn your Scroll, Caps or Num Lock LED
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index 3bfaad303516a..db1be06717c6e 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.nongnu.org/dmidecode/";
-    description = "A tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
+    description = "Tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/os-specific/linux/dpdk-kmods/default.nix b/pkgs/os-specific/linux/dpdk-kmods/default.nix
index ec5fda7aa4195..4205da7e7e80c 100644
--- a/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, fetchpatch, kernel }:
+{ lib, stdenv, fetchzip, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "dpdk-kmods";
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index bd5d9db661a88..3fd703c7ce1e8 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Set of libraries and drivers for fast packet processing";
     homepage = "http://dpdk.org/";
-    license = with licenses; [ lgpl21 gpl2 bsd2 ];
+    license = with licenses; [ lgpl21 gpl2Only bsd2 ];
     platforms =  platforms.linux;
     maintainers = with maintainers; [ magenbluten orivej mic92 zhaofengli ];
   };
diff --git a/pkgs/os-specific/linux/dracut/default.nix b/pkgs/os-specific/linux/dracut/default.nix
index e5461bddbc8f3..498f61dc9836e 100644
--- a/pkgs/os-specific/linux/dracut/default.nix
+++ b/pkgs/os-specific/linux/dracut/default.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/dracutdevs/dracut/wiki";
-    description = "An event driven initramfs infrastructure";
+    description = "Event driven initramfs infrastructure";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ lilyinstarlight ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index 75b613075e781..7fbd314a8ec7f 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -35,7 +35,7 @@ python3Packages.buildPythonApplication rec {
     homepage = "http://dag.wieers.com/home-made/dstat/";
     description = "Versatile resource statistics tool";
     mainProgram = "dstat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
     changelog = "https://github.com/dstat-real/dstat/blob/v${version}/ChangeLog";
diff --git a/pkgs/os-specific/linux/e1000e/default.nix b/pkgs/os-specific/linux/e1000e/default.nix
index 51bc6ada07dec..1ed7f6aa0193a 100644
--- a/pkgs/os-specific/linux/e1000e/default.nix
+++ b/pkgs/os-specific/linux/e1000e/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Linux kernel drivers for Intel Ethernet adapters and LOMs (LAN On Motherboard)";
     homepage = "http://e1000.sf.net/";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/ebtables/default.nix b/pkgs/os-specific/linux/ebtables/default.nix
index 31a5dbd68f9d2..bd39175050e94 100644
--- a/pkgs/os-specific/linux/ebtables/default.nix
+++ b/pkgs/os-specific/linux/ebtables/default.nix
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A filtering tool for Linux-based bridging firewalls";
+    description = "Filtering tool for Linux-based bridging firewalls";
     homepage = "http://ebtables.sourceforge.net/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/edac-utils/default.nix b/pkgs/os-specific/linux/edac-utils/default.nix
index 6171f8ed3073e..b23e0d34401a9 100644
--- a/pkgs/os-specific/linux/edac-utils/default.nix
+++ b/pkgs/os-specific/linux/edac-utils/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://github.com/grondo/edac-utils";
     description = "Handles the reporting of hardware-related memory errors";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 9c16a341a478f..1a5e119ef4737 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.64";
+  version = "0.65";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-LONfgFgPg8KCDwtw//WTOYQT9RpnIskdHAWcgafOhcg=";
+    hash = "sha256-q0C9KfWHxdmrG7xcbb8zpFL4ro+BJb7BL2tyKdFIhew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index b6ed869a71f52..9ce71745cdcfd 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.8.9";
+  version = "2.12.0";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    hash = "sha256-9Csrq9wM7Q99qPj7+NlnQgP6KcciNHMbAAb+Wg7eYAU=";
+    hash = "sha256-Z/eeIUY7Yl2l/IqK3Z2nxPhn+JLvP976IZ9ZXPBqoSo=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
   # linux 3.12
   env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
+  patches = [
+    # Use kernel version checks instead of API feature detection
+    # See https://github.com/NixOS/nixpkgs/pull/310680
+    ./override-features-api-detection.patch
+  ];
+
   configurePhase = ''
     runHook preConfigure
     cd kernel/linux/ena
diff --git a/pkgs/os-specific/linux/ena/override-features-api-detection.patch b/pkgs/os-specific/linux/ena/override-features-api-detection.patch
new file mode 100644
index 0000000000000..099530b121717
--- /dev/null
+++ b/pkgs/os-specific/linux/ena/override-features-api-detection.patch
@@ -0,0 +1,55 @@
+diff --git a/kernel/linux/ena/kcompat.h b/kernel/linux/ena/kcompat.h
+index 32a9cc5..8d39362 100644
+--- a/kernel/linux/ena/kcompat.h
++++ b/kernel/linux/ena/kcompat.h
+@@ -888,21 +888,6 @@ xdp_prepare_buff(struct xdp_buff *xdp, unsigned char *hard_start,
+ #define ENA_XDP_XMIT_FREES_FAILED_DESCS_INTERNALLY
+ #endif
+ 
+-#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0) && \
+-	!(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 188) && \
+-	 LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0)) && \
+-	!(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 251) && \
+-	 LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0))) && \
+-	!(defined(RHEL_RELEASE_CODE) && RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(8, 6)) && \
+-	!(defined(SUSE_VERSION) && (SUSE_VERSION == 15 && SUSE_PATCHLEVEL >= 4)) && \
+-	!(defined(SUSE_VERSION) && (SUSE_VERSION == 15 && SUSE_PATCHLEVEL == 3) && \
+-	  ENA_KERNEL_VERSION_GTE(5, 3, 18, 150300, 59, 43))
+-static inline void eth_hw_addr_set(struct net_device *dev, const u8 *addr)
+-{
+-	memcpy(dev->dev_addr, addr, ETH_ALEN);
+-}
+-#endif
+-
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0) || \
+ 	(defined(RHEL_RELEASE_CODE) && \
+ 	RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(8, 6) && \
+@@ -1112,7 +1097,7 @@ static inline void ena_dma_unmap_page_attrs(struct device *dev,
+ #define pci_dev_id(pdev) ((((u16)(pdev->bus->number)) << 8) | (pdev->devfn))
+ #endif /* ENA_HAVE_PCI_DEV_ID */
+ 
+-#ifndef ENA_HAVE_XDP_DO_FLUSH
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0)
+ #define xdp_do_flush xdp_do_flush_map
+ #endif /* ENA_HAVE_XDP_DO_FLUSH */
+ 
+@@ -1147,15 +1132,15 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
+ }
+ #endif /* ENA_HAVE_CPUMASK_LOCAL_SPREAD */
+ 
+-#ifndef ENA_HAVE_UPDATE_AFFINITY_HINT
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 17, 0)
+ static inline int irq_update_affinity_hint(unsigned int irq, const struct cpumask *m)
+ {
+ 	return 0;
+ }
+-#endif /* ENA_HAVE_UPDATE_AFFINITY_HINT */
++#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(5.17.0) */
+ 
+-#ifndef ENA_HAVE_ETHTOOL_PUTS
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 8, 0)
+ #define ethtool_puts ethtool_sprintf
+-#endif /* ENA_HAVE_ETHTOOL_PUTS */
++#endif
+ 
+ #endif /* _KCOMPAT_H_ */
diff --git a/pkgs/os-specific/linux/esdm/default.nix b/pkgs/os-specific/linux/esdm/default.nix
index 195c645eb539b..95fdd9648f238 100644
--- a/pkgs/os-specific/linux/esdm/default.nix
+++ b/pkgs/os-specific/linux/esdm/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , protobufc
 , pkg-config
 , fuse3
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
index 581382e4faf2d..94f18cccd9439 100644
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ethq";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "isc-projects";
     repo = "ethq";
     rev = "refs/tags/v${builtins.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-dr37KiSnP0S0OjQof242EcbH+y4pCCzu6R9D6fXR9qc=";
+    hash = "sha256-ye5ep9EM9Sq/NqNZHENPmFZefVBx1BGrPm3YEG1NcSc=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index 3c551939c7cf2..beb3cc6e97143 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "Simple monitoring of system events";
     mainProgram = "eventstat";
     homepage = "https://github.com/ColinIanKing/eventstat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index 3d2445df49806..c252238f7bd69 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, kernel }:
+{ stdenv, lib, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   name = "exfat-nofuse-${version}-${kernel.version}";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "exfat kernel module";
     inherit (src.meta) homepage;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ makefu ];
     platforms = lib.platforms.linux;
     broken = true;
diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
index ceba075758a6a..4fa670afb3962 100644
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/patjak/bcwc_pcie";
     description = "Linux driver for the Facetime HD (Broadcom 1570) PCIe webcam";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ womfoo grahamc kraem ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/fan2go/default.nix b/pkgs/os-specific/linux/fan2go/default.nix
index cb8ff5a84b74c..edd44842eed9a 100644
--- a/pkgs/os-specific/linux/fan2go/default.nix
+++ b/pkgs/os-specific/linux/fan2go/default.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
   CGO_LDFLAGS = "-L ${lm_sensors}/lib";
 
   meta = with lib; {
-    description = "A simple daemon providing dynamic fan speed control based on temperature sensors";
+    description = "Simple daemon providing dynamic fan speed control based on temperature sensors";
     mainProgram = "fan2go";
     homepage = "https://github.com/markusressel/fan2go";
     license = licenses.agpl3Plus;
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index 8704c72a21ba2..f472ce23aa2f7 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     mainProgram = "fbterm";
     homepage = "https://salsa.debian.org/debian/fbterm";
     maintainers = with maintainers; [ lovesegfault raskin ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index dfa974e3e683c..610f9d31353e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -8,7 +8,6 @@
 , fetchurl
 , fetchpatch
 , glibmm
-, kernel
 , libavc1394
 , libconfig
 , libiec61883
@@ -22,7 +21,6 @@
 }:
 
 let
-  inherit (python3.pkgs) pyqt5 dbus-python;
   python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
 in
 mkDerivation rec {
@@ -61,7 +59,7 @@ mkDerivation rec {
     pkg-config
     which
     python
-    pyqt5
+    python3.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 64607c5653eb5..768d07dab900f 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , libapparmor
 , which
diff --git a/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix b/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
index 988aabd85779a..655b8f7ddedd9 100644
--- a/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
+++ b/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation  rec {
 
   meta = with lib; {
     homepage = "https://github.com/winterheart/broadcom-bt-firmware/";
-    description = "A tool that converts hex to hcd based on inf file";
+    description = "Tool that converts hex to hcd based on inf file";
     mainProgram = "bt-fw-converter";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index af455e7ef61fa..1682f16c39035 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , udev
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     rustc
     pkg-config
     rustPlatform.cargoSetupHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -53,7 +53,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Graphical frontend for firmware management";
     homepage = "https://github.com/pop-os/firmware-manager";
-    license = lib.licenses.gpl3;
+    license = with lib.licenses; [ gpl3Plus cc0 ];
+    mainProgram = "com.system76.FirmwareManager";
     maintainers = [ lib.maintainers.shlevy ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
index d89c4a7b140a5..0faec11702211 100644
--- a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
@@ -1,8 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, fetchFromGitHub
-, substituteAll
+, fetchpatch
 , pkg-config
 , meson
 , ninja
diff --git a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
index 71a7cd9e947b5..31ac23df39606 100644
--- a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
+++ b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -52,9 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with sourceTypes; [
       binaryFirmware
     ];
-    maintainers = with maintainers; [
-      hexa
-    ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 })
diff --git a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
index e2f2fd4f9fee0..3ad52b314537d 100644
--- a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
@@ -40,9 +40,7 @@ stdenv.mkDerivation {
     sourceProvenance = with sourceTypes; [
       binaryFirmware
     ];
-    maintainers = with maintainers; [
-      hexa
-    ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index 3739c1dc3e463..adaa4968fd565 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,7 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20240410";
-  revision = "20240410";
-  sourceHash = "sha256-Qo4f5kdHlBYKlzdFOtoKoCPHXxgDeCawSE3tnRwfC4U=";
-  outputHash = "sha256-pOYDdb0A1sESiT0kfA4DbWxKJ3+pog54+S3KcQB3BsA=";
+  version = "20240610";
+  revision = "20240610";
+  sourceHash = "sha256-tjDqviOMvrBoEG8+Yn+XqdBlIDfQUX0KK2kpW6/jed8=";
+  outputHash = "sha256-2VxzN778TLov5N1DPSnnkT7wQnLg85PyKsljZOoSoNM=";
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 386df843971cf..b2125170db14d 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -2,22 +2,22 @@
 
 stdenvNoCC.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
-  version = "unstable-2023-11-15";
+  version = "unstable-2024-02-26";
 
   srcs = [
     (fetchFromGitHub {
       name = "bluez-firmware";
       owner = "RPi-Distro";
       repo = "bluez-firmware";
-      rev = "d9d4741caba7314d6500f588b1eaa5ab387a4ff5";
-      hash = "sha256-CjbZ3t3TW/iJ3+t9QKEtM9NdQU7SwcUCDYuTmFEwvhU=";
+      rev = "78d6a07730e2d20c035899521ab67726dc028e1c";
+      hash = "sha256-KakKnOBeWxh0exu44beZ7cbr5ni4RA9vkWYb9sGMb8Q=";
     })
     (fetchFromGitHub {
       name = "firmware-nonfree";
       owner = "RPi-Distro";
       repo = "firmware-nonfree";
-      rev = "88aa085bfa1a4650e1ccd88896f8343c22a24055";
-      hash = "sha256-Yynww79LPPkau4YDSLI6IMOjH64nMpHUdGjnCfIR2+M=";
+      rev = "223ccf3a3ddb11b3ea829749fbbba4d65b380897";
+      hash = "sha256-BGq0+cr+xBRwQM/LqiQuRWuZpQsKM5jfcrNCqWMuVzM=";
     })
   ];
 
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
index 72c6f6235548d..4ff7bf48b920c 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
@@ -48,6 +48,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/raspberrypi/tools";
     license = licenses.bsd3;
     platforms = [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index 0aea94bca067f..ece39dade72b0 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -3,16 +3,13 @@
 stdenvNoCC.mkDerivation rec {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-firmware";
-  # raspberrypi/firmware no longers tag the releases. However, since each commit
-  # on the stable branch corresponds to a tag in raspberrypi/linux repo, we
-  # assume they are cut together.
-  version = "stable_20231123";
+  version = "1.20240529";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
-    rev = "524247ac6d8b1f4ddd53730e978a70c76a320bd6";
-    hash = "sha256-rESwkR7pc5MTwIZ8PaMUPXuzxfv+jVpdRp8ijvxHGcg=";
+    rev = version;
+    hash = "sha256-KsCo7ZG6vKstxRyFljZtbQvnDSqiAPdUza32xTY/tlA=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/zd1211/default.nix b/pkgs/os-specific/linux/firmware/zd1211/default.nix
index eb6276d36ac99..ecf131effd40a 100644
--- a/pkgs/os-specific/linux/firmware/zd1211/default.nix
+++ b/pkgs/os-specific/linux/firmware/zd1211/default.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "Firmware for the ZyDAS ZD1211(b) 802.11a/b/g USB WLAN chip";
     homepage = "https://sourceforge.net/projects/zd1211/";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix
index 18afaaa6d29b5..4961450fa36e3 100644
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fnotifystat";
-  version = "0.02.11";
+  version = "0.03.00";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-CwjaDL5pt2HMUhq0Q3s6Ssp3jr9uwCdVhT1JzlKcQQw=";
+    hash = "sha256-UGww0/m+JMftQyAguc8UpPrtIphjCq9TINabFaAKN0A=";
   };
 
   installFlags = [
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index 75ca64833a599..8454987343b0f 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Process fork/exec/exit monitoring tool";
     mainProgram = "forkstat";
     homepage = "https://github.com/ColinIanKing/forkstat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
   };
diff --git a/pkgs/os-specific/linux/forktty/default.nix b/pkgs/os-specific/linux/forktty/default.nix
index 7dc1f0c3b2e4c..7240368861380 100644
--- a/pkgs/os-specific/linux/forktty/default.nix
+++ b/pkgs/os-specific/linux/forktty/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool to detach from controlling TTY and attach to another";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/framework-laptop-kmod/default.nix b/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
index b5cb505e09a2c..c31ce1b84b6b1 100644
--- a/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
+++ b/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
@@ -29,9 +29,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A kernel module that exposes the Framework Laptop (13, 16)'s battery charge limit and LEDs to userspace.";
+    description = "Kernel module that exposes the Framework Laptop (13, 16)'s battery charge limit and LEDs to userspace";
     homepage = "https://github.com/DHowett/framework-laptop-kmod";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ gaykitty ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
index e94f6370da984..27c17ea793e6f 100644
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.11.1";
+  version = "4.12.1";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-Ubq2xAqBvjUwrzD2R6tB0i1WsdA0Y0jnJLgi4p4r8D4=";
+    sha256 = "sha256-SPZ+QgssDKG1Hz1oqtVdg864qtcvncuOlzTWjN4+loM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 8b54a1f9a7456..2cf5243422e15 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    hash = "sha256-4Im3YWhLs5Q+o4DtpSuSMuKtKqXaICL9/EB0q5um6mQ=";
+    hash = "sha256-US1jw0XK1BcP037XPhttzBloDU62m4BVSIbsGs9LaJU=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
       --replace "/usr/local" "$out"
   '';
 
-  vendorHash = "sha256-APW0XM6fTQOCw4tE1NA5VNN3fBUmsvn99NqqJnB3Q0s=";
+  vendorHash = "sha256-FuVWV3Rimhd+Pm9wrKGLWQWtbP1hWvoWa22pQT+m2go=";
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/linux/fsverity-utils/default.nix b/pkgs/os-specific/linux/fsverity-utils/default.nix
index 7d0f1f48e7e54..911b1f1fa1953 100644
--- a/pkgs/os-specific/linux/fsverity-utils/default.nix
+++ b/pkgs/os-specific/linux/fsverity-utils/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#userspace-utility";
     changelog = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/tree/NEWS.md";
-    description = "A set of userspace utilities for fs-verity";
+    description = "Set of userspace utilities for fs-verity";
     mainProgram = "fsverity";
     license = licenses.mit;
     maintainers = with maintainers; [ jk ];
diff --git a/pkgs/os-specific/linux/fswebcam/default.nix b/pkgs/os-specific/linux/fswebcam/default.nix
index 1f45d7955da49..08b1b9935291e 100644
--- a/pkgs/os-specific/linux/fswebcam/default.nix
+++ b/pkgs/os-specific/linux/fswebcam/default.nix
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     mainProgram = "fswebcam";
     homepage = "http://www.sanslogic.co.uk/fswebcam";
     platforms = lib.platforms.linux;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index a73cc1896ecdc..dd24730104f36 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,38 +1,43 @@
 { stdenv
 , lib
-, fetchFromGitHub
+, fetchFromGitLab
+, cmake
 , pkg-config
-, hostname
+, libusb1
+, libftdi1
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "unstable-2022-12-03";
+  version = "0-unstable-2024-04-23";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
+    domain = "gitlab.howett.net";
     owner = "DHowett";
-    repo = "fw-ectool";
-    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
-    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
+    repo = "ectool";
+    rev = "abdd574ebe3640047988cb928bb6789a15dd1390";
+    hash = "sha256-j0Z2Uo1LBXlHZVHPm4Xjx3LZaI6Qq0nSdViyC/CjWC8=";
   };
 
   nativeBuildInputs = [
+    cmake
     pkg-config
-    hostname
   ];
 
-  buildPhase = ''
-    patchShebangs util
-    make out=out utils
-  '';
+  buildInputs = [
+    libusb1
+    libftdi1
+  ];
 
   installPhase = ''
-    install -D out/util/ectool $out/bin/ectool
+    runHook preInstall
+    install -Dm555 src/ectool "$out/bin/ectool"
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://github.com/DHowett/framework-ec";
+    homepage = "https://gitlab.howett.net/DHowett/ectool";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index f04b8fcd21089..2d438a8a88c68 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "24.01.00";
+  version = "24.03.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-MXWmKxcxgSVCSeeGlWsa8JTBa5hLyvGPZ0811w+s+yA=";
+    sha256 = "sha256-UKL5q5sURSVXvEOzoZdG+wWBSS5f9YWo5stViY3F2vg=";
     stripRoot = false;
   };
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.ubuntu.com/FirmwareTestSuite";
     description = "Firmware Test Suite";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ tadfisher ];
   };
 }
diff --git a/pkgs/os-specific/linux/g15daemon/default.nix b/pkgs/os-specific/linux/g15daemon/default.nix
index 90a818be49472..528b5e0993f54 100644
--- a/pkgs/os-specific/linux/g15daemon/default.nix
+++ b/pkgs/os-specific/linux/g15daemon/default.nix
@@ -1,14 +1,10 @@
 { stdenv
 , lib
-, fetchFromGitHub
 , fetchurl
-, fetchpatch
-, patchelf
-, freetype
 , libusb-compat-0_1
 }:
 let
-  license = lib.licenses.gpl2;
+  license = lib.licenses.gpl2Plus;
   maintainers = with lib.maintainers; [ peterhoeg ];
 
   g15src = { pname, version, sha256 }: fetchurl {
@@ -49,7 +45,7 @@ let
     enableParallelBuilding = true;
 
     meta = {
-      description = "A small graphics library optimised for drawing on an LCD";
+      description = "Small graphics library optimised for drawing on an LCD";
       inherit license maintainers;
     };
   };
@@ -87,7 +83,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
-    description = "A daemon that makes it possible to use the Logitech keyboard G-Buttons and draw on various Logitech LCDs";
+    description = "Daemon that makes it possible to use the Logitech keyboard G-Buttons and draw on various Logitech LCDs";
     mainProgram = "g15daemon";
     inherit license maintainers;
   };
diff --git a/pkgs/os-specific/linux/game-devices-udev-rules/default.nix b/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
index daaf23db6ce2c..ca2ef7a4498e5 100644
--- a/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
@@ -6,20 +6,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "game-devices-udev-rules";
-  version = "0.22";
+  version = "0.23";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "fabiscafe";
     repo = "game-devices-udev";
     rev = finalAttrs.version;
-    hash = "sha256-1aOb8pJxB+/PM7spcvZcy/cwdEolHQ4+lwBLij+6iDk=";
+    hash = "sha256-dWWo3qXnxdLP68NuFKM4/Cw5yE6uAsWzj0vZa9UTT0U=";
   };
 
   postInstall = ''
     install -Dm444 -t "$out/lib/udev/rules.d" *.rules
     substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
-    --replace "/bin/sh" "${bash}/bin/bash"
+    --replace-fail "/bin/sh" "${bash}/bin/bash"
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/gasket/default.nix b/pkgs/os-specific/linux/gasket/default.nix
index c1e81dfa9b712..e8df9acf8e4b5 100644
--- a/pkgs/os-specific/linux/gasket/default.nix
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   meta = with lib; {
-    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
+    description = "Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems";
     homepage = "https://github.com/google/gasket-driver";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = [ lib.maintainers.kylehendricks ];
     platforms = platforms.linux;
     broken = versionOlder kernel.version "5.15";
diff --git a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
index 1f0265207dfbf..a1e3a8be430e5 100644
--- a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
+++ b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Kernel module for overclocking the Nintendo Wii U/Mayflash GameCube adapter";
     homepage = "https://github.com/HannesMann/gcadapter-oc-kmod";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ r-burns ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/gobi_loader/default.nix b/pkgs/os-specific/linux/gobi_loader/default.nix
index 2b251242119c8..2783e9f559b82 100644
--- a/pkgs/os-specific/linux/gobi_loader/default.nix
+++ b/pkgs/os-specific/linux/gobi_loader/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Firmware loader for Qualcomm Gobi USB chipsets";
     homepage = "https://www.codon.org.uk/~mjg59/gobi_loader/";
-    license = with licenses; [ gpl2 ];
+    license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ _0x4A6F ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/gt/default.nix b/pkgs/os-specific/linux/gt/default.nix
index 9d35556358b5c..e5a6967579808 100644
--- a/pkgs/os-specific/linux/gt/default.nix
+++ b/pkgs/os-specific/linux/gt/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Linux command line tool for setting up USB gadgets using configfs";
     mainProgram = "gt";
     license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ lheckemann ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index e082038730111..def7248c3b2c6 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -21,7 +21,7 @@
 # can be turned off if used as a library
 , useGtk ? true
 , gtk3 ? null
-, wrapGAppsHook ? null
+, wrapGAppsHook3 ? null
 }:
 
 assert pulseaudioSupport -> libpulseaudio != null;
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     intltool
     pkg-config
   ]
-    ++ lib.optionals (useGtk) [ wrapGAppsHook ]
+    ++ lib.optionals (useGtk) [ wrapGAppsHook3 ]
     ++ lib.optionals (useQt) [ wrapQtAppsHook ]
   ;
 
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   ;
 
   meta = with lib; {
-    description = "A simple interface for devices supported by the linux UVC driver";
+    description = "Simple interface for devices supported by the linux UVC driver";
     mainProgram = "guvcview";
     homepage = "https://guvcview.sourceforge.net";
     maintainers = [ maintainers.coconnor ];
diff --git a/pkgs/os-specific/linux/hdapsd/default.nix b/pkgs/os-specific/linux/hdapsd/default.nix
index e9dca6fd8927e..43700d20aa9aa 100644
--- a/pkgs/os-specific/linux/hdapsd/default.nix
+++ b/pkgs/os-specific/linux/hdapsd/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     { description = "Hard Drive Active Protection System Daemon";
       mainProgram = "hdapsd";
       homepage = "http://hdaps.sf.net/";
-      license = licenses.gpl2;
+      license = licenses.gpl2Plus;
       platforms = platforms.linux;
       maintainers = [ maintainers.ehmry ];
     };
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index 3e23e3a7da7b0..156901d3643d7 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = with lib; {
-    description = "A tool to get/set ATA/SATA drive parameters under Linux";
+    description = "Tool to get/set ATA/SATA drive parameters under Linux";
     homepage = "https://sourceforge.net/projects/hdparm/";
     platforms = platforms.linux;
     license = licenses.bsd2;
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
index e63b7ca7fe258..e55433c0a70bd 100644
--- a/pkgs/os-specific/linux/health-check/default.nix
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "Process monitoring tool";
     mainProgram = "health-check";
     homepage = "https://github.com/ColinIanKing/health-check";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
   };
diff --git a/pkgs/os-specific/linux/hibernate/default.nix b/pkgs/os-specific/linux/hibernate/default.nix
index 71a93e4a154e6..dfd3407f2a03d 100644
--- a/pkgs/os-specific/linux/hibernate/default.nix
+++ b/pkgs/os-specific/linux/hibernate/default.nix
@@ -32,7 +32,7 @@ in
     '';
 
     meta = {
-      description = "The `hibernate' script for swsusp and Tux-on-Ice";
+      description = "`hibernate' script for swsusp and Tux-on-Ice";
       mainProgram = "hibernate";
       longDescription = ''
         This package provides the `hibernate' script, a command-line utility
diff --git a/pkgs/os-specific/linux/hid-t150/default.nix b/pkgs/os-specific/linux/hid-t150/default.nix
new file mode 100644
index 0000000000000..b3800ec5cfa37
--- /dev/null
+++ b/pkgs/os-specific/linux/hid-t150/default.nix
@@ -0,0 +1,40 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+}:
+
+stdenv.mkDerivation {
+  pname = "hid-t150";
+  #https://github.com/scarburato/t150_driver/blob/165d0601e11576186c9416c40144927549ef804d/install.sh#L3
+  version = "0.8a";
+
+  src = fetchFromGitHub {
+    owner = "scarburato";
+    repo = "t150_driver";
+    rev = "580b79b7b479076ba470fcc21fbd8484f5328546";
+    hash = "sha256-6xqm8500+yMXA/WonMv1JAOS/oIeSNDp9HFuYkEd03U=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  sourceRoot = "source/hid-t150";
+
+  makeFlags = kernel.makeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  installPhase = ''
+    make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build M=$(pwd) modules_install $makeFlags
+  '';
+
+  meta = with lib; {
+    description = "Linux kernel driver for Thrustmaster T150 and TMX Force Feedback wheel";
+    homepage = "https://github.com/scarburato/t150_driver";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.dbalan ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/hid-tmff2/default.nix b/pkgs/os-specific/linux/hid-tmff2/default.nix
index ac297c78e10e4..bc296e9ab6222 100644
--- a/pkgs/os-specific/linux/hid-tmff2/default.nix
+++ b/pkgs/os-specific/linux/hid-tmff2/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   postPatch = "sed -i '/depmod -A/d' Makefile";
 
   meta = with lib; {
-    description = "A linux kernel module for Thrustmaster T300RS, T248 and TX(experimental)";
+    description = "Linux kernel module for Thrustmaster T300RS, T248 and TX(experimental)";
     homepage = "https://github.com/Kimplul/hid-tmff2";
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.rayslash ];
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 23ace63249b19..1187cd2194570 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -103,8 +103,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://w1.fi/hostapd/";
-    description = "A user space daemon for access point and authentication servers";
-    license = licenses.gpl2;
+    description = "User space daemon for access point and authentication servers";
+    license = licenses.bsd3;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 83519d7f2a7ac..320f10d551380 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.381";
+  version = "0.382";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-FD1p4qyO+ZsBdMXRa9u6CpO07RewWH8OxULLxcYAsyk=";
+    hash = "sha256-j7ITcLilcnV8QCUFC/Ybv1dX6Kl36P0G9vBlrzifhFQ=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix
index 9bd5ca302da36..5a7279ba998cb 100644
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -47,10 +47,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A better i7 (and now i3, i5) reporting tool for Linux";
+    description = "Better i7 (and now i3, i5) reporting tool for Linux";
     mainProgram = "i7z";
     homepage = "https://github.com/DimitryAndric/i7z";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ bluescreen303 ];
     # broken on ARM
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/i810switch/default.nix b/pkgs/os-specific/linux/i810switch/default.nix
index 3a202ca08e96c..a5e24b1eb2936 100644
--- a/pkgs/os-specific/linux/i810switch/default.nix
+++ b/pkgs/os-specific/linux/i810switch/default.nix
@@ -17,10 +17,10 @@ stdenv.mkDerivation {
   };
 
   meta = with lib; {
-    description = "A utility for switching between the LCD and external VGA display on Intel graphics cards";
+    description = "Utility for switching between the LCD and external VGA display on Intel graphics cards";
     homepage = "http://www16.plala.or.jp/mano-a-mano/i810switch.html";
     maintainers = with maintainers; [ ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ifenslave/default.nix b/pkgs/os-specific/linux/ifenslave/default.nix
index cc132c69faf71..8aeeff77ecbb7 100644
--- a/pkgs/os-specific/linux/ifenslave/default.nix
+++ b/pkgs/os-specific/linux/ifenslave/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Utility for enslaving networking interfaces under a bond";
     mainProgram = "ifenslave";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ima-evm-utils/default.nix b/pkgs/os-specific/linux/ima-evm-utils/default.nix
index fa90ceecdb2b1..5960e49e78250 100644
--- a/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "evmctl utility to manage digital signatures of the Linux kernel integrity subsystem (IMA/EVM)";
     mainProgram = "evmctl";
     homepage = "https://sourceforge.net/projects/linux-ima/";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ nickcao ];
   };
diff --git a/pkgs/os-specific/linux/input-utils/default.nix b/pkgs/os-specific/linux/input-utils/default.nix
deleted file mode 100644
index 36a203a47c76b..0000000000000
--- a/pkgs/os-specific/linux/input-utils/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, stdenv, fetchurl, linuxHeaders }:
-
-stdenv.mkDerivation rec {
-  pname = "input-utils";
-  version = "1.3";
-
-  src = fetchurl {
-    url = "https://www.kraxel.org/releases/input/input-${version}.tar.gz";
-    sha256 = "11w0pp20knx6qpgzmawdbk1nj2z3fzp8yd6nag6s8bcga16w6hli";
-  };
-
-  prePatch = ''
-    # Use proper include path for kernel include files.
-    substituteInPlace ./name.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/"
-    substituteInPlace ./lirc.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/"
-  '';
-
-  makeFlags = [
-    "prefix=$(out)"
-    "STRIP="
-  ];
-
-  meta = with lib; {
-    description = "Input layer utilities, includes lsinput";
-    homepage    = "https://www.kraxel.org/blog/linux/input/";
-    license     = licenses.gpl2;
-    maintainers = with maintainers; [ samueldr ];
-    platforms   = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index e686e06804197..8f5655a90cbdf 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.13.29138.7";
+  version = "24.17.29377.6";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-AMIuA1AMrSX0xpdGSfye8iUJTk5s9HDiRy9Yy3kZss8=";
+    hash = "sha256-+bx6P1vZlgolHrINzkH4ukXT+hgAtH18DOX6vb9vPVs=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/intel-speed-select/default.nix b/pkgs/os-specific/linux/intel-speed-select/default.nix
index 9d9c9b134c64e..97bfdbeb30d5c 100644
--- a/pkgs/os-specific/linux/intel-speed-select/default.nix
+++ b/pkgs/os-specific/linux/intel-speed-select/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     description = "Tool to enumerate and control the Intel Speed Select Technology features";
     mainProgram = "intel-speed-select";
     homepage = "https://www.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
     broken = kernel.kernelAtLeast "5.18";
   };
diff --git a/pkgs/os-specific/linux/iomelt/default.nix b/pkgs/os-specific/linux/iomelt/default.nix
index 331c9020a4804..8796b740c3473 100644
--- a/pkgs/os-specific/linux/iomelt/default.nix
+++ b/pkgs/os-specific/linux/iomelt/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "A simple yet effective way to benchmark disk IO in Linux systems";
+    description = "Simple yet effective way to benchmark disk IO in Linux systems";
     homepage = "https://github.com/camposr/iomelt";
     maintainers = with maintainers; [ raspher ];
     license = licenses.artistic2;
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index 41647a2378e49..767bf4a2915ce 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -19,9 +19,9 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "A tool to find out the processes doing the most IO";
+    description = "Tool to find out the processes doing the most IO";
     homepage = "http://guichaz.free.fr/iotop";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     mainProgram = "iotop";
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 031dbfa700bc8..effe5eb8526b9 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  configureFlags = [
+    "--color" "auto"
+  ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
@@ -46,7 +50,9 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [ bison flex pkg-config ];
-  buildInputs = [ db iptables elfutils libmnl ];
+  buildInputs = [ db iptables libmnl ]
+    # needed to uploaded bpf programs
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ elfutils ];
 
   enableParallelBuilding = true;
 
@@ -58,9 +64,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://wiki.linuxfoundation.org/networking/iproute2";
-    description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";
+    description = "Collection of utilities for controlling TCP/IP networking and traffic control in Linux";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ primeos eelco fpletz globin ];
   };
 }
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 4b8fadcecf25c..94a5a43b76e19 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://ipset.netfilter.org/";
     description = "Administration tool for IP sets";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index b82484514e5f7..afaa91ca2f37e 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -50,11 +50,11 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    description = "A program to configure the Linux IP packet filtering ruleset";
+    description = "Program to configure the Linux IP packet filtering ruleset";
     homepage = "https://www.netfilter.org/projects/iptables/index.html";
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     downloadPage = "https://www.netfilter.org/projects/iptables/files/";
   };
 }
diff --git a/pkgs/os-specific/linux/ipu6-drivers/default.nix b/pkgs/os-specific/linux/ipu6-drivers/default.nix
index fe9cb1da018c6..cb1cf06b530e9 100644
--- a/pkgs/os-specific/linux/ipu6-drivers/default.nix
+++ b/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/intel/ipu6-drivers";
     description = "IPU6 kernel driver";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ hexa ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
     platforms = [ "x86_64-linux" ];
     # requires 6.1.7 https://github.com/intel/ipu6-drivers/pull/84
     broken = kernel.kernelOlder "6.1.7";
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 75d706b63f952..1be7debb895cc 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/iputils/iputils";
     changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
-    description = "A set of small useful utilities for Linux networking";
+    description = "Set of small useful utilities for Linux networking";
     longDescription = ''
       A set of small useful utilities for Linux networking including:
 
@@ -79,6 +79,6 @@ stdenv.mkDerivation rec {
     '';
     license = with licenses; [ gpl2Plus bsd3 ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos lheckemann ];
+    maintainers = with maintainers; [ primeos ];
   };
 }
diff --git a/pkgs/os-specific/linux/ipvsadm/default.nix b/pkgs/os-specific/linux/ipvsadm/default.nix
index c988167469188..c6447e9a9b578 100644
--- a/pkgs/os-specific/linux/ipvsadm/default.nix
+++ b/pkgs/os-specific/linux/ipvsadm/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux Virtual Server support programs";
     homepage = "http://www.linuxvirtualserver.org/software/ipvs.html";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 5e4b7fff489ca..48e2774aaa96b 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, glib, ncurses, libcap_ng }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, glib, ncurses, libcap_ng }:
 
 stdenv.mkDerivation rec {
   pname = "irqbalance";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/Irqbalance/irqbalance";
     changelog = "https://github.com/Irqbalance/irqbalance/releases/tag/v${version}";
-    description = "A daemon to help balance the cpu load generated by interrupts across all of a systems cpus";
+    description = "Daemon to help balance the cpu load generated by interrupts across all of a systems cpus";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ moni ];
diff --git a/pkgs/os-specific/linux/ivsc-driver/default.nix b/pkgs/os-specific/linux/ivsc-driver/default.nix
index 72173de49baa5..1308ff5f37cf4 100644
--- a/pkgs/os-specific/linux/ivsc-driver/default.nix
+++ b/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/intel/ivsc-driver";
     description = "Intel Vision Sensing Controller kernel driver";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ hexa ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
     platforms = [ "x86_64-linux" ];
     broken = kernel.kernelOlder "5.15";
   };
diff --git a/pkgs/os-specific/linux/iw/default.nix b/pkgs/os-specific/linux/iw/default.nix
deleted file mode 100644
index 4c1d94f02e6bc..0000000000000
--- a/pkgs/os-specific/linux/iw/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, libnl }:
-
-stdenv.mkDerivation rec {
-  pname = "iw";
-  version = "5.19";
-
-  src = fetchurl {
-    url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8We76UfdU7uevAwdzvXbatc6wdYITyxvk3bFw2DMTU4=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libnl ];
-
-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
-
-  meta = {
-    description = "Tool to use nl80211";
-    mainProgram = "iw";
-    longDescription = ''
-      iw is a new nl80211 based CLI configuration utility for wireless devices.
-      It supports all new drivers that have been added to the kernel recently.
-      The old tool iwconfig, which uses Wireless Extensions interface, is
-      deprecated and it's strongly recommended to switch to iw and nl80211.
-    '';
-    homepage = "https://wireless.wiki.kernel.org/en/users/Documentation/iw";
-    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ viric primeos ];
-    platforms = with lib.platforms; linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/ixgbevf/default.nix b/pkgs/os-specific/linux/ixgbevf/default.nix
index 6a748c4701903..3cb9d06e7fcf4 100644
--- a/pkgs/os-specific/linux/ixgbevf/default.nix
+++ b/pkgs/os-specific/linux/ixgbevf/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel 82599 Virtual Function Driver";
     homepage = "https://sourceforge.net/projects/e1000/files/ixgbevf%20stable/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     priority = 20;
     # kernels ship ixgbevf driver for a long time already, maybe switch to a newest kernel?
     broken = versionAtLeast kernel.version "5.2";
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index ee5ee1128a867..904bb7366f7e2 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     homepage = "https://www.jool.mx/";
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - CLI tools";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/jujuutils/default.nix b/pkgs/os-specific/linux/jujuutils/default.nix
index 12e4c15e62c0b..8c5dabf66a900 100644
--- a/pkgs/os-specific/linux/jujuutils/default.nix
+++ b/pkgs/os-specific/linux/jujuutils/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://github.com/cladisch/linux-firewire-utils";
     description = "Utilities around FireWire devices connected to a Linux computer";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/kbdlight/default.nix b/pkgs/os-specific/linux/kbdlight/default.nix
index b41e4cd4da1c9..4d6172fa39fe7 100644
--- a/pkgs/os-specific/linux/kbdlight/default.nix
+++ b/pkgs/os-specific/linux/kbdlight/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/hobarrera/kbdlight";
-    description = "A very simple application that changes MacBooks' keyboard backlight level";
+    description = "Very simple application that changes MacBooks' keyboard backlight level";
     mainProgram = "kbdlight";
     license = licenses.isc;
     maintainers = [ maintainers.womfoo ];
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index fc2f8ddbd1434..450e26b4eca17 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -104,19 +104,19 @@ let
 
     meta = with lib; {
       description = "Header files and scripts for Linux kernel";
-      license = licenses.gpl2;
+      license = licenses.gpl2Only;
       platforms = platforms.linux;
     };
   };
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "6.7"; in
+  linuxHeaders = let version = "6.9"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-7zEUSiV20IDYwxaY6D7J9mv5fGd/oqrw1bu58zRbEGk=";
+        hash = "sha256-JPoB+5icej4oRT8Rd5kWhxN2bhGcU4HawwEV8Y8mgUk=";
       };
       patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c213bd4e6ffec..551d4cffbb923 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -327,6 +327,10 @@ let
       INET_RAW_DIAG     = mkDefault module;
       INET_DIAG_DESTROY = mkDefault yes;
 
+      # IPsec over TCP
+      INET_ESPINTCP  = whenAtLeast "5.8" yes;
+      INET6_ESPINTCP = whenAtLeast "5.8" yes;
+
       # enable multipath-tcp
       MPTCP           = whenAtLeast "5.6" yes;
       MPTCP_IPV6      = whenAtLeast "5.6" yes;
@@ -435,13 +439,14 @@ let
       DRM_GMA500             = whenAtLeast "5.12" module;
       DRM_GMA600             = whenOlder "5.13" yes;
       DRM_GMA3600            = whenOlder "5.12" yes;
-      DRM_VMWGFX_FBCON       = whenOlder "6.2" yes;
+      DRM_VMWGFX_FBCON       = whenOlder "6.1" yes;
       # (experimental) amdgpu support for verde and newer chipsets
       DRM_AMDGPU_SI = yes;
       # (stable) amdgpu support for bonaire and newer chipsets
       DRM_AMDGPU_CIK = yes;
       # Allow device firmware updates
-      DRM_DP_AUX_CHARDEV = yes;
+      DRM_DP_AUX_CHARDEV = whenOlder "6.10" yes;
+      DRM_DISPLAY_DP_AUX_CHARDEV = whenAtLeast "6.10" yes;
       # amdgpu display core (DC) support
       DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
@@ -470,7 +475,8 @@ let
       MEDIA_CEC_RC = whenAtLeast "5.10" yes;
 
       # Enable CEC over DisplayPort
-      DRM_DP_CEC = yes;
+      DRM_DP_CEC = whenOlder "6.10" yes;
+      DRM_DISPLAY_DP_AUX_CEC = whenAtLeast "6.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
       DRM_I915_GVT = yes;
@@ -615,8 +621,8 @@ let
       F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
       UDF_FS              = module;
 
-      NFSD_V2_ACL            = whenOlder "5.15" yes;
-      NFSD_V3                = whenOlder "5.15" yes;
+      NFSD_V2_ACL            = whenOlder "5.10" yes;
+      NFSD_V3                = whenOlder "5.10" yes;
       NFSD_V3_ACL            = yes;
       NFSD_V4                = yes;
       NFSD_V4_SECURITY_LABEL = yes;
@@ -871,12 +877,14 @@ let
     };
 
     zram = {
-      ZRAM            = module;
-      ZRAM_WRITEBACK  = option yes;
-      ZRAM_MULTI_COMP = whenAtLeast "6.2" yes;
-      ZSWAP           = option yes;
-      ZPOOL           = yes;
-      ZBUD            = option yes;
+      ZRAM                          = module;
+      ZRAM_WRITEBACK                = option yes;
+      ZRAM_MULTI_COMP               = whenAtLeast "6.2" yes;
+      ZRAM_DEF_COMP_ZSTD            = whenAtLeast "5.11" yes;
+      ZSWAP                         = option yes;
+      ZSWAP_COMPRESSOR_DEFAULT_ZSTD = whenAtLeast "5.7" (mkOptionDefault yes);
+      ZPOOL                         = yes;
+      ZSMALLOC                      = option yes;
     };
 
     brcmfmac = {
@@ -925,8 +933,10 @@ let
       # i686 issues: https://github.com/NixOS/nixpkgs/pull/117961#issuecomment-812106375
       useZstd = stdenv.buildPlatform.is64bit && versionAtLeast version "5.9";
     in {
-      KERNEL_XZ            = mkIf (!useZstd) yes;
-      KERNEL_ZSTD          = mkIf useZstd yes;
+      # stdenv.hostPlatform.linux-kernel.target assumes uncompressed on RISC-V.
+      KERNEL_UNCOMPRESSED  = mkIf stdenv.hostPlatform.isRiscV yes;
+      KERNEL_XZ            = mkIf (!stdenv.hostPlatform.isRiscV && !useZstd) yes;
+      KERNEL_ZSTD          = mkIf (!stdenv.hostPlatform.isRiscV && useZstd) yes;
 
       HID_BATTERY_STRENGTH = yes;
       # enabled by default in x86_64 but not arm64, so we do that here
@@ -948,8 +958,8 @@ let
       THRUSTMASTER_FF    = yes;
       ZEROPLUS_FF        = yes;
 
-      MODULE_COMPRESS    = whenOlder "5.13" yes;
-      MODULE_COMPRESS_XZ = yes;
+      MODULE_COMPRESS      = whenOlder "5.13" yes;
+      MODULE_COMPRESS_XZ   = yes;
 
       SYSVIPC            = yes;  # System-V IPC
 
@@ -1124,6 +1134,7 @@ let
       FW_LOADER_USER_HELPER_FALLBACK = option no;
 
       FW_LOADER_COMPRESS = whenAtLeast "5.3" yes;
+      FW_LOADER_COMPRESS_ZSTD = whenAtLeast "5.19" yes;
 
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 631217735d8fa..5981de6732426 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -97,7 +97,7 @@ let
   # For further context, see https://github.com/NixOS/nixpkgs/pull/143113#issuecomment-953319957
   basicArgs = builtins.removeAttrs
     args
-    (lib.filter (x: ! (builtins.elem x [ "version" "src" ])) (lib.attrNames args));
+    (lib.filter (x: ! (builtins.elem x [ "version" "pname" "src" ])) (lib.attrNames args));
 
   # Combine the `features' attribute sets of all the kernel patches.
   kernelFeatures = lib.foldr (x: y: (x.features or {}) // y) ({
@@ -140,8 +140,7 @@ let
     passAsFile = [ "kernelConfig" ];
 
     depsBuildBuild = [ buildPackages.stdenv.cc ];
-    nativeBuildInputs = [ perl gmp libmpc mpfr ]
-      ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+    nativeBuildInputs = [ perl gmp libmpc mpfr bison flex ]
       ++ lib.optional (lib.versionAtLeast version "5.2") pahole
       ++ lib.optionals withRust [ rust-bindgen rustc ]
     ;
@@ -221,7 +220,7 @@ let
     config = {
       CONFIG_MODULES = "y";
       CONFIG_FW_LOADER = "m";
-      CONFIG_RUST = lib.mkIf withRust "y";
+      CONFIG_RUST = if withRust then "y" else "n";
     };
   });
 
diff --git a/pkgs/os-specific/linux/kernel/gpio-utils.nix b/pkgs/os-specific/linux/kernel/gpio-utils.nix
index 40e282bbf541d..dc8f88b5769f7 100644
--- a/pkgs/os-specific/linux/kernel/gpio-utils.nix
+++ b/pkgs/os-specific/linux/kernel/gpio-utils.nix
@@ -19,6 +19,6 @@ stdenv.mkDerivation {
     description = "Linux tools to inspect the gpiochip interface";
     maintainers = with maintainers; [ kwohlfahrt ];
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index dec6a757c5290..d687366dbe2f8 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -88,7 +88,7 @@ assert (versionAtLeast version "4.9");
   UBSAN      = yes;
   UBSAN_TRAP = whenAtLeast "5.7" yes;
   UBSAN_BOUNDS = whenAtLeast "5.7" yes;
-  UBSAN_SANITIZE_ALL = yes;
+  UBSAN_SANITIZE_ALL = whenOlder "6.9" yes;
   UBSAN_LOCAL_BOUNDS = option yes; # clang only
   CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1
 
@@ -97,7 +97,7 @@ assert (versionAtLeast version "4.9");
   RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
 
   # Disable various dangerous settings
-  ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
+  ACPI_CUSTOM_METHOD = whenOlder "6.9" no; # Allows writing directly to physical memory
   PROC_KCORE         = no; # Exposes kernel text image layout
   INET_DIAG          = no; # Has been used for heap based attacks in the past
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 21772b2e03eb0..62f1fcdda20c6 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,81 +2,81 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.309-hardened1.patch",
-            "sha256": "1hww72w5anmfr9czqbl31glzl70s34492k9qz9zax141zg1sf6sp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.309-hardened1/linux-hardened-4.19.309-hardened1.patch"
+            "name": "linux-hardened-4.19.315-hardened1.patch",
+            "sha256": "1w17mwsv618pw5bkahmz6in0i5zjjxd3d14gggafqdd3dgfr1h8q",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.315-hardened1/linux-hardened-4.19.315-hardened1.patch"
         },
-        "sha256": "1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm",
-        "version": "4.19.309"
+        "sha256": "1j1j8awy0237jp2r211qpa305c10y7rlcbkxkzdvzbgyhwy4spkc",
+        "version": "4.19.315"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.212-hardened1.patch",
-            "sha256": "0h04i94vshhcli5m4qpnqg4vsi5v1ifvdhhklk7c0bvkfk35cbml",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.212-hardened1/linux-hardened-5.10.212-hardened1.patch"
+            "name": "linux-hardened-5.10.218-hardened1.patch",
+            "sha256": "1ah4pznha17ngg3w7l0j74h4910gjv8qj503adrap7plvapf82m4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.218-hardened1/linux-hardened-5.10.218-hardened1.patch"
         },
-        "sha256": "14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc",
-        "version": "5.10.212"
+        "sha256": "1mmj5hwm5i16gc1y4nzr1cs882vi6vrihrincdcivv63x11v4dlw",
+        "version": "5.10.218"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.151-hardened1.patch",
-            "sha256": "040jc5n9qsdz2wv5ksfvc28vd72nmya2i2f0ps0jiras6l2wlhjz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.151-hardened1/linux-hardened-5.15.151-hardened1.patch"
+            "name": "linux-hardened-5.15.160-hardened1.patch",
+            "sha256": "1r10ylx886rslsmrixlijjm4crhwzkl3wj6kpyn2344qik1gxpqr",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.160-hardened1/linux-hardened-5.15.160-hardened1.patch"
         },
-        "sha256": "0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la",
-        "version": "5.15.151"
+        "sha256": "018v19a7rhzc4szybzzn86jlnk42x7jm6xkadfd2d3xq6f7727pl",
+        "version": "5.15.160"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.271-hardened1.patch",
-            "sha256": "0rw5il7885d0d3k2hmh46541svib6rp32g00fcl5bw37ydmq3z8b",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.271-hardened1/linux-hardened-5.4.271-hardened1.patch"
+            "name": "linux-hardened-5.4.277-hardened1.patch",
+            "sha256": "1zjw5wl8lj69j402qm8dg3m4dxgq3ppx2jyz8jks976vyhh8fsg4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.277-hardened1/linux-hardened-5.4.277-hardened1.patch"
         },
-        "sha256": "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d",
-        "version": "5.4.271"
+        "sha256": "0l8zq3k07hdprfpvw69ykkf2pdg8wiv28xz733yxsjcfb0l5n7vy",
+        "version": "5.4.277"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.81-hardened1.patch",
-            "sha256": "0af9dxdsa858zyqc0vsrzg098afhg5vpb2wpr6gj2ykwc13iaf07",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.81-hardened1/linux-hardened-6.1.81-hardened1.patch"
+            "name": "linux-hardened-6.1.92-hardened1.patch",
+            "sha256": "0cw87ygmisi823y3f7xrck12b6zh3mq1qmb7lcmr3hg6w3xskmn3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.92-hardened1/linux-hardened-6.1.92-hardened1.patch"
         },
-        "sha256": "0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f",
-        "version": "6.1.81"
+        "sha256": "1j9n8gk76nn4gw42iba5zgghr360gb9n1mslr5dyv76wpwkz86ch",
+        "version": "6.1.92"
     },
-    "6.5": {
+    "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.5.13-hardened1.patch",
-            "sha256": "1fj6yaq2gdjlj2h19vkm13jrx0yiczj6pvric1kq1r6cprqrkkki",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.13-hardened1/linux-hardened-6.5.13-hardened1.patch"
+            "name": "linux-hardened-6.6.32-hardened1.patch",
+            "sha256": "19362a6lxs3cnaw19jvda7n791y95lfgn9ki4wmaxnw2qbpi0bgg",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.32-hardened1/linux-hardened-6.6.32-hardened1.patch"
         },
-        "sha256": "1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq",
-        "version": "6.5.13"
+        "sha256": "1qbc8dqmk2xs1cz968rysw5xvhq3lj8g0pxp48fr2qbzy3m29a5a",
+        "version": "6.6.32"
     },
-    "6.6": {
+    "6.8": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.21-hardened1.patch",
-            "sha256": "0k35s5pj92lvfp6kw3isg78zc3gijsg0xbzcyvxdkmhzaq8j6i1i",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.21-hardened1/linux-hardened-6.6.21-hardened1.patch"
+            "name": "linux-hardened-6.8.11-hardened1.patch",
+            "sha256": "08i03dmri9h6jxcjd9g6s7pv0spqi3f4fgch1ars68cgngikvbpq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.8.11-hardened1/linux-hardened-6.8.11-hardened1.patch"
         },
-        "sha256": "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf",
-        "version": "6.6.21"
+        "sha256": "1di8kr596sf68sm61kp5rz6bn3sb0q5ag1qc5hm8f9dpyq4wv3dp",
+        "version": "6.8.11"
     },
-    "6.7": {
+    "6.9": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.7.6-hardened1.patch",
-            "sha256": "063yrs3g0knlz37aq979jhng9k6l19873nbi1jy167xfqmpqqajr",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.7.6-hardened1/linux-hardened-6.7.6-hardened1.patch"
+            "name": "linux-hardened-6.9.2-hardened1.patch",
+            "sha256": "0ph1m0pnlqrhvddz2mjgcwvs0ddcpzigz8kgi9zi063qinlfbm3q",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.9.2-hardened1/linux-hardened-6.9.2-hardened1.patch"
         },
-        "sha256": "1lrp7pwnxnqyy8c2l4n4nz997039gbnssrfm8ss8kl3h2c7fr2g4",
-        "version": "6.7.6"
+        "sha256": "1yg5j284y1gz7zwxjz2abvlnas259m1y1vzd9lmcqqar5kgmnv6l",
+        "version": "6.9.2"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index cb624ebe86b93..1e34ca209aa90 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -211,6 +211,7 @@ with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as kernel_versions_json:
 
 # Remove patches for unpackaged kernel versions.
 for kernel_key in sorted(patches.keys() - kernel_versions.keys()):
+    del patches[kernel_key]
     commit_patches(kernel_key=kernel_key, message="remove")
 
 g = Github(os.environ.get("GITHUB_TOKEN"))
diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix
index dad377db06abb..b811cf12bb01d 100644
--- a/pkgs/os-specific/linux/kernel/htmldocs.nix
+++ b/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -6,7 +6,6 @@
 , makeFontsConf
 , perl
 , python3
-, sphinx
 , which
 }:
 
@@ -48,11 +47,11 @@ stdenv.mkDerivation {
     cp -r Documentation/* $out/share/doc/linux-doc/
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Linux kernel html documentation";
     homepage = "https://www.kernel.org/doc/htmldocs/";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     inherit (linux_latest.meta) license;
-    maintainers = with maintainers; [ ];
+    maintainers = with lib.maintainers; [ sigmanificient ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b69c0f9c6003d..4722c0a64a057 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,34 +1,38 @@
 {
     "testing": {
-        "version": "6.9-rc6",
-        "hash": "sha256:075l5vhk8zmwln4jks7gr5n5k67s65qvs07l2rpbc7a75fdp6c14"
+        "version": "6.10-rc4",
+        "hash": "sha256:1cx7c25fa8pvabhwph0rdqdryalxgl7rs1ry0v4k048bxpisvahf"
     },
     "6.1": {
-        "version": "6.1.90",
-        "hash": "sha256:07cfg0chssvpc4mqls3aln6s4lqjp6k4x2n63wndmkjgfqpdg8w3"
+        "version": "6.1.95",
+        "hash": "sha256:1gfz2j6iixbr0dfkb8jkwnb4gicrm5rc5lsa24wmyrkm3nmg0q19"
     },
     "5.15": {
-        "version": "5.15.158",
-        "hash": "sha256:1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr"
+        "version": "5.15.161",
+        "hash": "sha256:0k277hz6nq62v0xfc1n2hc69cyvmnxpl0qcbszinajywh23gfafn"
     },
     "5.10": {
-        "version": "5.10.216",
-        "hash": "sha256:0lg1zfb9y4ps86q85mlnyalb3s90zix003z62jb9bw139f65h473"
+        "version": "5.10.220",
+        "hash": "sha256:16z1xqm7djm8pl15s5wvgc4pwq81gydcf00jpxfplw794kwszhvw"
     },
     "5.4": {
-        "version": "5.4.275",
-        "hash": "sha256:0k1hyknx854k8z27j4rq1gcp8l0xc0bspmrhc41a033gjilb1lns"
+        "version": "5.4.278",
+        "hash": "sha256:1245zf7vk2fyprw9fspljqy9wlzma9bayri7xx2g8iam2430d875"
     },
     "4.19": {
-        "version": "4.19.313",
-        "hash": "sha256:1j1r4mrdh1ray468jr5i8d2afiswb653bhq0ck8bcdw4rwp5w558"
+        "version": "4.19.316",
+        "hash": "sha256:0lmyhwr4la7kvim7jqdi29scjkvqp9crpvdbhpb4j8d7mj5kgzz4"
     },
     "6.6": {
-        "version": "6.6.30",
-        "hash": "sha256:1ilwmgpgvddwkd9nx5999cb6z18scjyq7jklid26k1hg7f35nsmn"
+        "version": "6.6.35",
+        "hash": "sha256:17nxymy3r9q45cfzc9rqp937m37zr1b8fjn1m0x0dv8jhxrfxqzw"
     },
     "6.8": {
-        "version": "6.8.9",
-        "hash": "sha256:1dn9bgmf03bdfbmgq98d043702g808rjikxs2i9yia57iqiz21gr"
+        "version": "6.8.12",
+        "hash": "sha256:0fb0m0fv4521g63gq04d7lm6hy8169s1rykiav5bkd99s9b1kcqr"
+    },
+    "6.9": {
+        "version": "6.9.6",
+        "hash": "sha256:0jvbv5g9xx76a4ni0b66gzj5i2y77gpmfdg0mdsg564rp3i6chsx"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 3344808ca2789..b5be3ba7230a9 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19546";
-    sha256 = "1yyj7pbfs02fki1rdxfj9gcrxdrl26igisy4fji7czcc9xbw03qm";
+    rev = "19584";
+    sha256 = "1vhk4jnx8f98lkj2isrms2jm9c5qrpgayxbhawslqrprq1pmzlif";
   }
 , ...
 }:
@@ -23,6 +23,7 @@ in linux.override {
   argsOverride = {
     modDirVersion = "${linux.modDirVersion}-${versionPrefix}";
     isLibre = true;
+    pname = "linux-libre";
 
     src = stdenv.mkDerivation {
       name = "${linux.name}-libre-src";
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index f1449998984be..775a50980f6d4 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -2,18 +2,19 @@
 
 let
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
-  modDirVersion = "6.1.63";
-  tag = "stable_20231123";
+  modDirVersion = "6.6.31";
+  tag = "stable_20240529";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
   inherit modDirVersion;
+  pname = "linux-rpi";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "linux";
     rev = tag;
-    hash = "sha256-4Rc57y70LmRFwDnOD4rHoHGmfxD9zYEAwYm9Wvyb3no=";
+    hash = "sha256-UWUTeCpEN7dlFSQjog6S3HyEWCCnaqiUqV5KxCjYink=";
   };
 
   defconfig = {
@@ -23,32 +24,33 @@ lib.overrideDerivation (buildLinux (args // {
     "4" = "bcm2711_defconfig";
   }.${toString rpiVersion};
 
+  structuredExtraConfig = (args.structuredExtraConfig or {}) // (with lib.kernel; {
+    # Workaround https://github.com/raspberrypi/linux/issues/6198
+    # Needed because NixOS 24.05+ sets DRM_SIMPLEDRM=y which pulls in
+    # DRM_KMS_HELPER=y.
+    BACKLIGHT_CLASS_DEVICE = yes;
+  });
+
   features = {
     efiBootStub = false;
   } // (args.features or {});
 
   kernelPatches = (args.kernelPatches or []) ++ [
-    # Fix "WARNING: unmet direct dependencies detected for MFD_RP1", and
-    # subsequent build failure.
-    # https://github.com/NixOS/nixpkgs/pull/268280#issuecomment-1911839809
-    # https://github.com/raspberrypi/linux/pull/5900
+    # Fix compilation errors due to incomplete patch backport.
+    # https://github.com/raspberrypi/linux/pull/6223
     {
-      name = "drm-rp1-depends-on-instead-of-select-MFD_RP1.patch";
+      name = "gpio-pwm_-_pwm_apply_might_sleep.patch";
       patch = fetchpatch {
-        url = "https://github.com/peat-psuwit/rpi-linux/commit/6de0bb51929cd3ad4fa27b2a421a2af12e6468f5.patch";
-        hash = "sha256-9pHcbgWTiztu48SBaLPVroUnxnXMKeCGt5vEo9V8WGw=";
+        url = "https://github.com/peat-psuwit/rpi-linux/commit/879f34b88c60dd59765caa30576cb5bfb8e73c56.patch";
+        hash = "sha256-HlOkM9EFmlzOebCGoj7lNV5hc0wMjhaBFFZvaRCI0lI=";
       };
     }
 
-    # Fix `ERROR: modpost: missing MODULE_LICENSE() in <...>/bcm2712-iommu.o`
-    # by preventing such code from being built as module.
-    # https://github.com/NixOS/nixpkgs/pull/284035#issuecomment-1913015802
-    # https://github.com/raspberrypi/linux/pull/5910
     {
-      name = "iommu-bcm2712-don-t-allow-building-as-module.patch";
+      name = "ir-rx51_-_pwm_apply_might_sleep.patch";
       patch = fetchpatch {
-        url = "https://github.com/peat-psuwit/rpi-linux/commit/693a5e69bddbcbe1d1b796ebc7581c3597685b1b.patch";
-        hash = "sha256-8BYYQDM5By8cTk48ASYKJhGVQnZBIK4PXtV70UtfS+A=";
+        url = "https://github.com/peat-psuwit/rpi-linux/commit/23431052d2dce8084b72e399fce82b05d86b847f.patch";
+        hash = "sha256-UDX/BJCJG0WVndP/6PbPK+AZsfU3vVxDCrpn1kb1kqE=";
       };
     }
   ];
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index b013c7f1bf181..ec7f104bcb1d2 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,25 +6,26 @@
 , ... } @ args:
 
 let
-  version = "5.10.215-rt107"; # updated by ./update-rt.sh
+  version = "5.10.218-rt110"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
+  pname = "linux-rt";
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
   modDirVersion = lib.versions.pad 3 version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747";
+    sha256 = "1mmj5hwm5i16gc1y4nzr1cs882vi6vrihrincdcivv63x11v4dlw";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0lnnpnfmypafzfzhcmaxqqc18nna4fr236v6hrcyabnxmxam79xj";
+      sha256 = "0zam7hlcrphxv53jcza7sw0lv8a9mz15cl35adwb2rd2y1x9nhad";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 91774ba38dbd8..127d7e6635138 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,11 +6,12 @@
 , ... } @ args:
 
 let
-  version = "5.15.153-rt75"; # updated by ./update-rt.sh
+  version = "5.15.160-rt77"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
+  pname = "linux-rt";
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
   modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
@@ -18,14 +19,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1g44gjcwcdq5552vwinljqwiy90bxax72jjvdasp71x88khv3pfp";
+    sha256 = "018v19a7rhzc4szybzzn86jlnk42x7jm6xkadfd2d3xq6f7727pl";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "04i22p0ap4dsqybf9jbbmrbzva11qknilnyk46z18gzrr0msjldl";
+      sha256 = "0id4m1k1xq84bxgnchm8r2iwfqw6nacv5n1ksgyzj6q6v66ik3wk";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 463385036292e..2fc18c76e5706 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -11,6 +11,7 @@ let
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
+  pname = "linux-rt";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 06028d209779d..a515cc1924fd9 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,11 +6,12 @@
 , ... } @ args:
 
 let
-  version = "6.1.83-rt28"; # updated by ./update-rt.sh
+  version = "6.1.94-rt33"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
+  pname = "linux-rt";
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
   modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
@@ -18,14 +19,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "145iw3wii7znhrqdmgnwhswk235g6gw8axjjji2cw4rn148rddl8";
+    sha256 = "0sakp5k4q2xfd3la7j8s2rcbvndh6fdqgzz5ivyqf0df4anp3siq";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "07wv3zd7n5378k8ywdavrp5ndqkdcis923dwpswfv7062xm34y5h";
+      sha256 = "0yawgw6s8zd6a2n165aqg861giamgpsissj9mw6ax3a7wvg19zjr";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index eb85f9c3cd091..b0cda7d0710be 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -6,11 +6,12 @@
 , ... } @ args:
 
 let
-  version = "6.6.25-rt29"; # updated by ./update-rt.sh
+  version = "6.6.34-rt33"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
+  pname = "linux-rt";
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
   modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
@@ -18,14 +19,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "0i0zvqlj02rm6wpbidji0rn9559vrpfc1b8gbfjk70lhhyz11llr";
+    sha256 = "180v8q5376gl6zmjd54qcb1wpmz7cq299bdbhmz738rsb67yrq64";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "15mb4zycv86yp1cbs5svgs3pnmh8jihjhf4jxc4h4ywlzglkb1za";
+      sha256 = "1sbbdv3mcca04g27vc7n4xv4kfhn9nz8xrhzzwc2r3f2x83ficwp";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index cab04ad0c7d80..323b77e851404 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
+, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
 , rustc, rust-bindgen, rustPlatform
 }:
@@ -20,6 +20,8 @@ let
 in lib.makeOverridable ({
   # The kernel version
   version,
+  # The kernel pname (should be set for variants)
+  pname ? "linux",
   # Position of the Linux build expression
   pos ? null,
   # Additional kernel make flags
@@ -118,7 +120,7 @@ let
       moduleBuildDependencies = [
         pahole
         perl
-        libelf
+        elfutils
         # module makefiles often run uname commands to find out the kernel version
         (buildPackages.deterministic-uname.override { inherit modDirVersion; })
       ]
@@ -140,13 +142,24 @@ let
       inherit src;
 
       depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ]
-                          ++ optional  needsUbootTools ubootTools
-                          ++ optional  (lib.versionOlder version "5.8") libelf
-                          ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-                          ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-                          ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-                          ++ optionals withRust [ rustc rust-bindgen ];
+      nativeBuildInputs = [
+        bison
+        flex
+        perl
+        bc
+        nettools
+        openssl
+        rsync
+        gmp
+        libmpc
+        mpfr
+        elfutils
+        zstd
+        python3Minimal
+        kmod
+      ] ++ optional  needsUbootTools ubootTools
+        ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+        ++ optionals withRust [ rustc rust-bindgen ];
 
       RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
@@ -170,12 +183,6 @@ let
         # Ensure that depmod gets resolved through PATH
         sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
 
-        # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
-        # This way kernels can be bit-by-bit reproducible depending on settings
-        # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
-        # See also https://kernelnewbies.org/BuildId
-        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
-
         # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
         [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
 
@@ -301,10 +308,10 @@ let
         export HOME=${installkernel}
       '';
 
-      # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+      # Some image types need special install targets (e.g. uImage is installed with make uinstall on arm)
       installTargets = [
         (kernelConf.installTarget or (
-          /**/ if kernelConf.target == "uImage" then "uinstall"
+          /**/ if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then "uinstall"
           else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
           else "install"))
       ];
@@ -404,12 +411,8 @@ let
     };
 in
 
-assert lib.versionOlder version "5.8" -> libelf != null;
-assert lib.versionAtLeast version "5.8" -> elfutils != null;
-
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
-  pname = "linux";
-  inherit version;
+  inherit pname version;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 20100774395e1..c1715a91e5fbc 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -82,15 +82,21 @@
 
   rust_1_77-6_8 = {
     name = "rust-1.77.patch";
-    patch = fetchurl {
-      name = "rust-1.77.patch";
-      url = "https://lore.kernel.org/rust-for-linux/20240217002717.57507-1-ojeda@kernel.org/raw";
-      hash = "sha256-0KW9nHpJeMSDssCPXWZbrN8kxq5bA434t+XuPfwslUc=";
-    };
+    patch = ./rust-1.77-6.8.patch;
   };
 
   rust_1_77-6_9 = {
     name = "rust-1.77.patch";
     patch = ./rust-1.77.patch;
   };
+
+  rust_1_78 = {
+    name = "rust-1.78.patch";
+    patch = fetchpatch {
+      name = "rust-1.78.patch";
+      url = "https://lore.kernel.org/rust-for-linux/20240401212303.537355-4-ojeda@kernel.org/raw";
+      excludes = [ "Documentation/process/changes.rst" ]; # Conflicts on 6.8.
+      hash = "sha256-EZ+Qa9z1AtAv08e72M7BEsCZi9UK572gmW+AR62a8EM=";
+    };
+  };
 }
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 02f0407425d13..851a4c8d5d7b6 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchurl
 , kernel
 , elfutils
diff --git a/pkgs/os-specific/linux/kernel/rust-1.77-6.8.patch b/pkgs/os-specific/linux/kernel/rust-1.77-6.8.patch
new file mode 100644
index 0000000000000..4b25d3e60e39d
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/rust-1.77-6.8.patch
@@ -0,0 +1,799 @@
+From 82a754271336c7736fb0350692be85fecb30e38e Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 17 Feb 2024 01:27:17 +0100
+Subject: [PATCH] rust: upgrade to Rust 1.77.1
+
+This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.1
+(i.e. the latest) [1].
+
+See the upgrade policy [2] and the comments on the first upgrade in
+commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2").
+
+# Unstable features
+
+The `offset_of` feature (single-field `offset_of!`) that we were using
+got stabilized in Rust 1.77.0 [3].
+
+Therefore, now the only unstable features allowed to be used outside the
+`kernel` crate is `new_uninit`, though other code to be upstreamed may
+increase the list.
+
+Please see [4] for details.
+
+# Required changes
+
+Rust 1.77.0 merged the `unused_tuple_struct_fields` lint into `dead_code`,
+thus upgrading it from `allow` to `warn` [5]. In turn, this made `rustc`
+complain about the `ThisModule`'s pointer field being never read, but
+the previous patch adds the `as_ptr` method to it, needed by Binder [6],
+so that we do not need to locally `allow` it.
+
+# Other changes
+
+Rust 1.77.0 introduces the `--check-cfg` feature [7], for which there
+is a Call for Testing going on [8]. We were requested to test it and
+we found it useful [9] -- we will likely enable it in the future.
+
+# `alloc` upgrade and reviewing
+
+The vast majority of changes are due to our `alloc` fork being upgraded
+at once.
+
+There are two kinds of changes to be aware of: the ones coming from
+upstream, which we should follow as closely as possible, and the updates
+needed in our added fallible APIs to keep them matching the newer
+infallible APIs coming from upstream.
+
+Instead of taking a look at the diff of this patch, an alternative
+approach is reviewing a diff of the changes between upstream `alloc` and
+the kernel's. This allows to easily inspect the kernel additions only,
+especially to check if the fallible methods we already have still match
+the infallible ones in the new version coming from upstream.
+
+Another approach is reviewing the changes introduced in the additions in
+the kernel fork between the two versions. This is useful to spot
+potentially unintended changes to our additions.
+
+To apply these approaches, one may follow steps similar to the following
+to generate a pair of patches that show the differences between upstream
+Rust and the kernel (for the subset of `alloc` we use) before and after
+applying this patch:
+
+    # Get the difference with respect to the old version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > old.patch
+    git -C linux restore rust/alloc
+
+    # Apply this patch.
+    git -C linux am rust-upgrade.patch
+
+    # Get the difference with respect to the new version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > new.patch
+    git -C linux restore rust/alloc
+
+Now one may check the `new.patch` to take a look at the additions (first
+approach) or at the difference between those two patches (second
+approach). For the latter, a side-by-side tool is recommended.
+
+Link: https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1770-2024-03-21 [1]
+Link: https://rust-for-linux.com/rust-version-policy [2]
+Link: https://github.com/rust-lang/rust/pull/118799 [3]
+Link: https://github.com/Rust-for-Linux/linux/issues/2 [4]
+Link: https://github.com/rust-lang/rust/pull/118297 [5]
+Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-2-08ba9197f637@google.com/#Z31rust:kernel:lib.rs [6]
+Link: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/check-cfg.html [7]
+Link: https://github.com/rust-lang/rfcs/pull/3013#issuecomment-1936648479 [8]
+Link: https://github.com/rust-lang/rust/issues/82450#issuecomment-1947462977 [9]
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Tested-by: Boqun Feng <boqun.feng@gmail.com>
+Link: https://lore.kernel.org/r/20240217002717.57507-1-ojeda@kernel.org
+[ Upgraded to 1.77.1. Removed `allow(dead_code)` thanks to the previous
+  patch. Reworded accordingly. No changes to `alloc` during the beta. ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+
+# Conflicts:
+#	Documentation/process/changes.rst
+#	rust/kernel/lib.rs
+---
+ Documentation/process/changes.rst |   2 +-
+ rust/alloc/alloc.rs               |   6 +-
+ rust/alloc/boxed.rs               |   4 +-
+ rust/alloc/lib.rs                 |   7 +-
+ rust/alloc/raw_vec.rs             |  13 ++--
+ rust/alloc/slice.rs               |   4 +-
+ rust/alloc/vec/into_iter.rs       | 104 +++++++++++++++++++-----------
+ rust/alloc/vec/mod.rs             | 101 ++++++++++++++++++++---------
+ rust/kernel/lib.rs                |   1 -
+ scripts/Makefile.build            |   2 +-
+ scripts/min-tool-version.sh       |   2 +-
+ 11 files changed, 158 insertions(+), 88 deletions(-)
+
+diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
+index c78ecc1e176f..641d67363b92 100644
+--- a/Documentation/process/changes.rst
++++ b/Documentation/process/changes.rst
+@@ -31,7 +31,7 @@ you probably needn't concern yourself with pcmciautils.
+ ====================== ===============  ========================================
+ GNU C                  5.1              gcc --version
+ Clang/LLVM (optional)  11.0.0           clang --version
+-Rust (optional)        1.76.0           rustc --version
++Rust (optional)        1.77.1           rustc --version
+ bindgen (optional)     0.65.1           bindgen --version
+ GNU make               3.82             make --version
+ bash                   4.2              bash --version
+diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
+index abb791cc2371..b1204f87227b 100644
+--- a/rust/alloc/alloc.rs
++++ b/rust/alloc/alloc.rs
+@@ -5,7 +5,7 @@
+ #![stable(feature = "alloc_module", since = "1.28.0")]
+ 
+ #[cfg(not(test))]
+-use core::intrinsics;
++use core::hint;
+ 
+ #[cfg(not(test))]
+ use core::ptr::{self, NonNull};
+@@ -210,7 +210,7 @@ unsafe fn grow_impl(
+                 let new_size = new_layout.size();
+ 
+                 // `realloc` probably checks for `new_size >= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size >= old_layout.size());
++                hint::assert_unchecked(new_size >= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+@@ -301,7 +301,7 @@ unsafe fn shrink(
+             // SAFETY: `new_size` is non-zero. Other conditions must be upheld by the caller
+             new_size if old_layout.align() == new_layout.align() => unsafe {
+                 // `realloc` probably checks for `new_size <= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size <= old_layout.size());
++                hint::assert_unchecked(new_size <= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
+index c93a22a5c97f..5fc39dfeb8e7 100644
+--- a/rust/alloc/boxed.rs
++++ b/rust/alloc/boxed.rs
+@@ -26,6 +26,7 @@
+ //! Creating a recursive data structure:
+ //!
+ //! ```
++//! ##[allow(dead_code)]
+ //! #[derive(Debug)]
+ //! enum List<T> {
+ //!     Cons(T, Box<List<T>>),
+@@ -194,8 +195,7 @@
+ #[fundamental]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ // The declaration of the `Box` struct must be kept in sync with the
+-// `alloc::alloc::box_free` function or ICEs will happen. See the comment
+-// on `box_free` for more details.
++// compiler or ICEs will happen.
+ pub struct Box<
+     T: ?Sized,
+     #[unstable(feature = "allocator_api", issue = "32838")] A: Allocator = Global,
+diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
+index 36f79c075593..39afd55ec074 100644
+--- a/rust/alloc/lib.rs
++++ b/rust/alloc/lib.rs
+@@ -105,7 +105,6 @@
+ #![feature(allocator_api)]
+ #![feature(array_chunks)]
+ #![feature(array_into_iter_constructors)]
+-#![feature(array_methods)]
+ #![feature(array_windows)]
+ #![feature(ascii_char)]
+ #![feature(assert_matches)]
+@@ -122,7 +121,6 @@
+ #![feature(const_size_of_val)]
+ #![feature(const_waker)]
+ #![feature(core_intrinsics)]
+-#![feature(core_panic)]
+ #![feature(deprecated_suggestion)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(error_generic_member_access)]
+@@ -132,6 +130,7 @@
+ #![feature(fmt_internals)]
+ #![feature(fn_traits)]
+ #![feature(hasher_prefixfree_extras)]
++#![feature(hint_assert_unchecked)]
+ #![feature(inline_const)]
+ #![feature(inplace_iteration)]
+ #![feature(iter_advance_by)]
+@@ -141,6 +140,8 @@
+ #![feature(maybe_uninit_slice)]
+ #![feature(maybe_uninit_uninit_array)]
+ #![feature(maybe_uninit_uninit_array_transpose)]
++#![feature(non_null_convenience)]
++#![feature(panic_internals)]
+ #![feature(pattern)]
+ #![feature(ptr_internals)]
+ #![feature(ptr_metadata)]
+@@ -149,7 +150,6 @@
+ #![feature(set_ptr_value)]
+ #![feature(sized_type_properties)]
+ #![feature(slice_from_ptr_range)]
+-#![feature(slice_group_by)]
+ #![feature(slice_ptr_get)]
+ #![feature(slice_ptr_len)]
+ #![feature(slice_range)]
+@@ -182,6 +182,7 @@
+ #![feature(const_ptr_write)]
+ #![feature(const_trait_impl)]
+ #![feature(const_try)]
++#![feature(decl_macro)]
+ #![feature(dropck_eyepatch)]
+ #![feature(exclusive_range_pattern)]
+ #![feature(fundamental)]
+diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
+index 98b6abf30af6..1839d1c8ee7a 100644
+--- a/rust/alloc/raw_vec.rs
++++ b/rust/alloc/raw_vec.rs
+@@ -4,7 +4,7 @@
+ 
+ use core::alloc::LayoutError;
+ use core::cmp;
+-use core::intrinsics;
++use core::hint;
+ use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
+ use core::ptr::{self, NonNull, Unique};
+ use core::slice;
+@@ -317,7 +317,7 @@ fn current_memory(&self) -> Option<(NonNull<u8>, Layout)> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -358,7 +358,7 @@ pub fn try_reserve(&mut self, len: usize, additional: usize) -> Result<(), TryRe
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -381,7 +381,7 @@ pub fn try_reserve_for_push(&mut self, len: usize) -> Result<(), TryReserveError
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -402,7 +402,7 @@ pub fn try_reserve_exact(
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -553,7 +553,7 @@ fn finish_grow<A>(
+         debug_assert_eq!(old_layout.align(), new_layout.align());
+         unsafe {
+             // The allocator checks for alignment equality
+-            intrinsics::assume(old_layout.align() == new_layout.align());
++            hint::assert_unchecked(old_layout.align() == new_layout.align());
+             alloc.grow(ptr, old_layout, new_layout)
+         }
+     } else {
+@@ -591,7 +591,6 @@ fn handle_reserve(result: Result<(), TryReserveError>) {
+ // `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
+ // an extra guard for this in case we're running on a platform which can use
+ // all 4GB in user-space, e.g., PAE or x32.
+-
+ #[inline]
+ fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
+     if usize::BITS < 64 && alloc_size > isize::MAX as usize {
+diff --git a/rust/alloc/slice.rs b/rust/alloc/slice.rs
+index 1181836da5f4..a36b072c9519 100644
+--- a/rust/alloc/slice.rs
++++ b/rust/alloc/slice.rs
+@@ -53,14 +53,14 @@
+ pub use core::slice::{from_mut_ptr_range, from_ptr_range};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{from_raw_parts, from_raw_parts_mut};
++#[stable(feature = "slice_group_by", since = "1.77.0")]
++pub use core::slice::{ChunkBy, ChunkByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Chunks, Windows};
+ #[stable(feature = "chunks_exact", since = "1.31.0")]
+ pub use core::slice::{ChunksExact, ChunksExactMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{ChunksMut, Split, SplitMut};
+-#[unstable(feature = "slice_group_by", issue = "80552")]
+-pub use core::slice::{GroupBy, GroupByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Iter, IterMut};
+ #[stable(feature = "rchunks", since = "1.31.0")]
+diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
+index 136bfe94af6c..0f11744c44b3 100644
+--- a/rust/alloc/vec/into_iter.rs
++++ b/rust/alloc/vec/into_iter.rs
+@@ -20,6 +20,17 @@
+ use core::ptr::{self, NonNull};
+ use core::slice::{self};
+ 
++macro non_null {
++    (mut $place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { &mut *(ptr::addr_of_mut!($place) as *mut NonNull<$t>) }
++    }},
++    ($place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { *(ptr::addr_of!($place) as *const NonNull<$t>) }
++    }},
++}
++
+ /// An iterator that moves out of a vector.
+ ///
+ /// This `struct` is created by the `into_iter` method on [`Vec`](super::Vec)
+@@ -43,10 +54,12 @@ pub struct IntoIter<
+     // the drop impl reconstructs a RawVec from buf, cap and alloc
+     // to avoid dropping the allocator twice we need to wrap it into ManuallyDrop
+     pub(super) alloc: ManuallyDrop<A>,
+-    pub(super) ptr: *const T,
+-    pub(super) end: *const T, // If T is a ZST, this is actually ptr+len. This encoding is picked so that
+-                              // ptr == end is a quick test for the Iterator being empty, that works
+-                              // for both ZST and non-ZST.
++    pub(super) ptr: NonNull<T>,
++    /// If T is a ZST, this is actually ptr+len. This encoding is picked so that
++    /// ptr == end is a quick test for the Iterator being empty, that works
++    /// for both ZST and non-ZST.
++    /// For non-ZSTs the pointer is treated as `NonNull<T>`
++    pub(super) end: *const T,
+ }
+ 
+ #[stable(feature = "vec_intoiter_debug", since = "1.13.0")]
+@@ -70,7 +83,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     /// ```
+     #[stable(feature = "vec_into_iter_as_slice", since = "1.15.0")]
+     pub fn as_slice(&self) -> &[T] {
+-        unsafe { slice::from_raw_parts(self.ptr, self.len()) }
++        unsafe { slice::from_raw_parts(self.ptr.as_ptr(), self.len()) }
+     }
+ 
+     /// Returns the remaining items of this iterator as a mutable slice.
+@@ -99,7 +112,7 @@ pub fn allocator(&self) -> &A {
+     }
+ 
+     fn as_raw_mut_slice(&mut self) -> *mut [T] {
+-        ptr::slice_from_raw_parts_mut(self.ptr as *mut T, self.len())
++        ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), self.len())
+     }
+ 
+     /// Drops remaining elements and relinquishes the backing allocation.
+@@ -126,7 +139,7 @@ pub(super) fn forget_allocation_drop_remaining(&mut self) {
+         // this creates less assembly
+         self.cap = 0;
+         self.buf = unsafe { NonNull::new_unchecked(RawVec::NEW.ptr()) };
+-        self.ptr = self.buf.as_ptr();
++        self.ptr = self.buf;
+         self.end = self.buf.as_ptr();
+ 
+         // Dropping the remaining elements can panic, so this needs to be
+@@ -138,9 +151,9 @@ pub(super) fn forget_allocation_drop_remaining(&mut self) {
+ 
+     /// Forgets to Drop the remaining elements while still allowing the backing allocation to be freed.
+     pub(crate) fn forget_remaining_elements(&mut self) {
+-        // For th ZST case, it is crucial that we mutate `end` here, not `ptr`.
++        // For the ZST case, it is crucial that we mutate `end` here, not `ptr`.
+         // `ptr` must stay aligned, while `end` may be unaligned.
+-        self.end = self.ptr;
++        self.end = self.ptr.as_ptr();
+     }
+ 
+     #[cfg(not(no_global_oom_handling))]
+@@ -162,7 +175,7 @@ pub(crate) fn into_vecdeque(self) -> VecDeque<T, A> {
+                 // say that they're all at the beginning of the "allocation".
+                 0..this.len()
+             } else {
+-                this.ptr.sub_ptr(buf)..this.end.sub_ptr(buf)
++                this.ptr.sub_ptr(this.buf)..this.end.sub_ptr(buf)
+             };
+             let cap = this.cap;
+             let alloc = ManuallyDrop::take(&mut this.alloc);
+@@ -189,29 +202,35 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ 
+     #[inline]
+     fn next(&mut self) -> Option<T> {
+-        if self.ptr == self.end {
+-            None
+-        } else if T::IS_ZST {
+-            // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
+-            // reducing the `end`.
+-            self.end = self.end.wrapping_byte_sub(1);
++        if T::IS_ZST {
++            if self.ptr.as_ptr() == self.end as *mut _ {
++                None
++            } else {
++                // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
++                // reducing the `end`.
++                self.end = self.end.wrapping_byte_sub(1);
+ 
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            let old = self.ptr;
+-            self.ptr = unsafe { self.ptr.add(1) };
++            if self.ptr == non_null!(self.end, T) {
++                None
++            } else {
++                let old = self.ptr;
++                self.ptr = unsafe { old.add(1) };
+ 
+-            Some(unsafe { ptr::read(old) })
++                Some(unsafe { ptr::read(old.as_ptr()) })
++            }
+         }
+     }
+ 
+     #[inline]
+     fn size_hint(&self) -> (usize, Option<usize>) {
+         let exact = if T::IS_ZST {
+-            self.end.addr().wrapping_sub(self.ptr.addr())
++            self.end.addr().wrapping_sub(self.ptr.as_ptr().addr())
+         } else {
+-            unsafe { self.end.sub_ptr(self.ptr) }
++            unsafe { non_null!(self.end, T).sub_ptr(self.ptr) }
+         };
+         (exact, Some(exact))
+     }
+@@ -219,7 +238,7 @@ fn size_hint(&self) -> (usize, Option<usize>) {
+     #[inline]
+     fn advance_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
+         let step_size = self.len().min(n);
+-        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr as *mut T, step_size);
++        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), step_size);
+         if T::IS_ZST {
+             // See `next` for why we sub `end` here.
+             self.end = self.end.wrapping_byte_sub(step_size);
+@@ -261,7 +280,7 @@ fn count(self) -> usize {
+             // Safety: `len` indicates that this many elements are available and we just checked that
+             // it fits into the array.
+             unsafe {
+-                ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, len);
++                ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, len);
+                 self.forget_remaining_elements();
+                 return Err(array::IntoIter::new_unchecked(raw_ary, 0..len));
+             }
+@@ -270,7 +289,7 @@ fn count(self) -> usize {
+         // Safety: `len` is larger than the array size. Copy a fixed amount here to fully initialize
+         // the array.
+         return unsafe {
+-            ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, N);
++            ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, N);
+             self.ptr = self.ptr.add(N);
+             Ok(raw_ary.transpose().assume_init())
+         };
+@@ -288,7 +307,7 @@ unsafe fn __iterator_get_unchecked(&mut self, i: usize) -> Self::Item
+         // Also note the implementation of `Self: TrustedRandomAccess` requires
+         // that `T: Copy` so reading elements from the buffer doesn't invalidate
+         // them for `Drop`.
+-        unsafe { if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) } }
++        unsafe { if T::IS_ZST { mem::zeroed() } else { self.ptr.add(i).read() } }
+     }
+ }
+ 
+@@ -296,18 +315,25 @@ unsafe fn __iterator_get_unchecked(&mut self, i: usize) -> Self::Item
+ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+     #[inline]
+     fn next_back(&mut self) -> Option<T> {
+-        if self.end == self.ptr {
+-            None
+-        } else if T::IS_ZST {
+-            // See above for why 'ptr.offset' isn't used
+-            self.end = self.end.wrapping_byte_sub(1);
++        if T::IS_ZST {
++            if self.end as *mut _ == self.ptr.as_ptr() {
++                None
++            } else {
++                // See above for why 'ptr.offset' isn't used
++                self.end = self.end.wrapping_byte_sub(1);
+ 
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            self.end = unsafe { self.end.sub(1) };
++            if non_null!(self.end, T) == self.ptr {
++                None
++            } else {
++                let new_end = unsafe { non_null!(self.end, T).sub(1) };
++                *non_null!(mut self.end, T) = new_end;
+ 
+-            Some(unsafe { ptr::read(self.end) })
++                Some(unsafe { ptr::read(new_end.as_ptr()) })
++            }
+         }
+     }
+ 
+@@ -333,7 +359,11 @@ fn advance_back_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T, A: Allocator> ExactSizeIterator for IntoIter<T, A> {
+     fn is_empty(&self) -> bool {
+-        self.ptr == self.end
++        if T::IS_ZST {
++            self.ptr.as_ptr() == self.end as *mut _
++        } else {
++            self.ptr == non_null!(self.end, T)
++        }
+     }
+ }
+ 
+diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
+index 220fb9d6f45b..0be27fff4554 100644
+--- a/rust/alloc/vec/mod.rs
++++ b/rust/alloc/vec/mod.rs
+@@ -360,7 +360,7 @@
+ ///
+ /// `vec![x; n]`, `vec![a, b, c, d]`, and
+ /// [`Vec::with_capacity(n)`][`Vec::with_capacity`], will all produce a `Vec`
+-/// with exactly the requested capacity. If <code>[len] == [capacity]</code>,
++/// with at least the requested capacity. If <code>[len] == [capacity]</code>,
+ /// (as is the case for the [`vec!`] macro), then a `Vec<T>` can be converted to
+ /// and from a [`Box<[T]>`][owned slice] without reallocating or moving the elements.
+ ///
+@@ -447,7 +447,7 @@ pub const fn new() -> Self {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -690,7 +690,7 @@ pub const fn new_in(alloc: A) -> Self {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1013,7 +1013,7 @@ pub fn capacity(&self) -> usize {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1043,7 +1043,7 @@ pub fn reserve(&mut self, additional: usize) {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1140,8 +1140,11 @@ pub fn try_reserve_exact(&mut self, additional: usize) -> Result<(), TryReserveE
+ 
+     /// Shrinks the capacity of the vector as much as possible.
+     ///
+-    /// It will drop down as close as possible to the length but the allocator
+-    /// may still inform the vector that there is space for a few more elements.
++    /// The behavior of this method depends on the allocator, which may either shrink the vector
++    /// in-place or reallocate. The resulting vector might still have some excess capacity, just as
++    /// is the case for [`with_capacity`]. See [`Allocator::shrink`] for more details.
++    ///
++    /// [`with_capacity`]: Vec::with_capacity
+     ///
+     /// # Examples
+     ///
+@@ -1191,10 +1194,10 @@ pub fn shrink_to(&mut self, min_capacity: usize) {
+ 
+     /// Converts the vector into [`Box<[T]>`][owned slice].
+     ///
+-    /// If the vector has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`shrink_to_fit`].
+     ///
+     /// [owned slice]: Box
++    /// [`shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+@@ -2017,7 +2020,7 @@ fn drop(&mut self) {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2133,7 +2136,7 @@ pub fn pop(&mut self) -> Option<T> {
+         } else {
+             unsafe {
+                 self.len -= 1;
+-                core::intrinsics::assume(self.len < self.capacity());
++                core::hint::assert_unchecked(self.len < self.capacity());
+                 Some(ptr::read(self.as_ptr().add(self.len())))
+             }
+         }
+@@ -2143,7 +2146,7 @@ pub fn pop(&mut self) -> Option<T> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2315,6 +2318,12 @@ pub fn is_empty(&self) -> bool {
+     /// `[at, len)`. After the call, the original vector will be left containing
+     /// the elements `[0, at)` with its previous capacity unchanged.
+     ///
++    /// - If you want to take ownership of the entire contents and capacity of
++    ///   the vector, see [`mem::take`] or [`mem::replace`].
++    /// - If you don't need the returned vector at all, see [`Vec::truncate`].
++    /// - If you want to take ownership of an arbitrary subslice, or you don't
++    ///   necessarily want to store the removed items in a vector, see [`Vec::drain`].
++    ///
+     /// # Panics
+     ///
+     /// Panics if `at > len`.
+@@ -2346,14 +2355,6 @@ fn assert_failed(at: usize, len: usize) -> ! {
+             assert_failed(at, self.len());
+         }
+ 
+-        if at == 0 {
+-            // the new vector can take over the original buffer and avoid the copy
+-            return mem::replace(
+-                self,
+-                Vec::with_capacity_in(self.capacity(), self.allocator().clone()),
+-            );
+-        }
+-
+         let other_len = self.len - at;
+         let mut other = Vec::with_capacity_in(other_len, self.allocator().clone());
+ 
+@@ -3027,6 +3028,50 @@ fn index_mut(&mut self, index: I) -> &mut Self::Output {
+     }
+ }
+ 
++/// Collects an iterator into a Vec, commonly called via [`Iterator::collect()`]
++///
++/// # Allocation behavior
++///
++/// In general `Vec` does not guarantee any particular growth or allocation strategy.
++/// That also applies to this trait impl.
++///
++/// **Note:** This section covers implementation details and is therefore exempt from
++/// stability guarantees.
++///
++/// Vec may use any or none of the following strategies,
++/// depending on the supplied iterator:
++///
++/// * preallocate based on [`Iterator::size_hint()`]
++///   * and panic if the number of items is outside the provided lower/upper bounds
++/// * use an amortized growth strategy similar to `pushing` one item at a time
++/// * perform the iteration in-place on the original allocation backing the iterator
++///
++/// The last case warrants some attention. It is an optimization that in many cases reduces peak memory
++/// consumption and improves cache locality. But when big, short-lived allocations are created,
++/// only a small fraction of their items get collected, no further use is made of the spare capacity
++/// and the resulting `Vec` is moved into a longer-lived structure, then this can lead to the large
++/// allocations having their lifetimes unnecessarily extended which can result in increased memory
++/// footprint.
++///
++/// In cases where this is an issue, the excess capacity can be discarded with [`Vec::shrink_to()`],
++/// [`Vec::shrink_to_fit()`] or by collecting into [`Box<[T]>`][owned slice] instead, which additionally reduces
++/// the size of the long-lived struct.
++///
++/// [owned slice]: Box
++///
++/// ```rust
++/// # use std::sync::Mutex;
++/// static LONG_LIVED: Mutex<Vec<Vec<u16>>> = Mutex::new(Vec::new());
++///
++/// for i in 0..10 {
++///     let big_temporary: Vec<u16> = (0..1024).collect();
++///     // discard most items
++///     let mut result: Vec<_> = big_temporary.into_iter().filter(|i| i % 100 == 0).collect();
++///     // without this a lot of unused capacity might be moved into the global
++///     result.shrink_to_fit();
++///     LONG_LIVED.lock().unwrap().push(result);
++/// }
++/// ```
+ #[cfg(not(no_global_oom_handling))]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T> FromIterator<T> for Vec<T> {
+@@ -3069,14 +3114,8 @@ fn into_iter(self) -> Self::IntoIter {
+                 begin.add(me.len()) as *const T
+             };
+             let cap = me.buf.capacity();
+-            IntoIter {
+-                buf: NonNull::new_unchecked(begin),
+-                phantom: PhantomData,
+-                cap,
+-                alloc,
+-                ptr: begin,
+-                end,
+-            }
++            let buf = NonNull::new_unchecked(begin);
++            IntoIter { buf, phantom: PhantomData, cap, alloc, ptr: buf, end }
+         }
+     }
+ }
+@@ -3598,8 +3637,10 @@ fn from(s: Box<[T], A>) -> Self {
+ impl<T, A: Allocator> From<Vec<T, A>> for Box<[T], A> {
+     /// Convert a vector into a boxed slice.
+     ///
+-    /// If `v` has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`Vec::shrink_to_fit`].
++    ///
++    /// [owned slice]: Box
++    /// [`Vec::shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
+index 75efe47522e4..f07bc5a2c6b4 100644
+--- a/rust/kernel/lib.rs
++++ b/rust/kernel/lib.rs
+@@ -17,7 +17,6 @@
+ #![feature(const_maybe_uninit_zeroed)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(new_uninit)]
+-#![feature(offset_of)]
+ #![feature(ptr_metadata)]
+ #![feature(receiver_trait)]
+ #![feature(unsize)]
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 1633175846df..0bc7c5fe64b1 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -262,7 +262,7 @@ $(obj)/%.lst: $(src)/%.c FORCE
+ # Compile Rust sources (.rs)
+ # ---------------------------------------------------------------------------
+ 
+-rust_allowed_features := new_uninit,offset_of
++rust_allowed_features := new_uninit
+ 
+ # `--out-dir` is required to avoid temporaries being created by `rustc` in the
+ # current working directory, which may be not accessible in the out-of-tree
+diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh
+index e217683b10d6..db2b0bc5866b 100755
+--- a/scripts/min-tool-version.sh
++++ b/scripts/min-tool-version.sh
+@@ -33,7 +33,7 @@ llvm)
+ 	fi
+ 	;;
+ rustc)
+-	echo 1.76.0
++	echo 1.77.1
+ 	;;
+ bindgen)
+ 	echo 0.65.1
+-- 
+2.44.0
+
diff --git a/pkgs/os-specific/linux/kernel/rust-1.77.patch b/pkgs/os-specific/linux/kernel/rust-1.77.patch
index 8bd0a5e337154..ed9eb56bf6d7e 100644
--- a/pkgs/os-specific/linux/kernel/rust-1.77.patch
+++ b/pkgs/os-specific/linux/kernel/rust-1.77.patch
@@ -1,14 +1,16 @@
-From d69265b7d756931b2e763a3262f22ba4100895a0 Mon Sep 17 00:00:00 2001
+From b256fc507d4710287b22077834c16d18cee4ab17 Mon Sep 17 00:00:00 2001
 From: Miguel Ojeda <ojeda@kernel.org>
 Date: Sat, 17 Feb 2024 01:27:17 +0100
-Subject: [PATCH] rust: upgrade to Rust 1.77.0
+Subject: [PATCH] rust: upgrade to Rust 1.77.1
 
-This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.0
+This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.1
 (i.e. the latest) [1].
 
 See the upgrade policy [2] and the comments on the first upgrade in
 commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2").
 
+# Unstable features
+
 The `offset_of` feature (single-field `offset_of!`) that we were using
 got stabilized in Rust 1.77.0 [3].
 
@@ -18,16 +20,22 @@ increase the list.
 
 Please see [4] for details.
 
+# Required changes
+
 Rust 1.77.0 merged the `unused_tuple_struct_fields` lint into `dead_code`,
-thus upgrading it from `allow` to `warn` [5]. In turn, this makes `rustc`
-complain about the `ThisModule`'s pointer field being never read. Thus
-locally `allow` it for the moment, since we will have users later on
-(e.g. Binder needs a `as_ptr` method [6]).
+thus upgrading it from `allow` to `warn` [5]. In turn, this made `rustc`
+complain about the `ThisModule`'s pointer field being never read, but
+the previous patch adds the `as_ptr` method to it, needed by Binder [6],
+so that we do not need to locally `allow` it.
+
+# Other changes
 
 Rust 1.77.0 introduces the `--check-cfg` feature [7], for which there
 is a Call for Testing going on [8]. We were requested to test it and
 we found it useful [9] -- we will likely enable it in the future.
 
+# `alloc` upgrade and reviewing
+
 The vast majority of changes are due to our `alloc` fork being upgraded
 at once.
 
@@ -85,9 +93,12 @@ Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-2-08ba9197f
 Link: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/check-cfg.html [7]
 Link: https://github.com/rust-lang/rfcs/pull/3013#issuecomment-1936648479 [8]
 Link: https://github.com/rust-lang/rust/issues/82450#issuecomment-1947462977 [9]
-Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Tested-by: Boqun Feng <boqun.feng@gmail.com>
 Link: https://lore.kernel.org/r/20240217002717.57507-1-ojeda@kernel.org
-Link: https://github.com/Rust-for-Linux/linux/commit/d69265b7d756931b2e763a3262f22ba4100895a0
+[ Upgraded to 1.77.1. Removed `allow(dead_code)` thanks to the previous
+  patch. Reworded accordingly. No changes to `alloc` during the beta. ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
 Signed-off-by: Alyssa Ross <hi@alyssa.is>
 ---
  Documentation/process/changes.rst |   2 +-
@@ -96,15 +107,15 @@ Signed-off-by: Alyssa Ross <hi@alyssa.is>
  rust/alloc/lib.rs                 |   7 +-
  rust/alloc/raw_vec.rs             |  13 ++--
  rust/alloc/slice.rs               |   4 +-
- rust/alloc/vec/into_iter.rs       | 108 +++++++++++++++++++-----------
- rust/alloc/vec/mod.rs             | 101 +++++++++++++++++++---------
- rust/kernel/lib.rs                |   3 +-
+ rust/alloc/vec/into_iter.rs       | 104 +++++++++++++++++++-----------
+ rust/alloc/vec/mod.rs             | 101 ++++++++++++++++++++---------
+ rust/kernel/lib.rs                |   1 -
  scripts/Makefile.build            |   2 +-
  scripts/min-tool-version.sh       |   2 +-
- 11 files changed, 161 insertions(+), 91 deletions(-)
+ 11 files changed, 158 insertions(+), 88 deletions(-)
 
 diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
-index 7ef8de58f7f892..879ee628893ae1 100644
+index 7ef8de58f7f8..b5d3107c6734 100644
 --- a/Documentation/process/changes.rst
 +++ b/Documentation/process/changes.rst
 @@ -31,7 +31,7 @@ you probably needn't concern yourself with pcmciautils.
@@ -112,12 +123,12 @@ index 7ef8de58f7f892..879ee628893ae1 100644
  GNU C                  5.1              gcc --version
  Clang/LLVM (optional)  13.0.1           clang --version
 -Rust (optional)        1.76.0           rustc --version
-+Rust (optional)        1.77.0           rustc --version
++Rust (optional)        1.77.1           rustc --version
  bindgen (optional)     0.65.1           bindgen --version
  GNU make               3.82             make --version
  bash                   4.2              bash --version
 diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
-index abb791cc23715a..b1204f87227b23 100644
+index abb791cc2371..b1204f87227b 100644
 --- a/rust/alloc/alloc.rs
 +++ b/rust/alloc/alloc.rs
 @@ -5,7 +5,7 @@
@@ -129,7 +140,7 @@ index abb791cc23715a..b1204f87227b23 100644
  
  #[cfg(not(test))]
  use core::ptr::{self, NonNull};
-@@ -210,7 +210,7 @@ impl Global {
+@@ -210,7 +210,7 @@ unsafe fn grow_impl(
                  let new_size = new_layout.size();
  
                  // `realloc` probably checks for `new_size >= old_layout.size()` or something similar.
@@ -138,7 +149,7 @@ index abb791cc23715a..b1204f87227b23 100644
  
                  let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
                  let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
-@@ -301,7 +301,7 @@ unsafe impl Allocator for Global {
+@@ -301,7 +301,7 @@ unsafe fn shrink(
              // SAFETY: `new_size` is non-zero. Other conditions must be upheld by the caller
              new_size if old_layout.align() == new_layout.align() => unsafe {
                  // `realloc` probably checks for `new_size <= old_layout.size()` or something similar.
@@ -148,7 +159,7 @@ index abb791cc23715a..b1204f87227b23 100644
                  let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
                  let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
 diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
-index c93a22a5c97f14..5fc39dfeb8e7bf 100644
+index c93a22a5c97f..5fc39dfeb8e7 100644
 --- a/rust/alloc/boxed.rs
 +++ b/rust/alloc/boxed.rs
 @@ -26,6 +26,7 @@
@@ -159,7 +170,7 @@ index c93a22a5c97f14..5fc39dfeb8e7bf 100644
  //! #[derive(Debug)]
  //! enum List<T> {
  //!     Cons(T, Box<List<T>>),
-@@ -194,8 +195,7 @@ mod thin;
+@@ -194,8 +195,7 @@
  #[fundamental]
  #[stable(feature = "rust1", since = "1.0.0")]
  // The declaration of the `Box` struct must be kept in sync with the
@@ -170,7 +181,7 @@ index c93a22a5c97f14..5fc39dfeb8e7bf 100644
      T: ?Sized,
      #[unstable(feature = "allocator_api", issue = "32838")] A: Allocator = Global,
 diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
-index 36f79c07559338..39afd55ec0749e 100644
+index 36f79c075593..39afd55ec074 100644
 --- a/rust/alloc/lib.rs
 +++ b/rust/alloc/lib.rs
 @@ -105,7 +105,6 @@
@@ -223,7 +234,7 @@ index 36f79c07559338..39afd55ec0749e 100644
  #![feature(exclusive_range_pattern)]
  #![feature(fundamental)]
 diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
-index 98b6abf30af6e4..1839d1c8ee7a04 100644
+index 98b6abf30af6..1839d1c8ee7a 100644
 --- a/rust/alloc/raw_vec.rs
 +++ b/rust/alloc/raw_vec.rs
 @@ -4,7 +4,7 @@
@@ -235,7 +246,7 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
  use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
  use core::ptr::{self, NonNull, Unique};
  use core::slice;
-@@ -317,7 +317,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+@@ -317,7 +317,7 @@ fn current_memory(&self) -> Option<(NonNull<u8>, Layout)> {
      ///
      /// # Panics
      ///
@@ -244,7 +255,7 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
      ///
      /// # Aborts
      ///
-@@ -358,7 +358,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+@@ -358,7 +358,7 @@ pub fn try_reserve(&mut self, len: usize, additional: usize) -> Result<(), TryRe
          }
          unsafe {
              // Inform the optimizer that the reservation has succeeded or wasn't needed
@@ -253,7 +264,7 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
          }
          Ok(())
      }
-@@ -381,7 +381,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+@@ -381,7 +381,7 @@ pub fn try_reserve_for_push(&mut self, len: usize) -> Result<(), TryReserveError
      ///
      /// # Panics
      ///
@@ -262,7 +273,7 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
      ///
      /// # Aborts
      ///
-@@ -402,7 +402,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+@@ -402,7 +402,7 @@ pub fn try_reserve_exact(
          }
          unsafe {
              // Inform the optimizer that the reservation has succeeded or wasn't needed
@@ -271,7 +282,7 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
          }
          Ok(())
      }
-@@ -553,7 +553,7 @@ where
+@@ -553,7 +553,7 @@ fn finish_grow<A>(
          debug_assert_eq!(old_layout.align(), new_layout.align());
          unsafe {
              // The allocator checks for alignment equality
@@ -289,10 +300,10 @@ index 98b6abf30af6e4..1839d1c8ee7a04 100644
  fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
      if usize::BITS < 64 && alloc_size > isize::MAX as usize {
 diff --git a/rust/alloc/slice.rs b/rust/alloc/slice.rs
-index 1181836da5f462..a36b072c95195f 100644
+index 1181836da5f4..a36b072c9519 100644
 --- a/rust/alloc/slice.rs
 +++ b/rust/alloc/slice.rs
-@@ -53,14 +53,14 @@ pub use core::slice::{from_mut, from_ref};
+@@ -53,14 +53,14 @@
  pub use core::slice::{from_mut_ptr_range, from_ptr_range};
  #[stable(feature = "rust1", since = "1.0.0")]
  pub use core::slice::{from_raw_parts, from_raw_parts_mut};
@@ -310,10 +321,10 @@ index 1181836da5f462..a36b072c95195f 100644
  pub use core::slice::{Iter, IterMut};
  #[stable(feature = "rchunks", since = "1.31.0")]
 diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
-index 136bfe94af6c83..0f11744c44b34c 100644
+index 136bfe94af6c..0f11744c44b3 100644
 --- a/rust/alloc/vec/into_iter.rs
 +++ b/rust/alloc/vec/into_iter.rs
-@@ -20,6 +20,17 @@ use core::ops::Deref;
+@@ -20,6 +20,17 @@
  use core::ptr::{self, NonNull};
  use core::slice::{self};
  
@@ -357,7 +368,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
      }
  
      /// Returns the remaining items of this iterator as a mutable slice.
-@@ -99,7 +112,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+@@ -99,7 +112,7 @@ pub fn allocator(&self) -> &A {
      }
  
      fn as_raw_mut_slice(&mut self) -> *mut [T] {
@@ -366,7 +377,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
      }
  
      /// Drops remaining elements and relinquishes the backing allocation.
-@@ -126,7 +139,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+@@ -126,7 +139,7 @@ pub(super) fn forget_allocation_drop_remaining(&mut self) {
          // this creates less assembly
          self.cap = 0;
          self.buf = unsafe { NonNull::new_unchecked(RawVec::NEW.ptr()) };
@@ -375,7 +386,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
          self.end = self.buf.as_ptr();
  
          // Dropping the remaining elements can panic, so this needs to be
-@@ -138,9 +151,9 @@ impl<T, A: Allocator> IntoIter<T, A> {
+@@ -138,9 +151,9 @@ pub(super) fn forget_allocation_drop_remaining(&mut self) {
  
      /// Forgets to Drop the remaining elements while still allowing the backing allocation to be freed.
      pub(crate) fn forget_remaining_elements(&mut self) {
@@ -387,7 +398,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
      }
  
      #[cfg(not(no_global_oom_handling))]
-@@ -162,7 +175,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+@@ -162,7 +175,7 @@ pub(crate) fn into_vecdeque(self) -> VecDeque<T, A> {
                  // say that they're all at the beginning of the "allocation".
                  0..this.len()
              } else {
@@ -406,9 +417,6 @@ index 136bfe94af6c83..0f11744c44b34c 100644
 -            // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
 -            // reducing the `end`.
 -            self.end = self.end.wrapping_byte_sub(1);
--
--            // Make up a value of this ZST.
--            Some(unsafe { mem::zeroed() })
 +        if T::IS_ZST {
 +            if self.ptr.as_ptr() == self.end as *mut _ {
 +                None
@@ -416,7 +424,9 @@ index 136bfe94af6c83..0f11744c44b34c 100644
 +                // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
 +                // reducing the `end`.
 +                self.end = self.end.wrapping_byte_sub(1);
-+
+ 
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
 +                // Make up a value of this ZST.
 +                Some(unsafe { mem::zeroed() })
 +            }
@@ -446,7 +456,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
          };
          (exact, Some(exact))
      }
-@@ -219,7 +238,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+@@ -219,7 +238,7 @@ fn size_hint(&self) -> (usize, Option<usize>) {
      #[inline]
      fn advance_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
          let step_size = self.len().min(n);
@@ -455,7 +465,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
          if T::IS_ZST {
              // See `next` for why we sub `end` here.
              self.end = self.end.wrapping_byte_sub(step_size);
-@@ -261,7 +280,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+@@ -261,7 +280,7 @@ fn count(self) -> usize {
              // Safety: `len` indicates that this many elements are available and we just checked that
              // it fits into the array.
              unsafe {
@@ -464,7 +474,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
                  self.forget_remaining_elements();
                  return Err(array::IntoIter::new_unchecked(raw_ary, 0..len));
              }
-@@ -270,7 +289,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+@@ -270,7 +289,7 @@ fn count(self) -> usize {
          // Safety: `len` is larger than the array size. Copy a fixed amount here to fully initialize
          // the array.
          return unsafe {
@@ -473,7 +483,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
              self.ptr = self.ptr.add(N);
              Ok(raw_ary.transpose().assume_init())
          };
-@@ -288,7 +307,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+@@ -288,7 +307,7 @@ unsafe fn __iterator_get_unchecked(&mut self, i: usize) -> Self::Item
          // Also note the implementation of `Self: TrustedRandomAccess` requires
          // that `T: Copy` so reading elements from the buffer doesn't invalidate
          // them for `Drop`.
@@ -482,7 +492,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
      }
  }
  
-@@ -296,18 +315,25 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+@@ -296,18 +315,25 @@ unsafe fn __iterator_get_unchecked(&mut self, i: usize) -> Self::Item
  impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
      #[inline]
      fn next_back(&mut self) -> Option<T> {
@@ -491,16 +501,15 @@ index 136bfe94af6c83..0f11744c44b34c 100644
 -        } else if T::IS_ZST {
 -            // See above for why 'ptr.offset' isn't used
 -            self.end = self.end.wrapping_byte_sub(1);
--
--            // Make up a value of this ZST.
--            Some(unsafe { mem::zeroed() })
 +        if T::IS_ZST {
 +            if self.end as *mut _ == self.ptr.as_ptr() {
 +                None
 +            } else {
 +                // See above for why 'ptr.offset' isn't used
 +                self.end = self.end.wrapping_byte_sub(1);
-+
+ 
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
 +                // Make up a value of this ZST.
 +                Some(unsafe { mem::zeroed() })
 +            }
@@ -518,7 +527,7 @@ index 136bfe94af6c83..0f11744c44b34c 100644
          }
      }
  
-@@ -333,7 +359,11 @@ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+@@ -333,7 +359,11 @@ fn advance_back_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
  #[stable(feature = "rust1", since = "1.0.0")]
  impl<T, A: Allocator> ExactSizeIterator for IntoIter<T, A> {
      fn is_empty(&self) -> bool {
@@ -532,10 +541,10 @@ index 136bfe94af6c83..0f11744c44b34c 100644
  }
  
 diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
-index 220fb9d6f45b3f..0be27fff4554a1 100644
+index 220fb9d6f45b..0be27fff4554 100644
 --- a/rust/alloc/vec/mod.rs
 +++ b/rust/alloc/vec/mod.rs
-@@ -360,7 +360,7 @@ mod spec_extend;
+@@ -360,7 +360,7 @@
  ///
  /// `vec![x; n]`, `vec![a, b, c, d]`, and
  /// [`Vec::with_capacity(n)`][`Vec::with_capacity`], will all produce a `Vec`
@@ -544,7 +553,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
  /// (as is the case for the [`vec!`] macro), then a `Vec<T>` can be converted to
  /// and from a [`Box<[T]>`][owned slice] without reallocating or moving the elements.
  ///
-@@ -447,7 +447,7 @@ impl<T> Vec<T> {
+@@ -447,7 +447,7 @@ pub const fn new() -> Self {
      ///
      /// # Panics
      ///
@@ -553,7 +562,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -690,7 +690,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -690,7 +690,7 @@ pub const fn new_in(alloc: A) -> Self {
      ///
      /// # Panics
      ///
@@ -562,7 +571,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -1013,7 +1013,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -1013,7 +1013,7 @@ pub fn capacity(&self) -> usize {
      ///
      /// # Panics
      ///
@@ -571,7 +580,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -1043,7 +1043,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -1043,7 +1043,7 @@ pub fn reserve(&mut self, additional: usize) {
      ///
      /// # Panics
      ///
@@ -580,7 +589,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -1140,8 +1140,11 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -1140,8 +1140,11 @@ pub fn try_reserve_exact(&mut self, additional: usize) -> Result<(), TryReserveE
  
      /// Shrinks the capacity of the vector as much as possible.
      ///
@@ -594,7 +603,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -1191,10 +1194,10 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -1191,10 +1194,10 @@ pub fn shrink_to(&mut self, min_capacity: usize) {
  
      /// Converts the vector into [`Box<[T]>`][owned slice].
      ///
@@ -607,7 +616,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -2017,7 +2020,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -2017,7 +2020,7 @@ fn drop(&mut self) {
      ///
      /// # Panics
      ///
@@ -616,7 +625,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -2133,7 +2136,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -2133,7 +2136,7 @@ pub fn pop(&mut self) -> Option<T> {
          } else {
              unsafe {
                  self.len -= 1;
@@ -625,7 +634,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
                  Some(ptr::read(self.as_ptr().add(self.len())))
              }
          }
-@@ -2143,7 +2146,7 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -2143,7 +2146,7 @@ pub fn pop(&mut self) -> Option<T> {
      ///
      /// # Panics
      ///
@@ -634,7 +643,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      ///
      /// # Examples
      ///
-@@ -2315,6 +2318,12 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -2315,6 +2318,12 @@ pub fn is_empty(&self) -> bool {
      /// `[at, len)`. After the call, the original vector will be left containing
      /// the elements `[0, at)` with its previous capacity unchanged.
      ///
@@ -647,7 +656,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      /// # Panics
      ///
      /// Panics if `at > len`.
-@@ -2346,14 +2355,6 @@ impl<T, A: Allocator> Vec<T, A> {
+@@ -2346,14 +2355,6 @@ fn assert_failed(at: usize, len: usize) -> ! {
              assert_failed(at, self.len());
          }
  
@@ -662,7 +671,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
          let other_len = self.len - at;
          let mut other = Vec::with_capacity_in(other_len, self.allocator().clone());
  
-@@ -3027,6 +3028,50 @@ impl<T, I: SliceIndex<[T]>, A: Allocator> IndexMut<I> for Vec<T, A> {
+@@ -3027,6 +3028,50 @@ fn index_mut(&mut self, index: I) -> &mut Self::Output {
      }
  }
  
@@ -713,7 +722,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
  #[cfg(not(no_global_oom_handling))]
  #[stable(feature = "rust1", since = "1.0.0")]
  impl<T> FromIterator<T> for Vec<T> {
-@@ -3069,14 +3114,8 @@ impl<T, A: Allocator> IntoIterator for Vec<T, A> {
+@@ -3069,14 +3114,8 @@ fn into_iter(self) -> Self::IntoIter {
                  begin.add(me.len()) as *const T
              };
              let cap = me.buf.capacity();
@@ -730,7 +739,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
          }
      }
  }
-@@ -3598,8 +3637,10 @@ impl<T, A: Allocator> From<Box<[T], A>> for Vec<T, A> {
+@@ -3598,8 +3637,10 @@ fn from(s: Box<[T], A>) -> Self {
  impl<T, A: Allocator> From<Vec<T, A>> for Box<[T], A> {
      /// Convert a vector into a boxed slice.
      ///
@@ -744,7 +753,7 @@ index 220fb9d6f45b3f..0be27fff4554a1 100644
      /// # Examples
      ///
 diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
-index be68d5e567b1a1..71f95e5aa09abd 100644
+index 6858e2f8a3ed..9e9b245ebab5 100644
 --- a/rust/kernel/lib.rs
 +++ b/rust/kernel/lib.rs
 @@ -16,7 +16,6 @@
@@ -755,17 +764,8 @@ index be68d5e567b1a1..71f95e5aa09abd 100644
  #![feature(receiver_trait)]
  #![feature(unsize)]
  
-@@ -78,7 +77,7 @@ pub trait Module: Sized + Sync {
- /// Equivalent to `THIS_MODULE` in the C API.
- ///
- /// C header: [`include/linux/export.h`](srctree/include/linux/export.h)
--pub struct ThisModule(*mut bindings::module);
-+pub struct ThisModule(#[allow(dead_code)] *mut bindings::module);
- 
- // SAFETY: `THIS_MODULE` may be used from all threads within a module.
- unsafe impl Sync for ThisModule {}
 diff --git a/scripts/Makefile.build b/scripts/Makefile.build
-index baf86c0880b6d7..367cfeea74c5f5 100644
+index 533a7799fdfe..5a6ab6d965bc 100644
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
 @@ -263,7 +263,7 @@ $(obj)/%.lst: $(src)/%.c FORCE
@@ -778,7 +778,7 @@ index baf86c0880b6d7..367cfeea74c5f5 100644
  # `--out-dir` is required to avoid temporaries being created by `rustc` in the
  # current working directory, which may be not accessible in the out-of-tree
 diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh
-index 5927cc6b7de338..cc5141b67b4a71 100755
+index 5927cc6b7de3..6086e00e640e 100755
 --- a/scripts/min-tool-version.sh
 +++ b/scripts/min-tool-version.sh
 @@ -33,7 +33,7 @@ llvm)
@@ -786,7 +786,10 @@ index 5927cc6b7de338..cc5141b67b4a71 100755
  	;;
  rustc)
 -	echo 1.76.0
-+	echo 1.77.0
++	echo 1.77.1
  	;;
  bindgen)
  	echo 0.65.1
+-- 
+2.44.0
+
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index b7840b554beee..b2c4d0a6a6695 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,19 +6,20 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.29";
-    hash = "sha256-Be2VaW0DQDS0FJUwXM627QaNgrn1B3Hbyq+PiKb7b+k=";
+    version = "6.6.33";
+    hash = "sha256-3qGxIYNVm2f69rym0Ya1X497G7yRNj3lLCtVgyEZ9yw=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.8";
-    hash = "sha256-6fT9vRjHw775m4ySUAUWU9R0dz/cWYYdZsPCwZjGiXM=";
+    version = "6.9.4";
+    hash = "sha256-gY0t77aPWOuRZFESNp0OLIsjLAv+rf0NHbab9WF2VtA=";
     variant = "main";
   };
 
   xanmodKernelFor = { version, suffix ? "xanmod1", hash, variant }: buildLinux (args // rec {
     inherit version;
+    pname = "linux-xanmod";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
 
     src = fetchFromGitHub {
@@ -46,8 +47,13 @@ let
       HZ_250 = yes;
       HZ_1000 = no;
 
-      # Disable writeback throttling by default
-      BLK_WBT_MQ = lib.mkOverride 60 no;
+      # RCU_BOOST and RCU_EXP_KTHREAD
+      RCU_EXPERT = yes;
+      RCU_FANOUT = freeform "64";
+      RCU_FANOUT_LEAF = freeform "16";
+      RCU_BOOST = yes;
+      RCU_BOOST_DELAY = freeform "0";
+      RCU_EXP_KTHREAD = yes;
     };
 
     extraMeta = {
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 1f36e36c2335e..9d15662162607 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,20 +4,21 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.8.6"; #zen
+    version = "6.9.6"; #zen
     suffix = "zen1"; #zen
-    sha256 = "09233xbvkwjd8yglzjh50pbw5n3pk7d8l5pb270ric9rnnl383jn"; #zen
+    sha256 = "09s3h4wiqfh8nsb1xw78qn2pqdjm8cff89f1q8r2p8hfzs6zpc1b"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.8.6"; #lqx
-    suffix = "lqx2"; #lqx
-    sha256 = "0mxbl0h8s021m0ab12yy778qyhdlb5789qjbn66l8qxsw0dv4ags"; #lqx
+    version = "6.9.5"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "0r3pgjfyza3vkvp7kw1s7sn1gf4hxq6r6qs5wvv76gmff7s399yz"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
     inherit version;
+    pname = "linux-${if isLqx then "lqx" else "zen"}";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
 
@@ -84,8 +85,8 @@ let
       SCHED_PDS = yes;
 
       # Swap storage is compressed with LZ4 using zswap
-      ZSWAP_COMPRESSOR_DEFAULT_LZ4 = yes;
-      ZSWAP_COMPRESSOR_DEFAULT = freeform "lz4";
+      ZSWAP_COMPRESSOR_DEFAULT_LZ4  = lib.mkOptionDefault yes;
+      ZSWAP_COMPRESSOR_DEFAULT_ZSTD = lib.mkDefault no;
 
       # Fix error: unused option: XXX.
       CFS_BANDWIDTH = lib.mkForce (option no);
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index 530fd767bb909..fb5911a68053c 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -18,7 +18,12 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/6c1192cbf166698932030c2e3de71db1885a572d/srcpkgs/kexec-tools/patches/ppc64-elfv2.patch";
       sha256 = "19wzfwb0azm932v0vhywv4221818qmlmvdfwpvvpfyw4hjsc2s1l";
     })
-  ];
+    # binutils-2.42 support
+    (fetchpatch {
+      url = "https://github.com/horms/kexec-tools/commit/328de8e00e298f00d7ba6b25dc3950147e9642e6.patch";
+      hash = "sha256-wVQI4oV+hBLq3kGIp2+F5J3f6s/TypDu3Xq583KYc3U=";
+    })
+  ] ++ lib.optional (stdenv.hostPlatform.useLLVM or false) ./fix-purgatory-llvm-libunwind.patch;
 
   hardeningDisable = [ "format" "pic" "relro" "pie" ];
 
@@ -38,6 +43,6 @@ stdenv.mkDerivation rec {
       "riscv64-linux" "riscv32-linux"
       "sparc-linux" "sparc64-linux"
     ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/kexec-tools/fix-purgatory-llvm-libunwind.patch b/pkgs/os-specific/linux/kexec-tools/fix-purgatory-llvm-libunwind.patch
new file mode 100644
index 0000000000000..235410da94f2c
--- /dev/null
+++ b/pkgs/os-specific/linux/kexec-tools/fix-purgatory-llvm-libunwind.patch
@@ -0,0 +1,11 @@
+--- a/purgatory/Makefile	2024-06-06 23:59:33.089005832 -0700
++++ b/purgatory/Makefile	2024-06-06 23:59:56.761169892 -0700
+@@ -62,7 +62,7 @@
+ $(PURGATORY): LDFLAGS=$($(ARCH)_PURGATORY_EXTRA_CFLAGS)\
+ 			-Wl,--no-undefined -nostartfiles -nostdlib \
+ 			-nodefaultlibs -e purgatory_start -r \
+-			-Wl,-Map=$(PURGATORY_MAP)
++			-Wl,-Map=$(PURGATORY_MAP) -static
+ 
+ $(PURGATORY): $(PURGATORY_OBJS)
+ 	$(MKDIR) -p $(@D)
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
index b81f581c07aaa..fa4bdbd9e66d5 100644
--- a/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -35,8 +35,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Userspace utilities for the ksmbd kernel SMB server";
     homepage = "https://www.kernel.org/doc/html/latest/filesystems/cifs/ksmbd.html";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ elohmeier ];
   };
 }
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
index 3258295be58a6..cc5ace339b420 100644
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     inherit (vdo.meta) license maintainers;
     homepage = "https://github.com/dm-vdo/kvdo";
-    description = "A pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
+    description = "Pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.15";
+    broken = kernel.kernelOlder "5.17";
   };
 }
diff --git a/pkgs/os-specific/linux/kvmfr/default.nix b/pkgs/os-specific/linux/kvmfr/default.nix
index a77d1290ca803..3224fc137db1b 100644
--- a/pkgs/os-specific/linux/kvmfr/default.nix
+++ b/pkgs/os-specific/linux/kvmfr/default.nix
@@ -6,9 +6,6 @@ stdenv.mkDerivation {
 
   src = looking-glass-client.src;
   sourceRoot = "${looking-glass-client.src.name}/module";
-  patches = lib.optional (kernel.kernelAtLeast "6.4") [
-    ./linux-6-4-compat.patch
-  ];
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch b/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
deleted file mode 100644
index e57d1d27c36cd..0000000000000
--- a/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/kvmfr.c b/kvmfr.c
-index 121aae5b..2f4c9e1a 100644
---- a/kvmfr.c
-+++ b/kvmfr.c
-@@ -539,7 +539,11 @@ static int __init kvmfr_module_init(void)
-   if (kvmfr->major < 0)
-     goto out_free;
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
-   kvmfr->pClass = class_create(THIS_MODULE, KVMFR_DEV_NAME);
-+#else
-+  kvmfr->pClass = class_create(KVMFR_DEV_NAME);
-+#endif
-   if (IS_ERR(kvmfr->pClass))
-     goto out_unreg;
- 
diff --git a/pkgs/os-specific/linux/latencytop/default.nix b/pkgs/os-specific/linux/latencytop/default.nix
index 023140e1f482b..43d1fddde9272 100644
--- a/pkgs/os-specific/linux/latencytop/default.nix
+++ b/pkgs/os-specific/linux/latencytop/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     homepage = "http://latencytop.org";
     description = "Tool to show kernel reports on latencies (LATENCYTOP option)";
     mainProgram = "latencytop";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.viric ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index 0dea0ce4e8b0d..5214f270bfb26 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "A lightweight device mounter, with libudev as only dependency";
+    description = "Lightweight device mounter, with libudev as only dependency";
     mainProgram = "ldm";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/ledger-udev-rules/default.nix b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
index 3a6bf9e5d51c0..8201f12480c39 100644
--- a/pkgs/os-specific/linux/ledger-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "ledger-udev-rules";
-  version = "unstable-2021-09-10";
+  version = "0-unstable-2024-02-12";
 
   src = fetchFromGitHub {
     owner = "LedgerHQ";
     repo = "udev-rules";
-    rev = "2776324af6df36c2af4d2e8e92a1c98c281117c9";
-    sha256 = "sha256-yTYI81PXMc32lMfI5uhD14nP20zAI7ZF33V1LRDWg2Y=";
+    rev = "f474382e370c9fa2a2207e6e675b9b364441aed7";
+    sha256 = "sha256-5jN9xy3+kk540PAyfsxIqck9hdI3t2CNpgqKxLbAsDg=";
   };
 
   dontBuild = true;
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "udev rules for Ledger devices";
     license = licenses.asl20;
-    maintainers = with maintainers; [ asymmetric ];
+    maintainers = with maintainers; [ asymmetric toasteruwu ];
     platforms = platforms.linux;
     homepage = "https://github.com/LedgerHQ/udev-rules";
   };
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
index eeccf301ee95b..66212124e9875 100644
--- a/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = {
-    description = "An utility to control Lenovo Legion laptop";
+    description = "Utility to control Lenovo Legion laptop";
     homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/lenovo-legion/default.nix b/pkgs/os-specific/linux/lenovo-legion/default.nix
index 527f1852f1e08..a79c901a13126 100644
--- a/pkgs/os-specific/linux/lenovo-legion/default.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, stdenv, kernel, bash, lenovo-legion }:
+{ lib, stdenv, kernel, bash, lenovo-legion }:
 
 stdenv.mkDerivation {
   pname = "lenovo-legion-module";
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 324e2695dd537..d2cccef37b894 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   version = "0.3.113";
diff --git a/pkgs/os-specific/linux/libbpf/0.x.nix b/pkgs/os-specific/linux/libbpf/0.x.nix
index 480e78d0803a8..b34cca4a51af4 100644
--- a/pkgs/os-specific/linux/libbpf/0.x.nix
+++ b/pkgs/os-specific/linux/libbpf/0.x.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+    sha256 = "sha256-J5cUvfUYc+uLdkFa2jx/2bqBoZg/eSzc6SWlgKqcfIc=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 99454beb41878..6a0ee908347ca 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-3TCsIlr28vO6Zu9lDaEq6J4J+D5sHP7SSo1O/M0ZzUo=";
+    sha256 = "sha256-PlGr/qZbKnaY37wikdmX/iYtP11WHShn1I7vACUgLG0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 59aa5bbc0e5d0..478b5fa8ac2cc 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
+    hash = "sha256-O6UpTRy9+pivqs+8ALavntK4PoohgXGF39hEzIx6xv8=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
index 7346e0d67d391..4d86812698e5a 100644
--- a/pkgs/os-specific/linux/libnvme/default.nix
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -1,4 +1,5 @@
 { fetchFromGitHub
+, bash
 , json_c
 , keyutils
 , lib
@@ -17,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnvme";
-  version = "1.7.1";
+  version = "1.9";
 
   outputs = [ "out" ] ++ lib.optionals withDocs [ "man" ];
 
@@ -25,11 +26,13 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linux-nvme";
     repo = "libnvme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hCR/K8bPXj8HthayrnwwGfI+wxpUwcWkcx3S/8h+3m8=";
+    hash = "sha256-nXzYbj4BDxFii30yR+aTgqjQfyYMFiAIcV/OHI2y5Ws=";
   };
 
   postPatch = ''
     patchShebangs scripts
+    substituteInPlace test/sysfs/sysfs-tree-diff.sh \
+      --replace-fail /bin/bash ${bash}/bin/bash
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index 0dab09de4c1ca..ee47968352ae4 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -40,8 +40,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/intel/opa-psm2";
-    description = "The PSM2 library supports a number of fabric media and stacks";
-    license = with licenses; [ gpl2 bsd3 ];
+    description = "PSM2 library supports a number of fabric media and stacks";
+    license = with licenses; [ gpl2Only bsd3 ];
     platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.bzizou ];
   };
diff --git a/pkgs/os-specific/linux/libratbag/default.nix b/pkgs/os-specific/linux/libratbag/default.nix
index a35ab1dcc01c9..3a13c53cf5868 100644
--- a/pkgs/os-specific/linux/libratbag/default.nix
+++ b/pkgs/os-specific/linux/libratbag/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, wrapGAppsNoGuiHook, gobject-introspection
 , glib, systemd, udev, libevdev, gitMinimal, check, valgrind, swig, python3
 , json-glib, libunistring }:
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    meson ninja pkg-config gitMinimal swig check valgrind
+    meson ninja pkg-config gitMinimal swig check valgrind wrapGAppsNoGuiHook gobject-introspection
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index c0711f6933778..de092af473de4 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, buildPackages, pcre2, pkg-config, libsepol
+{ lib, stdenv, fetchurl, buildPackages, pcre2, pkg-config, libsepol
 , enablePython ? !stdenv.hostPlatform.isStatic
 , swig ? null, python3 ? null, python3Packages
 , fts
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 548d5222c7a29..9c7f1abb3a4e0 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, flex }:
+{ lib, stdenv, fetchurl, flex }:
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     description = "SELinux binary policy manipulation library";
     homepage = "http://userspace.selinuxproject.org";
     platforms = platforms.linux;
-    maintainers = [ ];
+    maintainers = with maintainers; [ RossComputerGuy ];
     license = lib.licenses.gpl2Plus;
     pkgConfigModules = [ "libselinux" ];
   };
diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix
index df4337a6caffc..9f0bfacf07d3c 100644
--- a/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/pkgs/os-specific/linux/libsmbios/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/dell/libsmbios";
-    description = "A library to obtain BIOS information";
+    description = "Library to obtain BIOS information";
     license = with licenses; [ osl21 gpl2Plus ];
     maintainers = with maintainers; [ ];
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/libvolume_id/default.nix b/pkgs/os-specific/linux/libvolume_id/default.nix
index 653094c91884f..718bd9cec89ca 100644
--- a/pkgs/os-specific/linux/libvolume_id/default.nix
+++ b/pkgs/os-specific/linux/libvolume_id/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "http://www.marcuscom.com/downloads/";
   };
 }
diff --git a/pkgs/os-specific/linux/libwebcam/default.nix b/pkgs/os-specific/linux/libwebcam/default.nix
index 5f87a89496b75..093b3dac21f20 100644
--- a/pkgs/os-specific/linux/libwebcam/default.nix
+++ b/pkgs/os-specific/linux/libwebcam/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "The webcam-tools package";
+    description = "Webcam-tools package";
     platforms = platforms.linux;
     license = licenses.lgpl3;
     maintainers = with maintainers; [ jraygauthier ];
diff --git a/pkgs/os-specific/linux/libzbc/default.nix b/pkgs/os-specific/linux/libzbc/default.nix
index 79a4277a85603..e2da36d9dc793 100644
--- a/pkgs/os-specific/linux/libzbc/default.nix
+++ b/pkgs/os-specific/linux/libzbc/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzbc";
-  version = "5.13.0";
+  version = "5.14.0";
 
   src = fetchFromGitHub {
     owner = "westerndigitalcorporation";
     repo = "libzbc";
     rev = "v${version}";
-    sha256 = "6xkA96bgQ2Ik1vEwkw7hwjMbjMSlopzv5ziTh60Mjx0=";
+    sha256 = "sha256-+MBk2ZUr3Vt6pZFb4gTXMOzKBlf1EXMF8y/c1iDrIZM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index 46dd76e0d277d..f1f95d5563b01 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     description = "MacBook automatic light sensor daemon";
     mainProgram = "lightum";
     homepage = "https://github.com/poliva/lightum";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ puffnfresh ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/liquidtux/default.nix b/pkgs/os-specific/linux/liquidtux/default.nix
index 317801bb3cddb..ca4fb27c8f199 100644
--- a/pkgs/os-specific/linux/liquidtux/default.nix
+++ b/pkgs/os-specific/linux/liquidtux/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux kernel hwmon drivers for AIO liquid coolers and other devices";
     homepage = "https://github.com/liquidctl/liquidtux";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ nickhu ];
     broken = lib.versionOlder kernel.version "5.10";
diff --git a/pkgs/os-specific/linux/lksctp-tools/default.nix b/pkgs/os-specific/linux/lksctp-tools/default.nix
index 24915143fbd0d..f6a91c663a05d 100644
--- a/pkgs/os-specific/linux/lksctp-tools/default.nix
+++ b/pkgs/os-specific/linux/lksctp-tools/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux Kernel Stream Control Transmission Protocol Tools";
     homepage = "https://lksctp.sourceforge.net/";
-    license = with licenses; [ gpl2 lgpl21 ]; # library is lgpl21
+    license = with licenses; [ gpl2Plus lgpl21 ]; # library is lgpl21
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/lockdep/default.nix b/pkgs/os-specific/linux/lockdep/default.nix
index be3967f0a8587..971ba71d8a759 100644
--- a/pkgs/os-specific/linux/lockdep/default.nix
+++ b/pkgs/os-specific/linux/lockdep/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     description = "Userspace locking validation tool built on the Linux kernel";
     mainProgram = "lockdep";
     homepage    = "https://kernel.org/";
-    license     = lib.licenses.gpl2;
+    license     = lib.licenses.gpl2Only;
     platforms   = lib.platforms.linux;
     maintainers = [ lib.maintainers.thoughtpolice ];
   };
diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix
index d87820f246649..11826a105669e 100644
--- a/pkgs/os-specific/linux/lsscsi/default.nix
+++ b/pkgs/os-specific/linux/lsscsi/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 89b49068d40c1..cfb38f0983cea 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${kernel.version}";
-  version = "2.13.10";
+  version = "2.13.13";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-modules";
     rev = "v${version}";
-    hash = "sha256-R5qwB1ayw0KueMBSSxm0TwINt78N6w356kY7WGBX0zM=";
+    hash = "sha256-iA3B838EUU5rFWCL8BAubkTrTO1itDFp5d1653OPnS0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index caafa52a81738..9cba67ee2b39d 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     homepage = "http://sourceware.org/lvm2/";
     description = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = platforms.linux;
-    license = with licenses; [ gpl2 bsd2 lgpl21 ];
+    license = with licenses; [ gpl2Only bsd2 lgpl21 ];
     maintainers = with maintainers; [ raskin ajs124 ] ++ teams.helsinki-systems.members;
   };
 }
diff --git a/pkgs/os-specific/linux/macchanger/default.nix b/pkgs/os-specific/linux/macchanger/default.nix
index e998bfad93613..66cbeefb89295 100644
--- a/pkgs/os-specific/linux/macchanger/default.nix
+++ b/pkgs/os-specific/linux/macchanger/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "info" ];
 
   meta = with lib; {
-    description = "A utility for viewing/manipulating the MAC address of network interfaces";
+    description = "Utility for viewing/manipulating the MAC address of network interfaces";
     maintainers = with maintainers; [ joachifm dotlambda ];
     license = licenses.gpl2Plus;
     homepage = "https://github.com/alobbs/macchanger";
diff --git a/pkgs/os-specific/linux/mba6x_bl/default.nix b/pkgs/os-specific/linux/mba6x_bl/default.nix
index 3add5eb227f5e..47466dc54051a 100644
--- a/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "MacBook Air 6,1 and 6,2 (mid 2013) backlight driver";
     homepage = "https://github.com/patjak/mba6x_bl";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.simonvandel ];
   };
diff --git a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
index 0b4fec4dfb4e9..2670c72544491 100644
--- a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
+++ b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A driver for MacBook models 2018 and newer, which makes the keyboard, mouse and audio output work.";
+    description = "Driver for MacBook models 2018 and newer, which makes the keyboard, mouse and audio output work";
     longDescription = ''
       A driver for MacBook models 2018 and newer, implementing the VHCI (required for mouse/keyboard/etc.) and audio functionality.
     '';
diff --git a/pkgs/os-specific/linux/mceinject/default.nix b/pkgs/os-specific/linux/mceinject/default.nix
index f7cd199a5e8b9..01d230e3335a9 100644
--- a/pkgs/os-specific/linux/mceinject/default.nix
+++ b/pkgs/os-specific/linux/mceinject/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "destdir=$(out)" "manprefix=/share" ];
 
   meta = with lib; {
-    description = "A tool to inject machine checks into x86 kernel for testing";
+    description = "Tool to inject machine checks into x86 kernel for testing";
     mainProgram = "mce-inject";
     longDescription = ''
       mce-inject allows to inject machine check errors on the software level
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       kernel machine check handler.
     '';
     homepage = "https://github.com/andikleen/mce-inject/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ arkivm ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 65556987508e5..cc26b020235e8 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -17,6 +17,15 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/e58d2b17d3c40faffc0d426aab00184f28d9dafa/srcpkgs/mdadm/patches/musl.patch";
       hash = "sha256-TIcQs+8RM5Q6Z8MHkI50kaJd7f9WdS/EVI16F7b2+SA=";
     })
+    # Fixes build on musl 1.2.5+
+    (fetchurl {
+      url = "https://lore.kernel.org/linux-raid/20240220165158.3521874-1-raj.khem@gmail.com/raw";
+      hash = "sha256-JOZ8n7zi+nq236NPpB4e2gUy8I3l3DbcoLhpeL73f98=";
+    })
+    (fetchurl {
+      url = "https://github.com/md-raid-utilities/mdadm/commit/9dbd11e091f84eb0bf9d717283774816c4c4453d.patch";
+      hash = "sha256-8GdjP1ceVwejTOFXcHXG8wkIF9/D6hOUGD6btvuqs24=";
+    })
   ];
 
   makeFlags = [
@@ -55,7 +64,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Programs for managing RAID arrays under Linux";
     homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     mainProgram = "mdadm";
     maintainers = with maintainers; [ ekleog ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/mdevctl/default.nix b/pkgs/os-specific/linux/mdevctl/default.nix
index ce4ea250827b4..d7b61f74dc4cb 100644
--- a/pkgs/os-specific/linux/mdevctl/default.nix
+++ b/pkgs/os-specific/linux/mdevctl/default.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/mdevctl/mdevctl";
-    description = "A mediated device management utility for linux";
+    description = "Mediated device management utility for linux";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ edwtjo ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/metastore/default.nix b/pkgs/os-specific/linux/metastore/default.nix
index 76e4ae8932876..999c771fcfafb 100644
--- a/pkgs/os-specific/linux/metastore/default.nix
+++ b/pkgs/os-specific/linux/metastore/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     description = "Store and restore metadata from a filesystem";
     mainProgram = "metastore";
     homepage = "https://software.przemoc.net/#metastore";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ sstef ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 6953bbca8963e..6e133564e28ce 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20240312";
+  version = "20240531";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-4ZSA+LVczfjZINXhImmFOCc/6kKNrrUQvrXPdOvMM8g=";
+    hash = "sha256-64vcEc3UiiV5Rg4Eh3Wsi/WSCj5DbjvZBzKLr7EgNOU=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/microcode/iucode-tool.nix b/pkgs/os-specific/linux/microcode/iucode-tool.nix
index 316aaa22932dc..d38fa0a488950 100644
--- a/pkgs/os-specific/linux/microcode/iucode-tool.nix
+++ b/pkgs/os-specific/linux/microcode/iucode-tool.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     description = "Intel® 64 and IA-32 processor microcode tool";
     mainProgram = "iucode_tool";
     homepage = "https://gitlab.com/iucode-tool/iucode-tool";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = [ "x86_64-linux" "i686-linux" ];
   };
diff --git a/pkgs/os-specific/linux/mingetty/default.nix b/pkgs/os-specific/linux/mingetty/default.nix
index eff1bf50a361e..bbae8f73e316a 100644
--- a/pkgs/os-specific/linux/mingetty/default.nix
+++ b/pkgs/os-specific/linux/mingetty/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/mingetty";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
index 9d7480d239f21..1748c908e1a55 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -80,7 +80,7 @@ kaem.runCommand "${pname}-${version}" {
   ];
 
   meta = with lib; {
-    description = "The GNU Core Utilities";
+    description = "GNU Core Utilities";
     homepage = "https://www.gnu.org/software/coreutils";
     license = licenses.gpl3Plus;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index 14584e0a7e6d6..9de71315fcc31 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -50,7 +50,7 @@ bash.runCommand "${pname}-${version}" {
     '';
 
   meta = with lib; {
-    description = "The GNU Core Utilities";
+    description = "GNU Core Utilities";
     homepage = "https://www.gnu.org/software/coreutils";
     license = licenses.gpl3Plus;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
index 823d314f28022..270d4e36c7882 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
@@ -151,7 +151,7 @@ kaem.runCommand "${pname}-${version}" {
   nativeBuildInputs = [ tinycc.compiler gnupatch ];
 
   meta = with lib; {
-    description = "A tool to control the generation of non-source files from sources";
+    description = "Tool to control the generation of non-source files from sources";
     homepage = "https://www.gnu.org/software/make";
     license = licenses.gpl3Plus;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
index 504095732e8ce..47b3de03c4ca9 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
@@ -51,7 +51,7 @@ bash.runCommand "${pname}-${version}" {
     '';
 
   meta = with lib; {
-    description = "A tool to control the generation of non-source files from sources";
+    description = "Tool to control the generation of non-source files from sources";
     homepage = "https://www.gnu.org/software/make";
     license = licenses.gpl3Plus;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
index 182e515c2f1b2..7e3d29b6d29ec 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
@@ -92,7 +92,7 @@ bash.runCommand "${pname}-${version}" {
     '';
 
   meta = with lib; {
-    description = "The Heirloom Toolchest is a collection of standard Unix utilities";
+    description = "Heirloom Toolchest is a collection of standard Unix utilities";
     homepage = "https://heirloom.sourceforge.net/tools.html";
     license = with licenses; [
       # All licenses according to LICENSE/
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
index 6addd11554d08..965803c40d8f8 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
@@ -33,7 +33,7 @@ bash.runCommand "${pname}-${version}" {
 
   meta = with lib; {
     description = "Header files and scripts for Linux kernel";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = teams.minimal-bootstrap.members;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
index 807d043fa9e34..c6c89b98a2701 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -28,7 +28,7 @@ kaem.runCommand "${pname}-${version}" {
   passthru.CFLAGS = "-DHAVE_CONFIG_H=1 -I${mes-libc}/include -I${mes-libc}/include/linux/x86";
 
   meta = with lib; {
-    description = "The Mes C Library";
+    description = "Mes C Library";
     homepage = "https://www.gnu.org/software/mes";
     license = licenses.gpl3Plus;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
index 52db5f9474251..ac1bb84b9f3e5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
@@ -4,7 +4,7 @@
   pname = "musl";
 
   meta = with lib; {
-    description = "An efficient, small, quality libc implementation";
+    description = "Efficient, small, quality libc implementation";
     homepage = "https://musl.libc.org";
     license = licenses.mit;
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
index 8dcccbacaca88..2533b617e5a60 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
@@ -40,7 +40,7 @@ bash.runCommand "${pname}-${version}" {
     '';
 
   meta = with lib; {
-    description = "A general-purpose data compression software, successor of LZMA";
+    description = "General-purpose data compression software, successor of LZMA";
     homepage = "https://tukaani.org/xz";
     license = with licenses; [ gpl2Plus lgpl21Plus ];
     maintainers = teams.minimal-bootstrap.members;
diff --git a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
index da2ba4b9ff2de..0e7bb127dbb9a 100644
--- a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://archlinux.org/";
     description = "ipconfig and nfsmount tools for root on NFS, ported from klibc";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms  = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
   };
diff --git a/pkgs/os-specific/linux/vm-tools/default.nix b/pkgs/os-specific/linux/mm-tools/default.nix
index c5981bfc27136..38f16ca4e7d27 100644
--- a/pkgs/os-specific/linux/vm-tools/default.nix
+++ b/pkgs/os-specific/linux/mm-tools/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, linux }:
 
 stdenv.mkDerivation {
-  pname = "vm-tools";
+  pname = "mm-tools";
   inherit (linux) version src;
 
   makeFlags = [ "sbindir=${placeholder "out"}/bin" ];
 
-  preConfigure = "cd tools/vm";
+  preConfigure = "cd tools/mm";
 
   meta = with lib; {
     inherit (linux.meta) license platforms;
diff --git a/pkgs/os-specific/linux/msr-tools/default.nix b/pkgs/os-specific/linux/msr-tools/default.nix
index 1e6a55a4d6560..a96a74c764c4e 100644
--- a/pkgs/os-specific/linux/msr-tools/default.nix
+++ b/pkgs/os-specific/linux/msr-tools/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool to read/write from/to MSR CPU registers on Linux";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/os-specific/linux/mstflint_access/default.nix b/pkgs/os-specific/linux/mstflint_access/default.nix
index 6e29e27ccbf20..5d9a60216a548 100644
--- a/pkgs/os-specific/linux/mstflint_access/default.nix
+++ b/pkgs/os-specific/linux/mstflint_access/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/kernel-mstflint-${version}.tar.gz";
-    hash = "sha256-rfZts0m8x6clVazpbAa2xK+dYgRU9Us5rbcWa0uHJ1M=";
+    hash = "sha256-bWYglHJUNCPT13N7aBdjbLPMZIk7vjvF+o9W3abDNr0=";
   };
 
   nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
@@ -18,10 +18,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  preConfigure = lib.optionals (lib.versionAtLeast kernel.version "6.4") ''
-    sed -i "s/class_create(THIS_MODULE, dev->name)/class_create(dev->name)/g" mst_main.c
-  '';
-
   installPhase = ''
     runHook preInstall
 
@@ -31,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A kernel module for Nvidia NIC firmware update";
+    description = "Kernel module for Nvidia NIC firmware update";
     homepage = "https://github.com/Mellanox/mstflint";
     license = [ licenses.gpl2Only ];
     maintainers = with maintainers; [ thillux ];
diff --git a/pkgs/os-specific/linux/mstpd/default.nix b/pkgs/os-specific/linux/mstpd/default.nix
index 389acdf91e6e9..0f82fb8fcbdd4 100644
--- a/pkgs/os-specific/linux/mstpd/default.nix
+++ b/pkgs/os-specific/linux/mstpd/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multiple Spanning Tree Protocol daemon";
     homepage = "https://github.com/mstpd/mstpd";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 5ec8197451cfb..9fe8630e22757 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , coreutils
 
 , perl
@@ -21,31 +22,29 @@
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
-  version = "0.9.6";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "opensvc";
     repo = "multipath-tools";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-X4sAMGn4oBMY3cQkVj1dMcrDF7FgMl8SbZeUnCCOY6Q=";
+    sha256 = "sha256-4cby19BjgnmWf7klK1sBgtZnyvo7q3L1uyVPlVoS+uk=";
   };
 
+  patches = [
+    # Backport build fix for musl libc 1.2.5
+    (fetchpatch {
+      url = "https://github.com/openSUSE/multipath-tools/commit/e5004de8296cd596aeeac0a61b901e98cf7a69d2.patch";
+      hash = "sha256-3Qt8zfrWi9aOdqMObZQaNAaXDmjhvSYrXK7qycC9L1Q=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace create-config.mk \
-      --replace /bin/echo ${coreutils}/bin/echo
-
-    substituteInPlace multipathd/multipathd.service \
-      --replace /sbin/multipathd "$out/bin/multipathd"
-
-    sed -i -re '
-      s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
-    ' libmultipath/defaults.h
-    sed -i -e 's,\$(DESTDIR)/\(usr/\)\?,$(prefix)/,g' \
-      kpartx/Makefile libmpathpersist/Makefile
-    sed -i -e "s,GZIP,GZ," \
-      $(find * -name Makefile\*)
+      --replace-fail /bin/echo ${coreutils}/bin/echo
 
-    sed '1i#include <assert.h>' -i tests/{util,vpd}.c
+    substituteInPlace multipathd/multipathd.service.in \
+      --replace-fail /sbin/multipathd "$out/bin/multipathd"
   '';
 
   nativeBuildInputs = [
@@ -76,7 +75,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
   preCheck = ''
     # skip test attempting to access /sys/dev/block
-    substituteInPlace tests/Makefile --replace ' devt ' ' '
+    substituteInPlace tests/Makefile --replace-fail ' devt ' ' '
   '';
   nativeCheckInputs = [ cmocka ];
 
@@ -85,7 +84,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tools for the Linux multipathing storage driver";
     homepage = "http://christophe.varoqui.free.fr/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/musl-fts/default.nix b/pkgs/os-specific/linux/musl-fts/default.nix
index cdb1cca47c6aa..eed0553792792 100644
--- a/pkgs/os-specific/linux/musl-fts/default.nix
+++ b/pkgs/os-specific/linux/musl-fts/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/void-linux/musl-fts";
-    description = "An implementation of fts(3) for musl-libc";
+    description = "Implementation of fts(3) for musl-libc";
     platforms = platforms.linux;
     license = licenses.bsd3;
     maintainers = [ maintainers.pjjw ];
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 9f7867065ea89..eb24879366472 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -145,7 +145,7 @@ stdenv.mkDerivation rec {
   passthru.linuxHeaders = linuxHeaders;
 
   meta = with lib; {
-    description = "An efficient, small, quality libc implementation";
+    description = "Efficient, small, quality libc implementation";
     homepage    = "https://musl.libc.org/";
     changelog   = "https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?h=v${version}";
     license     = licenses.mit;
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index bedeaadc294ed..3b37ce4b8136e 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://net-tools.sourceforge.net/";
-    description = "A set of tools for controlling the network subsystem in Linux";
+    description = "Set of tools for controlling the network subsystem in Linux";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index 68386173ed505..b1a9d244a8d85 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     description = "Network monitoring module for atop";
     mainProgram = "netatopd";
     homepage = "https://www.atoptool.nl/downloadnetatop.php";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ viric ];
   };
diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix
index 4fde1dcf910d8..88a4f33b2f3f0 100644
--- a/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://linux-nfs.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
   };
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 3680cd43efb77..97518275ced67 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -5,7 +5,6 @@
 , autoreconfHook
 , withDebugSymbols ? false
 , withCli ? true, libedit
-, withPython ? false, python3
 , withXtables ? true, iptables
 , nixosTests
 }:
@@ -29,25 +28,12 @@ stdenv.mkDerivation rec {
     libmnl libnftnl libpcap
     gmp jansson
   ] ++ lib.optional withCli libedit
-    ++ lib.optional withXtables iptables
-    ++ lib.optionals withPython [
-      python3
-      python3.pkgs.setuptools
-    ];
-
-  patches = [ ./fix-py-libnftables.patch ];
-
-  postPatch = ''
-    substituteInPlace "py/src/nftables.py" \
-      --subst-var-by "out" "$out"
-  '';
+    ++ lib.optional withXtables iptables;
 
   configureFlags = [
     "--with-json"
     (lib.withFeatureAs withCli "cli" "editline")
   ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
-    ++ lib.optional (!withPython) "--disable-python"
-    ++ lib.optional withPython "--enable-python"
     ++ lib.optional withXtables "--with-xtables";
 
   passthru.tests = {
@@ -57,7 +43,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
+    description = "Project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch b/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
deleted file mode 100644
index 3ab1e5363019a..0000000000000
--- a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/py/src/nftables.py b/py/src/nftables.py
-index f1e43ade..9adcd1be 100644
---- a/py/src/nftables.py
-+++ b/py/src/nftables.py
-@@ -69,7 +69,7 @@ class Nftables:
- 
-     validator = None
- 
--    def __init__(self, sofile="libnftables.so.1"):
-+    def __init__(self, sofile="@out@/lib/libnftables.so.1"):
-         """Instantiate a new Nftables class object.
- 
-         Accepts a shared object file to open, by default standard search path
diff --git a/pkgs/os-specific/linux/nftables/python.nix b/pkgs/os-specific/linux/nftables/python.nix
new file mode 100644
index 0000000000000..7980b8ff6de68
--- /dev/null
+++ b/pkgs/os-specific/linux/nftables/python.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, setuptools
+, nftables
+}:
+
+buildPythonPackage {
+  pname = "nftables";
+  inherit (nftables) version src;
+  pyproject = true;
+
+  postPatch = ''
+    substituteInPlace "src/nftables.py" \
+      --replace-fail "libnftables.so.1" "${nftables}/lib/libnftables.so.1"
+  '';
+
+  setSourceRoot = "sourceRoot=$(echo */py)";
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "nftables" ];
+
+  meta = {
+    inherit (nftables.meta) description homepage license platforms maintainers;
+  };
+}
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index 17a9bc51732ca..63f8c92e2327e 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -50,7 +50,7 @@ substitute {
   };
 
   meta = {
-    description = "Rebuild your NixOS configuration and switch to it, on local hosts and remote.";
+    description = "Rebuild your NixOS configuration and switch to it, on local hosts and remote";
     homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/os-specific/linux/nixos-rebuild";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.Profpatsch ];
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
index 8df05f9310f2c..89c8e511154d8 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
@@ -18,11 +18,16 @@
 .Op Fl -no-build-nix
 .Op Fl -fast
 .Op Fl -rollback
-.Op Fl -builders Ar builder-spec
 .br
 .Op Fl -flake Ar flake-uri
 .Op Fl -no-flake
-.Op Fl -override-input Ar input-name flake-uri
+.Op Fl -recreate-lock-file
+.Op Fl -no-update-lock-file
+.Op Fl -no-write-lock-file
+.Op Fl -no-registries
+.Op Fl -commit-lock-file
+.Op Fl -update-input Ar input-path
+.Op Fl -override-input Ar input-path flake-url
 .br
 .Op Fl -profile-name | p Ar name
 .Op Fl -specialisation | c Ar name
@@ -31,14 +36,26 @@
 .Op Fl -target-host Va host
 .Op Fl -use-remote-sudo
 .br
-.Op Fl -show-trace
-.Op Fl I Va NIX_PATH
 .Op Fl -verbose | v
-.Op Fl -accept-flake-config
-.Op Fl -impure
+.Op Fl -quiet
+.Op Fl -log-format Ar format
+.Op Fl -no-build-output | Q
 .Op Fl -max-jobs | j Va number
-.Op Fl -keep-failed | K
+.Op Fl -cores Va number
 .Op Fl -keep-going | k
+.Op Fl -keep-failed | K
+.Op Fl -fallback
+.Op Fl I Va NIX_PATH
+.Op Fl -option Ar name value
+.Op Fl -repair
+.Op Fl -builders Va builder-spec
+.Op Fl -accept-flake-config
+.Op Fl -print-build-logs | L
+.Op Fl -show-trace
+.Op Fl -refresh
+.Op Fl -impure
+.Op Fl -offline
+.Op Fl -no-net
 .
 .
 .
@@ -390,18 +407,57 @@ even if the current NixOS systems uses flakes.
 .Pp
 In addition,
 .Nm
-accepts various Nix-related flags, including
+accepts following options from nix commands that the tool calls:
+.
+.Pp
+flake-related options:
+.Bd -offset indent
+.Fl -recreate-lock-file Ns ,
+.Fl -no-update-lock-file Ns ,
+.Fl -no-write-lock-file Ns ,
+.Fl -no-registries Ns ,
+.Fl -commit-lock-file Ns ,
+.Fl -update-input Ar input-path Ns ,
+.Fl -override-input Ar input-path flake-url Ns
+.Ed
+.
+.Pp
+Builder options:
+.Bd -offset indent
+.Fl -verbose Ns ,
+.Fl v Ns ,
+.Fl -quiet Ns ,
+.Fl -log-format Ns ,
+.Fl -no-build-output Ns ,
+.Fl Q Ns ,
 .Fl -max-jobs Ns ,
 .Fl j Ns ,
+.Fl -cores Ns ,
+.Fl -keep-going Ns ,
+.Fl k Ns ,
+.Fl -keep-failed Ns ,
+.Fl K Ns ,
+.Fl -fallback Ns ,
 .Fl I Ns ,
+.Fl -option Ns
+.Fl -repair Ns ,
+.Fl -builders Ns ,
 .Fl -accept-flake-config Ns ,
+.Fl -print-build-logs Ns ,
+.Fl L Ns ,
 .Fl -show-trace Ns ,
-.Fl -keep-failed Ns ,
-.Fl -keep-going Ns ,
+.Fl -refresh Ns ,
 .Fl -impure Ns ,
-.Fl -verbose Ns , and
-.Fl v Ns
-\&. See the Nix manual for details.
+.Fl -offline Ns ,
+.Fl -no-net Ns
+.Ed
+.
+.Pp
+See the Nix manual,
+.Ic nix flake lock --help
+or
+.Ic nix-build --help
+for details.
 .
 .
 .
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index f3ee49a8c395f..fb7c8b2322a7a 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -391,7 +391,7 @@ if [[ -n $flake ]]; then
        flakeAttr="${BASH_REMATCH[2]}"
     fi
     if [[ -z $flakeAttr ]]; then
-        read -r hostname < /proc/sys/kernel/hostname
+        hostname="$(targetHostCmd cat /proc/sys/kernel/hostname)"
         if [[ -z $hostname ]]; then
             hostname=default
         fi
diff --git a/pkgs/os-specific/linux/nsncd/default.nix b/pkgs/os-specific/linux/nsncd/default.nix
index 0ad11ee8b79f8..80dfdb5457fa7 100644
--- a/pkgs/os-specific/linux/nsncd/default.nix
+++ b/pkgs/os-specific/linux/nsncd/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nsncd";
-  version = "unstable-2024-01-16";
+  version = "unstable-2024-03-18";
 
   src = fetchFromGitHub {
     owner = "twosigma";
     repo = "nsncd";
-    rev =  "f4706786f26d12c533035fb2916be9be5751150b";
-    hash = "sha256-GbKDWW00eZZwmslkaGIO8hjCyD5xi7h+S2WP6q5ekOQ=";
+    rev =  "7605e330d5a313a8656e6fcaf1c10cd6b5cdd427";
+    hash = "sha256-Bd7qE9MP5coBCkr70TdoJfwYhQpdrn/zmN4KoARcaMI=";
   };
 
-  cargoSha256 = "sha256-jAxcyMPDTBFBrG0cuKm0Tm5p/UEnUgTPQKDgqY2yK7w=";
+  cargoHash = "sha256-i1rmc5wxtc631hZy2oM4d6r7od0w8GrG7+/pdM6Gqco=";
   checkFlags = [
     # Relies on the test environment to be able to resolve "localhost"
     # on IPv4. That's not the case in the Nix sandbox somehow. Works
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   meta = with lib; {
-    description = "the name service non-caching daemon";
+    description = "Name service non-caching daemon";
     mainProgram = "nsncd";
     longDescription = ''
       nsncd is a nscd-compatible daemon that proxies lookups, without caching.
diff --git a/pkgs/os-specific/linux/nss_ldap/default.nix b/pkgs/os-specific/linux/nss_ldap/default.nix
index 7366932d1e676..784ecf2b39cce 100644
--- a/pkgs/os-specific/linux/nss_ldap/default.nix
+++ b/pkgs/os-specific/linux/nss_ldap/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "LDAP module for the Solaris Nameservice Switch (NSS)";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 16e2ae51f9572..142dd064e0f91 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Library and tools for non-uniform memory access (NUMA) machines";
     homepage = "https://github.com/numactl/numactl";
-    license = with licenses; [ gpl2 lgpl21 ]; # libnuma is lgpl21
+    license = with licenses; [ gpl2Only lgpl21 ]; # libnuma is lgpl21
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index 2eabbc95fa13b..6ea970a11769d 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "prefix=$(out)" ];
 
   meta = with lib; {
-    description = "A user-level daemon that monitors NUMA topology and processes resource consumption to facilitate good NUMA resource access";
+    description = "User-level daemon that monitors NUMA topology and processes resource consumption to facilitate good NUMA resource access";
     mainProgram = "numad";
     homepage = "https://fedoraproject.org/wiki/Features/numad";
     license = licenses.lgpl21;
diff --git a/pkgs/os-specific/linux/numworks-udev-rules/default.nix b/pkgs/os-specific/linux/numworks-udev-rules/default.nix
index aae7507f50cdd..dbea6e4df79d9 100644
--- a/pkgs/os-specific/linux/numworks-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/numworks-udev-rules/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "numworks-udev-rules";
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 777e5b6ca4d94..e08ffa1500a1d 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,12 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "550.78";
-    sha256_64bit = "sha256-NAcENFJ+ydV1SD5/EcoHjkZ+c/be/FQ2bs+9z+Sjv3M=";
-    sha256_aarch64 = "sha256-2POG5RWT2H7Rhs0YNfTGHO64Q8u5lJD9l/sQCGVb+AA=";
-    openSha256 = "sha256-cF9omNvfHx6gHUj2u99k6OXrHGJRpDQDcBG3jryf41Y=";
-    settingsSha256 = "sha256-lZiNZw4dJw4DI/6CI0h0AHbreLm825jlufuK9EB08iw=";
-    persistencedSha256 = "sha256-qDGBAcZEN/ueHqWO2Y6UhhXJiW5625Kzo1m/oJhvbj4=";
+    version = "550.90.07";
+    sha256_64bit = "sha256-Uaz1edWpiE9XOh0/Ui5/r6XnhB4iqc7AtLvq4xsLlzM=";
+    sha256_aarch64 = "sha256-uJa3auRlMHr8WyacQL2MyyeebqfT7K6VU0qR7LGXFXI=";
+    openSha256 = "sha256-VLmh7eH0xhEu/AK+Osb9vtqAFni+lx84P/bo4ZgCqj8=";
+    settingsSha256 = "sha256-sX9dHEp9zH9t3RWp727lLCeJLo8QRAGhVb8iN6eX49g=";
+    persistencedSha256 = "sha256-qe8e1Nxla7F0U88AbnOZm6cHxo57pnLCqtjdvOvq9jk=";
   };
 
   latest = selectHighestVersion production (generic {
@@ -51,24 +51,22 @@ rec {
   });
 
   beta = selectHighestVersion latest (generic {
-    version = "550.40.07";
-    sha256_64bit = "sha256-KYk2xye37v7ZW7h+uNJM/u8fNf7KyGTZjiaU03dJpK0=";
-    sha256_aarch64 = "sha256-AV7KgRXYaQGBFl7zuRcfnTGr8rS5n13nGUIe3mJTXb4=";
-    openSha256 = "sha256-mRUTEWVsbjq+psVe+kAT6MjyZuLkG2yRDxCMvDJRL1I=";
-    settingsSha256 = "sha256-c30AQa4g4a1EHmaEu1yc05oqY01y+IusbBuq+P6rMCs=";
-    persistencedSha256 = "sha256-11tLSY8uUIl4X/roNnxf5yS2PQvHvoNjnd2CB67e870=";
-
-    patches = [ rcu_patch ];
+    version = "555.52.04";
+    sha256_64bit = "sha256-nVOubb7zKulXhux9AruUTVBQwccFFuYGWrU1ZiakRAI=";
+    sha256_aarch64 = "sha256-Kt60kTTO3mli66De2d1CAoE3wr0yUbBe7eqCIrYHcWk=";
+    openSha256 = "sha256-wDimW8/rJlmwr1zQz8+b1uvxxxbOf3Bpk060lfLKuy0=";
+    settingsSha256 = "sha256-PMh5efbSEq7iqEMBr2+VGQYkBG73TGUh6FuDHZhmwHk=";
+    persistencedSha256 = "sha256-KAYIvPjUVilQQcD04h163MHmKcQrn2a8oaXujL2Bxro=";
   });
 
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.61";
+    version = "550.40.63";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-JNVeA5/u5/ictU3QpPnbXIHDKOtwou8wGmMt3We4FJY=";
-    openSha256 = "sha256-kWGTj3eAvwLTJ7zgzRFvyhXmfpxQbUMmyxWxER9i9m0=";
+    sha256_64bit = "sha256-YvlNgxcFsCl3DzHFpKe+VXzfc0QIgf3N/hTKsWZ7gDE=";
+    openSha256 = "sha256-mITh1kdSPtB+jP6TDHw04EN7gRx48KGbzbLO0wTSS/U=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
@@ -107,13 +105,26 @@ rec {
   # If you add a legacy driver here, also update `top-level/linux-kernels.nix`,
   # adding to the `nvidia_x11_legacy*` entries.
 
+  # Last one without the bug reported here:
+  # https://bbs.archlinux.org/viewtopic.php?pid=2155426#p2155426
+  legacy_535 = generic {
+    version = "535.154.05";
+    sha256_64bit = "sha256-fpUGXKprgt6SYRDxSCemGXLrEsIA6GOinp+0eGbqqJg=";
+    sha256_aarch64 = "sha256-G0/GiObf/BZMkzzET8HQjdIcvCSqB1uhsinro2HLK9k=";
+    openSha256 = "sha256-wvRdHguGLxS0mR06P5Qi++pDJBCF8pJ8hr4T8O6TJIo=";
+    settingsSha256 = "sha256-9wqoDEWY4I7weWW05F4igj1Gj9wjHsREFMztfEmqm10=";
+    persistencedSha256 = "sha256-d0Q3Lk80JqkS1B54Mahu2yY/WocOqFFbZVBh+ToGhaE=";
+
+    patches = [ rcu_patch ];
+  };
+
   # Last one supporting Kepler architecture
   legacy_470 = generic {
-    version = "470.239.06";
-    sha256_64bit = "sha256-fXTKrBQKBDLXnr6OQzDceW85un3UCz/NYd92AYG/nMw=";
-    sha256_aarch64 = "sha256-NZj8OLQ0N7y3V7UBamLyJE8AbI3alZJD1weNjnssuNs=";
-    settingsSha256 = "sha256-2YTk6DaoB8Qvob9/ohtHXuDhxGO9O/SUwlXXbLSgJP0=";
-    persistencedSha256 = "sha256-wLrkfD8MQ8sMODE+yEnWg/1ETxYVWOqNsIj1dY+5yjc=";
+    version = "470.256.02";
+    sha256_64bit = "sha256-1kUYYt62lbsER/O3zWJo9z6BFowQ4sEFl/8/oBNJsd4=";
+    sha256_aarch64 = "sha256-e+QvE+S3Fv3JRqC9ZyxTSiCu8gJdZXSz10gF/EN6DY0=";
+    settingsSha256 = "sha256-kftQ4JB0iSlE8r/Ze/+UMnwLzn0nfQtqYXBj+t6Aguk=";
+    persistencedSha256 = "sha256-iYoSib9VEdwjOPBP1+Hx5wCIMhW8q8cCHu9PULWfnyQ=";
   };
 
   # Last one supporting x86
diff --git a/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared-3xx.patch b/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared-3xx.patch
new file mode 100644
index 0000000000000..d2e074add7549
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared-3xx.patch
@@ -0,0 +1,24 @@
+--- a/src/libXNVCtrl/Makefile
++++ b/src/libXNVCtrl/Makefile
+@@ -33,6 +33,8 @@
+ 
+ LIBXNVCTRL = libXNVCtrl.a
+ 
++LIBXNVCTRL_SHARED = $(OUTPUTDIR)/libXNVCtrl.so
++
+ LIBXNVCTRL_PROGRAM_NAME = "libXNVCtrl"
+ 
+ LIBXNVCTRL_VERSION := $(NVIDIA_VERSION)
+@@ -62,6 +64,12 @@
+ $(LIBXNVCTRL) : $(OBJS)
+ 	$(AR) ru $@ $(OBJS)
+ 
++$(LIBXNVCTRL_SHARED): $(LIBXNVCTRL_OBJ)
++	$(RM) $@ $@.*
++	$(CC) -shared -Wl,-soname=$(@F).0 -o $@.0.0.0 $(LDFLAGS) $^ -lXext -lX11
++	ln -s $(@F).0.0.0 $@.0
++	ln -s $(@F).0 $@
++
+ # define the rule to build each object file
+ $(foreach src,$(SRC),$(eval $(call DEFINE_OBJECT_RULE,TARGET,$(src))))
+ 
diff --git a/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared.patch b/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared.patch
new file mode 100644
index 0000000000000..ad1dc1eae4002
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/libxnvctrl-build-shared.patch
@@ -0,0 +1,21 @@
+--- a/src/libXNVCtrl/xnvctrl.mk
++++ b/src/libXNVCtrl/xnvctrl.mk
+@@ -39,6 +39,8 @@
+ 
+ LIBXNVCTRL = $(OUTPUTDIR)/libXNVCtrl.a
+ 
++LIBXNVCTRL_SHARED = $(OUTPUTDIR)/libXNVCtrl.so
++
+ LIBXNVCTRL_SRC = $(XNVCTRL_DIR)/NVCtrl.c
+ 
+ LIBXNVCTRL_OBJ = $(call BUILD_OBJECT_LIST,$(LIBXNVCTRL_SRC))
+@@ -47,3 +49,9 @@
+ 
+ $(LIBXNVCTRL) : $(LIBXNVCTRL_OBJ)
+ 	$(call quiet_cmd,AR) ru $@ $(LIBXNVCTRL_OBJ)
++
++$(LIBXNVCTRL_SHARED): $(LIBXNVCTRL_OBJ)
++	$(RM) $@ $@.*
++	$(CC) -shared -Wl,-soname=$(@F).0 -o $@.0.0.0 $(LDFLAGS) $^ -lXext -lX11
++	ln -s $(@F).0.0.0 $@.0
++	ln -s $(@F).0 $@
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index b11dc06c85ebf..a26acd144125c 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -16,7 +16,7 @@ nvidia_x11: sha256:
 , libXxf86vm
 , libvdpau
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , addOpenGLRunpath
 , withGtk2 ? false
 , withGtk3 ? true
@@ -30,6 +30,12 @@ let
     inherit sha256;
   };
 
+  meta = with lib; {
+    homepage = "https://www.nvidia.com/object/unix.html";
+    platforms = nvidia_x11.meta.platforms;
+    maintainers = with maintainers; [ abbradar aidalgol ];
+  };
+
   libXNVCtrl = stdenv.mkDerivation {
     pname = "libXNVCtrl";
     version = nvidia_x11.settingsVersion;
@@ -43,6 +49,14 @@ let
 
     makeFlags = [
       "OUTPUTDIR=." # src/libXNVCtrl
+      "libXNVCtrl.a"
+      "libXNVCtrl.so"
+    ];
+
+    patches = [
+      # Patch the Makefile to also produce a shared library.
+      (if lib.versionOlder nvidia_x11.settingsVersion "400" then ./libxnvctrl-build-shared-3xx.patch
+      else ./libxnvctrl-build-shared.patch)
     ];
 
     installPhase = ''
@@ -52,7 +66,14 @@ let
       cp libXNVCtrl.a $out/lib
       cp NVCtrl.h     $out/include/NVCtrl
       cp NVCtrlLib.h  $out/include/NVCtrl
+      cp -P libXNVCtrl.so* $out/lib
     '';
+
+    meta = meta // {
+      description = "NVIDIA NV-CONTROL X extension";
+      # https://github.com/NVIDIA/nvidia-settings/commit/edcf9edad9f52f9b10e63d4480bbe88b22dde884
+      license = lib.licenses.mit;
+    };
   };
 
 in
@@ -93,21 +114,20 @@ stdenv.mkDerivation {
     fi
   '';
 
-  nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ];
+  nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ]
+    ++ lib.optionals withGtk3 [ wrapGAppsHook3 ];
 
-  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
-    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
+  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 dbus ]
+    ++ lib.optionals (withGtk2 || lib.versionOlder nvidia_x11.settingsVersion "525.53") [ gtk2 ]
+    ++ lib.optionals withGtk3 [ gtk3 librsvg ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  postInstall = ''
-    ${lib.optionalString (!withGtk2) ''
-      rm -f $out/lib/libnvidia-gtk2.so.*
-    ''}
-    ${lib.optionalString (!withGtk3) ''
-      rm -f $out/lib/libnvidia-gtk3.so.*
-    ''}
-
+  postInstall = lib.optionalString (!withGtk2) ''
+    rm -f $out/lib/libnvidia-gtk2.so.*
+  '' + lib.optionalString (!withGtk3) ''
+    rm -f $out/lib/libnvidia-gtk3.so.*
+  '' + ''
     # Install the desktop file and icon.
     # The template has substitution variables intended to be replaced resulting
     # in absolute paths. Because absolute paths break after the desktop file is
@@ -132,12 +152,10 @@ stdenv.mkDerivation {
     inherit libXNVCtrl;
   };
 
-  meta = with lib; {
-    homepage = "https://www.nvidia.com/object/unix.html";
+  meta = meta // {
     description = "Settings application for NVIDIA graphics cards";
-    license = licenses.unfreeRedistributable;
-    platforms = nvidia_x11.meta.platforms;
+    # nvml.h is licensed as part of the cuda developer license.
+    license = lib.licenses.unfreeRedistributable;
     mainProgram = "nvidia-settings";
-    maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidiabl/default.nix b/pkgs/os-specific/linux/nvidiabl/default.nix
index 0f4d485a4edc6..68991e1289598 100644
--- a/pkgs/os-specific/linux/nvidiabl/default.nix
+++ b/pkgs/os-specific/linux/nvidiabl/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux driver for setting the backlight brightness on laptops using NVIDIA GPU";
     homepage = "https://github.com/yorickvP/nvidiabl";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ yorickvp ];
     broken = kernel.kernelAtLeast "5.18";
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index d909e331871be..a39c26ac7c199 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "2.7.1";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    hash = "sha256-Gm+1tb/Nh+Yg2PgSUn/1hR4CZYnfTWRwcQU0A8UeQwI=";
+    hash = "sha256-zs7UksB5QkvCP29iELDGMJeObvMdKrs6ajQkEzCPzzQ=";
   };
 
   mesonFlags = [
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index 9306099213a98..9bb98fbeea3bb 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "open-iscsi";
-  version = "2.1.9";
+  version = "2.1.10";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-iscsi";
     rev = version;
-    hash = "sha256-y0NIb/KsKpCd8byr/SXI7nwTKXP2/bSSoW8QgeL5xdc=";
+    hash = "sha256-5bT9MaJ2OHFU9R9X01UOOztRqtR6rWv4RS5d1MGWf6M=";
   };
 
   nativeBuildInputs = [
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
   passthru.tests = { inherit (nixosTests) iscsi-root; };
 
   meta = with lib; {
-    description = "A high performance, transport independent, multi-platform implementation of RFC3720";
+    description = "High performance, transport independent, multi-platform implementation of RFC3720";
     license = licenses.gpl2Plus;
     homepage = "https://www.open-iscsi.com";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/openrazer/driver.nix b/pkgs/os-specific/linux/openrazer/driver.nix
index a2116797824cc..42e6be93dae4d 100644
--- a/pkgs/os-specific/linux/openrazer/driver.nix
+++ b/pkgs/os-specific/linux/openrazer/driver.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (common // {
   enableParallelBuilding = true;
 
   meta = common.meta // {
-    description = "An entirely open source Linux driver that allows you to manage your Razer peripherals on GNU/Linux";
+    description = "Entirely open source Linux driver that allows you to manage your Razer peripherals on GNU/Linux";
     mainProgram = "razer_mount";
     broken = kernel.kernelOlder "4.19";
   };
diff --git a/pkgs/os-specific/linux/otpw/default.nix b/pkgs/os-specific/linux/otpw/default.nix
index 45d0b77906d34..12920c0c342ea 100644
--- a/pkgs/os-specific/linux/otpw/default.nix
+++ b/pkgs/os-specific/linux/otpw/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "A one-time password login package";
+    description = "One-time password login package";
     mainProgram = "otpw-gen";
     homepage = "http://www.cl.cam.ac.uk/~mgk25/otpw.html";
     license = licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 2b0c327fbc2e6..e5f8fec5acb14 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch
+{ lib, stdenv, buildPackages, fetchurl
 , flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
 , autoreconfHook269, pkg-config-unwrapped
@@ -6,31 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-//SjTlu+534ujxmS8nYx4jKby/igVj3etcM4m04xaa0=";
+    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
   };
 
   patches = [
     ./suid-wrapper-path.patch
-
-    # Backport fix for missing include breaking musl builds.
-    (fetchpatch {
-      name = "pam_namespace-stdint.h.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
-      hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
-    })
-
-    # Resotre handling of empty passwords:
-    #   https://github.com/linux-pam/linux-pam/pull/784
-    # TODO: drop upstreamed patch on 1.6.1 update.
-    (fetchpatch {
-      name = "revert-unconditional-helper.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/8d0c575336ad301cd14e16ad2fdec6fe621764b8.patch";
-      hash = "sha256-z9KfMxxqXQVnmNaixaVjLnQqaGsH8MBHhHbiP/8fvhE=";
-    })
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
index 359636e742814..1921193d70311 100644
--- a/pkgs/os-specific/linux/pam_ccreds/default.nix
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.padl.com/OSS/pam_ccreds.html";
     description = "PAM module to locally authenticate using an enterprise identity when the network is unavailable";
     mainProgram = "ccreds_chkpwd";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
index 2ed6829f3614a..81199cb057c69 100644
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "PAM module to mount volumes for a user session";
     homepage = "https://pam-mount.sourceforge.net/";
-    license = with licenses; [ gpl2 gpl3 lgpl21 lgpl3 ];
+    license = with licenses; [ gpl2Plus gpl3 lgpl21 lgpl3 ];
     maintainers = with maintainers; [ netali ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix b/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
index 46587028f2962..656a3e62caca9 100644
--- a/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
+++ b/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, pam, openssl, perl }:
+{ lib, stdenv, nixosTests, fetchFromGitHub, pam, openssl, perl }:
 
 stdenv.mkDerivation rec {
   pname = "pam_ssh_agent_auth";
diff --git a/pkgs/os-specific/linux/pam_u2f/default.nix b/pkgs/os-specific/linux/pam_u2f/default.nix
index 085ff43a79355..715f60e193993 100644
--- a/pkgs/os-specific/linux/pam_u2f/default.nix
+++ b/pkgs/os-specific/linux/pam_u2f/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://developers.yubico.com/pam-u2f/";
-    description = "A PAM module for allowing authentication with a U2F device";
+    description = "PAM module for allowing authentication with a U2F device";
     changelog = "https://github.com/Yubico/pam-u2f/raw/pam_u2f-${version}/NEWS";
     license = licenses.bsd2;
     platforms = platforms.unix;
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index fbb0e00ebe911..e15b17378d9ee 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -25,10 +25,10 @@ stdenv.mkDerivation rec {
   setupHook = ./setup-hook.sh;
 
   meta = with lib; {
-    description = "A tool for controlling PaX flags on a per binary basis";
+    description = "Tool for controlling PaX flags on a per binary basis";
     mainProgram = "paxctl";
     homepage    = "https://pax.grsecurity.net";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Only;
     platforms   = platforms.all;
     maintainers = with maintainers; [ thoughtpolice ];
   };
diff --git a/pkgs/os-specific/linux/paxtest/default.nix b/pkgs/os-specific/linux/paxtest/default.nix
index acea7cbe49f77..b415970a743ef 100644
--- a/pkgs/os-specific/linux/paxtest/default.nix
+++ b/pkgs/os-specific/linux/paxtest/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Test various memory protection measures";
     mainProgram = "paxtest";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Only;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin joachifm ];
   };
diff --git a/pkgs/os-specific/linux/pcm/default.nix b/pkgs/os-specific/linux/pcm/default.nix
index e464d113e2f73..5c111952727de 100644
--- a/pkgs/os-specific/linux/pcm/default.nix
+++ b/pkgs/os-specific/linux/pcm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202403";
+  version = "202405";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    hash = "sha256-qefqtuxRaQEsWpXNAuGxuIT3LiH2b8xQb54B0RkzKGA=";
+    hash = "sha256-yEe1lWbvafc3N3+K9WMMlIXVVX+fVO8QsuKdyIqiKAg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index b5f9d8a0a2c24..bcfb101c6fcb5 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       the PCMCIA subsystem to behave (almost) as every other
       hotpluggable bus system.
     ";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index a0d43b2e0e367..a2e2456ad6e09 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
       Intel architectures.
     '';
     homepage = "https://github.com/danielw86dev/phc-intel-dkms";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
     broken = lib.versionAtLeast kernel.version "4.18";
   };
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index b1508dcb6a3ed..d646f004893c2 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -1,5 +1,5 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
-, wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
+, wrapGAppsHook3, gtk3, glib, desktop-file-utils, appstream-glib, gnome
 , gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
-  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
+  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook3 desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
     gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "GTK frontend for ratbagd mouse config daemon";
     mainProgram = "piper";
     homepage    = "https://github.com/libratbag/piper";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Only;
     maintainers = with maintainers; [ mvnetbiz ];
     platforms   = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 66971444e71a9..7fbc445902e9b 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , meson
 , ninja
 , pkg-config
diff --git a/pkgs/os-specific/linux/pm-utils/default.nix b/pkgs/os-specific/linux/pm-utils/default.nix
index 4076641717f40..3eccb6381cd17 100644
--- a/pkgs/os-specific/linux/pm-utils/default.nix
+++ b/pkgs/os-specific/linux/pm-utils/default.nix
@@ -49,8 +49,8 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://pm-utils.freedesktop.org/wiki/";
-    description = "A small collection of scripts that handle suspend and resume on behalf of HAL";
-    license = lib.licenses.gpl2;
+    description = "Small collection of scripts that handle suspend and resume on behalf of HAL";
+    license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 8267a2d4a7f9d..94ab7b7e3c2db 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://bazaar.launchpad.net/~fourmond/pmount/main/files";
     description = "Mount removable devices as normal user";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 5fdb3583b5cf4..bcb5dafa137b6 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "SELinux policy core utilities";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     inherit (libsepol.meta) homepage platforms maintainers;
   };
 }
diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix
index f92a9c1b5d1df..11a5cebc76bfb 100644
--- a/pkgs/os-specific/linux/pommed-light/default.nix
+++ b/pkgs/os-specific/linux/pommed-light/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "A trimmed version of the pommed hotkey handler for MacBooks";
+    description = "Trimmed version of the pommed hotkey handler for MacBooks";
     mainProgram = "pommed";
     longDescription = ''
       This is a stripped-down version of pommed with client, dbus, and
@@ -71,6 +71,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/bytbox/pommed-light";
     platforms = [ "x86_64-linux" ];
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/power-calibrate/default.nix b/pkgs/os-specific/linux/power-calibrate/default.nix
index d2ce5d4d4fa7e..24f7f7f419c13 100644
--- a/pkgs/os-specific/linux/power-calibrate/default.nix
+++ b/pkgs/os-specific/linux/power-calibrate/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Tool to calibrate power consumption";
     mainProgram = "power-calibrate";
     homepage = "https://github.com/ColinIanKing/power-calibrate";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
   };
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 11f26e5013a82..f7145bc02ebe7 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -11,6 +11,7 @@
 , polkit
 , dbus
 , gobject-introspection
+, wrapGAppsNoGuiHook
 , gettext
 , gtk-doc
 , docbook-xsl-nons
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
+    wrapGAppsNoGuiHook
     # checkInput but cheked for during the configuring
     (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
       pygobject3
@@ -95,6 +97,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Only need to wrap the Python tool (powerprofilectl)
+  dontWrapGApps = true;
+
   PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
   postPatch = ''
@@ -106,6 +111,10 @@ stdenv.mkDerivation rec {
       src/powerprofilesctl
   '';
 
+  postFixup = ''
+    wrapGApp "$out/bin/powerprofilesctl"
+  '';
+
   passthru = {
     tests = {
       nixos = nixosTests.power-profiles-daemon;
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index 83f0aa634efa9..b7a88a0d9ec9d 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Laptop power measuring tool";
     mainProgram = "powerstat";
     homepage = "https://github.com/ColinIanKing/powerstat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
   };
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 6acb8eba38633..3a3016d14b4be 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "19.3.0-54924";
+  version = "19.4.0-54962";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-Hj1manQSZHiht6mmWes44RVk2Bdqp6QdNCdK322bzWc=";
+    hash = "sha256-c/MrWUvwY/Z38uOBbetJSVkZlwkdzFhw6wpk1L0BuQs=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/procdump/default.nix b/pkgs/os-specific/linux/procdump/default.nix
index 0d648782e38c4..45e6516c745d7 100644
--- a/pkgs/os-specific/linux/procdump/default.nix
+++ b/pkgs/os-specific/linux/procdump/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A Linux version of the ProcDump Sysinternals tool";
+    description = "Linux version of the ProcDump Sysinternals tool";
     mainProgram = "procdump";
     homepage = "https://github.com/Microsoft/ProcDump-for-Linux";
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index e4d245fdc7ce1..70df91d31eee3 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.com/procps-ng/procps";
     description = "Utilities that give information about processes using the /proc filesystem";
     priority = 11; # less than coreutils, which also provides "kill" and "uptime"
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.typetetris ];
   };
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
index 0477985cc196d..96d6ed0327033 100644
--- a/pkgs/os-specific/linux/projecteur/default.nix
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -42,7 +42,7 @@ mkDerivation rec {
   ];
 
   meta = {
-    description = "Linux/X11 application for the Logitech Spotlight device (and similar devices).";
+    description = "Linux/X11 application for the Logitech Spotlight device (and similar devices)";
     homepage = "https://github.com/jahnf/Projecteur";
     license = lib.licenses.mit;
     mainProgram = "projecteur";
diff --git a/pkgs/os-specific/linux/pscircle/default.nix b/pkgs/os-specific/linux/pscircle/default.nix
index 712eea0c3651e..b34a2d7914b32 100644
--- a/pkgs/os-specific/linux/pscircle/default.nix
+++ b/pkgs/os-specific/linux/pscircle/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.com/mildlyparallel/pscircle";
     description = "Visualize Linux processes in a form of a radial tree";
     mainProgram = "pscircle";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.ldesgoui ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix
index 0f920eeafb5da..2e8003ab891ab 100644
--- a/pkgs/os-specific/linux/psmisc/default.nix
+++ b/pkgs/os-specific/linux/psmisc/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://gitlab.com/psmisc/psmisc";
-    description = "A set of small useful utilities that use the proc filesystem (such as fuser, killall and pstree)";
+    description = "Set of small useful utilities that use the proc filesystem (such as fuser, killall and pstree)";
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ryantm ];
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 6eb53ca17f7a3..274fcd06ffefa 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -6,18 +6,18 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
   name = "r8168-${kernel.version}-${version}";
   # on update please verify that the source matches the realtek version
-  version = "8.052.01";
+  version = "8.053.00";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
-  # [1] https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software
-  # I've verified manually (`diff -r`) that the source code for version 8.052.01
+  # [1] https://www.realtek.com/Download/List?cate_id=584
+  # I've verified manually (`diff -r`) that the source code for version 8.053.00
   # is the same as the one available on the realtek website.
   src = fetchFromGitHub {
     owner = "mtorromeo";
     repo = "r8168";
     rev = version;
-    sha256 = "01mi7hh92nc7jaxkfrpz7j0ci78djrhgmq0im4k1270mwmvr0yzj";
+    sha256 = "0bHGs8jyWd+ZiixOoNkBqhS9RjDpRp3vveAgk1YuOWU=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ timokau ];
-    broken = (lib.versions.majorMinor kernel.modDirVersion) != "5.15";
+    maintainers = with maintainers; [];
+    broken = lib.versionAtLeast kernel.modDirVersion "6.9";
   };
 }
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index 49e2fdfd90b52..221a26f623406 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       blocks. Supports R600 and later cards: even Southern Islands should work.
       Works with both the open drivers and AMD Catalyst. Total GPU utilization
       is also valid for OpenCL loads; the other blocks are only useful for GL
-      loads. Requires root rights or other permissions to read /dev/mem.
+      loads.
     '';
     homepage = "https://github.com/clbr/radeontop";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 9ddb211ba0d57..ec1bb7bbf35a6 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "51.0";
+  version = "52.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-G5Z2BbmF5fzOg/32BBgGpC6yroDFOnZWtA/+5QatQ1M=";
+    hash = "sha256-M4nmnfeEIxsaFO1DJV9jKD/NnkaLHVNXtfTPf2pTDs4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/rewritefs/default.nix b/pkgs/os-specific/linux/rewritefs/default.nix
index e78d5f2d164c8..0626fc0a91a7e 100644
--- a/pkgs/os-specific/linux/rewritefs/default.nix
+++ b/pkgs/os-specific/linux/rewritefs/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     description = ''A FUSE filesystem intended to be used
       like Apache mod_rewrite'';
     homepage    = "https://github.com/sloonz/rewritefs";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Only;
     maintainers = with maintainers; [ rnhmjoj ];
     platforms   = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/rt-tests/default.nix b/pkgs/os-specific/linux/rt-tests/default.nix
index 8e3a9b0ceb02a..16970a15b1d81 100644
--- a/pkgs/os-specific/linux/rt-tests/default.nix
+++ b/pkgs/os-specific/linux/rt-tests/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rt-tests";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-apRJwRqcyzfmyGCCv5BDN92pKP3Nafa9SkxlZ+Bxrm0=";
+    sha256 = "sha256-1kfLmB1RPO8Hd7o8tROSyVBWchchc+AGPuOUlM2hR8g=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     description = "Suite of real-time tests - cyclictest, hwlatdetect, pip_stress, pi_stress, pmqtest, ptsematest, rt-migrate-test, sendme, signaltest, sigwaittest, svsematest";
     platforms = platforms.linux;
     maintainers = with maintainers; [ poelzi ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index c6bb4e0cbfcdd..9c580edc308fd 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/heftig/rtkit";
-    description = "A daemon that hands out real-time priority to processes";
+    description = "Daemon that hands out real-time priority to processes";
     mainProgram = "rtkitctl";
     license = with licenses; [ gpl3 bsd0 ]; # lib is bsd license
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e31a54f56c31a..8e95ceafd3367 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2023-03-14";
+  version = "2024-01-21";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "ae7b31e55526ca0e01d2a3310118530bff4f1055";
-    sha256 = "sha256-l/xUxs63Y5LVT6ZafuRc+iaCXCSt2HwysYJLJ5hg3RM=";
+    rev = "eb51e021b0e1b6f94a4b49da3f4ee5c5fb20b715";
+    sha256 = "sha256-n7Bsstr1H1RvguAyJnVqk/JgEx8WEZWaVg7ZfEYykR0=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
@@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Driver for Realtek rtl8189es";
     homepage = "https://github.com/jwrdegoede/rtl8189ES_linux";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ danielfullmer lheckemann ];
+    maintainers = with maintainers; [ danielfullmer ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8189fs/default.nix b/pkgs/os-specific/linux/rtl8189fs/default.nix
index 67642f11d3222..87b0944c4d326 100644
--- a/pkgs/os-specific/linux/rtl8189fs/default.nix
+++ b/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -1,21 +1,21 @@
-{ lib, kernel, rtl8189es, fetchFromGitHub, fetchpatch }:
+{ lib, kernel, rtl8189es, fetchFromGitHub }:
 
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
   name = "rtl8189fs-${kernel.version}-${version}";
-  version = "2023-03-27";
+  version = "2024-01-22";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "c223a25b1000d64432eca4201a8f012414dfc7ce";
-    sha256 = "sha256-5b5IshLbWxvmzcKy/xLsqKa3kZpwDQXTQtjqZLHyOCo=";
+    rev = "5d523593f41c0b8d723c6aa86b217ee1d0965786";
+    sha256 = "sha256-pziaUM6XfF4Tt9yfWUnLUiTw+sw6uZrr1HcaXdRQ31E=";
   };
 
   meta = with lib; {
     description = "Driver for Realtek rtl8189fs";
     homepage = "https://github.com/jwrdegoede/rtl8189ES_linux/tree/rtl8189fs";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ puffnfresh ];
   };
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index 32b97b59c52ea..529f16fc1db4f 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -4,15 +4,15 @@ with lib;
 
 let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless/realtek/rtl8192eu";
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20230613";
+  version = "${kernel.version}-4.4.1.20240507";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "f2fc8af7ab58d2123eed1aa4428e713cdfc27976";
-    sha256 = "sha256-OgsxBcXoIP8h9Z0bLsG91/s/+r89Tdn2dPOt4p3sx8k=";
+    rev = "27410641da6926eb1ac565068ff89d35f7496328";
+    sha256 = "sha256-/BztTE3yKw35Oo7KkzHMtD+8qpJNXWiSwR3YjrotR0I=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index be4b954c1b618..d1f7e016e3bf3 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8723ds";
-  version = "${kernel.version}-unstable-2022-12-01";
+  version = "${kernel.version}-unstable-2023-11-14";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtl8723ds";
-    rev = "a638cc8639015b8b9390af3350fab0366b6c87e7";
-    sha256 = "sha256-qfVE7k71NPzw3FwoOaUxH66PnDjbpMAF6CyOyUVdSMA=";
+    rev = "52e593e8c889b68ba58bd51cbdbcad7fe71362e4";
+    sha256 = "sha256-SszvDuWN9opkXyVQAOLjnNtPp93qrKgnGvzK0y7Y9b0=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = {
-    description = "Linux driver for RTL8723DS.";
+    description = "Linux driver for RTL8723DS";
     homepage = "https://github.com/lwfinger/rtl8723ds";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index ed330fc246375..d9fd92c4a9f09 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2024-01-19";
+  version = "${kernel.version}-unstable-2024-03-20";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8812au-20210629";
-    rev = "3b921c0beda8583c1d2d1b0b7e4692d11e7ea772";
-    hash = "sha256-Ji61Y23uGSTyj3Z5ia9iev5rVzSOv7XY/IfAClhz7Q8=";
+    rev = "8be3a1d7acf60f77c5d9c33b690b8d7301bdf127";
+    hash = "sha256-HchnRezJNzimOB72Sv5BwL4oXuxPxloAHVuaL+warj8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 806df9f6dd4d8..9d83d4b4c28a1 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2023-09-10";
+  version = "${kernel.version}-unstable-2024-05-03";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
-    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
+    rev = "3eacc28b721950b51b0249508cc31e6e54988a0c";
+    hash = "sha256-JP7mvwhnKqmkb/B0l4vhc11TBjjUA1Ubzbj/IVEXvBM=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8852au/default.nix b/pkgs/os-specific/linux/rtl8852au/default.nix
index d154fbe86a208..e7b682893f855 100644
--- a/pkgs/os-specific/linux/rtl8852au/default.nix
+++ b/pkgs/os-specific/linux/rtl8852au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8852au";
-  version = "${kernel.version}-unstable-2023-11-24";
+  version = "${kernel.version}-unstable-2024-04-16";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtl8852au";
-    rev = "70bdde265b9ab002daf11d4bea1a42baa8da4325";
-    hash = "sha256-6ARS7/0iKYajpMH+f+jWDxIkPY9ZixJkk864oKom4l4=";
+    rev = "5894bc6fed2bcaa525d13fcee1edada8aba67f2b";
+    hash = "sha256-R4Yb/jbh3nMgM41ByFjtkCMbsh/mmMRJ7CcvCRUvKu8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index edb2feed6c619..91ed7cf9b4905 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, kernel, bc }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  bc,
+}:
 
 stdenv.mkDerivation {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2023-11-29";
+  version = "${kernel.version}-unstable-2024-06-09";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "88x2bu-20210702";
-    rev = "cd2b6cbd9c8fbfebee8a1f28fab8e4434450456c";
-    sha256 = "sha256-t1lLJSEDzY2zvgcKYaxUq/umrlLpxu4+4zWmG8R0Wz4=";
+    rev = "62f3a86a2687fe98bd441e0aff5adf87d95c238a";
+    hash = "sha256-gQWk1nhtT0W2dY5uQitWabBGEDfZpmJAoJg+j2ndO00=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
index 5ef6f7c4edbb7..46ae88abb37d0 100644
--- a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
+++ b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
@@ -18,7 +18,7 @@ kernel.stdenv.mkDerivation {
 
   meta = {
     broken = !kernel.withRust;
-    description = "A basic template for an out-of-tree Linux kernel module written in Rust";
+    description = "Basic template for an out-of-tree Linux kernel module written in Rust";
     homepage = "https://github.com/Rust-for-Linux/rust-out-of-tree-module";
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.blitz ];
diff --git a/pkgs/os-specific/linux/ryzen-smu/default.nix b/pkgs/os-specific/linux/ryzen-smu/default.nix
index 7f899f2c2c90c..87fb02fd08fe2 100644
--- a/pkgs/os-specific/linux/ryzen-smu/default.nix
+++ b/pkgs/os-specific/linux/ryzen-smu/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "A Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
+    description = "Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
     homepage = "https://gitlab.com/leogx9r/ryzen_smu";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ Cryolitia phdyellow ];
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index ef671b2f16c48..1d61f22b33e51 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Adjust power management settings for Ryzen Mobile Processors.";
+    description = "Adjust power management settings for Ryzen Mobile Processors";
     mainProgram = "ryzenadj";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
diff --git a/pkgs/os-specific/linux/sasutils/default.nix b/pkgs/os-specific/linux/sasutils/default.nix
index 64d288117bf4a..797fd4acd0c0a 100644
--- a/pkgs/os-specific/linux/sasutils/default.nix
+++ b/pkgs/os-specific/linux/sasutils/default.nix
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://github.com/stanford-rc/sasutils";
-    description = "A set of command-line tools to ease the administration of Serial Attached SCSI (SAS) fabrics";
+    description = "Set of command-line tools to ease the administration of Serial Attached SCSI (SAS) fabrics";
     license = licenses.asl20;
     maintainers = with maintainers; [ aij ];
   };
diff --git a/pkgs/os-specific/linux/schedtool/default.nix b/pkgs/os-specific/linux/schedtool/default.nix
index d3d009db1714b..0ee35df74449e 100644
--- a/pkgs/os-specific/linux/schedtool/default.nix
+++ b/pkgs/os-specific/linux/schedtool/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     description = "Query or alter a process' scheduling policy under Linux";
     mainProgram = "schedtool";
     homepage = "https://freequaos.host.sk/schedtool/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
   };
diff --git a/pkgs/os-specific/linux/sd-switch/default.nix b/pkgs/os-specific/linux/sd-switch/default.nix
index 7750862c34c2c..b8dfd36d5919c 100644
--- a/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/pkgs/os-specific/linux/sd-switch/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromSourcehut, rustPlatform, pkg-config, dbus }:
+{ lib, fetchFromSourcehut, rustPlatform, nix-update-script }:
 
-let version = "0.3.0";
+let version = "0.5.0";
 in rustPlatform.buildRustPackage {
   pname = "sd-switch";
   inherit version;
@@ -9,18 +9,20 @@ in rustPlatform.buildRustPackage {
     owner = "~rycee";
     repo = "sd-switch";
     rev = version;
-    hash = "sha256-mWrLbCUnoJ3hVtpSU/7dw91U5TLyw5kNchX5nmP9asA=";
+    hash = "sha256-TESS+CwwEugAz+grzndunAoKF9Or/Jl7tftL392fUaM=";
   };
 
-  cargoHash = "sha256-VK+kPX1pGhowbWKkUs1PL0DXIhDXJOFVoIHTtWQcWEs=";
+  cargoHash = "sha256-QEnleFwEIoKATupj0sSV/GUztQoozEsb3SEgnfFzAfw=";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ dbus ];
+  passthru = {
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
-    description = "A systemd unit switcher for Home Manager";
+    description = "Systemd unit switcher for Home Manager";
     mainProgram = "sd-switch";
-    homepage = "https://gitlab.com/rycee/sd-switch";
+    homepage = "https://git.sr.ht/~rycee/sd-switch";
+    changelog = "https://git.sr.ht/~rycee/sd-switch/refs/${version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ rycee ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/sdparm/default.nix b/pkgs/os-specific/linux/sdparm/default.nix
index a9137b18f39d6..2bd1a0946674e 100644
--- a/pkgs/os-specific/linux/sdparm/default.nix
+++ b/pkgs/os-specific/linux/sdparm/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "http://sg.danny.cz/sg/sdparm.html";
-    description = "A utility to access SCSI device parameters";
+    description = "Utility to access SCSI device parameters";
     license = licenses.bsd3;
     platforms = with platforms; linux;
   };
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
index c50f4ffccd0bb..121511401151f 100644
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -44,8 +44,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "SELinux policy core utilities written in Python";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     homepage = "https://selinuxproject.org";
+    maintainers = with lib.maintainers; [ RossComputerGuy ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
index 0d2843d216a46..0b4f0a203b81e 100644
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -53,8 +53,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "SELinux sandbox utility";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "https://selinuxproject.org";
     platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ RossComputerGuy ];
   };
 }
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index 70de3cc6b60c0..126f927007cd8 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "SELinux policy core utilities (packaging additions)";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     inherit (libsepol.meta) homepage platforms;
-    maintainers = [ ];
+    maintainers = with maintainers; [ RossComputerGuy ];
   };
 }
diff --git a/pkgs/os-specific/linux/service-wrapper/default.nix b/pkgs/os-specific/linux/service-wrapper/default.nix
index e7aa3ea9d49d3..08f7d00bc9628 100644
--- a/pkgs/os-specific/linux/service-wrapper/default.nix
+++ b/pkgs/os-specific/linux/service-wrapper/default.nix
@@ -13,7 +13,7 @@ runCommand name {
   };
 
   meta = with lib; {
-    description = "A convenient wrapper for the systemctl commands, borrow from Ubuntu";
+    description = "Convenient wrapper for the systemctl commands, borrow from Ubuntu";
     mainProgram = "service";
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 8e3b0e627d374..5a2f180a0ad96 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -8,13 +8,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4y4Uhh3O84UbK39j8ACu06/6n7lyHsd8MzODR0FOp3I=";
+    hash = "sha256-/6dOzSz2Do4d6TSS50fuak0CysoQ532zJ0bJ532BUCE=";
   };
 
   nativeBuildInputs = [ cython ];
@@ -36,7 +36,7 @@ buildPythonApplication rec {
   meta = {
     description = "SELinux Policy Analysis Tools";
     homepage = "https://github.com/SELinuxProject/setools";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
index c21f8ea8a644b..99e5c4b1a09c1 100644
--- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -16,7 +16,7 @@ let
     find "$out" -mindepth 1 -delete
     cp ${lib.concatStringsSep " " list} "$out/"
   '';
-  headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
+  headers = linkFarmFromDrvs "azure-dcap-client-intel-headers" [
     (fetchFromGitHub rec {
       name = "${repo}-headers";
       owner = "intel";
@@ -69,8 +69,8 @@ stdenv.mkDerivation rec {
     find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \;
 
     substitute src/Linux/Makefile{.in,} \
-      --replace '##CURLINC##' '${curl.dev}/include/curl/' \
-      --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
+      --replace-fail '##CURLINC##' '${curl.dev}/include/curl/' \
+      --replace-fail '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
   '';
 
   env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
@@ -84,11 +84,11 @@ stdenv.mkDerivation rec {
   # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests
   passthru.tests.suite = callPackage ./test-suite.nix { };
 
-  meta = with lib; {
+  meta = {
     description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
     homepage = "https://github.com/microsoft/azure-dcap-client";
-    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
+    maintainers = with lib.maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
-    license = [ licenses.mit ];
+    license = [ lib.licenses.mit ];
   };
 }
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 42e00071d8101..829b0c6525ecc 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -29,11 +29,11 @@ stdenv.mkDerivation rec {
       # Also include the Data Center Attestation Primitives (DCAP) platform
       # enclaves.
       dcap = rec {
-        version = "1.20";
+        version = "1.21";
         filename = "prebuilt_dcap_${version}.tar.gz";
         prebuilt = fetchurl {
           url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-nPsI89KSBA3cSNTMWyktZP5dkf+BwL3NZ4MuUf6G98o=";
+          hash = "sha256-/PPD2MyNxoCwzNljIFcpkFvItXbyvymsJ7+Uf4IyZuk=";
         };
       };
     in
@@ -158,31 +158,31 @@ stdenv.mkDerivation rec {
     # is helpful to have properly patched versions for non-NixOS distributions.
     echo "Fixing aesmd.service"
     substituteInPlace $out/lib/systemd/system/aesmd.service \
-      --replace '@aesm_folder@' \
-                "$out/aesm" \
-      --replace 'Type=forking' \
-                'Type=simple' \
-      --replace "ExecStart=$out/aesm/aesm_service" \
-                "ExecStart=$out/bin/aesm_service --no-daemon"\
-      --replace "/bin/mkdir" \
-                "${coreutils}/bin/mkdir" \
-      --replace "/bin/chown" \
-                "${coreutils}/bin/chown" \
-      --replace "/bin/chmod" \
-                "${coreutils}/bin/chmod" \
-      --replace "/bin/kill" \
-                "${coreutils}/bin/kill"
+      --replace-fail '@aesm_folder@' \
+                     "$out/aesm" \
+      --replace-fail 'Type=forking' \
+                     'Type=simple' \
+      --replace-fail "ExecStart=$out/aesm/aesm_service" \
+                     "ExecStart=$out/bin/aesm_service --no-daemon"\
+      --replace-fail "/bin/mkdir" \
+                     "${coreutils}/bin/mkdir" \
+      --replace-fail "/bin/chown" \
+                     "${coreutils}/bin/chown" \
+      --replace-fail "/bin/chmod" \
+                     "${coreutils}/bin/chmod" \
+      --replace-fail "/bin/kill" \
+                     "${coreutils}/bin/kill"
   '';
 
   passthru.tests = {
     service = nixosTests.aesmd;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Intel SGX Architectural Enclave Service Manager";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ phlip9 veehaitch citadelcore ];
+    maintainers = with lib.maintainers; [ phlip9 veehaitch citadelcore ];
     platforms = [ "x86_64-linux" ];
-    license = with licenses; [ bsd3 ];
+    license = [ lib.licenses.bsd3 ];
   };
 }
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 67489ee3c07c4..4f7374d634f36 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -26,15 +26,15 @@
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   # Version as given in se_version.h
-  version = "2.23.100.2";
+  version = "2.24.100.3";
   # Version as used in the Git tag
-  versionTag = "2.23";
+  versionTag = "2.24";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${versionTag}";
-    hash = "sha256-i+fE6xKiuljG8LY8TIHgrW15DVpdp46bZdNo/BjgT/I=";
+    hash = "sha256-1urEdfMKNUqqyJ3wQ10+tvtlRuAKELpaCWIOzjCbYKw=";
     fetchSubmodules = true;
   };
 
@@ -121,8 +121,6 @@ stdenv.mkDerivation rec {
 
       pushd 'external/ippcp_internal'
 
-      cp -r ${ipp-crypto-no_mitigation}/include/. inc/
-
       install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \
         lib/linux/intel64/no_mitigation/libippcp.a
       install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \
@@ -130,8 +128,13 @@ stdenv.mkDerivation rec {
       install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \
         lib/linux/intel64/cve_2020_0551_cf/libippcp.a
 
+      cp -r ${ipp-crypto-no_mitigation}/include/* inc/
+
+      mkdir inc/ippcp
+      cp ${ipp-crypto-no_mitigation}/include/fips_cert.h inc/ippcp/
+
       rm inc/ippcp.h
-      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp21u7.patch -o inc/ippcp.h
+      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp21u11.patch -o ./inc/ippcp.h
 
       install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE
 
@@ -285,11 +288,11 @@ stdenv.mkDerivation rec {
       '';
     };
 
-  meta = with lib; {
+  meta = {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ phlip9 sbellem arturcygan veehaitch ];
+    maintainers = with lib.maintainers; [ phlip9 sbellem arturcygan veehaitch ];
     platforms = [ "x86_64-linux" ];
-    license = with licenses; [ bsd3 ];
+    license = [ lib.licenses.bsd3 ];
   };
 }
diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
index bdf9b9f9136e9..c045606df144c 100644
--- a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
+++ b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
@@ -1,8 +1,8 @@
 diff --git a/Makefile b/Makefile
-index 32433051..2e480efb 100644
+index 73502a7..f24bd11 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -50,8 +50,8 @@ tips:
+@@ -50,18 +50,18 @@ tips:
  preparation:
  # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
  # Only enable the download from git
@@ -12,8 +12,10 @@ index 32433051..2e480efb 100644
 +	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
  	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
  	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
+-	cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
++	cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
  	./external/sgx-emm/create_symlink.sh
-@@ -59,8 +59,8 @@ preparation:
+ 	cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R
  	cd external/cbor && cp -r libcbor sgx_libcbor
  	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
  	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
index c72a0c5285164..eba9e7f6a0e5c 100644
--- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -8,16 +8,20 @@
 }:
 gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
-  version = "2021.10.0";
+  version = "2021.11.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipp-crypto";
     rev = "ippcp_${version}";
-    hash = "sha256-DfXsJ+4XqyjCD+79LUD53Cx8D46o1a4fAZa2UxGI1Xg=";
+    hash = "sha256-OgNrrPE8jFVD/hcv7A43Bno96r4Z/lb7/SE6TEL7RDI=";
   };
 
-  cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
+  cmakeFlags = [
+    "-DARCH=intel64"
+    # sgx-sdk now requires FIPS-compliance mode turned on
+    "-DIPPCP_FIPS_MODE=on"
+  ] ++ extraCmakeFlags;
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix
index 94d7e20b21c41..73cde2e030af4 100644
--- a/pkgs/os-specific/linux/sgx/ssl/default.nix
+++ b/pkgs/os-specific/linux/sgx/ssl/default.nix
@@ -10,7 +10,7 @@
 }:
 let
   sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "3.0.12";
+  opensslVersion = "3.0.13";
 in
 stdenv.mkDerivation {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     let
       opensslSourceArchive = fetchurl {
         url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
+        hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
       };
     in
     ''
@@ -39,8 +39,8 @@ stdenv.mkDerivation {
 
     # Skip the tests. Build and run separately (see below).
     substituteInPlace Linux/sgx/Makefile \
-      --replace '$(MAKE) -C $(TEST_DIR) all' \
-                'bash -c "true"'
+      --replace-fail '$(MAKE) -C $(TEST_DIR) all' \
+                     'bash -c "true"'
   '';
 
   nativeBuildInputs = [
@@ -71,11 +71,11 @@ stdenv.mkDerivation {
     SIM = callPackage ./tests.nix { sgxMode = "SIM"; inherit opensslVersion; };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
     homepage = "https://github.com/intel/intel-sgx-ssl";
-    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
+    maintainers = with lib.maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
-    license = [ licenses.bsd3 licenses.openssl ];
+    license = with lib.licenses; [ bsd3 openssl ];
   };
 }
diff --git a/pkgs/os-specific/linux/shufflecake/default.nix b/pkgs/os-specific/linux/shufflecake/default.nix
index 8e1330e567895..01c634cc4bfd3 100644
--- a/pkgs/os-specific/linux/shufflecake/default.nix
+++ b/pkgs/os-specific/linux/shufflecake/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = with lib; {
-    description = "A plausible deniability (hidden storage) layer for Linux";
+    description = "Plausible deniability (hidden storage) layer for Linux";
     homepage = "https://shufflecake.net";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ oluceps ];
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index 3bf73a8f495e1..680e1ae2771c2 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   ;
 
   meta = with lib; {
-    description = "A very minimal Linux init implementation from suckless.org";
+    description = "Very minimal Linux init implementation from suckless.org";
     mainProgram = "sinit";
     license = licenses.mit;
     maintainers = with maintainers; [ raskin ];
diff --git a/pkgs/os-specific/linux/smem/default.nix b/pkgs/os-specific/linux/smem/default.nix
index 6308b83b600a2..bfeb5902a4232 100644
--- a/pkgs/os-specific/linux/smem/default.nix
+++ b/pkgs/os-specific/linux/smem/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.selenic.com/smem/";
-    description = "A memory usage reporting tool that takes shared memory into account";
+    description = "Memory usage reporting tool that takes shared memory into account";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.eelco ];
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix
index 05ad1ddb03351..a6cdaf978c663 100644
--- a/pkgs/os-specific/linux/smemstat/default.nix
+++ b/pkgs/os-specific/linux/smemstat/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "Memory usage monitoring tool";
     mainProgram = "smemstat";
     homepage = "https://github.com/ColinIanKing/smemstat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
   };
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 4f27c7e83fb5d..b3395c7a4ceae 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -3,33 +3,25 @@
   python3, pam, popt, talloc, tdb, tevent, pkg-config, ldb, openldap,
   pcre2, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
   libuuid, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
-  nss_wrapper, ncurses, Po4a, http-parser, jansson, jose,
-  docbook_xsl, docbook_xml_dtd_44,
-  testers, nix-update-script, nixosTests, fetchpatch,
+  nss_wrapper, ncurses, Po4a, jansson, jose,
+  docbook_xsl, docbook_xml_dtd_45,
+  testers, nix-update-script, nixosTests,
   withSudo ? false }:
 
 let
-  docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
+  docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = "sssd";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-VJXZndbmC6mAVxzvv5Wjb4adrQkP16Rt4cgjl4qGDIc=";
+    hash = "sha256-wr6qFgM5XN3aizYVquj0xF+mVRgrkLWWhA3/gQOK8hQ=";
   };
 
-  patches = [
-    # Fix the build with Samba 4.20
-    (fetchpatch {
-      url = "https://github.com/SSSD/sssd/commit/1bf51929a48b84d62ac54f2a42f17e7fbffe1612.patch";
-      hash = "sha256-VLx04APEipp860iOJNIwTGywxZ7rIDdyh3te6m7Ymlo=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./sbus_generate.sh.in
   '';
@@ -74,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
                   talloc tdb tevent ldb pam openldap pcre2 libkrb5
                   cifs-utils glib keyutils dbus fakeroot libxslt libxml2
                   libuuid python3.pkgs.python-ldap systemd nspr check cmocka uid_wrapper
-                  nss_wrapper ncurses Po4a http-parser jansson jose ];
+                  nss_wrapper ncurses Po4a jansson jose ];
 
   makeFlags = [
     "SGML_CATALOG_FILES=${docbookFiles}"
diff --git a/pkgs/os-specific/linux/statifier/default.nix b/pkgs/os-specific/linux/statifier/default.nix
index 6aa11cad4f250..9c00cdab40164 100644
--- a/pkgs/os-specific/linux/statifier/default.nix
+++ b/pkgs/os-specific/linux/statifier/default.nix
@@ -20,6 +20,6 @@ multiStdenv.mkDerivation rec {
     description = "Tool for creating static Linux binaries";
     mainProgram = "statifier";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/swapview/default.nix b/pkgs/os-specific/linux/swapview/default.nix
index 3ef2426fad937..2cfc8e57c053c 100644
--- a/pkgs/os-specific/linux/swapview/default.nix
+++ b/pkgs/os-specific/linux/swapview/default.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "03yi6bsjjnl8hznxr1nrnxx5lrqb574625j2lkxqbl9vrg9mswdz";
 
   meta = with lib; {
-    description = "A simple program to view processes' swap usage on Linux";
+    description = "Simple program to view processes' swap usage on Linux";
     mainProgram = "swapview";
     homepage = "https://github.com/lilydjwg/swapview";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/sydbox/default.nix b/pkgs/os-specific/linux/sydbox/default.nix
index bdaf77147f2ee..7bcb0c565974c 100644
--- a/pkgs/os-specific/linux/sydbox/default.nix
+++ b/pkgs/os-specific/linux/sydbox/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://sydbox.exherbo.org/";
     description = "seccomp-based application sandbox";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mvs ];
   };
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 25b788104a4c0..ff149e771bcbf 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,11 +3,11 @@
 , protobuf, grpc, yaml-cpp, nlohmann_json, re2, zstd, uthash }:
 
 let
-  # Compare with https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/falcosecurity-libs.cmake
-  libsRev = "0.15.1";
-  libsHash = "sha256-CsKa5ybRj7Mjb71xNwd8FtDprOMfpJMrm3mvkeqZE3o=";
+  # Compare with https://github.com/draios/sysdig/blob/0.37.1/cmake/modules/falcosecurity-libs.cmake
+  libsRev = "0.16.0";
+  libsHash = "sha256-aduO2pLj91tRdZ1dW1F1JFEg//SopialXWPd6Oav/u8=";
 
-  # Compare with https://github.com/falcosecurity/libs/blob/0.15.1/cmake/modules/valijson.cmake
+  # Compare with https://github.com/falcosecurity/libs/blob/0.16.0/cmake/modules/valijson.cmake
   valijson = fetchFromGitHub {
     owner = "tristanpenman";
     repo = "valijson";
@@ -15,22 +15,24 @@ let
     hash = "sha256-wvFdjsDtKH7CpbEpQjzWtLC4RVOU9+D2rSK0Xo1cJqo=";
   };
 
-  # https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/driver.cmake
+  # https://github.com/draios/sysdig/blob/0.37.1/cmake/modules/driver.cmake
   driver = fetchFromGitHub {
     owner = "falcosecurity";
     repo = "libs";
-    rev = "7.0.0+driver";
-    hash = "sha256-kXqvfM7HbGh2wEGaO4KBkFDW+m5gpOShJZKJLu9McKk=";
+    rev = "7.1.0+driver";
+    hash = "sha256-FIlnJsNgofGo4HETEEpW28wpC3U9z5AZprwFR5AgFfA=";
   };
-in stdenv.mkDerivation rec {
+
+  version = "0.37.1";
+in stdenv.mkDerivation {
   pname = "sysdig";
-  version = "0.36.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    hash = "sha256-EQnmtxByTsSawQPFmTe2pBMcv5rFaNtST+2KXZSFuoo=";
+    hash = "sha256-V1rvQ6ZznL9UiUFW2lyW6gvdoGttOd5kgT2KPQCjmvQ=";
   };
 
   nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
@@ -73,12 +75,6 @@ in stdenv.mkDerivation rec {
     cp -r ${driver} driver-src
     chmod -R +w driver-src
 
-    # Hacky but needed until https://github.com/draios/sysdig/issues/2077 is resolved for kernel >= 6.8 as strlcpy got removed and build fails
-    ${lib.optionalString
-    (kernel != null && lib.versionAtLeast kernel.version "6.8") ''
-      substituteInPlace libs/driver/ppm_events.c driver-src/driver/ppm_events.c --replace-fail "strlcpy" "strscpy"
-    ''}
-
     cmakeFlagsArray+=(
       "-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs"
       "-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver"
@@ -98,8 +94,6 @@ in stdenv.mkDerivation rec {
   ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   env.NIX_CFLAGS_COMPILE =
-    # needed since luajit-2.1.0-beta3
-    "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
     # fix compiler warnings been treated as errors
     "-Wno-error";
 
@@ -138,13 +132,13 @@ in stdenv.mkDerivation rec {
     fi
   '';
 
-  meta = with lib; {
+  meta = {
     description =
       "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
-    license = with licenses; [ asl20 gpl2 mit ];
-    maintainers = [ maintainers.raskin ];
-    platforms = [ "x86_64-linux" ] ++ platforms.darwin;
-    broken = kernel != null && ((versionOlder kernel.version "4.14") || kernel.isHardened || kernel.isZen);
+    license = with lib.licenses; [ asl20 gpl2Only mit ];
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = [ "x86_64-linux" ] ++ lib.platforms.darwin;
+    broken = kernel != null && ((lib.versionOlder kernel.version "4.14") || kernel.isHardened || kernel.isZen);
     homepage = "https://sysdig.com/opensource/";
     downloadPage = "https://github.com/draios/sysdig/releases";
   };
diff --git a/pkgs/os-specific/linux/sysfsutils/default.nix b/pkgs/os-specific/linux/sysfsutils/default.nix
index 113ba7939a65a..b0fd24c066b32 100644
--- a/pkgs/os-specific/linux/sysfsutils/default.nix
+++ b/pkgs/os-specific/linux/sysfsutils/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
         filesystem in Linux kernel versions 2.5+ that exposes a system's
         device tree.
       '';
-    license = with lib.licenses; [ gpl2 lgpl21 ];
+    license = with lib.licenses; [ gpl2Plus lgpl21 ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index 048d82b5a530c..cfccba6fb542c 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
   preInstall = "mkdir -p $out/share/man/man5/ $out/share/man/man8/ $out/sbin";
 
   meta = with lib; {
-    description = "A system logging daemon";
+    description = "System logging daemon";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index f5153eb5abc98..c1424d01f878d 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,11 +1,14 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromRepoOrCz
+, gnu-efi
 , fetchurl
+, fetchpatch
 , libuuid
 , makeWrapper
 , mtools
 , nasm
+, nixosTests
 , perl
 , python3
 }:
@@ -16,11 +19,10 @@ stdenv.mkDerivation {
 
   # This is syslinux-6.04-pre3^1; syslinux-6.04-pre3 fails to run.
   # Same issue here https://www.syslinux.org/archives/2019-February/026330.html
-  src = fetchgit {
-    url = "https://repo.or.cz/syslinux";
+  src = fetchFromRepoOrCz {
+    repo = "syslinux";
     rev = "b40487005223a78c3bb4c300ef6c436b3f6ec1f7";
-    sha256 = "sha256-GqvRTr9mA2yRD0G0CF11x1X0jCgqV4Mh+tvE0/0yjqk=";
-    fetchSubmodules = true;
+    hash = "sha256-XNC+X7UYxdMQQAg4MLACQLxRNnI5/ZCOiCJrEkKgPeM=";
   };
 
   patches = let
@@ -65,19 +67,19 @@ stdenv.mkDerivation {
       "0018-prevent-pow-optimization.patch"
       "26f0e7b2"
       "sha256-dVzXBi/oSV9vYgU85mRFHBKuZdup+1x1BipJX74ED7E=")
+    # Fixes build with "modern" gnu-efi
+    ./import-efisetjmp.patch
+    # Upstream patch: https://www.syslinux.org/archives/2024-February/026903.html
+    ./define-wchar_t.patch
   ];
 
   postPatch = ''
-    substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
-    substituteInPlace utils/ppmtolss16 --replace /usr/bin/perl $(type -P perl)
+    substituteInPlace Makefile --replace-fail /bin/pwd $(type -P pwd)
+    substituteInPlace utils/ppmtolss16 --replace-fail /usr/bin/perl $(type -P perl)
 
     # fix tests
     substituteInPlace tests/unittest/include/unittest/unittest.h \
-      --replace /usr/include/ ""
-
-    # Hack to get `gcc -m32' to work without having 32-bit Glibc headers.
-    mkdir gnu-efi/inc/ia32/gnu
-    touch gnu-efi/inc/ia32/gnu/stubs-32.h
+      --replace-fail /usr/include/ ""
   '';
 
   nativeBuildInputs = [
@@ -89,6 +91,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     libuuid
+    gnu-efi
   ];
 
   # Fails very rarely with 'No rule to make target: ...'
@@ -111,8 +114,22 @@ stdenv.mkDerivation {
     "MANDIR=$(out)/share/man"
     "PERL=perl"
     "HEXDATE=0x00000000"
+    # Works around confusing (unrelated) error messages when upx is not made available
+    "UPX=false"
+
+    # Configurations needed to make use of external gnu-efi
+    "LIBEFI=${gnu-efi}/lib/libefi.a"
+    "LIBDIR=${gnu-efi}/lib/"
+    "EFIINC=${gnu-efi}/include/efi"
+
+    # Legacy bios boot target is always built
+    "bios"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isi686 [ "bios" "efi32" ];
+  # Build "ia32" EFI for i686
+  ++ lib.optional stdenv.hostPlatform.isi686 "efi32"
+  # Build "x86_64" EFI for x86_64
+  ++ lib.optional stdenv.hostPlatform.isx86_64 "efi64"
+  ;
 
   # Some tests require qemu, some others fail in a sandboxed environment
   doCheck = false;
@@ -125,11 +142,13 @@ stdenv.mkDerivation {
     rm -rf $out/share/syslinux/com32
   '';
 
+  passthru.tests.biosCdrom = nixosTests.boot.biosCdrom;
+
   meta = with lib; {
-    homepage = "http://www.syslinux.org/";
-    description = "A lightweight bootloader";
+    homepage = "https://www.syslinux.org/";
+    description = "Lightweight bootloader";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.samueldr ];
+    maintainers = [ ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/syslinux/define-wchar_t.patch b/pkgs/os-specific/linux/syslinux/define-wchar_t.patch
new file mode 100644
index 0000000000000..92baf101fb413
--- /dev/null
+++ b/pkgs/os-specific/linux/syslinux/define-wchar_t.patch
@@ -0,0 +1,11 @@
+diff --git a/com32/include/stddef.h b/com32/include/stddef.h
+index f52d62f3..437b11f2 100644
+--- a/com32/include/stddef.h
++++ b/com32/include/stddef.h
+@@ -29,4 +29,6 @@
+  */
+ #define container_of(p, c, m) ((c *)((char *)(p) - offsetof(c,m)))
+ 
++typedef short wchar_t;
++
+ #endif /* _STDDEF_H */
diff --git a/pkgs/os-specific/linux/syslinux/import-efisetjmp.patch b/pkgs/os-specific/linux/syslinux/import-efisetjmp.patch
new file mode 100644
index 0000000000000..6d1744fc4340d
--- /dev/null
+++ b/pkgs/os-specific/linux/syslinux/import-efisetjmp.patch
@@ -0,0 +1,22 @@
+From 68defee52f4eba82eefaeea17f21c7498448dd6b Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Mon, 3 Jun 2024 16:16:25 -0400
+Subject: [PATCH] efi/efi.h: Add efisetjmp.h
+
+See https://github.com/ncroxon/gnu-efi/commit/486ba3c3bdd147b7d98159b9e650be60bce0f027
+---
+ efi/efi.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/efi/efi.h b/efi/efi.h
+index c266532f3..e4497574b 100644
+--- a/efi/efi.h
++++ b/efi/efi.h
+@@ -23,6 +23,7 @@
+ #include <efi.h>
+ #include <efilib.h>
+ #include <efistdarg.h>
++#include <efisetjmp.h>
+ 
+ /* Delay for 100 ms */
+ #define EFI_NOMAP_PRINT_DELAY	100
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index 303935d8adb44..67e0770490781 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://sebastien.godard.pagesperso-orange.fr/";
-    description = "A collection of performance monitoring tools for Linux (such as sar, iostat and pidstat)";
+    description = "Collection of performance monitoring tools for Linux (such as sar, iostat and pidstat)";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.eelco ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9cdc5dcd9d44d..68209a4e2ccbc 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , pkgsCross
 , fetchFromGitHub
-, fetchpatch
 , fetchzip
 , buildPackages
 , makeBinaryWrapper
@@ -180,7 +179,7 @@ assert withBootloader -> withEfi;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "255.4";
+  version = "255.6";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -198,7 +197,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-P1mKq+ythrv8MU7y2CuNtEx6qCDacugzfsPRZL+NPys=";
+    hash = "sha256-ah0678iNfy0c5NhHhjn0roY6RoM8OE0hWyEt+qEGKRQ=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -229,15 +228,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-meson.build-do-not-create-systemdstatedir.patch
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
-  ] ++ lib.optional (stdenv.hostPlatform.isPower || stdenv.hostPlatform.isRiscV || stdenv.hostPlatform.isMips) [
-    # Fixed upstream and included in the main and stable branches. Can be dropped
-    # when bumping to >= v255.5.
-    # https://github.com/systemd/systemd/issues/30448
-    # https://github.com/NixOS/nixpkgs/pull/282607
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/8040fa55a1cbc34dede3205a902095ecd26c21e3.patch";
-      sha256 = "0c6z7bsndbkb8m130jnjpsl138sfv3q171726n5vkyl2n9ihnavk";
-    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -417,6 +407,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   outputs = [ "out" "dev" ] ++ (lib.optional (!buildLibsOnly) "man");
+  separateDebugInfo = true;
 
   hardeningDisable = [
     # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523
@@ -510,6 +501,12 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "default-hierarchy" "unified")
     (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
 
+    # Attempts to check /usr/sbin and that fails in macOS sandbox because
+    # permission is denied. If /usr/sbin is not a symlink, it defaults to true.
+    # We set it to false since stdenv moves sbin/* to bin and creates a symlink,
+    # that is, we do not have split bin.
+    (lib.mesonOption "split-bin" "false")
+
     # D-Bus
     (lib.mesonOption "dbuspolicydir" "${placeholder "out"}/share/dbus-1/system.d")
     (lib.mesonOption "dbussessionservicedir" "${placeholder "out"}/share/dbus-1/services")
@@ -562,7 +559,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "zlib" withCompression)
 
     # NSS
-    (lib.mesonEnable "nss-mymachines" withNss)
+    (lib.mesonEnable "nss-mymachines" (withNss && withMachined))
     (lib.mesonEnable "nss-resolve" withNss)
     (lib.mesonBool "nss-myhostname" withNss)
     (lib.mesonBool "nss-systemd" withNss)
@@ -574,7 +571,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # FIDO2
     (lib.mesonEnable "libfido2" withFido2)
-    (lib.mesonEnable "openssl" withFido2)
+    (lib.mesonEnable "openssl" (withHomed || withFido2 || withSysupdate))
 
     # Password Quality
     (lib.mesonEnable "pwquality" withPasswordQuality)
@@ -599,6 +596,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "libiptc" withIptables)
     (lib.mesonEnable "repart" withRepart)
     (lib.mesonEnable "sysupdate" withSysupdate)
+    (lib.mesonEnable "seccomp" withLibseccomp)
     (lib.mesonEnable "selinux" withSelinux)
     (lib.mesonEnable "tpm2" withTpm2Tss)
     (lib.mesonEnable "pcre2" withPCRE2)
@@ -823,6 +821,9 @@ stdenv.mkDerivation (finalAttrs: {
       substituteInPlace $i --replace /bin/false ${coreutils}/bin/false
     done
 
+    # For compatibility with dependents that use sbin instead of bin.
+    ln -s bin "$out/sbin"
+
     rm -rf $out/etc/rpm
   '' + lib.optionalString (!withKernelInstall) ''
     # "kernel-install" shouldn't be used on NixOS.
@@ -893,7 +894,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.freedesktop.org/wiki/Software/systemd/";
-    description = "A system and service manager for Linux";
+    description = "System and service manager for Linux";
     longDescription = ''
       systemd is a suite of basic building blocks for a Linux system. It
       provides a system and service manager that runs as PID 1 and starts the
@@ -925,8 +926,9 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ flokli kloenk ];
     platforms = lib.platforms.linux;
     priority = 10;
-    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
-    # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
-    broken = stdenv.hostPlatform.isStatic;
+    badPlatforms = [
+      # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
+      lib.systems.inspect.platformPatterns.isStatic
+    ];
   };
 })
diff --git a/pkgs/os-specific/linux/targetcli/default.nix b/pkgs/os-specific/linux/targetcli/default.nix
index 6058b3509772a..d5594a89a5620 100644
--- a/pkgs/os-specific/linux/targetcli/default.nix
+++ b/pkgs/os-specific/linux/targetcli/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3, fetchFromGitHub, nixosTests }:
+{ lib, python3, fetchFromGitHub, nixosTests, wrapGAppsNoGuiHook, gobject-introspection, glib }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "targetcli";
@@ -11,7 +11,10 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-9QYo7jGk9iWr26j0qPQCqYsJ+vLXAsO4Xs7+7VT9/yc=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [ configshell rtslib ];
+  nativeBuildInputs = [ wrapGAppsNoGuiHook gobject-introspection ];
+  buildInputs = [ glib ];
+
+  propagatedBuildInputs = with python3.pkgs; [ configshell rtslib pygobject3 ];
 
   postInstall = ''
     install -D targetcli.8 -t $out/share/man/man8/
@@ -23,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    description = "A command shell for managing the Linux LIO kernel target";
+    description = "Command shell for managing the Linux LIO kernel target";
     homepage = "https://github.com/open-iscsi/targetcli-fb";
     license = licenses.asl20;
     maintainers = lib.teams.helsinki-systems.members;
diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix
index 5805a400c1e25..31baf57a4eba8 100644
--- a/pkgs/os-specific/linux/tbs/default.nix
+++ b/pkgs/os-specific/linux/tbs/default.nix
@@ -5,22 +5,22 @@ let
     name = repo;
     owner = "tbsdtv";
     repo = "linux_media";
-    rev = "d0a7e44358f28064697e0eed309db03166dcd83b";
-    hash = "sha256-BTHlnta5qv2bdPjD2bButwYGpwR/bq99/AUoZqTHHYw=";
+    rev = "d8d1ff33c0c47e34fe3e860b52b4d6c457520866";
+    hash = "sha256-1Z9itZ5GFpfUeRtp5xTnS+I91LUZLDhsEcF2v8ThaCs=";
   };
 
   build = fetchFromGitHub rec {
     name = repo;
     owner = "tbsdtv";
     repo = "media_build";
-    rev = "88764363a3e3d36b3c59a0a2bf2244e262035d47";
-    hash = "sha256-LFTxYVPudflxqYTSBIDNkTrGs09MOuYBXwpGYqWfEFQ=";
+    rev = "8cd12a6e90999f3a341018812a5d66d7e6b30913";
+    hash = "sha256-+I0NrML54ni37qgDHbRUQiLmmw/UZgXmoFoiDNDeH5A=";
   };
 
 in
 stdenv.mkDerivation {
   pname = "tbs";
-  version = "20231210-${kernel.version}";
+  version = "20240506-${kernel.version}";
 
   srcs = [ media build ];
   sourceRoot = build.name;
@@ -63,9 +63,9 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://www.tbsdtv.com/";
     description = "Linux driver for TBSDTV cards";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ ck3d ];
     priority = -1;
-    broken = kernel.kernelOlder "4.14" || kernel.kernelAtLeast "6.6";
+    broken = kernel.kernelOlder "4.14" || kernel.kernelAtLeast "6.9";
   };
 }
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index a26602b6b44cb..919df3bbedfcd 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Performance monitoring tool for Linux";
     homepage = "http://tiptop.gforge.inria.fr";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ ];
   };
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 600655c447f7d..d93eeaff27232 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -18,7 +18,7 @@
 , glib
 , gobject-introspection
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
   # needs pkg_resources
 , withDoc ? false
 , sphinx
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ lib.optionals withDoc [
     sphinx
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
   checkPhase = "ctest --force-new-ctest-process -E gstreamer";
 
-  # wrapGAppsHook: make sure we add ourselves to the introspection
+  # wrapGAppsHook3: make sure we add ourselves to the introspection
   # and gstreamer paths.
   GI_TYPELIB_PATH = "${placeholder "out"}/lib/girepository-1.0";
   GST_PLUGIN_SYSTEM_PATH_1_0 = "${placeholder "out"}/lib/gstreamer-1.0";
@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "The Linux sources and UVC firmwares for The Imaging Source cameras";
+    description = "Linux sources and UVC firmwares for The Imaging Source cameras";
     homepage = "https://github.com/TheImagingSource/tiscamera";
     license = with licenses; [ asl20 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index a80724f19eb5a..c4222cfc3a245 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     description = "Monitoring and Testing Tool for Linux kernel thermal subsystem";
     mainProgram = "tmon";
     homepage = "https://www.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index d9c5921d46551..b0f760e3b00ad 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "IBM ThinkPad hardware functions driver";
     homepage = "https://github.com/linux-thinkpad/tp_smapi";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     maintainers = [ ];
     # driver is only ment for linux thinkpads i think  bellow platforms should cover it.
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 1eda219013da6..211e03637d4ee 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,22 +1,22 @@
-{ lib, mkDerivation, fetchzip, qtbase, cmake, asciidoc
+{ lib, stdenv, fetchzip, qtbase, qtscxml, cmake, asciidoc
 , docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
-, libtraceevent, libtracefs, freefont_ttf
+, libtraceevent, libtracefs, freefont_ttf, wrapQtAppsHook, qtwayland
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kernelshark";
-  version = "2.2.1";
+  version = "2.3.1";
 
   src = fetchzip {
-    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/snapshot/kernelshark-v${version}.tar.gz";
-    hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0=";
+    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/snapshot/kernelshark-v${finalAttrs.version}.tar.gz";
+    hash = "sha256-KV8ahV2koX7OL1C42H5If14e7m54jv0DlZ1dNsVRUWE=";
   };
 
   outputs = [ "out" ];
 
-  nativeBuildInputs = [ pkg-config cmake ];
+  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
 
-  buildInputs = [ qtbase json_c mesa_glu freeglut libtraceevent libtracefs trace-cmd ];
+  buildInputs = [ qtbase qtscxml qtwayland json_c mesa_glu freeglut libtraceevent libtracefs trace-cmd ];
 
   cmakeFlags = [
     "-D_INSTALL_PREFIX=${placeholder "out"}"
@@ -28,8 +28,8 @@ mkDerivation rec {
   meta = with lib; {
     description = "GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem";
     homepage    = "https://kernelshark.org/";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Only;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ basvandijk ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index 370620eef2527..a3e795c8ea02e 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with lib; {
-    description = "A Linux System call fuzz tester";
+    description = "Linux System call fuzz tester";
     mainProgram = "trinity";
     homepage = "https://github.com/kernelslacker/trinity";
     license = licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index b57169369ca72..634680dc318c2 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -9,7 +9,7 @@
 , gtk3
 , python-linux-procfs
 , python-ethtool
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     glib.dev
     gobject-introspection
     gtk3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pygobject3 python-linux-procfs python-ethtool ];
@@ -57,6 +57,5 @@ buildPythonApplication rec {
     homepage = "https://git.kernel.org/pub/scm/utils/tuna/tuna.git";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ elohmeier ];
   };
 }
diff --git a/pkgs/os-specific/linux/tunctl/default.nix b/pkgs/os-specific/linux/tunctl/default.nix
index 5e7fea75b6ab8..40d1aa572487a 100644
--- a/pkgs/os-specific/linux/tunctl/default.nix
+++ b/pkgs/os-specific/linux/tunctl/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     homepage = "https://tunctl.sourceforge.net/";
     description = "Utility to set up and maintain TUN/TAP network interfaces";
     mainProgram = "tunctl";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/turbostat/default.nix b/pkgs/os-specific/linux/turbostat/default.nix
index 4c51bca386d24..92aafcfe173f6 100644
--- a/pkgs/os-specific/linux/turbostat/default.nix
+++ b/pkgs/os-specific/linux/turbostat/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     description = "Report processor frequency and idle statistics";
     mainProgram = "turbostat";
     homepage = "https://www.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 11b2ed28fb3f6..51a342aa5e92e 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
+    description = "Daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
     homepage = "https://www.freedesktop.org/wiki/Software/udisks/";
     license = with licenses; [ lgpl2Plus gpl2Plus ]; # lgpl2Plus for the library, gpl2Plus for the tools & daemon
     maintainers = teams.freedesktop.members ++ (with maintainers; [ johnazoidberg ]);
diff --git a/pkgs/os-specific/linux/uhk-agent/default.nix b/pkgs/os-specific/linux/uhk-agent/default.nix
index 0d6b3ccd515ca..553e471faaffa 100644
--- a/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -12,12 +12,12 @@
 
 let
   pname = "uhk-agent";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-yx5hOmb1la+vNh8x0PM3edcMn4ojdwzNmGBUg/BH7wE=";
+    sha256 = "sha256-5VzUSuq+yc8HXSILMg24w/hbwasf4jq0H0wte9Mw+nY=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/os-specific/linux/ulogd/default.nix b/pkgs/os-specific/linux/ulogd/default.nix
index 533db8f19c84a..291876cc92d24 100644
--- a/pkgs/os-specific/linux/ulogd/default.nix
+++ b/pkgs/os-specific/linux/ulogd/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://www.netfilter.org/projects/ulogd/index.html";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ p-h ];
   };
diff --git a/pkgs/os-specific/linux/undervolt/default.nix b/pkgs/os-specific/linux/undervolt/default.nix
index d720031eb8ac3..045667c3e3a44 100644
--- a/pkgs/os-specific/linux/undervolt/default.nix
+++ b/pkgs/os-specific/linux/undervolt/default.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://github.com/georgewhewell/undervolt/";
-    description = "A program for undervolting Intel CPUs on Linux";
+    description = "Program for undervolting Intel CPUs on Linux";
     mainProgram = "undervolt";
 
     longDescription = ''
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
       voltage offset to one of 5 voltage planes, and override your systems temperature
       target (CPU will throttle when this temperature is reached).
     '';
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/untie/default.nix b/pkgs/os-specific/linux/untie/default.nix
index 7d96631deb868..356416832cc9a 100644
--- a/pkgs/os-specific/linux/untie/default.nix
+++ b/pkgs/os-specific/linux/untie/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
-    description = "A tool to run processes untied from some of the namespaces";
+    description = "Tool to run processes untied from some of the namespaces";
     mainProgram = "untie";
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 8a1d79a9d7bdd..4ee907fe5a995 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -210,7 +210,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     homepage = "https://upower.freedesktop.org/";
     changelog = "https://gitlab.freedesktop.org/upower/upower/-/blob/v${finalAttrs.version}/NEWS";
-    description = "A D-Bus service for power management";
+    description = "D-Bus service for power management";
     mainProgram = "upower";
     maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index e43ee0b421dc5..139d6b63d8dcd 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   passthru.tests = nixosTests.usbguard;
 
   meta = with lib; {
-    description = "The USBGuard software framework helps to protect your computer against BadUSB";
+    description = "USBGuard software framework helps to protect your computer against BadUSB";
     longDescription = ''
       USBGuard is a software framework for implementing USB device authorization
       policies (what kind of USB devices are authorized) as well as method of
diff --git a/pkgs/os-specific/linux/usbip/default.nix b/pkgs/os-specific/linux/usbip/default.nix
index b91f55dcd2fbb..adaaab868b78a 100644
--- a/pkgs/os-specific/linux/usbip/default.nix
+++ b/pkgs/os-specific/linux/usbip/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, kernel, udev, autoconf, automake, libtool, hwdata, kernelOlder }:
+{ lib, stdenv, kernel, udev, autoconf, automake, libtool, hwdata, kernelOlder }:
 
 stdenv.mkDerivation {
   name = "usbip-${kernel.name}";
diff --git a/pkgs/os-specific/linux/usbtop/default.nix b/pkgs/os-specific/linux/usbtop/default.nix
index ba97cae68bd0d..587d82d9e7ebc 100644
--- a/pkgs/os-specific/linux/usbtop/default.nix
+++ b/pkgs/os-specific/linux/usbtop/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/aguinet/usbtop";
-    description = "A top utility that shows an estimated instantaneous bandwidth on USB buses and devices";
+    description = "Top utility that shows an estimated instantaneous bandwidth on USB buses and devices";
     mainProgram = "usbtop";
     maintainers = with maintainers; [ ];
     license = licenses.bsd3;
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 73135da548edc..883e927444bee 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://github.com/tom5760/usermount";
-    description = "A simple tool to automatically mount removable drives using UDisks2 and D-Bus";
+    description = "Simple tool to automatically mount removable drives using UDisks2 and D-Bus";
     mainProgram = "usermount";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index ba989b41a6cac..e393bf1ac08e6 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.39.3";
+  version = "2.39.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-e2YF5I0aSfQ8xLTPxZ8xPQ3VQC+kC5aBC9Vy4Wff7Q8=";
+    hash = "sha256-bE+HI9r9QcOdk+y/FlCfyIwzzVvTJ3iArlodl6AU/Q4=";
   };
 
   patches = [
@@ -109,6 +109,9 @@ stdenv.mkDerivation rec {
     ln -svf "$swap/bin/"* $bin/bin/
     '' + ''
 
+    ln -svf "$bin/bin/hexdump" "$bin/bin/hd"
+    ln -svf "$man/share/man/man1/hexdump.1" "$man/share/man/man1/hd.1"
+
     installShellCompletion --bash bash-completion/*
   '';
 
@@ -123,7 +126,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
-    description = "A set of system utilities for Linux";
+    description = "Set of system utilities for Linux";
     changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
     # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
     license = with licenses; [ gpl2Only gpl2Plus gpl3Plus lgpl21Plus bsd3 bsdOriginalUC publicDomain ];
diff --git a/pkgs/os-specific/linux/uvcdynctrl/default.nix b/pkgs/os-specific/linux/uvcdynctrl/default.nix
index 8fa91e158e1c8..c8e3fc385fdf5 100644
--- a/pkgs/os-specific/linux/uvcdynctrl/default.nix
+++ b/pkgs/os-specific/linux/uvcdynctrl/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "A simple interface for devices supported by the linux UVC driver";
+    description = "Simple interface for devices supported by the linux UVC driver";
     homepage = "https://guvcview.sourceforge.net";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.puffnfresh ];
diff --git a/pkgs/os-specific/linux/v4l2-relayd/default.nix b/pkgs/os-specific/linux/v4l2-relayd/default.nix
index 77d7034b863be..c1d48f3094095 100644
--- a/pkgs/os-specific/linux/v4l2-relayd/default.nix
+++ b/pkgs/os-specific/linux/v4l2-relayd/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     description = "Streaming relay for v4l2loopback using GStreamer";
     mainProgram = "v4l2-relayd";
     homepage = "https://git.launchpad.net/v4l2-relayd";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ betaboon ];
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 6fe83fd09effc..7f825509b9475 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   ];
 
   meta = with lib; {
-    description = "A kernel module to create V4L2 loopback devices";
+    description = "Kernel module to create V4L2 loopback devices";
     mainProgram = "v4l2loopback-ctl";
     homepage = "https://github.com/umlaeute/v4l2loopback";
     license = licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/v86d/default.nix b/pkgs/os-specific/linux/v86d/default.nix
index 8597cc5ac9f93..12e9b57d001cb 100644
--- a/pkgs/os-specific/linux/v86d/default.nix
+++ b/pkgs/os-specific/linux/v86d/default.nix
@@ -38,10 +38,10 @@ in stdenv.mkDerivation rec {
   buildInputs = [ klibc ];
 
   meta = with lib; {
-    description = "A daemon to run x86 code in an emulated environment";
+    description = "Daemon to run x86 code in an emulated environment";
     mainProgram = "v86d";
     homepage = "https://github.com/mjanusz/v86d";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ codyopel ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
index 625aa232cc66a..e709b26ad93d3 100644
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/dm-vdo/vdo";
-    description = "A set of userspace tools for managing pools of deduplicated and/or compressed block storage";
+    description = "Set of userspace tools for managing pools of deduplicated and/or compressed block storage";
     # platforms are defined in https://github.com/dm-vdo/vdo/blob/master/utils/uds/atomicDefs.h
     platforms = [ "x86_64-linux" "aarch64-linux" "s390-linux" "powerpc64-linux" "powerpc64le-linux" ];
     license = with licenses; [ gpl2Plus ];
diff --git a/pkgs/os-specific/linux/virtio_vmmci/default.nix b/pkgs/os-specific/linux/virtio_vmmci/default.nix
index cff2cbbeae8c7..abb359fe06e4c 100644
--- a/pkgs/os-specific/linux/virtio_vmmci/default.nix
+++ b/pkgs/os-specific/linux/virtio_vmmci/default.nix
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "An OpenBSD VMM Control Interface (vmmci) for Linux";
+    description = "OpenBSD VMM Control Interface (vmmci) for Linux";
     homepage = "https://github.com/voutilad/virtio_vmmci";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qbit ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/vmm_clock/default.nix b/pkgs/os-specific/linux/vmm_clock/default.nix
index 7ce99f40df1fd..686a20ada2438 100644
--- a/pkgs/os-specific/linux/vmm_clock/default.nix
+++ b/pkgs/os-specific/linux/vmm_clock/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     description =
       "Experimental implementation of a kvmclock-derived clocksource for Linux guests under OpenBSD's hypervisor";
     homepage = "https://github.com/voutilad/vmm_clock";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qbit ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index ae42c206280da..5e29b911ca548 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -12,7 +12,7 @@
 , iproute2
 , iptables
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 , wl-clipboard
 , runtimeShell
 }:
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/wireless-tools/default.nix b/pkgs/os-specific/linux/wireless-tools/default.nix
index e95506461a4bd..33318b16bb819 100644
--- a/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/pkgs/os-specific/linux/wireless-tools/default.nix
@@ -21,6 +21,6 @@ stdenv.mkDerivation rec {
     description = "Wireless tools for Linux";
     homepage = "https://hewlettpackard.github.io/wireless-tools/Tools.html";
     platforms = lib.platforms.linux;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
   };
 }
diff --git a/pkgs/os-specific/linux/wiringpi/default.nix b/pkgs/os-specific/linux/wiringpi/default.nix
index bc80e2a33543b..a8eb74217a4f9 100644
--- a/pkgs/os-specific/linux/wiringpi/default.nix
+++ b/pkgs/os-specific/linux/wiringpi/default.nix
@@ -1,50 +1,54 @@
-{ lib
-, stdenv
-, symlinkJoin
-, fetchFromGitHub
-, libxcrypt
+{
+  lib,
+  stdenv,
+  symlinkJoin,
+  fetchFromGitHub,
+  libxcrypt,
 }:
 
 let
-  version = "2.61-1";
-  mkSubProject = { subprj # The only mandatory argument
-  , buildInputs ? []
-  , src ? fetchFromGitHub {
+  version = "3.6";
+  srcAll = fetchFromGitHub {
     owner = "WiringPi";
     repo = "WiringPi";
     rev = version;
-    sha256 = "sha256-VxAaPhaPXd9xYt663Ju6SLblqiSLizauhhuFqCqbO5M=";
-  }
-  }: stdenv.mkDerivation (finalAttrs: {
-    pname = "wiringpi-${subprj}";
-    inherit version src;
-    sourceRoot = "${src.name}/${subprj}";
-    inherit buildInputs;
-    # Remove (meant for other OSs) lines from Makefiles
-    preInstall = ''
-      sed -i "/chown root/d" Makefile
-      sed -i "/chmod/d" Makefile
-    '';
-    makeFlags = [
-      "DESTDIR=${placeholder "out"}"
-      "PREFIX=/."
-      # On NixOS we don't need to run ldconfig during build:
-      "LDCONFIG=echo"
-    ];
-  });
+    sha256 = "sha256-Hw81Ua9LTb/9l3Js1rx8TfCOF59MrrvH6AGsAsG1SoE=";
+  };
+  mkSubProject =
+    {
+      subprj, # The only mandatory argument
+      buildInputs ? [ ],
+      src ? srcAll,
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      pname = "wiringpi-${subprj}";
+      inherit version src;
+      sourceRoot = "${src.name}/${subprj}";
+      inherit buildInputs;
+      # Remove (meant for other OSs) lines from Makefiles
+      preInstall = ''
+        sed -i "/chown root/d" Makefile
+        sed -i "/chmod/d" Makefile
+      '';
+      makeFlags = [
+        "DESTDIR=${placeholder "out"}"
+        "PREFIX=/."
+        # On NixOS we don't need to run ldconfig during build:
+        "LDCONFIG=echo"
+      ];
+    });
   passthru = {
+    # Helps nix-update and probably nixpkgs-update find the src of this package
+    # automatically.
+    src = srcAll;
     inherit mkSubProject;
     wiringPi = mkSubProject {
       subprj = "wiringPi";
-      buildInputs = [
-        libxcrypt
-      ];
+      buildInputs = [ libxcrypt ];
     };
     devLib = mkSubProject {
       subprj = "devLib";
-      buildInputs = [
-        passthru.wiringPi
-      ];
+      buildInputs = [ passthru.wiringPi ];
     };
     wiringPiD = mkSubProject {
       subprj = "wiringPiD";
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 49355de17784e..f797b89efc7bf 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -120,7 +120,6 @@ stdenv.mkDerivation rec {
   + lib.optionalString dbusSupport ''
     mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
-    sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
   ''
@@ -136,7 +135,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://w1.fi/wpa_supplicant/";
-    description = "A tool for connecting to WPA and WPA2-protected wireless networks";
+    description = "Tool for connecting to WPA and WPA2-protected wireless networks";
     license = licenses.bsd3;
     maintainers = with maintainers; [ marcweber ma27 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index ac1de01af974a..45eedb25a9531 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchpatch, qtbase, qmake, inkscape, imagemagick, wpa_supplicant }:
+{ lib, mkDerivation, qtbase, qmake, inkscape, imagemagick, wpa_supplicant }:
 
 mkDerivation {
   pname = "wpa_gui";
diff --git a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
index cbe2a8134e60f..309d9865bebc6 100644
--- a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
+++ b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     description = "Set the energy versus performance policy preference bias on recent X86 processors";
     mainProgram = "x86_energy_perf_policy";
     homepage = "https://www.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
   };
 }
diff --git a/pkgs/os-specific/linux/x86info/default.nix b/pkgs/os-specific/linux/x86info/default.nix
index f330fbbe6c7a4..86830c851e55d 100644
--- a/pkgs/os-specific/linux/x86info/default.nix
+++ b/pkgs/os-specific/linux/x86info/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       frequency, and identify the cache sizes and layout.
     '';
     platforms = [ "i686-linux" "x86_64-linux" ];
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
     homepage = "https://github.com/kernelslacker/x86info";
     maintainers = with lib.maintainers; [ jcumming ];
   };
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index 4092e3797c2ff..bfc4a68bddf87 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     homepage = "https://cgit.freedesktop.org/xorg/driver/xf86-video-nested";
-    description = "A driver to run Xorg on top of Xorg or something else";
+    description = "Driver to run Xorg on top of Xorg or something else";
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
index b1e2ce570a2d2..b61b242291882 100644
--- a/pkgs/os-specific/linux/xone/default.nix
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, kernel, fetchurl, fetchpatch }:
+{ stdenv, lib, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xone";
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Linux kernel driver for Xbox One and Xbox Series X|S accessories";
     homepage = "https://github.com/medusalix/xone";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ rhysmdnz ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/xsensors/default.nix b/pkgs/os-specific/linux/xsensors/default.nix
index e3639fefffa4e..d229c22ee0c68 100644
--- a/pkgs/os-specific/linux/xsensors/default.nix
+++ b/pkgs/os-specific/linux/xsensors/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     ./replace-deprecated-gtk.patch
   ];
   meta = with lib; {
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index e8fce959c8dc9..8101f47c6a241 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ gtk3 ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index bf1240610f8c6..f5819f0d1d221 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     inherit (src.meta) homepage;
-    description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs.";
+    description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ alexbakker artturin ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/zfs/2_2.nix b/pkgs/os-specific/linux/zfs/2_2.nix
index 455c17383604f..14c88f195dbf3 100644
--- a/pkgs/os-specific/linux/zfs/2_2.nix
+++ b/pkgs/os-specific/linux/zfs/2_2.nix
@@ -14,17 +14,17 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_2_2";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel.kernelOlder "6.8";
+  kernelCompatible = kernel.kernelOlder "6.9";
 
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_8;
 
   # this package should point to the latest release.
-  version = "2.2.3";
+  version = "2.2.4";
 
   tests = [
     nixosTests.zfs.installer
     nixosTests.zfs.series_2_2
   ];
 
-  hash = "sha256-Bzkow15OitUUQ+mTYhCXgTrQl+ao/B4feleHY/rSSjg=";
+  hash = "sha256-SSp/1Tu1iGx5UDcG4j0k2fnYxK05cdE8gzfSn8DU5Z4=";
 }
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
index c0ff834cb34ab..ac32f034b7cd1 100644
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -1,6 +1,6 @@
 let
   genericBuild =
-  { pkgs, lib, stdenv, fetchFromGitHub, fetchpatch
+  { pkgs, lib, stdenv, fetchFromGitHub
   , autoreconfHook269, util-linux, nukeReferences, coreutils
   , perl
   , configFile ? "all"
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index c8db9c5c5df97..28401bf4adfa5 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -14,21 +14,21 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_unstable";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel.kernelOlder "6.9";
+  kernelCompatible = kernel.kernelOlder "6.10";
 
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_8;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.3-unstable-2024-04-09";
-  rev = "28520cad2500b60ce8653e431990e33f77ff08f7";
+  version = "2.2.4-unstable-2024-05-29";
+  rev = "2eab4f7b396a1abb9adf7cab82d6ff47f9d78e9b";
 
   isUnstable = true;
   tests = [
     nixosTests.zfs.unstable
   ];
 
-  hash = "sha256-lGoiTmCWOxqACSYY0WA0gN6CN/1FyYhSVHmtYC1Izhg=";
+  hash = "sha256-xcEiZRHsFtIWvjy47kaLai/No/XYfhkJ5+zi/1KWqUE=";
 }
diff --git a/pkgs/os-specific/windows/cygwin-setup/default.nix b/pkgs/os-specific/windows/cygwin-setup/default.nix
index 91dad81f1f52a..074157c182c38 100644
--- a/pkgs/os-specific/windows/cygwin-setup/default.nix
+++ b/pkgs/os-specific/windows/cygwin-setup/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://sourceware.org/cygwin-apps/setup.html";
-    description = "A tool for installing Cygwin";
+    description = "Tool for installing Cygwin";
     license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 7d152a607b8e4..234abcde16117 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -34,10 +34,6 @@ lib.makeScope newScope (self: with self; {
     stdenv = crossThreadsStdenv;
   };
 
-  mcfgthreads_pre_gcc_13 = callPackage ./mcfgthreads/pre_gcc_13.nix {
-    stdenv = crossThreadsStdenv;
-  };
-
   mcfgthreads = callPackage ./mcfgthreads {
     stdenv = crossThreadsStdenv;
   };
diff --git a/pkgs/os-specific/windows/mcfgthreads/default.nix b/pkgs/os-specific/windows/mcfgthreads/default.nix
index 5075107c5a3f2..9eabaf21e44fc 100644
--- a/pkgs/os-specific/windows/mcfgthreads/default.nix
+++ b/pkgs/os-specific/windows/mcfgthreads/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
-    description = "A threading support library for Windows 7 and above";
+    description = "Threading support library for Windows 7 and above";
     homepage = "https://github.com/lhmouse/mcfgthread/wiki";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ wegank ];
diff --git a/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix b/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix
deleted file mode 100644
index 6be64814c93aa..0000000000000
--- a/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
-
-stdenv.mkDerivation {
-  pname = "mcfgthreads";
-  version = "git"; # unstable-2021-03-12, not in any branch
-
-  src = fetchFromGitHub {
-    owner = "lhmouse";
-    repo = "mcfgthread";
-    rev = "c446cf4fcdc262fc899a188a4bb7136284c34222";
-    sha256 = "1ib90lrd4dz8irq4yvzwhxqa86i5vxl2q2z3z04sf1i8hw427p2f";
-  };
-
-  outputs = [ "out" "dev" ];
-
-  # Don't want prebuilt binaries sneaking in.
-  postUnpack = ''
-    rm -r "$sourceRoot/debug" "$sourceRoot/release"
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-  ];
-}
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index 706186c8e2f15..ba2b243a9408a 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -3,18 +3,12 @@
 , windows
 , fetchurl
 , autoreconfHook
+, mingw_w64_headers
 }:
 
-let
-  version = "11.0.1";
-in stdenv.mkDerivation {
+stdenv.mkDerivation {
   pname = "mingw-w64";
-  inherit version;
-
-  src = fetchurl {
-    url = "mirror://sourceforge/mingw-w64/mingw-w64-v${version}.tar.bz2";
-    hash = "sha256-P2a84Gnui+10OaGhPafLkaXmfqYXDyExesf1eUYl7hA=";
-  };
+  inherit (mingw_w64_headers) version src meta;
 
   outputs = [ "out" "dev" ];
 
@@ -30,8 +24,4 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ windows.mingw_w64_headers ];
   hardeningDisable = [ "stackprotector" "fortify" ];
-
-  meta = {
-    platforms = lib.platforms.windows;
-  };
 }
diff --git a/pkgs/os-specific/windows/mingw-w64/headers.nix b/pkgs/os-specific/windows/mingw-w64/headers.nix
index 1fd27a8c4573f..d5edaeaa2bd1e 100644
--- a/pkgs/os-specific/windows/mingw-w64/headers.nix
+++ b/pkgs/os-specific/windows/mingw-w64/headers.nix
@@ -1,11 +1,19 @@
-{ stdenvNoCC, mingw_w64 }:
+{ lib, stdenvNoCC, fetchurl }:
 
-stdenvNoCC.mkDerivation {
-  name = "${mingw_w64.name}-headers";
-  inherit (mingw_w64) src meta;
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "mingw_w64-headers";
+  version = "11.0.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/mingw-w64/mingw-w64-v${finalAttrs.version}.tar.bz2";
+    hash = "sha256-P2a84Gnui+10OaGhPafLkaXmfqYXDyExesf1eUYl7hA=";
+  };
 
   preConfigure = ''
     cd mingw-w64-headers
   '';
 
-}
+  meta = {
+    platforms = lib.platforms.windows;
+  };
+})
diff --git a/pkgs/os-specific/windows/mingw-w64/pthreads.nix b/pkgs/os-specific/windows/mingw-w64/pthreads.nix
index 3b143efed1d70..3c5fab4fa708f 100644
--- a/pkgs/os-specific/windows/mingw-w64/pthreads.nix
+++ b/pkgs/os-specific/windows/mingw-w64/pthreads.nix
@@ -1,8 +1,8 @@
-{ stdenv, mingw_w64 }:
+{ stdenv, mingw_w64_headers }:
 
 stdenv.mkDerivation {
-  name = "${mingw_w64.name}-pthreads";
-  inherit (mingw_w64) src meta;
+  pname = "mingw_w64-pthreads";
+  inherit (mingw_w64_headers) version src meta;
 
   configureFlags = [
     # Rustc require 'libpthread.a' when targeting 'x86_64-pc-windows-gnu'.