about summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix1101
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/column.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/common.nix3
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc (renamed from pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix120
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/config.nix18
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/csu.nix24
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/dict.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix41
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch (renamed from pkgs/os-specific/bsd/netbsd/getent.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/headers.nix11
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/include.nix40
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/install-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix49
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix18
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libc.nix76
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix27
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix26
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libm.nix10
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix11
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix15
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librt.nix13
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix32
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch (renamed from pkgs/os-specific/bsd/netbsd/locale.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix16
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/make.nix60
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix43
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/man.nix17
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/misc.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix82
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix5
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix14
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix19
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix72
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch (renamed from pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch (renamed from pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tic.nix28
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix16
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix68
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix23
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix2
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix85
-rw-r--r--pkgs/os-specific/darwin/noah/default.nix2
-rw-r--r--pkgs/os-specific/darwin/raycast/default.nix4
-rw-r--r--pkgs/os-specific/darwin/rectangle/default.nix4
-rw-r--r--pkgs/os-specific/darwin/sketchybar/default.nix77
-rw-r--r--pkgs/os-specific/darwin/skhd/default.nix55
-rw-r--r--pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist23
-rw-r--r--pkgs/os-specific/darwin/utm/default.nix6
-rw-r--r--pkgs/os-specific/darwin/xcode/default.nix5
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix141
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/below/default.nix6
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix4
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix1
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/disable-test.patch23
-rw-r--r--pkgs/os-specific/linux/device-tree/default.nix2
-rw-r--r--pkgs/os-specific/linux/dmidecode/default.nix6
-rw-r--r--pkgs/os-specific/linux/drbd/driver.nix25
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix38
-rw-r--r--pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch11
-rw-r--r--pkgs/os-specific/linux/ell/default.nix6
-rw-r--r--pkgs/os-specific/linux/ethq/default.nix2
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix2
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix25
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json424
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch13
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd-efi/default.nix8
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/google-authenticator/default.nix4
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix8
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix52
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json32
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/rust-1.77.patch792
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix11
-rw-r--r--pkgs/os-specific/linux/kexec-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/app.nix15
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/libnvme/default.nix2
-rw-r--r--pkgs/os-specific/linux/libzbc/default.nix2
-rw-r--r--pkgs/os-specific/linux/libzbd/default.nix2
-rw-r--r--pkgs/os-specific/linux/lxc/add-meson-options.patch153
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix94
-rw-r--r--pkgs/os-specific/linux/lxc/docbook-hack.patch21
-rw-r--r--pkgs/os-specific/linux/mwprocapture/default.nix4
-rw-r--r--pkgs/os-specific/linux/nct6687d/default.nix11
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix16
-rw-r--r--pkgs/os-specific/linux/nftables/fix-py-libnftables.patch13
-rw-r--r--pkgs/os-specific/linux/nftables/python.nix26
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh12
-rw-r--r--pkgs/os-specific/linux/nmon/default.nix4
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix18
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix4
-rw-r--r--pkgs/os-specific/linux/openvswitch/default.nix4
-rw-r--r--pkgs/os-specific/linux/openvswitch/generic.nix135
-rw-r--r--pkgs/os-specific/linux/openvswitch/lts.nix5
-rw-r--r--pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch12
-rwxr-xr-xpkgs/os-specific/linux/openvswitch/update.nu19
-rw-r--r--pkgs/os-specific/linux/pam/default.nix13
-rw-r--r--pkgs/os-specific/linux/piper/default.nix4
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix9
-rw-r--r--pkgs/os-specific/linux/r8125/default.nix4
-rw-r--r--pkgs/os-specific/linux/restool/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8852au/default.nix52
-rw-r--r--pkgs/os-specific/linux/rtl8852bu/default.nix51
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix6
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix10
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix48
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/default.nix36
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/tests.nix95
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix7
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix6
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix4
-rw-r--r--pkgs/os-specific/linux/upower/default.nix9
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix4
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix4
164 files changed, 2986 insertions, 2395 deletions
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index 1f321f032516f..b7cf5484c9e94 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -25,16 +25,11 @@ in makeScopeWithSplicing' {
       sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
     };
 
-    # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
-    # See note in ../netbsd/default.nix.
-
     compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
-
     freebsd-lib = import ./lib { inherit version; };
 
-    # Overridden arguments avoid cross package-set splicing issues,
-    # otherwise would just use implicit
-    # `lib.packagesFromDirectoryRecursive` auto-call.
+    # The manual callPackages below should in principle be unnecessary, but are
+    # necessary. See note in ../netbsd/default.nix
 
     compat = self.callPackage ./pkgs/compat/package.nix {
       inherit stdenv;
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 79d46732bd6c2..fd5e24aa7102a 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,1028 +1,137 @@
 { stdenv, lib, stdenvNoCC
 , makeScopeWithSplicing', generateSplicesForMkScope
 , buildPackages
-, bsdSetupHook, makeSetupHook, fetchcvs, groff, mandoc, byacc, flex
-, zlib
-, writeShellScript, writeText, runtimeShell, symlinkJoin
+, fetchcvs
 }:
 
-let
-  inherit (buildPackages.buildPackages) rsync;
-
-  fetchNetBSD = path: version: sha256: fetchcvs {
-    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
-    module = "src/${path}";
-    inherit sha256;
-    tag = "netbsd-${lib.replaceStrings ["."] ["-"] version}-RELEASE";
-  };
-
-  netbsdSetupHook = makeSetupHook {
-    name = "netbsd-setup-hook";
-  } ./setup-hook.sh;
-
-  defaultMakeFlags = [
-    "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
-      then "yes"
-      else "no"}"
-  ];
-
-in makeScopeWithSplicing' {
+makeScopeWithSplicing' {
   otherSplices = generateSplicesForMkScope "netbsd";
-  f = (self: let
-    inherit (self) mkDerivation;
-  in {
-
-  # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
-  #
-  # We use `makeScopeWithSplicing'` because this should be used for all
-  # nested package sets which support cross, so the inner `callPackage` works
-  # correctly. But for the inline packages we don't bother to use
-  # `callPackage`.
-  #
-  # We still could have tried to `with` a big spliced packages set, but
-  # splicing is jank and causes a number of bootstrapping infinite recursions
-  # if one is not careful. Pulling deps out of the right package set directly
-  # side-steps splicing entirely and avoids those footguns.
-  #
-  # For non-bootstrap-critical packages, we might as well use `callPackage` for
-  # consistency with everything else, and maybe put in separate files too.
-
-  compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
-
-  mkDerivation = lib.makeOverridable (attrs: let
-    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
-  in stdenv'.mkDerivation ({
-    pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
-    inherit (attrs) version;
-    src = fetchNetBSD attrs.path attrs.version attrs.sha256;
-
-    extraPaths = [ ];
-
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install tsort lorder buildPackages.mandoc groff statHook rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-
-    HOST_SH = stdenv'.shell;
-
-    MACHINE_ARCH = {
-      i486 = "i386";
-      i586 = "i386";
-      i686 = "i386";
-    }.${stdenv'.hostPlatform.parsed.cpu.name}
-      or stdenv'.hostPlatform.parsed.cpu.name;
-
-    MACHINE = {
-      x86_64 = "amd64";
-      aarch64 = "evbarm64";
-      i486 = "i386";
-      i586 = "i386";
-      i686 = "i386";
-    }.${stdenv'.hostPlatform.parsed.cpu.name}
-      or stdenv'.hostPlatform.parsed.cpu.name;
-
-    COMPONENT_PATH = attrs.path;
-
-    makeFlags = defaultMakeFlags;
-
-    strictDeps = true;
-
-    meta = with lib; {
-      maintainers = with maintainers; [ matthewbauer qyliss ];
-      platforms = platforms.unix;
-      license = licenses.bsd2;
+  f = (self: lib.packagesFromDirectoryRecursive {
+    callPackage = self.callPackage;
+    directory = ./pkgs;
+  } // (let inherit (self) mkDerivation; in {
+
+    fetchNetBSD = path: version: sha256: fetchcvs {
+      cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+      module = "src/${path}";
+      inherit sha256;
+      tag = "netbsd-${lib.replaceStrings ["."] ["-"] version}-RELEASE";
     };
 
-  } // lib.optionalAttrs stdenv'.hasCC {
-    # TODO should CC wrapper set this?
-    CPP = "${stdenv'.cc.targetPrefix}cpp";
-  } // lib.optionalAttrs stdenv'.isDarwin {
-    MKRELRO = "no";
-  } // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-    HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-    HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.isx86_32) {
-    USE_SSP = "no";
-  } // lib.optionalAttrs (attrs.headersOnly or false) {
-    installPhase = "includesPhase";
-    dontBuild = true;
-  } // attrs // {
-    # Files that use NetBSD-specific macros need to have nbtool_config.h
-    # included ahead of them on non-NetBSD platforms.
-    postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
-      set +e
-      grep -Zlr "^__RCSID
-      ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
-          xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
-      set -e
-    '' + attrs.postPatch or "";
-  }));
-
-  ##
-  ## START BOOTSTRAPPING
-  ##
-  makeMinimal = mkDerivation {
-    path = "tools/make";
-    sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
-    version = "9.2";
-
-    buildInputs = with self; [];
-    nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook netbsdSetupHook rsync ];
-
-    skipIncludesPhase = true;
-
-    postPatch = ''
-      patchShebangs $COMPONENT_PATH/configure
-      ${self.make.postPatch}
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      sh ./buildmake.sh
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      install -D nbmake $out/bin/nbmake
-      ln -s $out/bin/nbmake $out/bin/make
-      mkdir -p $out/share
-      cp -r $BSDSRCDIR/share/mk $out/share/mk
-
-      runHook postInstall
-    '';
-
-    extraPaths = with self; [ make.src ] ++ make.extraPaths;
-  };
-
-  compat = mkDerivation (let
-    version = "9.2";
-    commonDeps = [ zlib ];
-  in {
-    path = "tools/compat";
-    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
-    inherit version;
-
-    setupHooks = [
-      ../../../build-support/setup-hooks/role.bash
-      ./compat-setup-hook.sh
-    ];
-
-    preConfigure = ''
-      make include/.stamp configure nbtool_config.h.in defs.mk.in
-    '';
-
-    configurePlatforms = [ "build" "host" ];
-    configureFlags = [
-      "--cache-file=config.cache"
-    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-      # We include this header in our musl package only for legacy
-      # compatibility, and compat works fine without it (and having it
-      # know about sys/cdefs.h breaks packages like glib when built
-      # statically).
-      "ac_cv_header_sys_cdefs_h=no"
-    ];
-
-    nativeBuildInputs = with buildPackages.netbsd; commonDeps ++ [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      rsync
-    ];
-
-    buildInputs = with self; commonDeps;
-
-    # temporarily use gnuinstall for bootstrapping
-    # bsdinstall will be built later
-    makeFlags = defaultMakeFlags ++ [
-      "INSTALL=${buildPackages.coreutils}/bin/install"
-      "DATADIR=$(out)/share"
-      # Can't sort object files yet
-      "LORDER=echo"
-      "TSORT=cat"
-      # Can't process man pages yet
-      "MKSHARE=no"
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # GNU objcopy produces broken .a libs which won't link into dependers.
-      # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
-      "OBJCOPY=${buildPackages.darwin.cctools-port}/bin/strip"
-    ];
-    RENAME = "-D";
-
-    passthru.tests = { netbsd-install = self.install; };
-
-    patches = [
-      ./compat-cxx-safe-header.patch
-      ./compat-dont-configure-twice.patch
-      ./compat-no-force-native.patch
-    ];
-
-    preInstall = ''
-      makeFlagsArray+=('INSTALL_FILE=''${INSTALL} ''${COPY} ''${PRESERVE} ''${RENAME}')
-      makeFlagsArray+=('INSTALL_DIR=''${INSTALL} -d')
-      makeFlagsArray+=('INSTALL_SYMLINK=''${INSTALL} ''${SYMLINK} ''${RENAME}')
-    '';
-
-    postInstall = ''
-      # why aren't these installed by netbsd?
-      install -D compat_defs.h $out/include/compat_defs.h
-      install -D $BSDSRCDIR/include/cdbw.h $out/include/cdbw.h
-      install -D $BSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
-      install -D $BSDSRCDIR/sys/sys/featuretest.h \
-                 $out/include/sys/featuretest.h
-      install -D $BSDSRCDIR/sys/sys/md5.h $out/include/md5.h
-      install -D $BSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
-      install -D $BSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
-      install -D $BSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
-      install -D $BSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
-      install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
-      install -D $BSDSRCDIR/include/db.h $out/include/db.h
-      install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
-      install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
-      install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
-      install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
-      install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
-      install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
-
-      # Collapse includes slightly to fix dangling reference
-      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
-      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
-   '' + lib.optionalString stdenv.isDarwin ''
-      mkdir -p $out/include/ssp
-      touch $out/include/ssp/ssp.h
-   '' + ''
-      mkdir -p $out/lib/pkgconfig
-      substitute ${./libbsd-overlay.pc} $out/lib/pkgconfig/libbsd-overlay.pc \
-        --subst-var-by out $out \
-        --subst-var-by version ${version}
-    '';
-    extraPaths = with self; [ include.src libc.src libutil.src
-      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
-      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
-      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
-    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
-  });
-
-  # HACK: to ensure parent directories exist. This emulates GNU
-  # install’s -D option. No alternative seems to exist in BSD install.
-  install = let binstall = writeShellScript "binstall" ''
-    set -eu
-    for last in "$@"; do true; done
-    mkdir -p $(dirname $last)
-    @out@/bin/xinstall "$@"
-  ''; in mkDerivation {
-    path = "usr.bin/xinstall";
-    version = "9.2";
-    sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
-    extraPaths = with self; [ mtree.src make.src ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      mandoc groff rsync
-    ];
-    skipIncludesPhase = true;
-    buildInputs = with self; compatIfNeeded
-      # fts header is needed. glibc already has this header, but musl doesn't,
-      # so make sure pkgsMusl.netbsd.install still builds in case you want to
-      # remove it!
-      ++ [ fts ];
-    installPhase = ''
-      runHook preInstall
-
-      install -D install.1 $out/share/man/man1/install.1
-      install -D xinstall $out/bin/xinstall
-      install -D -m 0550 ${binstall} $out/bin/binstall
-      substituteInPlace $out/bin/binstall --subst-var out
-      ln -s $out/bin/binstall $out/bin/install
-
-      runHook postInstall
-    '';
-    setupHook = ./install-setup-hook.sh;
-  };
-
-  fts = mkDerivation {
-    pname = "fts";
-    path = "include/fts.h";
-    sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
-    version = "9.2";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook rsync
-    ];
-    propagatedBuildInputs = with self; compatIfNeeded;
-    extraPaths = with self; [
-      (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
-      (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
-      (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
-    ];
-    skipIncludesPhase = true;
-    buildPhase = ''
-      "$CC" -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
-          -o lib/libc/gen/fts.o
-      "$AR" -rsc libfts.a lib/libc/gen/fts.o
-    '';
-    installPhase = ''
-      runHook preInstall
-
-      install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
-      install -D include/fts.h $out/include/fts.h
-      install -D lib/libc/include/namespace.h $out/include/namespace.h
-      install -D libfts.a $out/lib/libfts.a
-
-      runHook postInstall
-    '';
-    setupHooks = [
-      ../../../build-support/setup-hooks/role.bash
-      ./fts-setup-hook.sh
-    ];
-  };
-
-  # Don't add this to nativeBuildInputs directly.  Use statHook instead.
-  stat = mkDerivation {
-    path = "usr.bin/stat";
-    version = "9.2";
-    sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  # stat isn't in POSIX, and NetBSD stat supports a completely
-  # different range of flags than GNU stat, so including it in PATH
-  # breaks stdenv.  Work around that with a hook that will point
-  # NetBSD's build system and NetBSD stat without including it in
-  # PATH.
-  statHook = makeSetupHook {
-    name = "netbsd-stat-hook";
-  } (writeText "netbsd-stat-hook-impl" ''
-    makeFlagsArray+=(TOOL_STAT=${self.stat}/bin/stat)
-  '');
-
-  tsort = mkDerivation {
-    path = "usr.bin/tsort";
-    version = "9.2";
-    sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  lorder = mkDerivation {
-    path = "usr.bin/lorder";
-    version = "9.2";
-    sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  ##
-  ## END BOOTSTRAPPING
-  ##
-
-  ##
-  ## START COMMAND LINE TOOLS
-  ##
-  make = mkDerivation {
-    path = "usr.bin/make";
-    sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
-    version = "9.2";
-
-   postPatch = ''
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
-       --replace '-o ''${DOCOWN}' "" \
-       --replace '-g ''${DOCGRP}' ""
-     for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
-       substituteInPlace $mk \
-         --replace '-o ''${BINOWN}' "" \
-         --replace '-g ''${BINGRP}' ""
-     done
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
-       --replace '-o ''${KMODULEOWN}' "" \
-       --replace '-g ''${KMODULEGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-       --replace '-o ''${LIBOWN}' "" \
-       --replace '-g ''${LIBGRP}' "" \
-       --replace '-o ''${DEBUGOWN}' "" \
-       --replace '-g ''${DEBUGGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
-       --replace '-o ''${LIBOWN}' "" \
-       --replace '-g ''${LIBGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
-       --replace '-o ''${MANOWN}' "" \
-       --replace '-g ''${MANGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
-       --replace '-o ''${NLSOWN}' "" \
-       --replace '-g ''${NLSGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
-       --replace '-o ''${BINOWN}' "" \
-       --replace '-g ''${BINGRP}' "" \
-       --replace '-o ''${RUMPBINOWN}' "" \
-       --replace '-g ''${RUMPBINGRP}' "" \
-       --replace '-o ''${DEBUGOWN}' "" \
-       --replace '-g ''${DEBUGGRP}' ""
-
-      # make needs this to pick up our sys make files
-      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
-
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-        --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
-        --replace /bin/rm rm
-    '' + lib.optionalString stdenv.isDarwin ''
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
-        --replace '-Wl,--fatal-warnings' "" \
-        --replace '-Wl,--warn-shared-textrel' ""
-    '';
-    postInstall = ''
-      make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
-    '';
-    extraPaths = [
-      (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
-    ];
-  };
-
-  mtree = mkDerivation {
-    path = "usr.sbin/mtree";
-    version = "9.2";
-    sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
-    extraPaths = with self; [ mknod.src ];
-  };
-
-  mknod = mkDerivation {
-    path = "sbin/mknod";
-    version = "9.2";
-    sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
-  };
-
-  getent = mkDerivation {
-    path = "usr.bin/getent";
-    sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
-    version = "9.2";
-    patches = [ ./getent.patch ];
-  };
-
-  getconf = mkDerivation {
-    path = "usr.bin/getconf";
-    sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
-    version = "9.2";
-  };
-
-  locale = mkDerivation {
-    path = "usr.bin/locale";
-    version = "9.2";
-    sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
-    patches = [ ./locale.patch ];
-    env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
-  };
-
-  rpcgen = mkDerivation {
-    path = "usr.bin/rpcgen";
-    version = "9.2";
-    sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
-  };
-
-  genassym = mkDerivation {
-    path = "usr.bin/genassym";
-    version = "9.2";
-    sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
-  };
-
-  gencat = mkDerivation {
-    path = "usr.bin/gencat";
-    version = "9.2";
-    sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
-  };
-
-  nbperf = mkDerivation {
-    path = "usr.bin/nbperf";
-    version = "9.2";
-    sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
-  };
-
-  tic = mkDerivation {
-    path = "tools/tic";
-    version = "9.2";
-    sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
-    HOSTPROG = "tic";
-    buildInputs = with self; compatIfNeeded;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff nbperf rsync
-    ];
-    makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
-    extraPaths = with self; [
-      libterminfo.src
-      (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
-      (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+    defaultMakeFlags = [
+      "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
+        then "yes"
+        else "no"}"
     ];
-  };
 
-  uudecode = mkDerivation {
-    path = "usr.bin/uudecode";
-    version = "9.2";
-    sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
-    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
-    NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
-  };
+    compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
 
-  cksum = mkDerivation {
-    path = "usr.bin/cksum";
-    version = "9.2";
-    sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    # The manual callPackages below should in principle be unnecessary because
+    # they're just selecting arguments that would be selected anyway. However,
+    # if we don't perform these manual calls, we get infinite recursion issues
+    # because of the splices.
 
-  config = mkDerivation {
-    path = "usr.bin/config";
-    version = "9.2";
-    sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
-    env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install mandoc byacc flex rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-    extraPaths = with self; [ cksum.src ];
-  };
-  ##
-  ## END COMMAND LINE TOOLS
-  ##
-
-  ##
-  ## START HEADERS
-  ##
-  include = mkDerivation {
-    path = "include";
-    version = "9.2";
-    sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync nbperf rpcgen
-    ];
-
-    # The makefiles define INCSDIR per subdirectory, so we have to set
-    # something else on the command line so those definitions aren't
-    # overridden.
-    postPatch = ''
-      find "$BSDSRCDIR" -name Makefile -exec \
-        sed -i -E \
-          -e 's_/usr/include_''${INCSDIR0}_' \
-          {} \;
-    '';
-
-    # multiple header dirs, see above
-    postConfigure = ''
-      makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
-    '';
-
-    extraPaths = with self; [ common ];
-    headersOnly = true;
-    noCC = true;
-    meta.platforms = lib.platforms.netbsd;
-    makeFlags = defaultMakeFlags ++ [ "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp" ];
-  };
-
-  common = fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9";
-
-  sys-headers = mkDerivation {
-    pname = "sys-headers";
-    path = "sys";
-    version = "9.2";
-    sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
-
-    # Make the build ignore linker warnings
-    prePatch = ''
-      substituteInPlace sys/conf/Makefile.kern.inc \
-        --replace "-Wa,--fatal-warnings" ""
-    '';
-
-    patches = [
-      # Fix this error when building bootia32.efi and bootx64.efi:
-      # error: PHDR segment not covered by LOAD segment
-      ./no-dynamic-linker.patch
-
-      # multiple header dirs, see above
-      ./sys-headers-incsdir.patch
-    ];
+    mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+      inherit stdenv stdenvNoCC;
+      inherit (buildPackages.netbsd) netbsdSetupHook makeMinimal install tsort lorder;
+      inherit (buildPackages) mandoc;
+      inherit (buildPackages.buildPackages) rsync;
 
-    postPatch =
-      ''
-        substituteInPlace sys/arch/i386/stand/efiboot/Makefile.efiboot \
-          --replace "-nocombreloc" "-z nocombreloc"
-      '' +
-      # multiple header dirs, see above
-      self.include.postPatch;
-
-    CONFIG = "GENERIC";
-
-    propagatedBuildInputs = with self; [ include ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install tsort lorder statHook rsync uudecode config genassym
-    ];
-
-    postConfigure = ''
-      pushd arch/$MACHINE/conf
-      config $CONFIG
-      popd
-    ''
-      # multiple header dirs, see above
-      + self.include.postConfigure;
-
-    makeFlags = defaultMakeFlags ++ [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
-    hardeningDisable = [ "pic" ];
-    MKKMOD = "no";
-    env.NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=array-parameter"
-      "-Wno-error=array-bounds"
-      "-Wa,--no-warn"
-    ];
-
-    postBuild = ''
-      make -C arch/$MACHINE/compile/$CONFIG $makeFlags
-    '';
-
-    postInstall = ''
-      cp arch/$MACHINE/compile/$CONFIG/netbsd $out
-    '';
-
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ common ];
-
-    installPhase = "includesPhase";
-    dontBuild = true;
-    noCC = true;
-  };
-
-  # The full kernel. We do the funny thing of overridding the headers to the
-  # full kernal and not vice versa to avoid infinite recursion -- the headers
-  # come earlier in the bootstrap.
-  sys = self.sys-headers.override {
-    pname = "sys";
-    installPhase = null;
-    noCC = false;
-    dontBuild = false;
-  };
-
-  headers = symlinkJoin {
-    name = "netbsd-headers-9.2";
-    paths = with self; [
-      include
-      sys-headers
-      libpthread-headers
-    ];
-    meta.platforms = lib.platforms.netbsd;
-  };
-  ##
-  ## END HEADERS
-  ##
-
-  ##
-  ## START LIBRARIES
-  ##
-  libarch = mkDerivation {
-    path = "lib/libarch";
-    version = "9.2";
-    sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
-    meta.platforms = lib.platforms.netbsd;
-  };
-
-  libutil = mkDerivation {
-    path = "lib/libutil";
-    version = "9.2";
-    sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
-    extraPaths = with self; [ common libc.src sys.src ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      byacc install tsort lorder mandoc statHook rsync
-    ];
-    buildInputs = with self; [ headers ];
-    SHLIBINSTALLDIR = "$(out)/lib";
-  };
-
-  libedit = mkDerivation {
-    path = "lib/libedit";
-    version = "9.2";
-    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
-    buildInputs = with self; [ libterminfo libcurses ];
-    propagatedBuildInputs = with self; compatIfNeeded;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
-    postPatch = ''
-      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
-      substituteInPlace $COMPONENT_PATH/config.h \
-        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
-      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
-    '';
-    env.NIX_CFLAGS_COMPILE = toString [
-      "-D__noinline="
-      "-D__scanflike(a,b)="
-      "-D__va_list=va_list"
-    ];
-  };
-
-  libterminfo = mkDerivation {
-    path = "lib/libterminfo";
-    version = "9.2";
-    sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    postPatch = ''
-      substituteInPlace $COMPONENT_PATH/term.c --replace /usr/share $out/share
-      substituteInPlace $COMPONENT_PATH/setupterm.c \
-        --replace '#include <curses.h>' 'void use_env(bool);'
-    '';
-    postBuild = ''
-      make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share
-    '';
-    postInstall = ''
-      make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
-    '';
-    extraPaths = with self; [
-      (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
-    ];
-  };
-
-  libcurses = mkDerivation {
-    path = "lib/libcurses";
-    version = "9.2";
-    sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
-    buildInputs = with self; [ libterminfo ];
-    env.NIX_CFLAGS_COMPILE = toString ([
-      "-D__scanflike(a,b)="
-      "-D__va_list=va_list"
-      "-D__warn_references(a,b)="
-    ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
-    propagatedBuildInputs = with self; compatIfNeeded;
-    MKDOC = "no"; # missing vfontedpr
-    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
-    postPatch = lib.optionalString (!stdenv.isDarwin) ''
-      substituteInPlace $COMPONENT_PATH/printw.c \
-        --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
-        --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
-      substituteInPlace $COMPONENT_PATH/scanw.c \
-        --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
-    '';
-  };
-
-  column = mkDerivation {
-    path = "usr.bin/column";
-    version = "9.2";
-    sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
-  };
+    };
 
-  libossaudio = mkDerivation {
-    path = "lib/libossaudio";
-    version = "9.2";
-    sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    makeMinimal = self.callPackage ./pkgs/makeMinimal.nix {
+      inherit (self) make;
+    };
 
-  librpcsvc = mkDerivation {
-    path = "lib/librpcsvc";
-    version = "9.2";
-    sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
-    makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(out)/include/rpcsvc" ];
-    meta.platforms = lib.platforms.netbsd;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install tsort lorder rpcgen statHook
-    ];
-  };
+    compat = self.callPackage ./pkgs/compat/package.nix {
+      inherit (buildPackages) coreutils;
+      inherit (buildPackages.darwin) cctools-port;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (buildPackages.netbsd) makeMinimal;
+      inherit (self) install include libc libutil;
+    };
 
-  librt = mkDerivation {
-    path = "lib/librt";
-    version = "9.2";
-    sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
-    postPatch = ''
-      sed -i 's,/usr\(/include/sys/syscall.h\),${self.headers}\1,g' \
-        $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
-    '';
-  };
+    install = self.callPackage ./pkgs/install/package.nix {
+      inherit (self) fts mtree make compatIfNeeded;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (buildPackages.netbsd) makeMinimal;
+    };
 
-  libcrypt = mkDerivation {
-    path = "lib/libcrypt";
-    version = "9.2";
-    sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
-    SHLIBINSTALLDIR = "$(out)/lib";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    # See note in pkgs/stat/package.nix
+    stat = self.callPackage ./pkgs/stat/package.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libpci = mkDerivation {
-    pname = "libpci";
-    path = "lib/libpci";
-    version = "9.2";
-    sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
-    env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ sys.src ];
-  };
+    # See note in pkgs/stat/hook.nix
+    statHook = self.callPackage ./pkgs/stat/hook.nix {
+      inherit (self) stat;
+    };
 
-  libpthread-headers = mkDerivation {
-    pname = "libpthread-headers";
-    path = "lib/libpthread";
-    version = "9.2";
-    sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
-    installPhase = "includesPhase";
-    dontBuild = true;
-    noCC = true;
-    meta.platforms = lib.platforms.netbsd;
-  };
+    tsort = self.callPackage ./pkgs/tsort.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libpthread = self.libpthread-headers.override {
-    pname = "libpthread";
-    installPhase = null;
-    noCC = false;
-    dontBuild = false;
-    buildInputs = with self; [ headers ];
-    SHLIBINSTALLDIR = "$(out)/lib";
-    extraPaths = with self; [ common libc.src librt.src sys.src ];
-  };
+    lorder = self.callPackage ./pkgs/lorder.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libresolv = mkDerivation {
-    path = "lib/libresolv";
-    version = "9.2";
-    sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ];
-  };
+    config = self.callPackage ./pkgs/config.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (self) cksum;
+    };
 
-  libm = mkDerivation {
-    path = "lib/libm";
-    version = "9.2";
-    sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
-    SHLIBINSTALLDIR = "$(out)/lib";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ sys.src ];
-  };
+    include = self.callPackage ./pkgs/include.nix {
+      inherit (buildPackages.netbsd)
+        makeMinimal install nbperf rpcgen;
+      inherit (buildPackages) stdenv;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  i18n_module = mkDerivation {
-    path = "lib/i18n_module";
-    version = "9.2";
-    sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ];
-  };
+    sys-headers = self.callPackage ./pkgs/sys/headers.nix {
+      inherit (buildPackages.netbsd)
+        makeMinimal install tsort lorder statHook uudecode config genassym;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  csu = mkDerivation {
-    path = "lib/csu";
-    version = "9.2";
-    sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
-    meta.platforms = lib.platforms.netbsd;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff flex
-      byacc genassym gencat lorder tsort statHook rsync
-    ];
-    buildInputs = with self; [ headers ];
-    extraPaths = with self; [ sys.src ld_elf_so.src ];
-  };
+    libutil = self.callPackage ./pkgs/libutil.nix {
+      inherit (self) libc sys;
+    };
 
-  ld_elf_so = mkDerivation {
-    path  = "libexec/ld.elf_so";
-    version = "9.2";
-    sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
-    meta.platforms = lib.platforms.netbsd;
-    LIBC_PIC = "${self.libc}/lib/libc_pic.a";
-    # Hack to prevent a symlink being installed here for compatibility.
-    SHLINKINSTALLDIR = "/usr/libexec";
-    USE_FORT = "yes";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/libexec" "CLIBOBJ=${self.libc}/lib" ];
-    extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
-  };
+    libpthread-headers = self.callPackage ./pkgs/libpthread/headers.nix { };
 
-  _mainLibcExtraPaths = with self; [
-      common i18n_module.src sys.src
-      ld_elf_so.src libpthread.src libm.src libresolv.src
-      librpcsvc.src libutil.src librt.src libcrypt.src
-  ];
+    csu = self.callPackage ./pkgs/csu.nix {
+      inherit (self) headers sys ld_elf_so;
+      inherit (buildPackages.netbsd)
+        netbsdSetupHook
+        makeMinimal
+        install
+        genassym gencat lorder tsort statHook;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libc = mkDerivation {
-    path = "lib/libc";
-    version = "9.2";
-    sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
-    USE_FORT = "yes";
-    MKPROFILE = "no";
-    extraPaths = with self; _mainLibcExtraPaths ++ [
-      (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
-    ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff flex
-      byacc genassym gencat lorder tsort statHook rsync rpcgen
+    _mainLibcExtraPaths = with self; [
+        common i18n_module.src sys.src
+        ld_elf_so.src libpthread.src libm.src libresolv.src
+        librpcsvc.src libutil.src librt.src libcrypt.src
     ];
-    buildInputs = with self; [ headers csu ];
-    env.NIX_CFLAGS_COMPILE = "-B${self.csu}/lib -fcommon";
-    meta.platforms = lib.platforms.netbsd;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    MKPICINSTALL = "yes";
-    NLSDIR = "$(out)/share/nls";
-    makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db"];
-    postInstall = ''
-      pushd ${self.headers}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      pushd ${self.csu}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      NIX_CFLAGS_COMPILE+=" -B$out/lib"
-      NIX_CFLAGS_COMPILE+=" -I$out/include"
-      NIX_LDFLAGS+=" -L$out/lib"
-
-      make -C $BSDSRCDIR/lib/libpthread $makeFlags
-      make -C $BSDSRCDIR/lib/libpthread $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libm $makeFlags
-      make -C $BSDSRCDIR/lib/libm $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libresolv $makeFlags
-      make -C $BSDSRCDIR/lib/libresolv $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
 
-      make -C $BSDSRCDIR/lib/i18n_module $makeFlags
-      make -C $BSDSRCDIR/lib/i18n_module $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libutil $makeFlags
-      make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librt $makeFlags
-      make -C $BSDSRCDIR/lib/librt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
-    '';
-    inherit (self.librt) postPatch;
-  };
-  #
-  # END LIBRARIES
-  #
-
-  #
-  # START MISCELLANEOUS
-  #
-  dict = mkDerivation {
-    path = "share/dict";
-    noCC = true;
-    version = "9.2";
-    sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
-  };
-
-  misc = mkDerivation {
-    path = "share/misc";
-    noCC = true;
-    version = "9.2";
-    sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
-  };
+    libc = self.callPackage ./pkgs/libc.nix {
+      inherit (self) headers csu librt;
+      inherit (buildPackages.netbsd)
+        netbsdSetupHook
+        makeMinimal
+        install
+        genassym gencat lorder tsort statHook rpcgen;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  man = mkDerivation {
-    path = "share/man";
-    noCC = true;
-    version = "9.2";
-    sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
-    # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
-    # so we can avoid the dependency on ghostscript
-    postPatch = ''
-      substituteInPlace $COMPONENT_PATH/man0/Makefile --replace "ps2pdf" "echo noop "
-    '';
-    makeFlags = defaultMakeFlags ++ [
-      "FILESDIR=$(out)/share"
-      "MKRUMP=no" # would require to have additional path sys/rump/share/man
-    ];
-  };
-  #
-  # END MISCELLANEOUS
-  #
+    mtree = self.callPackage ./pkgs/mtree.nix {
+      inherit (self) mknod;
+    };
 
-});
+  }));
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
new file mode 100644
index 0000000000000..a2ec387501ae1
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/cksum";
+  version = "9.2";
+  sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/column.nix b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
new file mode 100644
index 0000000000000..f3cebfa9ab261
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/column";
+  version = "9.2";
+  sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/common.nix b/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
new file mode 100644
index 0000000000000..464fc1c9e0c26
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
@@ -0,0 +1,3 @@
+{ fetchNetBSD }:
+
+fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9"
diff --git a/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch
index 2aaa90b76146b..2aaa90b76146b 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch
index 2758e256a6168..2758e256a6168 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch
index 117fb7e042982..117fb7e042982 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh
index acd90b7aa2f0e..acd90b7aa2f0e 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
index 3aadabe508822..3aadabe508822 100644
--- a/pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
new file mode 100644
index 0000000000000..a1336ad52f6dc
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
@@ -0,0 +1,120 @@
+{ lib, mkDerivation, stdenv
+, zlib
+, defaultMakeFlags
+, coreutils
+, cctools-port
+, include, libc, libutil
+, install
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, rsync
+, fetchNetBSD
+, _mainLibcExtraPaths
+}:
+
+mkDerivation (let
+    version = "9.2";
+    commonDeps = [ zlib ];
+  in {
+    path = "tools/compat";
+    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
+    inherit version;
+
+    setupHooks = [
+      ../../../../../build-support/setup-hooks/role.bash
+      ./compat-setup-hook.sh
+    ];
+
+    preConfigure = ''
+      make include/.stamp configure nbtool_config.h.in defs.mk.in
+    '';
+
+    configurePlatforms = [ "build" "host" ];
+    configureFlags = [
+      "--cache-file=config.cache"
+    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+      # We include this header in our musl package only for legacy
+      # compatibility, and compat works fine without it (and having it
+      # know about sys/cdefs.h breaks packages like glib when built
+      # statically).
+      "ac_cv_header_sys_cdefs_h=no"
+    ];
+
+    nativeBuildInputs = commonDeps ++ [
+      bsdSetupHook netbsdSetupHook
+      makeMinimal
+      rsync
+    ];
+
+    buildInputs = commonDeps;
+
+    # temporarily use gnuinstall for bootstrapping
+    # bsdinstall will be built later
+    makeFlags = defaultMakeFlags ++ [
+      "INSTALL=${coreutils}/bin/install"
+      "DATADIR=$(out)/share"
+      # Can't sort object files yet
+      "LORDER=echo"
+      "TSORT=cat"
+      # Can't process man pages yet
+      "MKSHARE=no"
+    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # GNU objcopy produces broken .a libs which won't link into dependers.
+      # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
+      "OBJCOPY=${cctools-port}/bin/strip"
+    ];
+    RENAME = "-D";
+
+    passthru.tests = { netbsd-install = install; };
+
+    patches = [
+      ./compat-cxx-safe-header.patch
+      ./compat-dont-configure-twice.patch
+      ./compat-no-force-native.patch
+    ];
+
+    preInstall = ''
+      makeFlagsArray+=('INSTALL_FILE=''${INSTALL} ''${COPY} ''${PRESERVE} ''${RENAME}')
+      makeFlagsArray+=('INSTALL_DIR=''${INSTALL} -d')
+      makeFlagsArray+=('INSTALL_SYMLINK=''${INSTALL} ''${SYMLINK} ''${RENAME}')
+    '';
+
+    postInstall = ''
+      # why aren't these installed by netbsd?
+      install -D compat_defs.h $out/include/compat_defs.h
+      install -D $BSDSRCDIR/include/cdbw.h $out/include/cdbw.h
+      install -D $BSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
+      install -D $BSDSRCDIR/sys/sys/featuretest.h \
+                 $out/include/sys/featuretest.h
+      install -D $BSDSRCDIR/sys/sys/md5.h $out/include/md5.h
+      install -D $BSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
+      install -D $BSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
+      install -D $BSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
+      install -D $BSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
+      install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
+      install -D $BSDSRCDIR/include/db.h $out/include/db.h
+      install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
+      install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
+      install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
+      install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
+      install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
+      install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
+
+      # Collapse includes slightly to fix dangling reference
+      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
+      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
+   '' + lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/include/ssp
+      touch $out/include/ssp/ssp.h
+   '' + ''
+      mkdir -p $out/lib/pkgconfig
+      substitute ${./libbsd-overlay.pc} $out/lib/pkgconfig/libbsd-overlay.pc \
+        --subst-var-by out $out \
+        --subst-var-by version ${version}
+    '';
+    extraPaths = [ include.src libc.src libutil.src
+      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
+      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
+      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
+    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/config.nix b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
new file mode 100644
index 0000000000000..277d70129e6f7
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
@@ -0,0 +1,18 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, mandoc, byacc, flex, rsync
+, compatIfNeeded
+, cksum
+}:
+mkDerivation {
+  path = "usr.bin/config";
+  version = "9.2";
+  sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
+  env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install mandoc byacc flex rsync
+  ];
+  buildInputs = compatIfNeeded;
+  extraPaths = [ cksum.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
new file mode 100644
index 0000000000000..2d13ced6d5ed5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
@@ -0,0 +1,24 @@
+{ lib, mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, flex
+, byacc, genassym, gencat, lorder, tsort, statHook, rsync
+, headers
+, sys
+, ld_elf_so
+}:
+
+mkDerivation {
+  path = "lib/csu";
+  version = "9.2";
+  sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
+  meta.platforms = lib.platforms.netbsd;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff flex
+    byacc genassym gencat lorder tsort statHook rsync
+  ];
+  buildInputs = [ headers ];
+  extraPaths = [ sys.src ld_elf_so.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
new file mode 100644
index 0000000000000..0d7d026dd21d2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/dict";
+  noCC = true;
+  version = "9.2";
+  sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh
index b6cb5aaca05b3..b6cb5aaca05b3 100644
--- a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
new file mode 100644
index 0000000000000..0393d36357f6e
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
@@ -0,0 +1,41 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook, rsync
+, compatIfNeeded
+, fetchNetBSD
+}:
+
+mkDerivation {
+  pname = "fts";
+  path = "include/fts.h";
+  sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
+  version = "9.2";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook rsync
+  ];
+  propagatedBuildInputs = compatIfNeeded;
+  extraPaths = [
+    (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
+    (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
+    (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+  ];
+  skipIncludesPhase = true;
+  buildPhase = ''
+    "$CC" -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+        -o lib/libc/gen/fts.o
+    "$AR" -rsc libfts.a lib/libc/gen/fts.o
+  '';
+  installPhase = ''
+    runHook preInstall
+
+    install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
+    install -D include/fts.h $out/include/fts.h
+    install -D lib/libc/include/namespace.h $out/include/namespace.h
+    install -D libfts.a $out/lib/libfts.a
+
+    runHook postInstall
+  '';
+  setupHooks = [
+    ../../../../../build-support/setup-hooks/role.bash
+    ./fts-setup-hook.sh
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
new file mode 100644
index 0000000000000..7f81a77a02dd2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/genassym";
+  version = "9.2";
+  sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
new file mode 100644
index 0000000000000..411be85e91e2f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/gencat";
+  version = "9.2";
+  sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
new file mode 100644
index 0000000000000..c8483d454b877
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/getconf";
+  sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
+  version = "9.2";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/getent.patch b/pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch
index 18258b6486186..18258b6486186 100644
--- a/pkgs/os-specific/bsd/netbsd/getent.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
new file mode 100644
index 0000000000000..7a9acb1e0a9e8
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/getent";
+  sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
+  version = "9.2";
+  patches = [ ./getent.patch ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
new file mode 100644
index 0000000000000..646e5675130bb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
@@ -0,0 +1,11 @@
+{ lib, symlinkJoin, include, sys-headers, libpthread-headers }:
+
+symlinkJoin {
+  name = "netbsd-headers-9.2";
+  paths = [
+    include
+    sys-headers
+    libpthread-headers
+  ];
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
new file mode 100644
index 0000000000000..60b091ef0b718
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation, libc }:
+
+mkDerivation {
+  path = "lib/i18n_module";
+  version = "9.2";
+  sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
new file mode 100644
index 0000000000000..1ecdec90ae095
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
@@ -0,0 +1,40 @@
+{ lib, mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync, nbperf, rpcgen
+, common
+, defaultMakeFlags
+, stdenv
+}:
+
+mkDerivation {
+  path = "include";
+  version = "9.2";
+  sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync nbperf rpcgen
+  ];
+
+  # The makefiles define INCSDIR per subdirectory, so we have to set
+  # something else on the command line so those definitions aren't
+  # overridden.
+  postPatch = ''
+    find "$BSDSRCDIR" -name Makefile -exec \
+      sed -i -E \
+        -e 's_/usr/include_''${INCSDIR0}_' \
+        {} \;
+  '';
+
+  # multiple header dirs, see above
+  postConfigure = ''
+    makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
+  '';
+
+  extraPaths = [ common ];
+  headersOnly = true;
+  noCC = true;
+  meta.platforms = lib.platforms.netbsd;
+  makeFlags = defaultMakeFlags ++ [ "RPCGEN_CPP=${stdenv.cc.cc}/bin/cpp" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/install-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh
index 4bfd4d785fac4..4bfd4d785fac4 100644
--- a/pkgs/os-specific/bsd/netbsd/install-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
new file mode 100644
index 0000000000000..991517ac2d486
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
@@ -0,0 +1,49 @@
+{ mkDerivation
+, writeShellScript
+, mtree, make
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, mandoc, groff, rsync
+, compatIfNeeded, fts
+
+}:
+
+# HACK: to ensure parent directories exist. This emulates GNU
+# install’s -D option. No alternative seems to exist in BSD install.
+let
+  binstall = writeShellScript "binstall" ''
+    set -eu
+    for last in "$@"; do true; done
+    mkdir -p $(dirname $last)
+    @out@/bin/xinstall "$@"
+  '';
+in
+  mkDerivation {
+    path = "usr.bin/xinstall";
+    version = "9.2";
+    sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
+    extraPaths = [ mtree.src make.src ];
+    nativeBuildInputs = [
+      bsdSetupHook netbsdSetupHook
+      makeMinimal
+      mandoc groff rsync
+    ];
+    skipIncludesPhase = true;
+    buildInputs = compatIfNeeded
+      # fts header is needed. glibc already has this header, but musl doesn't,
+      # so make sure pkgsMusl.netbsd.install still builds in case you want to
+      # remove it!
+      ++ [ fts ];
+    installPhase = ''
+      runHook preInstall
+
+      install -D install.1 $out/share/man/man1/install.1
+      install -D xinstall $out/bin/xinstall
+      install -D -m 0550 ${binstall} $out/bin/binstall
+      substituteInPlace $out/bin/binstall --subst-var out
+      ln -s $out/bin/binstall $out/bin/install
+
+      runHook postInstall
+    '';
+    setupHook = ./install-setup-hook.sh;
+  }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
new file mode 100644
index 0000000000000..1496ad6a0e884
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
@@ -0,0 +1,18 @@
+{ lib
+, mkDerivation
+, libc
+, defaultMakeFlags
+}:
+
+mkDerivation {
+  path  = "libexec/ld.elf_so";
+  version = "9.2";
+  sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
+  meta.platforms = lib.platforms.netbsd;
+  LIBC_PIC = "${libc}/lib/libc_pic.a";
+  # Hack to prevent a symlink being installed here for compatibility.
+  SHLINKINSTALLDIR = "/usr/libexec";
+  USE_FORT = "yes";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/libexec" "CLIBOBJ=${libc}/lib" ];
+  extraPaths = [ libc.src ] ++ libc.extraPaths;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
new file mode 100644
index 0000000000000..93ea02f8a17c1
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libarch";
+  version = "9.2";
+  sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
new file mode 100644
index 0000000000000..ebc01a11668a6
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -0,0 +1,76 @@
+{ lib
+, mkDerivation
+, defaultMakeFlags
+, _mainLibcExtraPaths
+, fetchNetBSD
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, flex
+, byacc, genassym, gencat, lorder, tsort, statHook, rsync, rpcgen
+, csu, headers
+, librt
+}:
+
+mkDerivation {
+  path = "lib/libc";
+  version = "9.2";
+  sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
+  USE_FORT = "yes";
+  MKPROFILE = "no";
+  extraPaths = _mainLibcExtraPaths ++ [
+    (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff flex
+    byacc genassym gencat lorder tsort statHook rsync rpcgen
+  ];
+  buildInputs = [ headers csu ];
+  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib -fcommon";
+  meta.platforms = lib.platforms.netbsd;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  MKPICINSTALL = "yes";
+  NLSDIR = "$(out)/share/nls";
+  makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db"];
+  postInstall = ''
+    pushd ${headers}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    pushd ${csu}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    NIX_CFLAGS_COMPILE+=" -B$out/lib"
+    NIX_CFLAGS_COMPILE+=" -I$out/include"
+    NIX_LDFLAGS+=" -L$out/lib"
+
+    make -C $BSDSRCDIR/lib/libpthread $makeFlags
+    make -C $BSDSRCDIR/lib/libpthread $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libm $makeFlags
+    make -C $BSDSRCDIR/lib/libm $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libresolv $makeFlags
+    make -C $BSDSRCDIR/lib/libresolv $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+
+    make -C $BSDSRCDIR/lib/i18n_module $makeFlags
+    make -C $BSDSRCDIR/lib/i18n_module $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libutil $makeFlags
+    make -C $BSDSRCDIR/lib/libutil $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librt $makeFlags
+    make -C $BSDSRCDIR/lib/librt $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+  '';
+  inherit (librt) postPatch;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
new file mode 100644
index 0000000000000..c5f9deff589c4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libcrypt";
+  version = "9.2";
+  sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
+  SHLIBINSTALLDIR = "$(out)/lib";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
new file mode 100644
index 0000000000000..2409879640a90
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
@@ -0,0 +1,27 @@
+{ lib, mkDerivation, stdenv
+, libterminfo
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+mkDerivation {
+  path = "lib/libcurses";
+  version = "9.2";
+  sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
+  buildInputs = [ libterminfo ];
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-D__scanflike(a,b)="
+    "-D__va_list=va_list"
+    "-D__warn_references(a,b)="
+  ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
+  propagatedBuildInputs = compatIfNeeded;
+  MKDOC = "no"; # missing vfontedpr
+  makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace $COMPONENT_PATH/printw.c \
+      --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
+      --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
+    substituteInPlace $COMPONENT_PATH/scanw.c \
+      --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
new file mode 100644
index 0000000000000..eb734f34c3d49
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
@@ -0,0 +1,26 @@
+{ lib, mkDerivation
+, libterminfo, libcurses
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+mkDerivation {
+    path = "lib/libedit";
+    version = "9.2";
+    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
+    buildInputs = [ libterminfo libcurses ];
+    propagatedBuildInputs = compatIfNeeded;
+    SHLIBINSTALLDIR = "$(out)/lib";
+    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
+    postPatch = ''
+      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
+      substituteInPlace $COMPONENT_PATH/config.h \
+        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
+      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
+    '';
+    env.NIX_CFLAGS_COMPILE = toString [
+      "-D__noinline="
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+    ];
+  }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
new file mode 100644
index 0000000000000..86990088adf28
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
@@ -0,0 +1,10 @@
+{ lib, mkDerivation, sys }:
+
+mkDerivation {
+  path = "lib/libm";
+  version = "9.2";
+  sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
+  SHLIBINSTALLDIR = "$(out)/lib";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ sys.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
new file mode 100644
index 0000000000000..51bbc216e2046
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libossaudio";
+  version = "9.2";
+  sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
new file mode 100644
index 0000000000000..21ca0f62fd4e4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
@@ -0,0 +1,11 @@
+{ lib, mkDerivation, sys }:
+
+mkDerivation {
+  pname = "libpci";
+  path = "lib/libpci";
+  version = "9.2";
+  sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
+  env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ sys.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
new file mode 100644
index 0000000000000..485a12837bcb4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
@@ -0,0 +1,6 @@
+{
+  path = "lib/libpthread";
+  version = "9.2";
+  sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
new file mode 100644
index 0000000000000..3896562501fc5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation }:
+
+mkDerivation (import ./base.nix // {
+  pname = "libpthread-headers";
+  installPhase = "includesPhase";
+  dontBuild = true;
+  noCC = true;
+  meta.platforms = lib.platforms.netbsd;
+})
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
new file mode 100644
index 0000000000000..c2a0d407718e9
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
@@ -0,0 +1,15 @@
+{ lib, mkDerivation
+, headers
+, common, libc, librt, sys
+}:
+
+mkDerivation (import ./base.nix // {
+  pname = "libpthread";
+  installPhase = null;
+  noCC = false;
+  dontBuild = false;
+  buildInputs = [ headers ];
+  SHLIBINSTALLDIR = "$(out)/lib";
+  extraPaths = [ common libc.src librt.src sys.src ];
+  meta.platforms = lib.platforms.netbsd;
+})
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
new file mode 100644
index 0000000000000..2427592e4aa9a
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation, libc }:
+
+mkDerivation {
+  path = "lib/libresolv";
+  version = "9.2";
+  sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
new file mode 100644
index 0000000000000..87524339e268f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
@@ -0,0 +1,21 @@
+{ lib
+, mkDerivation
+, defaultMakeFlags
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, tsort, lorder, rpcgen, statHook
+}:
+
+mkDerivation {
+  path = "lib/librpcsvc";
+  version = "9.2";
+  sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
+  makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(out)/include/rpcsvc" ];
+  meta.platforms = lib.platforms.netbsd;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install tsort lorder rpcgen statHook
+  ];
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
new file mode 100644
index 0000000000000..2ffe0787004a5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
@@ -0,0 +1,13 @@
+{ lib, mkDerivation, libc, headers }:
+
+mkDerivation {
+  path = "lib/librt";
+  version = "9.2";
+  sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ] ++ libc.extraPaths;
+  postPatch = ''
+    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' \
+      $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
new file mode 100644
index 0000000000000..b9268cc7ba333
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
@@ -0,0 +1,32 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, mandoc, statHook, nbperf, tic, rsync
+, compatIfNeeded
+, fetchNetBSD
+}:
+
+mkDerivation {
+  path = "lib/libterminfo";
+  version = "9.2";
+  sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
+  ];
+  buildInputs = compatIfNeeded;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  postPatch = ''
+    substituteInPlace $COMPONENT_PATH/term.c --replace /usr/share $out/share
+    substituteInPlace $COMPONENT_PATH/setupterm.c \
+      --replace '#include <curses.h>' 'void use_env(bool);'
+  '';
+  postBuild = ''
+    make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share
+  '';
+  postInstall = ''
+    make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
+  '';
+  extraPaths = [
+    (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
new file mode 100644
index 0000000000000..4aaf8f0e7ab63
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
@@ -0,0 +1,21 @@
+{ mkDerivation
+, common, libc, sys
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, byacc, install, tsort, lorder, mandoc, statHook, rsync
+, headers
+}:
+
+mkDerivation {
+  path = "lib/libutil";
+  version = "9.2";
+  sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
+  extraPaths = [ common libc.src sys.src ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    byacc install tsort lorder mandoc statHook rsync
+  ];
+  buildInputs = [ headers ];
+  SHLIBINSTALLDIR = "$(out)/lib";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/locale.patch b/pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch
index 4b7f478552879..4b7f478552879 100644
--- a/pkgs/os-specific/bsd/netbsd/locale.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
new file mode 100644
index 0000000000000..3c61e8517b35b
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
@@ -0,0 +1,9 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/locale";
+  version = "9.2";
+  sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
+  patches = [ ./locale.patch ];
+  env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
new file mode 100644
index 0000000000000..d3109601382a0
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
@@ -0,0 +1,16 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+mkDerivation {
+  path = "usr.bin/lorder";
+  version = "9.2";
+  sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
new file mode 100644
index 0000000000000..dcd80ef004678
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
@@ -0,0 +1,60 @@
+{ lib, mkDerivation, fetchNetBSD, stdenv }:
+
+mkDerivation {
+  path = "usr.bin/make";
+  sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
+  version = "9.2";
+
+ postPatch = ''
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
+     --replace '-o ''${DOCOWN}' "" \
+     --replace '-g ''${DOCGRP}' ""
+   for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
+     substituteInPlace $mk \
+       --replace '-o ''${BINOWN}' "" \
+       --replace '-g ''${BINGRP}' ""
+   done
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
+     --replace '-o ''${KMODULEOWN}' "" \
+     --replace '-g ''${KMODULEGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+     --replace '-o ''${LIBOWN}' "" \
+     --replace '-g ''${LIBGRP}' "" \
+     --replace '-o ''${DEBUGOWN}' "" \
+     --replace '-g ''${DEBUGGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
+     --replace '-o ''${LIBOWN}' "" \
+     --replace '-g ''${LIBGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
+     --replace '-o ''${MANOWN}' "" \
+     --replace '-g ''${MANGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
+     --replace '-o ''${NLSOWN}' "" \
+     --replace '-g ''${NLSGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
+     --replace '-o ''${BINOWN}' "" \
+     --replace '-g ''${BINGRP}' "" \
+     --replace '-o ''${RUMPBINOWN}' "" \
+     --replace '-g ''${RUMPBINGRP}' "" \
+     --replace '-o ''${DEBUGOWN}' "" \
+     --replace '-g ''${DEBUGGRP}' ""
+
+    # make needs this to pick up our sys make files
+    export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+      --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
+      --replace /bin/rm rm
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+      --replace '-Wl,--fatal-warnings' "" \
+      --replace '-Wl,--warn-shared-textrel' ""
+  '';
+  postInstall = ''
+    make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
+  '';
+  extraPaths = [
+    (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
new file mode 100644
index 0000000000000..18655b3bf863e
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
@@ -0,0 +1,43 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook, rsync
+, make
+}:
+
+mkDerivation {
+  path = "tools/make";
+  sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
+  version = "9.2";
+
+  buildInputs = [];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook rsync
+  ];
+
+  skipIncludesPhase = true;
+
+  postPatch = ''
+    patchShebangs $COMPONENT_PATH/configure
+    ${make.postPatch}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    sh ./buildmake.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D nbmake $out/bin/nbmake
+    ln -s $out/bin/nbmake $out/bin/make
+    mkdir -p $out/share
+    cp -r $BSDSRCDIR/share/mk $out/share/mk
+
+    runHook postInstall
+  '';
+
+  extraPaths = [ make.src ] ++ make.extraPaths;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/man.nix b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
new file mode 100644
index 0000000000000..bce5bcee66946
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
@@ -0,0 +1,17 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/man";
+  noCC = true;
+  version = "9.2";
+  sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
+  # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
+  # so we can avoid the dependency on ghostscript
+  postPatch = ''
+    substituteInPlace $COMPONENT_PATH/man0/Makefile --replace "ps2pdf" "echo noop "
+  '';
+  makeFlags = defaultMakeFlags ++ [
+    "FILESDIR=$(out)/share"
+    "MKRUMP=no" # would require to have additional path sys/rump/share/man
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
new file mode 100644
index 0000000000000..7f96f4d1495ad
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/misc";
+  noCC = true;
+  version = "9.2";
+  sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
new file mode 100644
index 0000000000000..82e8889f6cf4d
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenvNoCC, stdenv
+, fetchNetBSD
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, tsort, lorder
+, mandoc, groff, statHook, rsync
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+lib.makeOverridable (attrs: let
+  stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
+in stdenv'.mkDerivation ({
+  pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
+  inherit (attrs) version;
+  src = fetchNetBSD attrs.path attrs.version attrs.sha256;
+
+  extraPaths = [ ];
+
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install tsort lorder mandoc groff statHook rsync
+  ];
+  buildInputs = compatIfNeeded;
+
+  HOST_SH = stdenv'.shell;
+
+  MACHINE_ARCH = {
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  MACHINE = {
+    x86_64 = "amd64";
+    aarch64 = "evbarm64";
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  COMPONENT_PATH = attrs.path;
+
+  makeFlags = defaultMakeFlags;
+
+  strictDeps = true;
+
+  meta = with lib; {
+    maintainers = with maintainers; [ matthewbauer qyliss ];
+    platforms = platforms.unix;
+    license = licenses.bsd2;
+  };
+
+} // lib.optionalAttrs stdenv'.hasCC {
+  # TODO should CC wrapper set this?
+  CPP = "${stdenv'.cc.targetPrefix}cpp";
+} // lib.optionalAttrs stdenv'.isDarwin {
+  MKRELRO = "no";
+} // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+  HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+  HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.isx86_32) {
+  USE_SSP = "no";
+} // lib.optionalAttrs (attrs.headersOnly or false) {
+  installPhase = "includesPhase";
+  dontBuild = true;
+} // attrs // {
+  # Files that use NetBSD-specific macros need to have nbtool_config.h
+  # included ahead of them on non-NetBSD platforms.
+  postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
+    set +e
+    grep -Zlr "^__RCSID
+    ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
+        xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
+    set -e
+  '' + attrs.postPatch or "";
+}))
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
new file mode 100644
index 0000000000000..5c4c172e40a7d
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "sbin/mknod";
+  version = "9.2";
+  sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
new file mode 100644
index 0000000000000..723da3ad891bc
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
@@ -0,0 +1,8 @@
+{ mkDerivation, mknod }:
+
+mkDerivation {
+  path = "usr.sbin/mtree";
+  version = "9.2";
+  sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
+  extraPaths = [ mknod.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
new file mode 100644
index 0000000000000..02ce7cf6ce5eb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/nbperf";
+  version = "9.2";
+  sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
new file mode 100644
index 0000000000000..e80571f2bf9a2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
@@ -0,0 +1,5 @@
+{ makeSetupHook }:
+
+makeSetupHook {
+    name = "netbsd-setup-hook";
+  } ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
index fa8b19e7d8ce4..fa8b19e7d8ce4 100644
--- a/pkgs/os-specific/bsd/netbsd/setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
new file mode 100644
index 0000000000000..b1482d4dff112
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/rpcgen";
+  version = "9.2";
+  sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
new file mode 100644
index 0000000000000..78186f55cd455
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
@@ -0,0 +1,14 @@
+{ makeSetupHook, writeText, stat }:
+
+# stat isn't in POSIX, and NetBSD stat supports a completely
+# different range of flags than GNU stat, so including it in PATH
+# breaks stdenv.  Work around that with a hook that will point
+# NetBSD's build system and NetBSD stat without including it in
+# PATH.
+
+makeSetupHook {
+  name = "netbsd-stat-hook";
+} (writeText "netbsd-stat-hook-impl" ''
+  makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
+'')
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
new file mode 100644
index 0000000000000..fa4d5cb3e21f6
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
@@ -0,0 +1,19 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+# Don't add this to nativeBuildInputs directly.
+# Use statHook instead. See note in stat/hook.nix
+
+mkDerivation {
+  path = "usr.bin/stat";
+  version = "9.2";
+  sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
new file mode 100644
index 0000000000000..ba458ef5c712f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
@@ -0,0 +1,72 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+{
+  path = "sys";
+  version = "9.2";
+  sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
+
+  # Make the build ignore linker warnings
+  prePatch = ''
+    substituteInPlace sys/conf/Makefile.kern.inc \
+      --replace "-Wa,--fatal-warnings" ""
+  '';
+
+  patches = [
+    # Fix this error when building bootia32.efi and bootx64.efi:
+    # error: PHDR segment not covered by LOAD segment
+    ./no-dynamic-linker.patch
+
+    # multiple header dirs, see above
+    ./sys-headers-incsdir.patch
+  ];
+
+  postPatch =
+    ''
+      substituteInPlace sys/arch/i386/stand/efiboot/Makefile.efiboot \
+        --replace "-nocombreloc" "-z nocombreloc"
+    '' +
+    # multiple header dirs, see above
+    include.postPatch;
+
+  CONFIG = "GENERIC";
+
+  propagatedBuildInputs = [ include ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install tsort lorder statHook rsync uudecode config genassym
+  ];
+
+  postConfigure = ''
+    pushd arch/$MACHINE/conf
+    config $CONFIG
+    popd
+  ''
+    # multiple header dirs, see above
+    + include.postConfigure;
+
+  makeFlags = defaultMakeFlags ++ [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
+  hardeningDisable = [ "pic" ];
+  MKKMOD = "no";
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=array-parameter"
+    "-Wno-error=array-bounds"
+    "-Wa,--no-warn"
+  ];
+
+  postBuild = ''
+    make -C arch/$MACHINE/compile/$CONFIG $makeFlags
+  '';
+
+  postInstall = ''
+    cp arch/$MACHINE/compile/$CONFIG/netbsd $out
+  '';
+
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ common ];
+
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
new file mode 100644
index 0000000000000..a3f20d772a3e7
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
@@ -0,0 +1,21 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+let
+  base = import ./base.nix {
+    inherit
+      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
+      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
+      common;
+  };
+in
+  mkDerivation (base // {
+    pname = "sys-headers";
+    installPhase = "includesPhase";
+    dontBuild = true;
+    noCC = true;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch b/pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch
index b3e9f3c88a13c..b3e9f3c88a13c 100644
--- a/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
new file mode 100644
index 0000000000000..87031a50346ea
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
@@ -0,0 +1,21 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+let
+  base = import ./base.nix {
+    inherit
+      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
+      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
+      common;
+  };
+in
+  mkDerivation (base // {
+    pname = "sys";
+    installPhase = null;
+    noCC = false;
+    dontBuild = false;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch b/pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch
index 5cfb2a54c8db2..5cfb2a54c8db2 100644
--- a/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
new file mode 100644
index 0000000000000..2a7e3644b6be9
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
@@ -0,0 +1,28 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, nbperf, rsync
+, compatIfNeeded
+, defaultMakeFlags
+, libterminfo
+, fetchNetBSD
+}:
+
+mkDerivation {
+  path = "tools/tic";
+  version = "9.2";
+  sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
+  HOSTPROG = "tic";
+  buildInputs = compatIfNeeded;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff nbperf rsync
+  ];
+  makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
+  extraPaths = [
+    libterminfo.src
+    (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
+    (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
new file mode 100644
index 0000000000000..334eccc64c551
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
@@ -0,0 +1,16 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+mkDerivation {
+  path = "usr.bin/tsort";
+  version = "9.2";
+  sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
new file mode 100644
index 0000000000000..dac9674f9d6f3
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
@@ -0,0 +1,10 @@
+{ lib, mkDerivation, stdenv }:
+
+mkDerivation {
+  path = "usr.bin/uudecode";
+  version = "9.2";
+  sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
+  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
+}
+
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 518ab4230156f..238c1b7e460b0 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -105,6 +105,8 @@ let
     # conflicting LLVM modules.
     objc4 = stdenv.objc4 or (callPackage ./libobjc.nix { });
 
+    sdkRoot = pkgs.callPackage ../apple-sdk/sdkRoot.nix { sdkVersion = "11.0"; };
+
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
     inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 962f7f681c49d..a3d1df0867a9a 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -352,5 +352,11 @@ in rec {
 
   inherit darwin-stubs;
 
+  objc4 = pkgs.darwin.libobjc;
+
+  sdkRoot = pkgs.callPackage ./sdkRoot.nix { sdkVersion = "10.12"; };
+
+  inherit (pkgs.darwin) Libsystem;
+
   inherit sdk;
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix b/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix
new file mode 100644
index 0000000000000..67d9cbe031059
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  runCommand,
+  writeText,
+  sdkVersion,
+}:
+
+let
+  sdkName = "MacOSX${sdkVersion}";
+  toolchainName = "com.apple.dt.toolchain.XcodeDefault";
+  productBuildVer = null;
+
+  inherit (lib.generators) toPlist toJSON;
+
+  SDKSettings = {
+    CanonicalName = "macosx${sdkVersion}";
+    DisplayName = "macOS ${sdkVersion}";
+    Toolchains = [ toolchainName ];
+    Version = sdkVersion;
+    MaximumDeploymentTarget = "${sdkVersion}.99";
+    isBaseSDK = "YES";
+  };
+
+  SystemVersion =
+    lib.optionalAttrs (productBuildVer != null) { ProductBuildVersion = productBuildVer; }
+    // {
+      ProductName = "macOS";
+      ProductVersion = sdkVersion;
+    };
+in
+runCommand "sdkroot-${sdkVersion}" { } ''
+  sdk="$out/${sdkName}.sdk"
+
+  install -D ${writeText "SDKSettings.plist" (toPlist { } SDKSettings)} "$sdk/SDKSettings.plist"
+  install -D ${writeText "SDKSettings.json" (toJSON { } SDKSettings)} "$sdk/SDKSettings.json"
+  install -D ${
+    writeText "SystemVersion.plist" (toPlist { } SystemVersion)
+  } "$sdk/System/Library/CoreServices/SystemVersion.plist"
+
+  ln -s "$sdk" "$sdk/usr"
+
+  install -D '${../../../build-support/setup-hooks/role.bash}' "$out/nix-support/setup-hook"
+  cat >> "$out/nix-support/setup-hook" <<-hook
+  #
+  # See comments in cc-wrapper's setup hook. This works exactly the same way.
+  #
+  [[ -z \''${strictDeps-} ]] || (( "\$hostOffset" < 0 )) || return 0
+
+  sdkRootHook() {
+    # See ../../../build-support/setup-hooks/role.bash
+    local role_post
+    getHostRoleEnvHook
+
+    # Only set the SDK root if one has not been set via this hook or some other means.
+    if [[ ! \$NIX_CFLAGS_COMPILE =~ isysroot ]]; then
+      export NIX_CFLAGS_COMPILE\''${role_post}+=' -isysroot $out/${sdkName}.sdk'
+    fi
+  }
+
+  # See ../../../build-support/setup-hooks/role.bash
+  getTargetRole
+
+  addEnvHooks "\$targetOffset" sdkRootHook
+
+  # No local scope in sourced file
+  unset -v role_post
+  hook
+''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 7415e99e506cf..87fb8512fb646 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -10,24 +10,13 @@
 let
   darling.src = fetchzip {
     url = "https://github.com/darlinghq/darling/archive/d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b.tar.gz";
-    sha256 = "11b51fw47nl505h63bgx5kqiyhf3glhp1q6jkpb6nqfislnzzkrf";
+    hash = "sha256-/YynrKJdi26Xj4lvp5wsN+TAhZjonOrNNHuk4L5tC7s=";
     postFetch = ''
-      # The archive contains both `src/opendirectory` and `src/OpenDirectory`,
-      # pre-create the directory to choose the canonical case on
-      # case-insensitive filesystems.
-      mkdir -p $out/src/OpenDirectory
-
-      cd $out
-      tar -xzf $downloadedFile --strip-components=1
-      rm -r $out/src/libm
-
-      # If `src/opendirectory` and `src/OpenDirectory` refer to different
-      # things, then combine them into `src/OpenDirectory` to match the result
-      # on case-insensitive filesystems.
-      if [ "$(stat -c %i src/opendirectory)" != "$(stat -c %i src/OpenDirectory)" ]; then
-        mv src/opendirectory/* src/OpenDirectory/
-        rmdir src/opendirectory
-      fi
+      # The archive contains both `src/opendirectory` and `src/OpenDirectory`.
+      # Since neither directory is used for anything, we just remove them to avoid
+      #  the potential issue where file systems with different case sensitivity produce
+      #  different hashes.
+      rm -rf $out/src/{OpenDirectory,opendirectory}
     '';
   };
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index e91ee86cde08f..176cb8646f1e5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -13,7 +13,7 @@ appleDerivation' stdenvNoCC {
     cp -r dispatch/*.h $out/include/dispatch
     cp -r os/object*.h  $out/include/os
 
-    # gcc compatability. Source: https://stackoverflow.com/a/28014302/3714556
+    # gcc compatibility. Source: https://stackoverflow.com/a/28014302/3714556
     substituteInPlace $out/include/dispatch/object.h \
       --replace 'typedef void (^dispatch_block_t)(void);' \
                 '#ifdef __clang__
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index d7bdac6ceea34..78c510f7da4cd 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -11,6 +11,7 @@ let
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
     "codesign_allocate"
   ];
+  isCCToolsLLVM = lib.getName cctools == "cctools-llvm";
 in
 
 # TODO: loop over targetPrefixed binaries too
@@ -33,7 +34,7 @@ stdenv.mkDerivation {
     # - strip: the binutils one seems to break mach-o files
     # - lipo: gcc build assumes it exists
     # - nm: the gnu one doesn't understand many new load commands
-    for i in ${lib.concatStringsSep " " (builtins.map (e: targetPrefix + e) cmds)}; do
+    for i in ${lib.concatStringsSep " " (map (e: targetPrefix + e) cmds)}; do
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
@@ -41,51 +42,59 @@ stdenv.mkDerivation {
 
     ln -s ${binutils-unwrapped.out}/share $out/share
 
-    ln -s ${cctools}/libexec $out/libexec
-
     mkdir -p "$man"/share/man/man{1,5}
-    for i in ${builtins.concatStringsSep " " cmds}; do
+    for i in ${lib.concatStringsSep " " cmds}; do
       for path in "${cctools.man}"/share/man/man?/$i.*; do
         dest_path="$man''${path#${cctools.man}}"
         ln -sv "$path" "$dest_path"
       done
     done
   ''
-  # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
-  # handle the arch. Proxying calls to clang produces quite a bit of warnings,
-  # and using clang directly here is a better option than relying on cctools.
-  # On x86_64-darwin the Clang version is too old to support this mode.
-  + lib.optionalString stdenv.isAarch64 ''
-    rm $out/bin/${targetPrefix}as
-    makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-      --add-flags "-x assembler -integrated-as -c"
-  ''
-  # x86-64 Darwin gnat-bootstrap emits assembly
-  # with MOVQ as the mnemonic for quadword interunit moves
-  # such as `movq %rbp, %xmm0`.
-  # The clang integrated assembler recognises this as valid,
-  # but unfortunately the cctools-port GNU assembler does not;
-  # it instead uses MOVD as the mnemonic.
-  # The assembly that a GCC build emits is determined at build time
-  # and cannot be changed afterwards.
-  #
-  # To build GNAT on x86-64 Darwin, therefore,
-  # we need both the clang _and_ the cctools-port assemblers to be available:
-  # the former to build at least the stage1 compiler,
-  # and the latter at least to be detectable
-  # as the target for the final compiler.
-  #
-  # We choose to match the Aarch64 case above,
-  # wrapping the clang integrated assembler as `as`.
-  # It then seems sensible to wrap the cctools GNU assembler as `gas`.
-  #
-  + lib.optionalString (stdenv.isx86_64 && dualAs) ''
-    mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
-    makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-      --add-flags "-x assembler -integrated-as -c"
-  '';
+  + lib.optionalString (!isCCToolsLLVM) (
+    # cctools-port has a `libexec` folder for `as`, but cctools-llvm uses the clang
+    # assembler on both platforms. Only link it when cctools is cctools-port.
+    ''
+      ln -s ${cctools}/libexec $out/libexec
+    ''
+    # cctools-llvm uses the LLVM assembler on both architectures, so use the assembler
+    # from that instead of relinking it.
+    #
+    # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
+    # handle the arch. Proxying calls to clang produces quite a bit of warnings,
+    # and using clang directly here is a better option than relying on cctools.
+    # On x86_64-darwin the Clang version is too old to support this mode.
+    + lib.optionalString stdenv.isAarch64 ''
+      rm $out/bin/${targetPrefix}as
+      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+        --add-flags "-x assembler -integrated-as -c"
+    ''
+    # x86-64 Darwin gnat-bootstrap emits assembly
+    # with MOVQ as the mnemonic for quadword interunit moves
+    # such as `movq %rbp, %xmm0`.
+    # The clang integrated assembler recognises this as valid,
+    # but unfortunately the cctools-port GNU assembler does not;
+    # it instead uses MOVD as the mnemonic.
+    # The assembly that a GCC build emits is determined at build time
+    # and cannot be changed afterwards.
+    #
+    # To build GNAT on x86-64 Darwin, therefore,
+    # we need both the clang _and_ the cctools-port assemblers to be available:
+    # the former to build at least the stage1 compiler,
+    # and the latter at least to be detectable
+    # as the target for the final compiler.
+    #
+    # We choose to match the Aarch64 case above,
+    # wrapping the clang integrated assembler as `as`.
+    # It then seems sensible to wrap the cctools GNU assembler as `gas`.
+    #
+    + lib.optionalString (stdenv.isx86_64 && dualAs) ''
+      mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
+      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+        --add-flags "-x assembler -integrated-as -c"
+    ''
+  );
 
-  nativeBuildInputs = lib.optionals (stdenv.isAarch64 || dualAs) [ makeWrapper ];
+  nativeBuildInputs = lib.optionals (!isCCToolsLLVM && (stdenv.isAarch64 || dualAs)) [ makeWrapper ];
 
   passthru = {
     inherit targetPrefix;
diff --git a/pkgs/os-specific/darwin/noah/default.nix b/pkgs/os-specific/darwin/noah/default.nix
index b8cb1424cdda2..ad63b796f1838 100644
--- a/pkgs/os-specific/darwin/noah/default.nix
+++ b/pkgs/os-specific/darwin/noah/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     description = "Bash on Ubuntu on macOS";
     homepage = "https://github.com/linux-noah/noah";
     license = [ licenses.mit licenses.gpl2 ];
-    maintainers = [ maintainers.marsam ];
+    maintainers = [ ];
     platforms = platforms.darwin;
     # never built on aarch64-darwin since first introduction in nixpkgs
     broken = stdenv.isDarwin && stdenv.isAarch64;
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index 9671b5885c828..b6626c4d4eade 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.71.3";
+  version = "1.72.0";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-jiGo4H38qAiGMh4ckswyeDcijYL2wbcjs+IubDFjobU=";
+    hash = "sha256-L6CXWRmBfit+uWODEWt7u71shFAadPOqtNifMnSp0BU=";
   };
 
   dontPatch = true;
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 0ada82d0e7580..ca83bb7db4c00 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.76";
+  version = "0.77";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-oHq5mLMWloi6Tf81rjcmUFGwIggtMdyLPqbD/gOzNHU=";
+    hash = "sha256-wViFngw6iwlOG7KsW+zqxjm9ZRJahscX0TYz7/7T5nw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
deleted file mode 100644
index 0cc820986c088..0000000000000
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, AppKit
-, Carbon
-, CoreAudio
-, CoreWLAN
-, CoreVideo
-, DisplayServices
-, IOKit
-, MediaRemote
-, SkyLight
-, testers
-, nix-update-script
-}:
-
-let
-  inherit (stdenv.hostPlatform) system;
-  target = {
-    "aarch64-darwin" = "arm64";
-    "x86_64-darwin" = "x86";
-  }.${system} or (throw "Unsupported system: ${system}");
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sketchybar";
-  version = "2.21.0";
-
-  src = fetchFromGitHub {
-    owner = "FelixKratz";
-    repo = "SketchyBar";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-hTfQQjx6ai83zYFfccsz/KaoZUIj5Dfz4ENe59gS02E=";
-  };
-
-  buildInputs = [
-    AppKit
-    Carbon
-    CoreAudio
-    CoreWLAN
-    CoreVideo
-    DisplayServices
-    IOKit
-    MediaRemote
-    SkyLight
-  ];
-
-  makeFlags = [
-    target
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    cp ./bin/sketchybar $out/bin/sketchybar
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      version = "sketchybar-v${finalAttrs.version}";
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "A highly customizable macOS status bar replacement";
-    homepage = "https://github.com/FelixKratz/SketchyBar";
-    license = lib.licenses.gpl3;
-    mainProgram = "sketchybar";
-    maintainers = with lib.maintainers; [ azuwis khaneliman ];
-    platforms = lib.platforms.darwin;
-  };
-})
diff --git a/pkgs/os-specific/darwin/skhd/default.nix b/pkgs/os-specific/darwin/skhd/default.nix
deleted file mode 100644
index 539e90562ec71..0000000000000
--- a/pkgs/os-specific/darwin/skhd/default.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, Carbon
-, Cocoa
-, testers
-, nix-update-script
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "skhd";
-  version = "0.3.9";
-
-  src = fetchFromGitHub {
-    owner = "koekeishiya";
-    repo = "skhd";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-fnkWws/g4BdHKDRhqoCpdPFUavOHdk8R7h7H1dAdAYI=";
-  };
-
-  buildInputs = [
-    Carbon
-    Cocoa
-  ];
-
-  makeFlags = [
-    "BUILD_PATH=$(out)/bin"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-
-  postInstall = ''
-    mkdir -p $out/Library/LaunchDaemons
-    cp ${./org.nixos.skhd.plist} $out/Library/LaunchDaemons/org.nixos.skhd.plist
-    substituteInPlace $out/Library/LaunchDaemons/org.nixos.skhd.plist --subst-var out
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      version = "skhd-v${finalAttrs.version}";
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Simple hotkey daemon for macOS";
-    homepage = "https://github.com/koekeishiya/skhd";
-    license = lib.licenses.mit;
-    mainProgram = "skhd";
-    maintainers = with lib.maintainers; [ cmacrae lnl7 periklis khaneliman ];
-    platforms = lib.platforms.darwin;
-  };
-})
diff --git a/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist b/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist
deleted file mode 100644
index e6624487740bc..0000000000000
--- a/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>org.nixos.skhd</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>@out@/bin/skhd</string>
-  </array>
-  <key>ProcessType</key>
-  <string>Interactive</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>@out@/bin:/nix/var/nix/profiles/default/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-  </dict>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <true/>
-</dict>
-</plist>
diff --git a/pkgs/os-specific/darwin/utm/default.nix b/pkgs/os-specific/darwin/utm/default.nix
index 50f84a254dfc2..4915b9b54d782 100644
--- a/pkgs/os-specific/darwin/utm/default.nix
+++ b/pkgs/os-specific/darwin/utm/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "utm";
-  version = "4.4.5";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
-    hash = "sha256-FlIPSWqY2V1akd/InS6BPEBfc8pomJ8jgDns7wvaOm8=";
+    hash = "sha256-pBRmtHXnw9BoFeaCCokk5hulChdEFl9dENbL8zzXMzs=";
   };
 
   nativeBuildInputs = [ undmg makeWrapper ];
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation rec {
       See https://docs.getutm.app/ for more information.
     '';
     homepage = "https://mac.getutm.app/";
-    changelog = "https://github.com/utmapp/${pname}/releases/tag/v${version}";
+    changelog = "https://github.com/utmapp/utm/releases/tag/v${version}";
     mainProgram = "UTM";
     license = licenses.asl20;
     platforms = platforms.darwin; # 11.3 is the minimum supported version as of UTM 4.
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 54250001d9eb0..1b7949dcb124d 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -3,7 +3,7 @@
 let requireXcode = version: sha256:
   let
     xip = "Xcode_" + version +  ".xip";
-    # TODO(alexfmpe): Find out how to validate the .xip signature in Linux
+
     unxip = if stdenv.buildPlatform.isDarwin
             then ''
               open -W ${xip}
@@ -14,7 +14,9 @@ let requireXcode = version: sha256:
               rm -rf ${xip}
               pbzx -n Content | cpio -i
               rm Content Metadata
+              rcodesign verify Xcode.app/Contents/MacOS/Xcode
             '';
+
     app = requireFile rec {
       name     = "Xcode.app";
       url      = "https://developer.apple.com/services-account/download?path=/Developer_Tools/Xcode_${version}/${xip}";
@@ -83,4 +85,3 @@ in lib.makeExtensible (self: {
   xcode_15_1 = requireXcode "15.1" "sha256-0djqoSamU87rCpjo50Un3cFg9wKf+pSczRko6uumGM0=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
-
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
deleted file mode 100644
index 150db493198fa..0000000000000
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ /dev/null
@@ -1,141 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchzip
-, installShellFiles
-, testers
-, writeShellScript
-, common-updater-scripts
-, curl
-, jq
-, xcodebuild
-, xxd
-, yabai
-, Carbon
-, Cocoa
-, ScriptingBridge
-, SkyLight
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "yabai";
-  version = "7.1.0";
-
-  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  env = {
-    # silence service.h error
-    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-  };
-
-  nativeBuildInputs = [
-    installShellFiles
-  ]
-  ++ lib.optionals stdenv.isx86_64 [
-    xcodebuild
-    xxd
-  ];
-
-  buildInputs = [ ] ++ lib.optionals stdenv.isx86_64 [
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
-  ];
-
-  dontConfigure = true;
-  dontBuild = stdenv.isAarch64;
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
-
-    cp ./bin/yabai $out/bin/yabai
-    ${lib.optionalString stdenv.isx86_64 "cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg"}
-    installManPage ./doc/yabai.1
-
-    runHook postInstall
-  '';
-
-  postPatch = lib.optionalString stdenv.isx86_64 /* bash */ ''
-    # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
-    # Since multilib doesnt work on darwin i dont know of a better way of handling this.
-    substituteInPlace makefile \
-    --replace "-arch arm64e" "" \
-    --replace "-arch arm64" "" \
-    --replace "clang" "${stdenv.cc.targetPrefix}clang"
-
-    # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
-    # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
-    # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
-    substituteInPlace src/workspace.m \
-    --replace 'return screen.safeAreaInsets.top;' 'return 0;'
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = yabai;
-      version = "yabai-v${finalAttrs.version}";
-    };
-
-    sources = {
-      # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
-      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
-      "aarch64-darwin" = fetchzip {
-        url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-88Sh2nizAQ0a0cnlnrkhb5x3VjHa372HhjHlmNjGdQ4=";
-      };
-      "x86_64-darwin" = fetchFromGitHub
-        {
-          owner = "koekeishiya";
-          repo = "yabai";
-          rev = "v${finalAttrs.version}";
-          hash = "sha256-5iC1U6tyUYFLjOfnIxCrjCjj2deUZ/rvsJN4jlrr2Tc=";
-        };
-    };
-
-    updateScript = writeShellScript "update-yabai" ''
-      set -o errexit
-      export PATH="${lib.makeBinPath [ curl jq common-updater-scripts ]}"
-      NEW_VERSION=$(curl --silent https://api.github.com/repos/koekeishiya/yabai/releases/latest | jq '.tag_name | ltrimstr("v")' --raw-output)
-      if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
-          echo "The new version same as the old version."
-          exit 0
-      fi
-      for platform in ${lib.escapeShellArgs finalAttrs.meta.platforms}; do
-        update-source-version "yabai" "0" "${lib.fakeHash}" --source-key="sources.$platform"
-        update-source-version "yabai" "$NEW_VERSION" --source-key="sources.$platform"
-      done
-    '';
-  };
-
-  meta = {
-    description = "A tiling window manager for macOS based on binary space partitioning";
-    longDescription = ''
-      yabai is a window management utility that is designed to work as an extension to the built-in
-      window manager of macOS. yabai allows you to control your windows, spaces and displays freely
-      using an intuitive command line interface and optionally set user-defined keyboard shortcuts
-      using skhd and other third-party software.
-    '';
-    homepage = "https://github.com/koekeishiya/yabai";
-    changelog = "https://github.com/koekeishiya/yabai/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    platforms = builtins.attrNames finalAttrs.passthru.sources;
-    mainProgram = "yabai";
-    maintainers = with lib.maintainers; [
-      cmacrae
-      shardy
-      ivar
-      khaneliman
-    ];
-    sourceProvenance = with lib.sourceTypes; [ ]
-      ++ lib.optionals stdenv.isx86_64 [
-      fromSource
-    ] ++ lib.optionals stdenv.isAarch64 [
-      binaryNativeCode
-    ];
-  };
-})
-
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index a0b91f6d778b7..3cf9b26f4fdda 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.29.1";
+  version = "0.30.0";
 
   disabled = !stdenv.isLinux;
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    hash = "sha256-+HYCweAI5axx0ZNFd/jLRXkUinRLDmKWMpLTk7FrEe0=";
+    hash = "sha256-ngGLGfLv2prnjhgaRPf8ea3oyy4129zGodR0Yz1QtCw=";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/below/default.nix b/pkgs/os-specific/linux/below/default.nix
index 3204bd7dcf277..5efc80357d8f1 100644
--- a/pkgs/os-specific/linux/below/default.nix
+++ b/pkgs/os-specific/linux/below/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "below";
-  version = "0.7.1";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "below";
     rev = "v${version}";
-    sha256 = "sha256-2mZBpvLPY6yrEAvB1YlFuaXJlmmNuZqhu3xWADNHbx0=";
+    sha256 = "sha256-87Fdx3Jqi3dNWM5DZl+UYs031qn2DoiiWd3IysT/glQ=";
   };
 
-  cargoHash = "sha256-cTNxWCd4YH5VuZh0GRfBNtHmLqCQ75uyHqROkv1jbRA=";
+  cargoHash = "sha256-y2fNypA0MrCdUI/K6QrZWw/5mkYafj2s6jrGHU2zGXw=";
 
   prePatch = ''sed -i "s,ExecStart=.*/bin,ExecStart=$out/bin," etc/below.service'';
   postInstall = ''
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ffeb82d9b41bf..33fa7663f46dd 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -167,6 +167,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ TethysSvensson qyliss ];
     platforms = platforms.linux;
-    priority = 10;
+    priority = 15; # below systemd (halt, init, poweroff, reboot) and coreutils
   };
 }
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 02a781d1f0cf0..754f8e1396152 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -19,7 +19,7 @@
 , pygobject3
 , pyxdg
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -55,7 +55,7 @@ buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
 
     # Python packages
     dbus-python
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index 13e2fc78b8219..7c1b031d83349 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
     description = "Tool to examine and tune power saving features";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
+    mainProgram = "cpupower";
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 33edbc0a4f732..0e32966615ac1 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.0";
+  version = "2.7.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-lAA6AM1agZRPRejcUp4M/Spv9im9LNIc9eV05GXa95U=";
+    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 5180917623e93..784024f8754d0 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "35";
+  version = "36";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Qwi9X5jXHiQ3TOWefzv/p7x8/JkQW1QgdYji5SpLej0=";
+    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/disable-test.patch b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
index 487967aea8406..14faf1907cc20 100644
--- a/pkgs/os-specific/linux/dbus-broker/disable-test.patch
+++ b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
@@ -1,11 +1,14 @@
---- b/src/meson.build
-+++ a/src/meson.build
-@@ -196,9 +195,6 @@
- test_fdlist = executable('test-fdlist', ['util/test-fdlist.c'], dependencies: dep_bus)
- test('Utility File-Desciptor Lists', test_fdlist)
-
--test_fs = executable('test-fs', ['util/test-fs.c'], dependencies: dep_bus)
--test('File System Helpers', test_fs)
+diff --git a/src/meson.build b/src/meson.build
+index 4b9bc71..221ed5c 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -202,9 +202,6 @@ test('Error Handling', test_error, suite: 'unit')
+ test_fdlist = executable('test-fdlist', sources: ['util/test-fdlist.c'], kwargs: test_kwargs)
+ test('Utility File-Desciptor Lists', test_fdlist, suite: 'unit')
+ 
+-test_fs = executable('test-fs', sources: ['util/test-fs.c'], kwargs: test_kwargs)
+-test('File System Helpers', test_fs, suite: 'unit')
 -
- test_match = executable('test-match', ['bus/test-match.c'], dependencies: dep_bus)
- test('D-Bus Match Handling', test_match)
+ test_match = executable('test-match', sources: ['bus/test-match.c'], kwargs: test_kwargs)
+ test('D-Bus Match Handling', test_match, suite: 'unit')
+ 
diff --git a/pkgs/os-specific/linux/device-tree/default.nix b/pkgs/os-specific/linux/device-tree/default.nix
index 1a50d799b4b12..a15a9e32137cd 100644
--- a/pkgs/os-specific/linux/device-tree/default.nix
+++ b/pkgs/os-specific/linux/device-tree/default.nix
@@ -32,7 +32,7 @@ with lib; {
     in ''
       mkdir -p $out
       cd "${base}"
-      find . -type f -name '*.dtb' -print0 \
+      find -L . -type f -name '*.dtb' -print0 \
         | xargs -0 cp -v --no-preserve=mode --target-directory "$out" --parents
 
       for dtb in $(find "$out" -type f -name '*.dtb'); do
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index f09dec758f740..3bfaad303516a 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dmidecode";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchurl {
     url = "mirror://savannah/dmidecode/dmidecode-${version}.tar.xz";
-    sha256 = "sha256-eddnNe6OJRluKnIpZM+Wg/WglYFQNTeISyVrATicwHM=";
+    sha256 = "sha256-5Axl8+w9r+Ma2DSaTvGpcSLTj2UATtZldeGo1XXdi64=";
   };
 
   makeFlags = [
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     description = "A tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
index efc771905e53a..106bcf71cd98c 100644
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drbd-${version}-${kernel.version}";
-  version = "9.2.7";
+  version = "9.2.8";
 
   src = fetchurl {
     url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${version}.tar.gz";
-    sha256 = "1355ns10z0fjgqsdpf09qfy01j8lg2n7zy4kclmar3s798n3mh56";
+    hash = "sha256-LqK1lPucab7wKvcB4VKGdvBIq+K9XtuO2m0DP5XtK3M=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -26,12 +26,12 @@ stdenv.mkDerivation rec {
   # 6.4 and newer provide a in-tree version of the handshake module https://www.kernel.org/doc/html/v6.4/networking/tls-handshake.html
   installPhase = ''
     runHook preInstall
-    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ${lib.optionalString (lib.versionOlder kernel.version "6.4") ''
-      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ''}
     runHook postInstall
   '';
@@ -41,6 +41,16 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
   '';
 
+  # builder.pl had complained about the same file (drbd.ko.xz) provided by two different packages
+  # builder.pl also had complained about different permissions between the files from the two packages
+  # The compression is required because the kernel has the CONFIG_MODULE_COMPRESS_XZ option enabled
+  postFixup = ''
+    for ko in $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9/*.ko; do
+      xz --compress -6 --threads=0 $ko
+      chmod 0444 $ko.xz
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -53,5 +63,6 @@ stdenv.mkDerivation rec {
        DRBD is a software-based, shared-nothing, replicated storage solution
        mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
     '';
+    broken = lib.versionAtLeast kernel.version "6.8"; # wait until next DRBD release for 6.8 support https://github.com/LINBIT/drbd/issues/87#issuecomment-2059323084
   };
 }
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
deleted file mode 100644
index d1d95b4d3f959..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
-
-stdenv.mkDerivation rec {
-  pname = "earlyoom";
-  version = "1.7";
-
-  src = fetchFromGitHub {
-    owner = "rfjakob";
-    repo = "earlyoom";
-    rev = "v${version}";
-    sha256 = "sha256-8YcT1TTlAet7F1U9Ginda4IApNqkudegOXqm8rnRGfc=";
-  };
-
-  nativeBuildInputs = lib.optionals withManpage [ pandoc installShellFiles ];
-
-  patches = [ ./fix-dbus-path.patch ];
-
-  makeFlags = [ "VERSION=${version}" ];
-
-  installPhase = ''
-    install -D earlyoom $out/bin/earlyoom
-  '' + lib.optionalString withManpage ''
-    installManPage earlyoom.1
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) earlyoom;
-  };
-
-  meta = with lib; {
-    description = "Early OOM Daemon for Linux";
-    mainProgram = "earlyoom";
-    homepage = "https://github.com/rfjakob/earlyoom";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [];
-  };
-}
diff --git a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch b/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
deleted file mode 100644
index e1c10cf82f96e..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/kill.c
-+++ b/kill.c
-@@ -55,7 +55,7 @@ static void notify(const char* summary, const char* body)
-     }
-     // Complete command line looks like this:
-     // dbus-send --system / net.nuetzlich.SystemNotifications.Notify 'string:summary text' 'string:and body text'
--    execl("/usr/bin/dbus-send", "dbus-send", "--system", "/", "net.nuetzlich.SystemNotifications.Notify",
-+    execlp("dbus-send", "dbus-send", "--system", "/", "net.nuetzlich.SystemNotifications.Notify",
-         summary2, body2, NULL);
-     warn("notify: exec failed: %s\n", strerror(errno));
-     exit(1);
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 9175f477bd607..9c16a341a478f 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.63";
+  version = "0.64";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-husK3eurfL1NhRHgJUdFP6sYLqeZ4NSHa/tU8PUWmGo=";
+    hash = "sha256-LONfgFgPg8KCDwtw//WTOYQT9RpnIskdHAWcgafOhcg=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,6 @@ stdenv.mkDerivation rec {
     changelog = "https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=${version}";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ mic92 dtzWill amaxine ];
+    maintainers = with maintainers; [ mic92 dtzWill ];
   };
 }
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
index 5936447ac9351..581382e4faf2d 100644
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/isc-projects/ethq";
     license = licenses.mpl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 2aec4f63229d8..25a82b1806ca5 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     broken = kernel.kernelOlder "4.19";
-    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${version}";
+    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${finalAttrs.version}";
     description = "Extensible Virtual Display Interface";
     homepage = "https://www.displaylink.com/";
     license = with licenses; [ lgpl21Only gpl2Only ];
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index dfa974e3e683c..610f9d31353e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -8,7 +8,6 @@
 , fetchurl
 , fetchpatch
 , glibmm
-, kernel
 , libavc1394
 , libconfig
 , libiec61883
@@ -22,7 +21,6 @@
 }:
 
 let
-  inherit (python3.pkgs) pyqt5 dbus-python;
   python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
 in
 mkDerivation rec {
@@ -61,7 +59,7 @@ mkDerivation rec {
     pkg-config
     which
     python
-    pyqt5
+    python3.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index af455e7ef61fa..57b4207e383d0 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , udev
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     rustc
     pkg-config
     rustPlatform.cargoSetupHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 98b9ff5d33881..952139bb35e20 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -6,10 +6,16 @@
 
 flutter.buildFlutterApplication rec {
   pname = "firmware-updater";
-  version = "unstable-2023-09-17";
+  version = "unstable-2024-18-04";
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
+  patches = [
+    ./upgrade-file.patch
+  ];
+
+  sourceRoot = "./source/packages/firmware_updater";
+
   gitHashes = {
     fwupd = "sha256-l/+HrrJk1mE2Mrau+NmoQ7bu9qhHU6wX68+m++9Hjd4=";
   };
@@ -17,23 +23,10 @@ flutter.buildFlutterApplication rec {
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "firmware-updater";
-    rev = "855999da8d3d0c9930e06f2d296d82b55aeff79e";
-    hash = "sha256-tIeEuHl+sCKd756NYPmxXiV1Sg2m9W0eGUtM/Iskeu8=";
+    rev = "e48bb3f693e5d76656a3e7bbc07be0fcbfa19f23";
+    hash = "sha256-SO3sDIsJCK4Sh51pXO4u6WX4zcFa6jQYu9E+WtVrjDE=";
   };
 
-  postPatch = ''
-    rm -f pubspec.lock
-    ln -s "${writeText "${pname}-overrides.yaml" (builtins.toJSON {
-      dependency_overrides = {
-        yaru = "^1.1.0";
-        yaru_icons = "^2.2.1";
-        yaru_widgets = "^3.1.0";
-        mockito = "^5.4.2";
-        test_api = "^0.6.1";
-      };
-    })}" pubspec_overrides.yaml
-  '';
-
   meta = with lib; {
     description = "Firmware Updater for Linux";
     mainProgram = "firmware-updater";
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
index 0ad3deb2394eb..2212f02278688 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
@@ -20,25 +20,15 @@
       "source": "hosted",
       "version": "5.13.0"
     },
-    "ansi_styles": {
-      "dependency": "transitive",
-      "description": {
-        "name": "ansi_styles",
-        "sha256": "9c656cc12b3c27b17dd982b2cc5c0cfdfbdabd7bc8f3ae5e8542d9867b47ce8a",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.2+1"
-    },
     "args": {
       "dependency": "transitive",
       "description": {
         "name": "args",
-        "sha256": "eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596",
+        "sha256": "7cf60b9f0cc88203c5a190b4cd62a99feea42759a7fa695010eb5de1c0b2252a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.0"
     },
     "async": {
       "dependency": "transitive",
@@ -84,31 +74,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_daemon",
-        "sha256": "5f02d73eb2ba16483e693f80bee4f088563a820e47d1027d4cdfe62b5bb43e65",
+        "sha256": "0343061a33da9c5810b2d6cee51945127d8f4c060b7fbdd9d54917f0a3feaaa1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "4.0.1"
     },
     "build_resolvers": {
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "6c4dd11d05d056e76320b828a1db0fc01ccd376922526f8e9d6c796a5adbac20",
+        "sha256": "339086358431fa15d7eca8b6a36e5d783728cf025e559b834f4609a1fcfb7b0a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.4.2"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "10c6bcdbf9d049a0b666702cf1cee4ddfdc38f02a19d35ae392863b47519848b",
+        "sha256": "3ac61a79bfb6f6cc11f693591063a7f19a7af628dc52f141743edac5c16e8c22",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.6"
+      "version": "2.4.9"
     },
     "build_runner_core": {
       "dependency": "transitive",
@@ -134,11 +124,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "ff627b645b28fb8bdb69e645f910c2458fd6b65f6585c3a53e0626024897dedf",
+        "sha256": "c7913a9737ee4007efedaffc968c049fd0f3d0e49109e778edc10de9426005cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.6.2"
+      "version": "8.9.2"
     },
     "characters": {
       "dependency": "transitive",
@@ -150,16 +140,6 @@
       "source": "hosted",
       "version": "1.3.0"
     },
-    "charcode": {
-      "dependency": "transitive",
-      "description": {
-        "name": "charcode",
-        "sha256": "fb98c0f6d12c920a02ee2d998da788bca066ca5f148492b7085ee23372b12306",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.3.1"
-    },
     "checked_yaml": {
       "dependency": "transitive",
       "description": {
@@ -170,26 +150,6 @@
       "source": "hosted",
       "version": "2.0.3"
     },
-    "cli_launcher": {
-      "dependency": "transitive",
-      "description": {
-        "name": "cli_launcher",
-        "sha256": "5e7e0282b79e8642edd6510ee468ae2976d847a0a29b3916e85f5fa1bfe24005",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.1"
-    },
-    "cli_util": {
-      "dependency": "transitive",
-      "description": {
-        "name": "cli_util",
-        "sha256": "b8db3080e59b2503ca9e7922c3df2072cf13992354d5e944074ffa836fba43b7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.4.0"
-    },
     "clock": {
       "dependency": "transitive",
       "description": {
@@ -204,31 +164,21 @@
       "dependency": "transitive",
       "description": {
         "name": "code_builder",
-        "sha256": "4ad01d6e56db961d29661561effde45e519939fdaeb46c351275b182eac70189",
+        "sha256": "f692079e25e7869c14132d39f223f8eec9830eb76131925143b2129c4bb01b37",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.0"
+      "version": "4.10.0"
     },
     "collection": {
       "dependency": "direct main",
       "description": {
         "name": "collection",
-        "sha256": "f092b211a4319e98e5ff58223576de6c2803db36221657b46c82574721240687",
+        "sha256": "ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.17.2"
-    },
-    "conventional_commit": {
-      "dependency": "transitive",
-      "description": {
-        "name": "conventional_commit",
-        "sha256": "dec15ad1118f029c618651a4359eb9135d8b88f761aa24e4016d061cd45948f2",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.6.0+1"
+      "version": "1.18.0"
     },
     "convert": {
       "dependency": "transitive",
@@ -274,31 +224,31 @@
       "dependency": "direct main",
       "description": {
         "name": "dbus",
-        "sha256": "6f07cba3f7b3448d42d015bfd3d53fe12e5b36da2423f23838efc1d5fb31a263",
+        "sha256": "365c771ac3b0e58845f39ec6deebc76e3276aa9922b0cc60840712094d9047ac",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.8"
+      "version": "0.7.10"
     },
     "diacritic": {
       "dependency": "transitive",
       "description": {
         "name": "diacritic",
-        "sha256": "a84e03ec2779375fb86430dbe9d8fba62c68376f2499097a5f6e75556babe706",
+        "sha256": "96db5db6149cbe4aa3cfcbfd170aca9b7648639be7e48025f9d458517f807fe4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4"
+      "version": "0.1.5"
     },
     "dio": {
       "dependency": "direct main",
       "description": {
         "name": "dio",
-        "sha256": "7d328c4d898a61efc3cd93655a0955858e29a0aa647f0f9e02d59b3bb275e2e8",
+        "sha256": "11e40df547d418cc0c4900a9318b26304e665da6fa4755399a9ff9efd09034b5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.6"
+      "version": "5.4.3+1"
     },
     "fake_async": {
       "dependency": "transitive",
@@ -314,21 +264,21 @@
       "dependency": "transitive",
       "description": {
         "name": "ffi",
-        "sha256": "7bf0adc28a23d395f19f3f1eb21dd7cfd1dd9f8e1c50051c069122e6853bc878",
+        "sha256": "493f37e7df1804778ff3a53bd691d8692ddf69702cf4c1c1096a2e41b4779e21",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.1.2"
     },
     "file": {
       "dependency": "direct main",
       "description": {
         "name": "file",
-        "sha256": "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d",
+        "sha256": "5fc22d7c25582e38ad9a8515372cd9a93834027aacf1801cf01164dac0ffa08c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.4"
+      "version": "7.0.0"
     },
     "fixnum": {
       "dependency": "transitive",
@@ -363,14 +313,14 @@
       "version": "3.0.0-beta.2"
     },
     "flutter_lints": {
-      "dependency": "direct dev",
+      "dependency": "transitive",
       "description": {
         "name": "flutter_lints",
-        "sha256": "2118df84ef0c3ca93f96123a616ae8540879991b8b57af2f81b76a7ada49b2a4",
+        "sha256": "9e8c3858111da373efc5aa341de011d9bd23e2c5c5e0c62bccf32438e192d7b1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.2"
+      "version": "3.0.2"
     },
     "flutter_localizations": {
       "dependency": "direct main",
@@ -382,21 +332,21 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_markdown",
-        "sha256": "2b206d397dd7836ea60035b2d43825c8a303a76a5098e66f42d55a753e18d431",
+        "sha256": "04c4722cc36ec5af38acc38ece70d22d3c2123c61305d555750a091517bbe504",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.17+1"
+      "version": "0.6.23"
     },
     "flutter_svg": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_svg",
-        "sha256": "8c5d68a82add3ca76d792f058b186a0599414f279f00ece4830b9b231b570338",
+        "sha256": "7b4ca6cf3304575fe9c8ec64813c8d02ee41d2afe60bcfe0678bcb5375d596a2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.7"
+      "version": "2.0.10+1"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -414,11 +364,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "freezed",
-        "sha256": "2df89855fe181baae3b6d714dc3c4317acf4fccd495a6f36e5e00f24144c6c3b",
+        "sha256": "a434911f643466d78462625df76fd9eb13e57348ff43fe1f77bbe909522c67a1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.1"
+      "version": "2.5.2"
     },
     "freezed_annotation": {
       "dependency": "direct main",
@@ -434,11 +384,11 @@
       "dependency": "transitive",
       "description": {
         "name": "frontend_server_client",
-        "sha256": "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612",
+        "sha256": "f64a0333a82f30b0cca061bc3d143813a486dc086b574bfb233b7c1372427694",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "4.0.0"
     },
     "fuchsia_remote_debug_protocol": {
       "dependency": "transitive",
@@ -461,11 +411,11 @@
       "dependency": "transitive",
       "description": {
         "name": "get_it",
-        "sha256": "529de303c739fca98cd7ece5fca500d8ff89649f1bb4b4e94fb20954abcd7468",
+        "sha256": "d85128a5dae4ea777324730dc65edd9c9f43155c109d5cc0a69cab74139fbac1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.6.0"
+      "version": "7.7.0"
     },
     "glob": {
       "dependency": "transitive",
@@ -521,11 +471,11 @@
       "dependency": "transitive",
       "description": {
         "name": "http",
-        "sha256": "759d1a329847dd0f39226c688d3e06a6b8679668e350e2891a6474f8b4bb8525",
+        "sha256": "761a297c042deedc1ffbb156d6e2af13886bb305c2a343a4d972504cd67dd938",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.2.1"
     },
     "http_multi_server": {
       "dependency": "transitive",
@@ -577,31 +527,61 @@
       "dependency": "transitive",
       "description": {
         "name": "js",
-        "sha256": "f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3",
+        "sha256": "c1b2e9b5ea78c45e1a0788d29606ba27dc5f71f019f32ca5140f61ef071838cf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.7"
+      "version": "0.7.1"
     },
     "json_annotation": {
       "dependency": "transitive",
       "description": {
         "name": "json_annotation",
-        "sha256": "b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467",
+        "sha256": "1ce844379ca14835a50d2f019a3099f419082cfdd231cd86a142af94dd5c6bb1",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.9.0"
+    },
+    "leak_tracker": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker",
+        "sha256": "78eb209deea09858f5269f5a5b02be4049535f568c07b275096836f01ea323fa",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.0.0"
+    },
+    "leak_tracker_flutter_testing": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker_flutter_testing",
+        "sha256": "b46c5e37c19120a8a01918cfaf293547f47269f7cb4b0058f21531c2465d6ef0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "leak_tracker_testing": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker_testing",
+        "sha256": "a597f72a664dbd293f3bfc51f9ba69816f84dcd403cdac7066cb3f6003f3ab47",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.8.1"
+      "version": "2.0.1"
     },
     "lints": {
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452",
+        "sha256": "cbf8d4b858bb0134ef3ef87841abdf8d63bfc255c266b7bf6b39daa1085c4290",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "3.0.0"
     },
     "list_counter": {
       "dependency": "transitive",
@@ -637,61 +617,51 @@
       "dependency": "transitive",
       "description": {
         "name": "markdown",
-        "sha256": "acf35edccc0463a9d7384e437c015a3535772e09714cf60e07eeef3a15870dcd",
+        "sha256": "ef2a1298144e3f985cc736b22e0ccdaf188b5b3970648f2d9dc13efd1d9df051",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.1.1"
+      "version": "7.2.2"
     },
     "matcher": {
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "1803e76e6653768d64ed8ff2e1e67bea3ad4b923eb5c56a295c3e634bad5960e",
+        "sha256": "d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.16"
+      "version": "0.12.16+1"
     },
     "material_color_utilities": {
       "dependency": "transitive",
       "description": {
         "name": "material_color_utilities",
-        "sha256": "9528f2f296073ff54cb9fee677df673ace1218163c3bc7628093e7eed5203d41",
+        "sha256": "0e0a020085b65b6083975e499759762399b4475f766c21668c4ecca34ea74e5a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.0"
-    },
-    "melos": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "melos",
-        "sha256": "3f22f6cc629d72acf3acc8a7f8563384550290fa30790efa328c9cf606aa17d7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.1.1"
+      "version": "0.8.0"
     },
     "meta": {
       "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3",
+        "sha256": "d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.1"
+      "version": "1.11.0"
     },
     "mime": {
       "dependency": "transitive",
       "description": {
         "name": "mime",
-        "sha256": "e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e",
+        "sha256": "2e123074287cc9fd6c09de8336dae606d1ddb88d9ac47358826db698c176a1f2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.4"
+      "version": "1.0.5"
     },
     "mockito": {
       "dependency": "direct dev",
@@ -703,16 +673,6 @@
       "source": "hosted",
       "version": "5.4.2"
     },
-    "mustache_template": {
-      "dependency": "transitive",
-      "description": {
-        "name": "mustache_template",
-        "sha256": "a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.0.0"
-    },
     "nested": {
       "dependency": "transitive",
       "description": {
@@ -737,11 +697,11 @@
       "dependency": "direct main",
       "description": {
         "name": "path",
-        "sha256": "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917",
+        "sha256": "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.8.3"
+      "version": "1.9.0"
     },
     "path_parsing": {
       "dependency": "transitive",
@@ -757,31 +717,31 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750",
+        "sha256": "c15605cd28af66339f8eb6fbe0e541bfe2d1b72d5825efc6598f3e0a31b9ad27",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.4.0"
+      "version": "6.0.2"
     },
     "platform": {
       "dependency": "transitive",
       "description": {
         "name": "platform",
-        "sha256": "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76",
+        "sha256": "12220bb4b65720483f8fa9450b4332347737cf8213dd2840d8b2c823e47243ec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.1.4"
     },
     "plugin_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "plugin_platform_interface",
-        "sha256": "43798d895c929056255600343db8f049921cbec94d31ec87f1dc5c16c01935dd",
+        "sha256": "4820fbfdb9478b1ebae27888254d445073732dae3d6ea81f0b7e06d5dedc3f02",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.1.8"
     },
     "pool": {
       "dependency": "transitive",
@@ -797,31 +757,21 @@
       "dependency": "transitive",
       "description": {
         "name": "process",
-        "sha256": "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.2.4"
-    },
-    "prompts": {
-      "dependency": "transitive",
-      "description": {
-        "name": "prompts",
-        "sha256": "3773b845e85a849f01e793c4fc18a45d52d7783b4cb6c0569fad19f9d0a774a1",
+        "sha256": "21e54fd2faf1b5bdd5102afd25012184a6793927648ea81eea80552ac9405b32",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.0"
+      "version": "5.0.2"
     },
     "provider": {
       "dependency": "direct main",
       "description": {
         "name": "provider",
-        "sha256": "cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f",
+        "sha256": "c8a055ee5ce3fd98d6fc872478b03823ffdb448699c6ebdbbc71d59b596fd48c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.5"
+      "version": "6.1.2"
     },
     "pub_semver": {
       "dependency": "transitive",
@@ -833,26 +783,6 @@
       "source": "hosted",
       "version": "2.1.4"
     },
-    "pub_updater": {
-      "dependency": "transitive",
-      "description": {
-        "name": "pub_updater",
-        "sha256": "b06600619c8c219065a548f8f7c192b3e080beff95488ed692780f48f69c0625",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.1"
-    },
-    "pubspec": {
-      "dependency": "transitive",
-      "description": {
-        "name": "pubspec",
-        "sha256": "f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.3.0"
-    },
     "pubspec_parse": {
       "dependency": "transitive",
       "description": {
@@ -863,25 +793,15 @@
       "source": "hosted",
       "version": "1.2.3"
     },
-    "quiver": {
-      "dependency": "transitive",
-      "description": {
-        "name": "quiver",
-        "sha256": "b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.2.1"
-    },
     "safe_change_notifier": {
       "dependency": "direct main",
       "description": {
         "name": "safe_change_notifier",
-        "sha256": "e69034655ea33aa7dce3c5bb33cf12fc7c07a0ce7d59b7291fd030b70d059570",
+        "sha256": "8d0645ec2706f580912c38de488439ddb491be48247826927b7bc2e54ea8f7af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.3.2"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -923,11 +843,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_gen",
-        "sha256": "fc0da689e5302edb6177fdd964efcb7f58912f43c28c2047a808f5bfff643d16",
+        "sha256": "14658ba5f669685cd3d63701d01b31ea748310f7ab854e471962670abcf57832",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.0"
     },
     "source_span": {
       "dependency": "transitive",
@@ -943,21 +863,31 @@
       "dependency": "transitive",
       "description": {
         "name": "stack_trace",
-        "sha256": "c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5",
+        "sha256": "73713990125a6d93122541237550ee3352a2d84baad52d375a4cad2eb9b7ce0b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.11.0"
+      "version": "1.11.1"
+    },
+    "state_notifier": {
+      "dependency": "transitive",
+      "description": {
+        "name": "state_notifier",
+        "sha256": "b8677376aa54f2d7c58280d5a007f9e8774f1968d1fb1c096adcb4792fba29bb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
     },
     "stream_channel": {
       "dependency": "transitive",
       "description": {
         "name": "stream_channel",
-        "sha256": "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8",
+        "sha256": "ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
     },
     "stream_transform": {
       "dependency": "transitive",
@@ -1000,7 +930,7 @@
       "version": "1.2.1"
     },
     "test_api": {
-      "dependency": "direct overridden",
+      "dependency": "transitive",
       "description": {
         "name": "test_api",
         "sha256": "5c2f730018264d276c20e4f1503fd1308dfbbae39ec8ee63c5236311ac06954b",
@@ -1029,55 +959,55 @@
       "source": "hosted",
       "version": "1.3.2"
     },
+    "ubuntu_lints": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "ubuntu_lints",
+        "sha256": "1c9fd31f3b3e24969f4c5e5ccf19e1665df3e27ce9ff22ca000e4f687c4772c4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.3.0"
+    },
     "ubuntu_localizations": {
       "dependency": "transitive",
       "description": {
         "name": "ubuntu_localizations",
-        "sha256": "a75e87b9f1c3dc678f69a943eb4cee8ccbd5b0db64d491750325950e311adab0",
+        "sha256": "eca4f43453339acca16b4b23a70b93315ab92b1500f98156a8f95af5e5078def",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.4"
+      "version": "0.3.6"
     },
     "ubuntu_logger": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_logger",
-        "sha256": "f6d663e5b9c33e90a7a77a2f15b7f76e90be1dd98a94b6640d7bd74db262060f",
+        "sha256": "90de0c496c2c35757e0d6a32d2e3555cb37e9c2d4aab356bad589f64234bcdcc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.3"
+      "version": "0.1.1"
     },
     "ubuntu_service": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_service",
-        "sha256": "f6ad4dfb099af41e750c59aad00d67a96e22df00f4962d2e25d56ae3db78be49",
+        "sha256": "b9845f972bcc919df79381b0eb42cceee1834b3232b3f444c0e4943d66d01901",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.4"
-    },
-    "ubuntu_session": {
-      "dependency": "direct main",
-      "description": {
-        "name": "ubuntu_session",
-        "sha256": "ce79fdd31faf7982b061b2e4a1cdd0815baf3b6b976e9c16c72609749511f3a1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.0.4"
+      "version": "0.3.2"
     },
     "ubuntu_test": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_test",
-        "sha256": "2361b741808a11d95c64a50666151d536133e75cade17b8feccca1e67364be88",
+        "sha256": "ed8e277575e74057e59363eced7c86b5c9cb172b560b7590ab911eed738e32e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.0-beta.6"
+      "version": "0.1.0-beta.9"
     },
     "upower": {
       "dependency": "direct main",
@@ -1089,45 +1019,35 @@
       "source": "hosted",
       "version": "0.7.0"
     },
-    "uri": {
-      "dependency": "transitive",
-      "description": {
-        "name": "uri",
-        "sha256": "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
     "vector_graphics": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics",
-        "sha256": "670f6e07aca990b4a2bcdc08a784193c4ccdd1932620244c3a86bb72a0eac67f",
+        "sha256": "32c3c684e02f9bc0afb0ae0aa653337a2fe022e8ab064bcd7ffda27a74e288e3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_codec",
-        "sha256": "7451721781d967db9933b63f5733b1c4533022c0ba373a01bdd79d1a5457f69f",
+        "sha256": "c86987475f162fadff579e7320c7ddda04cd2fdeffbe1129227a85d9ac9e03da",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_graphics_compiler": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "80a13c613c8bde758b1464a1755a7b3a8f2b6cec61fbf0f5a53c94c30f03ba2e",
+        "sha256": "12faff3f73b1741a36ca7e31b292ddeb629af819ca9efe9953b70bd63fc8cd81",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_math": {
       "dependency": "transitive",
@@ -1143,11 +1063,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "c620a6f783fa22436da68e42db7ebbf18b8c44b9a46ab911f666ff09ffd9153f",
+        "sha256": "b3d56ff4341b8f182b96aceb2fa20e3dcb336b9f867bc0eafc0de10f1048e957",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.7.1"
+      "version": "13.0.0"
     },
     "watcher": {
       "dependency": "transitive",
@@ -1163,54 +1083,54 @@
       "dependency": "transitive",
       "description": {
         "name": "web",
-        "sha256": "dc8ccd225a2005c1be616fe02951e2e342092edf968cf0844220383757ef8f10",
+        "sha256": "97da13628db363c635202ad97068d47c5b8aa555808e7a9411963c533b449b27",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4-beta"
+      "version": "0.5.1"
     },
     "web_socket_channel": {
       "dependency": "transitive",
       "description": {
         "name": "web_socket_channel",
-        "sha256": "d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b",
+        "sha256": "58c6666b342a38816b2e7e50ed0f1e261959630becd4c879c4f26bfa14aa5a42",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.5"
     },
     "webdriver": {
       "dependency": "transitive",
       "description": {
         "name": "webdriver",
-        "sha256": "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49",
+        "sha256": "003d7da9519e1e5f329422b36c4dcdf18d7d2978d1ba099ea4e45ba490ed845e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.2"
+      "version": "3.0.3"
     },
     "window_manager": {
       "dependency": "transitive",
       "description": {
         "name": "window_manager",
-        "sha256": "6ee795be9124f90660ea9d05e581a466de19e1c89ee74fc4bf528f60c8600edd",
+        "sha256": "b3c895bdf936c77b83c5254bec2e6b3f066710c1f89c38b20b8acc382b525494",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.6"
+      "version": "0.3.8"
     },
     "xml": {
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84",
+        "sha256": "b015a8ad1c488f66851d762d3090a21c600e479dc75e68328c52774040cf9226",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.0"
+      "version": "6.5.0"
     },
     "yaml": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "yaml",
         "sha256": "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5",
@@ -1219,25 +1139,15 @@
       "source": "hosted",
       "version": "3.1.2"
     },
-    "yaml_edit": {
-      "dependency": "transitive",
-      "description": {
-        "name": "yaml_edit",
-        "sha256": "1579d4a0340a83cf9e4d580ea51a16329c916973bffd5bd4b45e911b25d46bfd",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.1.1"
-    },
     "yaru": {
       "dependency": "direct main",
       "description": {
         "name": "yaru",
-        "sha256": "24047f0de452784840a326874192d26cb5ebd8cf5eac7864086e5bc9272a28db",
+        "sha256": "e9ccb22cb283ecf3f6b21d64dee9764d4abff65a44f48ce21aa13b9eae3e3be5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.2.2"
     },
     "yaru_color_generator": {
       "dependency": "transitive",
@@ -1263,51 +1173,51 @@
       "dependency": "direct main",
       "description": {
         "name": "yaru_icons",
-        "sha256": "cbb0b5945f407116fd8a1fbe7265e7ffa0d568249d496343a69cb5c55360bba1",
+        "sha256": "2dff89ee31c2dd888e1ce146f0faef1c8de4ffbc90cb6466aacd55c3a9ad0674",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.4.0"
     },
     "yaru_test": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_test",
-        "sha256": "9396269fbe026bb9c398b9d4308c76982090ddeca102e4846bd4ba595333ff0a",
+        "sha256": "a62539bd03465065e4067e1c88472d5789a7215bd4a0873f051abb7896ff0934",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4"
+      "version": "0.1.5"
     },
     "yaru_widgets": {
       "dependency": "direct main",
       "description": {
         "name": "yaru_widgets",
-        "sha256": "482a71ef5566c6cb4135272f0041bf8a9c35729bf9079b0d304eedfa2fa0cc0c",
+        "sha256": "0bade922090f25eedcc88cdc15b8a6adbaba4e4b56d793e999224b22c95a19d2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.6.0"
     },
     "yaru_window": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_window",
-        "sha256": "55c8f039d13aaa1b211a8cf0b7731ae2fdcac9b1be1e0994eb14ad1d17fecaf7",
+        "sha256": "c9d16f78962652ad71aa160ab0a1e2e5924359439303394f980fd00eefc905eb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3"
+      "version": "0.2.1"
     },
     "yaru_window_linux": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_window_linux",
-        "sha256": "c45606cf75880ae6427bbe176dc5313356f16c876c7013a19aeee782882c40c2",
+        "sha256": "3676355492eba0461f03acf1b7420f7885982d1bffe113fccdca9415fbe39f5d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3"
+      "version": "0.2.0"
     },
     "yaru_window_manager": {
       "dependency": "transitive",
@@ -1341,7 +1251,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.1.0-185.0.dev <4.0.0",
-    "flutter": ">=3.10.0"
+    "dart": ">=3.3.0 <4.0.0",
+    "flutter": ">=3.19.0"
   }
 }
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch b/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch
new file mode 100644
index 0000000000000..2c82fa8bbaf94
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch
@@ -0,0 +1,13 @@
+diff --git a/pubspec.yaml b/pubspec.yaml
+index e9dfa1f..ec9f2f2 100644
+--- a/pubspec.yaml
++++ b/pubspec.yaml
+@@ -10,7 +10,7 @@ dependencies:
+   collection: ^1.17.2
+   dbus: ^0.7.8
+   dio: ^5.3.3
+-  file: ^6.1.4
++  file: ^7.0.0
+   flutter:
+     sdk: flutter
+   flutter_html: ^3.0.0-beta.2
diff --git a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
index acbc0d556224c..d89c4a7b140a5 100644
--- a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwupd-efi";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchurl {
-    url = "https://people.freedesktop.org/~hughsient/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RdKneTGzYkFt7CY22r9O/w0doQvBzMoayYDoMv7buhI=";
+    url = "https://github.com/fwupd/fwupd-efi/releases/download/${version}/fwupd-efi-${version}.tar.xz";
+    hash = "sha256-r9CAWirQgafK/y71vABM46AUe1OAFejsqWY0FxaxJg4=";
   };
 
   nativeBuildInputs = [
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ amaxine ];
+    maintainers = with maintainers; [ ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index 1d23411f3eefc..a73cc1896ecdc 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,43 +1,38 @@
 { stdenv
 , lib
-, fetchFromGitLab
-, cmake
+, fetchFromGitHub
 , pkg-config
-, libusb1
-, libftdi1
+, hostname
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "0-unstable-2023-12-15";
+  version = "unstable-2022-12-03";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.howett.net";
+  src = fetchFromGitHub {
     owner = "DHowett";
-    repo = "ectool";
-    rev = "3ebe7b8b713b2ebfe2ce92d48fd8d044276b2879";
-    hash = "sha256-s6PrFPAL+XJAENqLw5oJqFmAf11tHOJ8h3F5l3pOlZ4=";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
   };
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    hostname
   ];
 
-  buildInputs = [
-    libusb1
-    libftdi1
-  ];
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
 
   installPhase = ''
-    runHook preInstall
-    install -Dm555 src/ectool "$out/bin/ectool"
-    runHook postInstall
+    install -D out/util/ectool $out/bin/ectool
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://gitlab.howett.net/DHowett/ectool";
+    homepage = "https://github.com/DHowett/framework-ec";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index 02ca3d30d238c..11791a664c8bb 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "google-authenticator-libpam";
-  version = "1.09";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "google-authenticator-libpam";
     rev = version;
-    hash = "sha256-DS0h6FWMNKnSSj039bH6iyWrERa5M7LBSkbyig6pyxY=";
+    hash = "sha256-KEfwQeJIuRF+S3gPn+maDb8Fu0FRXLs2/Nlbjj2d3AE=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index e082038730111..d274c375fb42c 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -21,7 +21,7 @@
 # can be turned off if used as a library
 , useGtk ? true
 , gtk3 ? null
-, wrapGAppsHook ? null
+, wrapGAppsHook3 ? null
 }:
 
 assert pulseaudioSupport -> libpulseaudio != null;
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     intltool
     pkg-config
   ]
-    ++ lib.optionals (useGtk) [ wrapGAppsHook ]
+    ++ lib.optionals (useGtk) [ wrapGAppsHook3 ]
     ++ lib.optionals (useQt) [ wrapQtAppsHook ]
   ;
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index f7303b182ec74..83519d7f2a7ac 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.380";
+  version = "0.381";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Ioa0tUiwgOZO3qrtwAr9A/yGfYTBk83OON8Sr47J9Mg=";
+    hash = "sha256-FD1p4qyO+ZsBdMXRa9u6CpO07RewWH8OxULLxcYAsyk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index f4a250d4a84c8..e686e06804197 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.09.28717.12";
+  version = "24.13.29138.7";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-RzXV6icenMcQxmOfKA8Tpb6FigLXz3ZyoL0n16+jFRc=";
+    hash = "sha256-AMIuA1AMrSX0xpdGSfye8iUJTk5s9HDiRy9Yy3kZss8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index e2e4384908a8c..67914b0c4e276 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , buildPackages, bison, flex, pkg-config
-, db, iptables, libelf, libmnl
+, db, iptables, elfutils, libmnl
 , gitUpdater
 }:
 
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  configureFlags = [
+    "--color" "auto"
+  ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
@@ -46,7 +50,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [ bison flex pkg-config ];
-  buildInputs = [ db iptables libelf libmnl ];
+  buildInputs = [ db iptables elfutils libmnl ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index a15d21f2c3a1b..5c1d153b83fc9 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-YWtiI2HkGyIdUeBXerQtN5UvgaMaUs9eoG88ZUQRrDg=";
+    hash = "sha256-o/Q8vUtB4Yiz1x+/6+8LUKUQNtiAmwcdh++/tTUN4mM=";
   };
 
   outputs = [ "out" "man" "doc" ]
@@ -81,9 +81,9 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     substituteInPlace $out/share/dbus-1/system-services/net.connman.ead.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
     substituteInPlace $out/share/dbus-1/system-services/net.connman.iwd.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
   '';
 
   enableParallelBuilding = true;
@@ -98,6 +98,6 @@ stdenv.mkDerivation rec {
     description = "Wireless daemon for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ dtzWill fpletz amaxine ];
+    maintainers = with maintainers; [ dtzWill fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 77c6ee031956d..37c138402d006 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -12,9 +12,13 @@
 , rustc
 , rustPlatform
 , rust-bindgen
+# testing
+, emptyFile
+, nixos
 , nixosTests
 }@args':
 
+let overridableKernel =
 lib.makeOverridable ({ # The kernel source tarball.
   src
 
@@ -211,11 +215,15 @@ let
   }; # end of configfile derivation
 
   kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
-    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
+    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile modDirVersion;
     pos = builtins.unsafeGetAttrPos "version" args;
 
-    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
-  } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
+    config = {
+      CONFIG_MODULES = "y";
+      CONFIG_FW_LOADER = "m";
+      CONFIG_RUST = if withRust then "y" else "n";
+    };
+  });
 
 in
 kernel.overrideAttrs (finalAttrs: previousAttrs: {
@@ -241,7 +249,41 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
             + toString (lib.attrNames (lib.toFunction args { }))
           ) overridableKernel;
       };
-    in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
+      /* Certain arguments must be evaluated lazily; so that only the output(s) depend on them.
+         Original reproducer / simplified use case:
+       */
+      versionDoesNotDependOnPatchesEtcNixOS =
+        builtins.seq
+          (nixos ({ config, pkgs, ... }: {
+              boot.kernelPatches = [
+                (builtins.seq config.boot.kernelPackages.kernel.version { patch = pkgs.emptyFile; })
+              ];
+          })).config.boot.kernelPackages.kernel.outPath
+          emptyFile;
+      versionDoesNotDependOnPatchesEtc =
+        builtins.seq
+          (import ./generic.nix args' (args // (
+          let explain = attrName:
+            ''
+              The ${attrName} attribute must be able to access the kernel.version attribute without an infinite recursion.
+              That means that the kernel attrset (attrNames) and the kernel.version attribute must not depend on the ${attrName} argument.
+              The fact that this exception is raised shows that such a dependency does exist.
+              This is a problem for the configurability of ${attrName} in version-aware logic such as that in NixOS.
+              Strictness can creep in through optional attributes, or assertions and warnings that run as part of code that shouldn't access what is checked.
+            '';
+          in {
+            kernelPatches = throw (explain "kernelPatches");
+            structuredExtraConfig = throw (explain "structuredExtraConfig");
+            modDirVersion = throw (explain "modDirVersion");
+          }))).version
+          emptyFile;
+    in [
+      (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel)
+      versionDoesNotDependOnPatchesEtc
+      # Disabled by default, because the infinite recursion is hard to understand. The other test's error is better and produces a shorter trace.
+      # versionDoesNotDependOnPatchesEtcNixOS
+    ] ++ kernelTests;
   };
 
-}))
+}));
+in overridableKernel
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 50e6512b15e69..b69c0f9c6003d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,34 +1,34 @@
 {
     "testing": {
-        "version": "6.9-rc4",
-        "hash": "sha256:11wpak03nv9cg00jiyfrk21p7mzka553ih2c2dxr0ridig6mj8b3"
+        "version": "6.9-rc6",
+        "hash": "sha256:075l5vhk8zmwln4jks7gr5n5k67s65qvs07l2rpbc7a75fdp6c14"
     },
     "6.1": {
-        "version": "6.1.87",
-        "hash": "sha256:092iv5w5d6kwgiyzs7zajmhdxc1w03sinvvr1dwy9bp8f9mg2ypw"
+        "version": "6.1.90",
+        "hash": "sha256:07cfg0chssvpc4mqls3aln6s4lqjp6k4x2n63wndmkjgfqpdg8w3"
     },
     "5.15": {
-        "version": "5.15.156",
-        "hash": "sha256:0y3p7sqr8hsn0v9ybqlcmn1z150zc13yckgrymb10sck9k8na14z"
+        "version": "5.15.158",
+        "hash": "sha256:1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr"
     },
     "5.10": {
-        "version": "5.10.215",
-        "hash": "sha256:1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747"
+        "version": "5.10.216",
+        "hash": "sha256:0lg1zfb9y4ps86q85mlnyalb3s90zix003z62jb9bw139f65h473"
     },
     "5.4": {
-        "version": "5.4.274",
-        "hash": "sha256:1m4yyyv48mfkzhqms88dv1jf39zsfp88az5zpqynmm1wlhhv9iza"
+        "version": "5.4.275",
+        "hash": "sha256:0k1hyknx854k8z27j4rq1gcp8l0xc0bspmrhc41a033gjilb1lns"
     },
     "4.19": {
-        "version": "4.19.312",
-        "hash": "sha256:0jppa4p73pssd7m3jpc7i6rgnj9gawjcgk4wmqyy87ijzrgzm553"
+        "version": "4.19.313",
+        "hash": "sha256:1j1r4mrdh1ray468jr5i8d2afiswb653bhq0ck8bcdw4rwp5w558"
     },
     "6.6": {
-        "version": "6.6.28",
-        "hash": "sha256:151kdpp25fcl5qki138jxl90h9iyk5rk0kp2xamadnz72gnid1w1"
+        "version": "6.6.30",
+        "hash": "sha256:1ilwmgpgvddwkd9nx5999cb6z18scjyq7jklid26k1hg7f35nsmn"
     },
     "6.8": {
-        "version": "6.8.7",
-        "hash": "sha256:1bigq9my88d9xh647hgsy8gzval7p06hhacpxaqb71sfmwgil799"
+        "version": "6.8.9",
+        "hash": "sha256:1dn9bgmf03bdfbmgq98d043702g808rjikxs2i9yia57iqiz21gr"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 92f71e6496ab7..3344808ca2789 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19536";
-    sha256 = "1lwg4340nga0sn5jcsqrmqskf2cf4vvjhkbdl0h54bj3lcnbxaw4";
+    rev = "19546";
+    sha256 = "1yyj7pbfs02fki1rdxfj9gcrxdrl26igisy4fji7czcc9xbw03qm";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 337594115fa6f..b013c7f1bf181 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.213-rt105"; # updated by ./update-rt.sh
+  version = "5.10.215-rt107"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "105df7w6m5a3fngi6ajqs5qblaq4lbxsgcppllrk7v1r68i31kw4";
+    sha256 = "1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1q5kz3mfvwb4fd5i2mbklsa6gifb8g3wbq0wi2478q097dvmb6gi";
+      sha256 = "0lnnpnfmypafzfzhcmaxqqc18nna4fr236v6hrcyabnxmxam79xj";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 5b222c4b45eff..cab04ad0c7d80 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -26,7 +26,7 @@ in lib.makeOverridable ({
   extraMakeFlags ? [],
   # The name of the kernel module directory
   # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
-  modDirVersion ? lib.versions.pad 3 version,
+  modDirVersion ? null /* derive from version */,
   # The kernel source (tarball, git checkout, etc.)
   src,
   # a list of { name=..., patch=..., extraConfig=...} patches
@@ -54,6 +54,13 @@ in lib.makeOverridable ({
 }:
 
 let
+  # Provide defaults. Note that we support `null` so that callers don't need to use optionalAttrs,
+  # which can lead to unnecessary strictness and infinite recursions.
+  modDirVersion_ = if modDirVersion == null then lib.versions.pad 3 version else modDirVersion;
+in
+let
+  # Shadow the un-defaulted parameter; don't want null.
+  modDirVersion = modDirVersion_;
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index bce7d7d0dcb3b..20100774395e1 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -79,4 +79,18 @@
       hash = "sha256-q3iNBo8t4b1Rn5k5lau2myqOAqdA/9V9A+ok2jGkLdY=";
     };
   };
+
+  rust_1_77-6_8 = {
+    name = "rust-1.77.patch";
+    patch = fetchurl {
+      name = "rust-1.77.patch";
+      url = "https://lore.kernel.org/rust-for-linux/20240217002717.57507-1-ojeda@kernel.org/raw";
+      hash = "sha256-0KW9nHpJeMSDssCPXWZbrN8kxq5bA434t+XuPfwslUc=";
+    };
+  };
+
+  rust_1_77-6_9 = {
+    name = "rust-1.77.patch";
+    patch = ./rust-1.77.patch;
+  };
 }
diff --git a/pkgs/os-specific/linux/kernel/rust-1.77.patch b/pkgs/os-specific/linux/kernel/rust-1.77.patch
new file mode 100644
index 0000000000000..8bd0a5e337154
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/rust-1.77.patch
@@ -0,0 +1,792 @@
+From d69265b7d756931b2e763a3262f22ba4100895a0 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 17 Feb 2024 01:27:17 +0100
+Subject: [PATCH] rust: upgrade to Rust 1.77.0
+
+This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.0
+(i.e. the latest) [1].
+
+See the upgrade policy [2] and the comments on the first upgrade in
+commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2").
+
+The `offset_of` feature (single-field `offset_of!`) that we were using
+got stabilized in Rust 1.77.0 [3].
+
+Therefore, now the only unstable features allowed to be used outside the
+`kernel` crate is `new_uninit`, though other code to be upstreamed may
+increase the list.
+
+Please see [4] for details.
+
+Rust 1.77.0 merged the `unused_tuple_struct_fields` lint into `dead_code`,
+thus upgrading it from `allow` to `warn` [5]. In turn, this makes `rustc`
+complain about the `ThisModule`'s pointer field being never read. Thus
+locally `allow` it for the moment, since we will have users later on
+(e.g. Binder needs a `as_ptr` method [6]).
+
+Rust 1.77.0 introduces the `--check-cfg` feature [7], for which there
+is a Call for Testing going on [8]. We were requested to test it and
+we found it useful [9] -- we will likely enable it in the future.
+
+The vast majority of changes are due to our `alloc` fork being upgraded
+at once.
+
+There are two kinds of changes to be aware of: the ones coming from
+upstream, which we should follow as closely as possible, and the updates
+needed in our added fallible APIs to keep them matching the newer
+infallible APIs coming from upstream.
+
+Instead of taking a look at the diff of this patch, an alternative
+approach is reviewing a diff of the changes between upstream `alloc` and
+the kernel's. This allows to easily inspect the kernel additions only,
+especially to check if the fallible methods we already have still match
+the infallible ones in the new version coming from upstream.
+
+Another approach is reviewing the changes introduced in the additions in
+the kernel fork between the two versions. This is useful to spot
+potentially unintended changes to our additions.
+
+To apply these approaches, one may follow steps similar to the following
+to generate a pair of patches that show the differences between upstream
+Rust and the kernel (for the subset of `alloc` we use) before and after
+applying this patch:
+
+    # Get the difference with respect to the old version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > old.patch
+    git -C linux restore rust/alloc
+
+    # Apply this patch.
+    git -C linux am rust-upgrade.patch
+
+    # Get the difference with respect to the new version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > new.patch
+    git -C linux restore rust/alloc
+
+Now one may check the `new.patch` to take a look at the additions (first
+approach) or at the difference between those two patches (second
+approach). For the latter, a side-by-side tool is recommended.
+
+Link: https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1770-2024-03-21 [1]
+Link: https://rust-for-linux.com/rust-version-policy [2]
+Link: https://github.com/rust-lang/rust/pull/118799 [3]
+Link: https://github.com/Rust-for-Linux/linux/issues/2 [4]
+Link: https://github.com/rust-lang/rust/pull/118297 [5]
+Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-2-08ba9197f637@google.com/#Z31rust:kernel:lib.rs [6]
+Link: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/check-cfg.html [7]
+Link: https://github.com/rust-lang/rfcs/pull/3013#issuecomment-1936648479 [8]
+Link: https://github.com/rust-lang/rust/issues/82450#issuecomment-1947462977 [9]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Link: https://lore.kernel.org/r/20240217002717.57507-1-ojeda@kernel.org
+Link: https://github.com/Rust-for-Linux/linux/commit/d69265b7d756931b2e763a3262f22ba4100895a0
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+---
+ Documentation/process/changes.rst |   2 +-
+ rust/alloc/alloc.rs               |   6 +-
+ rust/alloc/boxed.rs               |   4 +-
+ rust/alloc/lib.rs                 |   7 +-
+ rust/alloc/raw_vec.rs             |  13 ++--
+ rust/alloc/slice.rs               |   4 +-
+ rust/alloc/vec/into_iter.rs       | 108 +++++++++++++++++++-----------
+ rust/alloc/vec/mod.rs             | 101 +++++++++++++++++++---------
+ rust/kernel/lib.rs                |   3 +-
+ scripts/Makefile.build            |   2 +-
+ scripts/min-tool-version.sh       |   2 +-
+ 11 files changed, 161 insertions(+), 91 deletions(-)
+
+diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
+index 7ef8de58f7f892..879ee628893ae1 100644
+--- a/Documentation/process/changes.rst
++++ b/Documentation/process/changes.rst
+@@ -31,7 +31,7 @@ you probably needn't concern yourself with pcmciautils.
+ ====================== ===============  ========================================
+ GNU C                  5.1              gcc --version
+ Clang/LLVM (optional)  13.0.1           clang --version
+-Rust (optional)        1.76.0           rustc --version
++Rust (optional)        1.77.0           rustc --version
+ bindgen (optional)     0.65.1           bindgen --version
+ GNU make               3.82             make --version
+ bash                   4.2              bash --version
+diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
+index abb791cc23715a..b1204f87227b23 100644
+--- a/rust/alloc/alloc.rs
++++ b/rust/alloc/alloc.rs
+@@ -5,7 +5,7 @@
+ #![stable(feature = "alloc_module", since = "1.28.0")]
+ 
+ #[cfg(not(test))]
+-use core::intrinsics;
++use core::hint;
+ 
+ #[cfg(not(test))]
+ use core::ptr::{self, NonNull};
+@@ -210,7 +210,7 @@ impl Global {
+                 let new_size = new_layout.size();
+ 
+                 // `realloc` probably checks for `new_size >= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size >= old_layout.size());
++                hint::assert_unchecked(new_size >= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+@@ -301,7 +301,7 @@ unsafe impl Allocator for Global {
+             // SAFETY: `new_size` is non-zero. Other conditions must be upheld by the caller
+             new_size if old_layout.align() == new_layout.align() => unsafe {
+                 // `realloc` probably checks for `new_size <= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size <= old_layout.size());
++                hint::assert_unchecked(new_size <= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
+index c93a22a5c97f14..5fc39dfeb8e7bf 100644
+--- a/rust/alloc/boxed.rs
++++ b/rust/alloc/boxed.rs
+@@ -26,6 +26,7 @@
+ //! Creating a recursive data structure:
+ //!
+ //! ```
++//! ##[allow(dead_code)]
+ //! #[derive(Debug)]
+ //! enum List<T> {
+ //!     Cons(T, Box<List<T>>),
+@@ -194,8 +195,7 @@ mod thin;
+ #[fundamental]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ // The declaration of the `Box` struct must be kept in sync with the
+-// `alloc::alloc::box_free` function or ICEs will happen. See the comment
+-// on `box_free` for more details.
++// compiler or ICEs will happen.
+ pub struct Box<
+     T: ?Sized,
+     #[unstable(feature = "allocator_api", issue = "32838")] A: Allocator = Global,
+diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
+index 36f79c07559338..39afd55ec0749e 100644
+--- a/rust/alloc/lib.rs
++++ b/rust/alloc/lib.rs
+@@ -105,7 +105,6 @@
+ #![feature(allocator_api)]
+ #![feature(array_chunks)]
+ #![feature(array_into_iter_constructors)]
+-#![feature(array_methods)]
+ #![feature(array_windows)]
+ #![feature(ascii_char)]
+ #![feature(assert_matches)]
+@@ -122,7 +121,6 @@
+ #![feature(const_size_of_val)]
+ #![feature(const_waker)]
+ #![feature(core_intrinsics)]
+-#![feature(core_panic)]
+ #![feature(deprecated_suggestion)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(error_generic_member_access)]
+@@ -132,6 +130,7 @@
+ #![feature(fmt_internals)]
+ #![feature(fn_traits)]
+ #![feature(hasher_prefixfree_extras)]
++#![feature(hint_assert_unchecked)]
+ #![feature(inline_const)]
+ #![feature(inplace_iteration)]
+ #![feature(iter_advance_by)]
+@@ -141,6 +140,8 @@
+ #![feature(maybe_uninit_slice)]
+ #![feature(maybe_uninit_uninit_array)]
+ #![feature(maybe_uninit_uninit_array_transpose)]
++#![feature(non_null_convenience)]
++#![feature(panic_internals)]
+ #![feature(pattern)]
+ #![feature(ptr_internals)]
+ #![feature(ptr_metadata)]
+@@ -149,7 +150,6 @@
+ #![feature(set_ptr_value)]
+ #![feature(sized_type_properties)]
+ #![feature(slice_from_ptr_range)]
+-#![feature(slice_group_by)]
+ #![feature(slice_ptr_get)]
+ #![feature(slice_ptr_len)]
+ #![feature(slice_range)]
+@@ -182,6 +182,7 @@
+ #![feature(const_ptr_write)]
+ #![feature(const_trait_impl)]
+ #![feature(const_try)]
++#![feature(decl_macro)]
+ #![feature(dropck_eyepatch)]
+ #![feature(exclusive_range_pattern)]
+ #![feature(fundamental)]
+diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
+index 98b6abf30af6e4..1839d1c8ee7a04 100644
+--- a/rust/alloc/raw_vec.rs
++++ b/rust/alloc/raw_vec.rs
+@@ -4,7 +4,7 @@
+ 
+ use core::alloc::LayoutError;
+ use core::cmp;
+-use core::intrinsics;
++use core::hint;
+ use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
+ use core::ptr::{self, NonNull, Unique};
+ use core::slice;
+@@ -317,7 +317,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -358,7 +358,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -381,7 +381,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -402,7 +402,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -553,7 +553,7 @@ where
+         debug_assert_eq!(old_layout.align(), new_layout.align());
+         unsafe {
+             // The allocator checks for alignment equality
+-            intrinsics::assume(old_layout.align() == new_layout.align());
++            hint::assert_unchecked(old_layout.align() == new_layout.align());
+             alloc.grow(ptr, old_layout, new_layout)
+         }
+     } else {
+@@ -591,7 +591,6 @@ fn handle_reserve(result: Result<(), TryReserveError>) {
+ // `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
+ // an extra guard for this in case we're running on a platform which can use
+ // all 4GB in user-space, e.g., PAE or x32.
+-
+ #[inline]
+ fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
+     if usize::BITS < 64 && alloc_size > isize::MAX as usize {
+diff --git a/rust/alloc/slice.rs b/rust/alloc/slice.rs
+index 1181836da5f462..a36b072c95195f 100644
+--- a/rust/alloc/slice.rs
++++ b/rust/alloc/slice.rs
+@@ -53,14 +53,14 @@ pub use core::slice::{from_mut, from_ref};
+ pub use core::slice::{from_mut_ptr_range, from_ptr_range};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{from_raw_parts, from_raw_parts_mut};
++#[stable(feature = "slice_group_by", since = "1.77.0")]
++pub use core::slice::{ChunkBy, ChunkByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Chunks, Windows};
+ #[stable(feature = "chunks_exact", since = "1.31.0")]
+ pub use core::slice::{ChunksExact, ChunksExactMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{ChunksMut, Split, SplitMut};
+-#[unstable(feature = "slice_group_by", issue = "80552")]
+-pub use core::slice::{GroupBy, GroupByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Iter, IterMut};
+ #[stable(feature = "rchunks", since = "1.31.0")]
+diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
+index 136bfe94af6c83..0f11744c44b34c 100644
+--- a/rust/alloc/vec/into_iter.rs
++++ b/rust/alloc/vec/into_iter.rs
+@@ -20,6 +20,17 @@ use core::ops::Deref;
+ use core::ptr::{self, NonNull};
+ use core::slice::{self};
+ 
++macro non_null {
++    (mut $place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { &mut *(ptr::addr_of_mut!($place) as *mut NonNull<$t>) }
++    }},
++    ($place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { *(ptr::addr_of!($place) as *const NonNull<$t>) }
++    }},
++}
++
+ /// An iterator that moves out of a vector.
+ ///
+ /// This `struct` is created by the `into_iter` method on [`Vec`](super::Vec)
+@@ -43,10 +54,12 @@ pub struct IntoIter<
+     // the drop impl reconstructs a RawVec from buf, cap and alloc
+     // to avoid dropping the allocator twice we need to wrap it into ManuallyDrop
+     pub(super) alloc: ManuallyDrop<A>,
+-    pub(super) ptr: *const T,
+-    pub(super) end: *const T, // If T is a ZST, this is actually ptr+len. This encoding is picked so that
+-                              // ptr == end is a quick test for the Iterator being empty, that works
+-                              // for both ZST and non-ZST.
++    pub(super) ptr: NonNull<T>,
++    /// If T is a ZST, this is actually ptr+len. This encoding is picked so that
++    /// ptr == end is a quick test for the Iterator being empty, that works
++    /// for both ZST and non-ZST.
++    /// For non-ZSTs the pointer is treated as `NonNull<T>`
++    pub(super) end: *const T,
+ }
+ 
+ #[stable(feature = "vec_intoiter_debug", since = "1.13.0")]
+@@ -70,7 +83,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     /// ```
+     #[stable(feature = "vec_into_iter_as_slice", since = "1.15.0")]
+     pub fn as_slice(&self) -> &[T] {
+-        unsafe { slice::from_raw_parts(self.ptr, self.len()) }
++        unsafe { slice::from_raw_parts(self.ptr.as_ptr(), self.len()) }
+     }
+ 
+     /// Returns the remaining items of this iterator as a mutable slice.
+@@ -99,7 +112,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     }
+ 
+     fn as_raw_mut_slice(&mut self) -> *mut [T] {
+-        ptr::slice_from_raw_parts_mut(self.ptr as *mut T, self.len())
++        ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), self.len())
+     }
+ 
+     /// Drops remaining elements and relinquishes the backing allocation.
+@@ -126,7 +139,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+         // this creates less assembly
+         self.cap = 0;
+         self.buf = unsafe { NonNull::new_unchecked(RawVec::NEW.ptr()) };
+-        self.ptr = self.buf.as_ptr();
++        self.ptr = self.buf;
+         self.end = self.buf.as_ptr();
+ 
+         // Dropping the remaining elements can panic, so this needs to be
+@@ -138,9 +151,9 @@ impl<T, A: Allocator> IntoIter<T, A> {
+ 
+     /// Forgets to Drop the remaining elements while still allowing the backing allocation to be freed.
+     pub(crate) fn forget_remaining_elements(&mut self) {
+-        // For th ZST case, it is crucial that we mutate `end` here, not `ptr`.
++        // For the ZST case, it is crucial that we mutate `end` here, not `ptr`.
+         // `ptr` must stay aligned, while `end` may be unaligned.
+-        self.end = self.ptr;
++        self.end = self.ptr.as_ptr();
+     }
+ 
+     #[cfg(not(no_global_oom_handling))]
+@@ -162,7 +175,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+                 // say that they're all at the beginning of the "allocation".
+                 0..this.len()
+             } else {
+-                this.ptr.sub_ptr(buf)..this.end.sub_ptr(buf)
++                this.ptr.sub_ptr(this.buf)..this.end.sub_ptr(buf)
+             };
+             let cap = this.cap;
+             let alloc = ManuallyDrop::take(&mut this.alloc);
+@@ -189,29 +202,35 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ 
+     #[inline]
+     fn next(&mut self) -> Option<T> {
+-        if self.ptr == self.end {
+-            None
+-        } else if T::IS_ZST {
+-            // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
+-            // reducing the `end`.
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.ptr.as_ptr() == self.end as *mut _ {
++                None
++            } else {
++                // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
++                // reducing the `end`.
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            let old = self.ptr;
+-            self.ptr = unsafe { self.ptr.add(1) };
++            if self.ptr == non_null!(self.end, T) {
++                None
++            } else {
++                let old = self.ptr;
++                self.ptr = unsafe { old.add(1) };
+ 
+-            Some(unsafe { ptr::read(old) })
++                Some(unsafe { ptr::read(old.as_ptr()) })
++            }
+         }
+     }
+ 
+     #[inline]
+     fn size_hint(&self) -> (usize, Option<usize>) {
+         let exact = if T::IS_ZST {
+-            self.end.addr().wrapping_sub(self.ptr.addr())
++            self.end.addr().wrapping_sub(self.ptr.as_ptr().addr())
+         } else {
+-            unsafe { self.end.sub_ptr(self.ptr) }
++            unsafe { non_null!(self.end, T).sub_ptr(self.ptr) }
+         };
+         (exact, Some(exact))
+     }
+@@ -219,7 +238,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+     #[inline]
+     fn advance_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
+         let step_size = self.len().min(n);
+-        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr as *mut T, step_size);
++        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), step_size);
+         if T::IS_ZST {
+             // See `next` for why we sub `end` here.
+             self.end = self.end.wrapping_byte_sub(step_size);
+@@ -261,7 +280,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+             // Safety: `len` indicates that this many elements are available and we just checked that
+             // it fits into the array.
+             unsafe {
+-                ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, len);
++                ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, len);
+                 self.forget_remaining_elements();
+                 return Err(array::IntoIter::new_unchecked(raw_ary, 0..len));
+             }
+@@ -270,7 +289,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Safety: `len` is larger than the array size. Copy a fixed amount here to fully initialize
+         // the array.
+         return unsafe {
+-            ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, N);
++            ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, N);
+             self.ptr = self.ptr.add(N);
+             Ok(raw_ary.transpose().assume_init())
+         };
+@@ -288,7 +307,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Also note the implementation of `Self: TrustedRandomAccess` requires
+         // that `T: Copy` so reading elements from the buffer doesn't invalidate
+         // them for `Drop`.
+-        unsafe { if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) } }
++        unsafe { if T::IS_ZST { mem::zeroed() } else { self.ptr.add(i).read() } }
+     }
+ }
+ 
+@@ -296,18 +315,25 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+     #[inline]
+     fn next_back(&mut self) -> Option<T> {
+-        if self.end == self.ptr {
+-            None
+-        } else if T::IS_ZST {
+-            // See above for why 'ptr.offset' isn't used
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.end as *mut _ == self.ptr.as_ptr() {
++                None
++            } else {
++                // See above for why 'ptr.offset' isn't used
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            self.end = unsafe { self.end.sub(1) };
++            if non_null!(self.end, T) == self.ptr {
++                None
++            } else {
++                let new_end = unsafe { non_null!(self.end, T).sub(1) };
++                *non_null!(mut self.end, T) = new_end;
+ 
+-            Some(unsafe { ptr::read(self.end) })
++                Some(unsafe { ptr::read(new_end.as_ptr()) })
++            }
+         }
+     }
+ 
+@@ -333,7 +359,11 @@ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T, A: Allocator> ExactSizeIterator for IntoIter<T, A> {
+     fn is_empty(&self) -> bool {
+-        self.ptr == self.end
++        if T::IS_ZST {
++            self.ptr.as_ptr() == self.end as *mut _
++        } else {
++            self.ptr == non_null!(self.end, T)
++        }
+     }
+ }
+ 
+diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
+index 220fb9d6f45b3f..0be27fff4554a1 100644
+--- a/rust/alloc/vec/mod.rs
++++ b/rust/alloc/vec/mod.rs
+@@ -360,7 +360,7 @@ mod spec_extend;
+ ///
+ /// `vec![x; n]`, `vec![a, b, c, d]`, and
+ /// [`Vec::with_capacity(n)`][`Vec::with_capacity`], will all produce a `Vec`
+-/// with exactly the requested capacity. If <code>[len] == [capacity]</code>,
++/// with at least the requested capacity. If <code>[len] == [capacity]</code>,
+ /// (as is the case for the [`vec!`] macro), then a `Vec<T>` can be converted to
+ /// and from a [`Box<[T]>`][owned slice] without reallocating or moving the elements.
+ ///
+@@ -447,7 +447,7 @@ impl<T> Vec<T> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -690,7 +690,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1013,7 +1013,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1043,7 +1043,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1140,8 +1140,11 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Shrinks the capacity of the vector as much as possible.
+     ///
+-    /// It will drop down as close as possible to the length but the allocator
+-    /// may still inform the vector that there is space for a few more elements.
++    /// The behavior of this method depends on the allocator, which may either shrink the vector
++    /// in-place or reallocate. The resulting vector might still have some excess capacity, just as
++    /// is the case for [`with_capacity`]. See [`Allocator::shrink`] for more details.
++    ///
++    /// [`with_capacity`]: Vec::with_capacity
+     ///
+     /// # Examples
+     ///
+@@ -1191,10 +1194,10 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Converts the vector into [`Box<[T]>`][owned slice].
+     ///
+-    /// If the vector has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`shrink_to_fit`].
+     ///
+     /// [owned slice]: Box
++    /// [`shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+@@ -2017,7 +2020,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2133,7 +2136,7 @@ impl<T, A: Allocator> Vec<T, A> {
+         } else {
+             unsafe {
+                 self.len -= 1;
+-                core::intrinsics::assume(self.len < self.capacity());
++                core::hint::assert_unchecked(self.len < self.capacity());
+                 Some(ptr::read(self.as_ptr().add(self.len())))
+             }
+         }
+@@ -2143,7 +2146,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2315,6 +2318,12 @@ impl<T, A: Allocator> Vec<T, A> {
+     /// `[at, len)`. After the call, the original vector will be left containing
+     /// the elements `[0, at)` with its previous capacity unchanged.
+     ///
++    /// - If you want to take ownership of the entire contents and capacity of
++    ///   the vector, see [`mem::take`] or [`mem::replace`].
++    /// - If you don't need the returned vector at all, see [`Vec::truncate`].
++    /// - If you want to take ownership of an arbitrary subslice, or you don't
++    ///   necessarily want to store the removed items in a vector, see [`Vec::drain`].
++    ///
+     /// # Panics
+     ///
+     /// Panics if `at > len`.
+@@ -2346,14 +2355,6 @@ impl<T, A: Allocator> Vec<T, A> {
+             assert_failed(at, self.len());
+         }
+ 
+-        if at == 0 {
+-            // the new vector can take over the original buffer and avoid the copy
+-            return mem::replace(
+-                self,
+-                Vec::with_capacity_in(self.capacity(), self.allocator().clone()),
+-            );
+-        }
+-
+         let other_len = self.len - at;
+         let mut other = Vec::with_capacity_in(other_len, self.allocator().clone());
+ 
+@@ -3027,6 +3028,50 @@ impl<T, I: SliceIndex<[T]>, A: Allocator> IndexMut<I> for Vec<T, A> {
+     }
+ }
+ 
++/// Collects an iterator into a Vec, commonly called via [`Iterator::collect()`]
++///
++/// # Allocation behavior
++///
++/// In general `Vec` does not guarantee any particular growth or allocation strategy.
++/// That also applies to this trait impl.
++///
++/// **Note:** This section covers implementation details and is therefore exempt from
++/// stability guarantees.
++///
++/// Vec may use any or none of the following strategies,
++/// depending on the supplied iterator:
++///
++/// * preallocate based on [`Iterator::size_hint()`]
++///   * and panic if the number of items is outside the provided lower/upper bounds
++/// * use an amortized growth strategy similar to `pushing` one item at a time
++/// * perform the iteration in-place on the original allocation backing the iterator
++///
++/// The last case warrants some attention. It is an optimization that in many cases reduces peak memory
++/// consumption and improves cache locality. But when big, short-lived allocations are created,
++/// only a small fraction of their items get collected, no further use is made of the spare capacity
++/// and the resulting `Vec` is moved into a longer-lived structure, then this can lead to the large
++/// allocations having their lifetimes unnecessarily extended which can result in increased memory
++/// footprint.
++///
++/// In cases where this is an issue, the excess capacity can be discarded with [`Vec::shrink_to()`],
++/// [`Vec::shrink_to_fit()`] or by collecting into [`Box<[T]>`][owned slice] instead, which additionally reduces
++/// the size of the long-lived struct.
++///
++/// [owned slice]: Box
++///
++/// ```rust
++/// # use std::sync::Mutex;
++/// static LONG_LIVED: Mutex<Vec<Vec<u16>>> = Mutex::new(Vec::new());
++///
++/// for i in 0..10 {
++///     let big_temporary: Vec<u16> = (0..1024).collect();
++///     // discard most items
++///     let mut result: Vec<_> = big_temporary.into_iter().filter(|i| i % 100 == 0).collect();
++///     // without this a lot of unused capacity might be moved into the global
++///     result.shrink_to_fit();
++///     LONG_LIVED.lock().unwrap().push(result);
++/// }
++/// ```
+ #[cfg(not(no_global_oom_handling))]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T> FromIterator<T> for Vec<T> {
+@@ -3069,14 +3114,8 @@ impl<T, A: Allocator> IntoIterator for Vec<T, A> {
+                 begin.add(me.len()) as *const T
+             };
+             let cap = me.buf.capacity();
+-            IntoIter {
+-                buf: NonNull::new_unchecked(begin),
+-                phantom: PhantomData,
+-                cap,
+-                alloc,
+-                ptr: begin,
+-                end,
+-            }
++            let buf = NonNull::new_unchecked(begin);
++            IntoIter { buf, phantom: PhantomData, cap, alloc, ptr: buf, end }
+         }
+     }
+ }
+@@ -3598,8 +3637,10 @@ impl<T, A: Allocator> From<Box<[T], A>> for Vec<T, A> {
+ impl<T, A: Allocator> From<Vec<T, A>> for Box<[T], A> {
+     /// Convert a vector into a boxed slice.
+     ///
+-    /// If `v` has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`Vec::shrink_to_fit`].
++    ///
++    /// [owned slice]: Box
++    /// [`Vec::shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
+index be68d5e567b1a1..71f95e5aa09abd 100644
+--- a/rust/kernel/lib.rs
++++ b/rust/kernel/lib.rs
+@@ -16,7 +16,6 @@
+ #![feature(coerce_unsized)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(new_uninit)]
+-#![feature(offset_of)]
+ #![feature(receiver_trait)]
+ #![feature(unsize)]
+ 
+@@ -78,7 +77,7 @@ pub trait Module: Sized + Sync {
+ /// Equivalent to `THIS_MODULE` in the C API.
+ ///
+ /// C header: [`include/linux/export.h`](srctree/include/linux/export.h)
+-pub struct ThisModule(*mut bindings::module);
++pub struct ThisModule(#[allow(dead_code)] *mut bindings::module);
+ 
+ // SAFETY: `THIS_MODULE` may be used from all threads within a module.
+ unsafe impl Sync for ThisModule {}
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index baf86c0880b6d7..367cfeea74c5f5 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -263,7 +263,7 @@ $(obj)/%.lst: $(src)/%.c FORCE
+ # Compile Rust sources (.rs)
+ # ---------------------------------------------------------------------------
+ 
+-rust_allowed_features := new_uninit,offset_of
++rust_allowed_features := new_uninit
+ 
+ # `--out-dir` is required to avoid temporaries being created by `rustc` in the
+ # current working directory, which may be not accessible in the out-of-tree
+diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh
+index 5927cc6b7de338..cc5141b67b4a71 100755
+--- a/scripts/min-tool-version.sh
++++ b/scripts/min-tool-version.sh
+@@ -33,7 +33,7 @@ llvm)
+ 	fi
+ 	;;
+ rustc)
+-	echo 1.76.0
++	echo 1.77.0
+ 	;;
+ bindgen)
+ 	echo 0.65.1
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index c09f5c485e432..b7840b554beee 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.27";
-    hash = "sha256-MYvt7QWRdUybbhva6B4MOYrwnJfuu/qvMlnaGKcO1Hw=";
+    version = "6.6.29";
+    hash = "sha256-Be2VaW0DQDS0FJUwXM627QaNgrn1B3Hbyq+PiKb7b+k=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.6";
-    hash = "sha256-7GsiIl3rcLm/u2zxrjpP6dTxn7w/6at22gaU//mLlzw=";
+    version = "6.8.8";
+    hash = "sha256-6fT9vRjHw775m4ySUAUWU9R0dz/cWYYdZsPCwZjGiXM=";
     variant = "main";
   };
 
@@ -45,6 +45,9 @@ let
       HZ = freeform "250";
       HZ_250 = yes;
       HZ_1000 = no;
+
+      # Disable writeback throttling by default
+      BLK_WBT_MQ = lib.mkOverride 60 no;
     };
 
     extraMeta = {
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index c62f9047fc60b..530fd767bb909 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.26";
+  version = "2.0.28";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
+    sha256 = "sha256-0vDvhy854v5LGwH+tisAATgyByObn4BB+YqVVkFh0FM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
index 6d6c604b1c054..eeccf301ee95b 100644
--- a/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lenovo-legion-app";
-  version = "0.0.9";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
     rev = "v${version}-prerelease";
-    hash = "sha256-PQdxfDfW3sn0wWjmsPoAt3HZ43PS3Tyez3/0KEVVZQg=";
+    hash = "sha256-BNrRv9EBmNINQbAw+BzVxKl/XoDgH1tsNZHJxfSpNoU=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     pyqt5
+    pyqt6
     argcomplete
     pyyaml
     darkdetect
@@ -26,13 +27,13 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace ./setup.cfg \
-      --replace "_VERSION" "${version}"
+      --replace-fail "_VERSION" "${version}"
     substituteInPlace ../../extra/service/fancurve-set \
-      --replace "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
+      --replace-fail "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
     substituteInPlace ./legion_linux/legion.py \
-      --replace "/etc/legion_linux" "$out/share/legion_linux"
-    substituteInPlace ./legion_linux/legion_gui{,_user}.desktop \
-      --replace "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
+      --replace-fail "/etc/legion_linux" "$out/share/legion_linux"
+    substituteInPlace ./legion_linux/legion_gui.desktop \
+      --replace-fail "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 22c162023e1c9..99454beb41878 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-wVCBLJK9nlS1N9/DrQtogoZmgWW4ECqInSeQTjUFhcY=";
+    sha256 = "sha256-3TCsIlr28vO6Zu9lDaEq6J4J+D5sHP7SSo1O/M0ZzUo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 59aa5bbc0e5d0..478b5fa8ac2cc 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
+    hash = "sha256-O6UpTRy9+pivqs+8ALavntK4PoohgXGF39hEzIx6xv8=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
index 34c798ca3355a..7346e0d67d391 100644
--- a/pkgs/os-specific/linux/libnvme/default.nix
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "C Library for NVM Express on Linux";
     homepage = "https://github.com/linux-nvme/libnvme";
-    maintainers = with maintainers; [ fogti vifino ];
+    maintainers = with maintainers; [ vifino ];
     license = with licenses; [ lgpl21Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libzbc/default.nix b/pkgs/os-specific/linux/libzbc/default.nix
index 94f5c93f949bb..79a4277a85603 100644
--- a/pkgs/os-specific/linux/libzbc/default.nix
+++ b/pkgs/os-specific/linux/libzbc/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ZBC device manipulation library";
     homepage = "https://github.com/westerndigitalcorporation/libzbc";
-    maintainers = [ maintainers.fogti ];
+    maintainers = [ ];
     license = with licenses; [ bsd2 lgpl3Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libzbd/default.nix b/pkgs/os-specific/linux/libzbd/default.nix
index 4675a13837587..3bc48d0657b27 100644
--- a/pkgs/os-specific/linux/libzbd/default.nix
+++ b/pkgs/os-specific/linux/libzbd/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "Zoned block device manipulation library and tools";
     mainProgram = "zbd";
     homepage = "https://github.com/westerndigitalcorporation/libzbd";
-    maintainers = [ maintainers.fogti ];
+    maintainers = [ ];
     license = with licenses; [ lgpl3Plus gpl3Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/lxc/add-meson-options.patch b/pkgs/os-specific/linux/lxc/add-meson-options.patch
deleted file mode 100644
index 01aea4df27473..0000000000000
--- a/pkgs/os-specific/linux/lxc/add-meson-options.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 21a8705d0..f12b81442 100644
---- a/meson.build
-+++ b/meson.build
-@@ -50,7 +50,7 @@ rootfsmount = get_option('rootfs-mount-path')
- user_network_db_opt = get_option('usernet-db-path')
- user_network_conf_opt = get_option('usernet-config-path')
- 
--bashcompletiondir = join_paths('/', 'usr', 'share', 'bash-completion', 'completions')
-+bashcompletiondir = join_paths(prefixdir, get_option('datadir'), 'bash-completion', 'completions')
- bindir = join_paths(prefixdir, get_option('bindir'))
- datadir = join_paths(prefixdir, get_option('datadir'))
- mandir = join_paths(prefixdir, get_option('mandir'))
-@@ -123,22 +123,6 @@ conf.set('PACKAGE_VERSION', meson.project_version())
- conf.set('RUNTIME_PATH', runtimepath)
- conf.set('SYSCONFDIR', sysconfdir)
- 
--# Set sysconfdir
--fs = import('fs')
--distrosysconfdir = get_option('distrosysconfdir')
--if distrosysconfdir != ''
--    distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--elif fs.is_dir('/etc/sysconfig')
--    distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--elif fs.is_dir('/etc/default')
--    distrosysconfdir = join_paths(sysconfdir, 'default')
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--else
--    error('"distrosysconfdir" is not set')
--endif
--
- # Cross-compile on Android.
- srcconf.set10('IS_BIONIC', host_machine.system() == 'android')
- 
-@@ -148,6 +132,7 @@ coverity = get_option('coverity-build')
- init_script = get_option('init-script')
- sanitize = get_option('b_sanitize')
- want_examples = get_option('examples')
-+want_install_init = get_option('install-init-files')
- want_io_uring = get_option('io-uring-event-loop')
- want_pam_cgroup = get_option('pam-cgroup')
- want_mans = get_option('man')
-@@ -160,10 +145,30 @@ want_openssl = get_option('openssl')
- want_selinux = get_option('selinux')
- want_oss_fuzz = get_option('oss-fuzz')
- want_seccomp = get_option('seccomp')
-+want_spec = get_option('specfile')
-+want_state_dirs = get_option('install-state-dirs')
- want_thread_safety = get_option('thread-safety')
- want_memfd_rexec = get_option('memfd-rexec')
- want_sd_bus = get_option('sd-bus')
- 
-+# Set sysconfdir
-+fs = import('fs')
-+if want_install_init
-+    distrosysconfdir = get_option('distrosysconfdir')
-+    if distrosysconfdir != ''
-+        distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    elif fs.is_dir('/etc/sysconfig')
-+        distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    elif fs.is_dir('/etc/default')
-+        distrosysconfdir = join_paths(sysconfdir, 'default')
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    else
-+        error('"distrosysconfdir" is not set')
-+    endif
-+endif
-+
- srcconf.set_quoted('DEFAULT_CGROUP_PATTERN', cgrouppattern)
- if coverity
-     srcconf.set('ENABLE_COVERITY_BUILD', 1)
-@@ -926,14 +931,16 @@ if want_apparmor
- endif
- subdir('config/bash')
- subdir('config/etc')
--subdir('config/init/common')
--subdir('config/init/systemd')
--subdir('config/init/sysvinit')
--subdir('config/init/upstart')
-+if want_install_init
-+    subdir('config/init/common')
-+    subdir('config/init/systemd')
-+    subdir('config/init/sysvinit')
-+    subdir('config/init/upstart')
-+    subdir('config/sysconfig')
-+endif
- if want_selinux
-     subdir('config/selinux')
- endif
--subdir('config/sysconfig')
- subdir('config/templates')
- subdir('config/templates/common.conf.d')
- subdir('config/yum')
-@@ -963,21 +970,25 @@ pkg_config_file = pkgconfig.generate(liblxc,
- )
- 
- # Empty dirs.
--install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
--install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
-+if want_state_dirs
-+    install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
-+    install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
-+endif
- 
- # RPM spec file.
--specconf = configuration_data()
--specconf.set('LXC_VERSION_BASE', meson.project_version())
--specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
--specconf.set('PACKAGE', meson.project_name())
--specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
--
--configure_file(
--    configuration: specconf,
--    input: 'lxc.spec.in',
--    output: 'lxc.spec',
--    install: false)
-+if want_spec
-+    specconf = configuration_data()
-+    specconf.set('LXC_VERSION_BASE', meson.project_version())
-+    specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
-+    specconf.set('PACKAGE', meson.project_name())
-+    specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
-+
-+    configure_file(
-+        configuration: specconf,
-+        input: 'lxc.spec.in',
-+        output: 'lxc.spec',
-+        install: false)
-+endif
- 
- # Build overview.
- status = [
-diff --git a/meson_options.txt b/meson_options.txt
-index 9803473d2..84a6d45b5 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -120,3 +120,12 @@ option('memfd-rexec', type : 'boolean', value : 'true',
- 
- option('distrosysconfdir', type : 'string', value: '',
-        description: 'relative path to sysconfdir for distro default configuration')
-+
-+option('specfile', type : 'boolean', value: true,
-+       description: 'whether to prepare RPM spec')
-+
-+option('install-init-files', type : 'boolean', value: true,
-+       description: 'whether to install init files for local init (e.g. systemd, sysvinit)')
-+
-+option('install-state-dirs', type : 'boolean', value: true,
-+       description: 'whether to create state directories on install')
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
deleted file mode 100644
index 71de8ce3cdcc1..0000000000000
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  docbook2x,
-  libapparmor,
-  libcap,
-  libseccomp,
-  libselinux,
-  meson,
-  ninja,
-  nix-update-script,
-  nixosTests,
-  openssl,
-  pkg-config,
-  systemd,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lxc";
-  version = "5.0.3";
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "lxc";
-    rev = "refs/tags/lxc-${version}";
-    hash = "sha256-lnLmLgWXt3pI2S+4OeHRlPP5gui7S7ZXXClFt+n/8sY=";
-  };
-
-  nativeBuildInputs = [
-    docbook2x
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    libapparmor
-    libcap
-    libseccomp
-    libselinux
-    openssl
-    systemd
-  ];
-
-  patches = [
-     # make build more nix compatible
-    ./add-meson-options.patch
-
-    # fix docbook2man version detection
-    ./docbook-hack.patch
-  ];
-
-  mesonFlags = [
-    "-Dinstall-init-files=false"
-    "-Dinstall-state-dirs=false"
-    "-Dspecfile=false"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  # https://github.com/NixOS/nixpkgs/issues/300635
-  postInstall = ''chmod -R u-s,g-s "$out"'';
-
-  passthru = {
-    tests = {
-      incus-legacy-init = nixosTests.incus.container-legacy-init;
-      incus-systemd-init = nixosTests.incus.container-systemd-init;
-    };
-    updateScript = nix-update-script {
-      extraArgs = [
-        "-vr"
-        "lxc-(.*)"
-      ];
-    };
-  };
-
-  meta = {
-    homepage = "https://linuxcontainers.org/";
-    description = "Userspace tools for Linux Containers, a lightweight virtualization system";
-    license = lib.licenses.gpl2;
-
-    longDescription = ''
-      LXC containers are often considered as something in the middle between a chroot and a
-      full fledged virtual machine. The goal of LXC is to create an environment as close as
-      possible to a standard Linux installation but without the need for a separate kernel.
-    '';
-
-    platforms = lib.platforms.linux;
-    maintainers = lib.teams.lxc.members;
-  };
-}
diff --git a/pkgs/os-specific/linux/lxc/docbook-hack.patch b/pkgs/os-specific/linux/lxc/docbook-hack.patch
deleted file mode 100644
index f758014efbaa2..0000000000000
--- a/pkgs/os-specific/linux/lxc/docbook-hack.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/meson.build b/meson.build
-index d1527679e..360824994 100644
---- a/meson.build
-+++ b/meson.build
-@@ -320,15 +320,7 @@ docconf.set('LXC_USERNIC_CONF', lxc_user_network_conf)
- docconf.set('LXC_USERNIC_DB', lxc_user_network_db)
- docconf.set('PACKAGE_VERSION', version_data.get('LXC_VERSION'))
- docconf.set('docdtd', '"-//OASIS//DTD DocBook XML" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"')
--sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false, version: '>=0.8')
--if not sgml2man.found()
--    sgml2man = find_program('docbook2man', required: false, version: '<0.8')
--    if sgml2man.found()
--        docconf.set('docdtd', '"-//Davenport//DTD DocBook V3.0//EN"')
--    elif want_mans
--        error('missing required docbook2x or docbook-utils dependency')
--    endif
--endif
-+sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false)
- 
- ## Threads.
- threads = dependency('threads')
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index a90a8716cca92..711a14845df76 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "sha256-HOVAR9auc8ulENPLoI0scdCMZoSbDYkTaCLgZoFG7eU=";
+    sha256 = "sha256-a2cU7PYQh1KR5eeMhMNx2Sc3HHd7QvCG9+BoJyVPp1Y=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.magewell.com/";
     description = "Linux driver for the Magewell Pro Capture family";
     license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ flexiondotorg MP2E ];
+    maintainers = with maintainers; [ flexiondotorg ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
index 493d0e6af101d..35e77c7922dfd 100644
--- a/pkgs/os-specific/linux/nct6687d/default.nix
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "nct6687d";
-  version = "unstable-2023-09-22";
+  version = "0-unstable-2024-02-23";
 
   src = fetchFromGitHub {
     owner = "Fred78290";
     repo = "nct6687d";
-    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
-    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+    rev = "0ee35ed9541bde22fe219305d1647b51ed010c5e";
+    hash = "sha256-g81U+ngnsOslBDCQP51uDDyHPpCv9T/j+KmFUAQfz/M=";
   };
 
   setSourceRoot = ''
@@ -30,6 +31,10 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch=main" ];
+  };
+
   meta = with lib; {
     description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
     license = with licenses; [ gpl2Only ];
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 3680cd43efb77..95e4183a2fb6b 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -5,7 +5,6 @@
 , autoreconfHook
 , withDebugSymbols ? false
 , withCli ? true, libedit
-, withPython ? false, python3
 , withXtables ? true, iptables
 , nixosTests
 }:
@@ -29,25 +28,12 @@ stdenv.mkDerivation rec {
     libmnl libnftnl libpcap
     gmp jansson
   ] ++ lib.optional withCli libedit
-    ++ lib.optional withXtables iptables
-    ++ lib.optionals withPython [
-      python3
-      python3.pkgs.setuptools
-    ];
-
-  patches = [ ./fix-py-libnftables.patch ];
-
-  postPatch = ''
-    substituteInPlace "py/src/nftables.py" \
-      --subst-var-by "out" "$out"
-  '';
+    ++ lib.optional withXtables iptables;
 
   configureFlags = [
     "--with-json"
     (lib.withFeatureAs withCli "cli" "editline")
   ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
-    ++ lib.optional (!withPython) "--disable-python"
-    ++ lib.optional withPython "--enable-python"
     ++ lib.optional withXtables "--with-xtables";
 
   passthru.tests = {
diff --git a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch b/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
deleted file mode 100644
index 3ab1e5363019a..0000000000000
--- a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/py/src/nftables.py b/py/src/nftables.py
-index f1e43ade..9adcd1be 100644
---- a/py/src/nftables.py
-+++ b/py/src/nftables.py
-@@ -69,7 +69,7 @@ class Nftables:
- 
-     validator = None
- 
--    def __init__(self, sofile="libnftables.so.1"):
-+    def __init__(self, sofile="@out@/lib/libnftables.so.1"):
-         """Instantiate a new Nftables class object.
- 
-         Accepts a shared object file to open, by default standard search path
diff --git a/pkgs/os-specific/linux/nftables/python.nix b/pkgs/os-specific/linux/nftables/python.nix
new file mode 100644
index 0000000000000..5c5770ebed4a5
--- /dev/null
+++ b/pkgs/os-specific/linux/nftables/python.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, setuptools
+, nftables
+}:
+
+buildPythonPackage {
+  pname = "nftables";
+  inherit (nftables) version src;
+  pyproject = true;
+
+  postPatch = ''
+    substituteInPlace "py/src/nftables.py" \
+      --replace-fail "libnftables.so.1" "${nftables}/lib/libnftables.so.1"
+  '';
+
+  setSourceRoot = "sourceRoot=$(echo */py)";
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "nftables" ];
+
+  meta = {
+    inherit (nftables.meta) description homepage license platforms maintainers;
+  };
+}
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 30a1e4dd8b6f0..f3ee49a8c395f 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -50,6 +50,10 @@ while [ "$#" -gt 0 ]; do
         ;;
       switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)
         if [ "$i" = dry-run ]; then i=dry-build; fi
+        if [ "$i" = list-generations ]; then
+            buildNix=
+            fast=1
+        fi
         # exactly one action mandatory, bail out if multiple are given
         if [ -n "$action" ]; then showSyntax; fi
         action="$i"
@@ -793,7 +797,13 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     else
         cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
 
-        if [[ ! -f "${cmd[-1]}" ]]; then
+        if [ -z "$targetHost" ]; then
+            specialisationExists=$(test -f "${cmd[-1]}")
+        else
+            specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
+        fi
+
+        if ! $specialisationExists; then
             log "error: specialisation not found: $specialisation"
             exit 1
         fi
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 9e3a6667d7054..3de22bfae6d76 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmon";
-  version = "16p";
+  version = "16q";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "sha256-XcYEX2cl4ySalpkY+uaWY6HWaRYgh3ILq825D86eayo=";
+    sha256 = "sha256-G3ioFnLBkpGz0RpuMZ3ZsjoCKiYtuh786gCNbfUaylE=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 318d2617c838c..777e5b6ca4d94 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,12 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "550.76";
-    sha256_64bit = "sha256-2/wAmBNiePhX74FsV7j21LnCaubxMC/kAYMmf8kQt1s=";
-    sha256_aarch64 = "sha256-LhiyYCUTFwqzUITK6CKIqxOQp62wG1RuKOuP0fTKoVk=";
-    openSha256 = "sha256-RWaUXIr/yCRmX4yIyUxvBxrKCLKRKSi4lQJAYvrd2Kg=";
-    settingsSha256 = "sha256-Lv95+0ahvU1+X/twzWWVqQH4nqq491ALigH9TVBn+YY=";
-    persistencedSha256 = "sha256-rbgI9kGdVzGlPNEvaoOq2zrAMx+H8D+XEBah2eqZzuI=";
+    version = "550.78";
+    sha256_64bit = "sha256-NAcENFJ+ydV1SD5/EcoHjkZ+c/be/FQ2bs+9z+Sjv3M=";
+    sha256_aarch64 = "sha256-2POG5RWT2H7Rhs0YNfTGHO64Q8u5lJD9l/sQCGVb+AA=";
+    openSha256 = "sha256-cF9omNvfHx6gHUj2u99k6OXrHGJRpDQDcBG3jryf41Y=";
+    settingsSha256 = "sha256-lZiNZw4dJw4DI/6CI0h0AHbreLm825jlufuK9EB08iw=";
+    persistencedSha256 = "sha256-qDGBAcZEN/ueHqWO2Y6UhhXJiW5625Kzo1m/oJhvbj4=";
   };
 
   latest = selectHighestVersion production (generic {
@@ -64,11 +64,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.59";
+    version = "550.40.61";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-hVwYC454vkxcK8I9bj1kp6iFS667em0c+Ral243C0J8=";
-    openSha256 = "sha256-/v1iVcmHhdvib54LDktNBHkcmgFxZVwQxwPdWSi0l/U=";
+    sha256_64bit = "sha256-JNVeA5/u5/ictU3QpPnbXIHDKOtwou8wGmMt3We4FJY=";
+    openSha256 = "sha256-kWGTj3eAvwLTJ7zgzRFvyhXmfpxQbUMmyxWxER9i9m0=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index b11dc06c85ebf..2d9dfd81829eb 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -16,7 +16,7 @@ nvidia_x11: sha256:
 , libXxf86vm
 , libvdpau
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , addOpenGLRunpath
 , withGtk2 ? false
 , withGtk3 ? true
@@ -96,7 +96,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ];
 
   buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
-    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
+    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook3 ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
deleted file mode 100644
index 0ea5b6391605a..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "3.3.0";
-  hash = "sha256-Gvy4H7lHwL6IWGaZXWwIjmHfQ1YRFXiSBqKzP3vBsF8=";
-}
diff --git a/pkgs/os-specific/linux/openvswitch/generic.nix b/pkgs/os-specific/linux/openvswitch/generic.nix
deleted file mode 100644
index ce800a7ba9923..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/generic.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{ version
-, hash
-, updateScriptArgs ? ""
-}:
-
-{ lib
-, stdenv
-, fetchurl
-, autoconf
-, automake
-, installShellFiles
-, iproute2
-, kernel ? null
-, libcap_ng
-, libtool
-, openssl
-, perl
-, pkg-config
-, procps
-, python3
-, sphinxHook
-, util-linux
-, which
-, writeScript
-}:
-
-let
-  _kernel = kernel;
-in stdenv.mkDerivation rec {
-  pname = "openvswitch";
-  inherit version;
-
-  kernel = lib.optional (_kernel != null) _kernel.dev;
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    inherit hash;
-  };
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  patches = [
-    # 8: vsctl-bashcomp - argument completion FAILED (completion.at:664)
-    ./patches/disable-bash-arg-completion-test.patch
-  ];
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-    installShellFiles
-    libtool
-    pkg-config
-    sphinxHook
-  ];
-
-  sphinxBuilders = [
-    "man"
-  ];
-
-  sphinxRoot = "./Documentation";
-
-  buildInputs = [
-    libcap_ng
-    openssl
-    perl
-    procps
-    python3
-    util-linux
-    which
-  ];
-
-  preConfigure = "./boot.sh";
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (lib.optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    installShellCompletion --bash utilities/ovs-appctl-bashcomp.bash
-    installShellCompletion --bash utilities/ovs-vsctl-bashcomp.bash
-  '';
-
-  doCheck = true;
-  preCheck = ''
-    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
-    export RECHECK=yes
-
-    patchShebangs tests/
-  '';
-
-  nativeCheckInputs = [
-    iproute2
-  ] ++ (with python3.pkgs; [
-    netaddr
-    pyparsing
-    pytest
-  ]);
-
-  passthru.updateScript = writeScript "ovs-update.nu" ''
-    ${./update.nu} ${updateScriptArgs}
-  '';
-
-  meta = with lib; {
-    changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
-    description = "A multilayer virtual switch";
-    longDescription = ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-    '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
deleted file mode 100644
index 93ccbfcee95d6..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-import ./generic.nix {
-  version = "2.17.9";
-  hash = "sha256-4bP6RyZ2YmhT8i1j+VnlrQYeG/V+G71ETQ7Yj5R++LE=";
-  updateScriptArgs = "--lts=true --regex '2\.17.*'";
-}
diff --git a/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch b/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
deleted file mode 100644
index 2b45427417632..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/tests/completion.at b/tests/completion.at
-index b6155af25..6367cb545 100644
---- a/tests/completion.at
-+++ b/tests/completion.at
-@@ -425,6 +425,7 @@ AT_CLEANUP
- 
- 
- AT_SETUP([vsctl-bashcomp - argument completion])
-+AT_SKIP_IF([true])
- AT_SKIP_IF([test -z ${BASH_VERSION+x}])
- AT_SKIP_IF([eval 'test ${BASH_VERSINFO[[0]]} -lt 4'])
- OVS_VSWITCHD_START(
diff --git a/pkgs/os-specific/linux/openvswitch/update.nu b/pkgs/os-specific/linux/openvswitch/update.nu
deleted file mode 100755
index 5d457dda5f3e9..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/update.nu
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts
-
-def main [--lts: bool = false, --regex: string] {
-  let tags = list-git-tags --url=https://github.com/openvswitch/ovs | lines | sort --natural | str replace v ''
-
-  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
-  let current_version = nix eval --raw -f default.nix $"openvswitch(if $lts {"-lts"}).version" | str trim
-
-  if $latest_tag != $current_version {
-    if $lts {
-      update-source-version openvswitch-lts $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/lts.nix"
-    } else {
-      update-source-version openvswitch $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/default.nix"
-    }
-  }
-
-  {"lts?": $lts, before: $current_version, after: $latest_tag}
-}
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index c956dfad4c64f..e5f8fec5acb14 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch
+{ lib, stdenv, buildPackages, fetchurl
 , flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
 , autoreconfHook269, pkg-config-unwrapped
@@ -6,22 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-//SjTlu+534ujxmS8nYx4jKby/igVj3etcM4m04xaa0=";
+    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
   };
 
   patches = [
     ./suid-wrapper-path.patch
-
-    # Backport fix for missing include breaking musl builds.
-    (fetchpatch {
-      name = "pam_namespace-stdint.h.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
-      hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
-    })
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index b1508dcb6a3ed..dcdc7a363e30e 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -1,5 +1,5 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
-, wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
+, wrapGAppsHook3, gtk3, glib, desktop-file-utils, appstream-glib, gnome
 , gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
-  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
+  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook3 desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
     gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 11f26e5013a82..f7145bc02ebe7 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -11,6 +11,7 @@
 , polkit
 , dbus
 , gobject-introspection
+, wrapGAppsNoGuiHook
 , gettext
 , gtk-doc
 , docbook-xsl-nons
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
+    wrapGAppsNoGuiHook
     # checkInput but cheked for during the configuring
     (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
       pygobject3
@@ -95,6 +97,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Only need to wrap the Python tool (powerprofilectl)
+  dontWrapGApps = true;
+
   PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
   postPatch = ''
@@ -106,6 +111,10 @@ stdenv.mkDerivation rec {
       src/powerprofilesctl
   '';
 
+  postFixup = ''
+    wrapGApp "$out/bin/powerprofilesctl"
+  '';
+
   passthru = {
     tests = {
       nixos = nixosTests.power-profiles-daemon;
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 1c261355954ad..9b5210350bdd2 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "r8125";
   # On update please verify (using `diff -r`) that the source matches the
   # realtek version.
-  version = "9.012.03";
+  version = "9.013.02";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "louistakepillz";
     repo = "r8125";
     rev = version;
-    sha256 = "sha256-+CrxvKB96QOcOo87McZOt/XUhriTtTV8jTQgpBG3ejs=";
+    sha256 = "sha256-i45xKF5WVN+nNhpD6HWZHvGgxuaD/YhMHERqW8/bC5Y=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/restool/default.nix b/pkgs/os-specific/linux/restool/default.nix
index 853d9eeb7f3d6..7f7c094007e47 100644
--- a/pkgs/os-specific/linux/restool/default.nix
+++ b/pkgs/os-specific/linux/restool/default.nix
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/nxp-qoriq/restool";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8852au/default.nix b/pkgs/os-specific/linux/rtl8852au/default.nix
new file mode 100644
index 0000000000000..d154fbe86a208
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8852au/default.nix
@@ -0,0 +1,52 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
+
+stdenv.mkDerivation {
+  pname = "rtl8852au";
+  version = "${kernel.version}-unstable-2023-11-24";
+
+  src = fetchFromGitHub {
+    owner = "lwfinger";
+    repo = "rtl8852au";
+    rev = "70bdde265b9ab002daf11d4bea1a42baa8da4325";
+    hash = "sha256-6ARS7/0iKYajpMH+f+jWDxIkPY9ZixJkk864oKom4l4=";
+  };
+
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
+  hardeningDisable = [ "pic" "format" ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace-fail /sbin/depmod \# \
+      --replace-fail '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/" \
+      --replace-fail '/usr/lib/systemd/system-sleep' "$out/usr/lib/systemd/system-sleep"
+    substituteInPlace ./platform/i386_pc.mk \
+      --replace-fail /lib/modules "${kernel.dev}/lib/modules"
+  '';
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    mkdir -p "$out/usr/lib/systemd/system-sleep"
+  '';
+
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Driver for Realtek 802.11ac, rtl8852au, provides the 8852au mod";
+    homepage = "https://github.com/lwfinger/rtl8852au";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lonyelon ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8852bu/default.nix b/pkgs/os-specific/linux/rtl8852bu/default.nix
new file mode 100644
index 0000000000000..cc0f495b8122f
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8852bu/default.nix
@@ -0,0 +1,51 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
+
+stdenv.mkDerivation {
+  pname = "rtl8852bu";
+  version = "${kernel.version}-unstable-2024-03-28";
+
+  src = fetchFromGitHub {
+    owner = "morrownr";
+    repo = "rtl8852bu";
+    rev = "f6aaa3c0094c541d9b0347926c76c1e9cc4a49d1";
+    hash = "sha256-Jbd6nixo873LU74klhhQU1qD3ahxEnywdqcF89LTRxc=";
+  };
+
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
+  hardeningDisable = [ "pic" "format" ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace-fail /sbin/depmod \# \
+      --replace-fail '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    substituteInPlace ./platform/i386_pc.mk \
+      --replace-fail /lib/modules "${kernel.dev}/lib/modules"
+  '';
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    mkdir -p "$out/usr/lib/systemd/system-sleep"
+  '';
+
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Driver for Realtek rtl8852au and rtl8832bu chipsets, provides the 8852au mod";
+    homepage = "https://github.com/morrownr/rtl8852bu";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lonyelon ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
index 0ee191e868957..c21f8ea8a644b 100644
--- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "azure-dcap-client";
-  version = "1.12.1";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = version;
-    hash = "sha256-q0dI4WdA1ue4sw+QfSherh31Ldf9gnhoft66o3E9gnU=";
+    hash = "sha256-zTDaICsSPXctgFRCZBiZwXV9dLk2pFL9kp5a8FkiTZA=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
     homepage = "https://github.com/microsoft/azure-dcap-client";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.mit ];
   };
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 22e52b6ec9fdb..42e00071d8101 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -14,7 +14,7 @@
 , debug ? false
 }:
 stdenv.mkDerivation rec {
-  inherit (sgx-sdk) version versionTag src;
+  inherit (sgx-sdk) patches src version versionTag;
   pname = "sgx-psw";
 
   postUnpack =
@@ -24,16 +24,16 @@ stdenv.mkDerivation rec {
       # attestation quotes, and do platform certification.
       ae.prebuilt = fetchurl {
         url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
-        hash = "sha256-IckW4p1XWkWCDCErXyTtnKYKeAUaCrp5iAMsRBMjLX0=";
+        hash = "sha256-IGV9VEwY/cQBV4Vz2sps4JgRweWRl/l08ocb9P4SH8Q=";
       };
       # Also include the Data Center Attestation Primitives (DCAP) platform
       # enclaves.
       dcap = rec {
-        version = "1.18";
+        version = "1.20";
         filename = "prebuilt_dcap_${version}.tar.gz";
         prebuilt = fetchurl {
           url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-9ceys7ozOEienug+9MTZ6dw3nx7VBfxLNiwhZYv4SzY=";
+          hash = "sha256-nPsI89KSBA3cSNTMWyktZP5dkf+BwL3NZ4MuUf6G98o=";
         };
       };
     in
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX Architectural Enclave Service Manager";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ veehaitch citadelcore ];
+    maintainers = with maintainers; [ phlip9 veehaitch citadelcore ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
new file mode 100644
index 0000000000000..019f58927152a
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
@@ -0,0 +1,26 @@
+diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+index aee499e9..13fa89d4 100644
+--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
++++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index,
+                    const_cast<mz_zip_archive*>(&m_ZipArchive), index)
+                    ? true
+                    : false;
+-    stat.modifiedTime = zipStat.m_time;
++    stat.modifiedTime = 0;
+     stat.crc32 = zipStat.m_crc32;
+     // This will limit the size info from uint64 to uint32 on 32-bit
+     // architectures. We don't care because we assume resources > 2GB
+diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c
+index 6b0ebd7a..fa2aebca 100644
+--- a/external/CppMicroServices/third_party/miniz.c
++++ b/external/CppMicroServices/third_party/miniz.c
+@@ -170,7 +170,7 @@
+ // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or
+ // get/set file times, and the C run-time funcs that get/set times won't be called.
+ // The current downside is the times written to your archives will be from 1979.
+-//#define MINIZ_NO_TIME
++#define MINIZ_NO_TIME
+
+ // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's.
+ //#define MINIZ_NO_ARCHIVE_APIS
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 2570406a7112e..67489ee3c07c4 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoconf
 , automake
 , binutils
@@ -27,15 +26,15 @@
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   # Version as given in se_version.h
-  version = "2.21.100.1";
+  version = "2.23.100.2";
   # Version as used in the Git tag
-  versionTag = "2.21";
+  versionTag = "2.23";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${versionTag}";
-    hash = "sha256-Yo2G0H0XUI2p9W7lDRLkFHw2t8X1220brGohQJ0r2WY=";
+    hash = "sha256-i+fE6xKiuljG8LY8TIHgrW15DVpdp46bZdNo/BjgT/I=";
     fetchSubmodules = true;
   };
 
@@ -46,39 +45,28 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
-    # Fix missing pthread_compat.h, see https://github.com/intel/linux-sgx/pull/784
-    (fetchpatch {
-      url = "https://github.com/intel/linux-sgx/commit/254b58f922a6bd49c308a4f47f05f525305bd760.patch";
-      sha256 = "sha256-sHU++K7NJ+PdITx3y0PwstA9MVh10rj2vrLn01N9F4w=";
-    })
+    # There's a `make preparation` step that downloads some prebuilt binaries
+    # and applies some patches to the in-repo git submodules. This patch removes
+    # the parts that download things, since we can't do that inside the sandbox.
+    ./disable-downloads.patch
+
+    # This patch disable mtime in bundled zip file for reproducible builds.
+    #
+    # Context: The `aesm_service` binary depends on a vendored library called
+    # `CppMicroServices`. At build time, this lib creates and then bundles
+    # service resources into a zip file and then embeds this zip into the
+    # binary. Without changes, the `aesm_service` will be different after every
+    # build because the embedded zip file contents have different modified times.
+    ./cppmicroservices-no-mtime.patch
   ];
 
-  # There's a `make preparation` step that downloads some prebuilt binaries and
-  # applies some patches to the in-repo git submodules. We can't just run it,
-  # since it downloads things, so this step just extracts the patching steps.
   postPatch = ''
     patchShebangs linux/installer/bin/build-installpkg.sh \
       linux/installer/common/sdk/createTarball.sh \
       linux/installer/common/sdk/install.sh \
       external/sgx-emm/create_symlink.sh
 
-    echo "Running 'make preparation' but without download steps"
-
-    # Seems to download something. Build currently uses ipp-crypto and not
-    # sgxssl so probably not an issue.
-    # $ ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
-
-    pushd external/openmp/openmp_code
-      git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 \
-        || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
-    popd
-
-    pushd external/protobuf/protobuf_code
-      git apply ../sgx_protobuf.patch >/dev/null 2>&1 \
-        || git apply ../sgx_protobuf.patch --check -R
-    popd
-
-    ./external/sgx-emm/create_symlink.sh
+    make preparation
   '';
 
   # We need `cmake` as a build input but don't use it to kick off the build phase
@@ -300,7 +288,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ sbellem arturcygan veehaitch ];
+    maintainers = with maintainers; [ phlip9 sbellem arturcygan veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
new file mode 100644
index 0000000000000..bdf9b9f9136e9
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 32433051..2e480efb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -50,8 +50,8 @@ tips:
+ preparation:
+ # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
+ # Only enable the download from git
+-	git submodule update --init --recursive
+-	./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
++	# git submodule update --init --recursive
++	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
+ 	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
+ 	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
+ 	./external/sgx-emm/create_symlink.sh
+@@ -59,8 +59,8 @@ preparation:
+ 	cd external/cbor && cp -r libcbor sgx_libcbor
+ 	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
+ 	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
+-	./download_prebuilt.sh
+-	./external/dcap_source/QuoteGeneration/download_prebuilt.sh
++	# ./download_prebuilt.sh
++	# ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
+ 
+ psw:
+ 	$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
index 5a4c941a22b99..c72a0c5285164 100644
--- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -8,13 +8,13 @@
 }:
 gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
-  version = "2021.9.0";
+  version = "2021.10.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipp-crypto";
     rev = "ippcp_${version}";
-    hash = "sha256-+ITnxyrkDQp4xRa+PVzXdYsSkI5sMNwQGfGU+lFJ6co=";
+    hash = "sha256-DfXsJ+4XqyjCD+79LUD53Cx8D46o1a4fAZa2UxGI1Xg=";
   };
 
   cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix
index 9d1905e09d1f7..94d7e20b21c41 100644
--- a/pkgs/os-specific/linux/sgx/ssl/default.nix
+++ b/pkgs/os-specific/linux/sgx/ssl/default.nix
@@ -1,8 +1,8 @@
 { stdenv
+, callPackage
 , fetchFromGitHub
 , fetchurl
 , lib
-, openssl
 , perl
 , sgx-sdk
 , which
@@ -10,7 +10,7 @@
 }:
 let
   sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "1.1.1u";
+  opensslVersion = "3.0.12";
 in
 stdenv.mkDerivation {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
@@ -19,15 +19,15 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-sgx-ssl";
-    rev = "lin_${sgxVersion}_${opensslVersion}";
-    hash = "sha256-zbXEQz72VUPqnGrboX6oXliaLpbcos7tV6K9lX+zleg=";
+    rev = "3.0_Rev2";
+    hash = "sha256-dmLyaG6v+skjSa0KxLAfIfSBOxp9grrI7ds6WdGPe0I=";
   };
 
   postUnpack =
     let
       opensslSourceArchive = fetchurl {
         url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-4vjYS1I+7NBse+diaDA3AwD7zBU4a/UULXJ1j2lj68Y=";
+        hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
       };
     in
     ''
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs Linux/build_openssl.sh
 
-    # Run the test in the `installCheckPhase`, not the `buildPhase`
+    # Skip the tests. Build and run separately (see below).
     substituteInPlace Linux/sgx/Makefile \
       --replace '$(MAKE) -C $(TEST_DIR) all' \
                 'bash -c "true"'
@@ -46,7 +46,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     perl
     sgx-sdk
-    stdenv.cc.libc
     which
   ];
 
@@ -60,21 +59,22 @@ stdenv.mkDerivation {
     "DESTDIR=$(out)"
   ];
 
-  # Build the test app
-  doInstallCheck = true;
-  installCheckTarget = "test";
-  installCheckFlags = [
-    "SGX_MODE=SIM"
-    "-j 1" # Makefile doesn't support multiple jobs
-  ];
-  nativeInstallCheckInputs = [
-    openssl
-  ];
+  # These tests build on any x86_64-linux but BOTH SIM and HW will only _run_ on
+  # real Intel hardware. Split these out so OfBorg doesn't choke on this pkg.
+  #
+  # ```
+  # nix run .#sgx-ssl.tests.HW
+  # nix run .#sgx-ssl.tests.SIM
+  # ```
+  passthru.tests = {
+    HW = callPackage ./tests.nix { sgxMode = "HW"; inherit opensslVersion; };
+    SIM = callPackage ./tests.nix { sgxMode = "SIM"; inherit opensslVersion; };
+  };
 
   meta = with lib; {
     description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
     homepage = "https://github.com/intel/intel-sgx-ssl";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.bsd3 licenses.openssl ];
   };
diff --git a/pkgs/os-specific/linux/sgx/ssl/tests.nix b/pkgs/os-specific/linux/sgx/ssl/tests.nix
new file mode 100644
index 0000000000000..d9357ba043102
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/ssl/tests.nix
@@ -0,0 +1,95 @@
+# This package _builds_ (but doesn't run!) the sgx-ssl test enclave + harness.
+# The whole package effectively does:
+#
+# ```
+# SGX_MODE=${sgxMode} make -C Linux/sgx/test_app
+# cp Linux/sgx/{TestApp,TestEnclave.signed.so} $out/bin
+# ```
+#
+# OfBorg fails to run these tests since they require real Intel HW. That
+# includes the simulation mode! The tests appears to do something fancy with
+# cpuid and exception trap handlers that make them very non-portable.
+#
+# These tests are split out from the parent pkg since recompiling the parent
+# takes like 30 min : )
+
+{ lib
+, openssl
+, sgx-psw
+, sgx-sdk
+, sgx-ssl
+, stdenv
+, which
+, opensslVersion ? throw "required parameter"
+, sgxMode ? throw "required parameter" # "SIM" or "HW"
+}:
+stdenv.mkDerivation {
+  inherit (sgx-ssl) postPatch src version;
+  pname = sgx-ssl.pname + "-tests-${sgxMode}";
+
+  postUnpack = sgx-ssl.postUnpack + ''
+    sourceRootAbs=$(readlink -e $sourceRoot)
+    packageDir=$sourceRootAbs/Linux/package
+
+    # Do the inverse of 'make install' and symlink built artifacts back into
+    # '$src/Linux/package/' to avoid work.
+    mkdir $packageDir/lib $packageDir/lib64
+    ln -s ${lib.getLib sgx-ssl}/lib/* $packageDir/lib/
+    ln -s ${lib.getLib sgx-ssl}/lib64/* $packageDir/lib64/
+    ln -sf ${lib.getDev sgx-ssl}/include/* $packageDir/include/
+
+    # test_app needs some internal openssl headers.
+    # See: tail end of 'Linux/build_openssl.sh'
+    tar -C $sourceRootAbs/openssl_source -xf $sourceRootAbs/openssl_source/openssl-${opensslVersion}.tar.gz
+    echo '#define OPENSSL_VERSION_STR "${opensslVersion}"' > $sourceRootAbs/Linux/sgx/osslverstr.h
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/crypto $sourceRootAbs/Linux/sgx/test_app/enclave/
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/internal $sourceRootAbs/Linux/sgx/test_app/enclave/
+  '';
+
+  nativeBuildInputs = [
+    openssl.bin
+    sgx-sdk
+    which
+  ];
+
+  preBuild = ''
+    # Need to regerate the edl header
+    make -C Linux/sgx/libsgx_tsgxssl sgx_tsgxssl_t.c
+  '';
+
+  makeFlags = [
+    "-C Linux/sgx/test_app"
+    "SGX_MODE=${sgxMode}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Enclaves can't be stripped after signing.
+    install -Dm 755 Linux/sgx/test_app/TestEnclave.signed.so -t $TMPDIR/enclaves
+
+    install -Dm 755 Linux/sgx/test_app/TestApp -t $out/bin
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # Move the enclaves where they actually belong.
+    mv $TMPDIR/enclaves/*.signed.so* $out/bin/
+
+    # HW SGX must runs against sgx-psw, not sgx-sdk.
+    if [[ "${sgxMode}" == "HW" ]]; then
+      patchelf \
+        --set-rpath "$( \
+          patchelf --print-rpath $out/bin/TestApp \
+            | sed 's|${lib.getLib sgx-sdk}|${lib.getLib sgx-psw}|' \
+        )" \
+        $out/bin/TestApp
+    fi
+  '';
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "TestApp";
+  };
+}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index edd11143ad609..9cdc5dcd9d44d 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -150,6 +150,10 @@
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
 , withVmspawn ? true
+  # kernel-install shouldn't usually be used on NixOS, but can be useful, e.g. for
+  # building disk images for non-NixOS systems. To save users from trying to use it
+  # on their live NixOS system, we disable it by default.
+, withKernelInstall ? false
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -628,6 +632,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "efi" withEfi)
     (lib.mesonBool "utmp" withUtmp)
     (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "kernel-install" withKernelInstall)
     (lib.mesonBool "quotacheck" false)
     (lib.mesonBool "ldconfig" false)
     (lib.mesonBool "install-sysconfdir" false)
@@ -819,7 +824,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
 
     rm -rf $out/etc/rpm
-
+  '' + lib.optionalString (!withKernelInstall) ''
     # "kernel-install" shouldn't be used on NixOS.
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 600655c447f7d..8847a83d53d77 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -18,7 +18,7 @@
 , glib
 , gobject-introspection
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
   # needs pkg_resources
 , withDoc ? false
 , sphinx
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ lib.optionals withDoc [
     sphinx
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
   checkPhase = "ctest --force-new-ctest-process -E gstreamer";
 
-  # wrapGAppsHook: make sure we add ourselves to the introspection
+  # wrapGAppsHook3: make sure we add ourselves to the introspection
   # and gstreamer paths.
   GI_TYPELIB_PATH = "${placeholder "out"}/lib/girepository-1.0";
   GST_PLUGIN_SYSTEM_PATH_1_0 = "${placeholder "out"}/lib/gstreamer-1.0";
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index b57169369ca72..3b527c8b534fe 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -9,7 +9,7 @@
 , gtk3
 , python-linux-procfs
 , python-ethtool
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     glib.dev
     gobject-introspection
     gtk3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pygobject3 python-linux-procfs python-ethtool ];
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 3b08318c965ea..8a1d79a9d7bdd 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , makeWrapper
 , pkg-config
 , libxslt
@@ -33,7 +32,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.90.2";
+  version = "1.90.4";
 
   outputs = [ "out" "dev" "installedTests" ]
     ++ lib.optionals withDocs [ "devdoc" ];
@@ -43,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7WzMAJuf1czU8ZalsEU/NwCXYqTGvcqEqxFt5ocgt48=";
+    hash = "sha256-5twHuDLisVF07Y5KYwlqWMi12+p6UpARJvoBN/+tX2o=";
   };
 
   patches = lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
@@ -52,10 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./i686-test-remove-battery-check.patch
   ] ++ [
     ./installed-tests-path.patch
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/upower/upower/-/merge_requests/207.diff";
-      hash = "sha256-ldr1bKbSAdYpwbbe/Iq9i0Q9zQrHWvIvBGym/F3+vxs=";
-    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index ae42c206280da..5e29b911ca548 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -12,7 +12,7 @@
 , iproute2
 , iptables
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 , wl-clipboard
 , runtimeShell
 }:
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index e8fce959c8dc9..8101f47c6a241 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ gtk3 ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];