about summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix925
-rw-r--r--pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix2
-rw-r--r--pkgs/os-specific/bsd/freebsd/lib/default.nix16
-rw-r--r--pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh30
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch (renamed from pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch (renamed from pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-setup-hook.sh (renamed from pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix135
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/config.nix17
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/csu.nix25
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix28
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/file2c.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh (renamed from pkgs/os-specific/bsd/freebsd/setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch (renamed from pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix56
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/install.nix41
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch (renamed from pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch (renamed from pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch (renamed from pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix139
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix27
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix24
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch (renamed from pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix26
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libnv.nix10
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix20
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/make.nix20
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix61
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix78
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix22
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/rpcgen-glibc-hack.patch (renamed from pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sed.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/source.nix11
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/stat.nix13
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix12
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix67
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch (renamed from pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch (renamed from pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch)0
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix12
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/uudecode.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/package.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/xargs-j.sh (renamed from pkgs/os-specific/bsd/xargs-j.sh)0
-rwxr-xr-xpkgs/os-specific/bsd/freebsd/update.py182
-rw-r--r--pkgs/os-specific/bsd/freebsd/versions.json210
-rw-r--r--pkgs/os-specific/darwin/CoreSymbolication/default.nix46
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix1
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix253
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch48
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build544
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.options1
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix2
-rw-r--r--pkgs/os-specific/darwin/cctools/apple.nix2
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix2
-rw-r--r--pkgs/os-specific/darwin/grandperspective/default.nix15
-rw-r--r--pkgs/os-specific/darwin/insert_dylib/default.nix22
-rw-r--r--pkgs/os-specific/darwin/libtapi/default.nix4
-rw-r--r--pkgs/os-specific/darwin/maloader/default.nix40
-rw-r--r--pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch100
-rw-r--r--pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch84
-rw-r--r--pkgs/os-specific/darwin/moltenvk/default.nix236
-rw-r--r--pkgs/os-specific/darwin/opencflite/default.nix21
-rw-r--r--pkgs/os-specific/darwin/print-reexports/default.nix1
-rw-r--r--pkgs/os-specific/darwin/raycast/default.nix21
-rwxr-xr-xpkgs/os-specific/darwin/raycast/update.sh20
-rw-r--r--pkgs/os-specific/darwin/rewrite-tbd/default.nix1
-rw-r--r--pkgs/os-specific/darwin/sketchybar/default.nix11
-rw-r--r--pkgs/os-specific/darwin/skhd/default.nix11
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix224
-rw-r--r--pkgs/os-specific/linux/915resolution/default.nix1
-rw-r--r--pkgs/os-specific/linux/acpi-call/default.nix1
-rw-r--r--pkgs/os-specific/linux/acpi/default.nix1
-rw-r--r--pkgs/os-specific/linux/acpitool/default.nix1
-rw-r--r--pkgs/os-specific/linux/adcli/default.nix1
-rw-r--r--pkgs/os-specific/linux/akvcam/default.nix5
-rw-r--r--pkgs/os-specific/linux/amdctl/default.nix1
-rw-r--r--pkgs/os-specific/linux/aseq2json/default.nix1
-rw-r--r--pkgs/os-specific/linux/autofs/default.nix1
-rw-r--r--pkgs/os-specific/linux/autosuspend/default.nix85
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix1
-rw-r--r--pkgs/os-specific/linux/beefi/default.nix1
-rw-r--r--pkgs/os-specific/linux/bolt/default.nix1
-rw-r--r--pkgs/os-specific/linux/bpfmon/default.nix1
-rw-r--r--pkgs/os-specific/linux/bpftrace/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftune/default.nix1
-rw-r--r--pkgs/os-specific/linux/bridge-utils/default.nix1
-rw-r--r--pkgs/os-specific/linux/cachefilesd/default.nix1
-rw-r--r--pkgs/os-specific/linux/cannelloni/default.nix1
-rw-r--r--pkgs/os-specific/linux/catfs/default.nix1
-rw-r--r--pkgs/os-specific/linux/checksec/default.nix1
-rw-r--r--pkgs/os-specific/linux/compsize/default.nix1
-rw-r--r--pkgs/os-specific/linux/conky/default.nix1
-rw-r--r--pkgs/os-specific/linux/conspy/default.nix1
-rw-r--r--pkgs/os-specific/linux/cpuid/default.nix26
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix1
-rw-r--r--pkgs/os-specific/linux/cpustat/default.nix21
-rw-r--r--pkgs/os-specific/linux/cramfsswap/default.nix1
-rw-r--r--pkgs/os-specific/linux/cshatag/default.nix1
-rw-r--r--pkgs/os-specific/linux/dcgm/default.nix5
-rw-r--r--pkgs/os-specific/linux/devmem2/default.nix1
-rw-r--r--pkgs/os-specific/linux/disk-indicator/default.nix1
-rw-r--r--pkgs/os-specific/linux/dpdk-kmods/default.nix13
-rw-r--r--pkgs/os-specific/linux/dpdk/default.nix28
-rw-r--r--pkgs/os-specific/linux/drbd/driver.nix57
-rw-r--r--pkgs/os-specific/linux/drbd/utils.nix (renamed from pkgs/os-specific/linux/drbd/default.nix)15
-rw-r--r--pkgs/os-specific/linux/dstat/default.nix1
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix1
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/esdm/default.nix4
-rw-r--r--pkgs/os-specific/linux/ethq/default.nix1
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix1
-rw-r--r--pkgs/os-specific/linux/facetimehd/default.nix4
-rw-r--r--pkgs/os-specific/linux/fan2go/default.nix1
-rw-r--r--pkgs/os-specific/linux/fanctl/default.nix1
-rw-r--r--pkgs/os-specific/linux/fbterm/default.nix1
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix3
-rw-r--r--pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix1
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix1
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd-efi/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/default.nix5
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/source.nix8
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix5
-rw-r--r--pkgs/os-specific/linux/fnotifystat/default.nix1
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix1
-rw-r--r--pkgs/os-specific/linux/framework-laptop-kmod/default.nix6
-rw-r--r--pkgs/os-specific/linux/freefall/default.nix1
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix1
-rw-r--r--pkgs/os-specific/linux/fscryptctl/default.nix1
-rw-r--r--pkgs/os-specific/linux/fsverity-utils/default.nix5
-rw-r--r--pkgs/os-specific/linux/fswebcam/default.nix1
-rw-r--r--pkgs/os-specific/linux/ftop/default.nix1
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/fxload/default.nix1
-rw-r--r--pkgs/os-specific/linux/g15daemon/default.nix1
-rw-r--r--pkgs/os-specific/linux/gfxtablet/default.nix1
-rw-r--r--pkgs/os-specific/linux/google-authenticator/default.nix1
-rw-r--r--pkgs/os-specific/linux/gpu-switch/default.nix1
-rw-r--r--pkgs/os-specific/linux/gt/default.nix1
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix1
-rw-r--r--pkgs/os-specific/linux/hd-idle/default.nix1
-rw-r--r--pkgs/os-specific/linux/hdapsd/default.nix1
-rw-r--r--pkgs/os-specific/linux/health-check/default.nix1
-rw-r--r--pkgs/os-specific/linux/hibernate/default.nix1
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/hyperv-daemons/default.nix1
-rw-r--r--pkgs/os-specific/linux/i7z/default.nix1
-rw-r--r--pkgs/os-specific/linux/ifenslave/default.nix1
-rw-r--r--pkgs/os-specific/linux/iio-sensor-proxy/default.nix1
-rw-r--r--pkgs/os-specific/linux/ima-evm-utils/default.nix1
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix5
-rw-r--r--pkgs/os-specific/linux/intel-speed-select/default.nix1
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix5
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/iptstate/default.nix1
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix4
-rw-r--r--pkgs/os-specific/linux/iw/default.nix1
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix4
-rw-r--r--pkgs/os-specific/linux/joycond/default.nix1
-rw-r--r--pkgs/os-specific/linux/kbdlight/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix224
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json60
-rw-r--r--pkgs/os-specific/linux/kernel/htmldocs.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json36
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.15.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.6.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix30
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/perf/default.nix1
-rwxr-xr-xpkgs/os-specific/linux/kernel/update-mainline.py7
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix16
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/os-specific/linux/klibc/default.nix1
-rw-r--r--pkgs/os-specific/linux/kmscon/default.nix1
-rw-r--r--pkgs/os-specific/linux/ksmbd-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/kvdo/default.nix4
-rw-r--r--pkgs/os-specific/linux/latencytop/default.nix1
-rw-r--r--pkgs/os-specific/linux/ldm/default.nix1
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix2
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix7
-rw-r--r--pkgs/os-specific/linux/libtracefs/default.nix1
-rw-r--r--pkgs/os-specific/linux/libzbd/default.nix1
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix1
-rw-r--r--pkgs/os-specific/linux/lockdep/default.nix1
-rw-r--r--pkgs/os-specific/linux/lsb-release/default.nix1
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix7
-rw-r--r--pkgs/os-specific/linux/lxcfs/default.nix76
-rw-r--r--pkgs/os-specific/linux/lxcfs/no-spec.patch24
-rw-r--r--pkgs/os-specific/linux/lxcfs/pidfd.patch29
-rw-r--r--pkgs/os-specific/linux/lxcfs/skip-init.patch12
-rw-r--r--pkgs/os-specific/linux/mbpfan/default.nix1
-rw-r--r--pkgs/os-specific/linux/mceinject/default.nix1
-rw-r--r--pkgs/os-specific/linux/mcelog/default.nix1
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix16
-rw-r--r--pkgs/os-specific/linux/mdadm/fix-hardcoded-mapdir.patch13
-rw-r--r--pkgs/os-specific/linux/metastore/default.nix1
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--pkgs/os-specific/linux/microcode/iucode-tool.nix1
-rw-r--r--pkgs/os-specific/linux/miraclecast/default.nix11
-rw-r--r--pkgs/os-specific/linux/mmc-utils/default.nix7
-rw-r--r--pkgs/os-specific/linux/msr/default.nix1
-rw-r--r--pkgs/os-specific/linux/mwprocapture/default.nix4
-rw-r--r--pkgs/os-specific/linux/ndiswrapper/default.nix4
-rw-r--r--pkgs/os-specific/linux/netatop/default.nix1
-rw-r--r--pkgs/os-specific/linux/nix-ld/default.nix52
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/default.nix20
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh9
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/test/repl.nix15
-rw-r--r--pkgs/os-specific/linux/nmon/default.nix1
-rw-r--r--pkgs/os-specific/linux/nsncd/default.nix1
-rw-r--r--pkgs/os-specific/linux/numad/default.nix1
-rw-r--r--pkgs/os-specific/linux/numatop/default.nix1
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix20
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix1
-rw-r--r--pkgs/os-specific/linux/nvmet-cli/default.nix1
-rw-r--r--pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix1
-rw-r--r--pkgs/os-specific/linux/oddjob/default.nix62
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix24
-rw-r--r--pkgs/os-specific/linux/openrazer/driver.nix1
-rw-r--r--pkgs/os-specific/linux/otpw/default.nix1
-rw-r--r--pkgs/os-specific/linux/pagemon/default.nix1
-rw-r--r--pkgs/os-specific/linux/pam_ccreds/default.nix1
-rw-r--r--pkgs/os-specific/linux/pam_rssh/default.nix25
-rw-r--r--pkgs/os-specific/linux/pam_tmpdir/default.nix1
-rw-r--r--pkgs/os-specific/linux/paxctl/default.nix1
-rw-r--r--pkgs/os-specific/linux/paxtest/default.nix1
-rw-r--r--pkgs/os-specific/linux/pcimem/default.nix1
-rw-r--r--pkgs/os-specific/linux/pcm/default.nix4
-rw-r--r--pkgs/os-specific/linux/pflask/default.nix1
-rw-r--r--pkgs/os-specific/linux/piper/default.nix1
-rw-r--r--pkgs/os-specific/linux/pipework/default.nix1
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix16
-rw-r--r--pkgs/os-specific/linux/ply/default.nix1
-rw-r--r--pkgs/os-specific/linux/pommed-light/default.nix1
-rw-r--r--pkgs/os-specific/linux/power-calibrate/default.nix1
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix13
-rw-r--r--pkgs/os-specific/linux/powerstat/default.nix1
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix1
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/procdump/default.nix1
-rw-r--r--pkgs/os-specific/linux/pscircle/default.nix1
-rw-r--r--pkgs/os-specific/linux/psmisc/default.nix4
-rw-r--r--pkgs/os-specific/linux/qperf/default.nix1
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix1
-rw-r--r--pkgs/os-specific/linux/rasdaemon/default.nix9
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/os-specific/linux/reap/default.nix1
-rw-r--r--pkgs/os-specific/linux/regionset/default.nix1
-rw-r--r--pkgs/os-specific/linux/reptyr/default.nix1
-rw-r--r--pkgs/os-specific/linux/rfkill/udev.nix1
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix12
-rw-r--r--pkgs/os-specific/linux/rust-out-of-tree-module/default.nix3
-rw-r--r--pkgs/os-specific/linux/ryzen-smu/default.nix69
-rw-r--r--pkgs/os-specific/linux/ryzenadj/default.nix5
-rw-r--r--pkgs/os-specific/linux/schedtool/default.nix1
-rw-r--r--pkgs/os-specific/linux/sd-switch/default.nix1
-rw-r--r--pkgs/os-specific/linux/service-wrapper/default.nix1
-rw-r--r--pkgs/os-specific/linux/setools/default.nix4
-rw-r--r--pkgs/os-specific/linux/seturgent/default.nix1
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix4
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix1
-rw-r--r--pkgs/os-specific/linux/smemstat/default.nix1
-rw-r--r--pkgs/os-specific/linux/sssd/default.nix17
-rw-r--r--pkgs/os-specific/linux/statifier/default.nix1
-rw-r--r--pkgs/os-specific/linux/swapview/default.nix1
-rw-r--r--pkgs/os-specific/linux/switcheroo-control/default.nix1
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix113
-rw-r--r--pkgs/os-specific/linux/system76-power/default.nix1
-rw-r--r--pkgs/os-specific/linux/system76-scheduler/default.nix1
-rw-r--r--pkgs/os-specific/linux/systemd-wait/default.nix1
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix8
-rw-r--r--pkgs/os-specific/linux/tailor-gui/default.nix3
-rw-r--r--pkgs/os-specific/linux/target-isns/default.nix1
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch25
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch70
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch25
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix19
-rw-r--r--pkgs/os-specific/linux/tmon/default.nix1
-rw-r--r--pkgs/os-specific/linux/tomb/default.nix6
-rw-r--r--pkgs/os-specific/linux/tpacpi-bat/default.nix1
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix1
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix1
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix1
-rw-r--r--pkgs/os-specific/linux/tunctl/default.nix1
-rw-r--r--pkgs/os-specific/linux/turbostat/default.nix1
-rw-r--r--pkgs/os-specific/linux/tuxedo-rs/default.nix6
-rw-r--r--pkgs/os-specific/linux/ulogd/default.nix1
-rw-r--r--pkgs/os-specific/linux/ultrablue-server/default.nix1
-rw-r--r--pkgs/os-specific/linux/undervolt/default.nix1
-rw-r--r--pkgs/os-specific/linux/unscd/default.nix1
-rw-r--r--pkgs/os-specific/linux/unstick/default.nix1
-rw-r--r--pkgs/os-specific/linux/untie/default.nix1
-rw-r--r--pkgs/os-specific/linux/upower/default.nix6
-rw-r--r--pkgs/os-specific/linux/usbrelay/default.nix1
-rw-r--r--pkgs/os-specific/linux/usbtop/default.nix1
-rw-r--r--pkgs/os-specific/linux/usermount/default.nix1
-rw-r--r--pkgs/os-specific/linux/v4l2-relayd/default.nix1
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix1
-rw-r--r--pkgs/os-specific/linux/v86d/default.nix1
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix1
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/gui.nix1
-rw-r--r--pkgs/os-specific/linux/x86_energy_perf_policy/default.nix1
-rw-r--r--pkgs/os-specific/linux/xf86-input-wacom/default.nix4
-rw-r--r--pkgs/os-specific/linux/xone/default.nix25
-rw-r--r--pkgs/os-specific/linux/xsos/default.nix1
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix1
-rw-r--r--pkgs/os-specific/linux/zenstates/default.nix1
-rw-r--r--pkgs/os-specific/linux/zfs/2_1.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/2_2.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix8
-rw-r--r--pkgs/os-specific/solo5/default.nix78
338 files changed, 3535 insertions, 2524 deletions
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index 398b2ff6fa6dc..1f321f032516f 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -1,904 +1,77 @@
 { stdenv, lib, stdenvNoCC
 , makeScopeWithSplicing', generateSplicesForMkScope
 , buildPackages
-, bsdSetupHook, makeSetupHook
-, fetchgit, fetchzip, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
-, zlib, expat, libmd
-, runCommand, writeShellScript, writeText, symlinkJoin
+, fetchgit, fetchzip
 }:
 
 let
   inherit (buildPackages.buildPackages) rsync;
 
-  version = "13.1.0";
-
-  # `BuildPackages.fetchgit` avoids some probably splicing-caused infinite
-  # recursion.
-  freebsdSrc = buildPackages.fetchgit {
-    url = "https://git.FreeBSD.org/src.git";
-    rev = "release/${version}";
-    sha256 = "14nhk0kls83xfb64d5xy14vpi6k8laswjycjg80indq9pkcr2rlv";
-  };
-
-  freebsdSetupHook = makeSetupHook {
-    name = "freebsd-setup-hook";
-  } ./setup-hook.sh;
-
-  mkBsdArch = stdenv':  {
-    x86_64 = "amd64";
-    aarch64 = "arm64";
-    i486 = "i386";
-    i586 = "i386";
-    i686 = "i386";
-  }.${stdenv'.hostPlatform.parsed.cpu.name}
-    or stdenv'.hostPlatform.parsed.cpu.name;
-
-  install-wrapper = ''
-    set -eu
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
 
-    args=()
-    declare -i path_args=0
-
-    while (( $# )); do
-      if (( $# == 1 )); then
-        if (( path_args > 1)) || [[ "$1" = */ ]]; then
-          mkdir -p "$1"
-        else
-          mkdir -p "$(dirname "$1")"
-        fi
-      fi
-      case $1 in
-        -C) ;;
-        -o | -g) shift ;;
-        -s) ;;
-        -m | -l)
-          # handle next arg so not counted as path arg
-          args+=("$1" "$2")
-          shift
-          ;;
-        -*) args+=("$1") ;;
-        *)
-          path_args+=1
-          args+=("$1")
-          ;;
-      esac
-      shift
-    done
-  '';
+  version = "13.1.0";
+  branch = "release/${version}";
 
 in makeScopeWithSplicing' {
   otherSplices = generateSplicesForMkScope "freebsd";
-  f = (self: let
-    inherit (self) mkDerivation;
-  in {
-  inherit freebsdSrc;
-
-  ports = fetchzip {
-    url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
-    sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
-  };
-
-  # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
-  # See note in ../netbsd/default.nix.
-
-  compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
-
-  mkDerivation = lib.makeOverridable (attrs: let
-    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
-  in stdenv'.mkDerivation (rec {
-    pname = "${attrs.pname or (baseNameOf attrs.path)}-freebsd";
-    inherit version;
-    src = runCommand "${pname}-filtered-src" {
-      nativeBuildInputs = [ rsync ];
-    } ''
-      for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [])}; do
-        set -x
-        path="$out/$p"
-        mkdir -p "$(dirname "$path")"
-        src_path="${freebsdSrc}/$p"
-        if [[ -d "$src_path" ]]; then src_path+=/; fi
-        rsync --chmod="+w" -r "$src_path" "$path"
-        set +x
-      done
-    '';
-
-    extraPaths = [ ];
-
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal
-      install tsort lorder mandoc groff #statHook
-    ];
-    buildInputs = with self; compatIfNeeded;
-
-    HOST_SH = stdenv'.shell;
-
-    # Since STRIP below is the flag
-    STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
-
-    makeFlags = [
-      "STRIP=-s" # flag to install, not command
-    ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
-
-    # amd64 not x86_64 for this on unlike NetBSD
-    MACHINE_ARCH = mkBsdArch stdenv';
-
-    MACHINE = mkBsdArch stdenv';
-
-    MACHINE_CPUARCH = MACHINE_ARCH;
-
-    COMPONENT_PATH = attrs.path or null;
-
-    strictDeps = true;
-
-    meta = with lib; {
-      maintainers = with maintainers; [ ericson2314 ];
-      platforms = platforms.unix;
-      license = licenses.bsd2;
+  f = (self: lib.packagesFromDirectoryRecursive {
+    callPackage = self.callPackage;
+    directory = ./pkgs;
+  } // {
+    sourceData = versions.${branch};
+
+    ports = fetchzip {
+      url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
+      sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
     };
-  } // lib.optionalAttrs stdenv'.hasCC {
-    # TODO should CC wrapper set this?
-    CPP = "${stdenv'.cc.targetPrefix}cpp";
-  } // lib.optionalAttrs stdenv'.isDarwin {
-    MKRELRO = "no";
-  } // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-    HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-    HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.isx86_32) {
-    USE_SSP = "no";
-  } // lib.optionalAttrs (attrs.headersOnly or false) {
-    installPhase = "includesPhase";
-    dontBuild = true;
-  } // attrs));
-
-  ##
-  ## START BOOTSTRAPPING
-  ##
-  makeMinimal = mkDerivation rec {
-    inherit (self.make) path;
-
-    buildInputs = with self; [];
-    nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook freebsdSetupHook ];
-
-    skipIncludesPhase = true;
-
-    makeFlags = [];
-
-    postPatch = ''
-      patchShebangs configure
-      ${self.make.postPatch}
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      sh ./make-bootstrap.sh
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      install -D bmake "$out/bin/bmake"
-      ln -s "$out/bin/bmake" "$out/bin/make"
-      mkdir -p "$out/share"
-      cp -r "$BSDSRCDIR/share/mk" "$out/share/mk"
-      find "$out/share/mk" -type f -print0 |
-        while IFS= read -r -d "" f; do
-          substituteInPlace "$f" --replace 'usr/' ""
-        done
-      substituteInPlace "$out/share/mk/bsd.symver.mk" \
-        --replace '/share/mk' "$out/share/mk"
-
-      runHook postInstall
-    '';
-
-    postInstall = lib.optionalString (!stdenv.targetPlatform.isFreeBSD) ''
-      boot_mk="$BSDSRCDIR/tools/build/mk"
-      cp "$boot_mk"/Makefile.boot* "$out/share/mk"
-      replaced_mk="$out/share/mk.orig"
-      mkdir "$replaced_mk"
-      mv "$out"/share/mk/bsd.{lib,prog}.mk "$replaced_mk"
-      for m in bsd.{lib,prog}.mk; do
-        cp "$boot_mk/$m" "$out/share/mk"
-        substituteInPlace "$out/share/mk/$m" --replace '../../../share/mk' '../mk.orig'
-      done
-    '';
-
-    extraPaths = with self; make.extraPaths;
-  };
-
-  # Wrap NetBSD's install
-  boot-install = buildPackages.writeShellScriptBin "boot-install" (install-wrapper + ''
-
-    ${buildPackages.netbsd.install}/bin/xinstall "''${args[@]}"
-  '');
-
-  compat = mkDerivation rec {
-    pname = "compat";
-    path = "tools/build";
-    extraPaths = [
-      "lib/libc/db"
-      "lib/libc/stdlib" # getopt
-      "lib/libc/gen" # getcap
-      "lib/libc/locale" # rpmatch
-    ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-      "lib/libc/string" # strlcpy
-      "lib/libutil"
-    ] ++ [
-      "contrib/libc-pwcache"
-      "contrib/libc-vis"
-      "sys/libkern"
-      "sys/kern/subr_capability.c"
-
-      # Take only individual headers, or else we will clobber native libc, etc.
-
-      "sys/rpc/types.h"
-
-      # Listed in Makekfile as INC
-      "include/mpool.h"
-      "include/ndbm.h"
-      "include/err.h"
-      "include/stringlist.h"
-      "include/a.out.h"
-      "include/nlist.h"
-      "include/db.h"
-      "include/getopt.h"
-      "include/nl_types.h"
-      "include/elf.h"
-      "sys/sys/ctf.h"
-
-      # Listed in Makekfile as SYSINC
-
-      "sys/sys/capsicum.h"
-      "sys/sys/caprights.h"
-      "sys/sys/imgact_aout.h"
-      "sys/sys/nlist_aout.h"
-      "sys/sys/nv.h"
-      "sys/sys/dnv.h"
-      "sys/sys/cnv.h"
-
-      "sys/sys/elf32.h"
-      "sys/sys/elf64.h"
-      "sys/sys/elf_common.h"
-      "sys/sys/elf_generic.h"
-      "sys/${mkBsdArch stdenv}/include"
-    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
-      "sys/x86/include"
-    ] ++ [
-
-      "sys/sys/queue.h"
-      "sys/sys/md5.h"
-      "sys/sys/sbuf.h"
-      "sys/sys/tree.h"
-      "sys/sys/font.h"
-      "sys/sys/consio.h"
-      "sys/sys/fnv_hash.h"
-
-      "sys/crypto/chacha20/_chacha.h"
-      "sys/crypto/chacha20/chacha.h"
-      # included too, despite ".c"
-      "sys/crypto/chacha20/chacha.c"
-
-      "sys/fs"
-      "sys/ufs"
-      "sys/sys/disk"
-
-      "lib/libcapsicum"
-      "lib/libcasper"
-    ];
-
-    patches = [
-      ./compat-install-dirs.patch
-      ./compat-fix-typedefs-locations.patch
-    ];
-
-    preBuild = ''
-      NIX_CFLAGS_COMPILE+=' -I../../include -I../../sys'
-
-      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys
-      cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys/${mkBsdArch stdenv}
-    '' + lib.optionalString stdenv.hostPlatform.isx86 ''
-      cp ../../sys/x86/include/elf.h ../../sys/x86
-    '';
-
-    setupHooks = [
-      ../../../build-support/setup-hooks/role.bash
-      ./compat-setup-hook.sh
-    ];
-
-    # This one has an ifdefed `#include_next` that makes it annoying.
-    postInstall = ''
-      rm ''${!outputDev}/0-include/libelf.h
-    '';
-
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal
-      boot-install
-
-      which
-    ];
-    buildInputs = [ expat zlib ];
-
-    makeFlags = [
-      "STRIP=-s" # flag to install, not command
-      "MK_WERROR=no"
-      "HOST_INCLUDE_ROOT=${lib.getDev stdenv.cc.libc}/include"
-      "INSTALL=boot-install"
-    ];
-
-    preIncludes = ''
-      mkdir -p $out/{0,1}-include
-      cp --no-preserve=mode -r cross-build/include/common/* $out/0-include
-    '' + lib.optionalString stdenv.hostPlatform.isLinux ''
-      cp --no-preserve=mode -r cross-build/include/linux/* $out/1-include
-    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      cp --no-preserve=mode -r cross-build/include/darwin/* $out/1-include
-    '';
-  };
-
-  libnetbsd = mkDerivation {
-    path = "lib/libnetbsd";
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal mandoc groff
-      (if stdenv.hostPlatform == stdenv.buildPlatform
-       then boot-install
-       else install)
-    ];
-    patches = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
-      ./libnetbsd-do-install.patch
-      #./libnetbsd-define-__va_list.patch
-    ];
-    makeFlags = [
-      "STRIP=-s" # flag to install, not command
-      "MK_WERROR=no"
-    ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
-    buildInputs = with self; compatIfNeeded;
-  };
-
-  # HACK: to ensure parent directories exist. This emulates GNU
-  # install’s -D option. No alternative seems to exist in BSD install.
-  install = let binstall = writeShellScript "binstall" (install-wrapper + ''
-
-    @out@/bin/xinstall "''${args[@]}"
-  ''); in mkDerivation {
-    path = "usr.bin/xinstall";
-    extraPaths = with self; [ mtree.path ];
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal mandoc groff
-      (if stdenv.hostPlatform == stdenv.buildPlatform
-       then boot-install
-       else install)
-    ];
-    skipIncludesPhase = true;
-    buildInputs = with self; compatIfNeeded ++ [ libmd libnetbsd ];
-    makeFlags = [
-      "STRIP=-s" # flag to install, not command
-      "MK_WERROR=no"
-      "TESTSDIR=${builtins.placeholder "test"}"
-    ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
-    postInstall = ''
-      install -D -m 0550 ${binstall} $out/bin/binstall
-      substituteInPlace $out/bin/binstall --subst-var out
-      mv $out/bin/install $out/bin/xinstall
-      ln -s ./binstall $out/bin/install
-    '';
-    outputs = [ "out" "man" "test" ];
-  };
-
-  sed = mkDerivation {
-    path = "usr.bin/sed";
-    TESTSRC = "${freebsdSrc}/contrib/netbsd-tests";
-    MK_TESTS = "no";
-  };
-
-  # Don't add this to nativeBuildInputs directly.  Use statHook instead.
-  stat = mkDerivation {
-    path = "usr.bin/stat";
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-    ];
-  };
-
-  # stat isn't in POSIX, and NetBSD stat supports a completely
-  # different range of flags than GNU stat, so including it in PATH
-  # breaks stdenv.  Work around that with a hook that will point
-  # NetBSD's build system and NetBSD stat without including it in
-  # PATH.
-  statHook = makeSetupHook {
-    name = "netbsd-stat-hook";
-  } (writeText "netbsd-stat-hook-impl" ''
-    makeFlagsArray+=(TOOL_STAT=${self.stat}/bin/stat)
-  '');
-
-  tsort = mkDerivation {
-    path = "usr.bin/tsort";
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-    ];
-  };
-
-  lorder = mkDerivation rec {
-    path = "usr.bin/lorder";
-    noCC = true;
-    dontBuild = true;
-    installPhase = ''
-      mkdir -p "$out/bin" "$man/share/man"
-      mv "lorder.sh" "$out/bin/lorder"
-      chmod +x "$out/bin/lorder"
-      mv "lorder.1" "$man/share/man"
-    '';
-    nativeBuildInputs = [ bsdSetupHook freebsdSetupHook ];
-    buildInputs = [];
-    outputs = [ "out" "man" ];
-  };
-
-  ##
-  ## END BOOTSTRAPPING
-  ##
-
-  ##
-  ## START COMMAND LINE TOOLS
-  ##
-  make = mkDerivation {
-    path = "contrib/bmake";
-    version = "9.2";
-    postPatch = ''
-      # make needs this to pick up our sys make files
-      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
-
-    '' + lib.optionalString stdenv.isDarwin ''
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
-        --replace '-Wl,--fatal-warnings' "" \
-        --replace '-Wl,--warn-shared-textrel' ""
-    '';
-    postInstall = ''
-      make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
-    '';
-    extraPaths = [ "share/mk" ]
-      ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "tools/build/mk";
-  };
-  mtree = mkDerivation {
-    path = "contrib/mtree";
-    extraPaths = with self; [ mknod.path ];
-  };
-
-  mknod = mkDerivation {
-    path = "sbin/mknod";
-  };
-
-  rpcgen = mkDerivation rec {
-    path = "usr.bin/rpcgen";
-    patches = lib.optionals (stdenv.hostPlatform.libc == "glibc") [
-      # `WUNTRACED` is defined privately `bits/waitflags.h` in glibc.
-      # But instead of having a regular header guard, it has some silly
-      # non-modular logic. `stdlib.h` will include it if `sys/wait.h`
-      # hasn't yet been included (for it would first), and vice versa.
-      #
-      # The problem is that with the FreeBSD compat headers, one of
-      # those headers ends up included other headers...which ends up
-      # including the other one, this means by the first time we reach
-      # `#include `<bits/waitflags.h>`, both `_SYS_WAIT_H` and
-      # `_STDLIB_H` are already defined! Thus, we never ned up including
-      # `<bits/waitflags.h>` and defining `WUNTRACED`.
-      #
-      # This hacks around this by manually including `WUNTRACED` until
-      # the problem is fixed properly in glibc.
-      ./rpcgen-glibc-hack.patch
-    ];
-  };
-
-  gencat = mkDerivation {
-    path = "usr.bin/gencat";
-  };
 
-  file2c = mkDerivation {
-    path = "usr.bin/file2c";
-    MK_TESTS = "no";
-  };
+    # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
+    # See note in ../netbsd/default.nix.
 
-  libnv = mkDerivation {
-    path = "lib/libnv";
-    extraPaths = [
-      "sys/contrib/libnv"
-      "sys/sys"
-    ];
-    MK_TESTS = "no";
-  };
+    compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
 
-  libsbuf = mkDerivation {
-    path = "lib/libsbuf";
-    extraPaths = [
-      "sys/kern"
-    ];
-    MK_TESTS = "no";
-  };
+    freebsd-lib = import ./lib { inherit version; };
 
-  libelf = mkDerivation {
-    path = "lib/libelf";
-    extraPaths = [
-      "contrib/elftoolchain/libelf"
-      "contrib/elftoolchain/common"
-      "sys/sys/elf32.h"
-      "sys/sys/elf64.h"
-      "sys/sys/elf_common.h"
-    ];
-    BOOTSTRAPPING = !stdenv.isFreeBSD;
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
+    # Overridden arguments avoid cross package-set splicing issues,
+    # otherwise would just use implicit
+    # `lib.packagesFromDirectoryRecursive` auto-call.
 
-      m4
-    ];
-    MK_TESTS = "no";
-  };
-
-  libdwarf = mkDerivation {
-    path = "lib/libdwarf";
-    extraPaths = [
-      "contrib/elftoolchain/libdwarf"
-      "contrib/elftoolchain/common"
-      "sys/sys/elf32.h"
-      "sys/sys/elf64.h"
-      "sys/sys/elf_common.h"
-    ];
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-
-      m4
-    ];
-    buildInputs = with self; compatIfNeeded ++ [
-      libelf
-    ];
-    MK_TESTS = "no";
-  };
-
-  uudecode = mkDerivation {
-    path = "usr.bin/uudecode";
-    MK_TESTS = "no";
-  };
-
-  config = mkDerivation {
-    path = "usr.sbin/config";
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-
-      flex byacc file2c
-    ];
-    buildInputs = with self; compatIfNeeded ++ [ libnv libsbuf ];
-  };
-  ##
-  ## END COMMAND LINE TOOLS
-  ##
-
-  ##
-  ## START HEADERS
-  ##
-  include = mkDerivation {
-    path = "include";
-
-    extraPaths = [
-      "contrib/libc-vis"
-      "etc/mtree/BSD.include.dist"
-      "sys"
-    ];
-
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal
-      install
-      mandoc groff rsync /*nbperf*/ rpcgen
-
-      # HACK use NetBSD's for now
-      buildPackages.netbsd.mtree
-    ];
-
-    patches = [
-      ./no-perms-BSD.include.dist.patch
-    ];
-
-    # The makefiles define INCSDIR per subdirectory, so we have to set
-    # something else on the command line so those definitions aren't
-    # overridden.
-    postPatch = ''
-      find "$BSDSRCDIR" -name Makefile -exec \
-        sed -i -E \
-          -e 's_/usr/include_''${INCSDIR0}_' \
-          {} \;
-    '';
-
-    makeFlags = [
-      "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp"
-    ];
-
-    # multiple header dirs, see above
-    postConfigure = ''
-      makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
-    '';
-
-    headersOnly = true;
-
-    MK_HESIOD = "yes";
-
-    meta.platforms = lib.platforms.freebsd;
-  };
-
-  ##
-  ## END HEADERS
-  ##
-
-  csu = mkDerivation {
-    path = "lib/csu";
-    extraPaths = with self; [
-      "lib/Makefile.inc"
-      "lib/libc/include/libc_private.h"
-    ];
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal
-      install
-
-      flex byacc gencat
-    ];
-    buildInputs = with self; [ include ];
-    MK_TESTS = "no";
-    meta.platforms = lib.platforms.freebsd;
-  };
-
-  libc = mkDerivation rec {
-    pname = "libc";
-    path = "lib/libc";
-    extraPaths = [
-      "etc/group"
-      "etc/master.passwd"
-      "etc/shells"
-      "lib/libmd"
-      "lib/libutil"
-      "lib/msun"
-      "sys/kern"
-      "sys/libkern"
-      "sys/sys"
-      "sys/crypto/chacha20"
-      "include/rpcsvc"
-      "contrib/jemalloc"
-      "contrib/gdtoa"
-      "contrib/libc-pwcache"
-      "contrib/libc-vis"
-      "contrib/tzcode/stdtime"
-
-      # libthr
-      "lib/libthr"
-      "lib/libthread_db"
-      "libexec/rtld-elf"
-
-      # librpcsvc
-      "lib/librpcsvc"
-
-      # librt
-      "lib/librt"
-
-      # libcrypt
-      "lib/libcrypt"
-      "lib/libmd"
-      "sys/crypto/sha2"
-    ];
-
-    patches = [
-      # Hack around broken propogating MAKEFLAGS to submake, just inline logic
-      ./libc-msun-arch-subdir.patch
-
-      # Don't force -lcompiler-rt, we don't actually call it that
-      ./libc-no-force--lcompiler-rt.patch
-
-      # Fix extra include dir to get rpcsvc headers.
-      ./librpcsvc-include-subdir.patch
-    ];
-
-    postPatch = ''
-      substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
-    '';
-
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal
-      install
-
-      flex byacc gencat rpcgen
-    ];
-    buildInputs = with self; [ include csu ];
-    env.NIX_CFLAGS_COMPILE = "-B${self.csu}/lib";
-
-    # Suppress lld >= 16 undefined version errors
-    # https://github.com/freebsd/freebsd-src/commit/2ba84b4bcdd6012e8cfbf8a0d060a4438623a638
-    env.NIX_LDFLAGS = lib.optionalString (stdenv.targetPlatform.linker == "lld") "--undefined-version";
-
-    makeFlags = [
-      "STRIP=-s" # flag to install, not command
-      # lib/libc/gen/getgrent.c has sketchy cast from `void *` to enum
-      "MK_WERROR=no"
-    ];
-
-    MK_SYMVER = "yes";
-    MK_SSP = "yes";
-    MK_NLS = "yes";
-    MK_ICONV = "no"; # TODO make srctop
-    MK_NS_CACHING = "yes";
-    MK_INET6_SUPPORT = "yes";
-    MK_HESIOD = "yes";
-    MK_NIS = "yes";
-    MK_HYPERV = "yes";
-    MK_FP_LIBC = "yes";
-
-    MK_TCSH = "no";
-    MK_MALLOC_PRODUCTION = "yes";
-
-    MK_TESTS = "no";
-
-    postInstall = ''
-      pushd ${self.include}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      pushd ${self.csu}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      sed -i -e 's| [^ ]*/libc_nonshared.a||' $out/lib/libc.so
-
-      $CC -nodefaultlibs -lgcc -shared -o $out/lib/libgcc_s.so
-
-      NIX_CFLAGS_COMPILE+=" -B$out/lib"
-      NIX_CFLAGS_COMPILE+=" -I$out/include"
-      NIX_LDFLAGS+=" -L$out/lib"
-
-      make -C $BSDSRCDIR/lib/libthr $makeFlags
-      make -C $BSDSRCDIR/lib/libthr $makeFlags install
-
-      make -C $BSDSRCDIR/lib/msun $makeFlags
-      make -C $BSDSRCDIR/lib/msun $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libutil $makeFlags
-      make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librt $makeFlags
-      make -C $BSDSRCDIR/lib/librt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
-    '';
-
-    meta.platforms = lib.platforms.freebsd;
-  };
-
-  ##
-  ## Kernel
-  ##
-
-  libspl = mkDerivation {
-    path = "cddl/lib/libspl";
-    extraPaths = [
-      "sys/contrib/openzfs/lib/libspl"
-      "sys/contrib/openzfs/include"
-
-      "cddl/compat/opensolaris/include"
-      "sys/contrib/openzfs/module/icp/include"
-      "sys/modules/zfs"
-    ];
-    # nativeBuildInputs = with buildPackages.freebsd; [
-    #   bsdSetupHook freebsdSetupHook
-    #   makeMinimal install mandoc groff
-
-    #   flex byacc file2c
-    # ];
-    # buildInputs = with self; compatIfNeeded ++ [ libnv libsbuf ];
-    meta.license = lib.licenses.cddl;
-  };
-
-  ctfconvert = mkDerivation {
-    path = "cddl/usr.bin/ctfconvert";
-    extraPaths = [
-      "cddl/compat/opensolaris"
-      "cddl/contrib/opensolaris"
-      "sys/cddl/compat/opensolaris"
-      "sys/cddl/contrib/opensolaris"
-      "sys/contrib/openzfs"
-    ];
-    OPENSOLARIS_USR_DISTDIR = "$(SRCTOP)/cddl/contrib/opensolaris";
-    OPENSOLARIS_SYS_DISTDIR = "$(SRCTOP)/sys/cddl/contrib/opensolaris";
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-
-      # flex byacc file2c
-    ];
-    buildInputs = with self; compatIfNeeded ++ [
-      libelf libdwarf zlib libspl
-    ];
-    meta.license = lib.licenses.cddl;
-  };
-
-  xargs-j = substituteAll {
-    name = "xargs-j";
-    shell = runtimeShell;
-    src = ../xargs-j.sh;
-    dir = "bin";
-    isExecutable = true;
-  };
-
-  sys = mkDerivation (let
-    cfg = "MINIMAL";
-  in rec {
-    path = "sys";
-
-    nativeBuildInputs = with buildPackages.freebsd; [
-      bsdSetupHook freebsdSetupHook
-      makeMinimal install mandoc groff
-
-      config rpcgen file2c gawk uudecode xargs-j
-      #ctfconvert
-    ];
-
-    patches = [
-      ./sys-gnu-date.patch
-      ./sys-no-explicit-intrinsics-dep.patch
-    ];
-
-    # --dynamic-linker /red/herring is used when building the kernel.
-    NIX_ENFORCE_PURITY = 0;
-
-    AWK = "${buildPackages.gawk}/bin/awk";
-
-    CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
-
-    MK_CTF = "no";
+    compat = self.callPackage ./pkgs/compat/package.nix {
+      inherit stdenv;
+      inherit (buildPackages.freebsd) makeMinimal boot-install;
+    };
 
-    KODIR = "${builtins.placeholder "out"}/kernel";
-    KMODDIR = "${builtins.placeholder "out"}/kernel";
-    DTBDIR = "${builtins.placeholder"out"}/dbt";
+    csu = self.callPackage ./pkgs/csu.nix {
+      inherit (buildPackages.freebsd) makeMinimal install gencat;
+      inherit (self) include;
+    };
 
-    KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
-    KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
-    KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+    include = self.callPackage ./pkgs/include/package.nix {
+      inherit (buildPackages.freebsd) makeMinimal install rpcgen;
+    };
 
-    skipIncludesPhase = true;
+    install = self.callPackage ./pkgs/install.nix {
+      inherit (buildPackages.freebsd) makeMinimal;
+      inherit (self) mtree libnetbsd;
+    };
 
-    configurePhase = ''
-      runHook preConfigure
+    libc = self.callPackage ./pkgs/libc/package.nix {
+      inherit (buildPackages.freebsd) makeMinimal install gencat rpcgen;
+      inherit (self) csu include;
+    };
 
-      for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
-        substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
-      done
+    libnetbsd = self.callPackage ./pkgs/libnetbsd/package.nix {
+      inherit (buildPackages.freebsd) makeMinimal;
+    };
 
-      for f in conf/*.mk; do
-        substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
-      done
+    mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+      inherit stdenv;
+      inherit (buildPackages.freebsd) makeMinimal install tsort;
+    };
 
-      cd ${mkBsdArch stdenv}/conf
-      sed -i ${cfg} \
-        -e 's/WITH_CTF=1/WITH_CTF=0/' \
-        -e '/KDTRACE/d'
-      config ${cfg}
+    makeMinimal = self.callPackage ./pkgs/makeMinimal.nix {
+      inherit (self) make;
+    };
 
-      runHook postConfigure
-    '';
-    preBuild = ''
-      cd ../compile/${cfg}
-    '';
   });
-
-});
 }
diff --git a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
index b6dab0d8bdfc5..d62c01f5eb887 100644
--- a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
   INSTALL_AS_USER = true;
   NO_CHECKSUM = true;
   NO_MTREE = true;
-  SRC_BASE = freebsd.freebsdSrc;
+  SRC_BASE = freebsd.source;
 
   preUnpack = ''
     export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
diff --git a/pkgs/os-specific/bsd/freebsd/lib/default.nix b/pkgs/os-specific/bsd/freebsd/lib/default.nix
new file mode 100644
index 0000000000000..30fea7e17dce6
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/lib/default.nix
@@ -0,0 +1,16 @@
+{ version }:
+
+{
+  inherit version;
+
+  mkBsdArch = stdenv':  {
+    x86_64 = "amd64";
+    aarch64 = "arm64";
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  install-wrapper = builtins.readFile ./install-wrapper.sh;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh b/pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh
new file mode 100644
index 0000000000000..91a7a2679f209
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/lib/install-wrapper.sh
@@ -0,0 +1,30 @@
+set -eu
+
+args=()
+declare -i path_args=0
+
+while (( $# )); do
+  if (( $# == 1 )); then
+    if (( path_args > 1)) || [[ "$1" = */ ]]; then
+      mkdir -p "$1"
+    else
+      mkdir -p "$(dirname "$1")"
+    fi
+  fi
+  case $1 in
+    -C) ;;
+    -o | -g) shift ;;
+    -s) ;;
+    -m | -l)
+      # handle next arg so not counted as path arg
+      args+=("$1" "$2")
+      shift
+      ;;
+    -*) args+=("$1") ;;
+    *)
+      path_args+=1
+      args+=("$1")
+      ;;
+  esac
+  shift
+done
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix b/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix
new file mode 100644
index 0000000000000..71ecef1bcae47
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/boot-install.nix
@@ -0,0 +1,7 @@
+{ buildPackages, freebsd-lib }:
+
+# Wrap NetBSD's install
+buildPackages.writeShellScriptBin "boot-install" (freebsd-lib.install-wrapper + ''
+
+  ${buildPackages.netbsd.install}/bin/xinstall "''${args[@]}"
+'')
diff --git a/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch
index 3336a2504e584..3336a2504e584 100644
--- a/pkgs/os-specific/bsd/freebsd/compat-fix-typedefs-locations.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-fix-typedefs-locations.patch
diff --git a/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch
index 9bb2bea32ee98..9bb2bea32ee98 100644
--- a/pkgs/os-specific/bsd/freebsd/compat-install-dirs.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-install-dirs.patch
diff --git a/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-setup-hook.sh
index 6c3fda4e95ac9..6c3fda4e95ac9 100644
--- a/pkgs/os-specific/bsd/freebsd/compat-setup-hook.sh
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/compat-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
new file mode 100644
index 0000000000000..5e4528fbf46a1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
@@ -0,0 +1,135 @@
+{ lib, stdenv, mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, boot-install
+, which
+, freebsd-lib
+, expat, zlib,
+}:
+
+let
+  inherit (freebsd-lib) mkBsdArch;
+in
+
+mkDerivation rec {
+  pname = "compat";
+  path = "tools/build";
+  extraPaths = [
+    "lib/libc/db"
+    "lib/libc/stdlib" # getopt
+    "lib/libc/gen" # getcap
+    "lib/libc/locale" # rpmatch
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "lib/libc/string" # strlcpy
+    "lib/libutil"
+  ] ++ [
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "sys/libkern"
+    "sys/kern/subr_capability.c"
+
+    # Take only individual headers, or else we will clobber native libc, etc.
+
+    "sys/rpc/types.h"
+
+    # Listed in Makekfile as INC
+    "include/mpool.h"
+    "include/ndbm.h"
+    "include/err.h"
+    "include/stringlist.h"
+    "include/a.out.h"
+    "include/nlist.h"
+    "include/db.h"
+    "include/getopt.h"
+    "include/nl_types.h"
+    "include/elf.h"
+    "sys/sys/ctf.h"
+
+    # Listed in Makekfile as SYSINC
+
+    "sys/sys/capsicum.h"
+    "sys/sys/caprights.h"
+    "sys/sys/imgact_aout.h"
+    "sys/sys/nlist_aout.h"
+    "sys/sys/nv.h"
+    "sys/sys/dnv.h"
+    "sys/sys/cnv.h"
+
+    "sys/sys/elf32.h"
+    "sys/sys/elf64.h"
+    "sys/sys/elf_common.h"
+    "sys/sys/elf_generic.h"
+    "sys/${mkBsdArch stdenv}/include"
+  ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+    "sys/x86/include"
+  ] ++ [
+
+    "sys/sys/queue.h"
+    "sys/sys/md5.h"
+    "sys/sys/sbuf.h"
+    "sys/sys/tree.h"
+    "sys/sys/font.h"
+    "sys/sys/consio.h"
+    "sys/sys/fnv_hash.h"
+
+    "sys/crypto/chacha20/_chacha.h"
+    "sys/crypto/chacha20/chacha.h"
+    # included too, despite ".c"
+    "sys/crypto/chacha20/chacha.c"
+
+    "sys/fs"
+    "sys/ufs"
+    "sys/sys/disk"
+
+    "lib/libcapsicum"
+    "lib/libcasper"
+  ];
+
+  patches = [
+    ./compat-install-dirs.patch
+    ./compat-fix-typedefs-locations.patch
+  ];
+
+  preBuild = ''
+    NIX_CFLAGS_COMPILE+=' -I../../include -I../../sys'
+
+    cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys
+    cp ../../sys/${mkBsdArch stdenv}/include/elf.h ../../sys/sys/${mkBsdArch stdenv}
+  '' + lib.optionalString stdenv.hostPlatform.isx86 ''
+    cp ../../sys/x86/include/elf.h ../../sys/x86
+  '';
+
+  setupHooks = [
+    ../../../../../build-support/setup-hooks/role.bash
+    ./compat-setup-hook.sh
+  ];
+
+  # This one has an ifdefed `#include_next` that makes it annoying.
+  postInstall = ''
+    rm ''${!outputDev}/0-include/libelf.h
+  '';
+
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal
+    boot-install
+
+    which
+  ];
+  buildInputs = [ expat zlib ];
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "MK_WERROR=no"
+    "HOST_INCLUDE_ROOT=${lib.getDev stdenv.cc.libc}/include"
+    "INSTALL=boot-install"
+  ];
+
+  preIncludes = ''
+    mkdir -p $out/{0,1}-include
+    cp --no-preserve=mode -r cross-build/include/common/* $out/0-include
+  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
+    cp --no-preserve=mode -r cross-build/include/linux/* $out/1-include
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    cp --no-preserve=mode -r cross-build/include/darwin/* $out/1-include
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/config.nix b/pkgs/os-specific/bsd/freebsd/pkgs/config.nix
new file mode 100644
index 0000000000000..641cfc46b4e9b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/config.nix
@@ -0,0 +1,17 @@
+{ mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+, flex, byacc, file2c
+, compatIfNeeded, libnv, libsbuf
+}:
+
+mkDerivation {
+  path = "usr.sbin/config";
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+
+    flex byacc file2c
+  ];
+  buildInputs = compatIfNeeded ++ [ libnv libsbuf ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix b/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix
new file mode 100644
index 0000000000000..0b17cb1c8481d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/csu.nix
@@ -0,0 +1,25 @@
+{ lib, mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal
+, install
+, flex, byacc, gencat
+, include
+}:
+
+mkDerivation {
+  path = "lib/csu";
+  extraPaths = [
+    "lib/Makefile.inc"
+    "lib/libc/include/libc_private.h"
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal
+    install
+
+    flex byacc gencat
+  ];
+  buildInputs = [ include ];
+  MK_TESTS = "no";
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix
new file mode 100644
index 0000000000000..0aebc9b3d0b93
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ctfconvert.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+, compatIfNeeded, libelf, libdwarf, zlib, libspl
+}:
+
+mkDerivation {
+  path = "cddl/usr.bin/ctfconvert";
+  extraPaths = [
+    "cddl/compat/opensolaris"
+    "cddl/contrib/opensolaris"
+    "sys/cddl/compat/opensolaris"
+    "sys/cddl/contrib/opensolaris"
+    "sys/contrib/openzfs"
+  ];
+  OPENSOLARIS_USR_DISTDIR = "$(SRCTOP)/cddl/contrib/opensolaris";
+  OPENSOLARIS_SYS_DISTDIR = "$(SRCTOP)/sys/cddl/contrib/opensolaris";
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+
+    # flex byacc file2c
+  ];
+  buildInputs = compatIfNeeded ++ [
+    libelf libdwarf zlib libspl
+  ];
+  meta.license = lib.licenses.cddl;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/file2c.nix b/pkgs/os-specific/bsd/freebsd/pkgs/file2c.nix
new file mode 100644
index 0000000000000..ff35d97afe360
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/file2c.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/file2c";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix
new file mode 100644
index 0000000000000..430c4c5c43ac1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/package.nix
@@ -0,0 +1,5 @@
+{ makeSetupHook }:
+
+makeSetupHook {
+  name = "freebsd-setup-hook";
+} ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/freebsd/setup-hook.sh b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh
index 929782954ba77..929782954ba77 100644
--- a/pkgs/os-specific/bsd/freebsd/setup-hook.sh
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/freebsdSetupHook/setup-hook.sh
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix
new file mode 100644
index 0000000000000..e9ae9f27cc05b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/gencat.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/gencat";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch b/pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch
index 985617ee0f457..985617ee0f457 100644
--- a/pkgs/os-specific/bsd/freebsd/no-perms-BSD.include.dist.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/include/no-perms-BSD.include.dist.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
new file mode 100644
index 0000000000000..73fa887c51231
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
@@ -0,0 +1,56 @@
+{ lib, mkDerivation
+, buildPackages
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal
+, install
+, mandoc, groff, rsync /*, nbperf*/, rpcgen
+}:
+
+mkDerivation {
+  path = "include";
+
+  extraPaths = [
+    "contrib/libc-vis"
+    "etc/mtree/BSD.include.dist"
+    "sys"
+  ];
+
+  nativeBuildInputs =  [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal
+    install
+    mandoc groff rsync /*nbperf*/ rpcgen
+
+    # HACK use NetBSD's for now
+    buildPackages.netbsd.mtree
+  ];
+
+  patches = [
+    ./no-perms-BSD.include.dist.patch
+  ];
+
+  # The makefiles define INCSDIR per subdirectory, so we have to set
+  # something else on the command line so those definitions aren't
+  # overridden.
+  postPatch = ''
+    find "$BSDSRCDIR" -name Makefile -exec \
+      sed -i -E \
+        -e 's_/usr/include_''${INCSDIR0}_' \
+        {} \;
+  '';
+
+  makeFlags = [
+    "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp"
+  ];
+
+  # multiple header dirs, see above
+  postConfigure = ''
+    makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
+  '';
+
+  headersOnly = true;
+
+  MK_HESIOD = "yes";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/install.nix b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
new file mode 100644
index 0000000000000..3db6cd3633d49
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
@@ -0,0 +1,41 @@
+{ lib, stdenv, mkDerivation, writeShellScript
+, freebsd-lib
+, mtree
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, mandoc, groff
+, boot-install, install
+, compatIfNeeded, libmd, libnetbsd
+}:
+
+# HACK: to ensure parent directories exist. This emulates GNU
+# install’s -D option. No alternative seems to exist in BSD install.
+let
+  binstall = writeShellScript "binstall" (freebsd-lib.install-wrapper + ''
+
+    @out@/bin/xinstall "''${args[@]}"
+  '');
+in mkDerivation {
+  path = "usr.bin/xinstall";
+  extraPaths = [ mtree.path ];
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal mandoc groff
+    (if stdenv.hostPlatform == stdenv.buildPlatform
+     then boot-install
+     else install)
+  ];
+  skipIncludesPhase = true;
+  buildInputs = compatIfNeeded ++ [ libmd libnetbsd ];
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "MK_WERROR=no"
+    "TESTSDIR=${builtins.placeholder "test"}"
+  ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+  postInstall = ''
+    install -D -m 0550 ${binstall} $out/bin/binstall
+    substituteInPlace $out/bin/binstall --subst-var out
+    mv $out/bin/install $out/bin/xinstall
+    ln -s ./binstall $out/bin/install
+  '';
+  outputs = [ "out" "man" "test" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch b/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch
index 4a69e85a986a0..4a69e85a986a0 100644
--- a/pkgs/os-specific/bsd/freebsd/libc-msun-arch-subdir.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-msun-arch-subdir.patch
diff --git a/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch b/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch
index 60176fb73cf76..60176fb73cf76 100644
--- a/pkgs/os-specific/bsd/freebsd/libc-no-force--lcompiler-rt.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/libc-no-force--lcompiler-rt.patch
diff --git a/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch b/pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch
index 38e06682869fb..38e06682869fb 100644
--- a/pkgs/os-specific/bsd/freebsd/librpcsvc-include-subdir.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/librpcsvc-include-subdir.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
new file mode 100644
index 0000000000000..0225d44be4c3b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
@@ -0,0 +1,139 @@
+{ lib, stdenv, mkDerivation
+
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal
+, install
+, flex, byacc, gencat, rpcgen
+
+, csu, include
+}:
+
+mkDerivation rec {
+  pname = "libc";
+  path = "lib/libc";
+  extraPaths = [
+    "etc/group"
+    "etc/master.passwd"
+    "etc/shells"
+    "lib/libmd"
+    "lib/libutil"
+    "lib/msun"
+    "sys/kern"
+    "sys/libkern"
+    "sys/sys"
+    "sys/crypto/chacha20"
+    "include/rpcsvc"
+    "contrib/jemalloc"
+    "contrib/gdtoa"
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "contrib/tzcode/stdtime"
+
+    # libthr
+    "lib/libthr"
+    "lib/libthread_db"
+    "libexec/rtld-elf"
+
+    # librpcsvc
+    "lib/librpcsvc"
+
+    # librt
+    "lib/librt"
+
+    # libcrypt
+    "lib/libcrypt"
+    "lib/libmd"
+    "sys/crypto/sha2"
+  ];
+
+  patches = [
+    # Hack around broken propogating MAKEFLAGS to submake, just inline logic
+    ./libc-msun-arch-subdir.patch
+
+    # Don't force -lcompiler-rt, we don't actually call it that
+    ./libc-no-force--lcompiler-rt.patch
+
+    # Fix extra include dir to get rpcsvc headers.
+    ./librpcsvc-include-subdir.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
+  '';
+
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal
+    install
+
+    flex byacc gencat rpcgen
+  ];
+  buildInputs = [ include csu ];
+  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib";
+
+  # Suppress lld >= 16 undefined version errors
+  # https://github.com/freebsd/freebsd-src/commit/2ba84b4bcdd6012e8cfbf8a0d060a4438623a638
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.targetPlatform.linker == "lld") "--undefined-version";
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    # lib/libc/gen/getgrent.c has sketchy cast from `void *` to enum
+    "MK_WERROR=no"
+  ];
+
+  MK_SYMVER = "yes";
+  MK_SSP = "yes";
+  MK_NLS = "yes";
+  MK_ICONV = "no"; # TODO make srctop
+  MK_NS_CACHING = "yes";
+  MK_INET6_SUPPORT = "yes";
+  MK_HESIOD = "yes";
+  MK_NIS = "yes";
+  MK_HYPERV = "yes";
+  MK_FP_LIBC = "yes";
+
+  MK_TCSH = "no";
+  MK_MALLOC_PRODUCTION = "yes";
+
+  MK_TESTS = "no";
+
+  postInstall = ''
+    pushd ${include}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    pushd ${csu}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    sed -i -e 's| [^ ]*/libc_nonshared.a||' $out/lib/libc.so
+
+    $CC -nodefaultlibs -lgcc -shared -o $out/lib/libgcc_s.so
+
+    NIX_CFLAGS_COMPILE+=" -B$out/lib"
+    NIX_CFLAGS_COMPILE+=" -I$out/include"
+    NIX_LDFLAGS+=" -L$out/lib"
+
+    make -C $BSDSRCDIR/lib/libthr $makeFlags
+    make -C $BSDSRCDIR/lib/libthr $makeFlags install
+
+    make -C $BSDSRCDIR/lib/msun $makeFlags
+    make -C $BSDSRCDIR/lib/msun $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libutil $makeFlags
+    make -C $BSDSRCDIR/lib/libutil $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librt $makeFlags
+    make -C $BSDSRCDIR/lib/librt $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+  '';
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix
new file mode 100644
index 0000000000000..9fc8fc5f9a624
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libdwarf.nix
@@ -0,0 +1,27 @@
+{ lib, stdenv, mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+, m4
+, compatIfNeeded, libelf
+}:
+
+mkDerivation {
+  path = "lib/libdwarf";
+  extraPaths = [
+    "contrib/elftoolchain/libdwarf"
+    "contrib/elftoolchain/common"
+    "sys/sys/elf32.h"
+    "sys/sys/elf64.h"
+    "sys/sys/elf_common.h"
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+
+    m4
+  ];
+  buildInputs = compatIfNeeded ++ [
+    libelf
+  ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
new file mode 100644
index 0000000000000..a44ce1685e57d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+, m4
+}:
+
+mkDerivation {
+  path = "lib/libelf";
+  extraPaths = [
+    "contrib/elftoolchain/libelf"
+    "contrib/elftoolchain/common"
+    "sys/sys/elf32.h"
+    "sys/sys/elf64.h"
+    "sys/sys/elf_common.h"
+  ];
+  BOOTSTRAPPING = !stdenv.isFreeBSD;
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+
+    m4
+  ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch
index a7bd032d2be54..a7bd032d2be54 100644
--- a/pkgs/os-specific/bsd/freebsd/libnetbsd-do-install.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/libnetbsd-do-install.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
new file mode 100644
index 0000000000000..4011e4d8a6490
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv
+, mkDerivation
+, bsdSetupHook, freebsdSetupHook, makeMinimal, mandoc, groff
+, boot-install, install
+, compatIfNeeded
+}:
+
+mkDerivation {
+  path = "lib/libnetbsd";
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal mandoc groff
+    (if stdenv.hostPlatform == stdenv.buildPlatform
+     then boot-install
+     else install)
+  ];
+  patches = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
+    ./libnetbsd-do-install.patch
+    #./libnetbsd-define-__va_list.patch
+  ];
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "MK_WERROR=no"
+  ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+  buildInputs = compatIfNeeded;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libnv.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libnv.nix
new file mode 100644
index 0000000000000..6ce61e5a68c7b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libnv.nix
@@ -0,0 +1,10 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "lib/libnv";
+  extraPaths = [
+    "sys/contrib/libnv"
+    "sys/sys"
+  ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
new file mode 100644
index 0000000000000..719474dbb11ac
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
@@ -0,0 +1,9 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "lib/libsbuf";
+  extraPaths = [
+    "sys/kern"
+  ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix
new file mode 100644
index 0000000000000..da5445a09fcda
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libspl.nix
@@ -0,0 +1,21 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "cddl/lib/libspl";
+  extraPaths = [
+    "sys/contrib/openzfs/lib/libspl"
+    "sys/contrib/openzfs/include"
+
+    "cddl/compat/opensolaris/include"
+    "sys/contrib/openzfs/module/icp/include"
+    "sys/modules/zfs"
+  ];
+  # nativeBuildInputs = [
+  #   bsdSetupHook freebsdSetupHook
+  #   makeMinimal install mandoc groff
+
+  #   flex byacc file2c
+  # ];
+  # buildInputs = compatIfNeeded ++ [ libnv libsbuf ];
+  meta.license = lib.licenses.cddl;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
new file mode 100644
index 0000000000000..c420d0daf8520
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, lib, stdenv }:
+mkDerivation {
+  path = "lib/libutil";
+  extraPaths = ["lib/libc/gen"];
+  clangFixup = true;
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix
new file mode 100644
index 0000000000000..d1fd86ab5e463
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/lorder.nix
@@ -0,0 +1,20 @@
+{ mkDerivation
+, bsdSetupHook, freebsdSetupHook
+}:
+
+mkDerivation rec {
+  path = "usr.bin/lorder";
+  noCC = true;
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p "$out/bin" "$man/share/man"
+    mv "lorder.sh" "$out/bin/lorder"
+    chmod +x "$out/bin/lorder"
+    mv "lorder.1" "$man/share/man"
+  '';
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+  ];
+  buildInputs = [];
+  outputs = [ "out" "man" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/make.nix b/pkgs/os-specific/bsd/freebsd/pkgs/make.nix
new file mode 100644
index 0000000000000..fa1722cfec22c
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/make.nix
@@ -0,0 +1,20 @@
+{ lib, mkDerivation, stdenv }:
+
+mkDerivation {
+  path = "contrib/bmake";
+  version = "9.2";
+  postPatch = ''
+    # make needs this to pick up our sys make files
+    export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+      --replace '-Wl,--fatal-warnings' "" \
+      --replace '-Wl,--warn-shared-textrel' ""
+  '';
+  postInstall = ''
+    make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
+  '';
+  extraPaths = [ "share/mk" ]
+    ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "tools/build/mk";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix b/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix
new file mode 100644
index 0000000000000..e6a8e38a4acec
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/makeMinimal.nix
@@ -0,0 +1,61 @@
+{ lib, stdenv, mkDerivation
+, make
+, bsdSetupHook, freebsdSetupHook
+}:
+
+mkDerivation rec {
+  inherit (make) path;
+
+  buildInputs = [];
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+  ];
+
+  skipIncludesPhase = true;
+
+  makeFlags = [];
+
+  postPatch = ''
+    patchShebangs configure
+    ${make.postPatch}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    sh ./make-bootstrap.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D bmake "$out/bin/bmake"
+    ln -s "$out/bin/bmake" "$out/bin/make"
+    mkdir -p "$out/share"
+    cp -r "$BSDSRCDIR/share/mk" "$out/share/mk"
+    find "$out/share/mk" -type f -print0 |
+      while IFS= read -r -d "" f; do
+        substituteInPlace "$f" --replace 'usr/' ""
+      done
+    substituteInPlace "$out/share/mk/bsd.symver.mk" \
+      --replace '/share/mk' "$out/share/mk"
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (!stdenv.targetPlatform.isFreeBSD) ''
+    boot_mk="$BSDSRCDIR/tools/build/mk"
+    cp "$boot_mk"/Makefile.boot* "$out/share/mk"
+    replaced_mk="$out/share/mk.orig"
+    mkdir "$replaced_mk"
+    mv "$out"/share/mk/bsd.{lib,prog}.mk "$replaced_mk"
+    for m in bsd.{lib,prog}.mk; do
+      cp "$boot_mk/$m" "$out/share/mk"
+      substituteInPlace "$out/share/mk/$m" --replace '../../../share/mk' '../mk.orig'
+    done
+  '';
+
+  extraPaths = make.extraPaths;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
new file mode 100644
index 0000000000000..79428626b8ec2
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -0,0 +1,78 @@
+{ lib, stdenv, stdenvNoCC
+, compatIfNeeded
+, runCommand, rsync
+, freebsd-lib
+, source
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal
+, install, tsort, lorder, mandoc, groff
+}:
+
+lib.makeOverridable (attrs: let
+  stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
+in stdenv'.mkDerivation (rec {
+  pname = "${attrs.pname or (baseNameOf attrs.path)}-freebsd";
+  inherit (freebsd-lib) version;
+  src = runCommand "${pname}-filtered-src" {
+    nativeBuildInputs = [ rsync ];
+  } ''
+    for p in ${lib.concatStringsSep " " ([ attrs.path ] ++ attrs.extraPaths or [])}; do
+      set -x
+      path="$out/$p"
+      mkdir -p "$(dirname "$path")"
+      src_path="${source}/$p"
+      if [[ -d "$src_path" ]]; then src_path+=/; fi
+      rsync --chmod="+w" -r "$src_path" "$path"
+      set +x
+    done
+  '';
+
+  extraPaths = [ ];
+
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal
+    install tsort lorder mandoc groff #statHook
+  ];
+  buildInputs = compatIfNeeded;
+
+  HOST_SH = stdenv'.shell;
+
+  # Since STRIP below is the flag
+  STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+
+  # amd64 not x86_64 for this on unlike NetBSD
+  MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';
+
+  MACHINE = freebsd-lib.mkBsdArch stdenv';
+
+  MACHINE_CPUARCH = MACHINE_ARCH;
+
+  COMPONENT_PATH = attrs.path or null;
+
+  strictDeps = true;
+
+  meta = with lib; {
+    maintainers = with maintainers; [ ericson2314 ];
+    platforms = platforms.unix;
+    license = licenses.bsd2;
+  };
+} // lib.optionalAttrs stdenv'.hasCC {
+  # TODO should CC wrapper set this?
+  CPP = "${stdenv'.cc.targetPrefix}cpp";
+} // lib.optionalAttrs stdenv'.isDarwin {
+  MKRELRO = "no";
+} // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+  HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+  HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.isx86_32) {
+  USE_SSP = "no";
+} // lib.optionalAttrs (attrs.headersOnly or false) {
+  installPhase = "includesPhase";
+  dontBuild = true;
+} // attrs))
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix
new file mode 100644
index 0000000000000..56dff7d606bd9
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mknod.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "sbin/mknod";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
new file mode 100644
index 0000000000000..23a4672069e6a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, mknod }:
+
+mkDerivation {
+  path = "contrib/mtree";
+  extraPaths = [ mknod.path ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
new file mode 100644
index 0000000000000..56141255af5e1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
@@ -0,0 +1,22 @@
+{ lib, mkDerivation, stdenv }:
+
+mkDerivation rec {
+  path = "usr.bin/rpcgen";
+  patches = lib.optionals (stdenv.hostPlatform.libc == "glibc") [
+    # `WUNTRACED` is defined privately `bits/waitflags.h` in glibc.
+    # But instead of having a regular header guard, it has some silly
+    # non-modular logic. `stdlib.h` will include it if `sys/wait.h`
+    # hasn't yet been included (for it would first), and vice versa.
+    #
+    # The problem is that with the FreeBSD compat headers, one of
+    # those headers ends up included other headers...which ends up
+    # including the other one, this means by the first time we reach
+    # `#include `<bits/waitflags.h>`, both `_SYS_WAIT_H` and
+    # `_STDLIB_H` are already defined! Thus, we never ned up including
+    # `<bits/waitflags.h>` and defining `WUNTRACED`.
+    #
+    # This hacks around this by manually including `WUNTRACED` until
+    # the problem is fixed properly in glibc.
+    ./rpcgen-glibc-hack.patch
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/rpcgen-glibc-hack.patch
index 3dde1a0106514..3dde1a0106514 100644
--- a/pkgs/os-specific/bsd/freebsd/rpcgen-glibc-hack.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/rpcgen-glibc-hack.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix
new file mode 100644
index 0000000000000..07b55afe133fc
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sed.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, source }:
+
+mkDerivation {
+  path = "usr.bin/sed";
+  TESTSRC = "${source}/contrib/netbsd-tests";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/source.nix b/pkgs/os-specific/bsd/freebsd/pkgs/source.nix
new file mode 100644
index 0000000000000..5e31f900e8216
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/source.nix
@@ -0,0 +1,11 @@
+{ fetchFromGitHub, sourceData }:
+
+# Using fetchFromGitHub from their mirror because it's a lot faster than their git server
+# If you want you could fetchgit from "https://git.FreeBSD.org/src.git" instead.
+# The update script still pulls directly from git.freebsd.org
+fetchFromGitHub {
+  name = "src"; # Want to rename this next rebuild
+  owner = "freebsd";
+  repo = "freebsd-src";
+  inherit (sourceData) rev hash;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
new file mode 100644
index 0000000000000..c730f00869f8e
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
@@ -0,0 +1,13 @@
+{ mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+}:
+
+# Don't add this to nativeBuildInputs directly.  Use statHook instead.
+mkDerivation {
+  path = "usr.bin/stat";
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix b/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix
new file mode 100644
index 0000000000000..07129938b0953
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/statHook.nix
@@ -0,0 +1,12 @@
+{ makeSetupHook, writeText, stat }:
+
+# stat isn't in POSIX, and NetBSD stat supports a completely
+# different range of flags than GNU stat, so including it in PATH
+# breaks stdenv.  Work around that with a hook that will point
+# NetBSD's build system and NetBSD stat without including it in
+# PATH.
+makeSetupHook {
+  name = "netbsd-stat-hook";
+} (writeText "netbsd-stat-hook-impl" ''
+  makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
+'')
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
new file mode 100644
index 0000000000000..81cf4114e8737
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
@@ -0,0 +1,67 @@
+{ lib, stdenv, mkDerivation, freebsd-lib
+, buildPackages
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+, config, rpcgen, file2c, gawk, uudecode, xargs-j #, ctfconvert
+}:
+
+mkDerivation (let
+  cfg = "MINIMAL";
+in rec {
+  path = "sys";
+
+  nativeBuildInputs = [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+
+    config rpcgen file2c gawk uudecode xargs-j
+    #ctfconvert
+  ];
+
+  patches = [
+    ./sys-gnu-date.patch
+    ./sys-no-explicit-intrinsics-dep.patch
+  ];
+
+  # --dynamic-linker /red/herring is used when building the kernel.
+  NIX_ENFORCE_PURITY = 0;
+
+  AWK = "${buildPackages.gawk}/bin/awk";
+
+  CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
+
+  MK_CTF = "no";
+
+  KODIR = "${builtins.placeholder "out"}/kernel";
+  KMODDIR = "${builtins.placeholder "out"}/kernel";
+  DTBDIR = "${builtins.placeholder"out"}/dbt";
+
+  KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
+  KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
+  KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+
+  skipIncludesPhase = true;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
+      substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
+    done
+
+    for f in conf/*.mk; do
+      substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
+    done
+
+    cd ${freebsd-lib.mkBsdArch stdenv}/conf
+    sed -i ${cfg} \
+      -e 's/WITH_CTF=1/WITH_CTF=0/' \
+      -e '/KDTRACE/d'
+    config ${cfg}
+
+    runHook postConfigure
+  '';
+  preBuild = ''
+    cd ../compile/${cfg}
+  '';
+})
diff --git a/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch b/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch
index 2356446baf853..2356446baf853 100644
--- a/pkgs/os-specific/bsd/freebsd/sys-gnu-date.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-gnu-date.patch
diff --git a/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch b/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch
index edf44de5bb0d7..edf44de5bb0d7 100644
--- a/pkgs/os-specific/bsd/freebsd/sys-no-explicit-intrinsics-dep.patch
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sys/sys-no-explicit-intrinsics-dep.patch
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix b/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix
new file mode 100644
index 0000000000000..cdc1b27ce8fed
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/tsort.nix
@@ -0,0 +1,12 @@
+{ mkDerivation
+, bsdSetupHook, freebsdSetupHook
+, makeMinimal, install, mandoc, groff
+}:
+
+mkDerivation {
+  path = "usr.bin/tsort";
+  nativeBuildInputs =  [
+    bsdSetupHook freebsdSetupHook
+    makeMinimal install mandoc groff
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/uudecode.nix b/pkgs/os-specific/bsd/freebsd/pkgs/uudecode.nix
new file mode 100644
index 0000000000000..7e2341913dc08
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/uudecode.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/uudecode";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/package.nix
new file mode 100644
index 0000000000000..3a6b0ff004287
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/package.nix
@@ -0,0 +1,9 @@
+{ substituteAll, runtimeShell }:
+
+substituteAll {
+  name = "xargs-j";
+  shell = runtimeShell;
+  src = ./xargs-j.sh;
+  dir = "bin";
+  isExecutable = true;
+}
diff --git a/pkgs/os-specific/bsd/xargs-j.sh b/pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/xargs-j.sh
index 3dd27c2cd2cd7..3dd27c2cd2cd7 100644
--- a/pkgs/os-specific/bsd/xargs-j.sh
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/xargs-j/xargs-j.sh
diff --git a/pkgs/os-specific/bsd/freebsd/update.py b/pkgs/os-specific/bsd/freebsd/update.py
new file mode 100755
index 0000000000000..cd20f67148fa7
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/update.py
@@ -0,0 +1,182 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p git "python3.withPackages (ps: with ps; [ gitpython packaging beautifulsoup4 pandas lxml ])"
+
+import bs4
+import git
+import io
+import json
+import os
+import packaging.version
+import pandas
+import re
+import subprocess
+import sys
+import tempfile
+import typing
+import urllib.request
+
+_QUERY_VERSION_PATTERN = re.compile('^([A-Z]+)="(.+)"$')
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+MIN_VERSION = packaging.version.Version("13.0.0")
+MAIN_BRANCH = "main"
+TAG_PATTERN = re.compile(
+    f"^release/({packaging.version.VERSION_PATTERN})$", re.IGNORECASE | re.VERBOSE
+)
+REMOTE = "origin"
+BRANCH_PATTERN = re.compile(
+    f"^{REMOTE}/((stable|releng)/({packaging.version.VERSION_PATTERN}))$",
+    re.IGNORECASE | re.VERBOSE,
+)
+
+
+def request_supported_refs() -> list[str]:
+    # Looks pretty shady but I think this should work with every version of the page in the last 20 years
+    r = re.compile("^h\d$", re.IGNORECASE)
+    soup = bs4.BeautifulSoup(
+        urllib.request.urlopen("https://www.freebsd.org/security"), features="lxml"
+    )
+    header = soup.find(
+        lambda tag: r.match(tag.name) is not None
+        and tag.text.lower() == "supported freebsd releases"
+    )
+    table = header.find_next("table")
+    df = pandas.read_html(io.StringIO(table.prettify()))[0]
+    return list(df["Branch"])
+
+
+def query_version(repo: git.Repo) -> dict[str, typing.Any]:
+    # This only works on FreeBSD 13 and later
+    text = (
+        subprocess.check_output(
+            ["bash", os.path.join(repo.working_dir, "sys", "conf", "newvers.sh"), "-v"]
+        )
+        .decode("utf-8")
+        .strip()
+    )
+    fields = dict()
+    for line in text.splitlines():
+        m = _QUERY_VERSION_PATTERN.match(line)
+        if m is None:
+            continue
+        fields[m[1].lower()] = m[2]
+
+    fields["major"] = packaging.version.parse(fields["revision"]).major
+    return fields
+
+
+def handle_commit(
+    repo: git.Repo,
+    rev: git.objects.commit.Commit,
+    ref_name: str,
+    ref_type: str,
+    supported_refs: list[str],
+    old_versions: dict[str, typing.Any],
+) -> dict[str, typing.Any]:
+    if old_versions.get(ref_name, {}).get("rev", None) == rev.hexsha:
+        print(f"{ref_name}: revision still {rev.hexsha}, skipping")
+        return old_versions[ref_name]
+
+    repo.git.checkout(rev)
+    print(f"{ref_name}: checked out {rev.hexsha}")
+
+    full_hash = (
+        subprocess.check_output(["nix", "hash", "path", "--sri", repo.working_dir])
+        .decode("utf-8")
+        .strip()
+    )
+    print(f"{ref_name}: hash is {full_hash}")
+
+    version = query_version(repo)
+    print(f"{ref_name}: version is {version['version']}")
+
+    return {
+        "rev": rev.hexsha,
+        "hash": full_hash,
+        "ref": ref_name,
+        "refType": ref_type,
+        "supported": ref_name in supported_refs,
+        "version": query_version(repo),
+    }
+
+
+def main() -> None:
+    # Normally uses /run/user/*, which is on a tmpfs and too small
+    temp_dir = tempfile.TemporaryDirectory(dir="/tmp")
+    print(f"Selected temporary directory {temp_dir.name}")
+
+    if len(sys.argv) >= 2:
+        orig_repo = git.Repo(sys.argv[1])
+        print(f"Fetching updates on {orig_repo.git_dir}")
+        orig_repo.remote("origin").fetch()
+    else:
+        print("Cloning source repo")
+        orig_repo = git.Repo.clone_from(
+            "https://git.FreeBSD.org/src.git", to_path=os.path.join(temp_dir.name, "orig")
+        )
+
+    supported_refs = request_supported_refs()
+    print(f"Supported refs are: {' '.join(supported_refs)}")
+
+    print("Doing git crimes, do not run `git worktree prune` until after script finishes!")
+    workdir = os.path.join(temp_dir.name, "work")
+    git.cmd.Git(orig_repo.git_dir).worktree("add", "--orphan", workdir)
+
+    # Have to create object before removing .git otherwise it will complain
+    repo = git.Repo(workdir)
+    repo.git.set_persistent_git_options(git_dir=repo.git_dir)
+    # Remove so that nix hash doesn't see the file
+    os.remove(os.path.join(workdir, ".git"))
+
+    print(f"Working in directory {repo.working_dir} with git directory {repo.git_dir}")
+
+
+    try:
+        with open(os.path.join(BASE_DIR, "versions.json"), "r") as f:
+            old_versions = json.load(f)
+    except FileNotFoundError:
+        old_versions = dict()
+
+    versions = dict()
+    for tag in repo.tags:
+        m = TAG_PATTERN.match(tag.name)
+        if m is None:
+            continue
+        version = packaging.version.parse(m[1])
+        if version < MIN_VERSION:
+            print(f"Skipping old tag {tag.name} ({version})")
+            continue
+
+        print(f"Trying tag {tag.name} ({version})")
+
+        result = handle_commit(
+            repo, tag.commit, tag.name, "tag", supported_refs, old_versions
+        )
+        versions[tag.name] = result
+
+    for branch in repo.remote("origin").refs:
+        m = BRANCH_PATTERN.match(branch.name)
+        if m is not None:
+            fullname = m[1]
+            version = packaging.version.parse(m[3])
+            if version < MIN_VERSION:
+                print(f"Skipping old branch {fullname} ({version})")
+                continue
+            print(f"Trying branch {fullname} ({version})")
+        elif branch.name == f"{REMOTE}/{MAIN_BRANCH}":
+            fullname = MAIN_BRANCH
+            print(f"Trying development branch {fullname}")
+        else:
+            continue
+
+        result = handle_commit(
+            repo, branch.commit, fullname, "branch", supported_refs, old_versions
+        )
+        versions[fullname] = result
+
+
+    with open(os.path.join(BASE_DIR, "versions.json"), "w") as out:
+        json.dump(versions, out, sort_keys=True, indent=2)
+        out.write("\n")
+
+if __name__ == '__main__':
+    main()
diff --git a/pkgs/os-specific/bsd/freebsd/versions.json b/pkgs/os-specific/bsd/freebsd/versions.json
new file mode 100644
index 0000000000000..736c4c3a3e3c1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/versions.json
@@ -0,0 +1,210 @@
+{
+  "main": {
+    "hash": "sha256-C5ucT9BK/eK8a9HNSDDi8S1uhpPmiqV22XEooxAqbPw=",
+    "ref": "main",
+    "refType": "branch",
+    "rev": "125c4560bc70971b950d035cfcd2255b89984011",
+    "supported": false,
+    "version": {
+      "branch": "CURRENT",
+      "major": 15,
+      "reldate": "1500017",
+      "release": "15.0-CURRENT",
+      "revision": "15.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 15.0-CURRENT"
+    }
+  },
+  "release/13.0.0": {
+    "hash": "sha256-2WYk/taxWc74uh2KJf9TzWDxUPrtkvt2nhU/qUZMu+Q=",
+    "ref": "release/13.0.0",
+    "refType": "tag",
+    "rev": "ea31abc261ffc01b6ff5671bffb15cf910a07f4b",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE",
+      "major": 13,
+      "reldate": "1300139",
+      "release": "13.0-RELEASE",
+      "revision": "13.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.0-RELEASE"
+    }
+  },
+  "release/13.1.0": {
+    "hash": "sha256-m2aR2bwJNxsBepJ5ybWiaJp4Nwm+l0bMcn0gTSeY0JI=",
+    "ref": "release/13.1.0",
+    "refType": "tag",
+    "rev": "fc952ac2212b121aa6eefc273f5960ec3e0a466d",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE",
+      "major": 13,
+      "reldate": "1301000",
+      "release": "13.1-RELEASE",
+      "revision": "13.1",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.1-RELEASE"
+    }
+  },
+  "release/13.2.0": {
+    "hash": "sha256-VuktVknlKYkklST0I5CUiH7OsDn3DVTE1W9O/IhaCkE=",
+    "ref": "release/13.2.0",
+    "refType": "tag",
+    "rev": "525ecfdad597980ea4cd59238e24c8530dbcd31d",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE",
+      "major": 13,
+      "reldate": "1302001",
+      "release": "13.2-RELEASE",
+      "revision": "13.2",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.2-RELEASE"
+    }
+  },
+  "release/13.3.0": {
+    "hash": "sha256-djqHlPnGlJCi9DGtX1kTULB2EEj8YUsjGTIUDQoHzAQ=",
+    "ref": "release/13.3.0",
+    "refType": "tag",
+    "rev": "80d2b634ddf0b459910b54a04bc09f5cbc7185a7",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE",
+      "major": 13,
+      "reldate": "1303001",
+      "release": "13.3-RELEASE",
+      "revision": "13.3",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.3-RELEASE"
+    }
+  },
+  "release/14.0.0": {
+    "hash": "sha256-eBKwCYcOG9Lg7gBA2gZqxQFO/3uMMrcQGtgqi8se6zA=",
+    "ref": "release/14.0.0",
+    "refType": "tag",
+    "rev": "f9716eee8ab45ad906d9b5c5233ca20c10226ca7",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE",
+      "major": 14,
+      "reldate": "1400097",
+      "release": "14.0-RELEASE",
+      "revision": "14.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 14.0-RELEASE"
+    }
+  },
+  "releng/13.0": {
+    "hash": "sha256-7PrqTb2o21IQgQ2N+zjavlzX/ju60Rw+MXjMRICmQi0=",
+    "ref": "releng/13.0",
+    "refType": "branch",
+    "rev": "5fe9c9de03ef3191d216964bc4d8e427d5ed5720",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE-p13",
+      "major": 13,
+      "reldate": "1300139",
+      "release": "13.0-RELEASE-p13",
+      "revision": "13.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.0-RELEASE-p13"
+    }
+  },
+  "releng/13.1": {
+    "hash": "sha256-9fou2HVWlpNRKkc8XToe8/aSxwbNsIZIAKpteeSjLnc=",
+    "ref": "releng/13.1",
+    "refType": "branch",
+    "rev": "39b281c2996526288c0f2ae94abe6b164bcd5954",
+    "supported": false,
+    "version": {
+      "branch": "RELEASE-p9",
+      "major": 13,
+      "reldate": "1301000",
+      "release": "13.1-RELEASE-p9",
+      "revision": "13.1",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.1-RELEASE-p9"
+    }
+  },
+  "releng/13.2": {
+    "hash": "sha256-KN508aIe02Ue4TjlonO6TmAQ7DmiOOSOYrZfg5HP9AM=",
+    "ref": "releng/13.2",
+    "refType": "branch",
+    "rev": "f5ac4e174fdd3497749e351c27aafb34171c5730",
+    "supported": true,
+    "version": {
+      "branch": "RELEASE-p11",
+      "major": 13,
+      "reldate": "1302001",
+      "release": "13.2-RELEASE-p11",
+      "revision": "13.2",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.2-RELEASE-p11"
+    }
+  },
+  "releng/13.3": {
+    "hash": "sha256-huzUiMZHfyK/mgLD3hW+DaSGgAaTUIuM51xDp+IE3qE=",
+    "ref": "releng/13.3",
+    "refType": "branch",
+    "rev": "7a0d63c9093222938f26cd63ff742e555168de77",
+    "supported": true,
+    "version": {
+      "branch": "RELEASE-p1",
+      "major": 13,
+      "reldate": "1303001",
+      "release": "13.3-RELEASE-p1",
+      "revision": "13.3",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.3-RELEASE-p1"
+    }
+  },
+  "releng/14.0": {
+    "hash": "sha256-15B9Nglshniokju88dEKj3BIffZ6L28L+ZuhAC3UqOI=",
+    "ref": "releng/14.0",
+    "refType": "branch",
+    "rev": "d338712beb16ad7740bbd00bd93299a131a68045",
+    "supported": true,
+    "version": {
+      "branch": "RELEASE-p6",
+      "major": 14,
+      "reldate": "1400097",
+      "release": "14.0-RELEASE-p6",
+      "revision": "14.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 14.0-RELEASE-p6"
+    }
+  },
+  "stable/13": {
+    "hash": "sha256-XateLKKs2A/HCP9Lx/nBm1cybB3otrbeXQvyCL40S0M=",
+    "ref": "stable/13",
+    "refType": "branch",
+    "rev": "e0a58ef24a3baf5ed4cc09a798b9fe2d85408052",
+    "supported": true,
+    "version": {
+      "branch": "STABLE",
+      "major": 13,
+      "reldate": "1303502",
+      "release": "13.3-STABLE",
+      "revision": "13.3",
+      "type": "FreeBSD",
+      "version": "FreeBSD 13.3-STABLE"
+    }
+  },
+  "stable/14": {
+    "hash": "sha256-tIKnK/SYBDk9UnE5AfhjeDpqHnzspYbor0678ye/mrs=",
+    "ref": "stable/14",
+    "refType": "branch",
+    "rev": "ab872ab0bf195e872ed8d955aab3b2a537a230cd",
+    "supported": true,
+    "version": {
+      "branch": "STABLE",
+      "major": 14,
+      "reldate": "1400510",
+      "release": "14.0-STABLE",
+      "revision": "14.0",
+      "type": "FreeBSD",
+      "version": "FreeBSD 14.0-STABLE"
+    }
+  }
+}
diff --git a/pkgs/os-specific/darwin/CoreSymbolication/default.nix b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
index d9a2b378134a2..f6b0e2b79c3d3 100644
--- a/pkgs/os-specific/darwin/CoreSymbolication/default.nix
+++ b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
@@ -1,8 +1,14 @@
-{ lib, fetchFromGitHub, fetchpatch, stdenv }:
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  stdenvNoCC,
+  darwin-stubs,
+}:
 
-stdenv.mkDerivation {
-  pname = "core-symbolication";
-  version = "unstable-2018-06-17";
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "CoreSymbolication";
+  inherit (darwin-stubs) version;
 
   src = fetchFromGitHub {
     repo = "CoreSymbolication";
@@ -12,15 +18,35 @@ stdenv.mkDerivation {
   };
 
   patches = [
-    # C99 compilation fix
-    # https://github.com/matthewbauer/CoreSymbolication/pull/1
+    # Add missing symbol definitions needed to build `zlog` in system_cmds.
+    # https://github.com/matthewbauer/CoreSymbolication/pull/2
     (fetchpatch {
-      url = "https://github.com/boltzmannrain/CoreSymbolication/commit/1c26cc93f260bda9230a93e91585284e80aa231f.patch";
-      hash = "sha256-d/ieDEnvZ9kVOjBVUdJzGmdvC1AF3Jk4fbwp04Q6l/I=";
+      url = "https://github.com/matthewbauer/CoreSymbolication/commit/ae7ac6a7043dbae8e63d6ce5e63dfaf02b5977fe.patch";
+      hash = "sha256-IuXGMsaR1LIGs+BpDU1b4YlznKm9VhK5DQ+Dthtb1mI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/matthewbauer/CoreSymbolication/commit/6531da946949a94643e6d8424236174ae64fe0ca.patch";
+      hash = "sha256-+nDX04yY92yVT9KxiAFY2LxKcS7P8JpU539K+YVRqV4=";
     })
   ];
 
-  makeFlags = [ "PREFIX=$(out)" "CC=${stdenv.cc.targetPrefix}cc" ];
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Library/Frameworks/CoreSymbolication.framework/Versions/A/Headers
+
+    ln -s A $out/Library/Frameworks/CoreSymbolication.framework/Versions/Current
+    ln -s Versions/Current/Headers $out/Library/Frameworks/CoreSymbolication.framework/Headers
+    ln -s Versions/Current/CoreSymbolication.tbd $out/Library/Frameworks/CoreSymbolication.framework/CoreSymbolication.tbd
+
+    cp *.h $out/Library/Frameworks/CoreSymbolication.framework/Versions/A/Headers
+    cp ${darwin-stubs}/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication.tbd \
+      $out/Library/Frameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication.tbd
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Reverse engineered headers for Apple's CoreSymbolication framework";
@@ -29,4 +55,4 @@ stdenv.mkDerivation {
     platforms = platforms.darwin;
     maintainers = with maintainers; [ matthewbauer ];
   };
-}
+})
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 0e908d0179db1..518ab4230156f 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -143,5 +143,16 @@ let
       });
       xcbuild = xcodebuild;
     }));
+
+    darwin-stubs = stdenvNoCC.mkDerivation {
+      pname = "darwin-stubs";
+      inherit (MacOSX-SDK) version;
+
+      buildCommand = ''
+        mkdir -p "$out"
+        ln -s ${MacOSX-SDK}/System "$out/System"
+        ln -s ${MacOSX-SDK}/usr "$out/usr"
+      '';
+    };
   };
 in packages
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 5484ba5acb189..962f7f681c49d 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -350,5 +350,7 @@ in rec {
 
   frameworks = bareFrameworks // overrides bareFrameworks;
 
+  inherit darwin-stubs;
+
   inherit sdk;
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
index 25e1df3773dbf..f3ef0e9151f34 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
@@ -15,6 +15,6 @@ appleDerivation' stdenvNoCC {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
index 36013fe307ce4..32e142981f2d3 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
@@ -37,6 +37,6 @@ appleDerivation' stdenvNoCC {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
index cc73c0ac94157..8cb478d0874ce 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -24,6 +24,6 @@ appleDerivation' stdenv {
     description = "Apple's common startup stubs for darwin";
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index aeeb5c06b34c4..3943e2b2a9b7a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -183,6 +183,6 @@ appleDerivation' stdenv {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
index 1bf6396d47fd9..3c71531515a17 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
@@ -17,6 +17,6 @@ appleDerivation {
   meta = with lib; {
     maintainers = with maintainers; [ matthewbauer ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index c9cc99a6550e7..7415e99e506cf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -181,6 +181,6 @@ appleDerivation' stdenv {
     description = "The Mac OS libc/libSystem (tapi library with pure headers)";
     maintainers = with maintainers; [ copumpkin gridaphobe ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
index e0e27255b72f4..86f58b6b5a3c4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
@@ -34,6 +34,6 @@ appleDerivation' stdenvNoCC {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index ab13e91e37354..1bd574fe46a49 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -6,6 +6,9 @@ let
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
   # now it's staying here.
   versions = {
+    "macos-14.3" = {
+      system_cmds   = "970.0.4";
+    };
     "osx-10.12.6" = {
       xnu           = "3789.70.16";
       libiconv      = "50";
@@ -155,7 +158,7 @@ let
     version = versions.${sdkName}.${pname};
   in fetchApple' pname version sha256;
 
-  appleDerivation'' = stdenv: pname: version: sdkName: sha256: attrs: stdenv.mkDerivation ({
+  appleDerivation'' = stdenv: pname: version: sdkName: sha256: attrs: stdenv.mkDerivation (finalAttrs: {
     inherit pname version;
 
     src = if attrs ? srcs then null else (fetchApple' pname version sha256);
@@ -181,10 +184,10 @@ let
       fi
     '';
 
-  } // attrs // {
+  } // (if builtins.isFunction attrs then attrs finalAttrs else attrs) // {
     meta = (with lib; {
       platforms = platforms.darwin;
-      license = licenses.apsl20;
+      license = licenses.apple-psl20;
     }) // (attrs.meta or {});
   });
 
@@ -276,7 +279,9 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     libmalloc       = if stdenv.isx86_64 then
       applePackage "libmalloc" "osx-10.12.6" "sha256-brfG4GEF2yZipKdhlPq6DhT2z5hKYSb2MAmffaikdO4=" {}
     else macosPackages_11_0_1.libmalloc;
-    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {};
+    libplatform     = if stdenv.isx86_64 then
+      applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {}
+    else macosPackages_11_0_1.libplatform;
     libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
     libresolv       = applePackage "libresolv"         "osx-10.12.6"     "sha256-FtvwjJKSFX6j9APYPC8WLXVOjbHLZa1Gcoc8yxLy8qE=" {};
     Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "sha256-zvRdCP//TjKCGAqm/5nJXPppshU1cv2fg/L/yK/olGQ=" {};
@@ -304,7 +309,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     else macosPackages_11_0_1.network_cmds;
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "sha256-JYy6HwmultKeZtLfaysbsyLoWg+OaTh7eJu54JkJC0Q=" {};
     shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "sha256-kmEOprkiJGMVcl7yHkGX8ymk/5KjE99gWuF8j2hK5hY=" {};
-    system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "sha256-KBdGlHeXo2PwgRQOOeElJ1RBqCY1Tdhn5KD42CMhdzI=" {};
+    system_cmds     = applePackage "system_cmds"       "macos-14.3"      "sha256-qFp9nkzsq9uQ7zoyfvO+3gvDlc7kaPvn6luvmO/Io30=" {};
     text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "sha256-KSebU7ZyUsPeqn51nzuGNaNxs9pvmlIQQdkWXIVzDxw=" {};
     top             = applePackage "top"               "osx-10.11.6"     "sha256-jbz64ODogtpNyLpXGSZj1jCBdFPVXcVcBkL1vc7g5qQ=" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "sha256-bYGtYnBOcE5W03AZzfVTJXPZ6GgryGAMt/LgLPxFkVk=" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
index ca3b70cd09264..e91d703602650 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
@@ -11,6 +11,6 @@ appleDerivation' stdenvNoCC {
     description = "Impure primitive symlinks to the Mac OS native dyld, along with headers";
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
index 39c801962692f..e0b25d27778a9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
@@ -1,9 +1,10 @@
-{ appleDerivation', stdenvNoCC }:
+{ lib, appleDerivation', stdenvNoCC }:
 
-appleDerivation' stdenvNoCC {
+appleDerivation' stdenvNoCC (finalAttrs: {
   installPhase = ''
     mkdir $out
     cp -r include $out/include
+    test -d private && cp -r private/* $out/include
   '';
 
   appleHeaders = ''
@@ -27,6 +28,12 @@ appleDerivation' stdenvNoCC {
     platform/introspection_private.h
     platform/string.h
     setjmp.h
-    ucontext.h
-  '';
-}
+  '' + (
+    if lib.versionAtLeast finalAttrs.version "254.40.4" then ''
+      string_x86.h
+      ucontext.h
+    '' else ''
+      ucontext.h
+    ''
+  );
+})
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
index 0d378f6089fb3..df3c5650452de 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
@@ -12,6 +12,6 @@ appleDerivation {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin lnl7 ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index e7c8a6b1113b2..5cc8e0ffa28ab 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -38,6 +38,6 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
   meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    license     = licenses.apple-psl20;
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
index 0a70e648695d5..b4a7bbc4df243 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
@@ -40,7 +40,6 @@ objc4 = applePackage' "objc4" "818.2" "macos-11.0.1" "0m8mk1qd18wqjfn2jsq2lx6fxv
 ppp = applePackage' "ppp" "877.40.2" "macos-11.0.1" "06xznc77j45zzi12m4cmr3jj853qlc8dbmynbg1z6m9qf5phdbgk" {};
 removefile = applePackage' "removefile" "49.40.3" "macos-11.0.1" "0870ihxpmvj8ggaycwlismbgbw9768lz7w6mc9vxf8l6nlc43z4f" {};
 shell_cmds = applePackage' "shell_cmds" "216.40.4" "macos-11.0.1" "0wbysc9lwf1xgl686r3yn95rndcmqlp17zc1ig9gsl5fxyy5bghh" {};
-system_cmds = applePackage' "system_cmds" "880.40.5" "macos-11.0.1" "064yqf84ny0cjpqmzmnhz05faay6axb2r4i6knnyc8n21yiip5dc" {};
 text_cmds = applePackage' "text_cmds" "106" "macos-11.0.1" "17fn35m6i866zjrf8da6cq6crydp6vp4zq0aaab243rv1fx303yy" {};
 top = applePackage' "top" "129" "macos-11.0.1" "0d9pqmv3mwkfcv7c05hfvnvnn4rbsl92plr5hsazp854pshzqw2k" {};
 xnu = applePackage' "xnu" "7195.50.7.100.1" "macos-11.0.1" "11zjmpw11rcc6a0xlbwramra1rsr65s4ypnxwpajgbr2c657lipl" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index f708d77409007..7bd3cae118eb2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -1,114 +1,161 @@
-{ stdenv, appleDerivation, lib
-, libutil, Librpcsvc, apple_sdk, pam, CF, openbsm }:
-
-appleDerivation {
-  # xcbuild fails with:
-  # /nix/store/fc0rz62dh8vr648qi7hnqyik6zi5sqx8-xcbuild-wrapper/nix-support/setup-hook: line 1:  9083 Segmentation fault: 11  xcodebuild OTHER_CFLAGS="$NIX_CFLAGS_COMPILE" OTHER_CPLUSPLUSFLAGS="$NIX_CFLAGS_COMPILE" OTHER_LDFLAGS="$NIX_LDFLAGS" build
-  # see issue facebook/xcbuild#188
-  # buildInputs = [ xcbuild ];
-
-  buildInputs = [ libutil Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
-                  apple_sdk.frameworks.IOKit openbsm ];
-  # env.NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
-  #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
-  #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
-  env.NIX_CFLAGS_COMPILE = toString ([ "-DDAEMON_UID=1"
-                         "-DDAEMON_GID=1"
-                         "-DDEFAULT_AT_QUEUE='a'"
-                         "-DDEFAULT_BATCH_QUEUE='b'"
-                         "-DPERM_PATH=\"/usr/lib/cron/\""
-                         "-DOPEN_DIRECTORY"
-                         "-DNO_DIRECT_RPC"
-                         "-DAPPLE_GETCONF_UNDERSCORE"
-                         "-DAPPLE_GETCONF_SPEC"
-                         "-DUSE_PAM"
-                         "-DUSE_BSM_AUDIT"
-                         "-D_PW_NAME_LEN=MAXLOGNAME"
-                         "-D_PW_YPTOKEN=\"__YP!\""
-                         "-DAHZV1=64 "
-                         "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
-                         "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
-                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
-
-  patches = [
-    # Fix implicit declarations that cause builds to fail when built with clang 16.
-    ./fix-implicit-declarations.patch
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  appleDerivation,
+  fetchFromGitHub,
+  runCommand,
+  gawk,
+  meson,
+  ninja,
+  pkg-config,
+  libdispatch,
+  libmalloc,
+  libplatform,
+  Librpcsvc,
+  libutil,
+  ncurses,
+  openbsm,
+  pam,
+  xnu,
+  CoreFoundation,
+  CoreSymbolication,
+  DirectoryService,
+  IOKit,
+  Kernel,
+  Libc,
+  OpenDirectory,
+  WebKit,
+}:
+
+let
+  OpenDirectoryPrivate = stdenvNoCC.mkDerivation (finalAttrs: {
+    name = "apple-private-framework-OpenDirectory";
+    version = "146";
+
+    src = fetchFromGitHub {
+      owner = "apple-oss-distributions";
+      repo = "OpenDirectory";
+      rev = "OpenDirectory-${finalAttrs.version}";
+      hash = "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=";
+    };
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/include/CFOpenDirectory" "$out/include/OpenDirectory"
+      install -t "$out/include/CFOpenDirectory" \
+        Core/CFOpenDirectoryPriv.h \
+        Core/CFODTrigger.h
+      touch "$out/include/CFOpenDirectory/CFOpenDirectoryConstantsPriv.h"
+      install -t "$out/include/OpenDirectory" \
+        Framework/OpenDirectoryPriv.h \
+        Framework/NSOpenDirectoryPriv.h
+
+      runHook postInstall
+    '';
+  });
+
+  libmallocPrivate = stdenvNoCC.mkDerivation {
+    pname = "libmalloc-private";
+    version = lib.getVersion libmalloc;
+
+    inherit (libmalloc) src;
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/include"
+      cp -r private/*.h "$out/include"
+
+      runHook postInstall
+    '';
+  };
+
+  # Private xnu headers that are part of the source tree but not in the xnu derivation.
+  xnuPrivate = stdenvNoCC.mkDerivation {
+    pname = "xnu-private";
+    version = lib.getVersion xnu;
+
+    inherit (xnu) src;
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/include"
+      cp libsyscall/wrappers/spawn/spawn_private.h "$out/include"
+
+      runHook postInstall
+    '';
+  };
+in
+appleDerivation (finalAttrs: {
+  nativeBuildInputs = [
+    gawk
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libdispatch
+    libplatform
+    Librpcsvc
+    libutil
+    ncurses
+    openbsm
+    pam
+    xnu
+    CoreFoundation
+    CoreSymbolication
+    DirectoryService
+    IOKit
+    Kernel
+    OpenDirectory
   ];
 
   postPatch = ''
-    substituteInPlace login.tproj/login.c \
-      --replace bsm/audit_session.h bsm/audit.h
-    substituteInPlace login.tproj/login_audit.c \
-      --replace bsm/audit_session.h bsm/audit.h
-  '' + lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace sysctl.tproj/sysctl.c \
-      --replace "GPROF_STATE" "0"
-    substituteInPlace login.tproj/login.c \
-      --replace "defined(__arm__)" "defined(__arm__) || defined(__arm64__)"
+    # Replace hard-coded, impure system paths with the output path in the store.
+    sed -e "s|PATH=[^;]*|PATH='$out/bin'|" -i "pagesize/pagesize.sh"
   '';
 
-  buildPhase = ''
-    for dir in *.tproj; do
-      name=$(basename $dir)
-      name=''${name%.tproj}
-
-      CFLAGS=""
-      case $name in
-           arch) CFLAGS="-framework CoreFoundation";;
-           atrun) CFLAGS="-Iat.tproj";;
-           chkpasswd)
-             CFLAGS="-framework OpenDirectory -framework CoreFoundation -lpam";;
-           getconf)
-               for f in getconf.tproj/*.gperf; do
-                   cfile=''${f%.gperf}.c
-                   LC_ALL=C awk -f getconf.tproj/fake-gperf.awk $f > $cfile
-               done
-           ;;
-           iostat) CFLAGS="-framework IOKit -framework CoreFoundation";;
-           login) CFLAGS="-lbsm -lpam";;
-           nvram) CFLAGS="-framework CoreFoundation -framework IOKit";;
-           sadc) CFLAGS="-framework IOKit -framework CoreFoundation";;
-           sar) CFLAGS="-Isadc.tproj";;
-      esac
-
-      echo "Building $name"
-
-      case $name in
-
-           # These are all broken currently.
-           arch) continue;;
-           chpass) continue;;
-           dirhelper) continue;;
-           dynamic_pager) continue;;
-           fs_usage) continue;;
-           latency) continue;;
-           pagesize) continue;;
-           passwd) continue;;
-           reboot) continue;;
-           sc_usage) continue;;
-           shutdown) continue;;
-           trace) continue;;
-
-           *) cc $dir/*.c -I''${dir} $CFLAGS -o $name ;;
-      esac
-    done
+  # A vendored meson.build is used instead of the upstream Xcode project.
+  # This is done for a few reasons:
+  # - The upstream project causes `xcbuild` to crash.
+  #   See: https://github.com/facebookarchive/xcbuild/issues/188;
+  # - Achieving the same flexibility regarding SDK version would require modifying the
+  #   Xcode project, but modifying Xcode projects without using Xcode is painful; and
+  # - Using Meson allows the derivation to leverage the robust Meson support in nixpkgs,
+  #   and it allows it to use Meson features to simplify the build (e.g., generators).
+  preConfigure = ''
+    substitute '${./meson.build}' meson.build \
+      --subst-var-by kernel '${Kernel}' \
+      --subst-var-by libc_private '${Libc}' \
+      --subst-var-by libmalloc_private '${libmallocPrivate}' \
+      --subst-var-by opendirectory '${OpenDirectory}' \
+      --subst-var-by opendirectory_private '${OpenDirectoryPrivate}' \
+      --subst-var-by xnu '${xnu}' \
+      --subst-var-by xnu_private '${xnuPrivate}' \
+      --subst-var-by version '${finalAttrs.version}'
+    cp '${./meson.options}' meson.options
   '';
 
-  installPhase = ''
-    for dir in *.tproj; do
-      name=$(basename $dir)
-      name=''${name%.tproj}
-      [ -x $name ] && install -D $name $out/bin/$name
-      for n in 1 2 3 4 5 6 7 8 9; do
-        for f in $dir/*.$n; do
-          install -D $f $out/share/man/man$n/$(basename $f)
-        done
-      done
-    done
-  '';
+  mesonFlags = [ (lib.mesonOption "sdk_version" stdenv.hostPlatform.darwinSdkVersion) ];
 
   meta = {
     platforms = lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ shlevy matthewbauer ];
+    maintainers = with lib.maintainers; [
+      shlevy
+      matthewbauer
+    ];
   };
-}
+})
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch
deleted file mode 100644
index b08f54045724f..0000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -ur a/getty.tproj/main.c b/getty.tproj/main.c
---- a/getty.tproj/main.c	2008-06-10 14:50:19.000000000 -0400
-+++ b/getty.tproj/main.c	2023-05-31 18:06:40.121028558 -0400
-@@ -67,6 +67,7 @@
- #include <syslog.h>
- #include <termios.h>
- #include <time.h>
-+#include <util.h>
- #include <unistd.h>
- 
- #ifdef __APPLE__
-@@ -152,7 +153,7 @@
- static void	putpad(const char *);
- static void	puts(const char *);
- static void	timeoverrun(int);
--static char	*getline(int);
-+static char	*get_line(int);
- static void	setttymode(int);
- static int	opentty(const char *, int);
- 
-@@ -352,7 +353,7 @@
- 			if ((fd = open(IF, O_RDONLY)) != -1) {
- 				char * cp;
- 
--				while ((cp = getline(fd)) != NULL) {
-+				while ((cp = get_line(fd)) != NULL) {
- 					  putf(cp);
- 				}
- 				close(fd);
-@@ -744,7 +745,7 @@
- 
- 
- static char *
--getline(int fd)
-+get_line(int fd)
- {
- 	int i = 0;
- 	static char linebuf[512];
---- a/newgrp.tproj/newgrp.c	2021-10-06 01:38:52.000000000 -0400
-+++ b/newgrp.tproj/newgrp.c	2023-05-31 22:26:50.656157841 -0400
-@@ -47,6 +47,7 @@
- #include <string.h>
- #include <unistd.h>
- #ifdef __APPLE__
-+#include <membership.h>
- #include <paths.h>
- #endif /* __APPLE__ */
- static void	 addgroup(const char *grpname);
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build
new file mode 100644
index 0000000000000..de73e88f5d4d3
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.build
@@ -0,0 +1,544 @@
+# Build settings based on the upstream Xcode project.
+# See: https://github.com/apple-oss-distributions/system_cmds/blob/main/system_cmds.xcodeproj/project.pbxproj
+
+
+# Project settings
+project('system_cmds', 'c', version : '@version@')
+
+if host_machine.system() != 'linux'
+  add_project_arguments('-D__FreeBSD__', language : 'c')
+endif
+
+sdk_version = get_option('sdk_version')
+
+
+# Dependencies
+cc = meson.get_compiler('c')
+# Upstream uses awk to process `.gperf` files instead of gperf, which can’t process them.
+fake_gperf = find_program('awk', required : true)
+
+## Frameworks
+core_foundation = dependency('appleframeworks', modules : 'CoreFoundation')
+core_symbolication = dependency('appleframeworks', modules : 'CoreSymbolication')
+directory_service = dependency('appleframeworks', modules : 'DirectoryService')
+iokit = dependency('appleframeworks', modules : 'IOKit')
+kernel = declare_dependency(include_directories : '@kernel@/Library/Frameworks/Kernel.framework/Headers')
+open_directory = dependency('appleframeworks', modules : 'OpenDirectory')
+
+## Private Headers
+cfopen_directory = declare_dependency(
+    dependencies : declare_dependency(
+        compile_args :[ '-iframework', '@opendirectory@/Library/Frameworks/OpenDirectory.framework/Frameworks' ],
+   ),
+    include_directories : '@opendirectory_private@/include',
+)
+libc_private = declare_dependency(include_directories : '@libc_private@/include')
+libmalloc_private = declare_dependency(include_directories : '@libmalloc_private@/include')
+
+xnu_include_dirs = [
+    '@xnu@/include/bsd',
+    '@xnu@/include/libkern',
+    '@xnu@/include/iokit',
+    '@xnu@/include/osfmk',
+    '@xnu_private@/include'
+]
+if sdk_version.version_compare('>=10.13')
+    xnu_include_dirs += '@xnu@/include/san'
+endif
+xnu_private = declare_dependency(
+    compile_args : [
+        # Suppresses suffixing symbols with '$UNIX2003', which causes link failures.
+        '-D__DARWIN_ONLY_UNIX_CONFORMANCE=1',
+        # Make sure Darwin is correctly detected as macOS
+        '-DPLATFORM_MacOSX=1',
+        # Access private definitions
+        '-DPRIVATE=1'
+    ],
+    include_directories : xnu_include_dirs
+)
+
+## Libraries
+ncurses = dependency('ncurses')
+openbsm = cc.find_library('bsm')
+pam = cc.find_library('pam')
+
+# Feature Tests
+if sdk_version.version_compare('<12')
+    add_project_arguments('-DkIOMainPortDefault=kIOMasterPortDefault', language : 'c')
+    add_project_arguments('-DIOMainPort=IOMasterPort', language : 'c')
+endif
+
+
+# Generators
+pgperf = generator(
+    fake_gperf,
+    arguments : [ '-f', meson.source_root() + '/getconf/fake-gperf.awk', '@INPUT@' ],
+    capture : true,
+    output : '@BASENAME@.gperf.c'
+)
+
+
+# Binaries
+executable('ac', install : true, sources : 'ac/ac.c')
+install_man('ac/ac.8')
+
+executable('accton', install : true, sources : 'accton/accton.c')
+install_man('accton/accton.8')
+
+executable(
+    'arch',
+    build_by_default : sdk_version.version_compare('>=11'),
+    install : sdk_version.version_compare('>=11'),
+    sources : 'arch/arch.c'
+)
+install_man(
+    'arch/arch.1',
+    'arch/machine.1'
+)
+
+executable(
+    'at',
+    c_args : [
+        '-DDAEMON_UID=1',
+        '-DDAEMON_GID=1',
+        '-DDEFAULT_AT_QUEUE=\'a\'',
+        '-DDEFAULT_BATCH_QUEUE=\'b\'',
+        '-DPERM_PATH="/usr/lib/cron"',
+    ],
+    install : true,
+    sources : [
+        'at/at.c',
+        'at/panic.c',
+        'at/parsetime.c',
+        'at/perm.c'
+    ]
+)
+install_man('at/at.1')
+
+executable(
+    'atrun',
+    c_args : [ '-DDAEMON_UID=1', '-DDAEMON_GID=1' ],
+    include_directories : 'at',
+    install : true,
+    sources : [
+        'atrun/atrun.c',
+        'atrun/gloadavg.c'
+    ]
+)
+install_man('atrun/atrun.8')
+
+executable(
+    'chkpasswd',
+    c_args : '-DUSE_PAM',
+    dependencies : [ core_foundation, open_directory, pam ],
+    install : true,
+    sources : [
+        'chkpasswd/file_passwd.c',
+        'chkpasswd/nis_passwd.c',
+        'chkpasswd/od_passwd.c',
+        'chkpasswd/pam_passwd.c',
+        'chkpasswd/passwd.c',
+        'chkpasswd/stringops.c'
+    ]
+)
+install_man('chkpasswd/chkpasswd.8')
+
+executable(
+    'chpass',
+    dependencies : [ cfopen_directory, directory_service, open_directory ],
+    install : true,
+    sources : [
+        'chpass/chpass.c',
+        'chpass/edit.c',
+        'chpass/field.c',
+        'chpass/open_directory.c',
+        'chpass/table.c',
+        'chpass/util.c'
+    ]
+)
+install_man('chpass/chpass.1')
+
+executable('cpuctl', install : true, sources : 'cpuctl/cpuctl.c')
+install_man('cpuctl/cpuctl.8')
+
+executable('dmesg', install : true, sources : 'dmesg/dmesg.c')
+install_man('dmesg/dmesg.8')
+
+executable(
+    'dynamic_pager',
+    c_args : '-DNO_DIRECT_RPC',
+    install : true,
+    sources : 'dynamic_pager/dynamic_pager.c'
+)
+install_man('dynamic_pager/dynamic_pager.8')
+
+executable(
+    'fs_usage',
+    # Requires 'ktrace/session.h'
+    build_by_default : false,
+    install : false,
+    sources : 'fs_usage/fs_usage.c'
+)
+# install_man('fs_usage/fs_usage.1')
+
+executable(
+    'gcore',
+    # Requires XPC private APIs
+    build_by_default : false and sdk_version.version_compare('>=11'),
+    install : false and sdk_version.version_compare('>=11'),
+    sources : [
+        'gcore/convert.c',
+        'gcore/corefile.c',
+        'gcore/dyld.c',
+        'gcore/dyld_shared_cache.c',
+        'gcore/main.c',
+        'gcore/sparse.c',
+        'gcore/threads.c',
+        'gcore/utils.c',
+        'gcore/vanilla.c',
+        'gcore/vm.c'
+    ]
+)
+# install_man('gcore/gcore-internal.1', 'gcore/gcore.1')
+
+executable(
+    'getconf',
+    c_args : '-DAPPLE_GETCONF_UNDERSCORE',
+    include_directories : 'getconf',
+    install : true,
+    sources : [
+        'getconf/getconf.c',
+    ] + pgperf.process(
+        [
+            'getconf/confstr.gperf',
+            'getconf/limits.gperf',
+            'getconf/unsigned_limits.gperf',
+            'getconf/progenv.gperf',
+            'getconf/sysconf.gperf',
+            'getconf/pathconf.gperf'
+        ]
+   )
+)
+install_man('getconf/getconf.1')
+
+executable(
+    'getty',
+    install : true,
+    sources : [
+        'getty/chat.c',
+        'getty/init.c',
+        'getty/main.c',
+        'getty/subr.c'
+    ]
+)
+install_man(
+    'getty/getty.8',
+    'getty/gettytab.5',
+    'getty/ttys.5'
+)
+
+executable('hostinfo', install : true, sources : 'hostinfo/hostinfo.c')
+install_man('hostinfo/hostinfo.8')
+
+executable(
+    'iosim',
+    dependencies : [ core_foundation, iokit ],
+    include_directories : 'at',
+    install : true,
+    sources : 'iosim/iosim.c'
+)
+install_man('iosim/iosim.1')
+
+executable(
+    'iostat',
+    dependencies : [ core_foundation, iokit ],
+    install : true,
+    sources : 'iostat/iostat.c'
+)
+install_man('iostat/iostat.8')
+
+executable(
+    'kpgo',
+    dependencies : [ xnu_private ],
+    install : true,
+    sources : 'kpgo/kpgo.c'
+)
+# No man pages for `kpgo`
+
+executable(
+    'latency',
+    build_by_default : sdk_version.version_compare('>=12'),
+    dependencies : ncurses,
+    install : sdk_version.version_compare('>=12'),
+    sources : 'latency/latency.c'
+)
+if sdk_version.version_compare('>=12')
+    install_man('latency/latency.1')
+endif
+
+executable(
+    'login',
+    # Requires SoftLinking/WeakLinking.h and end-point security entitlements
+    build_by_default : false,
+    c_args : '-DUSE_BSM_AUDIT=1',
+    dependencies : [ openbsm, xnu_private ],
+    install : false,
+    sources : [
+        'login/login.c',
+        'login/login_audit.c'
+    ]
+)
+# install_man('login/login.1')
+
+executable(
+    'lskq',
+    build_by_default : sdk_version.version_compare('>=12'),
+    install : sdk_version.version_compare('>=12'),
+    sources : 'lskq/lskq.c'
+)
+if sdk_version.version_compare('>=12')
+    install_man('lskq/lskq.1')
+endif
+
+executable(
+    'lsmp',
+    build_by_default : sdk_version.version_compare('>=12'),
+    install : sdk_version.version_compare('>=12'),
+    sources : [
+        'lsmp/lsmp.c',
+        'lsmp/port_details.c',
+        'lsmp/task_details.c'
+    ]
+)
+if sdk_version.version_compare('>=12')
+    install_man('lsmp/lsmp.1')
+endif
+
+executable(
+    'ltop',
+    install : true,
+    sources : 'ltop/ltop.c'
+)
+install_man('ltop/ltop.1')
+
+executable('mean', install : true, sources : 'mean/mean.c')
+# No man pages for `mean`.
+
+executable(
+    'memory_pressure',
+    dependencies : [ xnu_private ],
+    install : true,
+    sources : 'memory_pressure/memory_pressure.c'
+)
+install_man('memory_pressure/memory_pressure.1')
+
+executable('mkfile', install : true, sources : 'mkfile/mkfile.c')
+install_man('mkfile/mkfile.8')
+
+executable(
+    'mslutil',
+    build_by_default : sdk_version.version_compare('>=10.13'),
+    dependencies : [ libmalloc_private ],
+    install : sdk_version.version_compare('>=10.13'),
+    sources : 'mslutil/mslutil.c'
+)
+if sdk_version.version_compare('>=10.13')
+    install_man('mslutil/mslutil.1')
+endif
+
+executable('newgrp', install : true, sources : 'newgrp/newgrp.c')
+install_man('newgrp/newgrp.1')
+
+executable('nologin', install : true, sources : 'nologin/nologin.c')
+install_man(
+    'nologin/nologin.5',
+    'nologin/nologin.8'
+)
+
+executable(
+    'nvram',
+    c_args : '-DTARGET_OS_BRIDGE=0',
+    dependencies : [ iokit, libc_private, xnu_private ],
+    install : true,
+    sources : 'nvram/nvram.c'
+)
+install_man('nvram/nvram.8')
+
+custom_target(
+    'pagesize',
+    command : [ 'cp', '@INPUT@', '@OUTPUT@' ],
+    install : true,
+    install_dir : get_option('bindir'),
+    install_mode : 'r-xr-xr-x',
+    input : 'pagesize/pagesize.sh',
+    output : 'pagesize'
+)
+install_man('pagesize/pagesize.1')
+
+executable(
+    'passwd',
+    dependencies : [ cfopen_directory, directory_service, open_directory, pam ],
+    install : true,
+    sources : [
+        'passwd/file_passwd.c',
+        'passwd/nis_passwd.c',
+        'passwd/od_passwd.c',
+        'passwd/pam_passwd.c',
+        'passwd/passwd.c'
+    ]
+)
+install_man('passwd/passwd.1')
+
+executable(
+    'proc_uuid_policy',
+    install : true,
+    sources : 'proc_uuid_policy/proc_uuid_policy.c'
+)
+install_man('proc_uuid_policy/proc_uuid_policy.1')
+
+executable('purge', install : true, sources : 'purge/purge.c')
+install_man('purge/purge.8')
+
+executable(
+    'pwd_mkdb',
+    c_args : [ '-D_PW_NAME_LEN=MAXLOGNAME', '-D_PW_YPTOKEN="__YP!"' ],
+    install : true,
+    sources : [
+        'pwd_mkdb/pw_scan.c',
+        'pwd_mkdb/pwd_mkdb.c'
+    ]
+)
+install_man('pwd_mkdb/pwd_mkdb.8')
+
+executable(
+    'reboot',
+    # Requires IOKitUser kext APIs
+    build_by_default : false,
+    install : false,
+    sources : 'reboot/reboot.c'
+)
+# install_man('reboot/reboot.8')
+
+executable(
+    'sa',
+    c_args : '-DAHZV1',
+    install : true,
+    sources : [
+        'sa/db.c',
+        'sa/main.c',
+        'sa/pdb.c',
+        'sa/usrdb.c'
+    ]
+)
+install_man('sa/sa.8')
+
+executable(
+    'sc_usage',
+    build_by_default : sdk_version.version_compare('>=12'),
+    dependencies : ncurses,
+    install : sdk_version.version_compare('>=12'),
+    sources : 'sc_usage/sc_usage.c'
+)
+if sdk_version.version_compare('>=12')
+    install_man('sc_usage/sc_usage.1')
+endif
+
+executable('shutdown',
+    # Requires IOKitUser kext APIs
+    build_by_default : false,
+    install : false,
+    sources : 'shutdown/shutdown.c'
+)
+# install_man('shutdown/shutdown.8')
+
+executable(
+    'stackshot',
+    build_by_default : sdk_version.version_compare('>=10.13'),
+    dependencies : [ xnu_private ],
+    install : sdk_version.version_compare('>=10.13'),
+    sources : 'stackshot/stackshot.c'
+)
+# No man pages for `stackshot`.
+
+executable('sync', install : true, sources : 'sync/sync.c')
+# No man pages for `sync`.
+
+executable('sysctl', install : true, sources : 'sysctl/sysctl.c')
+install_man(
+    'sysctl/sysctl.8',
+    'sysctl/sysctl.conf.5'
+)
+
+executable(
+    'taskpolicy',
+    build_by_default : sdk_version.version_compare('>=11'),
+    dependencies : [ xnu_private ],
+    install : sdk_version.version_compare('>=11'),
+    sources : 'taskpolicy/taskpolicy.c'
+)
+if sdk_version.version_compare('>=11')
+    install_man('taskpolicy/taskpolicy.8')
+endif
+
+executable('vifs', install : true, sources : 'vifs/vifs.c')
+install_man('vifs/vifs.8')
+
+executable(
+    'vipw',
+    install : true,
+    sources : [
+        'vipw/pw_util.c',
+        'vipw/vipw.c'
+    ]
+)
+install_man('vipw/vipw.8')
+
+executable('vm_purgeable_stat',
+    build_by_default : sdk_version.version_compare('>=11'),
+    install : sdk_version.version_compare('>=11'),
+    sources : 'vm_purgeable_stat/vm_purgeable_stat.c'
+)
+if sdk_version.version_compare('>=11')
+    install_man('vm_purgeable_stat/vm_purgeable_stat.1')
+endif
+
+executable('vm_stat', install : true, sources : 'vm_stat/vm_stat.c')
+install_man('vm_stat/vm_stat.1')
+
+executable('wait4path', install : true, sources : 'wait4path/wait4path.c')
+install_man('wait4path/wait4path.1')
+
+executable('wordexp-helper', install : true, sources : 'wordexp-helper/wordexp-helper.c')
+# No man pages for `wordexp-helper`.
+
+executable('zdump', include_directories : 'zic', install : true, sources : 'zdump/zdump.c')
+install_man('zdump/zdump.8')
+
+executable('zic', install : true, sources : 'zic/zic.c')
+install_man('zic/zic.8')
+
+executable(
+    'zlog',
+    build_by_default : sdk_version.version_compare('>=11'),
+    c_args : '-DKERN_NOT_FOUND=56',
+    dependencies : core_symbolication,
+    install : sdk_version.version_compare('>=11'),
+    sources : [
+        'zlog/SymbolicationHelper.c',
+        'zlog/zlog.c',
+    ]
+)
+if sdk_version.version_compare('>=11')
+    install_man('zlog/zlog.1')
+endif
+
+executable(
+    'zprint',
+    # Requires IOKitUser kext APIs
+    build_by_default : false,
+    dependencies: [ kernel ],
+    install : false,
+    sources : 'zprint/zprint.c'
+)
+# install_man('zprint/zprint.1')
+
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.options b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.options
new file mode 100644
index 0000000000000..8c4ce874c64c5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/meson.options
@@ -0,0 +1 @@
+option('sdk_version', type : 'string')
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 7650dcdc8c704..14ede7949d0f9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -34,7 +34,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace "-Werror " ""
 
     substituteInPlace SETUP/kextsymboltool/Makefile \
-      --replace "-lstdc++" "-lc++ -lc++abi"
+      --replace "-lstdc++" "-lc++"
 
     substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
       --replace "/usr/include" "/include" \
diff --git a/pkgs/os-specific/darwin/cctools/apple.nix b/pkgs/os-specific/darwin/cctools/apple.nix
index 7adcfa9539a2d..dee4e20062560 100644
--- a/pkgs/os-specific/darwin/cctools/apple.nix
+++ b/pkgs/os-specific/darwin/cctools/apple.nix
@@ -116,7 +116,7 @@ symlinkJoin rec {
   meta = with lib; {
     description = "MacOS Compiler Tools";
     homepage = "http://www.opensource.apple.com/source/cctools/";
-    license = licenses.apsl20;
+    license = licenses.apple-psl20;
     platforms = platforms.darwin;
   };
 }
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index c9b11ee20155e..377d84d9bf731 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -186,7 +186,7 @@ stdenv.mkDerivation {
     broken = !stdenv.targetPlatform.isDarwin; # Only supports darwin targets
     homepage = "http://www.opensource.apple.com/source/cctools/";
     description = "MacOS Compiler Tools (cross-platform port)";
-    license = lib.licenses.apsl20;
+    license = lib.licenses.apple-psl20;
     maintainers = with lib.maintainers; [ matthewbauer ];
   };
 }
diff --git a/pkgs/os-specific/darwin/grandperspective/default.nix b/pkgs/os-specific/darwin/grandperspective/default.nix
index 0d57d4f277144..816440ec1155e 100644
--- a/pkgs/os-specific/darwin/grandperspective/default.nix
+++ b/pkgs/os-specific/darwin/grandperspective/default.nix
@@ -1,20 +1,24 @@
-{ stdenv, lib, fetchurl, undmg }:
+{ stdenv, lib, fetchurl, undmg, makeWrapper }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.4.1";
+  version = "3.4.2";
   pname = "grandperspective";
 
   src = fetchurl {
     inherit (finalAttrs) version;
     url = "mirror://sourceforge/grandperspectiv/GrandPerspective-${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}.dmg";
-    hash = "sha256-iTtvP6iONcfDWJ3qMh+TUJMN+3spwCQ/5S+A307BJCM=";
+    hash = "sha256-ZgyBeQCoixLGCFS8+UFoMilvtswplEC8MzK3BE4ocDg=";
   };
 
   sourceRoot = "GrandPerspective.app";
   buildInputs = [ undmg ];
+  nativeBuildInputs = [ makeWrapper ];
+  # Create a trampoline script in $out/bin/ because a symlink doesn’t work for
+  # this app.
   installPhase = ''
-    mkdir -p "$out/Applications/GrandPerspective.app";
-    cp -R . "$out/Applications/GrandPerspective.app";
+    mkdir -p "$out/Applications/GrandPerspective.app" "$out/bin"
+    cp -R . "$out/Applications/GrandPerspective.app"
+    makeWrapper "$out/Applications/GrandPerspective.app/Contents/MacOS/GrandPerspective" "$out/bin/grandperspective"
   '';
 
   meta = with lib; {
@@ -25,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
       space. It uses a so called tree map for visualisation. Each file is shown as a rectangle with an area proportional to
       the file's size. Files in the same folder appear together, but their placement is otherwise arbitrary.
     '';
+    mainProgram = "grandperspective";
     homepage = "https://grandperspectiv.sourceforge.net";
     license = licenses.gpl2Only;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/os-specific/darwin/insert_dylib/default.nix b/pkgs/os-specific/darwin/insert_dylib/default.nix
deleted file mode 100644
index 7ab9692f0d427..0000000000000
--- a/pkgs/os-specific/darwin/insert_dylib/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, xcbuildHook }:
-
-stdenv.mkDerivation {
-  pname = "insert_dylib";
-  version = "unstable-2016-08-28";
-
-  src = fetchFromGitHub {
-    owner = "Tyilo";
-    repo = "insert_dylib";
-    rev = "c8beef66a08688c2feeee2c9b6eaf1061c2e67a9";
-    sha256 = "0az38y06pvvy9jf2wnzdwp9mp98lj6nr0ldv0cs1df5p9x2qvbya";
-  };
-
-  nativeBuildInputs = [ xcbuildHook ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    install -m755 Products/Release/insert_dylib $out/bin
-  '';
-
-  meta.platforms = lib.platforms.darwin;
-}
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index 5a72225eec30c..cb6b3cf4b7393 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -40,15 +40,12 @@ stdenv.mkDerivation (finalAttrs: {
         let
           nativeCC = pkgsBuildBuild.stdenv.cc;
           nativeBintools = nativeCC.bintools.bintools;
-          nativeLibcxxabi = lib.getLib pkgsBuildBuild.libcxxabi;
           nativeToolchainFlags = [
             "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
             "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
             "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
             "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
             "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-            "-DCMAKE_EXE_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
-            "-DCMAKE_SHARED_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
           ];
         in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
       )
@@ -70,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "Replaces the Mach-O Dynamic Library Stub files in Apple's SDKs to reduce the size";
+    mainProgram = "tapi";
     homepage = "https://github.com/tpoechtrager/apple-libtapi";
     license = licenses.ncsa;
     maintainers = with maintainers; [ matthewbauer ];
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
deleted file mode 100644
index c59f854b84756..0000000000000
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, opencflite, clang, libcxx }:
-
-stdenv.mkDerivation {
-  pname = "maloader";
-  version = "unstable-2014-02-25";
-
-  src = fetchFromGitHub {
-    owner = "shinh";
-    repo = "maloader";
-    rev = "5f220393e0b7b9ad0cf1aba0e89df2b42a1f0442";
-    sha256 = "0dd1pn07x1y8pyn5wz8qcl1c1xwghyya4d060m3y9vx5dhv9xmzw";
-  };
-
-  postPatch = ''
-    sed -i \
-      -e '/if.*loadLibMac.*mypath/s|mypath|"'"$out/lib/"'"|' \
-      -e 's|libCoreFoundation\.so|${opencflite}/lib/&|' \
-      ld-mac.cc
-  '';
-
-  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
-  buildInputs = [ clang libcxx ];
-  buildFlags = [ "USE_LIBCXX=1" "release" ];
-
-  installPhase = ''
-    install -vD libmac.so "$out/lib/libmac.so"
-
-    for bin in extract macho2elf ld-mac; do
-      install -vD "$bin" "$out/bin/$bin"
-    done
-  '';
-
-  meta = {
-    description = "Mach-O loader for Linux";
-    homepage = "https://github.com/shinh/maloader";
-    license = lib.licenses.bsd2;
-    platforms = lib.platforms.linux;
-    broken = true; # 2018-09-08, no succesful build since 2017-08-21
-  };
-}
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
deleted file mode 100644
index 83e020a1b8486..0000000000000
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-diff --git a/MoltenVK/MoltenVK.xcodeproj/project.pbxproj b/MoltenVK/MoltenVK.xcodeproj/project.pbxproj
-index c23afce4..12ac12f4 100644
---- a/MoltenVK/MoltenVK.xcodeproj/project.pbxproj
-+++ b/MoltenVK/MoltenVK.xcodeproj/project.pbxproj
-@@ -365,13 +365,6 @@
- /* End PBXBuildFile section */
- 
- /* Begin PBXContainerItemProxy section */
--		2F21D82E24983488009BEA5F /* PBXContainerItemProxy */ = {
--			isa = PBXContainerItemProxy;
--			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
--			proxyType = 1;
--			remoteGlobalIDString = 2FEA0CFF2490381A00EEF3AD;
--			remoteInfo = "MoltenVKSPIRVToMSLConverter-tvOS";
--		};
- 		2FEA0D1B249040CA00EEF3AD /* PBXContainerItemProxy */ = {
- 			isa = PBXContainerItemProxy;
- 			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
-@@ -400,27 +393,6 @@
- 			remoteGlobalIDString = A93903C71C57E9ED00FE90DC;
- 			remoteInfo = "MVKSPIRVToMSLConverter-macOS";
- 		};
--		A981499A1FB6B9CF005F00B4 /* PBXContainerItemProxy */ = {
--			isa = PBXContainerItemProxy;
--			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
--			proxyType = 1;
--			remoteGlobalIDString = A93903B81C57E9D700FE90DC;
--			remoteInfo = "MVKSPIRVToMSLConverter-iOS";
--		};
--		A9B1C7F4251AA5AF001D12CC /* PBXContainerItemProxy */ = {
--			isa = PBXContainerItemProxy;
--			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
--			proxyType = 1;
--			remoteGlobalIDString = A9092A8C1A81717B00051823;
--			remoteInfo = MoltenVKShaderConverter;
--		};
--		DCA2CEAE2A45DFD400FB75B6 /* PBXContainerItemProxy */ = {
--			isa = PBXContainerItemProxy;
--			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
--			proxyType = 1;
--			remoteGlobalIDString = DCFD7F6F2A45BDA0007BBBF7;
--			remoteInfo = "MoltenVKShaderConverter-xrOS";
--		};
-		DCBC41212A45DB1000F49BD1 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = A9C86CB61C55B8350096CAF2 /* MoltenVKShaderConverter.xcodeproj */;
-@@ -1019,7 +998,6 @@
- 			buildRules = (
- 			);
- 			dependencies = (
--				2F21D82F24983488009BEA5F /* PBXTargetDependency */,
- 			);
- 			name = "MoltenVK-tvOS";
- 			productName = MoltenVK;
-@@ -1039,7 +1017,6 @@
- 			buildRules = (
- 			);
- 			dependencies = (
--				A981499B1FB6B9CF005F00B4 /* PBXTargetDependency */,
- 			);
- 			name = "MoltenVK-iOS";
- 			productName = MoltenVK;
-@@ -1059,7 +1036,6 @@
- 			buildRules = (
- 			);
- 			dependencies = (
--				A9B1C7F5251AA5AF001D12CC /* PBXTargetDependency */,
- 			);
- 			name = "MoltenVK-macOS";
- 			productName = MoltenVK;
-@@ -1476,29 +1452,6 @@
- 		};
- /* End PBXSourcesBuildPhase section */
- 
--/* Begin PBXTargetDependency section */
--		2F21D82F24983488009BEA5F /* PBXTargetDependency */ = {
--			isa = PBXTargetDependency;
--			name = "MoltenVKSPIRVToMSLConverter-tvOS";
--			targetProxy = 2F21D82E24983488009BEA5F /* PBXContainerItemProxy */;
--		};
--		A981499B1FB6B9CF005F00B4 /* PBXTargetDependency */ = {
--			isa = PBXTargetDependency;
--			name = "MVKSPIRVToMSLConverter-iOS";
--			targetProxy = A981499A1FB6B9CF005F00B4 /* PBXContainerItemProxy */;
--		};
--		A9B1C7F5251AA5AF001D12CC /* PBXTargetDependency */ = {
--			isa = PBXTargetDependency;
--			name = MoltenVKShaderConverter;
--			targetProxy = A9B1C7F4251AA5AF001D12CC /* PBXContainerItemProxy */;
--		};
--		DCA2CEAF2A45DFD400FB75B6 /* PBXTargetDependency */ = {
--			isa = PBXTargetDependency;
--			name = "MoltenVKShaderConverter-xrOS";
--			targetProxy = DCA2CEAE2A45DFD400FB75B6 /* PBXContainerItemProxy */;
--		};
--/* End PBXTargetDependency section */
--
- /* Begin XCBuildConfiguration section */
- 		2FEA0AB824902F9F00EEF3AD /* Debug */ = {
- 			isa = XCBuildConfiguration;
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
deleted file mode 100644
index 3e48b2b5ba67f..0000000000000
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-diff --git a/MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj b/MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj
-index c7842b63..d55f73ed 100644
---- a/MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj
-+++ b/MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj
-@@ -3,7 +3,7 @@
- 	archiveVersion = 1;
- 	classes = {
- 	};
--	objectVersion = 54;
-+	objectVersion = 48;
- 	objects = {
-
- /* Begin PBXBuildFile section */
-@@ -33,9 +33,6 @@
- 		A920A8AC251B75B70076851C /* GLSLToSPIRVConverter.h in Headers */ = {isa = PBXBuildFile; fileRef = A920A8A2251B75B70076851C /* GLSLToSPIRVConverter.h */; };
- 		A920A8AD251B75B80076851C /* GLSLToSPIRVConverter.h in Headers */ = {isa = PBXBuildFile; fileRef = A920A8A2251B75B70076851C /* GLSLToSPIRVConverter.h */; };
- 		A920A8AE251B75B80076851C /* GLSLToSPIRVConverter.h in Headers */ = {isa = PBXBuildFile; fileRef = A920A8A2251B75B70076851C /* GLSLToSPIRVConverter.h */; };
--		A920A8AF251B77900076851C /* glslang.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386FD24EEE93700199A05 /* glslang.xcframework */; };
--		A920A8B0251B77910076851C /* glslang.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386FD24EEE93700199A05 /* glslang.xcframework */; };
--		A920A8B1251B77920076851C /* glslang.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386FD24EEE93700199A05 /* glslang.xcframework */; };
- 		A925B71B1C78DEB2006E7ECD /* libMoltenVKShaderConverter.a in Frameworks */ = {isa = PBXBuildFile; fileRef = A93903C71C57E9ED00FE90DC /* libMoltenVKShaderConverter.a */; };
- 		A928C9191D0488DC00071B88 /* SPIRVConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = A928C9171D0488DC00071B88 /* SPIRVConversion.h */; };
- 		A928C91A1D0488DC00071B88 /* SPIRVConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = A928C9171D0488DC00071B88 /* SPIRVConversion.h */; };
-@@ -55,12 +52,6 @@
- 		A97CC7411C7527F3004A5C7E /* MoltenVKShaderConverterTool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A97CC73E1C7527F3004A5C7E /* MoltenVKShaderConverterTool.cpp */; };
- 		A98149681FB6A98A005F00B4 /* MVKStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = A98149651FB6A98A005F00B4 /* MVKStrings.h */; };
- 		A98149691FB6A98A005F00B4 /* MVKStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = A98149651FB6A98A005F00B4 /* MVKStrings.h */; };
--		A98386FA24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386F824EEE91A00199A05 /* SPIRVCross.xcframework */; };
--		A98386FB24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386F824EEE91A00199A05 /* SPIRVCross.xcframework */; };
--		A98386FC24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A98386F824EEE91A00199A05 /* SPIRVCross.xcframework */; };
--		A983870724EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A983870224EEE94800199A05 /* SPIRVTools.xcframework */; };
--		A983870824EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A983870224EEE94800199A05 /* SPIRVTools.xcframework */; };
--		A983870924EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A983870224EEE94800199A05 /* SPIRVTools.xcframework */; };
- 		A9A14E332244388700C080F3 /* Metal.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A9A14E322244388700C080F3 /* Metal.framework */; };
- 		A9B51BDD225E98BB00AC74D2 /* MVKOSExtensions.mm in Sources */ = {isa = PBXBuildFile; fileRef = A9B51BDB225E98BB00AC74D2 /* MVKOSExtensions.mm */; };
- 		A9F042B21FB4D060009FCCB8 /* MVKCommonEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = A9F042AA1FB4D060009FCCB8 /* MVKCommonEnvironment.h */; };
-@@ -115,9 +106,6 @@
- 			isa = PBXFrameworksBuildPhase;
- 			buildActionMask = 2147483647;
- 			files = (
--				A983870824EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */,
--				A98386FB24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */,
--				A920A8B0251B77910076851C /* glslang.xcframework in Frameworks */,
- 			);
- 			runOnlyForDeploymentPostprocessing = 0;
- 		};
-@@ -134,9 +122,6 @@
- 			isa = PBXFrameworksBuildPhase;
- 			buildActionMask = 2147483647;
- 			files = (
--				A983870724EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */,
--				A98386FA24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */,
--				A920A8AF251B77900076851C /* glslang.xcframework in Frameworks */,
- 			);
- 			runOnlyForDeploymentPostprocessing = 0;
- 		};
-@@ -144,9 +129,6 @@
- 			isa = PBXFrameworksBuildPhase;
- 			buildActionMask = 2147483647;
- 			files = (
--				A983870924EEE94800199A05 /* SPIRVTools.xcframework in Frameworks */,
--				A98386FC24EEE91A00199A05 /* SPIRVCross.xcframework in Frameworks */,
--				A920A8B1251B77920076851C /* glslang.xcframework in Frameworks */,
- 			);
- 			runOnlyForDeploymentPostprocessing = 0;
- 		};
-@@ -313,7 +295,7 @@
- 				A925B71D1C78DEBF006E7ECD /* PBXTargetDependency */,
- 			);
- 			name = MoltenVKShaderConverter;
--			productName = MetalGLShaderConverterTool;
-+			productName = MoltenVKShaderConverter;
- 			productReference = A964BD5F1C57EFBD00D930D8 /* MoltenVKShaderConverter */;
- 			productType = "com.apple.product-type.tool";
- 		};
-@@ -349,7 +331,7 @@
- 			dependencies = (
- 			);
- 			name = "MoltenVKShaderConverter-macOS";
--			productName = "MetalGLShaderConverter-macOS";
-+			productName = MoltenVKShaderConverter;
- 			productReference = A93903C71C57E9ED00FE90DC /* libMoltenVKShaderConverter.a */;
- 			productType = "com.apple.product-type.library.static";
- 		};
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index c6ada1f55d5f7..1324bdeb7f217 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -1,29 +1,34 @@
-{ lib
-, overrideCC
-, stdenv
-, fetchFromGitHub
-, gitUpdater
-, cctools
-, sigtool
-, cereal
-, libcxx
-, glslang
-, spirv-cross
-, spirv-headers
-, spirv-tools
-, vulkan-headers
-, xcbuild
-, AppKit
-, Foundation
-, Libsystem
-, MacOSX-SDK
-, Metal
-, QuartzCore
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gitUpdater,
+  cereal,
+  libcxx,
+  glslang,
+  simd,
+  spirv-cross,
+  spirv-headers,
+  spirv-tools,
+  vulkan-headers,
+  xcbuild,
+  AppKit,
+  Foundation,
+  Metal,
+  QuartzCore,
+  # MoltenVK supports using private APIs to implement some Vulkan functionality.
+  # Applications that use private APIs can’t be distributed on the App Store,
+  # but that’s not really a concern for nixpkgs, so use them by default.
+  # See: https://github.com/KhronosGroup/MoltenVK/blob/main/README.md#metal_private_api
+  enablePrivateAPIUsage ? true,
 }:
 
+let
+  inherit (stdenv.hostPlatform) isStatic;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.7";
+  version = "1.2.8";
 
   buildInputs = [
     AppKit
@@ -32,123 +37,164 @@ stdenv.mkDerivation (finalAttrs: {
     QuartzCore
     cereal
     glslang
+    simd
     spirv-cross
     spirv-headers
     spirv-tools
     vulkan-headers
   ];
 
-  nativeBuildInputs = [ cctools sigtool xcbuild ];
+  nativeBuildInputs = [ xcbuild ];
 
-  outputs = [ "out" "bin" "dev" ];
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0+S/kueV+AEVt+oFnh4cgcDRVtEbUH1QiHFPhGhimCA=";
+    hash = "sha256-nsNN2iCSjXzfarSdaNmeNbfDliUBMQMsb0rXEENWJqw=";
   };
 
-  patches = [
-    # Fix the Xcode projects to play nicely with `xcbuild`.
-    ./MoltenVKShaderConverter.xcodeproj.patch
-    ./MoltenVK.xcodeproj.patch
-  ];
-
   postPatch = ''
     # Move `mvkGitRevDerived.h` to a stable location
     substituteInPlace Scripts/gen_moltenvk_rev_hdr.sh \
       --replace-fail '$'''{BUILT_PRODUCTS_DIR}' "$NIX_BUILD_TOP/$sourceRoot/build/include" \
       --replace-fail '$(git rev-parse HEAD)' ${finalAttrs.src.rev}
-    # Use the SPIRV-Cross packaged in nixpkgs instead of one built specifically for MoltenVK.
-    substituteInPlace MoltenVK/MoltenVK.xcodeproj/project.pbxproj \
-      --replace-fail SPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross SPIRV_CROSS_NAMESPACE_OVERRIDE=spirv_cross
+
+    # Modify MoltenVK Xcode projects to build with xcbuild and dependencies from nixpkgs.
+    for proj in MoltenVK MoltenVKShaderConverter; do
+      # Remove xcframework dependencies from the Xcode projects. The basic format is:
+      #     (children|files) = (
+      #         DCFD7F822A45BDA0007BBBF7 /* SPIRVCross.xcframework in Frameworks */,
+      #         etc
+      #     )
+      # This regex will only remove lines matching `xcframework` that are in these blocks
+      # to avoid accidentally corrupting the project.
+      sed -E -e '/(children|files) = /,/;/{/xcframework/d}' \
+        -i "$proj/$proj.xcodeproj/project.pbxproj"
+      # Ensure the namespace used is consistent with the spirv-cross package in nixpkgs.
+      substituteInPlace "$proj/$proj.xcodeproj/project.pbxproj" \
+        --replace-fail SPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross SPIRV_CROSS_NAMESPACE_OVERRIDE=spirv_cross
+    done
     substituteInPlace MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj \
-      --replace-fail SPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross SPIRV_CROSS_NAMESPACE_OVERRIDE=spirv_cross
-    # Adding all of `usr/include` from the SDK results in header conflicts with `libcxx.dev`.
-    # Work around it by symlinking just the SIMD stuff needed by MoltenVK.
+      --replace-fail MetalGLShaderConverterTool MoltenVKShaderConverter \
+      --replace-fail MetalGLShaderConverter-macOS MoltenVKShaderConverter
+
+    # Don’t try to build `xcframework`s because `xcbuild` can’t build them.
+    sed -e '/xcframework/d' -i Scripts/package_all.sh
+
+    # Remove vendored dependency links.
+    find . -lname '*/External/*' -delete
+
+    # The library will be linked in the install phase regardless of version,
+    # so truncate it if it exists to avoid link failures.
+    test -f Scripts/create_dylib.sh && truncate --size 0 Scripts/create_dylib.sh
+
+    # Link glslang source because MoltenVK needs non-public headers to build.
     mkdir -p build/include
-    ln -s "${MacOSX-SDK}/usr/include/simd" "build/include"
     ln -s "${glslang.src}" "build/include/glslang"
   '';
 
-  dontConfigure = true;
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-isystem ${lib.getDev libcxx}/include/c++/v1"
-    "-I${lib.getDev spirv-cross}/include/spirv_cross"
-    "-I${lib.getDev spirv-headers}/include/spirv/unified1/"
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-isystem ${lib.getDev libcxx}/include/c++/v1"
+      "-I${lib.getDev spirv-cross}/include/spirv_cross"
+      "-I${lib.getDev spirv-headers}/include/spirv/unified1"
+    ]
+    ++ lib.optional enablePrivateAPIUsage "-DMVK_USE_METAL_PRIVATE_API=1"
+  );
+
+  env.NIX_LDFLAGS = toString [
+    "-lMachineIndependent"
+    "-lGenericCodeGen"
+    "-lglslang"
+    "-lOSDependent"
+    "-lSPIRV"
+    "-lSPIRV-Tools"
+    "-lSPIRV-Tools-opt"
+    "-lspirv-cross-msl"
+    "-lspirv-cross-core"
+    "-lspirv-cross-glsl"
+    "-lspirv-cross-reflect"
   ];
 
   buildPhase = ''
+    runHook preBuild
+
     NIX_CFLAGS_COMPILE+=" \
       -I$NIX_BUILD_TOP/$sourceRoot/build/include \
       -I$NIX_BUILD_TOP/$sourceRoot/Common"
-    NIX_LDFLAGS+=" -L$NIX_BUILD_TOP/$sourceRoot/build/lib"
-
-    # Build each project on its own because `xcbuild` fails to build `MoltenVKPackaging.xcodeproj`.
-    build=$NIX_BUILD_TOP/$sourceRoot/build
-    mkdir -p "$build/bin" "$build/lib"
-
-    NIX_LDFLAGS+=" \
-      -lMachineIndependent \
-      -lGenericCodeGen \
-      -lglslang \
-      -lOSDependent \
-      -lSPIRV \
-      -lSPIRV-Tools \
-      -lSPIRV-Tools-opt \
-      -lspirv-cross-msl \
-      -lspirv-cross-core \
-      -lspirv-cross-glsl"
-
-    pushd MoltenVKShaderConverter
-    xcodebuild build \
-      -jobs $NIX_BUILD_CORES \
-      -configuration Release \
-      -project MoltenVKShaderConverter.xcodeproj \
-      -scheme MoltenVKShaderConverter \
-      -arch ${stdenv.hostPlatform.darwinArch}
-    declare -A products=( [MoltenVKShaderConverter]=bin [libMoltenVKShaderConverter.a]=lib )
-    for product in "''${!products[@]}"; do
-      cp MoltenVKShaderConverter-*/Build/Products/Release/$product "$build/''${products[$product]}/$product"
-    done
-    popd
-
-    NIX_LDFLAGS+=" \
-      -lobjc \
-      -lMoltenVKShaderConverter \
-      -lspirv-cross-reflect"
 
-    pushd MoltenVK
     xcodebuild build \
+      SYMROOT=$PWD/Products OBJROOT=$PWD/Intermedates \
       -jobs $NIX_BUILD_CORES \
       -configuration Release \
-      -project MoltenVK.xcodeproj \
-      -scheme MoltenVK-macOS \
+      -project MoltenVKPackaging.xcodeproj \
+      -scheme 'MoltenVK Package (macOS only)' \
+      -destination generic/platform=macOS \
       -arch ${stdenv.hostPlatform.darwinArch}
-    cp MoltenVK-*/Build/Products/Release/dynamic/libMoltenVK.dylib "$build/lib/libMoltenVK.dylib"
-    popd
+
+    runHook postBuild
   '';
 
+  postBuild =
+    if isStatic then
+      ''
+        mkdir -p Package/Release/MoltenVK/static
+        cp Products/Release/libMoltenVK.a Package/Release/MoltenVK/static
+      ''
+    else
+      ''
+        # MoltenVK’s Xcode project builds the dylib, but it doesn’t seem to work with
+        # xcbuild. This is based on the script versions prior to 1.2.8 used.
+        mkdir -p Package/Release/MoltenVK/dynamic/dylib
+        clang++ -Wl,-all_load -Wl,-w \
+          -dynamiclib \
+          -compatibility_version 1.0.0 -current_version 1.0.0 \
+          -LProducts/Release \
+          -framework AppKit \
+          -framework CoreGraphics \
+          -framework Foundation \
+          -framework IOKit \
+          -framework IOSurface \
+          -framework Metal \
+          -framework QuartzCore \
+          -lobjc \
+          -lMoltenVKShaderConverter \
+          -lspirv-cross-reflect \
+          -install_name "$out/lib/libMoltenVK.dylib" \
+          -o Package/Release/MoltenVK/dynamic/dylib/libMoltenVK.dylib \
+          -force_load Products/Release/libMoltenVK.a
+      '';
+
   installPhase = ''
-    mkdir -p "$out/lib" "$out/share/vulkan/icd.d" "$bin/bin" "$dev/include/MoltenVK"
-    cp build/bin/MoltenVKShaderConverter "$bin/bin/"
-    cp build/lib/libMoltenVK.dylib "$out/lib/"
-    cp MoltenVK/MoltenVK/API/* "$dev/include/MoltenVK"
-    install -m644 MoltenVK/icd/MoltenVK_icd.json "$out/share/vulkan/icd.d/MoltenVK_icd.json"
-    substituteInPlace $out/share/vulkan/icd.d/MoltenVK_icd.json \
+    runHook preInstall
+
+    libraryExtension=${if isStatic then ".a" else ".dylib"}
+    packagePath=${if isStatic then "static" else "dynamic/dylib"}
+
+    mkdir -p "$out/lib" "$out/share/vulkan/icd.d" "$bin/bin" "$dev"
+
+    cp Package/Release/MoltenVKShaderConverter/Tools/MoltenVKShaderConverter "$bin/bin"
+    cp -r Package/Release/MoltenVK/include "$dev"
+    cp Package/Release/MoltenVK/$packagePath/libMoltenVK$libraryExtension "$out/lib"
+
+    # Install ICD definition for use with vulkan-loader.
+    install -m644 MoltenVK/icd/MoltenVK_icd.json \
+      "$out/share/vulkan/icd.d/MoltenVK_icd.json"
+    substituteInPlace "$out/share/vulkan/icd.d/MoltenVK_icd.json" \
       --replace-fail ./libMoltenVK.dylib "$out/lib/libMoltenVK.dylib"
-  '';
 
-  postFixup = ''
-    install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
-    codesign -s - -f "$out/lib/libMoltenVK.dylib"
-    codesign -s - -f "$bin/bin/MoltenVKShaderConverter"
+    runHook postInstall
   '';
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
+    ignoredVersions = ".*-(beta|rc).*";
   };
 
   meta = {
diff --git a/pkgs/os-specific/darwin/opencflite/default.nix b/pkgs/os-specific/darwin/opencflite/default.nix
deleted file mode 100644
index 937d0763feff1..0000000000000
--- a/pkgs/os-specific/darwin/opencflite/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, stdenv, fetchurl, icu, libuuid, tzdata }:
-
-stdenv.mkDerivation rec {
-  pname = "opencflite";
-  version = "476.19.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/opencflite/${pname}-${version}.tar.gz";
-    sha256 = "0jgmzs0ycl930hmzcvx0ykryik56704yw62w394q1q3xw5kkjn9v";
-  };
-
-  configureFlags = [ "--with-uuid=${libuuid.dev}" ];
-  buildInputs = [ icu tzdata.dev ];
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Cross platform port of the macOS CoreFoundation";
-    homepage = "https://sourceforge.net/projects/opencflite/";
-    license = lib.licenses.apsl20;
-  };
-}
diff --git a/pkgs/os-specific/darwin/print-reexports/default.nix b/pkgs/os-specific/darwin/print-reexports/default.nix
index 740bcb48ef595..992cf1bff8ea3 100644
--- a/pkgs/os-specific/darwin/print-reexports/default.nix
+++ b/pkgs/os-specific/darwin/print-reexports/default.nix
@@ -14,4 +14,5 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     mv print-reexports $out/bin
   '';
+  meta.mainProgram = "print-reexports";
 }
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index e45188f3e2cd2..9671b5885c828 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -1,17 +1,21 @@
 { lib
 , stdenvNoCC
 , fetchurl
+, writeShellApplication
+, curl
+, jq
+, common-updater-scripts
 , undmg
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.66.2";
+  version = "1.71.3";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-HV3urzJX33dQjzUxtQhVgMaguGk8nqtXJJBXjHwaqC0=";
+    hash = "sha256-jiGo4H38qAiGMh4ckswyeDcijYL2wbcjs+IubDFjobU=";
   };
 
   dontPatch = true;
@@ -32,12 +36,23 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = lib.getExe (writeShellApplication {
+    name = "raycast-update-script";
+    runtimeInputs = [ curl jq common-updater-scripts ];
+    text = ''
+      set -eo pipefail
+      url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
+      version=$(echo "$url" | jq -r '.version')
+      update-source-version raycast "$version" --file=./pkgs/os-specific/darwin/raycast/default.nix
+    '';
+  });
+
   meta = with lib; {
     description = "Control your tools with a few keystrokes";
     homepage = "https://raycast.app/";
     license = with licenses; [ unfree ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ lovesegfault stepbrobd ];
+    maintainers = with maintainers; [ lovesegfault stepbrobd donteatoreo ];
     platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
 })
diff --git a/pkgs/os-specific/darwin/raycast/update.sh b/pkgs/os-specific/darwin/raycast/update.sh
deleted file mode 100755
index e33f8421597d9..0000000000000
--- a/pkgs/os-specific/darwin/raycast/update.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../. -i bash -p common-updater-scripts jq
-
-set -eo pipefail
-
-new_version=$(curl --silent https://releases.raycast.com/releases/latest?build=universal | jq -r '.version')
-old_version=$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)
-
-if [[ $new_version == $old_version ]]; then
-    echo "Already up to date."
-    exit 0
-else
-    echo "raycast: $old_version -> $new_version"
-    sed -Ei.bak '/ *version = "/s/".+"/"'"$new_version"'"/' ./default.nix
-    rm ./default.nix.bak
-fi
-
-hash=$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://releases.raycast.com/releases/$new_version/download?build=universal" | jq -r '.hash')
-sed -Ei.bak '/ *hash = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
-rm ./default.nix.bak
diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index 7a5467dc92a44..527cca8e87c1e 100644
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://github.com/thefloweringash/rewrite-tbd/";
     description = "Rewrite filepath in .tbd to Nix applicable format";
+    mainProgram = "rewrite-tbd";
     platforms = platforms.unix;
     license = licenses.mit;
   };
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index 3081e40622c54..0cc820986c088 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -11,6 +11,7 @@
 , MediaRemote
 , SkyLight
 , testers
+, nix-update-script
 }:
 
 let
@@ -56,9 +57,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
-    version = "sketchybar-v${finalAttrs.version}";
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "sketchybar-v${finalAttrs.version}";
+    };
+
+    updateScript = nix-update-script { };
   };
 
   meta = {
diff --git a/pkgs/os-specific/darwin/skhd/default.nix b/pkgs/os-specific/darwin/skhd/default.nix
index f979f7ec020e7..539e90562ec71 100644
--- a/pkgs/os-specific/darwin/skhd/default.nix
+++ b/pkgs/os-specific/darwin/skhd/default.nix
@@ -4,6 +4,7 @@
 , Carbon
 , Cocoa
 , testers
+, nix-update-script
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,9 +35,13 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace $out/Library/LaunchDaemons/org.nixos.skhd.plist --subst-var out
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
-    version = "skhd-v${finalAttrs.version}";
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "skhd-v${finalAttrs.version}";
+    };
+
+    updateScript = nix-update-script { };
   };
 
   meta = {
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index cdae949ba982c..150db493198fa 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -1,30 +1,117 @@
 { lib
 , stdenv
-, stdenvNoCC
 , fetchFromGitHub
 , fetchzip
 , installShellFiles
 , testers
-, yabai
-, xxd
+, writeShellScript
+, common-updater-scripts
+, curl
+, jq
 , xcodebuild
-  # These all need to be from SDK 11.0 or later starting with yabai 5.0.0
+, xxd
+, yabai
 , Carbon
 , Cocoa
 , ScriptingBridge
 , SkyLight
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "yabai";
-  version = "6.0.15";
+  version = "7.1.0";
+
+  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  env = {
+    # silence service.h error
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.isx86_64 [
+    xcodebuild
+    xxd
+  ];
+
+  buildInputs = [ ] ++ lib.optionals stdenv.isx86_64 [
+    Carbon
+    Cocoa
+    ScriptingBridge
+    SkyLight
+  ];
+
+  dontConfigure = true;
+  dontBuild = stdenv.isAarch64;
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
+
+    cp ./bin/yabai $out/bin/yabai
+    ${lib.optionalString stdenv.isx86_64 "cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg"}
+    installManPage ./doc/yabai.1
+
+    runHook postInstall
+  '';
+
+  postPatch = lib.optionalString stdenv.isx86_64 /* bash */ ''
+    # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
+    # Since multilib doesnt work on darwin i dont know of a better way of handling this.
+    substituteInPlace makefile \
+    --replace "-arch arm64e" "" \
+    --replace "-arch arm64" "" \
+    --replace "clang" "${stdenv.cc.targetPrefix}clang"
+
+    # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
+    # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
+    # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
+    substituteInPlace src/workspace.m \
+    --replace 'return screen.safeAreaInsets.top;' 'return 0;'
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = yabai;
+      version = "yabai-v${finalAttrs.version}";
+    };
+
+    sources = {
+      # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
+      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
+      "aarch64-darwin" = fetchzip {
+        url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
+        hash = "sha256-88Sh2nizAQ0a0cnlnrkhb5x3VjHa372HhjHlmNjGdQ4=";
+      };
+      "x86_64-darwin" = fetchFromGitHub
+        {
+          owner = "koekeishiya";
+          repo = "yabai";
+          rev = "v${finalAttrs.version}";
+          hash = "sha256-5iC1U6tyUYFLjOfnIxCrjCjj2deUZ/rvsJN4jlrr2Tc=";
+        };
+    };
 
-  test-version = testers.testVersion {
-    package = yabai;
-    version = "yabai-v${version}";
+    updateScript = writeShellScript "update-yabai" ''
+      set -o errexit
+      export PATH="${lib.makeBinPath [ curl jq common-updater-scripts ]}"
+      NEW_VERSION=$(curl --silent https://api.github.com/repos/koekeishiya/yabai/releases/latest | jq '.tag_name | ltrimstr("v")' --raw-output)
+      if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
+          echo "The new version same as the old version."
+          exit 0
+      fi
+      for platform in ${lib.escapeShellArgs finalAttrs.meta.platforms}; do
+        update-source-version "yabai" "0" "${lib.fakeHash}" --source-key="sources.$platform"
+        update-source-version "yabai" "$NEW_VERSION" --source-key="sources.$platform"
+      done
+    '';
   };
 
-  _meta = with lib; {
+  meta = {
     description = "A tiling window manager for macOS based on binary space partitioning";
     longDescription = ''
       yabai is a window management utility that is designed to work as an extension to the built-in
@@ -33,119 +120,22 @@ let
       using skhd and other third-party software.
     '';
     homepage = "https://github.com/koekeishiya/yabai";
-    changelog = "https://github.com/koekeishiya/yabai/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    platforms = platforms.darwin;
+    changelog = "https://github.com/koekeishiya/yabai/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    platforms = builtins.attrNames finalAttrs.passthru.sources;
     mainProgram = "yabai";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       cmacrae
       shardy
       ivar
       khaneliman
     ];
-  };
-in
-{
-  # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
-  # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
-  aarch64-darwin = stdenvNoCC.mkDerivation {
-    inherit pname version;
-
-    src = fetchzip {
-      url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-L82N0IaC2OAZVhmu9NALencK78FeCZI2cWJyNkGH2vQ=";
-    };
-
-    nativeBuildInputs = [
-      installShellFiles
+    sourceProvenance = with lib.sourceTypes; [ ]
+      ++ lib.optionals stdenv.isx86_64 [
+      fromSource
+    ] ++ lib.optionals stdenv.isAarch64 [
+      binaryNativeCode
     ];
-
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r ./bin $out
-      installManPage ./doc/yabai.1
-
-      runHook postInstall
-    '';
-
-    passthru.tests.version = test-version;
-
-    meta = _meta // {
-      sourceProvenance = with lib.sourceTypes; [
-        binaryNativeCode
-      ];
-    };
   };
+})
 
-  x86_64-darwin = stdenv.mkDerivation {
-    inherit pname version;
-
-    src = fetchFromGitHub {
-      owner = "koekeishiya";
-      repo = "yabai";
-      rev = "v${version}";
-      hash = "sha256-buX6FRIXdM5VmYpA80eESDMPf+xeMfJJj0ulyx2g94M=";
-    };
-
-    nativeBuildInputs = [
-      installShellFiles
-      xcodebuild
-      xxd
-    ];
-
-    buildInputs = [
-      Carbon
-      Cocoa
-      ScriptingBridge
-      SkyLight
-    ];
-
-    dontConfigure = true;
-    enableParallelBuilding = true;
-
-    env = {
-      # silence service.h error
-      NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-    };
-
-    postPatch = ''
-      # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
-      # Since multilib doesnt work on darwin i dont know of a better way of handling this.
-      substituteInPlace makefile \
-        --replace "-arch arm64e" "" \
-        --replace "-arch arm64" "" \
-        --replace "clang" "${stdenv.cc.targetPrefix}clang"
-
-      # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
-      # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
-      # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
-      substituteInPlace src/workspace.m \
-        --replace 'return screen.safeAreaInsets.top;' 'return 0;'
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
-
-      cp ./bin/yabai $out/bin/yabai
-      cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg
-      installManPage ./doc/yabai.1
-
-      runHook postInstall
-    '';
-
-    passthru.tests.version = test-version;
-
-    meta = _meta // {
-      sourceProvenance = with lib.sourceTypes; [
-        fromSource
-      ];
-    };
-  };
-}.${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}")
diff --git a/pkgs/os-specific/linux/915resolution/default.nix b/pkgs/os-specific/linux/915resolution/default.nix
index b67d737034e48..6966a76cfa971 100644
--- a/pkgs/os-specific/linux/915resolution/default.nix
+++ b/pkgs/os-specific/linux/915resolution/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://915resolution.mango-lang.org/";
     description = "A tool to modify Intel 800/900 video BIOS";
+    mainProgram = "915resolution";
     platforms = [ "i686-linux" "x86_64-linux" ];
     license = licenses.publicDomain;
   };
diff --git a/pkgs/os-specific/linux/acpi-call/default.nix b/pkgs/os-specific/linux/acpi-call/default.nix
index b84ecd21293a7..0da824b169e63 100644
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/nix-community/acpi_call";
     platforms = platforms.linux;
     description = "A module allowing arbitrary ACPI calls; use case: hybrid video";
+    mainProgram = "test_discrete_video_off.sh";
     license = licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/acpi/default.nix b/pkgs/os-specific/linux/acpi/default.nix
index d257553299cf7..2b661e57c4cdd 100644
--- a/pkgs/os-specific/linux/acpi/default.nix
+++ b/pkgs/os-specific/linux/acpi/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Show battery status and other ACPI information";
+    mainProgram = "acpi";
     longDescription = ''
       Linux ACPI client is a small command-line
       program that attempts to replicate the functionality of
diff --git a/pkgs/os-specific/linux/acpitool/default.nix b/pkgs/os-specific/linux/acpitool/default.nix
index d494e95e3db67..317ca54b7cde4 100644
--- a/pkgs/os-specific/linux/acpitool/default.nix
+++ b/pkgs/os-specific/linux/acpitool/default.nix
@@ -44,6 +44,7 @@ in stdenv.mkDerivation rec {
 
   meta = {
     description = "A small, convenient command-line ACPI client with a lot of features";
+    mainProgram = "acpitool";
     homepage = "https://sourceforge.net/projects/acpitool/";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.guibert ];
diff --git a/pkgs/os-specific/linux/adcli/default.nix b/pkgs/os-specific/linux/adcli/default.nix
index 66e017437f9da..5f94da21f2074 100644
--- a/pkgs/os-specific/linux/adcli/default.nix
+++ b/pkgs/os-specific/linux/adcli/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
     description = "A helper library and tools for Active Directory client operations.";
+    mainProgram = "adcli";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ SohamG anthonyroussel ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/akvcam/default.nix b/pkgs/os-specific/linux/akvcam/default.nix
index ddf9fed60bfd1..3fdb247a33ebb 100644
--- a/pkgs/os-specific/linux/akvcam/default.nix
+++ b/pkgs/os-specific/linux/akvcam/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "akvcam";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "webcamoid";
     repo = "akvcam";
     rev = version;
-    sha256 = "sha256-SzyamP6kcJI/GEeFp3uf1APdoBtwoUj0/9Otwtmygvs=";
+    sha256 = "sha256-8jQxBvWRE9Bsh0oz76gO7o+ROm6Z5QGAIe3WERIouUw=";
   };
   sourceRoot = "${src.name}/src";
 
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ freezeboy ];
     platforms = platforms.linux;
     license = licenses.gpl2Only;
-    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/pkgs/os-specific/linux/amdctl/default.nix b/pkgs/os-specific/linux/amdctl/default.nix
index d0a15578857ce..abc26aabf7843 100644
--- a/pkgs/os-specific/linux/amdctl/default.nix
+++ b/pkgs/os-specific/linux/amdctl/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux.";
+    mainProgram = "amdctl";
     homepage = "https://github.com/kevinlekiller/amdctl";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/os-specific/linux/aseq2json/default.nix b/pkgs/os-specific/linux/aseq2json/default.nix
index ac1a8220d564b..d828c808037a6 100644
--- a/pkgs/os-specific/linux/aseq2json/default.nix
+++ b/pkgs/os-specific/linux/aseq2json/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "Listens for MIDI events on the Alsa sequencer and outputs as JSON to stdout";
+    mainProgram = "aseq2json";
     homepage = "https://github.com/google/midi-dump-tools";
     license = licenses.asl20;
     maintainers = [ maintainers.queezle ];
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 48d12abcf2f5e..db0e7b48383f3 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Kernel-based automounter";
+    mainProgram = "automount";
     homepage = "https://www.kernel.org/pub/linux/daemons/autofs/";
     license = lib.licenses.gpl2Plus;
     executables = [ "automount" ];
diff --git a/pkgs/os-specific/linux/autosuspend/default.nix b/pkgs/os-specific/linux/autosuspend/default.nix
deleted file mode 100644
index 5abacf966b9e1..0000000000000
--- a/pkgs/os-specific/linux/autosuspend/default.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{ lib
-, fetchFromGitHub
-, fetchPypi
-, python3
-}:
-
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      # autosuspend is incompatible with tzlocal v5
-      # See https://github.com/regebro/tzlocal#api-change
-      tzlocal = super.tzlocal.overridePythonAttrs (prev: rec {
-        version = "4.3.1";
-        src = fetchPypi {
-          inherit (prev) pname;
-          inherit version;
-          hash = "sha256-7jLvjCCAPBmpbtNmrd09SnKe9jCctcc1mgzC7ut/pGo=";
-        };
-        propagatedBuildInputs = with self; [
-          pytz-deprecation-shim
-        ];
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
-  pname = "autosuspend";
-  version = "6.0.0";
-
-  disabled = python3.pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "languitar";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
-  };
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace '--cov-config=setup.cfg' ""
-  '';
-
-  propagatedBuildInputs = with python.pkgs; [
-    dbus-python
-    icalendar
-    jsonpath-ng
-    lxml
-    mpd2
-    portalocker
-    psutil
-    python-dateutil
-    pytz
-    requests
-    requests-file
-    tzlocal
-  ];
-
-  nativeCheckInputs = with python.pkgs; [
-    freezegun
-    pytest-datadir
-    pytest-httpserver
-    pytest-mock
-    pytestCheckHook
-    python-dbusmock
-  ];
-
-  # Disable tests that need root
-  disabledTests = [
-    "test_smoke"
-    "test_multiple_sessions"
-  ];
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "A daemon to automatically suspend and wake up a system";
-    homepage = "https://autosuspend.readthedocs.io";
-    changelog = "https://github.com/languitar/autosuspend/releases/tag/v${version}";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ bzizou anthonyroussel ];
-    mainProgram = "autosuspend";
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index b01f48a242a6b..bb44ac5e99f56 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, control tool";
+    mainProgram = "batctl";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ fpletz ];
     platforms = with lib.platforms; linux;
diff --git a/pkgs/os-specific/linux/beefi/default.nix b/pkgs/os-specific/linux/beefi/default.nix
index 959a43faea91d..39300b948976d 100644
--- a/pkgs/os-specific/linux/beefi/default.nix
+++ b/pkgs/os-specific/linux/beefi/default.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A small script to create bootable EFISTUB kernel images";
+    mainProgram = "beefi";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ tu-maurice ];
diff --git a/pkgs/os-specific/linux/bolt/default.nix b/pkgs/os-specific/linux/bolt/default.nix
index f81173095814f..11973ba5a5708 100644
--- a/pkgs/os-specific/linux/bolt/default.nix
+++ b/pkgs/os-specific/linux/bolt/default.nix
@@ -93,6 +93,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Thunderbolt 3 device management daemon";
+    mainProgram = "boltctl";
     homepage = "https://gitlab.freedesktop.org/bolt/bolt";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ callahad ];
diff --git a/pkgs/os-specific/linux/bpfmon/default.nix b/pkgs/os-specific/linux/bpfmon/default.nix
index f0815376c2a0b..ca59dbde6bb89 100644
--- a/pkgs/os-specific/linux/bpfmon/default.nix
+++ b/pkgs/os-specific/linux/bpfmon/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "BPF based visual packet rate monitor";
+    mainProgram = "bpfmon";
     homepage = "https://github.com/bbonev/bpfmon";
     changelog = "https://github.com/bbonev/bpfmon/releases/tag/v${version}";
     maintainers = with maintainers; [ arezvov ];
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
index c16343a176b7e..068f4532451b0 100644
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchFromGitHub {
     owner = "iovisor";
     repo  = "bpftrace";
     rev   = "v${version}";
-    hash  = "sha256-AndqOqwDTQIFr5vVJ8i4tarCfg9Vz2i58eB+/7OVHNE=";
+    hash  = "sha256-B4BxoZSPSpDWLUgcYgQEmuhVr2mX04hrFCLu04vp1so=";
   };
 
 
diff --git a/pkgs/os-specific/linux/bpftune/default.nix b/pkgs/os-specific/linux/bpftune/default.nix
index 86c706ac2702d..517cd04a455d8 100644
--- a/pkgs/os-specific/linux/bpftune/default.nix
+++ b/pkgs/os-specific/linux/bpftune/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "BPF-based auto-tuning of Linux system parameters";
+    mainProgram = "bpftune";
     homepage = "https://github.com/oracle-samples/bpftune";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ nickcao ];
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index a03cb12727ce1..1753be599380d 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "An userspace tool to configure linux bridges (deprecated in favour or iproute2).";
+    mainProgram = "brctl";
     homepage = "https://wiki.linuxfoundation.org/networking/bridge";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/cachefilesd/default.nix b/pkgs/os-specific/linux/cachefilesd/default.nix
index 6c52eb4a7f600..12b9e1cf99190 100644
--- a/pkgs/os-specific/linux/cachefilesd/default.nix
+++ b/pkgs/os-specific/linux/cachefilesd/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Local network file caching management daemon";
+    mainProgram = "cachefilesd";
     homepage = "https://people.redhat.com/dhowells/fscache/";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/cannelloni/default.nix b/pkgs/os-specific/linux/cannelloni/default.nix
index 0a27c53eefc89..86107d4f7aa03 100644
--- a/pkgs/os-specific/linux/cannelloni/default.nix
+++ b/pkgs/os-specific/linux/cannelloni/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "A SocketCAN over Ethernet tunnel";
+    mainProgram = "cannelloni";
     homepage = "https://github.com/mguentner/cannelloni";
     platforms = platforms.linux;
     license = licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/catfs/default.nix b/pkgs/os-specific/linux/catfs/default.nix
index fb4d21820755d..107dce2123db9 100644
--- a/pkgs/os-specific/linux/catfs/default.nix
+++ b/pkgs/os-specific/linux/catfs/default.nix
@@ -41,6 +41,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "Caching filesystem written in Rust";
+    mainProgram = "catfs";
     homepage = "https://github.com/kahing/catfs";
     license = licenses.asl20;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index 07574722cd20d..488bfdff1a6ad 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -97,6 +97,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool for checking security bits on executables";
+    mainProgram = "checksec";
     homepage = "https://www.trapkit.de/tools/checksec/";
     license = licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/compsize/default.nix b/pkgs/os-specific/linux/compsize/default.nix
index 9d0dbeffaee3c..441108b0e54f7 100644
--- a/pkgs/os-specific/linux/compsize/default.nix
+++ b/pkgs/os-specific/linux/compsize/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "btrfs: Find compression type/ratio on a file or set of files";
+    mainProgram = "compsize";
     homepage = "https://github.com/kilobyte/compsize";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ CrazedProgrammer ];
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 32eef7f9e26a7..0818850f75493 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -148,6 +148,7 @@ stdenv.mkDerivation rec {
     homepage = "https://conky.cc";
     changelog = "https://github.com/brndnmtthws/conky/releases/tag/v${version}";
     description = "Advanced, highly configurable system monitor based on torsmo";
+    mainProgram = "conky";
     maintainers = [ maintainers.guibert ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/conspy/default.nix b/pkgs/os-specific/linux/conspy/default.nix
index 00e97855e2617..19b1565e435d6 100644
--- a/pkgs/os-specific/linux/conspy/default.nix
+++ b/pkgs/os-specific/linux/conspy/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux text console viewer";
+    mainProgram = "conspy";
     license = licenses.epl10;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/cpuid/default.nix b/pkgs/os-specific/linux/cpuid/default.nix
index 396baa4b98c18..d74d25398f645 100644
--- a/pkgs/os-specific/linux/cpuid/default.nix
+++ b/pkgs/os-specific/linux/cpuid/default.nix
@@ -1,27 +1,24 @@
-{ lib
-, stdenv
-, fetchurl
-, perl
+{
+  lib,
+  stdenv,
+  fetchurl,
+  perl,
 }:
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20230614";
+  version = "20240324";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-scgwRe/CYHYwd1HgZi1YAnf1+b+JzwJyMaeBIAPDpOg=";
+    sha256 = "sha256-3fvFudgBUbsEl16d7BMFEDQZeY0i7/LiRJCD3AhiGEw=";
   };
 
   # For pod2man during the build process.
-  nativeBuildInputs = [
-    perl
-  ];
+  nativeBuildInputs = [ perl ];
 
   # As runtime dependency for cpuinfo2cpuid.
-  buildInputs = [
-    perl
-  ];
+  buildInputs = [ perl ];
 
   # The Makefile hardcodes $(BUILDROOT)/usr as installation
   # destination. Just nuke all mentions of /usr to get the right
@@ -50,6 +47,9 @@ stdenv.mkDerivation rec {
     homepage = "http://etallen.com/cpuid.html";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ blitz ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
   };
 }
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 1f57bc9428f02..02a781d1f0cf0 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -96,6 +96,7 @@ buildPythonApplication rec {
 
   meta = with lib; {
     description = "Change the frequency limits of your cpu and its governor";
+    mainProgram = "cpupower-gui";
     homepage = "https://github.com/vagnum08/cpupower-gui/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ unode ];
diff --git a/pkgs/os-specific/linux/cpustat/default.nix b/pkgs/os-specific/linux/cpustat/default.nix
index e5bbd388081e8..84a4fc53933e7 100644
--- a/pkgs/os-specific/linux/cpustat/default.nix
+++ b/pkgs/os-specific/linux/cpustat/default.nix
@@ -1,17 +1,23 @@
-{ stdenv, lib, fetchFromGitHub, ncurses }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, ncurses
+}:
 
 stdenv.mkDerivation rec {
   pname = "cpustat";
-  version = "0.02.19";
+  version = "0.02.20";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
-    repo = pname;
-    rev = "V${version}";
-    hash = "sha256-MujdgA+rFLrRc/N9yN7udnarA1TCzX//95hoXTUHG8Q=";
+    repo ="cpustat";
+    rev = "refs/tags/V${version}";
+    hash = "sha256-cdHoo2esm772q782kb7mwRwlPXGDNNLHJRbd2si5g7k=";
   };
 
-  buildInputs = [ ncurses ];
+  buildInputs = [
+    ncurses
+  ];
 
   installFlags = [
     "BINDIR=${placeholder "out"}/bin"
@@ -22,8 +28,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "CPU usage monitoring tool";
     homepage = "https://github.com/ColinIanKing/cpustat";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
+    mainProgram = "cpustat";
   };
 }
diff --git a/pkgs/os-specific/linux/cramfsswap/default.nix b/pkgs/os-specific/linux/cramfsswap/default.nix
index f79921186388a..c696df6f00849 100644
--- a/pkgs/os-specific/linux/cramfsswap/default.nix
+++ b/pkgs/os-specific/linux/cramfsswap/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Swap endianess of a cram filesystem (cramfs)";
+    mainProgram = "cramfsswap";
     homepage = "https://packages.debian.org/sid/utils/cramfsswap";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/cshatag/default.nix b/pkgs/os-specific/linux/cshatag/default.nix
index 84de0c5dd11d1..70fd5ccbb6954 100644
--- a/pkgs/os-specific/linux/cshatag/default.nix
+++ b/pkgs/os-specific/linux/cshatag/default.nix
@@ -22,6 +22,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "A tool to detect silent data corruption";
+    mainProgram = "cshatag";
     homepage = "https://github.com/rfjakob/cshatag";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/dcgm/default.nix b/pkgs/os-specific/linux/dcgm/default.nix
index f3ebdf1427ebb..a7f3511b3f4ba 100644
--- a/pkgs/os-specific/linux/dcgm/default.nix
+++ b/pkgs/os-specific/linux/dcgm/default.nix
@@ -1,6 +1,7 @@
 { lib
 , gcc11Stdenv
 , fetchFromGitHub
+, autoAddDriverRunpath
 , catch2
 , cmake
 , cudaPackages_10_2
@@ -105,10 +106,10 @@ in gcc11Stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [
-    # autoAddOpenGLRunpathHook does not actually depend on or incur any dependency
+    # autoAddDriverRunpath does not actually depend on or incur any dependency
     # of cudaPackages. It merely adds an impure, non-Nix PATH to the RPATHs of
     # executables that need to use cuda at runtime.
-    cudaPackages_12.autoAddOpenGLRunpathHook
+    autoAddDriverRunpath
 
     cmake
     git
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
index fbf47204b3e6f..88a3877c37f2c 100644
--- a/pkgs/os-specific/linux/devmem2/default.nix
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Simple program to read/write from/to any location in memory";
+    mainProgram = "devmem2";
     homepage = "http://lartmaker.nl/lartware/port/";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index f5c7f3bc774e4..e0e238fd35602 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/MeanEYE/Disk-Indicator";
     description = "A program that will turn a LED into a hard disk indicator";
+    mainProgram = "disk_indicator";
     longDescription = ''
       Small program for Linux that will turn your Scroll, Caps or Num Lock LED
       or LED on your ThinkPad laptop into a hard disk activity indicator.
diff --git a/pkgs/os-specific/linux/dpdk-kmods/default.nix b/pkgs/os-specific/linux/dpdk-kmods/default.nix
index a3e4f6663860a..ec5fda7aa4195 100644
--- a/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -2,20 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dpdk-kmods";
-  version = "2022-08-29";
+  version = "2023-02-05";
 
   src = fetchzip {
-    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-4a589f7bed00fc7009c93d430bd214ac7ad2bb6b.tar.xz";
-    sha256 = "sha256-l9asJuw2nl63I1BxK6udy2pNunRiMJxyoXeg9V5+WgI=";
+    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-e721c733cd24206399bebb8f0751b0387c4c1595.tar.xz";
+    sha256 = "sha256-AG5Lthp+CPR4R7I23DUmoWAmET8gLEFHHdjk2TUbQn4=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.launchpad.net/ubuntu/+source/dpdk-kmods/plain/debian/patches/0001-support-linux-5.18.patch?id=9d628c02c169d8190bc2cb6afd81e4d364c382cd";
-      sha256 = "sha256-j4kpx1DOnmf5lFxOhaVFNT7prEy1jrJERX2NFaybTPU=";
-    })
-  ];
-
   hardeningDisable = [ "pic" ];
 
   makeFlags = kernel.makeFlags ++ [
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index c92f40e3935ff..bd5d9db661a88 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -1,8 +1,7 @@
 { stdenv, lib
-, kernel
 , fetchurl
 , pkg-config, meson, ninja, makeWrapper
-, libbsd, numactl, libbpf, zlib, libelf, jansson, openssl, libpcap, rdma-core
+, libbsd, numactl, libbpf, zlib, elfutils, jansson, openssl, libpcap, rdma-core
 , doxygen, python3, pciutils
 , withExamples ? []
 , shared ? false
@@ -13,16 +12,13 @@
   )
 }:
 
-let
-  mod = kernel != null;
-  dpdkVersion = "23.07";
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "dpdk";
-  version = "${dpdkVersion}" + lib.optionalString mod "-${kernel.version}";
+  version = "23.11";
 
   src = fetchurl {
-    url = "https://fast.dpdk.org/rel/dpdk-${dpdkVersion}.tar.xz";
-    sha256 = "sha256-4IYU6K65KUB9c9cWmZKJpE70A0NSJx8JOX7vkysjs9Y=";
+    url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
+    sha256 = "sha256-ZPpY/fyelRDo5BTjvt0WW9PUykZaIxsoAyP4PNU/2GU=";
   };
 
   nativeBuildInputs = [
@@ -38,13 +34,13 @@ in stdenv.mkDerivation {
   buildInputs = [
     jansson
     libbpf
-    libelf
+    elfutils
     libpcap
     numactl
     openssl.dev
     zlib
     python3
-  ] ++ lib.optionals mod kernel.moduleBuildDependencies;
+  ];
 
   propagatedBuildInputs = [
     # Propagated to support current DPDK users in nixpkgs which statically link
@@ -56,21 +52,15 @@ in stdenv.mkDerivation {
 
   postPatch = ''
     patchShebangs config/arm buildtools
-  '' + lib.optionalString mod ''
-    # kernel_install_dir is hardcoded to `/lib/modules`; patch that.
-    sed -i "s,kernel_install_dir *= *['\"].*,kernel_install_dir = '$kmod/lib/modules/${kernel.modDirVersion}'," kernel/linux/meson.build
   '';
 
   mesonFlags = [
     "-Dtests=false"
     "-Denable_docs=true"
-    "-Denable_kmods=${lib.boolToString mod}"
+    "-Ddeveloper_mode=disabled"
   ]
-  # kni kernel driver is currently not compatble with 5.11
-  ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni"
   ++ [(if shared then "-Ddefault_library=shared" else "-Ddefault_library=static")]
   ++ lib.optional (machine != null) "-Dmachine=${machine}"
-  ++ lib.optional mod "-Dkernel_dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ++ lib.optional (withExamples != []) "-Dexamples=${builtins.concatStringsSep "," withExamples}";
 
   postInstall = ''
@@ -87,7 +77,6 @@ in stdenv.mkDerivation {
 
   outputs =
     [ "out" "doc" ]
-    ++ lib.optional mod "kmod"
     ++ lib.optional (withExamples != []) "examples";
 
   meta = with lib; {
@@ -96,6 +85,5 @@ in stdenv.mkDerivation {
     license = with licenses; [ lgpl21 gpl2 bsd2 ];
     platforms =  platforms.linux;
     maintainers = with maintainers; [ magenbluten orivej mic92 zhaofengli ];
-    broken = mod && kernel.isHardened;
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
new file mode 100644
index 0000000000000..efc771905e53a
--- /dev/null
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -0,0 +1,57 @@
+{ stdenv, lib, fetchurl, kernel, flex, coccinelle, python3 }:
+
+stdenv.mkDerivation rec {
+  name = "drbd-${version}-${kernel.version}";
+  version = "9.2.7";
+
+  src = fetchurl {
+    url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${version}.tar.gz";
+    sha256 = "1355ns10z0fjgqsdpf09qfy01j8lg2n7zy4kclmar3s798n3mh56";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = [
+    kernel.moduleBuildDependencies
+    flex
+    coccinelle
+    python3
+  ];
+
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "SPAAS=false"
+  ];
+
+  # 6.4 and newer provide a in-tree version of the handshake module https://www.kernel.org/doc/html/v6.4/networking/tls-handshake.html
+  installPhase = ''
+    runHook preInstall
+    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    ${lib.optionalString (lib.versionOlder kernel.version "6.4") ''
+      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    ''}
+    runHook postInstall
+  '';
+
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/LINBIT/drbd";
+    description = "LINBIT DRBD kernel module";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ birkb ];
+    longDescription = ''
+       DRBD is a software-based, shared-nothing, replicated storage solution
+       mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
+    '';
+  };
+}
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/utils.nix
index 0c5acd0ac0645..ad50c2c3e50a5 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/utils.nix
@@ -10,7 +10,9 @@
 , libxslt
 , nixosTests
 , perl
+, perlPackages
 , systemd
+, keyutils
 
 # drbd-utils are compiled twice, once with forOCF = true to extract
 # its OCF definitions for use in the ocf-resource-agents derivation,
@@ -22,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drbd";
-  version = "9.19.1";
+  version = "9.27.0";
 
   src = fetchurl {
     url = "https://pkg.linbit.com/downloads/drbd/utils/${pname}-utils-${version}.tar.gz";
-    sha256 = "1l99kcrb0j85wxxmrdihpx9bk1a4sdi7wlp5m1x5l24k8ck1m5cf";
+    sha256 = "1qwdrjrgas8z8vc6c85xcrqaczjwyqd61yig01n44wa5z0j3v4aq";
   };
 
   nativeBuildInputs = [
@@ -34,11 +36,12 @@ stdenv.mkDerivation rec {
     libxslt
     docbook_xsl
     asciidoctor
+    keyutils
   ];
 
   buildInputs = [
     perl
-    # perlPackages.Po4a used by ja documentation
+    perlPackages.Po4a
   ];
 
   configureFlags = [
@@ -123,6 +126,10 @@ stdenv.mkDerivation rec {
     description = "Distributed Replicated Block Device, a distributed storage system for Linux (userspace utilities)";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ryantm astro ];
+    maintainers = with maintainers; [ ryantm astro birkb ];
+    longDescription = ''
+       DRBD is a software-based, shared-nothing, replicated storage solution
+       mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
+    '';
   };
 }
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index d79f9f4c61bfd..75b613075e781 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -34,6 +34,7 @@ python3Packages.buildPythonApplication rec {
   meta = with lib; {
     homepage = "http://dag.wieers.com/home-made/dstat/";
     description = "Versatile resource statistics tool";
+    mainProgram = "dstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
index ad7468bac0f55..d1d95b4d3f959 100644
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ b/pkgs/os-specific/linux/earlyoom/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Early OOM Daemon for Linux";
+    mainProgram = "earlyoom";
     homepage = "https://github.com/rfjakob/earlyoom";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 59f2a6965daf5..9175f477bd607 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.62";
+  version = "0.63";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-HgYwyE0jejEzg9LorjDz7F0GbiXUfYpKNJ+tFIBbYWA=";
+    hash = "sha256-husK3eurfL1NhRHgJUdFP6sYLqeZ4NSHa/tU8PUWmGo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/esdm/default.nix b/pkgs/os-specific/linux/esdm/default.nix
index f4db69e244b4c..195c645eb539b 100644
--- a/pkgs/os-specific/linux/esdm/default.nix
+++ b/pkgs/os-specific/linux/esdm/default.nix
@@ -60,13 +60,13 @@ assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend =
 
 stdenv.mkDerivation rec {
   pname = "esdm";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${version}";
-    sha256 = "sha256-J7iVp6lLjR2JPdpppnqgV5Ke+X9TcZaS5V1ffejI5yE=";
+    sha256 = "sha256-UH6ws/hfHdcmbLETyZ0b4wDm8nHPdLsot3ZhIljpUlw=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
index d103604294a4f..5936447ac9351 100644
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Ethernet NIC Queue stats viewer";
+    mainProgram = "ethq";
     homepage = "https://github.com/isc-projects/ethq";
     license = licenses.mpl20;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index 0de1ded835435..3c551939c7cf2 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Simple monitoring of system events";
+    mainProgram = "eventstat";
     homepage = "https://github.com/ColinIanKing/eventstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
index 30d232f6eb88e..ceba075758a6a 100644
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "facetimehd-${version}-${kernel.version}";
-  version = "0.6.8";
+  version = "0.6.8.1";
 
   # Note: When updating this revision:
   # 1. Also update pkgs/os-specific/linux/firmware/facetimehd-firmware/
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "patjak";
     repo = "facetimehd";
     rev = version;
-    sha256 = "sha256-Tze85Hx1YmStAKenmF/S1JuMDq5eVjBcs3LSWXjyE7w=";
+    sha256 = "sha256-h5Erga2hlDIWdDKQbkmkLY1aNCibFM7SVSnxVcoToaM=";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/fan2go/default.nix b/pkgs/os-specific/linux/fan2go/default.nix
index c7176183018ae..cb8ff5a84b74c 100644
--- a/pkgs/os-specific/linux/fan2go/default.nix
+++ b/pkgs/os-specific/linux/fan2go/default.nix
@@ -23,6 +23,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "A simple daemon providing dynamic fan speed control based on temperature sensors";
+    mainProgram = "fan2go";
     homepage = "https://github.com/markusressel/fan2go";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ mtoohey ];
diff --git a/pkgs/os-specific/linux/fanctl/default.nix b/pkgs/os-specific/linux/fanctl/default.nix
index d8769b0f04de1..f55779bd91657 100644
--- a/pkgs/os-specific/linux/fanctl/default.nix
+++ b/pkgs/os-specific/linux/fanctl/default.nix
@@ -15,6 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "Replacement for fancontrol with more fine-grained control interface in its config file";
+    mainProgram = "fanctl";
     homepage = "https://gitlab.com/mcoffin/fanctl";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ icewind1991 ];
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index f762eca36bebe..8704c72a21ba2 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -96,6 +96,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Framebuffer terminal emulator";
+    mainProgram = "fbterm";
     homepage = "https://salsa.debian.org/debian/fbterm";
     maintainers = with maintainers; [ lovesegfault raskin ];
     license = licenses.gpl2;
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
index fe7a3e9ae406f..65e2596675167 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
@@ -18,8 +18,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Firmware extractor for cards supported by the b43 kernel module";
+    mainProgram = "b43-fwcutter";
     homepage = "http://wireless.kernel.org/en/users/Drivers/b43";
-    license = lib.licenses.free;
+    license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix b/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
index a28189a9e4749..988aabd85779a 100644
--- a/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
+++ b/pkgs/os-specific/linux/firmware/bt-fw-converter/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation  rec {
   meta = with lib; {
     homepage = "https://github.com/winterheart/broadcom-bt-firmware/";
     description = "A tool that converts hex to hcd based on inf file";
+    mainProgram = "bt-fw-converter";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ zraexy ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 2b280c72b1ca3..98b9ff5d33881 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -36,6 +36,7 @@ flutter.buildFlutterApplication rec {
 
   meta = with lib; {
     description = "Firmware Updater for Linux";
+    mainProgram = "firmware-updater";
     homepage = "https://github.com/canonical/firmware-updater";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ mkg20001 ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
index fbc1398cfb718..acbc0d556224c 100644
--- a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwupd-efi";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-J928Ck4yCVQ+q0nmnxoBTrntlfk/9R+WbzEILTt7/7w=";
+    sha256 = "sha256-RdKneTGzYkFt7CY22r9O/w0doQvBzMoayYDoMv7buhI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index 283e04b475458..ae04c6a9ce32a 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -40,8 +40,5 @@ stdenvNoCC.mkDerivation rec {
     priority = 6; # give precedence to kernel firmware
   };
 
-  passthru = {
-    inherit version;
-    updateScript = ./update.sh;
-  };
+  passthru.updateScript = ./update.sh;
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index 5088c1dc33205..3739c1dc3e463 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,7 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20240312";
-  revision = "20240312";
-  sourceHash = "sha256-fDrnI7H87vG4OpcmjMcRTio01oHI0Z2KUfe3NNeY3JY=";
-  outputHash = "sha256-GYmRaW6wsOR+pqeQDyGYUDh6HfEs+sEi5vQoBHEeX9I=";
+  version = "20240410";
+  revision = "20240410";
+  sourceHash = "sha256-Qo4f5kdHlBYKlzdFOtoKoCPHXxgDeCawSE3tnRwfC4U=";
+  outputHash = "sha256-pOYDdb0A1sESiT0kfA4DbWxKJ3+pog54+S3KcQB3BsA=";
 }
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index d84fb2a873d08..e4aa0b353acae 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2023.12.1";
+  version = "2024.03";
 
   src = fetchurl {
     url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-${version}.tar.gz";
-    sha256 = "sha256-6ied38mcWxHWNPH10jN/bVwNw4HOMxR5D3tVDkCI5nQ=";
+    sha256 = "sha256-T9ky97vBUXsG+nkR5tVmgU1dxP7FYIvbROfE/kkp+/Y=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation rec {
     cp -av sof-tplg $out/lib/firmware/intel/sof-tplg
     cp -av sof-ace-tplg $out/lib/firmware/intel/sof-ace-tplg
     cp -av sof-ipc4 $out/lib/firmware/intel/sof-ipc4
+    cp -av sof-ipc4-tplg $out/lib/firmware/intel/sof-ipc4-tplg
     runHook postInstall
   '';
 
diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix
index c943ce26f91eb..18afaaa6d29b5 100644
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "File activity monitoring tool";
+    mainProgram = "fnotifystat";
     homepage = "https://github.com/ColinIanKing/fnotifystat";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index c87c69c077084..75ca64833a599 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Process fork/exec/exit monitoring tool";
+    mainProgram = "forkstat";
     homepage = "https://github.com/ColinIanKing/forkstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/framework-laptop-kmod/default.nix b/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
index 088e30e91f8ca..b5cb505e09a2c 100644
--- a/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
+++ b/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "framework-laptop-kmod";
-  version = "unstable-2023-12-03";
+  version = "0-unstable-2024-01-02";
 
   src = fetchFromGitHub {
     owner = "DHowett";
     repo = "framework-laptop-kmod";
-    rev = "d5367eb9e5b5542407494d04ac1a0e77f10cc89d";
-    hash = "sha256-t8F4XHPkuCjWBrsEjW97ielYtf3V6hlLsrasvyab198=";
+    rev = "a9e8db9ba2959b75c1fb820ffac8fa189f0f63c3";
+    hash = "sha256-Ai/OxvkaKPltri8R0oyfmxQLUVfaj6Q8vebrhmWYhUU=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
index 683b599e5beb8..bad4849ca0bfd 100644
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
     inherit (kernel.meta) homepage license;
 
     description = "Free-fall protection for spinning HP/Dell laptop hard drives";
+    mainProgram = "freefall";
     longDescription = ''
       Provides a shock protection facility in modern laptops with spinning hard
       drives, by stopping all input/output operations on the internal hard drive
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index fd925ab654fa8..8b54a1f9a7456 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -41,6 +41,7 @@ buildGoModule rec {
   meta = with lib; {
     description =
       "A high-level tool for the management of Linux filesystem encryption";
+    mainProgram = "fscrypt";
     longDescription = ''
       This tool manages metadata, key generation, key wrapping, PAM integration,
       and provides a uniform interface for creating and modifying encrypted
diff --git a/pkgs/os-specific/linux/fscryptctl/default.nix b/pkgs/os-specific/linux/fscryptctl/default.nix
index 2a2a9b41c9c2a..4b38913b7122b 100644
--- a/pkgs/os-specific/linux/fscryptctl/default.nix
+++ b/pkgs/os-specific/linux/fscryptctl/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Small C tool for Linux filesystem encryption";
+    mainProgram = "fscryptctl";
     longDescription = ''
       fscryptctl is a low-level tool written in C that handles raw keys and
       manages policies for Linux filesystem encryption, specifically the
diff --git a/pkgs/os-specific/linux/fsverity-utils/default.nix b/pkgs/os-specific/linux/fsverity-utils/default.nix
index b0b6286c8cfa4..7d0f1f48e7e54 100644
--- a/pkgs/os-specific/linux/fsverity-utils/default.nix
+++ b/pkgs/os-specific/linux/fsverity-utils/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fsverity-utils";
-  version = "1.5";
+  version = "1.6";
 
   outputs = [ "out" "lib" "dev" ] ++ lib.optional enableManpages "man";
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/snapshot/fsverity-utils-v${version}.tar.gz";
-    sha256 = "sha256-ygBOkp2PBe8Z2ak6SXEJ6HHuT4NRKmIsbJDHcY+h8PQ=";
+    sha256 = "sha256-FZN4MKNmymIXZ2Q0woA0SLzPf4SaUJkj4ssKPsY4xXc=";
   };
 
   patches = lib.optionals (!enableShared) [
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#userspace-utility";
     changelog = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/tree/NEWS.md";
     description = "A set of userspace utilities for fs-verity";
+    mainProgram = "fsverity";
     license = licenses.mit;
     maintainers = with maintainers; [ jk ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/fswebcam/default.nix b/pkgs/os-specific/linux/fswebcam/default.nix
index 678e0d428419b..1f45d7955da49 100644
--- a/pkgs/os-specific/linux/fswebcam/default.nix
+++ b/pkgs/os-specific/linux/fswebcam/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Neat and simple webcam app";
+    mainProgram = "fswebcam";
     homepage = "http://www.sanslogic.co.uk/fswebcam";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2;
diff --git a/pkgs/os-specific/linux/ftop/default.nix b/pkgs/os-specific/linux/ftop/default.nix
index abd6d78846198..b199c84b9fb52 100644
--- a/pkgs/os-specific/linux/ftop/default.nix
+++ b/pkgs/os-specific/linux/ftop/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Show progress of open files and file systems";
+    mainProgram = "ftop";
     homepage = "https://code.google.com/archive/p/ftop/";
     license = licenses.gpl3Plus;
     longDescription = ''
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index a73cc1896ecdc..1d23411f3eefc 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,38 +1,43 @@
 { stdenv
 , lib
-, fetchFromGitHub
+, fetchFromGitLab
+, cmake
 , pkg-config
-, hostname
+, libusb1
+, libftdi1
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "unstable-2022-12-03";
+  version = "0-unstable-2023-12-15";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
+    domain = "gitlab.howett.net";
     owner = "DHowett";
-    repo = "fw-ectool";
-    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
-    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
+    repo = "ectool";
+    rev = "3ebe7b8b713b2ebfe2ce92d48fd8d044276b2879";
+    hash = "sha256-s6PrFPAL+XJAENqLw5oJqFmAf11tHOJ8h3F5l3pOlZ4=";
   };
 
   nativeBuildInputs = [
+    cmake
     pkg-config
-    hostname
   ];
 
-  buildPhase = ''
-    patchShebangs util
-    make out=out utils
-  '';
+  buildInputs = [
+    libusb1
+    libftdi1
+  ];
 
   installPhase = ''
-    install -D out/util/ectool $out/bin/ectool
+    runHook preInstall
+    install -Dm555 src/ectool "$out/bin/ectool"
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://github.com/DHowett/framework-ec";
+    homepage = "https://gitlab.howett.net/DHowett/ectool";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/fxload/default.nix b/pkgs/os-specific/linux/fxload/default.nix
index e8b9d0648bd8f..a4b204b571d45 100644
--- a/pkgs/os-specific/linux/fxload/default.nix
+++ b/pkgs/os-specific/linux/fxload/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/libusb/libusb";
     description = "Tool to upload firmware to into an21, fx, fx2, fx2lp and fx3 ez-usb devices";
+    mainProgram = "fxload";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ realsnick ];
diff --git a/pkgs/os-specific/linux/g15daemon/default.nix b/pkgs/os-specific/linux/g15daemon/default.nix
index 823f523db242b..90a818be49472 100644
--- a/pkgs/os-specific/linux/g15daemon/default.nix
+++ b/pkgs/os-specific/linux/g15daemon/default.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A daemon that makes it possible to use the Logitech keyboard G-Buttons and draw on various Logitech LCDs";
+    mainProgram = "g15daemon";
     inherit license maintainers;
   };
 }
diff --git a/pkgs/os-specific/linux/gfxtablet/default.nix b/pkgs/os-specific/linux/gfxtablet/default.nix
index 608ca8e58cc5b..3ee35844f9995 100644
--- a/pkgs/os-specific/linux/gfxtablet/default.nix
+++ b/pkgs/os-specific/linux/gfxtablet/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Uinput driver for Android GfxTablet tablet-as-input-device app";
+    mainProgram = "networktablet";
     license = lib.licenses.mit ;
     maintainers = [lib.maintainers.raskin];
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index fcf75ac7821a9..02ca3d30d238c 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/google/google-authenticator-libpam";
     description = "Two-step verification, with pam module";
+    mainProgram = "google-authenticator";
     license = licenses.asl20;
     maintainers = with maintainers; [ aneeshusa ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/gpu-switch/default.nix b/pkgs/os-specific/linux/gpu-switch/default.nix
index 17452a5e2446d..d6f749aa8f1e3 100644
--- a/pkgs/os-specific/linux/gpu-switch/default.nix
+++ b/pkgs/os-specific/linux/gpu-switch/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation {
   '';
   meta = with lib; {
     description = "Application that allows to switch between the graphic cards of dual-GPU MacBook Pro models";
+    mainProgram = "gpu-switch";
     homepage = "https://github.com/0xbb/gpu-switch";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/gt/default.nix b/pkgs/os-specific/linux/gt/default.nix
index 85897b72585ea..9d35556358b5c 100644
--- a/pkgs/os-specific/linux/gt/default.nix
+++ b/pkgs/os-specific/linux/gt/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Linux command line tool for setting up USB gadgets using configfs";
+    mainProgram = "gt";
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ lheckemann ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index 6e073662c4e69..e082038730111 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A simple interface for devices supported by the linux UVC driver";
+    mainProgram = "guvcview";
     homepage = "https://guvcview.sourceforge.net";
     maintainers = [ maintainers.coconnor ];
     license = licenses.gpl3;
diff --git a/pkgs/os-specific/linux/hd-idle/default.nix b/pkgs/os-specific/linux/hd-idle/default.nix
index 13cb397b17980..7c2ac2894a55b 100644
--- a/pkgs/os-specific/linux/hd-idle/default.nix
+++ b/pkgs/os-specific/linux/hd-idle/default.nix
@@ -21,6 +21,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Spins down external disks after a period of idle time";
+    mainProgram = "hd-idle";
     homepage = "https://github.com/adelolmo/hd-idle";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/hdapsd/default.nix b/pkgs/os-specific/linux/hdapsd/default.nix
index 959fa9ac6e8a4..e9dca6fd8927e 100644
--- a/pkgs/os-specific/linux/hdapsd/default.nix
+++ b/pkgs/os-specific/linux/hdapsd/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib;
     { description = "Hard Drive Active Protection System Daemon";
+      mainProgram = "hdapsd";
       homepage = "http://hdaps.sf.net/";
       license = licenses.gpl2;
       platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
index b8737eb153025..e63b7ca7fe258 100644
--- a/pkgs/os-specific/linux/health-check/default.nix
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Process monitoring tool";
+    mainProgram = "health-check";
     homepage = "https://github.com/ColinIanKing/health-check";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/hibernate/default.nix b/pkgs/os-specific/linux/hibernate/default.nix
index 1a7dd01e97714..71a93e4a154e6 100644
--- a/pkgs/os-specific/linux/hibernate/default.nix
+++ b/pkgs/os-specific/linux/hibernate/default.nix
@@ -33,6 +33,7 @@ in
 
     meta = {
       description = "The `hibernate' script for swsusp and Tux-on-Ice";
+      mainProgram = "hibernate";
       longDescription = ''
         This package provides the `hibernate' script, a command-line utility
         that saves the computer's state to disk and switches it off, turning
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 7aeea8a8b59a5..f7303b182ec74 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.379";
+  version = "0.380";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-6IMvnXP9uy8kAKRyzV/raZzUnpVCzp7SHnGt8qDUDXY=";
+    hash = "sha256-Ioa0tUiwgOZO3qrtwAr9A/yGfYTBk83OON8Sr47J9Mg=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/hyperv-daemons/default.nix b/pkgs/os-specific/linux/hyperv-daemons/default.nix
index 12033063c165d..619318d7e04c9 100644
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -97,6 +97,7 @@ in stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Integration Services for running NixOS under HyperV";
+    mainProgram = "lsvmbus";
     longDescription = ''
       This packages contains the daemons that are used by the Hyper-V hypervisor
       on the host.
diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix
index 9af2aba3d8066..9bd5ca302da36 100644
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A better i7 (and now i3, i5) reporting tool for Linux";
+    mainProgram = "i7z";
     homepage = "https://github.com/DimitryAndric/i7z";
     license = licenses.gpl2;
     maintainers = with maintainers; [ bluescreen303 ];
diff --git a/pkgs/os-specific/linux/ifenslave/default.nix b/pkgs/os-specific/linux/ifenslave/default.nix
index d23fc101bcc0a..cc132c69faf71 100644
--- a/pkgs/os-specific/linux/ifenslave/default.nix
+++ b/pkgs/os-specific/linux/ifenslave/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Utility for enslaving networking interfaces under a bond";
+    mainProgram = "ifenslave";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index 3da9396d618ec..38c30dc436874 100644
--- a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Proxy for sending IIO sensor data to D-Bus";
+    mainProgram = "monitor-sensor";
     homepage = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy";
     license = licenses.gpl3;
     maintainers = with maintainers; [ _999eagle ];
diff --git a/pkgs/os-specific/linux/ima-evm-utils/default.nix b/pkgs/os-specific/linux/ima-evm-utils/default.nix
index 34889783034c0..fa90ceecdb2b1 100644
--- a/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "evmctl utility to manage digital signatures of the Linux kernel integrity subsystem (IMA/EVM)";
+    mainProgram = "evmctl";
     homepage = "https://sourceforge.net/projects/linux-ima/";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 073714bd57a0f..f4a250d4a84c8 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.05.28454.6";
+  version = "24.09.28717.12";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-gX6zvZcwZXcSj3ch/eIWqIefccKuab0voh2vHHJTTso=";
+    hash = "sha256-RzXV6icenMcQxmOfKA8Tpb6FigLXz3ZyoL0n16+jFRc=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Intel Graphics Compute Runtime for OpenCL. Replaces Beignet for Gen8 (Broadwell) and beyond";
+    mainProgram = "ocloc";
     homepage = "https://github.com/intel/compute-runtime";
     changelog = "https://github.com/intel/compute-runtime/releases/tag/${version}";
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/intel-speed-select/default.nix b/pkgs/os-specific/linux/intel-speed-select/default.nix
index 2caad335d57ce..9d9c9b134c64e 100644
--- a/pkgs/os-specific/linux/intel-speed-select/default.nix
+++ b/pkgs/os-specific/linux/intel-speed-select/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Tool to enumerate and control the Intel Speed Select Technology features";
+    mainProgram = "intel-speed-select";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
index 38d9afddaca6d..d02018f570c4a 100644
--- a/pkgs/os-specific/linux/ipp-usb/default.nix
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -1,13 +1,13 @@
 { buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
 buildGoModule rec {
   pname = "ipp-usb";
-  version = "0.9.24";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "openprinting";
     repo = "ipp-usb";
     rev = version;
-    sha256 = "sha256-06Kb4s9oN53llz/Yya45ig5rd86VvlcK+vRh3bL/MAw=";
+    sha256 = "sha256-ryKQDzb31JA192lbCYkwJrXgwErViqIzP4mD2NmWdgA=";
   };
 
   postPatch = ''
@@ -34,6 +34,7 @@ buildGoModule rec {
 
   meta = {
     description = "Daemon to use the IPP everywhere protocol with USB printers";
+    mainProgram = "ipp-usb";
     homepage = "https://github.com/OpenPrinting/ipp-usb";
     maintainers = [ lib.maintainers.symphorien ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 03eb1959c9b27..e2e4384908a8c 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.7.0";
+  version = "6.8.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-/5Qt2YKNfR+Gf2H+cs5DMHjDHl2OSnjiDwLLWJLohB0=";
+    hash = "sha256-A6bMo9cakI0fFfe0lb4rj+hR+UFFjcRmSQDX9F/PaM4=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iptstate/default.nix b/pkgs/os-specific/linux/iptstate/default.nix
index 4e3693aba6f18..d1e193f831ca9 100644
--- a/pkgs/os-specific/linux/iptstate/default.nix
+++ b/pkgs/os-specific/linux/iptstate/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Conntrack top like tool";
+    mainProgram = "iptstate";
     homepage = "https://github.com/jaymzh/iptstate";
     platforms = platforms.linux;
     maintainers = with maintainers; [ trevorj ];
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index d73a74ee7eff5..5e4b7fff489ca 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "irqbalance";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
     rev = "v${version}";
-    sha256 = "sha256-0e7dV6gncSlAUfkyX7F0FSYJjlvdi/ol7YC2T5afl+Q=";
+    sha256 = "sha256-7es7wwsPnDSF37uL5SCgAQB+u+qGWmWDHOh3JkHuXMs=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/os-specific/linux/iw/default.nix b/pkgs/os-specific/linux/iw/default.nix
index bf7cb025bc1c5..4c1d94f02e6bc 100644
--- a/pkgs/os-specific/linux/iw/default.nix
+++ b/pkgs/os-specific/linux/iw/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Tool to use nl80211";
+    mainProgram = "iw";
     longDescription = ''
       iw is a new nl80211 based CLI configuration utility for wireless devices.
       It supports all new drivers that have been added to the kernel recently.
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index ccaf54759d85d..a15d21f2c3a1b 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.14";
+  version = "2.16";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-35hKb8IVL8jQG80y48a5CcozUEWxLCdTqAHhZlPFCYE=";
+    hash = "sha256-YWtiI2HkGyIdUeBXerQtN5UvgaMaUs9eoG88ZUQRrDg=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/joycond/default.nix b/pkgs/os-specific/linux/joycond/default.nix
index e60e661f0c44a..5edc227732f80 100644
--- a/pkgs/os-specific/linux/joycond/default.nix
+++ b/pkgs/os-specific/linux/joycond/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/DanielOgorchock/joycond";
     description = "Userspace daemon to combine joy-cons from the hid-nintendo kernel driver";
+    mainProgram = "joycond";
     license = licenses.gpl3Only;
     maintainers = [ maintainers.ivar ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/kbdlight/default.nix b/pkgs/os-specific/linux/kbdlight/default.nix
index 0ed575b82546a..b41e4cd4da1c9 100644
--- a/pkgs/os-specific/linux/kbdlight/default.nix
+++ b/pkgs/os-specific/linux/kbdlight/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/hobarrera/kbdlight";
     description = "A very simple application that changes MacBooks' keyboard backlight level";
+    mainProgram = "kbdlight";
     license = licenses.isc;
     maintainers = [ maintainers.womfoo ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index cc9e7484c331d..0f1b314df6bd5 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -23,7 +23,7 @@ let
 
 
   # configuration items have to be part of a subattrs
-  flattenKConf =  nested: mapAttrs (_: head) (zipAttrs (attrValues nested));
+  flattenKConf = nested: mapAttrs (name: values: if length values == 1 then head values else throw "duplicate kernel configuration option: ${name}") (zipAttrs (attrValues nested));
 
   whenPlatformHasEBPFJit =
     mkIf (stdenv.hostPlatform.isAarch32 ||
@@ -55,17 +55,33 @@ let
       DYNAMIC_DEBUG             = yes;
       DEBUG_STACK_USAGE         = no;
       RCU_TORTURE_TEST          = no;
-      SCHEDSTATS                = no;
+      SCHEDSTATS                = yes;
       DETECT_HUNG_TASK          = yes;
       CRASH_DUMP                = option no;
       # Easier debugging of NFS issues.
       SUNRPC_DEBUG              = yes;
       # Provide access to tunables like sched_migration_cost_ns
       SCHED_DEBUG               = yes;
+
+      # Count IRQ and steal CPU time separately
+      IRQ_TIME_ACCOUNTING       = yes;
+      PARAVIRT_TIME_ACCOUNTING  = yes;
+
+      # Enable CPU lockup detection
+      LOCKUP_DETECTOR           = yes;
+      SOFTLOCKUP_DETECTOR       = yes;
+      HARDLOCKUP_DETECTOR       = yes;
+
+      # Enable streaming logs to a remote device over a network
+      NETCONSOLE                = module;
+      NETCONSOLE_DYNAMIC        = yes;
+
+      # Export known printks in debugfs
+      PRINTK_INDEX              = whenAtLeast "5.15" yes;
     };
 
     power-management = {
-      CPU_FREQ_DEFAULT_GOV_PERFORMANCE = yes;
+      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL   = yes;
       CPU_FREQ_GOV_SCHEDUTIL           = yes;
       PM_ADVANCED_DEBUG                = yes;
       PM_WAKELOCKS                     = yes;
@@ -85,6 +101,34 @@ let
       # depends on HAVE_VIRT_CPU_ACCOUNTING_GEN depends on 64BIT,
       # so we can't force-enable this
       RCU_LAZY                         = whenAtLeast "6.2" (option yes);
+
+      # Auto suspend Bluetooth devices at idle
+      BT_HCIBTUSB_AUTOSUSPEND          = yes;
+
+      # Expose cpufreq stats in sysfs
+      CPU_FREQ_STAT                    = yes;
+
+      # Enable CPU energy model for scheduling
+      ENERGY_MODEL                     = whenAtLeast "5.0" yes;
+
+      # Enable thermal interface netlink API
+      THERMAL_NETLINK                  = whenAtLeast "5.9" yes;
+
+      # Prefer power-efficient workqueue implementation to per-CPU workqueues,
+      # which is slightly slower, but improves battery life.
+      # This is opt-in per workqueue, and can be disabled globally with a kernel command line option.
+      WQ_POWER_EFFICIENT_DEFAULT       = yes;
+
+      # Default SATA link power management to "medium with device initiated PM"
+      # for some extra power savings.
+      SATA_MOBILE_LPM_POLICY           = whenAtLeast "5.18" (freeform "3");
+
+      # GPIO power management
+      POWER_RESET_GPIO                 = option yes;
+      POWER_RESET_GPIO_RESTART         = option yes;
+
+      # Enable Pulse-Width-Modulation support, commonly used for fan and backlight.
+      PWM                              = yes;
     } // optionalAttrs (stdenv.hostPlatform.isx86) {
       INTEL_IDLE                       = yes;
       INTEL_RAPL                       = whenAtLeast "5.3" module;
@@ -109,6 +153,9 @@ let
       CHT_DC_TI_PMIC_OPREGION          = whenAtLeast "5.10" yes;
       MFD_TPS68470                     = whenBetween "5.10" "5.13" yes;
       TPS68470_PMIC_OPREGION           = whenAtLeast "5.10" yes;
+
+      # Enable Intel thermal hardware feedback
+      INTEL_HFI_THERMAL                = whenAtLeast "5.18" yes;
     };
 
     external-firmware = {
@@ -133,9 +180,19 @@ let
       DAMON_VADDR = whenAtLeast "5.15" yes;
       DAMON_PADDR = whenAtLeast "5.16" yes;
       DAMON_SYSFS = whenAtLeast "5.18" yes;
-      DAMON_DBGFS = whenAtLeast "5.15" yes;
+      DAMON_DBGFS = whenBetween "5.15" "6.9" yes;
       DAMON_RECLAIM = whenAtLeast "5.16" yes;
       DAMON_LRU_SORT = whenAtLeast "6.0" yes;
+      # Support recovering from memory failures on systems with ECC and MCA recovery.
+      MEMORY_FAILURE = yes;
+
+      # Collect ECC errors and retire pages that fail too often
+      RAS_CEC                   = yes;
+    } // optionalAttrs (stdenv.is32bit) {
+      # Enable access to the full memory range (aka PAE) on 32-bit architectures
+      # This check isn't super accurate but it's close enough
+      HIGHMEM                   = option yes;
+      BOUNCE                    = option yes;
     };
 
     memtest = {
@@ -154,6 +211,9 @@ let
       BFQ_GROUP_IOSCHED = yes;
       MQ_IOSCHED_KYBER = yes;
       IOSCHED_BFQ = module;
+      # Enable CPU utilization clamping for RT tasks
+      UCLAMP_TASK = whenAtLeast "5.3" yes;
+      UCLAMP_TASK_GROUP = whenAtLeast "5.4" yes;
     };
 
 
@@ -166,6 +226,7 @@ let
     # Enable NUMA.
     numa = {
       NUMA  = option yes;
+      NUMA_BALANCING = option yes;
     };
 
     networking = {
@@ -250,6 +311,9 @@ let
       # Bridge Netfilter Configuration
       NF_TABLES_BRIDGE            = mkMerge [ (whenOlder "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
+      # Expose some debug info
+      NF_CONNTRACK_PROCFS         = yes;
+      NF_FLOW_TABLE_PROCFS        = whenAtLeast "6.0" yes;
 
       # needed for `dropwatch`
       # Builtin-only since https://github.com/torvalds/linux/commit/f4b6bcc7002f0e3a3428bac33cf1945abff95450
@@ -276,6 +340,10 @@ let
       INFINIBAND = module;
       INFINIBAND_IPOIB = module;
       INFINIBAND_IPOIB_CM = yes;
+
+      # Enable debugfs for wireless drivers
+      CFG80211_DEBUGFS = yes;
+      MAC80211_DEBUGFS = yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
       # Not enabled by default, hides modules behind it
       NET_VENDOR_MEDIATEK = yes;
@@ -288,8 +356,8 @@ let
       CFG80211_WEXT               = option yes; # Without it, ipw2200 drivers don't build
       IPW2100_MONITOR             = option yes; # support promiscuous mode
       IPW2200_MONITOR             = option yes; # support promiscuous mode
-      HOSTAP_FIRMWARE             = option yes; # Support downloading firmware images with Host AP driver
-      HOSTAP_FIRMWARE_NVRAM       = option yes;
+      HOSTAP_FIRMWARE             = whenOlder "6.8" (option yes); # Support downloading firmware images with Host AP driver
+      HOSTAP_FIRMWARE_NVRAM       = whenOlder "6.8" (option yes);
       MAC80211_MESH               = option yes; # Enable 802.11s (mesh networking) support
       ATH9K_PCI                   = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
       ATH9K_AHB                   = option yes; # Ditto, AHB bus
@@ -331,8 +399,8 @@ let
       FRAMEBUFFER_CONSOLE_ROTATION = yes;
       FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = yes;
       FB_GEODE            = mkIf (stdenv.hostPlatform.system == "i686-linux") yes;
-      # On 5.14 this conflicts with FB_SIMPLE.
-      DRM_SIMPLEDRM = whenAtLeast "5.14" no;
+      # Use simplefb on older kernels where we don't have simpledrm (enabled below)
+      FB_SIMPLE           = whenOlder "5.15" yes;
       DRM_FBDEV_EMULATION = yes;
     };
 
@@ -345,10 +413,22 @@ let
       FONT_TER16x32 = whenAtLeast "5.0" yes;
     };
 
-    video = {
+    video = let
+      whenHasDevicePrivate = mkIf (!stdenv.isx86_32 && versionAtLeast version "5.1");
+    in {
+      # compile in DRM so simpledrm can load before initrd if necessary
+      AGP = yes;
+      DRM = yes;
+
       DRM_LEGACY = whenOlder "6.8" no;
+
       NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
 
+      # Enable simpledrm and use it for generic framebuffer
+      # Technically added in 5.14, but adding more complex configuration is not worth it
+      DRM_SIMPLEDRM = whenAtLeast "5.15" yes;
+      SYSFB_SIMPLEFB = whenAtLeast "5.15" yes;
+
       # Allow specifying custom EDID on the kernel command line
       DRM_LOAD_EDID_FIRMWARE = yes;
       VGA_SWITCHEROO         = yes; # Hybrid graphics support
@@ -371,8 +451,26 @@ let
       DRM_AMD_DC_FP = whenAtLeast "6.4" yes;
       DRM_AMD_DC_HDCP = whenBetween "5.5" "6.4" yes;
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
+
+      # Enable AMD Audio Coprocessor support for HDMI outputs
+      DRM_AMD_ACP = yes;
+
+      # Enable AMD secure display when available
+      DRM_AMD_SECURE_DISPLAY = whenAtLeast "5.13" yes;
+
       # Enable new firmware (and by extension NVK) for compatible hardware on Nouveau
       DRM_NOUVEAU_GSP_DEFAULT = whenAtLeast "6.8" yes;
+
+      # Enable Nouveau shared virtual memory (used by OpenCL)
+      DEVICE_PRIVATE = whenHasDevicePrivate yes;
+      DRM_NOUVEAU_SVM = whenHasDevicePrivate yes;
+
+      # Enable HDMI-CEC receiver support
+      RC_CORE = yes;
+      MEDIA_CEC_RC = whenAtLeast "5.10" yes;
+
+      # Enable CEC over DisplayPort
+      DRM_DP_CEC = yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
       DRM_I915_GVT = yes;
@@ -397,6 +495,11 @@ let
     sound = {
       SND_DYNAMIC_MINORS  = yes;
       SND_AC97_POWER_SAVE = yes; # AC97 Power-Saving Mode
+      # 10s for the idle timeout, Fedora does 1, Arch does 10.
+      # The kernel says we should do 10.
+      # Read: https://docs.kernel.org/sound/designs/powersave.html
+      SND_AC97_POWER_SAVE_DEFAULT = freeform "10";
+      SND_HDA_POWER_SAVE_DEFAULT = freeform "10";
       SND_HDA_INPUT_BEEP  = yes; # Support digital beep via input layer
       SND_HDA_RECONFIG    = yes; # Support reconfiguration of jack functions
       # Support configuring jack functions via fw mechanism at boot
@@ -404,6 +507,7 @@ let
       SND_HDA_CODEC_CA0132_DSP = whenOlder "5.7" yes; # Enable DSP firmware loading on Creative Soundblaster Z/Zx/ZxR/Recon
       SND_OSSEMUL         = yes;
       SND_USB_CAIAQ_INPUT = yes;
+      SND_USB_AUDIO_MIDI_V2 = whenAtLeast "6.5" yes;
     # Enable Sound Open Firmware support
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" &&
                         versionAtLeast version "5.5") {
@@ -440,14 +544,23 @@ let
       SND_SOC_SOF_TIGERLAKE_SUPPORT     = whenOlder "5.12" yes;
     };
 
-    usb-serial = {
-      USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
-    };
-
     usb = {
+      USB                  = yes; # compile USB core into kernel, so we can use USB_SERIAL_CONSOLE before modules
+
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
       USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
+
+      # default to dual role mode
+      USB_DWC2_DUAL_ROLE = yes;
+      USB_DWC3_DUAL_ROLE = yes;
+    };
+
+    usb-serial = {
+      USB_SERIAL                  = yes;
+      USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
+      USB_SERIAL_CONSOLE          = yes; # Allow using USB serial adapter as console
+      U_SERIAL_CONSOLE            = whenAtLeast "5.10" yes; # Allow using USB gadget as console
     };
 
     # Filesystem options - in particular, enable extended attributes and
@@ -471,7 +584,7 @@ let
       EXT4_FS_SECURITY  = yes;
       EXT4_ENCRYPTION   = whenOlder "5.1" yes;
 
-      NTFS_FS            = whenAtLeast "5.15" no;
+      NTFS_FS            = whenBetween "5.15" "6.9" no;
       NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
       NTFS3_FS_POSIX_ACL = whenAtLeast "5.15" yes;
 
@@ -502,8 +615,8 @@ let
       F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
       UDF_FS              = module;
 
-      NFSD_V2_ACL            = whenOlder "6.1" yes;
-      NFSD_V3                = whenOlder "5.18" yes;
+      NFSD_V2_ACL            = whenOlder "5.15" yes;
+      NFSD_V3                = whenOlder "5.15" yes;
       NFSD_V3_ACL            = yes;
       NFSD_V4                = yes;
       NFSD_V4_SECURITY_LABEL = yes;
@@ -528,6 +641,7 @@ let
 
       SQUASHFS_FILE_DIRECT         = yes;
       SQUASHFS_DECOMP_MULTI_PERCPU = whenOlder "6.2" yes;
+      SQUASHFS_CHOICE_DECOMP_BY_MOUNT = whenAtLeast "6.2" yes;
       SQUASHFS_XATTR               = yes;
       SQUASHFS_ZLIB                = yes;
       SQUASHFS_LZO                 = yes;
@@ -593,6 +707,16 @@ let
       CRYPTO_DRBG_HASH                 = yes;
       CRYPTO_DRBG_CTR                  = yes;
 
+      # Enable KFENCE
+      # See: https://docs.kernel.org/dev-tools/kfence.html
+      KFENCE                           = whenAtLeast "5.12" yes;
+
+      # Enable support for page poisoning. Still needs to be enabled on the command line to actually work.
+      PAGE_POISONING                   = yes;
+
+      # Enable stack smashing protections in schedule()
+      # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
+      SCHED_STACK_END_CHECK            = yes;
     } // optionalAttrs stdenv.hostPlatform.isx86_64 {
       # Enable Intel SGX
       X86_SGX     = whenAtLeast "5.11" yes;
@@ -609,6 +733,10 @@ let
       SEV_GUEST       = whenAtLeast "5.19" module;
       # Shadow stacks
       X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes;
+
+      # Mitigate straight line speculation at the cost of some file size
+      SLS = whenBetween "5.17" "6.9" yes;
+      MITIGATION_SLS = whenAtLeast "6.9" yes;
     };
 
     microcode = {
@@ -743,11 +871,12 @@ let
     };
 
     zram = {
-      ZRAM           = module;
-      ZRAM_WRITEBACK = option yes;
-      ZSWAP          = option yes;
-      ZPOOL          = yes;
-      ZBUD           = option yes;
+      ZRAM            = module;
+      ZRAM_WRITEBACK  = option yes;
+      ZRAM_MULTI_COMP = whenAtLeast "6.2" yes;
+      ZSWAP           = option yes;
+      ZPOOL           = yes;
+      ZBUD            = option yes;
     };
 
     brcmfmac = {
@@ -776,7 +905,6 @@ let
       NOTIFIER_ERROR_INJECTION = option no;
       RCU_PERF_TEST            = whenOlder "5.9" no;
       RCU_SCALE_TEST           = whenAtLeast "5.10" no;
-      RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
       WW_MUTEX_SELFTEST        = option no;
       XZ_DEC_TEST              = option no;
@@ -786,6 +914,10 @@ let
       # Unconditionally enabled, because it is required for CRIU and
       # it provides the kcmp() system call that Mesa depends on.
       CHECKPOINT_RESTORE  = yes;
+
+      # Allows soft-dirty tracking on pages, used by CRIU.
+      # See https://docs.kernel.org/admin-guide/mm/soft-dirty.html
+      MEM_SOFT_DIRTY = mkIf (!stdenv.isx86_32) yes;
     };
 
     misc = let
@@ -800,6 +932,9 @@ let
       # enabled by default in x86_64 but not arm64, so we do that here
       HIDRAW               = yes;
 
+      # Enable loading HID fixups as eBPF from userspace
+      HID_BPF            = whenAtLeast "6.3" yes;
+
       HID_ACRUX_FF       = yes;
       DRAGONRISE_FF      = yes;
       GREENASIA_FF       = yes;
@@ -827,7 +962,10 @@ let
       # Enable initrd support.
       BLK_DEV_INITRD    = yes;
 
-      PM_TRACE_RTC         = no; # Disable some expensive (?) features.
+      # Allows debugging systems that get stuck during suspend/resume
+      PM_TRACE             = yes;
+      PM_TRACE_RTC         = yes;
+
       ACCESSIBILITY        = yes; # Accessibility support
       AUXDISPLAY           = yes; # Auxiliary Display support
       HIPPI                = yes;
@@ -852,6 +990,11 @@ let
 
       BLK_SED_OPAL = yes;
 
+      # Enable support for block layer inline encryption
+      BLK_INLINE_ENCRYPTION = whenAtLeast "5.8" yes;
+      # ...but fall back to CPU encryption if unavailable
+      BLK_INLINE_ENCRYPTION_FALLBACK = whenAtLeast "5.8" yes;
+
       BSD_PROCESS_ACCT_V3 = yes;
 
       SERIAL_DEV_BUS = yes; # enables support for serial devices
@@ -870,7 +1013,6 @@ let
       # Removed on 5.17 as it was unused
       # upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a4ee518185e902758191d968600399f3bc2be31
       CLEANCACHE = whenOlder "5.17" (option yes);
-      CRASH_DUMP = option no;
 
       FSCACHE_STATS = yes;
 
@@ -966,7 +1108,7 @@ let
       # Disable the firmware helper fallback, udev doesn't implement it any more
       FW_LOADER_USER_HELPER_FALLBACK = option no;
 
-      FW_LOADER_COMPRESS = option yes;
+      FW_LOADER_COMPRESS = whenAtLeast "5.3" yes;
 
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
@@ -1013,6 +1155,13 @@ let
 
       # Set system time from RTC on startup and resume
       RTC_HCTOSYS = option yes;
+
+      # Expose watchdog information in sysfs
+      WATCHDOG_SYSFS = yes;
+
+      # Enable generic kernel watch queues
+      # See https://docs.kernel.org/core-api/watch_queue.html
+      WATCH_QUEUE = whenAtLeast "5.8" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enable CPU/memory hotplug support
       # Allows you to dynamically add & remove CPUs/memory to a VM client running NixOS without requiring a reboot
@@ -1043,10 +1192,9 @@ let
       # https://github.com/torvalds/linux/blob/856deb866d16e29bd65952e0289066f6078af773/kernel/dma/contiguous.c#L35-L44
       CMA_SIZE_MBYTES = freeform "32";
 
-      # Many ARM SBCs hand off a pre-configured framebuffer.
-      # This always can can be replaced by the actual native driver.
-      # Keeping it a built-in ensures it will be used if possible.
-      FB_SIMPLE = yes;
+      # Add debug interfaces for CMA
+      CMA_DEBUGFS = yes;
+      CMA_SYSFS = yes;
 
       # https://docs.kernel.org/arch/arm/mem_alignment.html
       # tldr:
@@ -1088,6 +1236,24 @@ let
     } // optionalAttrs (versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
       CHROMEOS_LAPTOP = module;
       CHROMEOS_PSTORE = module;
+    } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
+      # Enable x86 resource control
+      X86_CPU_RESCTRL = whenAtLeast "5.0" yes;
+
+      # Enable TSX on CPUs where it's not vulnerable
+      X86_INTEL_TSX_MODE_AUTO = yes;
+
+      # Enable AMD Wi-Fi RF band mitigations
+      # See https://cateee.net/lkddb/web-lkddb/AMD_WBRF.html
+      AMD_WBRF = whenAtLeast "6.8" yes;
+
+      # Enable Intel Turbo Boost Max 3.0
+      INTEL_TURBO_MAX_3 = yes;
+    };
+
+    accel = {
+      # Build DRM accelerator devices
+      DRM_ACCEL = whenAtLeast "6.2" yes;
     };
   };
 in
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 14c863b459b1e..77c6ee031956d 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -12,8 +12,10 @@
 , rustc
 , rustPlatform
 , rust-bindgen
+, nixosTests
+}@args':
 
-, # The kernel source tarball.
+lib.makeOverridable ({ # The kernel source tarball.
   src
 
 , # The kernel version.
@@ -66,7 +68,10 @@
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
-, nixosTests
+
+, stdenv ? args'.stdenv
+, buildPackages ? args'.buildPackages
+
 , ...
 }@args:
 
@@ -239,4 +244,4 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
     in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
   };
 
-})
+}))
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index cb825a1adbac8..21772b2e03eb0 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.307-hardened1.patch",
-            "sha256": "01i15w3qzwag2v4r5r5bqyk337pidhmcfif228f286cnjnqz5d7h",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.307-hardened1/linux-hardened-4.19.307-hardened1.patch"
+            "name": "linux-hardened-4.19.309-hardened1.patch",
+            "sha256": "1hww72w5anmfr9czqbl31glzl70s34492k9qz9zax141zg1sf6sp",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.309-hardened1/linux-hardened-4.19.309-hardened1.patch"
         },
-        "sha256": "0lp3fc7sqy48vpcl2g0n1bz7i1hp9k0nlz3i1xfh9l056ihzzvl3",
-        "version": "4.19.307"
+        "sha256": "1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm",
+        "version": "4.19.309"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.210-hardened1.patch",
-            "sha256": "1fdkkl303kvw9sg9lpzg83157xrl9jcl4jjli1gi2a4j0yz2479n",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.210-hardened1/linux-hardened-5.10.210-hardened1.patch"
+            "name": "linux-hardened-5.10.212-hardened1.patch",
+            "sha256": "0h04i94vshhcli5m4qpnqg4vsi5v1ifvdhhklk7c0bvkfk35cbml",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.212-hardened1/linux-hardened-5.10.212-hardened1.patch"
         },
-        "sha256": "0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf",
-        "version": "5.10.210"
+        "sha256": "14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc",
+        "version": "5.10.212"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.149-hardened1.patch",
-            "sha256": "1y56l5l50h673a4n2pb3i3wh494lpnlw9vvdfr6m0jr0vymldb57",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.149-hardened1/linux-hardened-5.15.149-hardened1.patch"
+            "name": "linux-hardened-5.15.151-hardened1.patch",
+            "sha256": "040jc5n9qsdz2wv5ksfvc28vd72nmya2i2f0ps0jiras6l2wlhjz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.151-hardened1/linux-hardened-5.15.151-hardened1.patch"
         },
-        "sha256": "1c01fnaghj55mkgsgddznq1zq4mswsa05rz00kmh1d3y6sd8115x",
-        "version": "5.15.149"
+        "sha256": "0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la",
+        "version": "5.15.151"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.269-hardened1.patch",
-            "sha256": "06vf0mlp822i4bkpsxbyk1xjlbzabqpncy8qw9zajpjajwv87d7x",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.269-hardened1/linux-hardened-5.4.269-hardened1.patch"
+            "name": "linux-hardened-5.4.271-hardened1.patch",
+            "sha256": "0rw5il7885d0d3k2hmh46541svib6rp32g00fcl5bw37ydmq3z8b",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.271-hardened1/linux-hardened-5.4.271-hardened1.patch"
         },
-        "sha256": "1kqqm4hpif3jy2ycnb0dfjgzyn18vqhm1i5q7d7rkisks33bwm7z",
-        "version": "5.4.269"
+        "sha256": "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d",
+        "version": "5.4.271"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.79-hardened1.patch",
-            "sha256": "0inip6pmlwrj75vwjimkjgvh4jn6ldrq5312r02xh1i95qb0sg3a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.79-hardened1/linux-hardened-6.1.79-hardened1.patch"
+            "name": "linux-hardened-6.1.81-hardened1.patch",
+            "sha256": "0af9dxdsa858zyqc0vsrzg098afhg5vpb2wpr6gj2ykwc13iaf07",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.81-hardened1/linux-hardened-6.1.81-hardened1.patch"
         },
-        "sha256": "16xkd0hcslqlcf55d4ivzhf1fkhfs5yy0m9arbax8pmm5yi9r97s",
-        "version": "6.1.79"
+        "sha256": "0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f",
+        "version": "6.1.81"
     },
     "6.5": {
         "patch": {
@@ -62,12 +62,12 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.18-hardened1.patch",
-            "sha256": "0svlck53b7bd38b9b0hzgppmhm59d35r2vqv30ga85ghkvc61byn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.18-hardened1/linux-hardened-6.6.18-hardened1.patch"
+            "name": "linux-hardened-6.6.21-hardened1.patch",
+            "sha256": "0k35s5pj92lvfp6kw3isg78zc3gijsg0xbzcyvxdkmhzaq8j6i1i",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.21-hardened1/linux-hardened-6.6.21-hardened1.patch"
         },
-        "sha256": "07cv97l5jiakmmv35n0ganvqfr0590b02f3qb617qkx1zg2xhhsf",
-        "version": "6.6.18"
+        "sha256": "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf",
+        "version": "6.6.21"
     },
     "6.7": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix
index ba641347c839e..dad377db06abb 100644
--- a/pkgs/os-specific/linux/kernel/htmldocs.nix
+++ b/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs \
       Documentation/sphinx/parse-headers.pl \
-      scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install}
+      scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install} \
+      tools/net/ynl/ynl-gen-rst.py
   '';
 
   FONTCONFIG_FILE = makeFontsConf {
@@ -31,6 +32,7 @@ stdenv.mkDerivation {
     perl
     python3.pkgs.sphinx
     python3.pkgs.sphinx-rtd-theme
+    python3.pkgs.pyyaml
     which
   ];
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c838d6371b6ab..04e1fe87908b2 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,34 @@
 {
     "testing": {
-        "version": "6.8-rc7",
-        "hash": "sha256:0q9isgv6lxzrmb4idl0spxv2l7fsk3nn4cdq0vdw9c8lyzrh5yy0"
+        "version": "6.9-rc3",
+        "hash": "sha256:0xavyh3xg23il3bm2x6fjji3s26z05cyv1lry6h5yd7jjj3qm7cc"
     },
     "6.1": {
-        "version": "6.1.81",
-        "hash": "sha256:0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f"
+        "version": "6.1.86",
+        "hash": "sha256:0nqiwcaln36drkcaav96dymd2y8rv7wj6a5xjl58f2hg9z2cilyk"
     },
     "5.15": {
-        "version": "5.15.151",
-        "hash": "sha256:0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la"
+        "version": "5.15.155",
+        "hash": "sha256:1r16j5asd8v5hr5b0sb8z2wmp6say928pgm13k4iyv9fdnw5jn68"
     },
     "5.10": {
-        "version": "5.10.212",
-        "hash": "sha256:14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc"
+        "version": "5.10.215",
+        "hash": "sha256:1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747"
     },
     "5.4": {
-        "version": "5.4.271",
-        "hash": "sha256:0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d"
+        "version": "5.4.274",
+        "hash": "sha256:1m4yyyv48mfkzhqms88dv1jf39zsfp88az5zpqynmm1wlhhv9iza"
     },
     "4.19": {
-        "version": "4.19.309",
-        "hash": "sha256:1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm"
+        "version": "4.19.312",
+        "hash": "sha256:0jppa4p73pssd7m3jpc7i6rgnj9gawjcgk4wmqyy87ijzrgzm553"
     },
     "6.6": {
-        "version": "6.6.21",
-        "hash": "sha256:0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf"
-    },
-    "6.7": {
-        "version": "6.7.9",
-        "hash": "sha256:0inkvyrvq60j9lxgivkivq3qh94lsfc1dpv6vwgxmy3q0zy37mqg"
+        "version": "6.6.27",
+        "hash": "sha256:14c229mcrd2rd2vjp0c3apzqifn6mkz0rcbw07nj73rw1q3517k3"
     },
     "6.8": {
-        "version": "6.8",
-        "hash": "sha256:1wv5x7qhcd05m8m0myyqm2il6mha1sx11h7ppf8yjsxvx2jdwsf9"
+        "version": "6.8.6",
+        "hash": "sha256:158rb8x4qaig8ywbr6n2jnqpl9wgqha4ghs3y3mlbaq3sqr34wly"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index afdc6bb5fd01b..90a4935fef640 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19500";
-    sha256 = "1xlicxwb1j5m4yjyw9ybyffmilzg7xh847jxfl4jy318vjpkmffr";
+    rev = "19527";
+    sha256 = "0sb1qxc25g7f3v6qym9iwi3xjwmxzrf7w33yfmvv3k09rlfndijy";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 747d5aec77901..337594115fa6f 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.210-rt102"; # updated by ./update-rt.sh
+  version = "5.10.213-rt105"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf";
+    sha256 = "105df7w6m5a3fngi6ajqs5qblaq4lbxsgcppllrk7v1r68i31kw4";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1q4365ix990iw33a63cpn61qvgf8rkzf658xyi0hnr6292hlvajj";
+      sha256 = "1q5kz3mfvwb4fd5i2mbklsa6gifb8g3wbq0wi2478q097dvmb6gi";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 189a211c8e488..91774ba38dbd8 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.15.148-rt74"; # updated by ./update-rt.sh
+  version = "5.15.153-rt75"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1n75lrck581mppx84cds1a1l5vj05cdkp8ahpry7dx6rgz4pb1f4";
+    sha256 = "1g44gjcwcdq5552vwinljqwiy90bxax72jjvdasp71x88khv3pfp";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0vbwqrkzigjfwmyxfbhq5n1g1qvyis949r97zqxhnmanq7c4njdk";
+      sha256 = "04i22p0ap4dsqybf9jbbmrbzva11qknilnyk46z18gzrr0msjldl";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index cd2f60d3921d9..463385036292e 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.264-rt88"; # updated by ./update-rt.sh
+  version = "5.4.271-rt89"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1c5n47dq9khb15hz24a000k3hj913vv1dda6famnm8wpjbfr176k";
+    sha256 = "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1yzdiip1fm9szx2hhvq9ph7jq00qglb1skis6gv0184g0ls2qddg";
+      sha256 = "15k9jja5yd9zf5yhd7hhydwh4hksg2mybk66jhdjsryh4w9jav7z";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 16a23b6b139c9..06028d209779d 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.80-rt26"; # updated by ./update-rt.sh
+  version = "6.1.83-rt28"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "0wdnyy7m9kfkl98id0gm6jzp4aa0hfy6gfkb4k4cg1wbpfpcm3jn";
+    sha256 = "145iw3wii7znhrqdmgnwhswk235g6gw8axjjji2cw4rn148rddl8";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0w47ii5xhsbnkmgzlgg18ljwdms88scbzhqlw0qv3lnldicykg0p";
+      sha256 = "07wv3zd7n5378k8ywdavrp5ndqkdcis923dwpswfv7062xm34y5h";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 514baa0ca5980..eb85f9c3cd091 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.6.20-rt25"; # updated by ./update-rt.sh
+  version = "6.6.25-rt29"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "08nxv2240d2ak6p2vsbjasnp7askamswby3h6cclhhihkgrwgxp2";
+    sha256 = "0i0zvqlj02rm6wpbidji0rn9559vrpfc1b8gbfjk70lhhyz11llr";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1sfalbcfzzjmskxpix1850cypg4zixwzbd9rmpg37n8lclivn2gv";
+      sha256 = "15mb4zycv86yp1cbs5svgs3pnmh8jihjhf4jxc4h4ywlzglkb1za";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index baf0231f13e16..5b222c4b45eff 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -59,6 +59,33 @@ let
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
+      # Folding in `ubootTools` in the default nativeBuildInputs is problematic, as
+      # it makes updating U-Boot cumbersome, since it will go above the current
+      # threshold of rebuilds
+      #
+      # To prevent these needless rounds of staging for U-Boot builds, we can
+      # limit the inclusion of ubootTools to target platforms where uImage *may*
+      # be produced.
+      #
+      # This command lists those (kernel-named) platforms:
+      #     .../linux $ grep -l uImage ./arch/*/Makefile | cut -d'/' -f3 | sort
+      #
+      # This is still a guesstimation, but since none of our cached platforms
+      # coincide in that list, this gives us "perfect" decoupling here.
+      linuxPlatformsUsingUImage = [
+        "arc"
+        "arm"
+        "csky"
+        "mips"
+        "powerpc"
+        "sh"
+        "sparc"
+        "xtensa"
+      ];
+      needsUbootTools =
+        lib.elem stdenv.hostPlatform.linuxArch linuxPlatformsUsingUImage
+      ;
+
       config = let attrName = attr: "CONFIG_" + attr; in {
         isSet = attr: hasAttr (attrName attr) config;
 
@@ -106,7 +133,8 @@ let
       inherit src;
 
       depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
+      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ]
+                          ++ optional  needsUbootTools ubootTools
                           ++ optional  (lib.versionOlder version "5.8") libelf
                           ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
                           ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 9c2b50f95952a..bce7d7d0dcb3b 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -66,15 +66,6 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
-  rust_1_74 = {
-    name = "rust-1.74.patch";
-    patch = fetchpatch {
-      name = "rust-1.74.patch";
-      url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=80fe9e51510b23472ad0f97175556490549ed714";
-      hash = "sha256-yGt7PwqN/G+ZtZSt6eARvVFdkC8tnUiu0Fz4cFCyguM=";
-    };
-  };
-
   rust_1_75 = {
     name = "rust-1.75.patch";
     patch = ./rust-1.75.patch;
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 172965f2a78f1..02f0407425d13 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -164,6 +164,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://perf.wiki.kernel.org/";
     description = "Linux tools to profile with performance counters";
+    mainProgram = "perf";
     maintainers = with maintainers; [ viric ];
     platforms = platforms.linux;
     broken = kernel.kernelOlder "5";
diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
index 020e55c5fe402..bf5001ee378aa 100755
--- a/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -130,6 +130,13 @@ def main():
             continue
 
         if old_version is None:
+            if kernel.eol:
+                print(
+                    f"{kernel.branch} is EOL, not adding...",
+                    file=sys.stderr
+                )
+                continue
+
             message = f"linux_{nixpkgs_branch}: init at {kernel.version}"
         else:
             message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index ea0db48c75f3e..c09f5c485e432 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.21";
-    hash = "sha256-DDkjrtKK7zIffVMuBtHvSWp0GtMA87YuOp8AhUw64+Y=";
+    version = "6.6.27";
+    hash = "sha256-MYvt7QWRdUybbhva6B4MOYrwnJfuu/qvMlnaGKcO1Hw=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.7.9";
-    hash = "sha256-/YoZTclMdJBQ8iwpfm/Ne/YLNQneN0hccy95o3fWvGM=";
+    version = "6.8.6";
+    hash = "sha256-7GsiIl3rcLm/u2zxrjpP6dTxn7w/6at22gaU//mLlzw=";
     variant = "main";
   };
 
@@ -29,6 +29,14 @@ let
     };
 
     structuredExtraConfig = with lib.kernel; {
+      # CPUFreq governor Performance
+      CPU_FREQ_DEFAULT_GOV_PERFORMANCE = lib.mkOverride 60 yes;
+      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = lib.mkOverride 60 no;
+
+      # Full preemption
+      PREEMPT = lib.mkOverride 60 yes;
+      PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+
       # Google's BBRv3 TCP congestion Control
       TCP_CONG_BBR = yes;
       DEFAULT_BBR = yes;
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index d8261beb17641..7c4adba2efcf2 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.8"; #zen
+    version = "6.8.4"; #zen
     suffix = "zen1"; #zen
-    sha256 = "19rsi8747xw5lsq4pwizq2va6inmwrywgy8b5f2ppcd6ny0whn1i"; #zen
+    sha256 = "0cbcij31gar4is5zcrl748ijn91jly74i2gggf43ndh8yrzdni85"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.7.9"; #lqx
+    version = "6.8.4"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "0hhkn2098h69l8slz5f0krkckf3qm7hmh5z233j341jpc0qv8p6b"; #lqx
+    sha256 = "1hv9hvx9nw51qki5wbhm4dgyvgw7jjwxl8fvslaazn3r0rqch7z2"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
@@ -93,6 +93,8 @@ let
       RT_GROUP_SCHED = lib.mkForce (option no);
       SCHED_AUTOGROUP = lib.mkForce (option no);
       SCHED_CORE = lib.mkForce (option no);
+      UCLAMP_TASK = lib.mkForce (option no);
+      UCLAMP_TASK_GROUP = lib.mkForce (option no);
 
       # ERROR: modpost: "sched_numa_hop_mask" [drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko] undefined!
       MLX5_CORE = no;
diff --git a/pkgs/os-specific/linux/klibc/default.nix b/pkgs/os-specific/linux/klibc/default.nix
index 3a044cf9d84d6..2b010e5c8bce2 100644
--- a/pkgs/os-specific/linux/klibc/default.nix
+++ b/pkgs/os-specific/linux/klibc/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Minimalistic libc subset for initramfs usage";
+    mainProgram = "klcc";
     homepage = "https://kernel.org/pub/linux/libs/klibc/";
     maintainers = with lib.maintainers; [ fpletz ];
     license = lib.licenses.bsd3;
diff --git a/pkgs/os-specific/linux/kmscon/default.nix b/pkgs/os-specific/linux/kmscon/default.nix
index 2a60864ea6bf5..18ac0370b855e 100644
--- a/pkgs/os-specific/linux/kmscon/default.nix
+++ b/pkgs/os-specific/linux/kmscon/default.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "KMS/DRM based System Console";
+    mainProgram = "kmscon";
     homepage = "https://www.freedesktop.org/wiki/Software/kmscon/";
     license = licenses.mit;
     maintainers = with maintainers; [ omasanori ];
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
index dd429b2959902..b81f581c07aaa 100644
--- a/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ksmbd-tools";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "cifsd-team";
     repo = pname;
     rev = version;
-    sha256 = "sha256-1Htky39oggDqPYSbF4it2UMIxuoLp0aK+IjGojPgaiU=";
+    sha256 = "sha256-QE/Pnba4zgeInlVqOEjT3EqV6NPkQTp6xeYU3dsIl4M=";
   };
 
   buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
index e2390b68a5ca2..3258295be58a6 100644
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   inherit (vdo);
   pname = "kvdo";
-  version = "8.2.1.6"; # bump this version with vdo
+  version = "8.2.3.3"; # bump this version with vdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = "kvdo";
     rev = version;
-    hash = "sha256-S5r2Rgx5pWk4IsdIwmfZkuGL/oEQ3prquyVqxjR3cO0=";
+    hash = "sha256-y7uVgWFV6uWRoRqfiu0arG9731mgWijXjcp9KSaZ5X0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/latencytop/default.nix b/pkgs/os-specific/linux/latencytop/default.nix
index a48abf85831fe..023140e1f482b 100644
--- a/pkgs/os-specific/linux/latencytop/default.nix
+++ b/pkgs/os-specific/linux/latencytop/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://latencytop.org";
     description = "Tool to show kernel reports on latencies (LATENCYTOP option)";
+    mainProgram = "latencytop";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.viric ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index f8a519de847e2..0dea0ce4e8b0d 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A lightweight device mounter, with libudev as only dependency";
+    mainProgram = "ldm";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 21712e76661ae..22c162023e1c9 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   # outputs = [ "out" "dev" ];
 
   meta = with lib; {
-    description = "Upstream mirror of libbpf";
+    description = "Library for loading eBPF programs and reading and manipulating eBPF objects from user-space";
     homepage = "https://github.com/libbpf/libbpf";
     license = with licenses; [ lgpl21 /* or */ bsd2 ];
     maintainers = with maintainers; [ thoughtpolice vcunat saschagrunert martinetd ];
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index b42bffdc057df..c0711f6933778 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation rec {
             -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
       '';
     })
+
+    (fetchurl {
+      url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
+      sha256 = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config python3 ] ++ optionals enablePython [
@@ -53,7 +58,7 @@ stdenv.mkDerivation rec {
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -D_FILE_OFFSET_BITS=64";
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/pkgs/os-specific/linux/libtracefs/default.nix b/pkgs/os-specific/linux/libtracefs/default.nix
index 2432a28e0c7bf..3d99466c8f34e 100644
--- a/pkgs/os-specific/linux/libtracefs/default.nix
+++ b/pkgs/os-specific/linux/libtracefs/default.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux kernel trace file system library";
+    mainProgram = "sqlhist";
     homepage    = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/";
     license     = licenses.lgpl21Only;
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/libzbd/default.nix b/pkgs/os-specific/linux/libzbd/default.nix
index 0c77f73cf2fcf..4675a13837587 100644
--- a/pkgs/os-specific/linux/libzbd/default.nix
+++ b/pkgs/os-specific/linux/libzbd/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Zoned block device manipulation library and tools";
+    mainProgram = "zbd";
     homepage = "https://github.com/westerndigitalcorporation/libzbd";
     maintainers = [ maintainers.fogti ];
     license = with licenses; [ lgpl3Plus gpl3Plus ];
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index e9925b95bcd69..46dd76e0d277d 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "MacBook automatic light sensor daemon";
+    mainProgram = "lightum";
     homepage = "https://github.com/poliva/lightum";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ puffnfresh ];
diff --git a/pkgs/os-specific/linux/lockdep/default.nix b/pkgs/os-specific/linux/lockdep/default.nix
index 1ea2de63560b3..be3967f0a8587 100644
--- a/pkgs/os-specific/linux/lockdep/default.nix
+++ b/pkgs/os-specific/linux/lockdep/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Userspace locking validation tool built on the Linux kernel";
+    mainProgram = "lockdep";
     homepage    = "https://kernel.org/";
     license     = lib.licenses.gpl2;
     platforms   = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/lsb-release/default.nix b/pkgs/os-specific/linux/lsb-release/default.nix
index 7ab10bfac124f..f79c6527539ab 100644
--- a/pkgs/os-specific/linux/lsb-release/default.nix
+++ b/pkgs/os-specific/linux/lsb-release/default.nix
@@ -14,6 +14,7 @@ substituteAll {
 
   meta = with lib; {
     description = "Prints certain LSB (Linux Standard Base) and Distribution information";
+    mainProgram = "lsb_release";
     license = [ licenses.mit ];
     maintainers = with maintainers; [ primeos ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 4026784f92a43..71de8ce3cdcc1 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -61,10 +61,13 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # https://github.com/NixOS/nixpkgs/issues/300635
+  postInstall = ''chmod -R u-s,g-s "$out"'';
+
   passthru = {
     tests = {
-      incus-old-init = nixosTests.incus.container-old-init;
-      incus-new-init = nixosTests.incus.container-new-init;
+      incus-legacy-init = nixosTests.incus.container-legacy-init;
+      incus-systemd-init = nixosTests.incus.container-systemd-init;
     };
     updateScript = nix-update-script {
       extraArgs = [
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
deleted file mode 100644
index 1388b5360f123..0000000000000
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fuse3,
-  help2man,
-  makeWrapper,
-  meson,
-  ninja,
-  nixosTests,
-  pkg-config,
-  python3,
-  util-linux,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lxcfs";
-  version = "5.0.4";
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "lxcfs";
-    rev = "lxcfs-${version}";
-    sha256 = "sha256-vusxbFV7cnQVBOOo7E+fSyaE63f5QiE2xZhYavc8jJU=";
-  };
-
-  patches = [
-    # skip RPM spec generation
-    ./no-spec.patch
-
-    # skip installing systemd files
-    ./skip-init.patch
-
-    # fix pidfd checks and include
-    ./pidfd.patch
-  ];
-
-
-  nativeBuildInputs = [
-    meson
-    help2man
-    makeWrapper
-    ninja
-    (python3.withPackages (p: [ p.jinja2 ]))
-    pkg-config
-  ];
-  buildInputs = [ fuse3 ];
-
-  preConfigure = ''
-    patchShebangs tools/
-  '';
-
-  postInstall = ''
-    # `mount` hook requires access to the `mount` command from `util-linux`:
-    wrapProgram "$out/share/lxcfs/lxc.mount.hook" --prefix PATH : "${util-linux}/bin"
-  '';
-
-  postFixup = ''
-    # liblxcfs.so is reloaded with dlopen()
-    patchelf --set-rpath "$(patchelf --print-rpath "$out/bin/lxcfs"):$out/lib" "$out/bin/lxcfs"
-  '';
-
-  passthru.tests = {
-    incus-container-old-init = nixosTests.incus.container-old-init;
-    incus-container-new-init = nixosTests.incus.container-new-init;
-  };
-
-  meta = {
-    description = "FUSE filesystem for LXC";
-    homepage = "https://linuxcontainers.org/lxcfs";
-    changelog = "https://linuxcontainers.org/lxcfs/news/";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.linux;
-    maintainers = lib.teams.lxc.members;
-  };
-}
diff --git a/pkgs/os-specific/linux/lxcfs/no-spec.patch b/pkgs/os-specific/linux/lxcfs/no-spec.patch
deleted file mode 100644
index ead4bfcf80f75..0000000000000
--- a/pkgs/os-specific/linux/lxcfs/no-spec.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/meson.build b/meson.build
-index a0289ad..93fc61a 100644
---- a/meson.build
-+++ b/meson.build
-@@ -253,19 +253,6 @@ if want_tests == true
-         c_args: '-DRELOADTEST -DDEBUG')
- endif
- 
--# RPM spec.
--lxcfs_spec = custom_target(
--    'lxcfs.spec',
--    build_by_default: true,
--    input: 'lxcfs.spec.in',
--    output: 'lxcfs.spec',
--    command: [
--        meson_render_jinja2,
--        config_h,
--        '@INPUT@',
--        '@OUTPUT@',
--    ])
--
- # Man pages
- if want_docs == true
-     help2man = find_program('help2man')
diff --git a/pkgs/os-specific/linux/lxcfs/pidfd.patch b/pkgs/os-specific/linux/lxcfs/pidfd.patch
deleted file mode 100644
index 3d9b6faa57f9e..0000000000000
--- a/pkgs/os-specific/linux/lxcfs/pidfd.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/meson.build b/meson.build
-index a0289ad..211b01b 100644
---- a/meson.build
-+++ b/meson.build
-@@ -134,11 +134,13 @@ foreach ident: [
-      '''#include <stdlib.h>
-         #include <unistd.h>
-         #include <signal.h>
-+        #include <sys/pidfd.h>
-         #include <sys/wait.h>'''],
-     ['pidfd_open',
-      '''#include <stdlib.h>
-         #include <unistd.h>
-         #include <signal.h>
-+        #include <sys/pidfd.h>
-         #include <sys/wait.h>'''],
- ]
-     have = cc.has_function(ident[0], prefix: ident[1], args: '-D_GNU_SOURCE')
-diff --git a/src/bindings.c b/src/bindings.c
-index 13259c1..e760330 100644
---- a/src/bindings.c
-+++ b/src/bindings.c
-@@ -1,5 +1,6 @@
- /* SPDX-License-Identifier: LGPL-2.1+ */
- 
-+#include <sys/pidfd.h>
- #include "config.h"
- 
- #include <dirent.h>
diff --git a/pkgs/os-specific/linux/lxcfs/skip-init.patch b/pkgs/os-specific/linux/lxcfs/skip-init.patch
deleted file mode 100644
index 6e7cdc90d706f..0000000000000
--- a/pkgs/os-specific/linux/lxcfs/skip-init.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/meson.build b/meson.build
-index a0289ad..10c0a28 100644
---- a/meson.build
-+++ b/meson.build
-@@ -285,7 +285,6 @@ endif
- 
- 
- # Include sub-directories.
--subdir('config/init')
- subdir('share')
- subdir('tests')
- 
diff --git a/pkgs/os-specific/linux/mbpfan/default.nix b/pkgs/os-specific/linux/mbpfan/default.nix
index 50fc74d7fa0a0..4992fdbf1d46e 100644
--- a/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/pkgs/os-specific/linux/mbpfan/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   '';
   meta = with lib; {
     description = "Daemon that uses input from coretemp module and sets the fan speed using the applesmc module";
+    mainProgram = "mbpfan";
     homepage = "https://github.com/dgraziotin/mbpfan";
     license = licenses.gpl3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/mceinject/default.nix b/pkgs/os-specific/linux/mceinject/default.nix
index 524225763742b..f7cd199a5e8b9 100644
--- a/pkgs/os-specific/linux/mceinject/default.nix
+++ b/pkgs/os-specific/linux/mceinject/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A tool to inject machine checks into x86 kernel for testing";
+    mainProgram = "mce-inject";
     longDescription = ''
       mce-inject allows to inject machine check errors on the software level
       into a running Linux kernel. This is intended for validation of the
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index 916c79a4298d9..2a6727027f484 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Log x86 machine checks: memory, IO, and CPU hardware errors";
+    mainProgram = "mcelog";
     longDescription = ''
       The mcelog daemon accounts memory and some other errors in various ways
       on modern x86 Linux systems. The daemon can be queried and/or execute
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index e7aa16d3dd39a..65556987508e5 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -2,14 +2,22 @@
 
 stdenv.mkDerivation rec {
   pname = "mdadm";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/raid/mdadm/mdadm-${version}.tar.xz";
-    sha256 = "sha256-RhwhVnCGS7dKTRo2IGhKorL4KW3/oGdD8m3aVVes8B0=";
+    sha256 = "sha256-QWcnrh8QgOpuMJDOo23QdoJvw2kVHjarc2VXupIZb58=";
   };
 
-  patches = [ ./no-self-references.patch ];
+  patches = [
+    ./no-self-references.patch
+    ./fix-hardcoded-mapdir.patch
+    # Fixes build on musl
+    (fetchurl {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/e58d2b17d3c40faffc0d426aab00184f28d9dafa/srcpkgs/mdadm/patches/musl.patch";
+      hash = "sha256-TIcQs+8RM5Q6Z8MHkI50kaJd7f9WdS/EVI16F7b2+SA=";
+    })
+  ];
 
   makeFlags = [
     "NIXOS=1" "INSTALL=install" "BINDIR=$(out)/sbin"
@@ -46,7 +54,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Programs for managing RAID arrays under Linux";
-    homepage = "http://neil.brown.name/blog/mdadm";
+    homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
     license = licenses.gpl2;
     mainProgram = "mdadm";
     maintainers = with maintainers; [ ekleog ];
diff --git a/pkgs/os-specific/linux/mdadm/fix-hardcoded-mapdir.patch b/pkgs/os-specific/linux/mdadm/fix-hardcoded-mapdir.patch
new file mode 100644
index 0000000000000..cf50d6012487c
--- /dev/null
+++ b/pkgs/os-specific/linux/mdadm/fix-hardcoded-mapdir.patch
@@ -0,0 +1,13 @@
+diff --git a/udev.c b/udev.c
+index bc4722b0..aa2a1a24 100644
+--- a/udev.c
++++ b/udev.c
+@@ -167,7 +167,7 @@ enum udev_status udev_block(char *devnm)
+ 	int fd;
+ 	char *path = xcalloc(1, BUFSIZ);
+ 
+-	snprintf(path, BUFSIZ, "/run/mdadm/creating-%s", devnm);
++	snprintf(path, BUFSIZ, "%s/creating-%s", MAP_DIR, devnm);
+ 
+ 	fd = open(path, O_CREAT | O_RDWR, 0600);
+ 	if (!is_fd_valid(fd)) {
diff --git a/pkgs/os-specific/linux/metastore/default.nix b/pkgs/os-specific/linux/metastore/default.nix
index c9875297186e2..76e4ae8932876 100644
--- a/pkgs/os-specific/linux/metastore/default.nix
+++ b/pkgs/os-specific/linux/metastore/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Store and restore metadata from a filesystem";
+    mainProgram = "metastore";
     homepage = "https://software.przemoc.net/#metastore";
     license = licenses.gpl2;
     maintainers = with maintainers; [ sstef ];
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index de51beb2cc180..6953bbca8963e 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20231114";
+  version = "20240312";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-cZ7APDjwjarPCzk1HWxqIXdGwNOl6HG0KSCtffmEhx0=";
+    hash = "sha256-4ZSA+LVczfjZINXhImmFOCc/6kKNrrUQvrXPdOvMM8g=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/microcode/iucode-tool.nix b/pkgs/os-specific/linux/microcode/iucode-tool.nix
index d27e3ca6987b7..316aaa22932dc 100644
--- a/pkgs/os-specific/linux/microcode/iucode-tool.nix
+++ b/pkgs/os-specific/linux/microcode/iucode-tool.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Intel® 64 and IA-32 processor microcode tool";
+    mainProgram = "iucode_tool";
     homepage = "https://gitlab.com/iucode-tool/iucode-tool";
     license = licenses.gpl2;
     maintainers = with maintainers; [ peterhoeg ];
diff --git a/pkgs/os-specific/linux/miraclecast/default.nix b/pkgs/os-specific/linux/miraclecast/default.nix
index 7b502fa4adee7..0b03aeb3c2d07 100644
--- a/pkgs/os-specific/linux/miraclecast/default.nix
+++ b/pkgs/os-specific/linux/miraclecast/default.nix
@@ -1,24 +1,25 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config
-, glib, readline, pcre, systemd, udev }:
+, glib, readline, pcre, systemd, udev, iproute2 }:
 
 stdenv.mkDerivation {
   pname = "miraclecast";
-  version = "1.0-20190403";
+  version = "1.0-20231112";
 
   src = fetchFromGitHub {
     owner  = "albfan";
     repo   = "miraclecast";
-    rev    = "960a785e10523cc525885380dd03aa2c5ba11bc7";
-    sha256 = "05afqi33rv7k6pbkkw4mynj6p97vkzhhh13y5nh0yxkyhcgf45pm";
+    rev    = "af6ab257eae83bb0270a776a8fe00c0148bc53c4";
+    hash   = "sha256-3ZIAvA3w/ZhoJtVmUD444nch0PGD58PdBRke7zd9IuQ=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
 
-  buildInputs = [ glib pcre readline systemd udev ];
+  buildInputs = [ glib pcre readline systemd udev iproute2 ];
 
   mesonFlags = [
     "-Drely-udev=true"
     "-Dbuild-tests=true"
+    "-Dip-binary=${iproute2}/bin/ip"
   ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix
index 0fea46da56d29..76b7d3ae1af19 100644
--- a/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "mmc-utils";
-  version = "unstable-2023-10-10";
+  version = "unstable-2024-03-07";
 
   src = fetchzip rec {
     url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/snapshot/mmc-utils-${passthru.rev}.tar.gz";
-    passthru.rev = "b5ca140312d279ad2f22068fd72a6230eea13436";
-    sha256 = "QU4r8eajrrhT6u6WHEf1xtB1iyecBeHxu4vS+QcwAgM=";
+    passthru.rev = "e1281d4de9166b7254ba30bb58f9191fc2c9e7fb";
+    sha256 = "/lkcZ/ArdBAStV9usavrbfjULXenqb+h2rbDJzxZjJk=";
   };
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "prefix=$(out)" ];
@@ -28,6 +28,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Configure MMC storage devices from userspace";
+    mainProgram = "mmc";
     homepage = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/";
     license = licenses.gpl2Only;
     maintainers = [ maintainers.dezgeg ];
diff --git a/pkgs/os-specific/linux/msr/default.nix b/pkgs/os-specific/linux/msr/default.nix
index 0ffc460120965..630fc983690d2 100644
--- a/pkgs/os-specific/linux/msr/default.nix
+++ b/pkgs/os-specific/linux/msr/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://www.etallen.com/msr.html";
     description = "Linux tool to display or modify x86 model-specific registers (MSRs)";
+    mainProgram = "msr";
     license = licenses.bsd0;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index 9185f50674ff9..a90a8716cca92 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -12,12 +12,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mwprocapture";
-  subVersion = "4373";
+  subVersion = "4390";
   version = "1.3.0.${subVersion}-${kernel.version}";
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "sha256-/6q+6CTlgkHOgq1PF8dSPfl/xm/UFczr/AGkac2mXZ8=";
+    sha256 = "sha256-HOVAR9auc8ulENPLoI0scdCMZoSbDYkTaCLgZoFG7eU=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/ndiswrapper/default.nix b/pkgs/os-specific/linux/ndiswrapper/default.nix
index 2db046e6392f6..39a8d919d8be6 100644
--- a/pkgs/os-specific/linux/ndiswrapper/default.nix
+++ b/pkgs/os-specific/linux/ndiswrapper/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, kernel, perl, kmod, libelf }:
+{ lib, stdenv, fetchurl, kernel, perl, kmod, elfutils }:
 let
   version = "1.63";
 in
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     sha256 = "1v6b66jhisl110jfl00hm43lmnrav32vs39d85gcbxrjqnmcx08g";
   };
 
-  buildInputs = [ perl libelf ];
+  buildInputs = [ perl elfutils ];
 
   meta = {
     description = "Ndis driver wrapper for the Linux kernel";
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index d7d04e8368db4..68386173ed505 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Network monitoring module for atop";
+    mainProgram = "netatopd";
     homepage = "https://www.atoptool.nl/downloadnetatop.php";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/os-specific/linux/nix-ld/default.nix
deleted file mode 100644
index 208c59ab7576e..0000000000000
--- a/pkgs/os-specific/linux/nix-ld/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, meson
-, ninja
-, nixosTests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "nix-ld";
-  version = "1.2.3";
-
-  src = fetchFromGitHub {
-    owner = "mic92";
-    repo = "nix-ld";
-    rev = version;
-    hash = "sha256-h+odOVyiGmEERMECoFOj5P7FPiMR8IPRzroFA4sKivg=";
-  };
-
-  doCheck = true;
-
-  nativeBuildInputs = [ meson ninja ];
-
-  mesonFlags = [
-    "-Dnix-system=${stdenv.system}"
-  ];
-
-  hardeningDisable = [
-    "stackprotector"
-  ];
-
-  postInstall = ''
-    mkdir -p $out/nix-support
-
-    ldpath=/${stdenv.hostPlatform.libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
-    echo "$ldpath" > $out/nix-support/ldpath
-    mkdir -p $out/lib/tmpfiles.d/
-    cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
-      L+ $ldpath - - - - $out/libexec/nix-ld
-    EOF
-  '';
-
-  passthru.tests.nix-ld = nixosTests.nix-ld;
-
-  meta = with lib; {
-    description = "Run unpatched dynamic binaries on NixOS";
-    homepage = "https://github.com/Mic92/nix-ld";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index 4849ff75c54ab..17a9bc51732ca 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -1,5 +1,5 @@
 { callPackage
-, substituteAll
+, substitute
 , runtimeShell
 , coreutils
 , gnused
@@ -14,19 +14,25 @@
 let
   fallback = import ./../../../../nixos/modules/installer/tools/nix-fallback-paths.nix;
 in
-substituteAll {
+substitute {
   name = "nixos-rebuild";
   src = ./nixos-rebuild.sh;
   dir = "bin";
   isExecutable = true;
-  inherit runtimeShell nix;
-  nix_x86_64_linux = fallback.x86_64-linux;
-  nix_i686_linux = fallback.i686-linux;
-  nix_aarch64_linux = fallback.aarch64-linux;
-  path = lib.makeBinPath [ coreutils gnused gnugrep jq util-linux ];
+
+  substitutions = [
+    "--subst-var-by" "runtimeShell" runtimeShell
+    "--subst-var-by" "nix" nix
+    "--subst-var-by" "nix_x86_64_linux" fallback.x86_64-linux
+    "--subst-var-by" "nix_i686_linux" fallback.i686-linux
+    "--subst-var-by" "nix_aarch64_linux" fallback.aarch64-linux
+    "--subst-var-by" "path" (lib.makeBinPath [ coreutils gnused gnugrep jq util-linux ])
+  ];
+
   nativeBuildInputs = [
     installShellFiles
   ];
+
   postInstall = ''
     installManPage ${./nixos-rebuild.8}
 
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 1868f6b2af1bd..30a1e4dd8b6f0 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -559,11 +559,16 @@ if [ "$action" = repl ]; then
         blue="$(echo -e '\033[34;1m')"
         attention="$(echo -e '\033[35;1m')"
         reset="$(echo -e '\033[0m')"
+        if [[ -e $flake ]]; then
+            flakePath=$(realpath "$flake")
+        else
+            flakePath=$flake
+        fi
         # This nix repl invocation is impure, because usually the flakeref is.
         # For a solution that preserves the motd and custom scope, we need
         # something like https://github.com/NixOS/nix/issues/8679.
         exec nix repl --impure --expr "
-          let flake = builtins.getFlake ''$flake'';
+          let flake = builtins.getFlake ''$flakePath'';
               configuration = flake.$flakeAttr;
               motd = ''
                 $d{$q\n$q}
@@ -756,7 +761,7 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
         "-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
         "--collect"
         "--no-ask-password"
-        "--pty"
+        "--pipe"
         "--quiet"
         "--same-dir"
         "--service-type=exec"
diff --git a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
index 1161ff84664d3..c17546851cbf5 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
@@ -113,7 +113,7 @@ runCommand "test-nixos-rebuild-repl" {
 
   # cat -n ~/flake.nix
 
-  expect ${writeText "test-nixos-rebuild-repl-expect" ''
+  expect ${writeText "test-nixos-rebuild-repl-absolute-path-expect" ''
     ${expectSetup}
     spawn sh -c "nixos-rebuild repl --fast --flake path:\$HOME#testconf"
 
@@ -138,6 +138,19 @@ runCommand "test-nixos-rebuild-repl" {
     send "lib?nixos\n"
     expect_simple "true"
   ''}
+
+  pushd "$HOME"
+  expect ${writeText "test-nixos-rebuild-repl-relative-path-expect" ''
+    ${expectSetup}
+    spawn sh -c "nixos-rebuild repl --fast --flake .#testconf"
+
+    expect_simple "nix-repl>"
+
+    send "config.networking.hostName\n"
+    expect_simple "itsme"
+  ''}
+  popd
+
   echo
 
   #########
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 30285f9c5b254..9e3a6667d7054 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "AIX & Linux Performance Monitoring tool";
+    mainProgram = "nmon";
     homepage = "https://nmon.sourceforge.net";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/nsncd/default.nix b/pkgs/os-specific/linux/nsncd/default.nix
index 01cb6695b330e..0ad11ee8b79f8 100644
--- a/pkgs/os-specific/linux/nsncd/default.nix
+++ b/pkgs/os-specific/linux/nsncd/default.nix
@@ -26,6 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "the name service non-caching daemon";
+    mainProgram = "nsncd";
     longDescription = ''
       nsncd is a nscd-compatible daemon that proxies lookups, without caching.
     '';
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index 24fc9e188741e..2eabbc95fa13b 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A user-level daemon that monitors NUMA topology and processes resource consumption to facilitate good NUMA resource access";
+    mainProgram = "numad";
     homepage = "https://fedoraproject.org/wiki/Features/numad";
     license = licenses.lgpl21;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/numatop/default.nix b/pkgs/os-specific/linux/numatop/default.nix
index f4995264b09ed..159afa467dc3d 100644
--- a/pkgs/os-specific/linux/numatop/default.nix
+++ b/pkgs/os-specific/linux/numatop/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool for runtime memory locality characterization and analysis of processes and threads on a NUMA system";
+    mainProgram = "numatop";
     homepage = "https://01.org/numatop";
     license = licenses.bsd3;
     maintainers = with maintainers; [ dtzWill ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 449ff8042a704..dfa92cc8a3617 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,14 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "535.154.05";
-    sha256_64bit = "sha256-fpUGXKprgt6SYRDxSCemGXLrEsIA6GOinp+0eGbqqJg=";
-    sha256_aarch64 = "sha256-G0/GiObf/BZMkzzET8HQjdIcvCSqB1uhsinro2HLK9k=";
-    openSha256 = "sha256-wvRdHguGLxS0mR06P5Qi++pDJBCF8pJ8hr4T8O6TJIo=";
-    settingsSha256 = "sha256-9wqoDEWY4I7weWW05F4igj1Gj9wjHsREFMztfEmqm10=";
-    persistencedSha256 = "sha256-d0Q3Lk80JqkS1B54Mahu2yY/WocOqFFbZVBh+ToGhaE=";
-
-    patches = [ rcu_patch ];
+    version = "550.67";
+    sha256_64bit = "sha256-mSAaCccc/w/QJh6w8Mva0oLrqB+cOSO1YMz1Se/32uI=";
+    sha256_aarch64 = "sha256-+UuK0UniAsndN15VDb/xopjkdlc6ZGk5LIm/GNs5ivA=";
+    openSha256 = "sha256-M/1qAQxTm61bznAtCoNQXICfThh3hLqfd0s1n1BFj2A=";
+    settingsSha256 = "sha256-FUEwXpeUMH1DYH77/t76wF1UslkcW721x9BHasaRUaM=";
+    persistencedSha256 = "sha256-ojHbmSAOYl3lOi2X6HOBlokTXhTCK6VNsH6+xfGQsyo=";
   };
 
   latest = selectHighestVersion production (generic {
@@ -66,11 +64,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.55";
+    version = "550.40.59";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-i9FYgSZW0vLMEORg16+LxFBOacXXrAfWKbtCFuD8+IQ=";
-    openSha256 = "sha256-slb058rNKk/TEltGkdw6Shn/3SF3kjgsXQc8IyFMUB8=";
+    sha256_64bit = "sha256-hVwYC454vkxcK8I9bj1kp6iFS667em0c+Ral243C0J8=";
+    openSha256 = "sha256-/v1iVcmHhdvib54LDktNBHkcmgFxZVwQxwPdWSi0l/U=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index b7e94d3938aa0..d909e331871be 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -4,7 +4,6 @@
 , libnvme
 , json_c
 , zlib
-, libhugetlbfs
 , python3Packages
 }:
 
diff --git a/pkgs/os-specific/linux/nvmet-cli/default.nix b/pkgs/os-specific/linux/nvmet-cli/default.nix
index 4196efeae6726..eafa8501cdb76 100644
--- a/pkgs/os-specific/linux/nvmet-cli/default.nix
+++ b/pkgs/os-specific/linux/nvmet-cli/default.nix
@@ -18,6 +18,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "NVMe target CLI";
+    mainProgram = "nvmetcli";
     license = licenses.asl20;
     platforms = platforms.linux;
     maintainers = with maintainers; [ hoverbear ];
diff --git a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 61a27bd51f029..4f499197fbfde 100644
--- a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -53,6 +53,7 @@ buildGoModule rec {
     description = ''
       OCI hook to trace syscalls and generate a seccomp profile
     '';
+    mainProgram = "oci-seccomp-bpf-hook";
     license = licenses.asl20;
     maintainers = with maintainers; [ saschagrunert ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/oddjob/default.nix b/pkgs/os-specific/linux/oddjob/default.nix
index bcbea9086488d..1ade48c896972 100644
--- a/pkgs/os-specific/linux/oddjob/default.nix
+++ b/pkgs/os-specific/linux/oddjob/default.nix
@@ -1,12 +1,15 @@
-{ lib
-, fetchurl
-, stdenv
-, autoreconfHook
-, dbus
-, libxml2
-, pam
-, pkg-config
-, systemd
+{
+  autoreconfHook,
+  dbus,
+  fetchpatch,
+  fetchurl,
+  lib,
+  libxml2,
+  nixosTests,
+  pam,
+  pkg-config,
+  stdenv,
+  systemd,
 }:
 
 stdenv.mkDerivation rec {
@@ -14,34 +17,36 @@ stdenv.mkDerivation rec {
   version = "0.34.7";
 
   src = fetchurl {
-     url = "https://pagure.io/oddjob/archive/${pname}-${version}/oddjob-${pname}-${version}.tar.gz";
-     hash = "sha256-SUOsMH55HtEsk5rX0CXK0apDObTj738FGOaL5xZRnIM=";
+    url = "https://pagure.io/oddjob/archive/${pname}-${version}/oddjob-${pname}-${version}.tar.gz";
+    hash = "sha256-SUOsMH55HtEsk5rX0CXK0apDObTj738FGOaL5xZRnIM=";
   };
 
+  patches = [
+    # Define SystemD service location using `with-systemdsystemunitdir` configure flag
+    (fetchpatch {
+      url = "https://pagure.io/oddjob/c/f63287a35107385dcb6e04a4c742077c9d1eab86.patch";
+      hash = "sha256-2mmw4pJhrIk4/47FM8zKH0dTQJWnntHPNmq8VAUWqJI=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
 
-  buildInputs =[
-    libxml2
+  buildInputs = [
     dbus
+    libxml2
     pam
     systemd
   ];
 
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd 2> /dev/null`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}" \
-      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}"
-  '';
-
   configureFlags = [
     "--prefix=${placeholder "out"}"
     "--sysconfdir=${placeholder "out"}/etc"
     "--with-selinux-acls=no"
     "--with-selinux-labels=no"
-    "--disable-systemd"
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
   ];
 
   postConfigure = ''
@@ -49,12 +54,19 @@ stdenv.mkDerivation rec {
       --replace "globals.selinux_enabled" "FALSE"
   '';
 
-  meta = with lib; {
+  # Requires a dbus-daemon environment
+  doCheck = false;
+
+  passthru.tests = {
+    inherit (nixosTests) oddjobd;
+  };
+
+  meta = {
+    changelog = "https://pagure.io/oddjob/blob/oddjob-${version}/f/ChangeLog";
     description = "Odd Job Daemon";
     homepage = "https://pagure.io/oddjob";
-    changelog = "https://pagure.io/oddjob/blob/oddjob-${version}/f/ChangeLog";
-    license = licenses.bsd0;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ SohamG ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ SohamG ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 7ac560824db8c..d48a87216d469 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
 , autoreconfHook
 , pkg-config
 , dpdk
@@ -10,19 +10,22 @@
 , numactl
 , openssl
 , zlib
+, zstd
 , libbsd
-, libelf
+, elfutils
 , jansson
 , libnl
 }:
 
 stdenv.mkDerivation rec {
   pname = "odp-dpdk";
-  version = "1.42.0.0_DPDK_22.11";
+  version = "1.44.0.0_DPDK_22.11";
 
-  src = fetchurl {
-    url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${pname}-${version}.tar.gz";
-    hash = "sha256-qtdqYE4+ab6/9Z0YXXCItcfj+3+gyprcNMAnAZkl4GA=";
+  src = fetchFromGitHub {
+    owner = "OpenDataPlane";
+    repo = "odp-dpdk";
+    rev = "v${version}";
+    hash = "sha256-hYtQ7kKB08BImkTYXqtnv1Ny1SUPCs6GX7WOYks8iKA=";
   };
 
   nativeBuildInputs = [
@@ -37,19 +40,14 @@ stdenv.mkDerivation rec {
     numactl
     openssl
     zlib
+    zstd
     libbsd
-    libelf
+    elfutils
     jansson
     libbpf
     libnl
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    # Needed with GCC 12
-    "-Wno-error=maybe-uninitialized"
-    "-Wno-error=uninitialized"
-  ];
-
   # binaries will segfault otherwise
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/openrazer/driver.nix b/pkgs/os-specific/linux/openrazer/driver.nix
index f98fe5cfc743c..a2116797824cc 100644
--- a/pkgs/os-specific/linux/openrazer/driver.nix
+++ b/pkgs/os-specific/linux/openrazer/driver.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation (common // {
 
   meta = common.meta // {
     description = "An entirely open source Linux driver that allows you to manage your Razer peripherals on GNU/Linux";
+    mainProgram = "razer_mount";
     broken = kernel.kernelOlder "4.19";
   };
 })
diff --git a/pkgs/os-specific/linux/otpw/default.nix b/pkgs/os-specific/linux/otpw/default.nix
index c379c149a358f..45d0b77906d34 100644
--- a/pkgs/os-specific/linux/otpw/default.nix
+++ b/pkgs/os-specific/linux/otpw/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A one-time password login package";
+    mainProgram = "otpw-gen";
     homepage = "http://www.cl.cam.ac.uk/~mgk25/otpw.html";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/os-specific/linux/pagemon/default.nix b/pkgs/os-specific/linux/pagemon/default.nix
index 2ce723913578d..c05bd6183fc48 100644
--- a/pkgs/os-specific/linux/pagemon/default.nix
+++ b/pkgs/os-specific/linux/pagemon/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     inherit (src.meta) homepage;
     description = "Interactive memory/page monitor for Linux";
+    mainProgram = "pagemon";
     longDescription = ''
       pagemon is an ncurses based interactive memory/page monitoring tool
       allowing one to browse the memory map of an active running process
diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
index 4b2cc7a3822bd..359636e742814 100644
--- a/pkgs/os-specific/linux/pam_ccreds/default.nix
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.padl.com/OSS/pam_ccreds.html";
     description = "PAM module to locally authenticate using an enterprise identity when the network is unavailable";
+    mainProgram = "ccreds_chkpwd";
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/pam_rssh/default.nix b/pkgs/os-specific/linux/pam_rssh/default.nix
index 2da53d4627909..8b4224d6f4dfe 100644
--- a/pkgs/os-specific/linux/pam_rssh/default.nix
+++ b/pkgs/os-specific/linux/pam_rssh/default.nix
@@ -1,11 +1,12 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, coreutils
-, pkg-config
-, openssl
-, pam
-, openssh
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  coreutils,
+  pkg-config,
+  openssl,
+  pam,
+  openssh,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,9 +29,7 @@ rustPlatform.buildRustPackage rec {
       --replace '/bin/false' '${coreutils}/bin/false'
   '';
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     openssl
@@ -42,9 +41,7 @@ rustPlatform.buildRustPackage rec {
     "--skip=tests::parse_user_authorized_keys"
   ];
 
-  nativeCheckInputs = [
-    openssh
-  ];
+  nativeCheckInputs = [ (openssh.override { dsaKeysSupport = true; }) ];
 
   env.USER = "nixbld";
 
diff --git a/pkgs/os-specific/linux/pam_tmpdir/default.nix b/pkgs/os-specific/linux/pam_tmpdir/default.nix
index 859ebedc33408..2eee7c92f5c30 100644
--- a/pkgs/os-specific/linux/pam_tmpdir/default.nix
+++ b/pkgs/os-specific/linux/pam_tmpdir/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://tracker.debian.org/pkg/pam-tmpdir";
     description = "PAM module for creating safe per-user temporary directories";
+    mainProgram = "pam-tmpdir-helper";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index da9928a66e3b4..fbb0e00ebe911 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A tool for controlling PaX flags on a per binary basis";
+    mainProgram = "paxctl";
     homepage    = "https://pax.grsecurity.net";
     license     = licenses.gpl2;
     platforms   = platforms.all;
diff --git a/pkgs/os-specific/linux/paxtest/default.nix b/pkgs/os-specific/linux/paxtest/default.nix
index aae8c1296c630..acea7cbe49f77 100644
--- a/pkgs/os-specific/linux/paxtest/default.nix
+++ b/pkgs/os-specific/linux/paxtest/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Test various memory protection measures";
+    mainProgram = "paxtest";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin joachifm ];
diff --git a/pkgs/os-specific/linux/pcimem/default.nix b/pkgs/os-specific/linux/pcimem/default.nix
index dda4d0fff0b92..2f41e4c7395e6 100644
--- a/pkgs/os-specific/linux/pcimem/default.nix
+++ b/pkgs/os-specific/linux/pcimem/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Simple method of reading and writing to memory registers on a PCI card";
+    mainProgram = "pcimem";
     homepage = "https://github.com/billfarrow/pcimem";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/pcm/default.nix b/pkgs/os-specific/linux/pcm/default.nix
index 7a86a58ffa124..e464d113e2f73 100644
--- a/pkgs/os-specific/linux/pcm/default.nix
+++ b/pkgs/os-specific/linux/pcm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202401";
+  version = "202403";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    hash = "sha256-S4E9q4pdF9pT0ehKkeOMbJEFlTV9zB15BZA0R+cjVi8=";
+    hash = "sha256-qefqtuxRaQEsWpXNAuGxuIT3LiH2b8xQb54B0RkzKGA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/os-specific/linux/pflask/default.nix b/pkgs/os-specific/linux/pflask/default.nix
index 1270a9b9494f5..0394a3311ba27 100644
--- a/pkgs/os-specific/linux/pflask/default.nix
+++ b/pkgs/os-specific/linux/pflask/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Lightweight process containers for Linux";
+    mainProgram = "pflask";
     homepage = "https://ghedo.github.io/pflask/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index 39b0eaf5325ed..b1508dcb6a3ed 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -33,6 +33,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "GTK frontend for ratbagd mouse config daemon";
+    mainProgram = "piper";
     homepage    = "https://github.com/libratbag/piper";
     license     = licenses.gpl2;
     maintainers = with maintainers; [ mvnetbiz ];
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 3591303a8d0c1..56d192ad308b4 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
   '';
   meta = with lib; {
     description = "Software-Defined Networking tools for LXC";
+    mainProgram = "pipework";
     homepage = "https://github.com/jpetazzo/pipework";
     license = licenses.asl20;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index b81bf74a3d9e0..66971444e71a9 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -18,23 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "pktgen";
-  version = "22.07.1";
+  version = "23.10.0";
 
   src = fetchFromGitHub {
     owner = "pktgen";
     repo = "Pktgen-DPDK";
     rev = "pktgen-${version}";
-    sha256 = "sha256-wBLGwVdn3ymUTVv7J/kbQYz4WNIgV246PHg51+FStUo=";
+    sha256 = "sha256-eujVEU+XkxF1kIGQJoBW3oXXNSqBEzx6mwR2XYoHinM=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Ealier DPDK deprecated some macros, which were finally removed in >= 22.11
-      url = "https://github.com/pktgen/Pktgen-DPDK/commit/089ef94ac04629f7380f5e618443bcacb2cef5ab.patch";
-      sha256 = "sha256-ITU/dIfu7QPpdIVYuCuDhDG9rVF+n8i1YYn9bFmQUME=";
-    })
-  ];
-
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [
@@ -47,9 +39,7 @@ stdenv.mkDerivation rec {
   GUI = lib.optionalString withGtk "true";
 
   env.NIX_CFLAGS_COMPILE = toString [
-    # Needed with GCC 12
-    "-Wno-error=address"
-    "-Wno-error=use-after-free"
+    "-Wno-error=sign-compare"
   ];
 
   # requires symbols from this file
diff --git a/pkgs/os-specific/linux/ply/default.nix b/pkgs/os-specific/linux/ply/default.nix
index dbd8925a5cb33..0c8e323b43494 100644
--- a/pkgs/os-specific/linux/ply/default.nix
+++ b/pkgs/os-specific/linux/ply/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Dynamic tracing in Linux";
+    mainProgram = "ply";
     homepage = "https://wkz.github.io/ply/";
     license = [ licenses.gpl2Only ];
     maintainers = with maintainers; [ mic92 mbbx6spp ];
diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix
index 113cedfab2e92..f92a9c1b5d1df 100644
--- a/pkgs/os-specific/linux/pommed-light/default.nix
+++ b/pkgs/os-specific/linux/pommed-light/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A trimmed version of the pommed hotkey handler for MacBooks";
+    mainProgram = "pommed";
     longDescription = ''
       This is a stripped-down version of pommed with client, dbus, and
       ambient light sensor support removed, optimized for use with dwm
diff --git a/pkgs/os-specific/linux/power-calibrate/default.nix b/pkgs/os-specific/linux/power-calibrate/default.nix
index d4ae90cddd7cd..d2ce5d4d4fa7e 100644
--- a/pkgs/os-specific/linux/power-calibrate/default.nix
+++ b/pkgs/os-specific/linux/power-calibrate/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool to calibrate power consumption";
+    mainProgram = "power-calibrate";
     homepage = "https://github.com/ColinIanKing/power-calibrate";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index dcf146a01fa6a..11f26e5013a82 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, bash-completion
 , pkg-config
 , meson
 , mesonEmulatorHook
@@ -25,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "power-profiles-daemon";
-  version = "0.20";
+  version = "0.21";
 
   outputs = [ "out" "devdoc" ];
 
@@ -34,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "upower";
     repo = "power-profiles-daemon";
     rev = version;
-    sha256 = "sha256-8wSRPR/1ELcsZ9K3LvSNlPcJvxRhb/LRjTIxKtdQlCA=";
+    sha256 = "sha256-5JbMbz38SeNEkVKFjJLxeUHiOrx+QCaK/vXgRPbzwzY=";
   };
 
   nativeBuildInputs = [
@@ -53,12 +54,15 @@ stdenv.mkDerivation rec {
       pygobject3
       dbus-python
       python-dbusmock
+      argparse-manpage
+      shtab
     ]))
   ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     mesonEmulatorHook
   ];
 
   buildInputs = [
+    bash-completion
     libgudev
     systemd
     upower
@@ -84,6 +88,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "-Dgtk_doc=true"
+    "-Dpylint=disabled"
+    "-Dzshcomp=${placeholder "out"}/share/zsh/site-functions"
     "-Dtests=${lib.boolToString (stdenv.buildPlatform.canExecute stdenv.hostPlatform)}"
   ];
 
@@ -109,8 +115,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://gitlab.freedesktop.org/hadess/power-profiles-daemon";
     description = "Makes user-selected power profiles handling available over D-Bus";
+    mainProgram = "powerprofilesctl";
     platforms = platforms.linux;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ mvnetbiz ];
+    maintainers = with maintainers; [ mvnetbiz picnoir ];
   };
 }
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index 23378b67b4b57..83f0aa634efa9 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Laptop power measuring tool";
+    mainProgram = "powerstat";
     homepage = "https://github.com/ColinIanKing/powerstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 481cf1cd3bb51..756bd99816fbd 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     inherit (src.meta) homepage;
     changelog = "https://github.com/fenrus75/powertop/releases/tag/v${version}";
     description = "Analyze power consumption on Intel-based laptops";
+    mainProgram = "powertop";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ fpletz anthonyroussel ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index f8196dba61571..6acb8eba38633 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "19.2.1-54832";
+  version = "19.3.0-54924";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-PmQSGoJbB0+Q7t56FOFxOVQ86CJLqAa6PTnWLx5CzpA=";
+    hash = "sha256-Hj1manQSZHiht6mmWes44RVk2Bdqp6QdNCdK322bzWc=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/procdump/default.nix b/pkgs/os-specific/linux/procdump/default.nix
index 05ec4b90ed702..0d648782e38c4 100644
--- a/pkgs/os-specific/linux/procdump/default.nix
+++ b/pkgs/os-specific/linux/procdump/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A Linux version of the ProcDump Sysinternals tool";
+    mainProgram = "procdump";
     homepage = "https://github.com/Microsoft/ProcDump-for-Linux";
     license = licenses.mit;
     maintainers = with maintainers; [ c0bw3b ];
diff --git a/pkgs/os-specific/linux/pscircle/default.nix b/pkgs/os-specific/linux/pscircle/default.nix
index a7ee92beb52be..712eea0c3651e 100644
--- a/pkgs/os-specific/linux/pscircle/default.nix
+++ b/pkgs/os-specific/linux/pscircle/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://gitlab.com/mildlyparallel/pscircle";
     description = "Visualize Linux processes in a form of a radial tree";
+    mainProgram = "pscircle";
     license = licenses.gpl2;
     maintainers = [ maintainers.ldesgoui ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix
index f269c9146df44..0f920eeafb5da 100644
--- a/pkgs/os-specific/linux/psmisc/default.nix
+++ b/pkgs/os-specific/linux/psmisc/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "psmisc";
-  version = "23.6";
+  version = "23.7";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-TjnOn8a7HAgt11zcM0i5DM5ERmsvLJHvo1e5FOsl6IA=";
+    hash = "sha256-49YpdIh0DxLHfxos4sw1HUkV0XQBqmm4M9b0T4eN2xI=";
   };
 
   nativeBuildInputs = [ autoconf automake gettext ];
diff --git a/pkgs/os-specific/linux/qperf/default.nix b/pkgs/os-specific/linux/qperf/default.nix
index a074cde448d9b..896b5f5c1ff48 100644
--- a/pkgs/os-specific/linux/qperf/default.nix
+++ b/pkgs/os-specific/linux/qperf/default.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Measure RDMA and IP performance";
+    mainProgram = "qperf";
     homepage = "https://github.com/linux-rdma/qperf";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index 9e9cb5845e4e6..49e2fdfd90b52 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Top-like tool for viewing AMD Radeon GPU utilization";
+    mainProgram = "radeontop";
     longDescription = ''
       View GPU utilization, both for the total activity percent and individual
       blocks. Supports R600 and later cards: even Southern Islands should work.
diff --git a/pkgs/os-specific/linux/rasdaemon/default.nix b/pkgs/os-specific/linux/rasdaemon/default.nix
index c65a11fe85251..35478732fb8cc 100644
--- a/pkgs/os-specific/linux/rasdaemon/default.nix
+++ b/pkgs/os-specific/linux/rasdaemon/default.nix
@@ -2,6 +2,7 @@
 , autoreconfHook, pkg-config
 , glibcLocales, kmod, coreutils, perl
 , dmidecode, hwdata, sqlite, libtraceevent
+, fetchpatch
 , nixosTests
 }:
 
@@ -16,6 +17,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-BX3kc629FOh5cnD6Sa/69wKdhmhT3Rpz5ZvhnD4MclQ=";
   };
 
+  patches = [
+    (fetchpatch { # fix #295002 (segfault on AMD), will be in the release after 0.8.0
+      name = "fix crash on AMD";
+      url = "https://github.com/mchehab/rasdaemon/commit/f1ea76375281001cdf4a048c1a4a24d86c6fbe48.patch";
+      hash = "sha256-1VPDTrAsvZGiGbh52EUdG6tYV/n6wUS0mphOSXzran0=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 7014e3b095f49..9ddb211ba0d57 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "50.0";
+  version = "51.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PJlbY7QR9b2eVaALpuq/67kRTc91HEhs9Wl7WXtSLmA=";
+    hash = "sha256-G5Z2BbmF5fzOg/32BBgGpC6yroDFOnZWtA/+5QatQ1M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/reap/default.nix b/pkgs/os-specific/linux/reap/default.nix
index fbbabc96c781b..79bfe29362768 100644
--- a/pkgs/os-specific/linux/reap/default.nix
+++ b/pkgs/os-specific/linux/reap/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/leahneukirchen/reap";
     description = "run process until all its spawned processes are dead ";
+    mainProgram = "reap";
     license = with licenses; [ publicDomain ];
     platforms = platforms.linux;
     maintainers = [ maintainers.leahneukirchen ];
diff --git a/pkgs/os-specific/linux/regionset/default.nix b/pkgs/os-specific/linux/regionset/default.nix
index f685eec194888..07154a1fc9a1b 100644
--- a/pkgs/os-specific/linux/regionset/default.nix
+++ b/pkgs/os-specific/linux/regionset/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
     inherit version;
     homepage = "http://linvdr.org/projects/regionset/";
     description = "Tool for changing the region code setting of DVD players";
+    mainProgram = "regionset";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/reptyr/default.nix b/pkgs/os-specific/linux/reptyr/default.nix
index fadb9df980869..5a9e58c3f6f97 100644
--- a/pkgs/os-specific/linux/reptyr/default.nix
+++ b/pkgs/os-specific/linux/reptyr/default.nix
@@ -40,6 +40,7 @@ in stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [raskin];
     license = lib.licenses.mit;
     description = "Reparent a running program to a new terminal";
+    mainProgram = "reptyr";
     homepage = "https://github.com/nelhage/reptyr";
   };
 }
diff --git a/pkgs/os-specific/linux/rfkill/udev.nix b/pkgs/os-specific/linux/rfkill/udev.nix
index e1a14a80162c2..53cbf68330c64 100644
--- a/pkgs/os-specific/linux/rfkill/udev.nix
+++ b/pkgs/os-specific/linux/rfkill/udev.nix
@@ -50,6 +50,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     homepage = "http://wireless.kernel.org/en/users/Documentation/rfkill";
     description = "Rules+hook for udev to catch rfkill state changes";
+    mainProgram = "rfkill-hook.sh";
     platforms = platforms.linux;
     license = licenses.mit;
   };
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 69d32079d5c76..c6bb4e0cbfcdd 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/heftig/rtkit";
     description = "A daemon that hands out real-time priority to processes";
+    mainProgram = "rtkitctl";
     license = with licenses; [ gpl3 bsd0 ]; # lib is bsd license
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index 0b1522c969729..bef60b52814d8 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8814au";
-  version = "${kernel.version}-unstable-2023-03-21";
+  version = "${kernel.version}-unstable-2024-03-19";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8814au";
-    rev = "6f80699e68fd2a9f2bba3f1a56ca06d1b7992bd8";
-    hash = "sha256-7dv+8vNI1OLLA4SdZQPL87pTS9HR6mGijzWo9WL7vc0=";
+    rev = "d7945c1e0244c83cbbad4da331648246f12eaee9";
+    hash = "sha256-idjHlvyFpQgLGfNAPpZKRnLdXnAogUW3qGHC1WzGVmA=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index 78409b7bd14a2..2f6ab211d32e2 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl88xxau-aircrack";
-  version = "${kernel.version}-unstable-02-05-2023";
+  version = "${kernel.version}-unstable-2024-04-09";
 
   src = fetchFromGitHub {
     owner = "aircrack-ng";
     repo = "rtl8812au";
-    rev = "35308f4dd73e77fa572c48867cce737449dd8548";
-    hash = "sha256-0kHrNsTKRl/xTQpDkIOYqTtcHlytXhXX8h+6guvLmLI=";
+    rev = "63cf0b4584aa8878b0fe8ab38017f31c319bde3d";
+    hash = "sha256-tDsI/ZzsQm9999EpCpDFArfEIg/ueUJEbSYESbGxd4A=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -29,10 +29,12 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with lib; {
-    description = "Aircrack-ng kernel module for Realtek 88XXau network cards\n(8811au, 8812au, 8814au and 8821au chipsets) with monitor mode and injection support.";
+    description = ''
+      Aircrack-ng kernel module for Realtek 88XXau network cards
+      (8811au, 8812au, 8814au and 8821au chipsets) with monitor mode and injection support.'';
     homepage = "https://github.com/aircrack-ng/rtl8812au";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.jethro ];
+    maintainers = [ maintainers.ja1den maintainers.jethro ];
     platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
index fd6b85a4dbd69..5ef6f7c4edbb7 100644
--- a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
+++ b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
@@ -22,7 +22,8 @@ kernel.stdenv.mkDerivation {
     homepage = "https://github.com/Rust-for-Linux/rust-out-of-tree-module";
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.blitz ];
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ]
+      ++ lib.optional (kernel.kernelAtLeast "6.9") "aarch64-linux";
   };
 
 }
diff --git a/pkgs/os-specific/linux/ryzen-smu/default.nix b/pkgs/os-specific/linux/ryzen-smu/default.nix
new file mode 100644
index 0000000000000..7f899f2c2c90c
--- /dev/null
+++ b/pkgs/os-specific/linux/ryzen-smu/default.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+let
+  version = "0.1.5-unstable-2024-01-03";
+
+  ## Upstream has not been merging PRs.
+  ## Nixpkgs maintainers are providing a
+  ## repo with PRs merged until upstream is
+  ## updated.
+  src = fetchFromGitHub {
+    owner = "Cryolitia";
+    repo = "ryzen_smu";
+    rev = "ce1aa918efa33ca79998f0f7d467c04d4b07016c";
+    hash = "sha256-s9SSmbL6ixWqZUKEhrZdxN4xoWgk+8ClZPoKq2FDAAE=";
+  };
+
+  monitor-cpu = stdenv.mkDerivation {
+    pname = "monitor-cpu";
+    inherit version src;
+
+    makeFlags = [
+      "-C userspace"
+    ];
+
+    installPhase = ''
+    runHook preInstall
+
+    install userspace/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+  };
+
+in
+stdenv.mkDerivation {
+  pname = "ryzen-smu-${kernel.version}";
+  inherit version src;
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "TARGET=${kernel.modDirVersion}"
+    "KERNEL_BUILD=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install ryzen_smu.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/ryzen_smu
+    install ${monitor-cpu}/bin/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
+    homepage = "https://gitlab.com/leogx9r/ryzen_smu";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ Cryolitia phdyellow ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "monitor_cpu";
+  };
+}
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index 0744ed2896fff..ef671b2f16c48 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "sha256-Lqq4LNRmqQyeIJfr/+tYdKMEk+P54VnwZAQZcE0ev8Y=";
+    sha256 = "sha256-aNkVP1fuPcb41Qk5YI1loJnqVmamSzoMFyTGkJtrnvg=";
   };
 
   nativeBuildInputs = [ pciutils cmake ];
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
+    mainProgram = "ryzenadj";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
     maintainers = with maintainers; [ rhendric ];
diff --git a/pkgs/os-specific/linux/schedtool/default.nix b/pkgs/os-specific/linux/schedtool/default.nix
index 98d9248e3f425..d3d009db1714b 100644
--- a/pkgs/os-specific/linux/schedtool/default.nix
+++ b/pkgs/os-specific/linux/schedtool/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Query or alter a process' scheduling policy under Linux";
+    mainProgram = "schedtool";
     homepage = "https://freequaos.host.sk/schedtool/";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/sd-switch/default.nix b/pkgs/os-specific/linux/sd-switch/default.nix
index b231f32d42a1e..7750862c34c2c 100644
--- a/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/pkgs/os-specific/linux/sd-switch/default.nix
@@ -19,6 +19,7 @@ in rustPlatform.buildRustPackage {
 
   meta = with lib; {
     description = "A systemd unit switcher for Home Manager";
+    mainProgram = "sd-switch";
     homepage = "https://gitlab.com/rycee/sd-switch";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ rycee ];
diff --git a/pkgs/os-specific/linux/service-wrapper/default.nix b/pkgs/os-specific/linux/service-wrapper/default.nix
index 381f0699697a4..e7aa3ea9d49d3 100644
--- a/pkgs/os-specific/linux/service-wrapper/default.nix
+++ b/pkgs/os-specific/linux/service-wrapper/default.nix
@@ -14,6 +14,7 @@ runCommand name {
 
   meta = with lib; {
     description = "A convenient wrapper for the systemctl commands, borrow from Ubuntu";
+    mainProgram = "service";
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ DerTim1 ];
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 0819ae91fc87a..8e3b0e627d374 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -8,13 +8,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.4.4";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-QCJfFdY4THBurx7G8q/WAzb7b9CwtNNGi5fn9D++BMU=";
+    hash = "sha256-4y4Uhh3O84UbK39j8ACu06/6n7lyHsd8MzODR0FOp3I=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/os-specific/linux/seturgent/default.nix b/pkgs/os-specific/linux/seturgent/default.nix
index 6d83e322ce8f2..b8c02f47d0eeb 100644
--- a/pkgs/os-specific/linux/seturgent/default.nix
+++ b/pkgs/os-specific/linux/seturgent/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     platforms = platforms.linux;
     description = "Set an application's urgency hint (or not)";
+    mainProgram = "seturgent";
     maintainers = with maintainers; [ yarr ];
     homepage = "https://codemadness.org/seturgent-set-urgency-hints-for-x-applications.html";
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 946299366c0a1..8329e9e8f966d 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.14.5";
+  version = "4.14.6";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = pname;
     rev = version;
-    hash = "sha256-ogkPp6dxWHdvJvWcb5iauH81CVTH7BbonFXG1gGysUE=";
+    hash = "sha256-+klU1a0cSgHPwZkDnbCSjKnBUKIm2Z3OGUvR/zrqQxo=";
   };
 
   outputs = [ "out" "su" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index a412461bfd511..3bf73a8f495e1 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A very minimal Linux init implementation from suckless.org";
+    mainProgram = "sinit";
     license = licenses.mit;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix
index e5d7fb1a13b62..05ad1ddb03351 100644
--- a/pkgs/os-specific/linux/smemstat/default.nix
+++ b/pkgs/os-specific/linux/smemstat/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Memory usage monitoring tool";
+    mainProgram = "smemstat";
     homepage = "https://github.com/ColinIanKing/smemstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index a4a0d1dd49ffb..4f27c7e83fb5d 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -5,7 +5,7 @@
   libuuid, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
   nss_wrapper, ncurses, Po4a, http-parser, jansson, jose,
   docbook_xsl, docbook_xml_dtd_44,
-  testers, nix-update-script, nixosTests,
+  testers, nix-update-script, nixosTests, fetchpatch,
   withSudo ? false }:
 
 let
@@ -22,6 +22,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VJXZndbmC6mAVxzvv5Wjb4adrQkP16Rt4cgjl4qGDIc=";
   };
 
+  patches = [
+    # Fix the build with Samba 4.20
+    (fetchpatch {
+      url = "https://github.com/SSSD/sssd/commit/1bf51929a48b84d62ac54f2a42f17e7fbffe1612.patch";
+      hash = "sha256-VLx04APEipp860iOJNIwTGywxZ7rIDdyh3te6m7Ymlo=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs ./sbus_generate.sh.in
   '';
@@ -102,6 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     tests = {
       inherit (nixosTests) sssd sssd-ldap;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
         command = "sssd --version";
@@ -117,5 +126,11 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ illustris ];
+    pkgConfigModules = [
+      "ipa_hbac"
+      "sss_certmap"
+      "sss_idmap"
+      "sss_nss_idmap"
+    ];
   };
 })
diff --git a/pkgs/os-specific/linux/statifier/default.nix b/pkgs/os-specific/linux/statifier/default.nix
index eefd95d1153a9..6aa11cad4f250 100644
--- a/pkgs/os-specific/linux/statifier/default.nix
+++ b/pkgs/os-specific/linux/statifier/default.nix
@@ -18,6 +18,7 @@ multiStdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool for creating static Linux binaries";
+    mainProgram = "statifier";
     platforms = platforms.linux;
     license = licenses.gpl2;
   };
diff --git a/pkgs/os-specific/linux/swapview/default.nix b/pkgs/os-specific/linux/swapview/default.nix
index 8eb4555010527..3ef2426fad937 100644
--- a/pkgs/os-specific/linux/swapview/default.nix
+++ b/pkgs/os-specific/linux/swapview/default.nix
@@ -15,6 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "A simple program to view processes' swap usage on Linux";
+    mainProgram = "swapview";
     homepage = "https://github.com/lilydjwg/swapview";
     platforms = platforms.linux;
     license = with licenses; [ bsd3 ];
diff --git a/pkgs/os-specific/linux/switcheroo-control/default.nix b/pkgs/os-specific/linux/switcheroo-control/default.nix
index a749168f5bc4b..a6993af54910f 100644
--- a/pkgs/os-specific/linux/switcheroo-control/default.nix
+++ b/pkgs/os-specific/linux/switcheroo-control/default.nix
@@ -46,6 +46,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "D-Bus service to check the availability of dual-GPU";
+    mainProgram = "switcherooctl";
     homepage = "https://gitlab.freedesktop.org/hadess/switcheroo-control/";
     changelog = "https://gitlab.freedesktop.org/hadess/switcheroo-control/-/blob/${version}/NEWS";
     license = licenses.gpl3Plus;
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 302404b38e126..25b788104a4c0 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,38 +1,36 @@
 { lib, stdenv, fetchFromGitHub, cmake, kernel, installShellFiles, pkg-config
-, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
-, yaml-cpp, nlohmann_json, re2, zstd, uthash
-}:
+, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb
+, protobuf, grpc, yaml-cpp, nlohmann_json, re2, zstd, uthash }:
 
 let
-  # Compare with https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/falcosecurity-libs.cmake
-  libsRev = "0.14.2";
-  libsHash = "sha256-sWrniRB/vQd1BZnsiz+wLHugrF3LhuAr9e9gDMavLoo=";
+  # Compare with https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/falcosecurity-libs.cmake
+  libsRev = "0.15.1";
+  libsHash = "sha256-CsKa5ybRj7Mjb71xNwd8FtDprOMfpJMrm3mvkeqZE3o=";
 
-  # Compare with https://github.com/falcosecurity/libs/blob/0.14.2/cmake/modules/valijson.cmake
+  # Compare with https://github.com/falcosecurity/libs/blob/0.15.1/cmake/modules/valijson.cmake
   valijson = fetchFromGitHub {
     owner = "tristanpenman";
     repo = "valijson";
-    rev = "v0.6";
-    hash = "sha256-ZD19Q2MxMQd3yEKbY90GFCrerie5/jzgO8do4JQDoKM=";
+    rev = "v1.0.2";
+    hash = "sha256-wvFdjsDtKH7CpbEpQjzWtLC4RVOU9+D2rSK0Xo1cJqo=";
   };
 
-  # https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/driver.cmake
+  # https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/driver.cmake
   driver = fetchFromGitHub {
     owner = "falcosecurity";
     repo = "libs";
     rev = "7.0.0+driver";
     hash = "sha256-kXqvfM7HbGh2wEGaO4KBkFDW+m5gpOShJZKJLu9McKk=";
   };
-in
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.35.3";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    hash = "sha256-wvCnWzQbkkM8qEG93li22P67WX1bGX9orTk+2vsBHZY=";
+    hash = "sha256-EQnmtxByTsSawQPFmTe2pBMcv5rFaNtST+2KXZSFuoo=";
   };
 
   nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
@@ -58,12 +56,14 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "pic" ];
 
   postUnpack = ''
-    cp -r ${fetchFromGitHub {
-      owner = "falcosecurity";
-      repo = "libs";
-      rev = libsRev;
-      hash = libsHash;
-    }} libs
+    cp -r ${
+      fetchFromGitHub {
+        owner = "falcosecurity";
+        repo = "libs";
+        rev = libsRev;
+        hash = libsHash;
+      }
+    } libs
     chmod -R +w libs
 
     substituteInPlace libs/userspace/libscap/libscap.pc.in libs/userspace/libsinsp/libsinsp.pc.in \
@@ -72,6 +72,13 @@ stdenv.mkDerivation rec {
 
     cp -r ${driver} driver-src
     chmod -R +w driver-src
+
+    # Hacky but needed until https://github.com/draios/sysdig/issues/2077 is resolved for kernel >= 6.8 as strlcpy got removed and build fails
+    ${lib.optionalString
+    (kernel != null && lib.versionAtLeast kernel.version "6.8") ''
+      substituteInPlace libs/driver/ppm_events.c driver-src/driver/ppm_events.c --replace-fail "strlcpy" "strscpy"
+    ''}
+
     cmakeFlagsArray+=(
       "-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs"
       "-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver"
@@ -91,10 +98,10 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   env.NIX_CFLAGS_COMPILE =
-   # needed since luajit-2.1.0-beta3
-   "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
-   # fix compiler warnings been treated as errors
-   "-Wno-error";
+    # needed since luajit-2.1.0-beta3
+    "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
+    # fix compiler warnings been treated as errors
+    "-Wno-error";
 
   preConfigure = ''
     if ! grep -q "${libsRev}" cmake/modules/falcosecurity-libs.cmake; then
@@ -107,39 +114,37 @@ stdenv.mkDerivation rec {
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
 
-  postInstall =
-    ''
-      # Fix the bash completion location
-      installShellCompletion --bash $out/etc/bash_completion.d/sysdig
-      rm $out/etc/bash_completion.d/sysdig
-      rmdir $out/etc/bash_completion.d
-      rmdir $out/etc
-    ''
-    + lib.optionalString (kernel != null) ''
-      make install_driver
-      kernel_dev=${kernel.dev}
-      kernel_dev=''${kernel_dev#${builtins.storeDir}/}
-      kernel_dev=''${kernel_dev%%-linux*dev*}
-      if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
-          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
-      else
-          for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
-            if test -f "$i"; then
-              xz -d $i
-              sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
-              xz -9 ''${i%.xz}
-            fi
-          done
-      fi
-    '';
-
+  postInstall = ''
+    # Fix the bash completion location
+    installShellCompletion --bash $out/etc/bash_completion.d/sysdig
+    rm $out/etc/bash_completion.d/sysdig
+    rmdir $out/etc/bash_completion.d
+    rmdir $out/etc
+  '' + lib.optionalString (kernel != null) ''
+    make install_driver
+    kernel_dev=${kernel.dev}
+    kernel_dev=''${kernel_dev#${builtins.storeDir}/}
+    kernel_dev=''${kernel_dev%%-linux*dev*}
+    if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
+        sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
+    else
+        for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
+          if test -f "$i"; then
+            xz -d $i
+            sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
+            xz -9 ''${i%.xz}
+          fi
+        done
+    fi
+  '';
 
   meta = with lib; {
-    description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
+    description =
+      "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
     license = with licenses; [ asl20 gpl2 mit ];
-    maintainers = [maintainers.raskin];
-    platforms = ["x86_64-linux"] ++ platforms.darwin;
-    broken = kernel != null && versionOlder kernel.version "4.14";
+    maintainers = [ maintainers.raskin ];
+    platforms = [ "x86_64-linux" ] ++ platforms.darwin;
+    broken = kernel != null && ((versionOlder kernel.version "4.14") || kernel.isHardened || kernel.isZen);
     homepage = "https://sysdig.com/opensource/";
     downloadPage = "https://github.com/draios/sysdig/releases";
   };
diff --git a/pkgs/os-specific/linux/system76-power/default.nix b/pkgs/os-specific/linux/system76-power/default.nix
index f1a4c9b7bb3b5..6a5456080f593 100644
--- a/pkgs/os-specific/linux/system76-power/default.nix
+++ b/pkgs/os-specific/linux/system76-power/default.nix
@@ -24,6 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "System76 Power Management";
+    mainProgram = "system76-power";
     homepage = "https://github.com/pop-os/system76-power";
     license = licenses.gpl3Plus;
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/system76-scheduler/default.nix b/pkgs/os-specific/linux/system76-scheduler/default.nix
index 99c54900cf71e..0608fd1c10d08 100644
--- a/pkgs/os-specific/linux/system76-scheduler/default.nix
+++ b/pkgs/os-specific/linux/system76-scheduler/default.nix
@@ -35,6 +35,7 @@ in rustPlatform.buildRustPackage {
 
   meta = with lib; {
     description = "System76 Scheduler";
+    mainProgram = "system76-scheduler";
     homepage = "https://github.com/pop-os/system76-scheduler";
     license = licenses.mpl20;
     platforms = [ "x86_64-linux" "x86-linux" "aarch64-linux" ];
diff --git a/pkgs/os-specific/linux/systemd-wait/default.nix b/pkgs/os-specific/linux/systemd-wait/default.nix
index 348549a1bc64a..99e07ebbf49c4 100644
--- a/pkgs/os-specific/linux/systemd-wait/default.nix
+++ b/pkgs/os-specific/linux/systemd-wait/default.nix
@@ -19,6 +19,7 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/Stebalien/systemd-wait";
     license = lib.licenses.gpl3;
     description = "Wait for a systemd unit to enter a specific state";
+    mainProgram = "systemd-wait";
     maintainers = [ lib.maintainers.benley ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 135d61fd71d75..edd11143ad609 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -176,7 +176,7 @@ assert withBootloader -> withEfi;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "255.2";
+  version = "255.4";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -194,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-8SfJY/pcH4yrDeJi0GfIUpetTbpMwyswvSu+RSfgqfY=";
+    hash = "sha256-P1mKq+ythrv8MU7y2CuNtEx6qCDacugzfsPRZL+NPys=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -225,7 +225,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-meson.build-do-not-create-systemdstatedir.patch
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
-  ] ++ lib.optional (stdenv.hostPlatform.isPower || stdenv.hostPlatform.isRiscV) [
+  ] ++ lib.optional (stdenv.hostPlatform.isPower || stdenv.hostPlatform.isRiscV || stdenv.hostPlatform.isMips) [
     # Fixed upstream and included in the main and stable branches. Can be dropped
     # when bumping to >= v255.5.
     # https://github.com/systemd/systemd/issues/30448
@@ -866,7 +866,7 @@ stdenv.mkDerivation (finalAttrs: {
     # needed - and therefore `interfaceVersion` should be incremented.
     interfaceVersion = 2;
 
-    inherit withBootloader withCryptsetup withHostnamed withImportd withKmod
+    inherit withBootloader withCryptsetup withEfi withHostnamed withImportd withKmod
       withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
diff --git a/pkgs/os-specific/linux/tailor-gui/default.nix b/pkgs/os-specific/linux/tailor-gui/default.nix
index 69367ca6c2557..74bfbeafeac9b 100644
--- a/pkgs/os-specific/linux/tailor-gui/default.nix
+++ b/pkgs/os-specific/linux/tailor-gui/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src sourceRoot;
     name = "${pname}-${version}";
-    hash = "sha256-mt4YQ0iB/Mlnm+o9sGgYVEdbxjF7qArxA5FIK4MAZ8M=";
+    hash = "sha256-jcjq0uls28V8Ka2CMM8oOQmZZRUr9eEQeVtW56AmU28=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Rust GUI for interacting with hardware from TUXEDO Computers";
+    mainProgram = "tailor_gui";
     longDescription = ''
       An alternative to the TUXEDO Control Center (https://www.tuxedocomputers.com/en/TUXEDO-Control-Center.tuxedo),
       written in Rust.
diff --git a/pkgs/os-specific/linux/target-isns/default.nix b/pkgs/os-specific/linux/target-isns/default.nix
index fdc0c52a0bf74..397e414490c21 100644
--- a/pkgs/os-specific/linux/target-isns/default.nix
+++ b/pkgs/os-specific/linux/target-isns/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "iSNS client for the Linux LIO iSCSI target";
+    mainProgram = "target-isns";
     homepage = "https://github.com/open-iscsi/target-isns";
     maintainers = [ maintainers.markuskowa ];
     license = licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch b/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
deleted file mode 100644
index 0e98214678502..0000000000000
--- a/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 90b540bd135de2587352719b14c385b20aa572be Mon Sep 17 00:00:00 2001
-From: Raymond Gauthier <jraygauthier@gmail.com>
-Date: Wed, 15 Jun 2022 16:09:58 -0400
-Subject: [PATCH] cmake-find-aravis: fix pkg cfg include dirs
-
----
- cmake/modules/FindAravis.cmake | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/cmake/modules/FindAravis.cmake b/cmake/modules/FindAravis.cmake
-index 5dab5431..811302b9 100644
---- a/cmake/modules/FindAravis.cmake
-+++ b/cmake/modules/FindAravis.cmake
-@@ -20,7 +20,7 @@ find_path(aravis_INCLUDE_DIR
- 	arv.h
- 	PATHS
- 	${aravis_PKGCONF_INCLUDE_DIRS}
--	${aravis0_6_PKGCONF_INCLUDE_DIRS}
-+	${aravis0_8_PKGCONF_INCLUDE_DIRS}
- 	/usr/local/include
- 	# /usr/local/include/aravis-0.4
- 	/usr/local/include/aravis-0.8
--- 
-2.31.1
-
diff --git a/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch b/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
deleted file mode 100644
index 3d1e5503bcd3d..0000000000000
--- a/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 5e7146e176cb1b01b47d16a66763469dccd87f25 Mon Sep 17 00:00:00 2001
-From: Raymond Gauthier <jraygauthier@gmail.com>
-Date: Thu, 9 Jun 2022 19:45:30 -0400
-Subject: [PATCH] tcamconvert&tcamsrc: add missing include/lib dirs
-
-These were building libraries with dependencies on gstreamer-video
-and gstreamer-base but weren't adding the proper include and
-lib directories which resulted in build failure on systems
-where video and base aren't installed in the same location
-as gstreamer itself (e.g: nix, nixos).
----
- src/gstreamer-1.0/tcamconvert/CMakeLists.txt |  2 ++
- src/gstreamer-1.0/tcamsrc/CMakeLists.txt     | 11 +++++++++++
- 2 files changed, 13 insertions(+)
-
-diff --git a/src/gstreamer-1.0/tcamconvert/CMakeLists.txt b/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
-index 30563c38..066cb5d7 100644
---- a/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
-+++ b/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
-@@ -28,6 +28,8 @@ add_library(tcamconvert SHARED
- target_include_directories(tcamconvert
-   PRIVATE
-   ${GSTREAMER_INCLUDE_DIRS}
-+  ${GSTREAMER_BASE_INCLUDE_DIRS}
-+  ${GSTREAMER_VIDEO_INCLUDE_DIRS}
-   )
- 
- set_project_warnings(tcamconvert)
-diff --git a/src/gstreamer-1.0/tcamsrc/CMakeLists.txt b/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
-index 3bc7ed97..ed5be37f 100644
---- a/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
-+++ b/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
-@@ -21,12 +21,15 @@ add_library(gsttcamstatistics SHARED
- target_include_directories(gsttcamstatistics
-   PRIVATE
-   ${GSTREAMER_INCLUDE_DIRS}
-+  ${GSTREAMER_BASE_INCLUDE_DIRS}
-+  ${GSTREAMER_VIDEO_INCLUDE_DIRS}
-   )
- 
- target_link_libraries( gsttcamstatistics
-   PRIVATE
-   ${GSTREAMER_LIBRARIES}
-   ${GSTREAMER_BASE_LIBRARIES}
-+  ${GSTREAMER_VIDEO_LIBRARIES}
-   )
- 
- 
-@@ -53,10 +56,18 @@ add_library(gsttcamsrc SHARED
- 	tcambind.cpp
-     )
- 
-+  target_include_directories(gsttcamsrc
-+    PRIVATE
-+    ${GSTREAMER_INCLUDE_DIRS}
-+    ${GSTREAMER_BASE_INCLUDE_DIRS}
-+    ${GSTREAMER_VIDEO_INCLUDE_DIRS}
-+    )
-+
-   target_link_libraries( gsttcamsrc
-     PRIVATE
- 	${GSTREAMER_LIBRARIES}
- 	${GSTREAMER_BASE_LIBRARIES}
-+    ${GSTREAMER_VIDEO_LIBRARIES}
- 
- 	tcamgstbase
- 	tcam::gst-helper
--- 
-2.31.1
-
diff --git a/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch b/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch
deleted file mode 100644
index 9b373516aa9bc..0000000000000
--- a/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From fdbc0b74812b9afd663226715375b5688e5408b5 Mon Sep 17 00:00:00 2001
-From: Raymond Gauthier <jraygauthier@gmail.com>
-Date: Thu, 9 Jun 2022 20:23:02 -0400
-Subject: [PATCH] udev/rules: fix install location
-
----
- CMakeInstall.cmake | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CMakeInstall.cmake b/CMakeInstall.cmake
-index 4773091f..962c9b09 100644
---- a/CMakeInstall.cmake
-+++ b/CMakeInstall.cmake
-@@ -92,7 +92,7 @@ else()
- 
-   else()
- 
--    set(TCAM_INSTALL_UDEV "${CMAKE_INSTALL_PREFIX}/udev/rules.d" CACHE PATH "udev rules installation path" FORCE)
-+    set(TCAM_INSTALL_UDEV "${CMAKE_INSTALL_PREFIX}/lib/udev/rules.d" CACHE PATH "udev rules installation path" FORCE)
-     set(TCAM_INSTALL_SYSTEMD "${CMAKE_INSTALL_PREFIX}/lib/systemd/system/" CACHE PATH "systemd unit installation path" FORCE)
- 
-     set(TCAM_INSTALL_PKGCONFIG "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig" CACHE PATH "pkgconfig installation path" FORCE)
--- 
-2.31.1
-
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index ce59cea368b19..600655c447f7d 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -19,7 +19,8 @@
 , gobject-introspection
 , gst_all_1
 , wrapGAppsHook
-, withDoc ? true
+  # needs pkg_resources
+, withDoc ? false
 , sphinx
 , graphviz
 , withAravis ? true
@@ -32,21 +33,15 @@
 
 stdenv.mkDerivation rec {
   pname = "tiscamera";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "TheImagingSource";
-    repo = pname;
-    rev = "v-${pname}-${version}";
-    sha256 = "0msz33wvqrji11kszdswcvljqnjflmjpk0aqzmsv6i855y8xn6cd";
+    repo = "tiscamera";
+    rev = "v-tiscamera-${version}";
+    hash = "sha256-33U/8CbqNWIRwfDHXCZSN466WEQj9fip+Z5EJ7kIwRM=";
   };
 
-  patches = [
-    ./0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
-    ./0001-udev-rules-fix-install-location.patch
-    ./0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
-  ];
-
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp external/catch/catch.hpp
 
@@ -110,6 +105,8 @@ stdenv.mkDerivation rec {
     "-DTCAM_INSTALL_FORCE_PREFIX=ON"
   ];
 
+  env.CXXFLAGS = "-include cstdint";
+
   doCheck = true;
 
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index 3a2697e0a712a..a80724f19eb5a 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Monitoring and Testing Tool for Linux kernel thermal subsystem";
+    mainProgram = "tmon";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/tomb/default.nix b/pkgs/os-specific/linux/tomb/default.nix
index 9c97377cfe04f..98dd9bc1dbca0 100644
--- a/pkgs/os-specific/linux/tomb/default.nix
+++ b/pkgs/os-specific/linux/tomb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ stdenvNoCC
 , lib
 , fetchFromGitHub
 , substituteAll
@@ -20,7 +20,7 @@
 , nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "tomb";
   version = "2.10";
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # if not, it shows .tomb-wrapped when running
     substituteInPlace tomb \
-      --replace 'TOMBEXEC=$0' 'TOMBEXEC=tomb'
+      --replace-fail 'TOMBEXEC=$0' 'TOMBEXEC=tomb'
   '';
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/tpacpi-bat/default.nix b/pkgs/os-specific/linux/tpacpi-bat/default.nix
index 455a36eb7aebf..42d8a0f9dbcfe 100644
--- a/pkgs/os-specific/linux/tpacpi-bat/default.nix
+++ b/pkgs/os-specific/linux/tpacpi-bat/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
     maintainers = [lib.maintainers.orbekk];
     platforms = lib.platforms.linux;
     description = "Tool to set battery charging thresholds on Lenovo Thinkpad";
+    mainProgram = "tpacpi-bat";
     license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index d19754cdb5e00..80b20c555b4e0 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "User-space tools for the Linux kernel ftrace subsystem";
+    mainProgram = "trace-cmd";
     homepage    = "https://www.trace-cmd.org/";
     license     = with licenses; [ lgpl21Only gpl2Only ];
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index e0ab2b2802f1a..370620eef2527 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A Linux System call fuzz tester";
+    mainProgram = "trinity";
     homepage = "https://github.com/kernelslacker/trinity";
     license = licenses.gpl2Only;
     maintainers = [ maintainers.dezgeg ];
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index e3101cded09f1..b57169369ca72 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -53,6 +53,7 @@ buildPythonApplication rec {
 
   meta = with lib; {
     description = "Thread and IRQ affinity setting GUI and cmd line tool";
+    mainProgram = "tuna";
     homepage = "https://git.kernel.org/pub/scm/utils/tuna/tuna.git";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/tunctl/default.nix b/pkgs/os-specific/linux/tunctl/default.nix
index e71e349a2516d..5e7fea75b6ab8 100644
--- a/pkgs/os-specific/linux/tunctl/default.nix
+++ b/pkgs/os-specific/linux/tunctl/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://tunctl.sourceforge.net/";
     description = "Utility to set up and maintain TUN/TAP network interfaces";
+    mainProgram = "tunctl";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/turbostat/default.nix b/pkgs/os-specific/linux/turbostat/default.nix
index fb1bcf582fbae..4c51bca386d24 100644
--- a/pkgs/os-specific/linux/turbostat/default.nix
+++ b/pkgs/os-specific/linux/turbostat/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Report processor frequency and idle statistics";
+    mainProgram = "turbostat";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
diff --git a/pkgs/os-specific/linux/tuxedo-rs/default.nix b/pkgs/os-specific/linux/tuxedo-rs/default.nix
index ca48571b7933b..d6b09df678a8b 100644
--- a/pkgs/os-specific/linux/tuxedo-rs/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-rs/default.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tuxedo-rs";
-  version = "0.3.0";
+  version = "0.3.1";
 
   # NOTE: This src is shared with tailor-gui.
   # When updating, the tailor-gui.cargoDeps hash needs to be updated.
@@ -14,14 +14,14 @@ rustPlatform.buildRustPackage rec {
     owner = "AaronErhardt";
     repo = "tuxedo-rs";
     rev = "tailor-v${version}";
-    hash = "sha256-5F9Xo+tnmYqmFiKrKMe+EEqypmG9iIvwai5yuKCm00Y=";
+    hash = "sha256-+NzwUs8TZsA0us9hI1UmEKdiOo9IqTRmTOHs4xmC7MY=";
   };
 
 
   # Some of the tests are impure and rely on files in /etc/tailord
   doCheck = false;
 
-  cargoHash = "sha256-EPbh1elLOJKOrYLeBSaZ27zWGYFajiD60eFGEGaCJKw=";
+  cargoHash = "sha256-HtyCKQ0xDIXevgr4FAnVJcDI8G6vR9fLHFghe9+ADiU=";
 
   passthru.tests.version = testers.testVersion {
     package = tuxedo-rs;
diff --git a/pkgs/os-specific/linux/ulogd/default.nix b/pkgs/os-specific/linux/ulogd/default.nix
index a79a38389e4a7..533db8f19c84a 100644
--- a/pkgs/os-specific/linux/ulogd/default.nix
+++ b/pkgs/os-specific/linux/ulogd/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Userspace logging daemon for netfilter/iptables";
+    mainProgram = "ulogd";
 
     longDescription = ''
       Logging daemon that reads event messages coming from the Netfilter
diff --git a/pkgs/os-specific/linux/ultrablue-server/default.nix b/pkgs/os-specific/linux/ultrablue-server/default.nix
index bb162f1693bac..1d3cc69fae10d 100644
--- a/pkgs/os-specific/linux/ultrablue-server/default.nix
+++ b/pkgs/os-specific/linux/ultrablue-server/default.nix
@@ -23,6 +23,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "User-friendly Lightweight TPM Remote Attestation over Bluetooth";
+    mainProgram = "ultrablue-server";
     homepage = "https://github.com/ANSSI-FR/ultrablue";
     license = licenses.asl20;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/undervolt/default.nix b/pkgs/os-specific/linux/undervolt/default.nix
index 4b9758494dca0..d720031eb8ac3 100644
--- a/pkgs/os-specific/linux/undervolt/default.nix
+++ b/pkgs/os-specific/linux/undervolt/default.nix
@@ -14,6 +14,7 @@ python3Packages.buildPythonApplication rec {
   meta = with lib; {
     homepage = "https://github.com/georgewhewell/undervolt/";
     description = "A program for undervolting Intel CPUs on Linux";
+    mainProgram = "undervolt";
 
     longDescription = ''
       Undervolt is a program for undervolting Intel CPUs under Linux. It works in a similar
diff --git a/pkgs/os-specific/linux/unscd/default.nix b/pkgs/os-specific/linux/unscd/default.nix
index 82b8c70762717..9f77fa01b0ee5 100644
--- a/pkgs/os-specific/linux/unscd/default.nix
+++ b/pkgs/os-specific/linux/unscd/default.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://busybox.net/~vda/unscd/";
     description = "Less buggy replacement for the glibc name service cache daemon";
+    mainProgram = "nscd";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/os-specific/linux/unstick/default.nix b/pkgs/os-specific/linux/unstick/default.nix
index ee82679de4ea3..3c61e26b335ba 100644
--- a/pkgs/os-specific/linux/unstick/default.nix
+++ b/pkgs/os-specific/linux/unstick/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://github.com/kwohlfahrt/unstick";
     description = "Silently eats chmod commands forbidden by Nix";
+    mainProgram = "unstick";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ kwohlfahrt ];
diff --git a/pkgs/os-specific/linux/untie/default.nix b/pkgs/os-specific/linux/untie/default.nix
index 947ae2ca8d8b5..7d96631deb868 100644
--- a/pkgs/os-specific/linux/untie/default.nix
+++ b/pkgs/os-specific/linux/untie/default.nix
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A tool to run processes untied from some of the namespaces";
+    mainProgram = "untie";
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index b0b7b4f6776c0..3b08318c965ea 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , makeWrapper
 , pkg-config
 , libxslt
@@ -51,6 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
     ./i686-test-remove-battery-check.patch
   ] ++ [
     ./installed-tests-path.patch
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/upower/upower/-/merge_requests/207.diff";
+      hash = "sha256-ldr1bKbSAdYpwbbe/Iq9i0Q9zQrHWvIvBGym/F3+vxs=";
+    })
   ];
 
   strictDeps = true;
@@ -211,6 +216,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://upower.freedesktop.org/";
     changelog = "https://gitlab.freedesktop.org/upower/upower/-/blob/v${finalAttrs.version}/NEWS";
     description = "A D-Bus service for power management";
+    mainProgram = "upower";
     maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/usbrelay/default.nix b/pkgs/os-specific/linux/usbrelay/default.nix
index 670de2028c4fa..656808d8389b9 100644
--- a/pkgs/os-specific/linux/usbrelay/default.nix
+++ b/pkgs/os-specific/linux/usbrelay/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "Tool to control USB HID relays";
+    mainProgram = "usbrelay";
     homepage = "https://github.com/darrylb123/usbrelay";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ wentasah ];
diff --git a/pkgs/os-specific/linux/usbtop/default.nix b/pkgs/os-specific/linux/usbtop/default.nix
index fb3d32df09a05..ba97cae68bd0d 100644
--- a/pkgs/os-specific/linux/usbtop/default.nix
+++ b/pkgs/os-specific/linux/usbtop/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/aguinet/usbtop";
     description = "A top utility that shows an estimated instantaneous bandwidth on USB buses and devices";
+    mainProgram = "usbtop";
     maintainers = with maintainers; [ ];
     license = licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 475ccd848eb19..73135da548edc 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/tom5760/usermount";
     description = "A simple tool to automatically mount removable drives using UDisks2 and D-Bus";
+    mainProgram = "usermount";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/v4l2-relayd/default.nix b/pkgs/os-specific/linux/v4l2-relayd/default.nix
index a089ce8c77f8f..77d7034b863be 100644
--- a/pkgs/os-specific/linux/v4l2-relayd/default.nix
+++ b/pkgs/os-specific/linux/v4l2-relayd/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Streaming relay for v4l2loopback using GStreamer";
+    mainProgram = "v4l2-relayd";
     homepage = "https://git.launchpad.net/v4l2-relayd";
     license = licenses.gpl2;
     maintainers = with maintainers; [ betaboon ];
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 1c4a20ae85fed..6fe83fd09effc 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "A kernel module to create V4L2 loopback devices";
+    mainProgram = "v4l2loopback-ctl";
     homepage = "https://github.com/umlaeute/v4l2loopback";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ moni ];
diff --git a/pkgs/os-specific/linux/v86d/default.nix b/pkgs/os-specific/linux/v86d/default.nix
index dbc98344c5ec0..8597cc5ac9f93 100644
--- a/pkgs/os-specific/linux/v86d/default.nix
+++ b/pkgs/os-specific/linux/v86d/default.nix
@@ -39,6 +39,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A daemon to run x86 code in an emulated environment";
+    mainProgram = "v86d";
     homepage = "https://github.com/mjanusz/v86d";
     license = licenses.gpl2;
     maintainers = with maintainers; [ codyopel ];
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index 97818ba9c4d49..ae42c206280da 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -86,6 +86,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = {
     description = "Waydroid is a container-based approach to boot a full Android system on a regular GNU/Linux system like Ubuntu";
+    mainProgram = "waydroid";
     homepage = "https://github.com/waydroid/waydroid";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index 82e104cac3aad..ac1de01af974a 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -24,6 +24,7 @@ mkDerivation {
 
   meta = with lib; {
     description = "Qt-based GUI for wpa_supplicant";
+    mainProgram = "wpa_gui";
     homepage = "https://hostap.epitest.fi/wpa_supplicant/";
     license = licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
index d636f928f2494..cbe2a8134e60f 100644
--- a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
+++ b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Set the energy versus performance policy preference bias on recent X86 processors";
+    mainProgram = "x86_energy_perf_policy";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 614831c057d2b..eb5a5eae8032e 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xf86-input-wacom";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-PuIfeHlkcoin7w2v822P8uhWBNhYQGuOA7yD62L3qto=";
+    sha256 = "sha256-ldPNGa1ACjLivs2CVtkvKLsBZSzRuOM8Q7bvMdx0EWA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
index 104b7952f2be2..b1e2ce570a2d2 100644
--- a/pkgs/os-specific/linux/xone/default.nix
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -1,27 +1,18 @@
 { stdenv, lib, fetchFromGitHub, kernel, fetchurl, fetchpatch }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xone";
-  version = "0.3";
+  version = "0.3-unstable-2024-03-16";
 
   src = fetchFromGitHub {
     owner = "medusalix";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-h+j4xCV9R6hp9trsv1NByh9m0UBafOz42ZuYUjclILE=";
+    repo = "xone";
+    rev = "948d2302acdd6333295eaba4da06d96677290ad3";
+    hash = "sha256-srAEw1ai5KT0rmVUL3Dut9R2mNb00AAZVCcINikh2sM=";
   };
 
-  patches = [
-    # Fix build on kernel 6.3
-    (fetchpatch {
-      name = "kernel-6.3.patch";
-      url = "https://github.com/medusalix/xone/commit/bbf0dcc484c3f5611f4e375da43e0e0ef08f3d18.patch";
-      hash = "sha256-A2OzRRk4XT++rS6k6EIyiPy/LJptvVRUxoP7CIGrPWU=";
-    })
-  ];
-
   setSourceRoot = ''
-    export sourceRoot=$(pwd)/${src.name}
+    export sourceRoot=$(pwd)/${finalAttrs.src.name}
   '';
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -30,7 +21,7 @@ stdenv.mkDerivation rec {
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"
-    "VERSION=${version}"
+    "VERSION=${finalAttrs.version}"
   ];
 
   buildFlags = [ "modules" ];
@@ -45,4 +36,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
+)
diff --git a/pkgs/os-specific/linux/xsos/default.nix b/pkgs/os-specific/linux/xsos/default.nix
index 56516aee8b7b8..8d2dd747ffb69 100644
--- a/pkgs/os-specific/linux/xsos/default.nix
+++ b/pkgs/os-specific/linux/xsos/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Summarize system info from sosreports";
+    mainProgram = "xsos";
     homepage = "https://github.com/ryran/xsos";
     license = licenses.gpl3;
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index 8414ac7a1e14e..e8fce959c8dc9 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Monitoring software for AMD Zen-based CPUs";
+    mainProgram = "zenmonitor";
     homepage = "https://github.com/Ta180m/zenmonitor3";
     license = licenses.mit;
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/zenstates/default.nix b/pkgs/os-specific/linux/zenstates/default.nix
index 8e31073151bae..a320e959f0210 100644
--- a/pkgs/os-specific/linux/zenstates/default.nix
+++ b/pkgs/os-specific/linux/zenstates/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux utility for Ryzen processors and motherboards";
+    mainProgram = "zenstates";
     homepage = "https://github.com/r4m0n/ZenStates-Linux";
     license = licenses.mit;
     maintainers = with maintainers; [ savannidgerinel ];
diff --git a/pkgs/os-specific/linux/zfs/2_1.nix b/pkgs/os-specific/linux/zfs/2_1.nix
index 73cc0d9627030..97173a5154a59 100644
--- a/pkgs/os-specific/linux/zfs/2_1.nix
+++ b/pkgs/os-specific/linux/zfs/2_1.nix
@@ -17,7 +17,7 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible = kernel.kernelOlder "6.8";
 
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_7;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
 
   # This is a fixed version to the 2.1.x series, move only
   # if the 2.1.x series moves.
diff --git a/pkgs/os-specific/linux/zfs/2_2.nix b/pkgs/os-specific/linux/zfs/2_2.nix
index 3e5d262f73d06..455c17383604f 100644
--- a/pkgs/os-specific/linux/zfs/2_2.nix
+++ b/pkgs/os-specific/linux/zfs/2_2.nix
@@ -16,7 +16,7 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible = kernel.kernelOlder "6.8";
 
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_7;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
 
   # this package should point to the latest release.
   version = "2.2.3";
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index 052dd0cd74c9a..c8db9c5c5df97 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -16,19 +16,19 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible = kernel.kernelOlder "6.9";
 
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_7;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.3-unstable-2024-02-12";
-  rev = "4635453d9f06771678b2125d5b45852b4d2eb04f";
+  version = "2.2.3-unstable-2024-04-09";
+  rev = "28520cad2500b60ce8653e431990e33f77ff08f7";
 
   isUnstable = true;
   tests = [
     nixosTests.zfs.unstable
   ];
 
-  hash = "sha256-ch1/R61cn1BtWkkH2IViWjVp22XFz4/WbByquN+vybs=";
+  hash = "sha256-lGoiTmCWOxqACSYY0WA0gN6CN/1FyYhSVHmtYC1Izhg=";
 }
diff --git a/pkgs/os-specific/solo5/default.nix b/pkgs/os-specific/solo5/default.nix
deleted file mode 100644
index f235902a91cd6..0000000000000
--- a/pkgs/os-specific/solo5/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ lib, stdenv, fetchurl, dosfstools, libseccomp, makeWrapper, mtools, parted
-, pkg-config, qemu, syslinux, util-linux }:
-
-let
-  version = "0.8.0";
-  # list of all theoretically available targets
-  targets = [
-    "genode"
-    "hvt"
-    "muen"
-    "spt"
-    "virtio"
-    "xen"
-  ];
-in stdenv.mkDerivation {
-  pname = "solo5";
-  inherit version;
-
-  nativeBuildInputs = [ makeWrapper pkg-config ];
-  buildInputs = lib.optional (stdenv.hostPlatform.isLinux) libseccomp;
-
-  src = fetchurl {
-    url = "https://github.com/Solo5/solo5/releases/download/v${version}/solo5-v${version}.tar.gz";
-    sha256 = "sha256-t80VOZ8Tr1Dq+mJfRPVLGqYprCaqegcQtDqdoHaSXW0=";
-  };
-
-  hardeningEnable = [ "pie" ];
-
-  configurePhase = ''
-    runHook preConfigure
-    sh configure.sh --prefix=/
-    runHook postConfigure
-  '';
-
-  enableParallelBuilding = true;
-
-  separateDebugInfo = true;
-    # debugging requires information for both the unikernel and the tender
-
-  installPhase = ''
-    runHook preInstall
-    export DESTDIR=$out
-    export PREFIX=$out
-    make install
-
-    substituteInPlace $out/bin/solo5-virtio-mkimage \
-      --replace "/usr/lib/syslinux" "${syslinux}/share/syslinux" \
-      --replace "/usr/share/syslinux" "${syslinux}/share/syslinux" \
-      --replace "cp " "cp --no-preserve=mode "
-
-    wrapProgram $out/bin/solo5-virtio-mkimage \
-      --prefix PATH : ${lib.makeBinPath [ dosfstools mtools parted syslinux ]}
-
-    runHook postInstall
-  '';
-
-  doCheck = stdenv.hostPlatform.isLinux;
-  nativeCheckInputs = [ util-linux qemu ];
-  checkPhase = ''
-    runHook preCheck
-    patchShebangs tests
-    ./tests/bats-core/bats ./tests/tests.bats
-    runHook postCheck
-  '';
-
-  meta = with lib; {
-    description = "Sandboxed execution environment";
-    homepage = "https://github.com/solo5/solo5";
-    license = licenses.isc;
-    maintainers = [ maintainers.ehmry ];
-    platforms = builtins.map ({arch, os}: "${arch}-${os}")
-      (cartesianProductOfSets {
-        arch = [ "aarch64" "x86_64" ];
-        os = [ "freebsd" "genode" "linux" "openbsd" ];
-      });
-  };
-
-}