WIP: update satisfactory dedicated server

README.md

@@ -6,45 +6,28 @@ include_toc: true
 # dragnpkgs
 
 this is my personal nixos modules and packages repository. while it was designed for my own use,
-it's also intended to be flexible and reusable enough for general purpose usage
+it's also intended to be flexible and reusable enough for general purpose usage. i might consider
-
+upstreaming into nixpkgs if there is sufficient interest
-dragnpkgs provides the following
-- a set of package definitions, in `pkgs/`, which provide packages not in `nixpkgs`, some of my own
-  libraries and utilities, and rewrites/patches of upstream packages to suit my needs
-  - the top level overlay is located in `overlay.nix`, in a similar style as nixpkgs
-    `all-packages.nix`
-- a set of nixos modules, in `modules/`
-    - a module including all of the other modules is located at `module.nix`
-- utilities, in `lib/` and contained within `flake.nix`
-- flake templates, in `templates/`
-- a full wrapper around `nixpkgs` which includes the package set and nixos modules by default, and
-  changes the default nix implementation to `lix`, so this repo can be used in place of the
-  `nixpkgs` flake
-
-## licensing
-
-this repository is NOT licensed under a "standard" FOSS license. instead, it uses [CC-BY-NC-SA
-4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/deed.en). this means, in particular that
-commercial use is forbidden. if you are, for whatever reason, interested in using this code
-commercially, please contact me
-
-additionally, several package definitions included in this repo point to packages which have their
-own noteworthy licensing (including, for example, unfree and non-redistributable game server
-software). make sure you are following the license requirements, which can be found in
-`meta.license` for each package
 
 ## usage
 
+dragnpkgs provides a set of nixos modules and a nixpkgs overlay containing custom packages. the
+modules require the overlay
+
+### non-flake
+
 since i use flakes now (sigh!!!) i'm not supporting non-flake usage anymore. if you read the files
 in the repo there's a way to do it probably
 
+### flake
+
 for flake usage, add this repo as an input and don't input nixpkgs at all, since we fully wrap it
 
 ```nix
 {
   inputs = {
-    # for nixos-25.05
+    # for nixos-24.11
-    dragnpkgs.url = "git+https://git.lain.faith/haskal/dragnpkgs.git?ref=nixos-25.05";
+    dragnpkgs.url = "git+https://git.lain.faith/haskal/dragnpkgs.git?ref=nixos-24.11";
 
     # for nixos-unstable
     dragnpkgs.url = "git+https://git.lain.faith/haskal/dragnpkgs.git?ref=main";
@@ -64,205 +47,26 @@ flake.nix for details
   dragnpkgs-specific registration mechanism for these that is enabled by default, see
   `options.dragnpkgs`
 - in flake.nix but not in module.nix: disable channels
+- add lix cache and its keys to substitutors
 - enable experimental features `nix-command flakes repl-flake`
 - disable the default flake registry. i think it's cringe
 - add a repl overlay that adds some useful utilities to `nix repl` -- see repl-overlay.nix for
   details
-- provides a flake pure eval mode bypass via a lix plugin for allowlisting certain unfree licenses
-  that can be enabled when the user has permission to use packages with those licenses. this allows
-  usage of those packages without needing to set `NIXPKGS_ALLOW_UNFREE=1` and passing `--impure`,
-  which i find very clunky
 
 also note that overriding inputs to the flake won't necessarily work because of the way nixpkgs
 registers itself with the system. this requires really annoying hacks to get working at all. if you
 want to depend on `dragnpkgs` with a different version of `nixpkgs` (ie not 24.11 or unstable),
 clone the repo and recreate `flake.lock`. aren't flakes so cool and fun!!!!
 
-## flake lib documentation
+## options documentation
 
-These utilities are provided by the dragnpkgs flake.
+documentation for options provided by dragnpkgs
 
-### `dragnpkgs.lib.mkFlake attrs`
-
-This provides a small utility for defining flakes in a way that avoids some of the pain related to
-flake attributes being keyed by `system`. `attrs` is an attribute set similar to what would normally
-be returned for `outputs`, but the keys `packages`, `legacyPackages`, `devShells`, and `apps` are
-written in `callPackage` style
-
-For example:
-
-```nix
-outputs = { self, dragnpkgs }: dragnpkgs.lib.mkFlake {
-  devShells.default = {
-    mkShell,
-    hello,
-  }: mkShell {
-    packages = [
-      hello
-    ];
-  };
-};
-```
-
-Currently there is no mechanism to access `system`-keyed attributes from another `system`-keyed
-attribute, so it must be done manually using `system` in the arguments to the `callPackage`-style
-function. For example:
-
-```nix
-outputs = { self, dragnpkgs }: dragnpkgs.lib.mkFlake {
-  packages.default = {
-    stdenv,
-    mydependency,
-  }: stdenv.mkDerivation {
-    pname = "mypackage";
-    version = "DEV";
-
-    src = ./.;
-
-    buildInputs = [ mydependency ];
-  };
-
-  devShells.default = {
-    mkShell,
-    system,
-  }: mkShell {
-    packages = [
-      self.packages.${system}.default
-    ];
-  };
-};
-```
-
-Future work is planned to make this easier.
-
-## lib documentation
-
-These utilities are provided by the dragnpkgs overlay
-
-### [`fetchFromSteam`](./lib/fetchsteam)
-
-a fetcher that downloads binaries from [Steam](https://store.steampowered.com/) using
-[DepotDownloader](https://github.com/SteamRE/DepotDownloader). this is intended for game servers
-that are distributed via Steam. use [SteamDB](https://steamdb.info) to get the needed IDs.
-
-Usage:
-
-```nix
-pkgs.fetchFromSteam {
-  name = "..."; # optional
-  appId = "...";
-  depot = {
-    depotId = "...";
-    manifestId = "...";
-    beta = "..."; # optional
-  };
-
-  additionalDepots = [
-    # same format as the main `depot`
-    # use this to include eg the steamworks redistributable depot
-  ];
-
-  hash = pkgs.lib.fakeHash;
-}
-```
-
-### [`fetchb4`](./lib/fetchb4)
-
-A fetcher that uses `b4` to download patchsets from <https://lore.kernel.org> so that they can be
-applied in `boot.kernelPatches`
-
-Usage:
-
-```nix
-pkgs.fetchb4 {
-  msgid = "2024042069.1337-example@example";
-  hash = pkgs.lib.fakeHash;
-
-  # optional args
-  version = "3"; # default: latest
-  single_message = true; # default: false
-}
-```
-
-note that not specifying a version may make cause future invocations to return different output if a
-newer version is sent to the thread
-
-### [`mkNginxServer`](./lib/dev-nginx)
-
-creates a shell script that launches nginx in the foreground as the current user. the nginx is
-configured to run an http server on `localhost:8080` with the given `siteConfig`
-
-example:
-```nix
-pkgs.mkNginxServer {
-  siteConfig = ''
-    location / {
-      root path/to/development_site_root;
-      error_page 404 /404.html;
-    }
-  '';
-}
-```
-
-### [`makeSquashFs`](./lib/make-squashfs)
-
-builds a squashfs image from the given derivations
-
-example
-```nix
-makeSquashFs {
-  filename = "my-image"; # optional
-  storeContents = [ foo bar ];
-}
-```
-
-### [`makeHpcDist`](./lib/make-hpc-dist)
-
-create a packaged nix distribution with the given packages in it for weird HPC systems. go read the
-source to find out what it does; i don't recommend using this if you're not me
-
-### [`lib.licenses.fyptl`](./lib/licenses/fyptl.nix)
-
-The "Fuck You, Pirate This License" (FYPTL) is the author's version of a software non-license, which
-explicitly does not grant any rights to use, modify, or redistribute a given piece of software, but
-does disclaim warranty.
-
-## nixos options documentation
-
-documentation for nixos options provided by dragnpkgs
-
-### [`dragnpkgs`](./flake.nix)
-
-options for configuring dragnpkgs
-
-### [`dragnpkgs.setFlakeRegistry`](./flake.nix) (`true`)
-
-Set flake registry option pointing to self
-
-### [`dragnpkgs.setNixPath`](./flake.nix) (`true`)
-
-Set nix path entry pointing to self
-
-### [`dragnpkgs.setNixpkgsFlakeAlias`](./flake.nix) (`true`)
-
-Set flake registry entry for `nixpkgs` to self
-
-### [`dragnpkgs.setTemplatesFlakeAlias`](./flake.nix) (`true`)
-
-Set flake registry entry for `templates` to self
-
-### [`dragnpkgs.possiblyCommitCrimes`](./flake.nix) (`false`)
-
-Globally enable usage of packages marked as FYPTL. This installs a nix plugin, which is widely
-considered to be a nix crime, and it also might be an actual crime to use these packages depending
-on you jurisdiction. Use at your own risk
 
 ### [`services.ghidra-server`](./modules/ghidra-server)
-
+the shared project server for [ghidra](https://ghidra-sre.org)  
-the shared project server for [ghidra](https://github.com/NationalSecurityAgency/ghidra)
 
 example usage:
-
 ```nix
 services.ghidra-server = {
   enable = true;
@@ -270,209 +74,59 @@ services.ghidra-server = {
 };
 ```
 
-##### development notes
+#### services.ghidra-server.enable
-
-the module does the following:
-
-- sets up unix permissions on the ghidra repositories location that allows anyone in the `ghidra`
-  group to run `ghidra-svrAdmin` to perform admin tasks
-- only supports basic username/password authentication for the time being
-- parses the classpath file for the ghidra server which is normally read by the launcher, and uses
-  it to launch the server directly, without using the launcher. this was done because the launcher
-  was doing several things that were unwanted / could be better handled by systemd and journald, and
-  it was complicated to turn them off. this also allows us to customize the jvm args more easily
-- provides a log4j configuration that causes all logs to be sent to the system journal. this
-  effectively disables any ghidra-server-specific logfile management
-- sets the most basic isolation parameters (`PrivateTmp=true` and `NoNewPrivileges=true`), but more
-  work could be done to secure the ghidra server service
-
-#### `services.ghidra-server.enable`
 
 enables the ghidra server service
 
-#### `services.ghidra-server.enableAdminCli` (`true`)
+#### services.ghidra-server.enableAdminCli (`true`)
 
 adds a system package for the CLI tool `ghidra-svrAdmin`, which allows anyone in the `ghidra` group
 to administer the server (this corresponds to the `server/svrAdmin` tool in the stock ghidra
 distribution)
 
-#### `services.ghidra-server.{package, jdkPackage}` (`ghidra_headless`, `openjdk21_headless`)
+#### services.ghidra-server.{package, jdkPackage} (`ghidra_headless`, `openjdk21_headless`)
 
 allows overriding the ghidra package and jdk package used for the server
 
-#### `services.ghidra-server.host`
+#### services.ghidra-server.host
 
 the server hostname or IP; this is typically required (by java RMI) for correct operation
 
-#### `services.ghidra-server.basePort` (`13100`)
+#### services.ghidra-server.basePort (`13100`)
 
 the server will use 3 consecutive TCP ports starting from this port
 
-#### `services.ghidra-server.directory` (`ghidra-server`)
+#### services.ghidra-server.directory (`ghidra-server`)
 
 the root directory for server files, as a subdirectory of `/var/lib`. this is needed because this
 option is passed to systemd `StateDirectory=`
 
-#### `services.ghidra-server.{user,group}` (`ghidra`)
+#### services.ghidra-server.{user,group} (`ghidra`)
 
 the service user and group
 
-### [`programs.ghidra`](./modules/ghidra-client/default.nix)
 
-like upstream, but patches an issue with loading python packages in the ghidra debug feature
+### more coming soon(tm)
-
-this will probably get removed once upstream fixes the issue
-
-### [`environment.machineInfo`](./modules/machine-info/default.nix)
-
-provides options to customize the `/etc/machine-info` file on a NixOS system. See the module itself
-and <https://www.freedesktop.org/software/systemd/man/latest/machine-info.html> for more info
-
-### [`services.satisfactory`](./modules/satisfactory-dedicated-server/default.nix)
-
-The dedicated server for the game [Satisfactory](https://satisfactorygame.com)
-
-This module provides the needed runtime environment for the dedicated server to run on NixOS, as
-well as settings which can be automatically applied to provision the server on the first start (eg
-server name, admin password). This provisioning needs to be done at runtime, due to the way the
-server works, but it will be performed securely, before the server is exposed to the network for the
-first time. This means you can safely deploy the server to the public internet without worrying
-about exposing the "unclaimed" initial server mode, where any user could gain full privileges.
-
-##### development notes
-
-this module does the following:
-
-- sets up `satisfactory.service` with some systemd isolation options and
-  notably, a private mount namespace in which the nix store path for the server
-  is mounted together with some overmounts for read-write directories within
-  the installation. this allows the software to "write to its own install
-  directory" which is required for operation. the real location of the written
-  files is in `/var/lib/satisfactory`
-- if certs are provided, the systemd credentials mechanism is used to make them
-  available to the server process. another bind overmount is used to put the
-  credentials dir in the place that the server binary expects. additionally,
-  `satisfactory-restart-certs.service` is configured to restart the dedicated
-  server whenever the cert is renewed
-- when the first-run options are specified,
-  `satisfactory-first-time-setup.service` is configured as a dependency with a
-  condition on the data file the server uses to store its settings. if the file
-  exists, the first-run setup is skipped. in this service,
-  `PrivateNetwork=true` is used to isolate the service from the network while a
-  bash script executes HTTP API calls to perform the requested setup. once this
-  is done, the server is shut down and execution will proceed to the main
-  `satisfactory.service`
-
-this is mostly still in line with [a blog post i wrote on the
-topic](https://blog.awoo.systems/posts/2024-01-12-going-win32-scale-packaging-the-satisfactory-dedicated-server-on-nixos)
-but there have been some changes since then that are not reflected in the post
-
-#### `services.satisfactory.enable`
-
-enables the satisfactory dedicated server service
-
-#### `services.satisfactory.package` (`pkgs.satisfactory-dedicated-server`)
-
-the package to use for the service
-
-#### `services.satisfactory.directory` (`"/var/lib/satisfactory"`)
-
-Directory where Satisfactory Dedicated Server data will be stored
-
-#### `services.satisfactory.{user,group}` (`"satisfactory"`)
-
-User account and group under which Satisfactory Dedicated Server runs
-
-#### `services.satisfactory.useACMEHost` (`null`)
-
-If set, the server will use the ACME-provided TLS certificate for the given host.
-
-Note that this module does not actually provision the specified certificate; you must use additional
-config (e.g., `services.nginx.virtualHosts.<name>.enableACME = true`) to provision the certificate
-using a supported ACME method.
-
-#### `services.satisfactory.port` (`7777`)
-
-Server port number (TCP/UDP)
-
-This corresponds to the `-Port` command line option.
-
-#### `services.satisfactory.reliablePort` (`8888`)
-
-Server reliable port number
-
-This corresponds to the `-ReliablePort` command line option.
-
-#### `services.satisfactory.externalReliablePort` (`null`)
-
-Server reliable port number as seen outside NAT.
-
-This corresponds to the `-ExternalReliablePort` command line option.
-
-#### `services.satisfactory.disableSeasonalEvents` (`false`)
-
-Whether to run the server with seasonal events disabled.
-
-This corresponds to the `-DisableSeasonalEvents` command line option.
-
-#### `services.satisfactory.extraIniOptions` (`{}`)
-
-Run the server with additional ini configuration values.
-
-This is a nested attribute set of values.
-
-- The top level attribute specifies the ini file containing the value to set (i.e., the
-  first component of the `-ini` command line option), for example `Game` or `Engine`.
-- The secondary level attribute specifies the ini file category, without brackets,
-  for example `/Script/Engine.GameSession`.
-- The final level attribute specifies the option name to set, for example
-  `MaxPlayers`. The value of the attribute is the value to set on the command line.
-
-This corresponds to the `-ini` command line option.
-
-#### `services.satisfactory.initialSettings`
-
-Settings to apply to the server via the server API on the first run.
-
-#### `services.satisfactory.initialSettings.serverName` (`null`)
-
-The name of the server.
-
-If this is provided, `adminPasswordFile` must also be set.
-
-#### `services.satisfactory.initialSettings.adminPasswordFile` (`null`)
-
-Path to a file containing the initial admin password.
-
-If this is provided, `serverName` must also be set.
-
-#### `services.satisfactory.initialSettings.clientPasswordFile` (`null`)
-
-Path to a file containing the initial client password. If not set, the server will
-not be configured with a client password and will be accessible to any client.
-
-### [`hardware.wirelessRegulatoryDomain`](./modules/regdom/default.nix)
-
-The wireless regulatory domain to set in the kernel `cfg80211` module. This defaults to `"00"`
-(international), but more bands (such as 6GHz, on supported hardware) can be enabled by setting this
-to the jurisdiction in which the machine is located, for example `"US"`.
 
 ## packages documentation
 
-### [`ghidra`](./pkgs/reverse-engineering/ghidra/build.nix)
+### [`ghidra_headless`](./default.nix)
 
-a version of ghidra that uses a split derivation, `lib` contains the core ghidra distribution, `doc`
+a variant of ghidra which does not have a dependency on any jdk, intended to
-contains all the documentation elements, and `out` contains the bin folder, icons, and desktop file.
+reduce closure size for server operation with a headless jdk (in particular,
-only `out` has a dependency on the build jdk, so `lib` and `doc` can be used with reduced closure
+the ghidra-server nixos module uses `ghidra_headless` with `openjdk21_headless`
-size
+by default
 
-### [`ghidra_headless`](./pkgs/reverse-engineering/ghidra/build.nix)
+### [`ghidra`](./pkgs/ghidra-xenia/build.nix)
 
-a variant of ghidra which does not have a dependency on any jdk, intended to reduce closure size for
+a version of ghidra that uses a split derivation, `lib` contains the core
-server operation with a headless jdk (in particular, the ghidra-server nixos module uses
+ghidra distribution, `doc` contains all the documentation elements, and `out`
-`ghidra_headless` with `openjdk21_headless` by default
+contains the bin folder, icons, and desktop file. only `out` has a dependency
+on the build jdk, so `lib` and `doc` can be used with reduced closure size
 
-this is equivalent to the `lib` output of the split `ghidra` package
+### [`kicad`](./pkgs/kicad-xenia/default.nix)
+
+preview version of kicad with my patches
 
 ### [`ocamlPackages.ppx_unicode`](./pkgs/ocaml/ppx_unicode)
 
@@ -516,10 +170,6 @@ example
 feedvalidator --base "https://my-base-url/atom.xml" path/to/atom.xml
 ```
 
-### [`python312Packages.megacom` or `megacom`](./pkgs/python/megacom)
-
-a python utility to access serial ports from the command line
-
 ### [`outer-wilds-text-adventure`](./pkgs/games/outer-wilds-text-adventure)
 
 nix packaging for the Outer Wilds text adventure game. it should work by default on NixOS. if using
@@ -530,16 +180,6 @@ another ALSA plugin that lives in a separate package
 export ALSA_PLUGIN_DIR=$(nix eval -f '<nixpkgs>' --raw pipewire)/lib/alsa-lib
 ```
 
-### [`satisfactory-dedicated-server`](./pkgs/games/satisfactory-dedicated-server)
-
-The dedicated server for [Satisfactory](https://satisfactorygame.com), with packaging steps to make
-it run correctly on NixOS. This must be used together with the NixOS module
-(`services.satisfactory`), which sets up the environment needed for the server to execute.
-
-See
-[`services.satisfactory`](#services-satisfactory-modules-satisfactory-dedicated-server-default-nix)
-for further info and development notes
-
 ### [`eta`](./pkgs/cmdline/eta)
 
 Generic tool for monitoring ETA and progress of an arbitrary process.
@@ -558,23 +198,120 @@ Cado-NFS, An Implementation of the Number Field Sieve Algorithm
 
 <https://gitlab.inria.fr/cado-nfs/cado-nfs>
 
-### [`lix-plugins`](./pkgs/lix/lix-plugins)
+## lib documentation
 
-A plugin module for lix which provides the flake pure eval bypass which can be enabled using the
+### [`fetchFromSteam`](./lib/fetchsteam)
-dragnpkgs flake.
 
-### [`zfs_2_3`](./pkgs/zfs/)
+a fetcher that downloads binaries from [Steam](https://store.steampowered.com/) using
+[DepotDownloader](https://github.com/SteamRE/DepotDownloader). this is intended for game servers
+that are distributed via Steam. use [SteamDB](https://steamdb.info) to get the needed IDs.
 
-A version of ZFS with a patch for the `zed` userspace daemon to enable desktop notifications on ZFS
+Usage:
-errors. This makes ZFS a bit more reasonable to run on GUI systems
 
-### [`pympress`](./pkgs/python/pympress)
+```nix
+pkgs.fetchFromSteam {
+  name = "..."; # optional
+  appId = "...";
+  depot = {
+    depotId = "...";
+    manifestId = "...";
+    beta = "..."; # optional
+  };
 
-A version of [pympress](https://cimbali.github.io/pympress/) with a patch to fix the window icon on
+  additionalDepots = [
-KDE
+    # same format as the main `depot`
+    # use this to include eg the steamworks redistributable depot
+  ];
 
-### [`texliveDragonPackages.moloch`](./pkgs/tex/moloch)
+  hash = pkgs.lib.fakeHash;
+}
+```
 
-A version of the [moloch](https://jolars.co/blog/2024-05-30-moloch/) beamer theme with [some
+### [`fetchb4`](./lib/fetchb4)
-patches](https://git.lain.faith/haskal/moloch-dragon/) to make it easier to use with pympress and
+
-fix an issue with appendix slide numbering
+A fetcher that uses `b4` to download patchsets from <https://lore.kernel.org> so that they can be applied in `boot.kernelPatches`
+
+Usage:
+
+```nix
+pkgs.fetchb4 {
+  msgid = "2024042069.1337-example@example";
+  hash = pkgs.lib.fakeHash;
+
+  # optional args
+  version = "3"; # default: latest
+  single_message = true; # default: false
+}
+```
+
+note that not specifying a version may make cause future invocations to return different output if a newer version is sent to the thread
+
+### [`mkNginxServer`](./lib/dev-nginx)
+
+creates a shell script that launches nginx in the foreground as the current user. the nginx is
+configured to run an http server on `localhost:8080` with the given `siteConfig`
+
+example:
+```nix
+pkgs.mkNginxServer {
+  siteConfig = ''
+    location / {
+      root path/to/development_site_root;
+      error_page 404 /404.html;
+    }
+  '';
+}
+```
+
+### [`gitSource`](./lib/git-source)
+
+for development package nix files, computes the source set of files tracked by git at the given root
+path
+
+arguments:
+- `root`: the root of the git repo, where `.git` is located
+- `subdir`, optional: a subdirectory within the git repo. if provided, only files in this
+    subdirectory will go into the final source set
+
+example:
+```nix
+stdenv.mkDerivation {
+  # ...
+  src = gitSource { root = ./.; };
+}
+```
+
+### [`makeSquashFs`](./lib/make-squashfs)
+
+builds a squashfs image from the given derivations
+
+example
+```nix
+makeSquashFs {
+  filename = "my-image"; # optional
+  storeContents = [ foo bar ];
+}
+```
+
+### [`makeHpcDist`](./lib/make-hpc-dist)
+
+create a packaged nix distribution with the given packages in it for weird HPC systems. go read the
+source to find out what it does; i don't recommend using this if you're not me
+
+## development
+
+structure of this repo
+- `default.nix`: the top level NixOS module, which can also be interpreted as a plain nix file
+    outside of NixOS for access to just the nixpkgs overlay. this contains all definitions for
+    packages, library functions, and NixOS modules
+- `lib/`: library functions (ie functions that get added to the overlay) go here
+- `modules/`: NixOS modules go here
+- `pkgs/`: packages that get added to the overlay go here
+- `support/`: WIP support tools (eg generating documentation)
+
+## licensing
+
+this repository is NOT licensed under a "standard" FOSS license. instead, it uses
+[CC-BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/deed.en). this means, in
+particular that commercial use is forbidden. if you are, for whatever reason, interested in using
+this code commercially, please contact me

flake.lock

@@ -16,16 +16,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756542300,
+        "lastModified": 1756617294,
-        "narHash": "sha256-tlOn88coG5fzdyqz6R93SQL5Gpq+m/DsWpekNFhqPQk=",
+        "narHash": "sha256-aGnd4AHIYCWQKChAkHPpX+YYCt7pA6y2LFFA/s8q0wQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d7600c775f877cd87b4f5a831c28aa94137377aa",
+        "rev": "b4c2c57c31e68544982226d07e4719a2d86302a8",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "dragnpkgs together with nixpkgs and lix";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     lix-module = {
       url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-2.tar.gz";
@@ -28,18 +28,18 @@
       # self reference in the registry to be downloadable by URL in case it makes it into a
       # flake.lock
       meta.registry-entry = {
-        from = { id = "dragnpkgs-unstable"; type = "indirect"; };
+        from = { id = "dragnpkgs"; type = "indirect"; };
         to = {
           type = "git";
           url = "https://git.lain.faith/haskal/dragnpkgs.git";
-          ref = "main";
+          ref = "nixos-25.05";
         } // self.lib.filterAttrs
           (n: _: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
           self;
       };
 
       # the nix path entry for self
-      meta.path-entry = "dragnpkgs-unstable=flake:dragnpkgs-unstable";
+      meta.path-entry = "dragnpkgs=flake:dragnpkgs";
 
       lib = (lib-base.extend (import ./lib/overlay.nix)).extend (final: prev: {
         # initializes regular upstream nixpkgs with the given arguments
@@ -154,17 +154,17 @@
                     };
                   };
 
-                  config.nix.registry.dragnpkgs-unstable =
+                  config.nix.registry.dragnpkgs =
                     lib.mkIf config.dragnpkgs.setFlakeRegistry self.meta.registry-entry;
 
                   config.nix.registry.nixpkgs = lib.mkIf config.dragnpkgs.setNixpkgsFlakeAlias {
                     from = { id = "nixpkgs"; type = "indirect"; };
-                    to = { id = "dragnpkgs-unstable"; type = "indirect"; };
+                    to = { id = "dragnpkgs"; type = "indirect"; };
                   };
 
                   config.nix.registry.templates = lib.mkIf config.dragnpkgs.setTemplatesFlakeAlias {
                     from = { id = "templates"; type = "indirect"; };
-                    to = { id = "dragnpkgs-unstable"; type = "indirect"; };
+                    to = { id = "dragnpkgs"; type = "indirect"; };
                   };
 
                   config.nix.nixPath = lib.mkIf config.dragnpkgs.setNixPath [

lib/git-source/default.nix

@@ -0,0 +1,14 @@
+{ lib }: { root, subdir ? null }:
+let
+  fs = lib.fileset;
+  sourceFiles = fs.difference
+    (fs.gitTracked root)
+    (fs.fileFilter (file: file.hasExt "nix") root);
+  finalSourceFiles =
+    if subdir == null then
+      sourceFiles
+    else
+      fs.intersection sourceFiles subdir;
+  finalRoot = if subdir == null then root else subdir;
+in
+  fs.toSource { root = finalRoot; fileset = finalSourceFiles; }

module.nix

@@ -1,10 +1,9 @@
 { ... }: {
   imports = [
-    ./modules/ghidra-client
     ./modules/ghidra-server
     ./modules/machine-info
-    ./modules/regdom
     ./modules/satisfactory-dedicated-server
+    ./modules/regdom
   ];
 
   # set some nix settings defaults

modules/ghidra-client/default.nix

@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.ghidra;
-  package = cfg.package;
-  isSplit = lib.elem "lib" package.outputs;
-  libOutput = if isSplit then package.lib else package;
-in
-{
-  disabledModules = [ "programs/ghidra.nix" ];
-
-  options.programs.ghidra = {
-    enable = lib.mkEnableOption "Ghidra, a software reverse engineering (SRE) suite of tools";
-
-    gdb = lib.mkOption {
-      default = true;
-      type = lib.types.bool;
-      description = ''
-        Whether to add to gdbinit the python modules required to make Ghidra's debugger work.
-      '';
-    };
-
-    package = lib.mkPackageOption pkgs "ghidra" { example = "ghidra_headless"; };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment = {
-      systemPackages = [ package ];
-
-      etc = lib.mkIf cfg.gdb {
-        "gdb/gdbinit.d/ghidra-modules.gdb".text = with pkgs.python3.pkgs; ''
-          python
-          import sys
-          [sys.path.append(p) for p in "${
-            (makePythonPath [
-              psutil
-              protobuf
-            ])
-          }".split(":")]
-          sys.path.append("${libOutput}/lib/ghidra/Ghidra/Debug/Debugger-agent-gdb/pypkg/src")
-          sys.path.append("${libOutput}/lib/ghidra/Ghidra/Debug/Debugger-rmi-trace/pypkg/src")
-          end
-        '';
-      };
-    };
-  };
-}

modules/machine-info/default.nix

@@ -1,119 +1,119 @@
 { config, pkgs, lib, ... }: with lib; {
-  options.environment.machineInfo = mkOption {
+	options.environment.machineInfo = mkOption {
-    description = lib.mdDoc ''
+		description = lib.mdDoc ''
-      Machine metadata, including stylized hostname, computer icon, etc.
+			Machine metadata, including stylized hostname, computer icon, etc.
 
-      This module controls the options written to `/etc/machine-info`.  For more
+			This module controls the options written to `/etc/machine-info`.  For more
-      information, see [the freedesktop documentation][1].
+			information, see [the freedesktop documentation][1].
 
-      [1]: https://www.freedesktop.org/software/systemd/man/machine-info.html
+			[1]: https://www.freedesktop.org/software/systemd/man/machine-info.html
-      '';
+		'';
-    default = {};
+		default = {};
-    type = types.submodule { options = {
+		type = types.submodule { options = {
 
-      prettyHostname = mkOption {
+			prettyHostname = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          A pretty, human-readable hostname for this machine, potentially including
+					A pretty, human-readable hostname for this machine, potentially including
-          spaces, unicode, and emoji.  If unset, this falls back to the network hostname
+					spaces, unicode, and emoji.  If unset, this falls back to the network hostname
-          set in `networking.hostName`.
+					set in `networking.hostName`.
-          '';
+				'';
-        type = with types; nullOr str;
+				type = with types; nullOr str;
-        default = null;
+				default = null;
-        defaultText = literalExpression "null";
+				defaultText = literalExpression "null";
-        example = literalExpression "\"Jade's Laptop 💎\"";
+				example = literalExpression "\"Jade's Laptop 💎\"";
-      };
+			};
 
-      iconName = mkOption {
+			iconName = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          An XDG icon which should be associated with this machine.  Some common choices
+					An XDG icon which should be associated with this machine.  Some common choices
-          include:  `"computer"`, `"phone"`, but a complete list of icons can be found in
+					include:  `"computer"`, `"phone"`, but a complete list of icons can be found in
-          the [XDG Icon Naming Spec][1].
+					the [XDG Icon Naming Spec][1].
 
-          If left unset, applications will typically default to `"computer"`.
+					If left unset, applications will typically default to `"computer"`.
 
-          [1]: https://specifications.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
+					[1]: https://specifications.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
-          '';
+				'';
-        type = with types; nullOr str;
+				type = with types; nullOr str;
-        default = null;
+				default = null;
-        defaultText = literalExpression "null";
+				defaultText = literalExpression "null";
-        example = literalExpression "\"computer\"";
+				example = literalExpression "\"computer\"";
-      };
+			};
 
-      chassis = mkOption {
+			chassis = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          The type of chassis this machine resides within.  This is typically detected
+					The type of chassis this machine resides within.  This is typically detected
-          automatically, but can be manually overridden here.
+					automatically, but can be manually overridden here.
-          '';
+				'';
-        type = with types; nullOr (enum [
+				type = with types; nullOr (enum [
-            "desktop"
+					"desktop"
-            "laptop"
+					"laptop"
-            "convertible"
+					"convertible"
-            "server"
+					"server"
-            "tablet"
+					"tablet"
-            "handset"
+					"handset"
-            "watch"
+					"watch"
-            "embedded"
+					"embedded"
-            "vm"
+					"vm"
-            "container"
+					"container"
-        ]);
+				]);
-        default = null;
+				default = null;
-        defaultText = literalExpression "null";
+				defaultText = literalExpression "null";
-        example = literalExpression "\"server\"";
+				example = literalExpression "\"server\"";
-      };
+			};
 
-      deployment = mkOption {
+			deployment = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          If this machine is part of a deployment environment / pipeline, this option can
+					If this machine is part of a deployment environment / pipeline, this option can
-          be used to specify what environment/pipeline stage it manages.
+					be used to specify what environment/pipeline stage it manages.
 
-          Typically, but not necessarily, set to something like `"development"`,
+					Typically, but not necessarily, set to something like `"development"`,
-          `"integration"`, `"staging"`, or `"production"`.
+					`"integration"`, `"staging"`, or `"production"`.
-            '';
+				'';
-        type = with types; nullOr str;
+				type = with types; nullOr str;
-        default = null;
+				default = null;
-        defaultText = literalExpression "null";
+				defaultText = literalExpression "null";
-        example = literalExpression "\"production\"";
+				example = literalExpression "\"production\"";
-      };
+			};
 
-      location = mkOption {
+			location = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          A human-readable short description of the location of this machine.
+					A human-readable short description of the location of this machine.
 
-          This can be set to whatever has the most meaning for you, for example "Living
+					This can be set to whatever has the most meaning for you, for example "Living
-          Room", "Left Rack, 2nd Shelf", or "Parishville, NY".
+					Room", "Left Rack, 2nd Shelf", or "Parishville, NY".
-          '';
+				'';
-        type = with types; nullOr str;
+				type = with types; nullOr str;
-        default = null;
+				default = null;
-        defaultText = literalExpression "null";
+				defaultText = literalExpression "null";
-        example = literalExpression "\"Bedroom\"";
+				example = literalExpression "\"Bedroom\"";
-      };
+			};
 
-      extraOptions = mkOption {
+			extraOptions = mkOption {
-        description = lib.mdDoc ''
+				description = lib.mdDoc ''
-          Extra variables to put in `/etc/machine-info`
+				Extra variables to put in `/etc/machine-info`
-          '';
+				'';
-        type = with types; attrsOf str;
+				type = with types; attrsOf str;
-        default = {};
+				default = {};
-        defaultText = literalExpression "{ }";
+				defaultText = literalExpression "{ }";
-        example = literalExpression "{ HARDWARE_VENDOR = \"Intel Corp.\" }";
+				example = literalExpression "{ HARDWARE_VENDOR = \"Intel Corp.\" }";
-      };
+			};
 
-    };};
+		};};
-  };
+	};
 
-  config.environment.etc.machine-info =
+	config.environment.etc.machine-info =
-    with config.environment.machineInfo;
+		with config.environment.machineInfo;
-  let
+		let
-    rawShellVars = {
+			rawShellVars = {
-      PRETTY_HOSTNAME = prettyHostname;
+				PRETTY_HOSTNAME = prettyHostname;
-      ICON_NAME       = iconName;
+				ICON_NAME       = iconName;
-      CHASSIS         = chassis;
+				CHASSIS         = chassis;
-      DEPLOYMENT      = deployment;
+				DEPLOYMENT      = deployment;
-      LOCATION        = location;
+				LOCATION        = location;
-    } // extraOptions;
+			} // extraOptions;
-  nonNullShellVars = attrsets.filterAttrs (k: v: v != null) rawShellVars;
+			nonNullShellVars = attrsets.filterAttrs (k: v: v != null) rawShellVars;
-  in rec {
+		in rec {
-    text = strings.toShellVars nonNullShellVars;
+				text = strings.toShellVars nonNullShellVars;
-    enable = builtins.stringLength text > 0;
+				enable = builtins.stringLength text > 0;
-  };
+			};
-}
+}

modules/satisfactory-dedicated-server/default.nix

@@ -191,8 +191,6 @@ in {
       "${cfg.directory}".d = default;
       "${cfg.directory}/saves".d = default;
       "${cfg.directory}/settings".d = default;
-      "${cfg.directory}/settings/game".d = default;
-      "${cfg.directory}/settings/engine".d = default;
     };
 
     systemd.services = let
@@ -233,6 +231,10 @@ in {
           "acme-finished-${cfg.useACMEHost}.target"
         ];
 
+        environment = {
+          "LD_LIBRARY_PATH" = "${cfg.directory}/server/linux64";
+        };
+
         unitConfig = {
           RequiresMountsFor = cfg.directory;
         };
@@ -264,13 +266,12 @@ in {
             "${cfg.directory}:ro"
           ];
           BindReadOnlyPaths = [
-            "${cfg.package}/opt:${cfg.directory}/server"
+            "${cfg.package}:${cfg.directory}/server"
           ];
           BindPaths = [
             "${cfg.directory}/saves:${cfg.directory}/.config/Epic"
             "/var/tmp:${cfg.directory}/server/FactoryGame/Intermediate"
-            "${cfg.directory}/settings/game:${cfg.directory}/server/FactoryGame/Saved"
+            "${cfg.directory}/settings:${cfg.directory}/server/FactoryGame/Saved"
-            "${cfg.directory}/settings/engine:${cfg.directory}/server/Engine/Saved"
           ] ++ lib.optionals (cfg.useACMEHost != null) [
             "%d:${cfg.directory}/server/FactoryGame/Certificates"
           ];

overlay.nix

@@ -4,16 +4,18 @@ final: prev: {
   fetchFromSteam = prev.callPackage ./lib/fetchsteam {};
   fetchb4 = prev.callPackage ./lib/fetchb4 {};
 
+  gitSource = prev.callPackage ./lib/git-source {};
+
   makeSquashFs = prev.callPackage ./lib/make-squashfs {};
   makeHpcDist = final.callPackage ./lib/make-hpc-dist {};
 
   ghidra_headless = final.ghidra.lib;
 
   # stuff that tracks upstream
-  ghidra = final.callPackage ./pkgs/reverse-enginering/ghidra/build.nix {
+  ghidra = final.callPackage ./pkgs/ghidra-xenia-v2/build.nix {
     protobuf = final.protobuf_21;
   };
-  ghidra-extensions = final.lib.recurseIntoAttrs (final.callPackage ./pkgs/reverse-engineering/ghidra/extensions.nix { });
+  ghidra-extensions = final.lib.recurseIntoAttrs (final.callPackage ./pkgs/ghidra-xenia-v2/extensions.nix { });
   # end stuff that tracks upstream
 
 
@@ -34,6 +36,8 @@ final: prev: {
   feedvalidator = final.python312Packages.feedvalidator;
   megacom = final.python312Packages.megacom;
 
+  # temporary upgrade so we can actually download satisfactory
+  depotdownloader = prev.callPackage ./pkgs/temp/depotdownloader {};
   outer-wilds-text-adventure = prev.callPackage ./pkgs/games/outer-wilds-text-adventure {};
   satisfactory-dedicated-server = prev.callPackage ./pkgs/games/satisfactory-dedicated-server {};
 

pkgs/games/satisfactory-dedicated-server/default.nix

@@ -7,7 +7,7 @@
 }:
 let
   appId = "1690800";
-  buildId = "19876517";
+  buildId = "19234106";
   steamworks_sdk = fetchFromSteam {
     name = "steamworks-sdk";
     inherit appId;
@@ -22,9 +22,9 @@ let
     inherit appId;
     depot = {
       depotId = "1690802";
-      manifestId = "7620210706575413121";
+      manifestId = "5693629351763493998";
     };
-    hash = "sha256-jQbtHSBFCDcdycrDjIJBY4DGV7EgITvwv3k3+htZ7io=";
+    hash = "sha256-0svLwO4JYKIPwoNCRfT9+pocZ0n1QpSEqP41DdUhEac=";
   };
 in stdenv.mkDerivation {
   pname = "satisfactory-dedicated-server";
@@ -36,17 +36,15 @@ in stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/opt
+    mkdir -p $out
-    cp -r . $out/opt/.
+    cp -r . $out/.
-    cp -r ${steamworks_sdk}/linux64 $out/opt
+    cp -r ${steamworks_sdk}/linux64 $out
 
-    mkdir -p $out/opt/FactoryGame/Intermediate
+    mkdir -p $out/FactoryGame/Intermediate
-    mkdir -p $out/opt/FactoryGame/Saved
+    mkdir -p $out/FactoryGame/Saved
-    mkdir -p $out/opt/FactoryGame/Certificates
+    mkdir -p $out/FactoryGame/Certificates
 
-    mkdir -p $out/opt/Engine/Saved
+    rm $out/FactoryServer.sh
-
-    rm $out/opt/FactoryServer.sh
   '';
 
   dontStrip = true;
@@ -57,23 +55,21 @@ in stdenv.mkDerivation {
   preFixup = ''
     echo patching binaries
 
-    chmod +x $out/opt/Engine/Binaries/Linux/FactoryServer-Linux-Shipping
+    chmod +x $out/Engine/Binaries/Linux/FactoryServer-Linux-Shipping
 
     patchelf \
       --add-needed ${SDL2}/lib/libSDL2-2.0.so.0 \
-      $out/opt/linux64/steamclient.so
+      $out/linux64/steamclient.so
 
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --add-needed $out/opt/linux64/steamclient.so \
+      --add-needed $out/linux64/steamclient.so \
-      $out/opt/Engine/Binaries/Linux/FactoryServer-Linux-Shipping
+      $out/Engine/Binaries/Linux/FactoryServer-Linux-Shipping
   '';
 
   meta = with lib; {
     description = "Satisfactory Dedicated Server";
-    homepage = "https://www.satisfactorygame.com/";
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    sourceProvenance = [ sourceTypes.binaryNativeCode ];
   };
 }

pkgs/ghidra-xenia-v2/0001-Use-protobuf-gradle-plugin.patch

@@ -1,5 +1,18 @@
+From be4c852769e260e3a9b516bb5626a6a6a68a2cd3 Mon Sep 17 00:00:00 2001
+From: roblabla <unfiltered@roblab.la>
+Date: Wed, 31 Jan 2024 13:19:55 +0100
+Subject: [PATCH] Use com.google.protobuf:protobuf-gradle-plugin
+
+---
+ Ghidra/Debug/Debugger-isf/build.gradle       |  8 +-
+ Ghidra/Debug/Debugger-rmi-trace/build.gradle | 16 ++--
+ build.gradle                                 |  6 ++
+ gradle/hasProtobuf.gradle                    | 94 --------------------
+ 4 files changed, 22 insertions(+), 102 deletions(-)
+ delete mode 100644 gradle/hasProtobuf.gradle
+
 diff --git a/Ghidra/Debug/Debugger-isf/build.gradle b/Ghidra/Debug/Debugger-isf/build.gradle
-index 2db94ed67e..925f394cf0 100644
+index f6c8464405..396b52d188 100644
 --- a/Ghidra/Debug/Debugger-isf/build.gradle
 +++ b/Ghidra/Debug/Debugger-isf/build.gradle
 @@ -18,11 +18,17 @@ apply from: "${rootProject.projectDir}/gradle/javaProject.gradle"
@@ -19,10 +32,10 @@ index 2db94ed67e..925f394cf0 100644
 +}
 +
  dependencies {
+ 	api project(':Framework-AsyncComm')
  	api project(':ProposedUtils')
- }
 diff --git a/Ghidra/Debug/Debugger-rmi-trace/build.gradle b/Ghidra/Debug/Debugger-rmi-trace/build.gradle
-index 4fa3b9a539..2663aeaeb0 100644
+index 8b6589f035..05da5a7a7e 100644
 --- a/Ghidra/Debug/Debugger-rmi-trace/build.gradle
 +++ b/Ghidra/Debug/Debugger-rmi-trace/build.gradle
 @@ -19,12 +19,17 @@ apply from: "${rootProject.projectDir}/gradle/helpProject.gradle"
@@ -43,27 +56,25 @@ index 4fa3b9a539..2663aeaeb0 100644
 +}
 +
  dependencies {
- 	api project(':ProposedUtils')
  	api project(':Pty')
-@@ -37,13 +42,10 @@ dependencies {
+ 	api project(':Debugger')
- }
+@@ -44,12 +49,9 @@ task generateProtoPy {
- 
+ 	ext.outdir = file("build/generated/source/proto/main/py")
- task configureGenerateProtoPy {
+ 	outputs.dir(outdir)
+ 	inputs.files(src)
 -	dependsOn(configurations.protocArtifact)
 +	dependsOn(protobuf.generateProtoTasks.all())
- 
+ 	doLast {
--	doLast {
 -		def exe = configurations.protocArtifact.first()
 -		if (!isCurrentWindows()) {
 -			exe.setExecutable(true)
 -		}
-+ 	doLast {
 +		def exe = protobuf.tools.protoc.path
- 		generateProtoPy.commandLine exe
+ 		exec {
- 		generateProtoPy.args "--python_out=${generateProtoPy.outdir}"
+ 			commandLine exe, "--python_out=$outdir", "-I$srcdir"
- 		generateProtoPy.args "--pyi_out=${generateProtoPy.stubsOutdir}"
+ 			args src
 diff --git a/build.gradle b/build.gradle
-index 159eb7dd7b..ef4add1ad8 100644
+index 2d75307a08..aa8f1d7604 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -80,6 +80,12 @@ if (flatRepo.isDirectory()) {
@@ -81,19 +92,19 @@ index 159eb7dd7b..ef4add1ad8 100644
  else {	
 diff --git a/gradle/hasProtobuf.gradle b/gradle/hasProtobuf.gradle
 deleted file mode 100644
-index a8c176bcbe..0000000000
+index 23b4ce74bb..0000000000
 --- a/gradle/hasProtobuf.gradle
 +++ /dev/null
-@@ -1,98 +0,0 @@
+@@ -1,94 +0,0 @@
 -/* ###
 - * IP: GHIDRA
 - *
 - * Licensed under the Apache License, Version 2.0 (the "License");
 - * you may not use this file except in compliance with the License.
 - * You may obtain a copy of the License at
-- *
+- * 
 - *      http://www.apache.org/licenses/LICENSE-2.0
-- *
+- * 
 - * Unless required by applicable law or agreed to in writing, software
 - * distributed under the License is distributed on an "AS IS" BASIS,
 - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -146,22 +157,7 @@ index a8c176bcbe..0000000000
 -	}
 -}*/
 -
--task configureGenerateProto {
+-task generateProto {
--	dependsOn(configurations.protocArtifact)
--
--	doLast {
--		def exe = configurations.protocArtifact.first()
--		if (!isCurrentWindows()) {
--			exe.setExecutable(true)
--		}
--		generateProto.commandLine exe, "--java_out=${generateProto.outdir}", "-I${generateProto.srcdir}"
--		generateProto.args generateProto.src
--	}
--}
--
--// Can't use providers.exec, or else we see no output
--task generateProto(type:Exec) {
--	dependsOn(configureGenerateProto)
 -	ext.srcdir = file("src/main/proto")
 -	ext.src = fileTree(srcdir) {
 -		include "**/*.proto"
@@ -169,6 +165,17 @@ index a8c176bcbe..0000000000
 -	ext.outdir = file("build/generated/source/proto/main/java")
 -	outputs.dir(outdir)
 -	inputs.files(src)
+-	dependsOn(configurations.protocArtifact)
+-	doLast {
+-		def exe = configurations.protocArtifact.first()
+-		if (!isCurrentWindows()) {
+-			exe.setExecutable(true)
+-		}
+-		exec {
+-			commandLine exe, "--java_out=$outdir", "-I$srcdir"
+-			args src
+-		}
+-	}
 -}
 -
 -tasks.compileJava.dependsOn(tasks.generateProto)
@@ -183,3 +190,6 @@ index a8c176bcbe..0000000000
 -	}
 -}
 -zipSourceSubproject.dependsOn generateProto
+-- 
+2.47.0
+

pkgs/ghidra-xenia-v2/build.nix

@@ -19,7 +19,7 @@
 
 let
   pname = "ghidra";
-  version = "11.4.2";
+  version = "11.3.2";
 
   isMacArm64 = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
 
@@ -29,7 +29,7 @@ let
     owner = "NationalSecurityAgency";
     repo = "Ghidra";
     rev = "Ghidra_${version}_build";
-    hash = "sha256-/veSp2WuGOF0cYwUC4QFJD6kaMae5NuKrQ5Au4LjDe8=";
+    hash = "sha256-EvIOC/VIUaEl7eneVzgEt2fhLSP9DaawMAutk4ouFp8=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/ghidra-xenia-v2/deps.json

@@ -99,14 +99,11 @@
   }
  },
  "https://ftp.postgresql.org": {
-  "pub/source/v15.13/postgresql-15.13": {
+  "pub/source/v15.10/postgresql-15.10": {
-   "tar.gz": "sha256-r9wisKblvse2VyN1a5DUTqkR5hsvewHE3FUkq4E7TYk="
+   "tar.gz": "sha256-FzNmYFJZqD3BicQyf/TDclSv7WW0+GbL2KXvLqRJ6PM="
   }
  },
- "https://github.com/NationalSecurityAgency/ghidra-data/raw/Ghidra_11.4.2": {
+ "https://github.com/NationalSecurityAgency/ghidra-data/raw/Ghidra_11.3.2": {
-  "Debugger/dbgmodel": {
-   "tlb": "sha256-jPXzouuBFgqjSQVqXKTCxyaxtumL8wl81BNRRxYzQ8c="
-  },
   "FunctionID/vs2012_x64": {
    "fidb": "sha256-1OmKs/eQuDF5MhhDC7oNiySl+/TaZbDB/6jLDPvrDNw="
   },
@@ -286,10 +283,6 @@
    "jar": "sha256-fZOMgXiQKARcCMBl6UvnX8KAUnYg1b1itRnVg4UyNoo=",
    "pom": "sha256-w1zKe2HUZ42VeMvAuQG4cXtTmr+SVEQdp4uP5g3gZNA="
   },
-  "commons-codec#commons-codec/1.18.0": {
-   "jar": "sha256-ugBfMEzvkqPe3iSjitWsm4r8zw2PdYOdbBM4Y0z39uQ=",
-   "pom": "sha256-dLkW2ksDhMYZ5t1MGN7+iqQ4f3lSBSU8+0u7L0WM3c4="
-  },
   "commons-collections#commons-collections/3.2.2": {
    "jar": "sha256-7urpF5FxRKaKdB1MDf9mqlxcX9hVk/8he87T/Iyng7g=",
    "pom": "sha256-1dgfzCiMDYxxHDAgB8raSqmiJu0aES1LqmTLHWMiFws="
@@ -298,10 +291,6 @@
    "jar": "sha256-lhsvbYfbrMXVSr9Fq3puJJX4m3VZiWLYxyPOqbwhCQg=",
    "pom": "sha256-LgFv1+MkS18sIKytg02TqkeQSG7h5FZGQTYaPoMe71k="
   },
-  "commons-io#commons-io/2.19.0": {
-   "jar": "sha256-gkJokZtLYvn0DwjFQ4HeWZOwePWGZ+My0XNIrgGdcrk=",
-   "pom": "sha256-VCt6UC7WGVDRuDEStRsWF9NAfjpN9atWqY12Dg+MWVA="
-  },
   "commons-lang#commons-lang/2.6": {
    "jar": "sha256-UPEbCfh3wpTVbyRGP0fSj5Kc9QRPZIZhwPDPuumi9Jw=",
    "pom": "sha256-7Xa4iRwwtWYonHQ2Vvik1DWYaYJDjUDFZ8YmIzJH5xE="
@@ -343,9 +332,9 @@
    "jar": "sha256-/PSSLTj/hRhPHSMoMXu2CCbhTalIq9YG7j1bjGpw3r0=",
    "pom": "sha256-uIEr4lGsoTl/S2pCO/Tt06KERONFOyIDtTSTNrmVgik="
   },
-  "junit#junit/4.13.2": {
+  "junit#junit/4.12": {
-   "jar": "sha256-jklbY0Rp1k+4rPo0laBly6zIoP/1XOHjEAe+TBbcV9M=",
+   "jar": "sha256-WXIfCAXiI9hLkGd4h9n/Vn3FNNfFAsqQPAwrF/BcEWo=",
-   "pom": "sha256-Vptpd+5GA8llwcRsMFj6bpaSkbAWDraWTdCSzYnq3ZQ="
+   "pom": "sha256-kPFj944/+28cetl96efrpO6iWAcUG4XW0SvmfKJUScQ="
   },
   "kr/motd/maven#os-maven-plugin/1.7.0": {
    "jar": "sha256-lDBTUBpCnlPRxNYhUu7BJfo2Yg4NxmtzkKiVCXz96s4=",
@@ -443,9 +432,6 @@
   "org/apache#apache/27": {
    "pom": "sha256-srD8aeIqZQw4kvHDZtdwdvKVdcZzjfTHpwpEhESEzfk="
   },
-  "org/apache#apache/33": {
-   "pom": "sha256-14vYUkxfg4ChkKZSVoZimpXf5RLfIRETg6bYwJI6RBU="
-  },
   "org/apache#apache/7": {
    "pom": "sha256-E5fOHbQzrcnyI9vwdJbRM2gUSHUfSuKeWPaOePtLbCU="
   },
@@ -457,9 +443,9 @@
    "jar": "sha256-Hfi5QwtcjtFD14FeQD4z71NxskAKrb6b2giDdi4IRtE=",
    "pom": "sha256-JxvWc4Oa9G5zr/lX4pGNS/lvWsT2xs9NW+k/0fEnHE0="
   },
-  "org/apache/commons#commons-compress/1.27.1": {
+  "org/apache/commons#commons-compress/1.21": {
-   "jar": "sha256-KT2A9UtTa3QJXc1+o88KKbv8NAJRkoEzJJX0Qg03DRY=",
+   "jar": "sha256-auz9VFlyillWAc+gcljRMZcv/Dm0kutIvdWWV3ovJEo=",
-   "pom": "sha256-34zBqDh9TOhCNjtyCf3G0135djg5/T/KtVig+D+dhBw="
+   "pom": "sha256-Z1uwI8m+7d4yMpSZebl0Kl/qlGKApVobRi1Mp4AQiM0="
   },
   "org/apache/commons#commons-dbcp2/2.9.0": {
    "jar": "sha256-iHcgkSxcu83/bg4h1QNJN1Vfj/xZc4Hv+Pp38zzm1k4=",
@@ -468,9 +454,9 @@
   "org/apache/commons#commons-lang3/3.11": {
    "pom": "sha256-mA1mXYP+0EZlE08FeOUHRCoOdQaRBzeEORsKeYhySnU="
   },
-  "org/apache/commons#commons-lang3/3.17.0": {
+  "org/apache/commons#commons-lang3/3.12.0": {
-   "jar": "sha256-bucx31yOWil2ocoCO2uzIOqNNTn75kyKHVy3ZRJ8M7Q=",
+   "jar": "sha256-2RnZBEhsA3+NGTQS2gyS4iqfokIwudZ6V4VcXDHH6U4=",
-   "pom": "sha256-NRxuSUDpObHzMN9H9g8Tujg9uB7gCBga9UHzoqbSpWw="
+   "pom": "sha256-gtMfHcxFg+/9dE6XkWWxbaZL+GvKYj/F0bA+2U9FyFo="
   },
   "org/apache/commons#commons-lang3/3.9": {
    "pom": "sha256-pAIkKbmEJbQwGBkVchJ5pS9hDzRki9rEh9TKy76N/rU="
@@ -502,18 +488,6 @@
   "org/apache/commons#commons-parent/54": {
    "pom": "sha256-AA2Bh5UrIjcC/eKW33mVY/Nd6CznKttOe/FXNCN4++M="
   },
-  "org/apache/commons#commons-parent/72": {
-   "pom": "sha256-Q0Xev8dnsa6saKvdcvxn0YtSHUs5A3KhG2P/DFhrIyA="
-  },
-  "org/apache/commons#commons-parent/73": {
-   "pom": "sha256-TtRFYLB/hEhHnf0eg6Qiuk6D5gs25RsocaxQKm1cG+o="
-  },
-  "org/apache/commons#commons-parent/79": {
-   "pom": "sha256-Yo3zAUis08SRz8trc8euS1mJ5VJqsTovQo3qXUrRDXo="
-  },
-  "org/apache/commons#commons-parent/81": {
-   "pom": "sha256-NI1OfBMb5hFMhUpxnOekQwenw5vTZghJd7JP0prQ7bQ="
-  },
   "org/apache/commons#commons-pool2/2.11.1": {
    "jar": "sha256-6gUF7nUV5YsawOaG5NGl2ffYCOJRphvDcaoFlbmWP4M=",
    "pom": "sha256-wbsCmUpK34loDfepitujPFUnaDAUJy1liFuzA27NSMM="
@@ -549,17 +523,17 @@
   "org/apache/logging/log4j#log4j/2.17.1": {
    "pom": "sha256-lnq8AkRDqcsJaTVVmvXprW8P9hN1+Esn1EDS+nCAawk="
   },
-  "org/bouncycastle#bcpkix-jdk18on/1.80": {
+  "org/bouncycastle#bcpkix-jdk15on/1.69": {
-   "jar": "sha256-T0umqSYX6hncGD8PpdtJLu5Cb93ioKLWyUd3/9GvZBM=",
+   "jar": "sha256-QIN20Xqqh4nnrNBV/kBCiaEfozX9fGinUykEn7fSjtI=",
-   "pom": "sha256-pKEiETRntyjhjyb7DP1X8LGg18SlO4Zxis5wv4uG7Uc="
+   "pom": "sha256-WrvkytLCMJR0ZvsgmiJn48xqDTgKajGRWVnTqtm4F2w="
   },
-  "org/bouncycastle#bcprov-jdk18on/1.80": {
+  "org/bouncycastle#bcprov-jdk15on/1.69": {
-   "jar": "sha256-6K0gn4xY0pGjfKl1Dp6frGBZaVbJg+Sd2Cgjgd2LMkk=",
+   "jar": "sha256-5Gm9Ofk2mZ8lYAJjEAP/AioilR2p1b2Xicer+pdjopI=",
-   "pom": "sha256-oKdcdtkcQh7qVtD2Bi+49j7ff6x+xyT9QgzNytcYHUM="
+   "pom": "sha256-/YHicUSVvOeeauazAp2s0kzyz/NAJB2lgQVYlae6eN4="
   },
-  "org/bouncycastle#bcutil-jdk18on/1.80": {
+  "org/bouncycastle#bcutil-jdk15on/1.69": {
-   "jar": "sha256-Iuymh/eVVBH0Vq8z5uqOaPxzzYDLizKqX3qLGCfXxng=",
+   "jar": "sha256-KeQOJGbQQNgqbw6ZY10LwrujqUJRz3k5zwtpMhyu/Ak=",
-   "pom": "sha256-Qhp95L/rnFs4sfxHxCagh9kIeJVdQQf1t6gusde3R7Y="
+   "pom": "sha256-p2e8fzQtGTKJfso8i6zHAEygOAv6dSnyOpc0VJZcffw="
   },
   "org/checkerframework#checker-compat-qual/2.5.2": {
    "pom": "sha256-da9ztewybj29yUayH9RoAtXafGEsO/Hlh1N0yY1+pP0="
@@ -573,10 +547,10 @@
    "module": "sha256-clinadyqJrmBVNIp2FzHLls2ZrC8tjfS2vFuxJiVZjg=",
    "pom": "sha256-AjkvvUziGQH5RWFUcrHU1NNZGzqr3wExBfXJLsMstPA="
   },
-  "org/checkerframework#checker-qual/3.49.3": {
+  "org/checkerframework#checker-qual/3.42.0": {
-   "jar": "sha256-Nn7b8v6fYGwf21qLpuHJwnYlmT4f+VTjho3nC8xkFrc=",
+   "jar": "sha256-zK7dM68LeJTZ8vO2RPTRnkOSjjKQLmGsTRB3eDD1qsc=",
-   "module": "sha256-dv9CWNsfoaC8bOeur0coPfEGD9Q3oJvm7zxcMmnqWtM=",
+   "module": "sha256-4PpiK33mPq4RBH726RtMKtDx8OE8uQP/UggKR/V6V0Y=",
-   "pom": "sha256-i+QBdkYoXZFCx/sibPuARFwXfcfBNjsj2UH6bJuwXc8="
+   "pom": "sha256-v1/KqycvVMvPG753w72WPIIcmrrSBYcIvwvtPIdUlMo="
   },
   "org/codehaus#codehaus-parent/3": {
    "pom": "sha256-UOslOs0LbuBI9DLZ/Do7NiZO+z2h/6f7B/bE1LeoyjE="
@@ -605,10 +579,6 @@
    "jar": "sha256-YwKKfV6V7sjibuBCSxQfh+nalccYTypaSbtD371TsQQ=",
    "pom": "sha256-zMoEy/7Z60gzSM+6aexh9gvdyfPjwJJLZLsZ0cqy4s0="
   },
-  "org/commonmark#commonmark-ext-gfm-tables/0.23.0": {
-   "jar": "sha256-WfO2Gthywhg7guygUn14GspFThF31xmMl5WydH0XC3s=",
-   "pom": "sha256-x6/bJCGgs9hFDewHWaPrfBHEqZfTlLd8VR3Bgi3S2Uk="
-  },
   "org/commonmark#commonmark-ext-heading-anchor/0.23.0": {
    "jar": "sha256-7O27O1jbcgxhNXwb4boTKlweeczr4B8NPZo25VJCDL0=",
    "pom": "sha256-95zHry5Zpgc70UwPNKezU0JDO5FxqhdLYzeHRaVuASw="
@@ -699,17 +669,9 @@
    "jar": "sha256-EhJRcOeVUZum3IAQwHC1PHaq6StIXB43Uw5Uq13QjUM=",
    "pom": "sha256-EMo7z1F48YUH8hCmOtljeJaFM0OtHBKRoBmhFvIWpUg="
   },
-  "org/junit#junit-bom/5.11.0": {
+  "org/junit#junit-bom/5.7.1": {
-   "module": "sha256-9+2+Z/IgQnCMQQq8VHQI5cR29An1ViNqEXkiEnSi7S0=",
+   "module": "sha256-mFTjiU1kskhSB+AEa8oHs9QtFp54L0+oyc4imnj67gQ=",
-   "pom": "sha256-5nRZ1IgkJKxjdPQNscj0ouiJRrNAugcsgL6TKivkZE0="
+   "pom": "sha256-C5sUo9YhBvr+jGinF7h7h60YaFiZRRt1PAT6QbaFd4Q="
-  },
-  "org/junit#junit-bom/5.11.0-M2": {
-   "module": "sha256-hkd6vPSQ1soFmqmXPLEI0ipQb0nRpVabsyzGy/Q8LM4=",
-   "pom": "sha256-Sj/8Sk7c/sLLXWGZInBqlAcWF5hXGTn4VN/ac+ThfMg="
-  },
-  "org/junit#junit-bom/5.11.4": {
-   "module": "sha256-qaTye+lOmbnVcBYtJGqA9obSd9XTGutUgQR89R2vRuQ=",
-   "pom": "sha256-GdS3R7IEgFMltjNFUylvmGViJ3pKwcteWTpeTE9eQRU="
   },
   "org/junit#junit-bom/5.7.2": {
    "module": "sha256-87zrHFndT2mT9DBN/6WAFyuN9lp2zTb6T9ksBXjSitg=",
@@ -773,9 +735,9 @@
    "jar": "sha256-jK3UOsXrbQneBfrsyji5F6BAu5E5x+3rTMgcdAtxMoE=",
    "pom": "sha256-cimwOzCnPukQCActnkVppR2FR/roxQ9SeEGu9MGwuqg="
   },
-  "org/postgresql#postgresql/42.7.6": {
+  "org/postgresql#postgresql/42.7.3": {
-   "jar": "sha256-8qHMA1LdXlxvZdut/ye+4Awy5DLGrQMNB0R/ilmDxCo=",
+   "jar": "sha256-omRMv7obqhRf9+jI71gqbu16fsTKeS9/BUEivex1Ymg=",
-   "pom": "sha256-SfNzCJO2khPK99foymodjHaf9mhCHVJS3gBSvFVGp8c="
+   "pom": "sha256-wqy2hFfZlqjkntB3flklW3RlCXZSOVHxAa25QHXhWIU="
   },
   "org/python#jython-standalone/2.7.4": {
    "jar": "sha256-H7oXae/8yLGfXhBDa8gnShWM6YhVnyV5J8JMc7sTfzw=",

pkgs/ghidra-xenia-v2/extensions/findcrypt/default.nix

@@ -3,23 +3,26 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-buildGhidraExtension (finalAttrs: {
+let
+  version = "3.0.5";
+in
+buildGhidraExtension {
   pname = "findcrypt";
-  version = "3.1.2";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "antoniovazquezblanco";
     repo = "GhidraFindcrypt";
-    rev = "v${finalAttrs.version}";
+    rev = "v${version}";
-    hash = "sha256-KP6Wx2U8O/37yEAcV3abKg/uWraHJJOIfb7kvcfejHA=";
+    hash = "sha256-gWVYy+PWpNXlcgD83jap4IFRv66qdhloOwvpQVU2TcI=";
   };
 
   meta = {
     description = "Ghidra analysis plugin to locate cryptographic constants";
     homepage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt";
-    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
+    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
-    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.BonusPlay ];
   };
-})
+}

pkgs/ghidra-xenia-v2/extensions/ghidra-delinker-extension/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  ghidra,
+  gradle,
+  fetchFromGitHub,
+}:
+let
+  version = "0.5.1";
+  self = ghidra.buildGhidraExtension {
+    pname = "ghidra-delinker-extension";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "boricj";
+      repo = "ghidra-delinker-extension";
+      rev = "v${version}";
+      hash = "sha256-h6F50Z7S6tPOl9mIhChLKoFxHuAkq/n36ysUEFwWGxI=";
+    };
+
+    postPatch = ''
+      substituteInPlace build.gradle \
+        --replace-fail '"''${getGitHash()}"' '"v${version}"'
+    '';
+
+    gradleBuildTask = "buildExtension";
+
+    __darwinAllowLocalNetworking = true;
+
+    mitmCache = gradle.fetchDeps {
+      pkg = self;
+      data = ./deps.json;
+    };
+
+    meta = {
+      description = "Ghidra extension for delinking executables back to object files";
+      homepage = "https://github.com/boricj/ghidra-delinker-extension";
+      license = lib.licenses.asl20;
+      maintainers = [ lib.maintainers.jchw ];
+      platforms = lib.platforms.unix;
+    };
+  };
+in
+self

pkgs/ghidra-xenia-v2/extensions/ghidra-golanganalyzerextension/default.nix

@@ -3,22 +3,22 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-buildGhidraExtension (finalAttrs: {
+buildGhidraExtension rec {
   pname = "Ghidra-GolangAnalyzerExtension";
   version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "mooncat-greenpy";
     repo = "Ghidra_GolangAnalyzerExtension";
-    rev = finalAttrs.version;
+    rev = version;
     hash = "sha256-uxozIJ+BLcP1vBnLOCZD9ueY10hd37fON/Miii3zabo=";
   };
 
   meta = {
     description = "Facilitates the analysis of Golang binaries using Ghidra";
     homepage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension";
-    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${finalAttrs.version}";
+    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${version}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ivyfanchiang ];
   };
-})
+}

pkgs/ghidra-xenia-v2/extensions/gnudisassembler/default.nix

@@ -42,8 +42,7 @@ buildGhidraExtension {
     bison
     texinfo
     perl
-  ]
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
 
   buildInputs = [ zlib ];
   gradleBuildTask = "assemble";

pkgs/ghidra-xenia-v2/extensions/kaiju/default.nix

@@ -24,15 +24,15 @@ let
     }
   );
 
-  self = buildGhidraExtension (finalAttrs: {
+  self = buildGhidraExtension rec {
     pname = "kaiju";
-    version = "250828";
+    version = "250417";
 
     src = fetchFromGitHub {
       owner = "CERTCC";
       repo = "kaiju";
-      rev = finalAttrs.version;
+      rev = version;
-      hash = "sha256-edsQIBoOTY+WxVBtH1bbM7TZZHhA0jgVb2iJKC66iVM=";
+      hash = "sha256-SSvCb3xnOh0mb3H24RJTi11UmN2ARgFgsiiKlZXyufM=";
     };
 
     buildInputs = [
@@ -43,9 +43,9 @@ let
     # https://github.com/CERTCC/kaiju/blob/c9dbb55484b3d2a6abd9dfca2197cd00fb7ee3c1/build.gradle#L189
     preBuild = ''
       mkdir -p build/cmake/z3/java-bindings
-      ln -s ${lib.getOutput "java" z3_lib}/share/java/com.microsoft.z3.jar build/cmake/z3/java-bindings
+      ln -s ${lib.getOutput "lib" z3_lib}/lib/com.microsoft.z3.jar build/cmake/z3/java-bindings
       mkdir -p os/${ghidraPlatformName}
-      cp ${lib.getOutput "java" z3_lib}/lib/* os/${ghidraPlatformName}
+      cp ${lib.getOutput "lib" z3_lib}/lib/* os/${ghidraPlatformName}
     '';
 
     gradleFlags = [ "-PKAIJU_SKIP_Z3_BUILD=true" ];
@@ -56,9 +56,9 @@ let
     };
 
     meta = {
-      description = "Java implementation of some features of the CERT Pharos Binary Analysis Framework for Ghidra";
+      description = "A Java implementation of some features of the CERT Pharos Binary Analysis Framework for Ghidra";
       homepage = "https://github.com/CERTCC/kaiju";
-      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${finalAttrs.version}";
+      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${version}";
       license = lib.licenses.bsd3;
       maintainers = [ lib.maintainers.ivyfanchiang ];
       platforms = [
@@ -68,6 +68,6 @@ let
         "aarch64-darwin"
       ];
     };
-  });
+  };
 in
 self

pkgs/ghidra-xenia-v2/extensions/lightkeeper/default.nix

@@ -3,22 +3,22 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-buildGhidraExtension (finalAttrs: {
+buildGhidraExtension rec {
   pname = "lightkeeper";
   version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "WorksButNotTested";
     repo = "lightkeeper";
-    rev = finalAttrs.version;
+    rev = version;
     hash = "sha256-aGMWg6VQleKH/txlxpSw19QOotWZSqeW5Ve2SpWGhgA=";
   };
   preConfigure = ''
     cd lightkeeper
   '';
   meta = {
-    description = "Port of the Lighthouse plugin to GHIDRA";
+    description = "A port of the Lighthouse plugin to GHIDRA.";
     homepage = "https://github.com/WorksButNotTested/lightkeeper";
     license = lib.licenses.asl20;
   };
-})
+}

pkgs/ghidra-xenia-v2/extensions/wasm/default.nix

@@ -5,15 +5,18 @@
   ghidra,
   ant,
 }:
-buildGhidraExtension (finalAttrs: {
+let
+  version = "2.3.1";
+in
+buildGhidraExtension {
   pname = "wasm";
-  version = "2.3.2";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "nneonneo";
     repo = "ghidra-wasm-plugin";
-    rev = "v${finalAttrs.version}";
+    rev = "v${version}";
-    hash = "sha256-JFUPhh4WUcfxYow3kLMyva1Ni/cQBIit983o/KbbKps=";
+    hash = "sha256-aoSMNzv+TgydiXM4CbvAyu/YsxmdZPvpkZkYEE3C+V4=";
   };
 
   nativeBuildInputs = [ ant ];
@@ -32,9 +35,9 @@ buildGhidraExtension (finalAttrs: {
   meta = {
     description = "Ghidra Wasm plugin with disassembly and decompilation support";
     homepage = "https://github.com/nneonneo/ghidra-wasm-plugin";
-    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
+    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
-    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.BonusPlay ];
   };
-})
+}

pkgs/kicad-xenia/addons/default.nix

@@ -0,0 +1,5 @@
+{ kicad }:
+{
+  kikit = kicad.callPackage ./kikit.nix { addonName = "kikit"; };
+  kikit-library = kicad.callPackage ./kikit.nix { addonName = "kikit-library"; };
+}

pkgs/kicad-xenia/addons/kikit.nix

@@ -0,0 +1,52 @@
+# For building the multiple addons that are in the kikit repo.
+{ stdenv
+, bc
+, kikit
+, zip
+, python3
+, addonName
+, addonPath
+}:
+let
+  # This python is only used when building the package, it's not the python
+  # environment that will ultimately run the code packaged here. The python env defined
+  # in KiCad will import the python code packaged here when KiCad starts up.
+  python = python3.withPackages (ps: with ps; [ click ]);
+  kikit-module = python3.pkgs.toPythonModule (kikit.override { inherit python3; });
+
+  # The following different addons can be built from the same source.
+  targetSpecs = {
+    "kikit" = {
+      makeTarget = "pcm-kikit";
+      resultZip = "pcm-kikit.zip";
+      description = "KiCad plugin and a CLI tool to automate several tasks in a standard KiCad workflow";
+    };
+    "kikit-library" = {
+      makeTarget = "pcm-lib";
+      resultZip = "pcm-kikit-lib.zip";
+      description = "KiKit uses these symbols and footprints to annotate your boards (e.g., to place a tab in a panel).";
+    };
+  };
+  targetSpec = targetSpecs.${addonName};
+in
+stdenv.mkDerivation {
+  name = "kicadaddon-${addonName}";
+  inherit (kikit-module) src version;
+
+  nativeBuildInputs = [ python bc zip ];
+  propagatedBuildInputs = [ kikit-module ];
+
+  buildPhase = ''
+    patchShebangs scripts/setJson.py
+    make ${targetSpec.makeTarget}
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv build/${targetSpec.resultZip} $out/${addonPath}
+  '';
+
+  meta = kikit-module.meta // {
+    description = targetSpec.description;
+  };
+}

pkgs/kicad-xenia/base.nix

@@ -0,0 +1,211 @@
+{ lib
+, stdenv
+, cmake
+, libGLU
+, libGL
+, zlib
+, wxGTK
+, gtk3
+, libX11
+, gettext
+, glew
+, glm
+, cairo
+, curl
+, openssl
+, boost
+, pkg-config
+, doxygen
+, graphviz
+, pcre
+, libpthreadstubs
+, libXdmcp
+, unixODBC
+, libgit2
+, libsecret
+, libgcrypt
+, libgpg-error
+
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, libxkbcommon
+, libepoxy
+, dbus
+, at-spi2-core
+, libXtst
+, pcre2
+, libdeflate
+
+, swig4
+, python
+, wxPython
+, opencascade-occt_7_6
+, libngspice
+, valgrind
+
+, stable
+, testing
+, baseName
+, kicadSrc
+, kicadVersion
+, withNgspice
+, withScripting
+, withI18n
+, debug
+, sanitizeAddress
+, sanitizeThreads
+}:
+
+assert lib.assertMsg (!(sanitizeAddress && sanitizeThreads))
+  "'sanitizeAddress' and 'sanitizeThreads' are mutually exclusive, use one.";
+assert testing -> !stable
+  -> throw "testing implies stable and cannot be used with stable = false";
+
+let
+  opencascade-occt = opencascade-occt_7_6;
+  inherit (lib) optional optionals optionalString;
+in
+stdenv.mkDerivation rec {
+  pname = "kicad-base";
+  version = if (stable) then kicadVersion else builtins.substring 0 10 src.rev;
+
+  src = kicadSrc;
+
+  patches = [
+    # upstream issue 12941 (attempted to upstream, but appreciably unacceptable)
+    ./writable.patch
+    # https://gitlab.com/kicad/code/kicad/-/issues/15687
+    ./runtime_stock_data_path.patch
+  ];
+
+  # tagged releases don't have "unknown"
+  # kicad testing and nightlies use git describe --dirty
+  # nix removes .git, so its approximated here
+  postPatch = lib.optionalString (!stable || testing) ''
+    substituteInPlace cmake/KiCadVersion.cmake \
+      --replace "unknown" "${builtins.substring 0 10 src.rev}"
+
+    substituteInPlace cmake/CreateGitVersionHeader.cmake \
+      --replace "0000000000000000000000000000000000000000" "${src.rev}"
+  '';
+
+  makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
+
+  cmakeFlags = [
+    "-DKICAD_USE_EGL=ON"
+    "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
+    # https://gitlab.com/kicad/code/kicad/-/issues/17133
+    "-DCMAKE_CTEST_ARGUMENTS='--exclude-regex;qa_spice'"
+  ]
+  ++ optional (stdenv.hostPlatform.system == "aarch64-linux")
+    "-DCMAKE_CTEST_ARGUMENTS=--exclude-regex;'qa_spice|qa_cli'"
+  ++ optional (stable && !withNgspice) "-DKICAD_SPICE=OFF"
+  ++ optionals (!withScripting) [
+    "-DKICAD_SCRIPTING_WXPYTHON=OFF"
+  ]
+  ++ optionals (withI18n) [
+    "-DKICAD_BUILD_I18N=ON"
+  ]
+  ++ optionals (!doInstallCheck) [
+    "-DKICAD_BUILD_QA_TESTS=OFF"
+  ]
+  ++ optionals (debug) [
+    "-DKICAD_STDLIB_DEBUG=ON"
+    "-DKICAD_USE_VALGRIND=ON"
+  ]
+  ++ optionals (sanitizeAddress) [
+    "-DKICAD_SANITIZE_ADDRESS=ON"
+  ]
+  ++ optionals (sanitizeThreads) [
+    "-DKICAD_SANITIZE_THREADS=ON"
+  ];
+
+  cmakeBuildType = if debug then "Debug" else "Release";
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    graphviz
+    pkg-config
+    libgit2
+    libsecret
+    libgcrypt
+    libgpg-error
+  ]
+  # wanted by configuration on linux, doesn't seem to affect performance
+  # no effect on closure size
+  ++ optionals (stdenv.isLinux) [
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
+    libXtst
+    pcre2
+  ];
+
+  buildInputs = [
+    libGLU
+    libGL
+    zlib
+    libX11
+    wxGTK
+    gtk3
+    pcre
+    libXdmcp
+    gettext
+    glew
+    glm
+    libpthreadstubs
+    cairo
+    curl
+    openssl
+    boost
+    swig4
+    python
+    unixODBC
+    libdeflate
+    opencascade-occt
+  ]
+  ++ optional (withScripting) wxPython
+  ++ optional (withNgspice) libngspice
+  ++ optional (debug) valgrind;
+
+  # some ngspice tests attempt to write to $HOME/.cache/
+  # this could be and was resolved with XDG_CACHE_HOME = "$TMP";
+  # but failing tests still attempt to create $HOME
+  # and the newer CLI tests seem to also use $HOME...
+  HOME = "$TMP";
+
+  # debug builds fail all but the python test
+  doInstallCheck = !(debug);
+  installCheckTarget = "test";
+
+  nativeInstallCheckInputs = [
+    (python.withPackages(ps: with ps; [
+      numpy
+      pytest
+      cairosvg
+      pytest-image-diff
+    ]))
+  ];
+
+  dontStrip = debug;
+
+  meta = {
+    description = "Just the built source without the libraries";
+    longDescription = ''
+      Just the build products, the libraries are passed via an env var in the wrapper, default.nix
+    '';
+    homepage = "https://www.kicad.org/";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+  };
+}

pkgs/kicad-xenia/default.nix

@@ -0,0 +1,298 @@
+{ lib, stdenv
+, runCommand
+, newScope
+, fetchFromGitLab
+, fetchgit
+, makeWrapper
+, symlinkJoin
+, callPackage
+, callPackages
+
+, gnome
+, dconf
+, gtk3
+, wxGTK32
+, librsvg
+, cups
+, gsettings-desktop-schemas
+, hicolor-icon-theme
+
+, unzip
+, jq
+
+, pname ? "kicad"
+, stable ? true
+, testing ? false
+, withNgspice ? !stdenv.isDarwin
+, libngspice
+, withScripting ? true
+, python3
+, addons ? [ ]
+, debug ? false
+, sanitizeAddress ? false
+, sanitizeThreads ? false
+, with3d ? true
+, withI18n ? true
+, srcs ? { }
+}:
+
+# `addons`: https://dev-docs.kicad.org/en/addons/
+#
+# ```nix
+# kicad = pkgs.kicad.override {
+#   addons = with pkgs.kicadAddons; [ kikit kikit-library ];
+# };
+# ```
+
+# The `srcs` parameter can be used to override the kicad source code
+# and all libraries, which are otherwise inaccessible
+# to overlays since most of the kicad build expression has been
+# refactored into base.nix, most of the library build expressions have
+# been refactored into libraries.nix. Overrides are only applied when
+# building `kicad-unstable`. The `srcs` parameter has
+# no effect for stable `kicad`. `srcs` takes an attribute set in which
+# any of the following attributes are meaningful (though none are
+# mandatory): "kicad", "kicadVersion", "symbols", "templates",
+# "footprints", "packages3d", and "libVersion". "kicadVersion" and
+# "libVersion" should be set to a string with the desired value for
+# the version attribute in kicad's `mkDerivation` and the version
+# attribute in any of the library's `mkDerivation`, respectively.
+# "kicad", "symbols", "templates", "footprints", and "packages3d"
+# should be set to an appropriate fetcher (e.g. `fetchFromGitLab`).
+# So, for example, a possible overlay for kicad is:
+#
+# final: prev:
+
+# {
+#   kicad-unstable = (prev.kicad-unstable.override {
+#     srcs = {
+#       kicadVersion = "2020-10-08";
+#       kicad = prev.fetchFromGitLab {
+#         group = "kicad";
+#         owner = "code";
+#         repo = "kicad";
+#         rev = "fd22fe8e374ce71d57e9f683ba996651aa69fa4e";
+#         sha256 = "sha256-F8qugru/jU3DgZSpQXQhRGNFSk0ybFRkpyWb7HAGBdc=";
+#       };
+#     };
+#   });
+# }
+
+let
+  baseName = if (testing) then "kicad-testing"
+    else if (stable) then "kicad"
+    else "kicad-unstable";
+  versionsImport = import ./versions.nix;
+
+  # versions.nix does not provide us with version, src and rev. We
+  # need to turn this into approprate fetcher calls.
+  #kicadSrcFetch = fetchFromGitLab {
+  #  group = "kicad";
+  #  owner = "code";
+  #  repo = "kicad";
+  #  rev = versionsImport.${baseName}.kicadVersion.src.rev;
+  #  sha256 = versionsImport.${baseName}.kicadVersion.src.sha256;
+  #};
+  kicadSrcFetch = fetchgit {
+    url = "https://git.lain.faith/haskal/kicad.git";
+    rev = versionsImport.${baseName}.kicadVersion.src.rev;
+    sha256 = versionsImport.${baseName}.kicadVersion.src.sha256;
+  };
+
+  libSrcFetch = name: fetchFromGitLab {
+    group = "kicad";
+    owner = "libraries";
+    repo = "kicad-${name}";
+    rev = versionsImport.${baseName}.libVersion.libSources.${name}.rev;
+    sha256 = versionsImport.${baseName}.libVersion.libSources.${name}.sha256;
+  };
+
+  # only override `src` or `version` if building `kicad-unstable` with
+  # the appropriate attribute defined in `srcs`.
+  srcOverridep = attr: (!stable && builtins.hasAttr attr srcs);
+
+  # use default source and version (as defined in versions.nix) by
+  # default, or use the appropriate attribute from `srcs` if building
+  # unstable with `srcs` properly defined.
+  kicadSrc =
+    if srcOverridep "kicad" then srcs.kicad
+    else kicadSrcFetch;
+  kicadVersion =
+    if srcOverridep "kicadVersion" then srcs.kicadVersion
+    else versionsImport.${baseName}.kicadVersion.version;
+
+  libSrc = name: if srcOverridep name then srcs.${name} else libSrcFetch name;
+  # TODO does it make sense to only have one version for all libs?
+  libVersion =
+    if srcOverridep "libVersion" then srcs.libVersion
+    else versionsImport.${baseName}.libVersion.version;
+
+  wxGTK = wxGTK32;
+  python = python3;
+  wxPython = python.pkgs.wxpython;
+  addonPath = "addon.zip";
+  addonsDrvs = map (pkg: pkg.override { inherit addonPath python3; }) addons;
+
+  addonsJoined =
+    runCommand "addonsJoined"
+      {
+        inherit addonsDrvs;
+        nativeBuildInputs = [ unzip jq ];
+      } ''
+      mkdir $out
+
+      for pkg in $addonsDrvs; do
+        unzip $pkg/addon.zip -d unpacked
+
+        folder_name=$(jq .identifier unpacked/metadata.json --raw-output | tr . _)
+        for d in unpacked/*; do
+          if [ -d "$d" ]; then
+            dest=$out/share/kicad/scripting/$(basename $d)/$folder_name
+            mkdir -p $(dirname $dest)
+
+            mv $d $dest
+          fi
+        done
+        rm -r unpacked
+      done
+    '';
+
+  inherit (lib) concatStringsSep flatten optionalString optionals;
+in
+stdenv.mkDerivation rec {
+
+  # Common libraries, referenced during runtime, via the wrapper.
+  passthru.libraries = callPackages ./libraries.nix { inherit libSrc; };
+  passthru.callPackage = newScope { inherit addonPath python3; };
+  base = callPackage ./base.nix {
+    inherit stable testing baseName;
+    inherit kicadSrc kicadVersion;
+    inherit wxGTK python wxPython;
+    inherit withNgspice withScripting withI18n;
+    inherit debug sanitizeAddress sanitizeThreads;
+  };
+
+  inherit pname;
+  version = if (stable) then kicadVersion else builtins.substring 0 10 src.src.rev;
+
+  src = base;
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  pythonPath = optionals (withScripting)
+    [ wxPython python.pkgs.six python.pkgs.requests ] ++ addonsDrvs;
+
+  nativeBuildInputs = [ makeWrapper ]
+    ++ optionals (withScripting)
+    [ python.pkgs.wrapPython ];
+
+  # KICAD7_TEMPLATE_DIR only works with a single path (it does not handle : separated paths)
+  # but it's used to find both the templates and the symbol/footprint library tables
+  # https://gitlab.com/kicad/code/kicad/-/issues/14792
+  template_dir = symlinkJoin {
+    name = "KiCad_template_dir";
+    paths = with passthru.libraries; [
+      "${templates}/share/kicad/template"
+      "${footprints}/share/kicad/template"
+      "${symbols}/share/kicad/template"
+    ];
+  };
+  # We are emulating wrapGAppsHook3, along with other variables to the wrapper
+  makeWrapperArgs = with passthru.libraries; [
+    "--prefix XDG_DATA_DIRS : ${base}/share"
+    "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
+    "--prefix XDG_DATA_DIRS : ${gnome.adwaita-icon-theme}/share"
+    "--prefix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}"
+    "--prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
+    # wrapGAppsHook3 did these two as well, no idea if it matters...
+    "--prefix XDG_DATA_DIRS : ${cups}/share"
+    "--prefix GIO_EXTRA_MODULES : ${dconf}/lib/gio/modules"
+    # required to open a bug report link in firefox-wayland
+    "--set-default MOZ_DBUS_REMOTE 1"
+    "--set-default KICAD8_FOOTPRINT_DIR ${footprints}/share/kicad/footprints"
+    "--set-default KICAD8_SYMBOL_DIR ${symbols}/share/kicad/symbols"
+    "--set-default KICAD8_TEMPLATE_DIR ${template_dir}"
+  ]
+  ++ optionals (addons != [ ]) (
+    let stockDataPath = symlinkJoin {
+      name = "kicad_stock_data_path";
+      paths = [
+        "${base}/share/kicad"
+        "${addonsJoined}/share/kicad"
+      ];
+    };
+    in
+    [ "--set-default NIX_KICAD8_STOCK_DATA_PATH ${stockDataPath}" ]
+  )
+  ++ optionals (with3d)
+  [
+    "--set-default KICAD8_3DMODEL_DIR ${packages3d}/share/kicad/3dmodels"
+  ]
+  ++ optionals (withNgspice) [ "--prefix LD_LIBRARY_PATH : ${libngspice}/lib" ]
+
+  # infinisil's workaround for #39493
+  ++ [ "--set GDK_PIXBUF_MODULE_FILE ${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" ]
+  ;
+
+  # why does $makeWrapperArgs have to be added explicitly?
+  # $out and $program_PYTHONPATH don't exist when makeWrapperArgs gets set?
+  installPhase =
+    let
+      bin = if stdenv.isDarwin then "*.app/Contents/MacOS" else "bin";
+      tools = [ "kicad" "pcbnew" "eeschema" "gerbview" "pcb_calculator" "pl_editor" "bitmap2component" ];
+      utils = [ "dxf2idf" "idf2vrml" "idfcyl" "idfrect" "kicad-cli" ];
+    in
+    (concatStringsSep "\n"
+      (flatten [
+        "runHook preInstall"
+
+        (optionalString (withScripting) "buildPythonPath \"${base} $pythonPath\" \n")
+
+        # wrap each of the directly usable tools
+        (map
+          (tool: "makeWrapper ${base}/${bin}/${tool} $out/bin/${tool} $makeWrapperArgs"
+            + optionalString (withScripting) " --set PYTHONPATH \"$program_PYTHONPATH\""
+          )
+          tools)
+
+        # link in the CLI utils
+        (map (util: "ln -s ${base}/${bin}/${util} $out/bin/${util}") utils)
+
+        "runHook postInstall"
+      ])
+    )
+  ;
+
+  postInstall = ''
+    mkdir -p $out/share
+    ln -s ${base}/share/applications $out/share/applications
+    ln -s ${base}/share/icons $out/share/icons
+    ln -s ${base}/share/mime $out/share/mime
+    ln -s ${base}/share/metainfo $out/share/metainfo
+  '';
+
+  passthru.updateScript = {
+    command = [ ./update.sh "${pname}" ];
+    supportedFeatures = [ "commit" ];
+  };
+
+  meta = rec {
+    description = (if (stable)
+    then "Open Source Electronics Design Automation suite"
+    else if (testing) then "Open Source EDA suite, latest on stable branch"
+    else "Open Source EDA suite, latest on master branch")
+    + (lib.optionalString (!with3d) ", without 3D models");
+    homepage = "https://www.kicad.org/";
+    longDescription = ''
+      KiCad is an open source software suite for Electronic Design Automation.
+      The Programs handle Schematic Capture, and PCB Layout with Gerber output.
+    '';
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ evils ];
+    platforms = lib.platforms.all;
+    broken = stdenv.isDarwin;
+    mainProgram = "kicad";
+  };
+}

pkgs/kicad-xenia/libraries.nix

@@ -0,0 +1,39 @@
+{ lib, stdenv
+, cmake
+, gettext
+, libSrc
+, stepreduce
+, parallel
+, zip
+}:
+let
+  mkLib = name:
+    stdenv.mkDerivation {
+      pname = "kicad-${name}";
+      version = builtins.substring 0 10 (libSrc name).rev;
+
+      src = libSrc name;
+
+      nativeBuildInputs = [ cmake ]
+        ++ lib.optionals (name == "packages3d") [
+          stepreduce
+          parallel
+          zip
+        ];
+
+      postInstall = lib.optional (name == "packages3d") ''
+        find $out -type f -name '*.step' | parallel 'stepreduce {} {} && zip -9 {.}.stpZ {} && rm {}'
+      '';
+
+      meta = rec {
+        license = lib.licenses.cc-by-sa-40;
+        platforms = lib.platforms.all;
+      };
+    };
+in
+{
+  symbols = mkLib "symbols";
+  templates = mkLib "templates";
+  footprints = mkLib "footprints";
+  packages3d = mkLib "packages3d";
+}

pkgs/kicad-xenia/runtime_stock_data_path.patch

@@ -0,0 +1,15 @@
+diff --git a/common/paths.cpp b/common/paths.cpp
+index a74cdd9..790cc58 100644
+--- a/common/paths.cpp
++++ b/common/paths.cpp
+@@ -151,6 +151,10 @@ wxString PATHS::GetStockDataPath( bool aRespectRunFromBuildDir )
+ {
+     wxString path;
+
++    if( wxGetEnv( wxT( "NIX_KICAD8_STOCK_DATA_PATH" ), &path ) ) {
++        return path;
++    }
++
+     if( aRespectRunFromBuildDir && wxGetEnv( wxT( "KICAD_RUN_FROM_BUILD_DIR" ), nullptr ) )
+     {
+         // Allow debugging from build dir by placing relevant files/folders in the build root

pkgs/kicad-xenia/update.sh

@@ -0,0 +1,260 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils git nix curl jq
+# shellcheck shell=bash enable=all
+
+set -e
+shopt -s inherit_errexit
+
+# this script will generate versions.nix in the right location
+# this should contain the versions' revs and hashes
+# the stable revs are stored only for ease of skipping
+
+# by default nix-prefetch-url uses XDG_RUNTIME_DIR as tmp
+# which is /run/user/1000, which defaults to 10% of your RAM
+# unless you have over 64GB of ram that'll be insufficient
+# resulting in "tar: no space left on device" for packages3d
+# hence:
+export TMPDIR=/tmp
+
+# if something goes unrepairably wrong, run 'update.sh all clean'
+
+# TODO
+# support parallel instances for each pname
+#   currently risks reusing old data
+# no getting around manually checking if the build product works...
+# if there is, default to commiting?
+#   won't work when running in parallel?
+# remove items left in /nix/store?
+# reuse hashes of already checked revs (to avoid redownloading testing's packages3d)
+
+# nixpkgs' update.nix passes in UPDATE_NIX_PNAME to indicate which package is being updated
+# assigning a default value to that as shellcheck doesn't like the use of unassigned variables
+: "${UPDATE_NIX_PNAME:=""}"
+# update.nix can also parse JSON output of this script to formulate a commit
+# this requires we collect the version string in the old versions.nix for the updated package
+old_version=""
+new_version=""
+
+
+# get the latest tag that isn't an RC or *.99
+latest_tags="$(git ls-remote --tags --sort -version:refname https://gitlab.com/kicad/code/kicad.git)"
+# using a scratch variable to ensure command failures get caught (SC2312)
+scratch="$(grep -o 'refs/tags/[0-9]*\.[0-9]*\.[0-9]*$' <<< "${latest_tags}")"
+scratch="$(grep -ve '\.99' -e '\.9\.9' <<< "${scratch}")"
+scratch="$(sed -n '1p' <<< "${scratch}")"
+latest_tag="$(cut -d '/' -f 3 <<< "${scratch}")"
+
+# get the latest branch name for testing
+branches="$(git ls-remote --heads --sort -version:refname https://gitlab.com/kicad/code/kicad.git)"
+scratch="$(grep -o 'refs/heads/[0-9]*\.[0-9]*$' <<< "${branches}")"
+scratch="$(sed -n '1p' <<< "${scratch}")"
+testing_branch="$(cut -d '/' -f 3 <<< "${scratch}")"
+
+# "latest_tag" and "master" directly refer to what we want
+# "testing" uses "testing_branch" found above
+all_versions=( "${latest_tag}" testing master )
+
+prefetch="nix-prefetch-url --unpack --quiet"
+
+clean=""
+check_stable=""
+check_testing=1
+check_unstable=1
+commit=""
+
+for arg in "$@" "${UPDATE_NIX_PNAME}"; do
+  case "${arg}" in
+    help|-h|--help) echo "Read me!" >&2; exit 1; ;;
+    kicad|kicad-small|release|tag|stable|5*|6*|7*|8*) check_stable=1; check_testing=""; check_unstable="" ;;
+    *testing|kicad-testing-small) check_testing=1; check_unstable="" ;;
+    *unstable|*unstable-small|master|main) check_unstable=1; check_testing="" ;;
+    latest|now|today) check_unstable=1; check_testing=1 ;;
+    all|both|full) check_stable=1; check_testing=1; check_unstable=1 ;;
+    clean|fix|*fuck) check_stable=1; check_testing=1; check_unstable=1; clean=1 ;;
+    commit) commit=1 ;;
+    *) ;;
+  esac
+done
+
+here="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+commit_date() {
+  gitlab_json="$(curl -s https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad/repository/commits/"$1")"
+  commit_created="$(jq .created_at --raw-output <<< "${gitlab_json}")"
+  date --date="${commit_created}" --iso-8601 --utc
+}
+
+file="${here}/versions.nix"
+# just in case this runs in parallel
+tmp="${here}/,versions.nix.${RANDOM}"
+
+libs=( symbols templates footprints packages3d )
+
+get_rev() {
+    git ls-remote "$@"
+}
+
+gitlab="https://gitlab.com/kicad"
+# append commit hash or tag
+src_pre="https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad/repository/archive.tar.gz?sha="
+lib_pre="https://gitlab.com/api/v4/projects/kicad%2Flibraries%2Fkicad-"
+lib_mid="/repository/archive.tar.gz?sha="
+
+# number of items updated
+count=0
+
+printf "Latest tag is %s\n" "${latest_tag}" >&2
+
+if [[ ! -f ${file} ]]; then
+  echo "No existing file, generating from scratch" >&2
+  check_stable=1; check_testing=1; check_unstable=1; clean=1
+fi
+
+printf "Writing %s\n" "${tmp}" >&2
+
+# not a dangling brace, grouping the output to redirect to file
+{
+
+printf "# This file was generated by update.sh\n\n"
+printf "{\n"
+
+for version in "${all_versions[@]}"; do
+
+  src_version=${version};
+  lib_version=${version};
+  # testing is the stable branch on the main repo
+  # but the libraries don't have such a branch
+  # only the latest release tag and a master branch
+  if [[ ${version} == "testing" ]]; then
+      src_version=${testing_branch};
+      lib_version=${latest_tag};
+  fi
+
+  if [[ ${version} == "master" ]]; then
+    pname="kicad-unstable"
+  elif [[ ${version} == "testing" ]]; then
+    pname="kicad-testing"
+  else
+    pname="kicad"
+  fi
+
+  # skip a version if we don't want to check it
+  if [[ (-n ${check_stable} && ${version} != "master" && ${version} != "testing") \
+     || (-n ${check_testing} && ${version} == "testing") \
+     || (-n ${check_unstable} && ${version} == "master" ) ]]; then
+
+    now=$(commit_date "${src_version}")
+
+    if [[ ${version} == "master" ]]; then
+      pname="kicad-unstable"
+      new_version="${now}"
+    elif [[ ${version} == "testing" ]]; then
+      pname="kicad-testing"
+      new_version="${testing_branch}-${now}"
+    else
+      pname="kicad"
+      new_version="${version}"
+    fi
+
+    printf "\nChecking %s\n" "${pname}" >&2
+
+    printf "%2s\"%s\" = {\n" "" "${pname}"
+      printf "%4skicadVersion = {\n" ""
+        printf "%6sversion =\t\t\t\"%s\";\n" "" "${new_version}"
+        printf "%6ssrc = {\n" ""
+
+    echo "Checking src" >&2
+    scratch="$(get_rev "${gitlab}"/code/kicad.git "${src_version}")"
+    src_rev="$(cut -f1 <<< "${scratch}")"
+    has_rev="$(grep -sm 1 "\"${pname}\"" -A 4 "${file}" | grep -sm 1 "${src_rev}" || true)"
+    has_hash="$(grep -sm 1 "\"${pname}\"" -A 5 "${file}" | grep -sm 1 "sha256" || true)"
+    old_version="$(grep -sm 1 "\"${pname}\"" -A 3 "${file}" | grep -sm 1 "version" | awk -F "\"" '{print $2}' || true)"
+
+    if [[ -n ${has_rev} && -n ${has_hash} && -z ${clean} ]]; then
+      echo "Reusing old ${pname}.src.sha256, already latest .rev at ${old_version}" >&2
+      scratch=$(grep -sm 1 "\"${pname}\"" -A 5 "${file}")
+      grep -sm 1 "rev" -A 1 <<< "${scratch}"
+    else
+          prefetched="$(${prefetch} "${src_pre}${src_rev}")"
+          printf "%8srev =\t\t\t\"%s\";\n" "" "${src_rev}"
+          printf "%8ssha256 =\t\t\"%s\";\n" "" "${prefetched}"
+          count=$((count+1))
+    fi
+        printf "%6s};\n" ""
+      printf "%4s};\n" ""
+
+      printf "%4slibVersion = {\n" ""
+        printf "%6sversion =\t\t\t\"%s\";\n" "" "${new_version}"
+        printf "%6slibSources = {\n" ""
+
+          for lib in "${libs[@]}"; do
+            echo "Checking ${lib}" >&2
+            url="${gitlab}/libraries/kicad-${lib}.git"
+            scratch="$(get_rev "${url}" "${lib_version}")"
+            scratch="$(cut -f1 <<< "${scratch}")"
+            lib_rev="$(tail -n1 <<< "${scratch}")"
+            has_rev="$(grep -sm 1 "\"${pname}\"" -A 19 "${file}" | grep -sm 1 "${lib_rev}" || true)"
+            has_hash="$(grep -sm 1 "\"${pname}\"" -A 20 "${file}" | grep -sm 1 "${lib}.sha256" || true)"
+            if [[ -n ${has_rev} && -n ${has_hash} && -z ${clean} ]]; then
+              echo "Reusing old kicad-${lib}-${new_version}.src.sha256, already latest .rev" >&2
+              scratch="$(grep -sm 1 "\"${pname}\"" -A 20 "${file}")"
+              grep -sm 1 "${lib}" -A 1 <<< "${scratch}"
+            else
+              prefetched="$(${prefetch} "${lib_pre}${lib}${lib_mid}${lib_rev}")"
+              printf "%8s%s.rev =\t" "" "${lib}"
+              case "${lib}" in
+                symbols|templates) printf "\t" ;; *) ;;
+              esac
+              printf "\"%s\";\n" "${lib_rev}"
+              printf "%8s%s.sha256 =\t\"%s\";\n" "" "${lib}" "${prefetched}"
+              count=$((count+1))
+            fi
+          done
+        printf "%6s};\n" ""
+      printf "%4s};\n" ""
+    printf "%2s};\n" ""
+  else
+    printf "\nReusing old %s\n" "${pname}" >&2
+    grep -sm 1 "\"${pname}\"" -A 21 "${file}"
+  fi
+done
+printf "}\n"
+} > "${tmp}"
+
+if grep '""' "${tmp}"; then
+  echo "empty value detected, out of space?" >&2
+  exit "1"
+fi
+
+mv "${tmp}" "${file}"
+
+printf "\nFinished\nMoved output to %s\n\n" "${file}" >&2
+
+if [[ ${count} -gt 0 ]]; then
+  if [[ ${count} -gt 1 ]]; then s="s"; else s=""; fi
+  echo "${count} revision${s} changed" >&2
+  if [[ -n ${commit} ]]; then
+    git commit -am "$(printf "kicad: automatic update of %s item%s\n" "${count}" "${s}")"
+  fi
+  echo "Please confirm the new versions.nix works before making a PR." >&2
+else
+  echo "No changes, those checked are up to date" >&2
+fi
+
+# using UPDATE_NIX_ATTR_PATH to detect if this is being called from update.nix
+# and output JSON to describe the changes
+if [[ -n ${UPDATE_NIX_ATTR_PATH} ]]; then
+
+  if [[ ${count} -eq 0 ]]; then echo "[{}]"; exit 0; fi
+
+  jq -n \
+    --arg attrpath "${UPDATE_NIX_PNAME}" \
+    --arg oldversion "${old_version}" \
+    --arg newversion "${new_version}" \
+    --arg file "${file}" \
+'[{
+  "attrPath": $attrpath,
+  "oldVersion": $oldversion,
+  "newVersion": $newversion,
+  "files": [ $file ]
+}]'
+fi

pkgs/kicad-xenia/versions.nix

@@ -0,0 +1,70 @@
+# This file was generated by update.sh
+
+{
+  "kicad" = {
+    kicadVersion = {
+      version =			"8.0.2";
+      src = {
+        rev =			"2d5434e9abf570ffd19b22c90963ea71cfb91d3d";
+        sha256 =		"1n1jj7559xd4ib4c6ybya75a5hbarnkfy8gxzxfw58wdb4lxxmzz";
+      };
+    };
+    libVersion = {
+      version =			"8.0.2";
+      libSources = {
+        symbols.rev =		"099ac0c8ac402a685fde00b1369e34a116e29661";
+        symbols.sha256 =	"0w333f89yw2m0zlpkg0k6hfwlj10snm8laihdjnsb22asyz4pbhn";
+        templates.rev =		"2e2da58e02707d327d59d4101c401a82dc9a26f6";
+        templates.sha256 =	"073a6cyvzzy0vmkj3ip4ziq7b7pcizs70nm5acw838dxghjfyv3v";
+        footprints.rev =	"e8c30550cde4945cbe1bf30cccf0b3c1e2bda6c6";
+        footprints.sha256 =	"10j8qjljc1fv8k4zp3zn0da33g57hn6pgrgmbgp18dsa539xvxcz";
+        packages3d.rev =	"249f7947587529026e1676cd70c8d7493a8d8162";
+        packages3d.sha256 =	"04gvfb54jhnww2qwrxc27wpyrvmjasdc4xhr0ridl7dglh4qcp35";
+      };
+    };
+  };
+#  "kicad-testing" = {
+#    kicadVersion = {
+#      version =			"8.0-2024-02-23";
+#      src = {
+#        rev =			"14d71c8ca6b48d2eb956bb069acf05a37b1b2652";
+#        sha256 =		"0xqd0xbpnvsvba75526nwgzr8l2cfxy99sjmg13sjxfx7rq16kqi";
+#      };
+#    };
+#    libVersion = {
+#      version =			"8.0-2024-02-23";
+#      libSources = {
+#        symbols.rev =		"e228d4e8b295364e90e36c57f4023d8285ba88cd";
+#        symbols.sha256 =	"049h2a7yn6ks8sybppixa872dbvyd0rwf9r6nixvdg6d13fl6rwf";
+#        templates.rev =		"2e00c233b67e35323f90d04c190bf70237a252f2";
+#        templates.sha256 =	"0m9bggz3cm27kqpjjwxy19mqzk0c69bywcjkqcni7kafr21c6k4z";
+#        footprints.rev =	"6e5329a6d4aaa81290e23af3eba88f505c2f61b0";
+#        footprints.sha256 =	"0ypjlbmzmcl3pha3q2361va70c988b1drxy8320gm66jkzfc21a1";
+#        packages3d.rev =	"d1e521228d9f5888836b1a6a35fb05fb925456fa";
+#        packages3d.sha256 =	"0lcy1av7ixg1f7arflk50jllpc1749sfvf3h62hkxsz97wkr97xj";
+#      };
+#    };
+#  };
+#  "kicad-unstable" = {
+#    kicadVersion = {
+#      version =			"2024-02-23";
+#      src = {
+#        rev =			"b7b64d959f37f00bb0d14b007c3b3908196e1024";
+#        sha256 =		"1gl7mjqpmqq4m55z6crwb77983g00gi2161ichsc7hsfhs4c8grh";
+#      };
+#    };
+#    libVersion = {
+#      version =			"2024-02-23";
+#      libSources = {
+#        symbols.rev =		"8b0c343d8694fe0a968e5c4af69fd161bacf7da1";
+#        symbols.sha256 =	"049h2a7yn6ks8sybppixa872dbvyd0rwf9r6nixvdg6d13fl6rwf";
+#        templates.rev =		"0a6c4f798a68a5c639d54b4d3093460ab9267816";
+#        templates.sha256 =	"0m9bggz3cm27kqpjjwxy19mqzk0c69bywcjkqcni7kafr21c6k4z";
+#        footprints.rev =	"ded6b053460faae5783c538a38e91e2b4bddcf2e";
+#        footprints.sha256 =	"035bf37n4vrihaj4zfdncisdx9fly1vya7lhkxhlsbv5blpi4a5y";
+#        packages3d.rev =	"984667325076d4e50dab14e755aeacf97f42194c";
+#        packages3d.sha256 =	"0lkaxv02h4sxrnm8zr17wl9d07mazlisad78r35gry741i362cdg";
+#      };
+#    };
+#  };
+}

pkgs/kicad-xenia/writable.patch

@@ -0,0 +1,49 @@
+commit 6a72fd032405515e468797be91b5a6ebcbbb5fd8
+Author: Evils <evils.devils@protonmail.com>
+Date:   Wed Nov 23 19:49:13 2022 +0100
+
+    ensure new projects are writable
+
+diff --git a/kicad/kicad_manager_frame.cpp b/kicad/kicad_manager_frame.cpp
+index 7ee8090858..391514519c 100644
+--- a/kicad/kicad_manager_frame.cpp
++++ b/kicad/kicad_manager_frame.cpp
+@@ -638,6 +638,12 @@ void KICAD_MANAGER_FRAME::CreateNewProject( const wxFileName& aProjectFileName,
+ 
+                 // wxFFile dtor will close the file
+             }
++
++            if( destFileName.IsOk() && !destFileName.IsFileWritable() )
++            {
++                destFileName.SetPermissions(0644);
++            }
++
+         }
+     }
+ 
+diff --git a/kicad/project_template.cpp b/kicad/project_template.cpp
+index bf951fcddb..2bef94326b 100644
+--- a/kicad/project_template.cpp
++++ b/kicad/project_template.cpp
+@@ -282,6 +282,21 @@ bool PROJECT_TEMPLATE::CreateProject( wxFileName& aNewProjectPath, wxString* aEr
+ 
+             result = false;
+         }
++	else if( !destFile.IsFileWritable() && !destFile.SetPermissions(0644) )
++        {
++            if( aErrorMsg )
++            {
++                if( !aErrorMsg->empty() )
++                    *aErrorMsg += "\n";
++
++                wxString msg;
++
++                msg.Printf( _( "Cannot make file writable: '%s'." ), destFile.GetFullPath() );
++                *aErrorMsg += msg;
++            }
++
++            result = false;
++	}
+     }
+ 
+     return result;

pkgs/ocaml/ppx_unicode/default.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   fetchgit,
   buildDunePackage,
 
@@ -25,7 +24,7 @@ buildDunePackage rec {
   meta = {
     description = "opinionated ppx for string literals";
     homepage = "https://git.lain.faith/haskal/ppx_unicode";
-    license = lib.licenses.fyptl;
+    license = lib.licenses.cc-by-nc-sa-40;
     maintainers = [];
     platforms = with lib.platforms; linux ++ darwin;
   };

pkgs/ocaml/xlog/default.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   fetchgit,
   buildDunePackage,
 

pkgs/reverse-engineering/ghidra/extensions/ghidra-delinker-extension/default.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  ghidra,
-  gradle,
-  fetchFromGitHub,
-}:
-ghidra.buildGhidraExtension (finalAttrs: {
-  pname = "ghidra-delinker-extension";
-  version = "0.5.1";
-
-  src = fetchFromGitHub {
-    owner = "boricj";
-    repo = "ghidra-delinker-extension";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-h6F50Z7S6tPOl9mIhChLKoFxHuAkq/n36ysUEFwWGxI=";
-  };
-
-  postPatch = ''
-    substituteInPlace build.gradle \
-      --replace-fail '"''${getGitHash()}"' '"v${finalAttrs.version}"'
-  '';
-
-  gradleBuildTask = "buildExtension";
-
-  __darwinAllowLocalNetworking = true;
-
-  mitmCache = gradle.fetchDeps {
-    pkg = finalAttrs.finalPackage;
-    data = ./deps.json;
-  };
-
-  meta = {
-    description = "Ghidra extension for delinking executables back to object files";
-    homepage = "https://github.com/boricj/ghidra-delinker-extension";
-    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.jchw ];
-    platforms = lib.platforms.unix;
-  };
-})

pkgs/reverse-engineering/ghidra/extensions/ghidra-firmware-utils/default.nix

@@ -1,24 +0,0 @@
-{
-  buildGhidraExtension,
-  fetchFromGitHub,
-  lib,
-}:
-buildGhidraExtension (finalAttrs: {
-  pname = "ghidra-firmware-utils";
-  version = "2024.04.20";
-
-  src = fetchFromGitHub {
-    owner = "al3xtjames";
-    repo = "ghidra-firmware-utils";
-    rev = finalAttrs.version;
-    hash = "sha256-BbPRSD1EzgMA3TCKHyNqLjzEgiOm67mLJuOeFOTvd0I=";
-  };
-
-  meta = {
-    description = "Ghidra utilities for analyzing PC firmware";
-    homepage = "https://github.com/al3xtjames/ghidra-firmware-utils";
-    downloadPage = "https://github.com/al3xtjames/ghidra-firmware-utils/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ timschumi ];
-  };
-})

pkgs/temp/depotdownloader/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+}:
+
+buildDotnetModule rec {
+  pname = "depotdownloader";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "SteamRE";
+    repo = "DepotDownloader";
+    rev = "DepotDownloader_${version}";
+    hash = "sha256-zduNWIQi+ItNSh9RfRfY0giIw/tMQIMRh9woUzQ5pJw=";
+  };
+
+  projectFile = "DepotDownloader.sln";
+  nugetDeps = ./deps.json;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Steam depot downloader utilizing the SteamKit2 library";
+    changelog = "https://github.com/SteamRE/DepotDownloader/releases/tag/DepotDownloader_${version}";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.babbaj ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    mainProgram = "DepotDownloader";
+  };
+}

pkgs/temp/depotdownloader/deps.json

@@ -0,0 +1,72 @@
+[
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "5.0.0",
+    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "5.0.0",
+    "hash": "sha256-9kylPGfKZc58yFqNKa77stomcoNnMeERXozWJzDcUIA="
+  },
+  {
+    "pname": "Microsoft.Windows.CsWin32",
+    "version": "0.3.183",
+    "hash": "sha256-bn0rHYoVLRTqiZqkkp6u3PMKtg0NNxA2F++1e/+3Jhw="
+  },
+  {
+    "pname": "Microsoft.Windows.SDK.Win32Docs",
+    "version": "0.1.42-alpha",
+    "hash": "sha256-6DvzmNzrGVfWmNJNqooj+Ya+7bAQlyeg7pmyKaUlIws="
+  },
+  {
+    "pname": "Microsoft.Windows.SDK.Win32Metadata",
+    "version": "61.0.15-preview",
+    "hash": "sha256-OB60ThIv8e7AMGaRRzJ8dWme5HjN+Q0HoUDquP2ejTg="
+  },
+  {
+    "pname": "Microsoft.Windows.WDK.Win32Metadata",
+    "version": "0.12.8-experimental",
+    "hash": "sha256-YaN6JlgnpIooLYu3NdFVHwoqFwZYTeePtekXCfTiLTo="
+  },
+  {
+    "pname": "protobuf-net",
+    "version": "3.2.52",
+    "hash": "sha256-phXeroBt5KbHYkApkkMa0mRCVkDY+dtOOXXNY+i50Ek="
+  },
+  {
+    "pname": "protobuf-net.Core",
+    "version": "3.2.52",
+    "hash": "sha256-/9Jj26tuSKeYJb9udwew5i5EVvaoeNu/vBCKS0VhSQQ="
+  },
+  {
+    "pname": "QRCoder",
+    "version": "1.6.0",
+    "hash": "sha256-2Ev/6d7PH6K4dVYQQHlZ+ZggkCnDtrlaGygs65mDo28="
+  },
+  {
+    "pname": "SteamKit2",
+    "version": "3.2.0",
+    "hash": "sha256-hB/36fP9kf+1mIx+hTELUMHe8ZkmSKxOK41ZzOaBa3E="
+  },
+  {
+    "pname": "System.IO.Hashing",
+    "version": "9.0.4",
+    "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "5.0.0",
+    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "5.0.0",
+    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
+  },
+  {
+    "pname": "ZstdSharp.Port",
+    "version": "0.8.5",
+    "hash": "sha256-+UQFeU64md0LlSf9nMXif6hHnfYEKm+WRyYd0Vo2QvI="
+  }
+]