push sheeet

pkgs/applications/emulators/wine/base.nix

@@ -0,0 +1,314 @@
+{
+  stdenv,
+  lib,
+  pkgArches,
+  makeSetupHook,
+  pname,
+  version,
+  src,
+  mingwGccs,
+  monos,
+  geckos,
+  platforms,
+  bison,
+  flex,
+  fontforge,
+  gettext,
+  makeWrapper,
+  pkg-config,
+  nixosTests,
+  supportFlags,
+  wineRelease,
+  patches,
+  moltenvk,
+  buildScript ? null,
+  configureFlags ? [ ],
+  mainProgram ? "wine",
+}:
+
+with import ./util.nix { inherit lib; };
+
+let
+  prevName = pname;
+  prevConfigFlags = configureFlags;
+
+  setupHookDarwin = makeSetupHook {
+    name = "darwin-mingw-hook";
+    substitutions = {
+      darwinSuffixSalt = stdenv.cc.suffixSalt;
+      mingwGccsSuffixSalts = map (gcc: gcc.suffixSalt) mingwGccs;
+    };
+  } ./setup-hook-darwin.sh;
+
+  # Using the 14.4 SDK allows Wine to use `os_sync_wait_on_address` for its futex implementation on Darwin.
+  # It does an availability check, so older systems will still work.
+  darwinFrameworks = lib.optionals stdenv.hostPlatform.isDarwin (
+    toBuildInputs pkgArches (pkgs: [ pkgs.apple-sdk_14 ])
+  );
+
+  # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
+  # because they will put Darwin in `meta.badPlatforms`.
+  darwinUnsupportedFlags = [
+    "alsaSupport"
+    "cairoSupport"
+    "dbusSupport"
+    "fontconfigSupport"
+    "gtkSupport"
+    "netapiSupport"
+    "pulseaudioSupport"
+    "udevSupport"
+    "v4lSupport"
+    "vaSupport"
+    "waylandSupport"
+    "x11Support"
+    "xineramaSupport"
+  ];
+
+  badPlatforms = lib.optional (
+    !supportFlags.mingwSupport || lib.any (flag: supportFlags.${flag}) darwinUnsupportedFlags
+  ) "x86_64-darwin";
+in
+stdenv.mkDerivation (
+  finalAttrs:
+  lib.optionalAttrs (buildScript != null) { builder = buildScript; }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    postBuild = ''
+      # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
+      # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
+      # rebuild it with empty NIX_LDFLAGS.
+      for preloader in wine-preloader wine64-preloader; do
+        rm loader/$preloader &> /dev/null \
+        && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
+        || echo "loader/$preloader not built, skipping relink."
+      done
+    '';
+  }
+  // {
+    inherit version src;
+
+    pname =
+      prevName
+      + lib.optionalString (wineRelease != "stable" && wineRelease != "unstable") "-${wineRelease}";
+
+    # Fixes "Compiler cannot create executables" building wineWow with mingwSupport
+    strictDeps = true;
+
+    nativeBuildInputs =
+      with supportFlags;
+      [
+        bison
+        flex
+        fontforge
+        makeWrapper
+        pkg-config
+      ]
+      ++ lib.optional gettextSupport gettext
+      ++ lib.optionals mingwSupport (
+        mingwGccs ++ lib.optional stdenv.hostPlatform.isDarwin setupHookDarwin
+      );
+
+    buildInputs = toBuildInputs pkgArches (
+      with supportFlags;
+      (
+        pkgs:
+        [
+          pkgs.freetype
+          pkgs.perl
+          pkgs.libunwind
+        ]
+        ++ lib.optional stdenv.hostPlatform.isLinux pkgs.libcap
+        ++ lib.optional stdenv.hostPlatform.isDarwin pkgs.libinotify-kqueue
+        ++ lib.optional cupsSupport pkgs.cups
+        ++ lib.optional dbusSupport pkgs.dbus
+        ++ lib.optional cairoSupport pkgs.cairo
+        ++ lib.optional odbcSupport pkgs.unixODBC
+        ++ lib.optional netapiSupport pkgs.samba4
+        ++ lib.optional cursesSupport pkgs.ncurses
+        ++ lib.optional vaSupport pkgs.libva
+        ++ lib.optional pcapSupport pkgs.libpcap
+        ++ lib.optional v4lSupport pkgs.libv4l
+        ++ lib.optional saneSupport pkgs.sane-backends
+        ++ lib.optional gphoto2Support pkgs.libgphoto2
+        ++ lib.optional krb5Support pkgs.libkrb5
+        ++ lib.optional fontconfigSupport pkgs.fontconfig
+        ++ lib.optional alsaSupport pkgs.alsa-lib
+        ++ lib.optional pulseaudioSupport pkgs.libpulseaudio
+        ++ lib.optional (xineramaSupport && x11Support) pkgs.xorg.libXinerama
+        ++ lib.optional udevSupport pkgs.udev
+        ++ lib.optional vulkanSupport (
+          if stdenv.hostPlatform.isDarwin then moltenvk else pkgs.vulkan-loader
+        )
+        ++ lib.optional sdlSupport pkgs.SDL2
+        ++ lib.optional usbSupport pkgs.libusb1
+        ++ lib.optionals gstreamerSupport (
+          with pkgs.gst_all_1;
+          [
+            gstreamer
+            gst-plugins-base
+            gst-plugins-good
+            gst-plugins-ugly
+            gst-libav
+            gst-plugins-bad
+          ]
+        )
+        ++ lib.optionals gtkSupport [
+          pkgs.gtk3
+          pkgs.glib
+        ]
+        ++ lib.optionals openclSupport [
+          pkgs.opencl-headers
+          pkgs.ocl-icd
+        ]
+        ++ lib.optionals tlsSupport [
+          pkgs.openssl
+          pkgs.gnutls
+        ]
+        ++ lib.optionals (openglSupport && !stdenv.hostPlatform.isDarwin) [
+          pkgs.libGLU
+          pkgs.libGL
+          pkgs.libdrm
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin darwinFrameworks
+        ++ lib.optionals x11Support (
+          with pkgs.xorg;
+          [
+            libX11
+            libXcomposite
+            libXcursor
+            libXext
+            libXfixes
+            libXi
+            libXrandr
+            libXrender
+            libXxf86vm
+          ]
+        )
+        ++ lib.optionals waylandSupport (
+          with pkgs;
+          [
+            wayland
+            wayland-scanner
+            libxkbcommon
+            wayland-protocols
+            wayland.dev
+            libxkbcommon.dev
+            libgbm
+          ]
+        )
+      )
+    );
+
+    inherit patches;
+
+    configureFlags =
+      prevConfigFlags
+      ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
+      ++ lib.optionals supportFlags.vulkanSupport [ "--with-vulkan" ]
+      ++ lib.optionals (
+        (stdenv.hostPlatform.isDarwin && !supportFlags.xineramaSupport) || !supportFlags.x11Support
+      ) [ "--without-x" ];
+
+    # Wine locates a lot of libraries dynamically through dlopen().  Add
+    # them to the RPATH so that the user doesn't have to set them in
+    # LD_LIBRARY_PATH.
+    NIX_LDFLAGS = toString (
+      map (path: "-rpath " + path) (
+        map (x: "${lib.getLib x}/lib") (
+          [ stdenv.cc.cc ]
+          # Avoid adding rpath references to non-existent framework `lib` paths.
+          ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs
+        )
+        # libpulsecommon.so is linked but not found otherwise
+        ++ lib.optionals supportFlags.pulseaudioSupport (
+          map (x: "${lib.getLib x}/lib/pulseaudio") (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ]))
+        )
+        ++ lib.optionals supportFlags.waylandSupport (
+          map (x: "${lib.getLib x}/share/wayland-protocols") (
+            toBuildInputs pkgArches (pkgs: [ pkgs.wayland-protocols ])
+          )
+        )
+      )
+    );
+
+    # Don't shrink the ELF RPATHs in order to keep the extra RPATH
+    # elements specified above.
+    dontPatchELF = true;
+
+    ## FIXME
+    # Add capability to ignore known failing tests
+    # and enable doCheck
+    doCheck = false;
+
+    postInstall =
+      let
+        links = prefix: pkg: "ln -s ${pkg} $out/${prefix}/${pkg.name}";
+      in
+      lib.optionalString supportFlags.embedInstallers ''
+        mkdir -p $out/share/wine/gecko $out/share/wine/mono/
+        ${lib.strings.concatStringsSep "\n" (
+          (map (links "share/wine/gecko") geckos) ++ (map (links "share/wine/mono") monos)
+        )}
+      ''
+      + lib.optionalString supportFlags.gstreamerSupport ''
+        # Wrapping Wine is tricky.
+        # https://github.com/NixOS/nixpkgs/issues/63170
+        # https://github.com/NixOS/nixpkgs/issues/28486
+        # The main problem is that wine-preloader opens and loads the wine(64) binary, and
+        # breakage occurs if it finds a shell script instead of the real binary. We solve this
+        # by setting WINELOADER to point to the original binary. Additionally, the locations
+        # of the 32-bit and 64-bit binaries must differ only by the presence of "64" at the
+        # end, due to the logic Wine uses to find the other binary (see get_alternate_loader
+        # in dlls/kernel32/process.c). Therefore we do not use wrapProgram which would move
+        # the binaries to ".wine-wrapped" and ".wine64-wrapped", but use makeWrapper directly,
+        # and move the binaries to ".wine" and ".wine64".
+        for i in wine wine64 ; do
+          prog="$out/bin/$i"
+          if [ -e "$prog" ]; then
+            hidden="$(dirname "$prog")/.$(basename "$prog")"
+            mv "$prog" "$hidden"
+            makeWrapper "$hidden" "$prog" \
+              ${lib.optionalString (lib.versionAtLeast version "10.1") "--inherit-argv0"} \
+              --set WINELOADER "$hidden" \
+              --prefix GST_PLUGIN_SYSTEM_PATH_1_0 ":" "$GST_PLUGIN_SYSTEM_PATH_1_0"
+          fi
+        done
+      '';
+
+    enableParallelBuilding = true;
+
+    # https://bugs.winehq.org/show_bug.cgi?id=43530
+    # https://github.com/NixOS/nixpkgs/issues/31989
+    hardeningDisable = [
+      "bindnow"
+      "stackclashprotection"
+    ]
+    ++ lib.optional (stdenv.hostPlatform.isDarwin) "fortify"
+    ++ lib.optional (supportFlags.mingwSupport) "format";
+
+    passthru = {
+      inherit pkgArches;
+      tests = { inherit (nixosTests) wine; };
+      updateScript = src.updateScript or null;
+    };
+    meta = {
+      inherit version;
+      homepage = "https://www.winehq.org/";
+      license = with lib.licenses; [ lgpl21Plus ];
+      sourceProvenance = with lib.sourceTypes; [
+        fromSource
+        binaryNativeCode # mono, gecko
+      ];
+      description = "Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
+      inherit badPlatforms platforms;
+      maintainers = with lib.maintainers; [
+        avnik
+        bendlas
+        jmc-figueira
+        kira-bruneau
+        raskin
+        reckenrode
+      ];
+      inherit mainProgram;
+    };
+  }
+)

pkgs/applications/emulators/wine/builder-wow.sh

@@ -0,0 +1,49 @@
+## build described at https://wiki.winehq.org/Building_Wine#Shared_WoW64
+preFlags="${configureFlags}"
+
+unpackPhase
+cd $TMP/$sourceRoot
+patchPhase
+
+configureScript=$TMP/$sourceRoot/configure
+mkdir -p $TMP/wine-wow $TMP/wine64
+
+cd $TMP/wine64
+sourceRoot=`pwd`
+configureFlags="${preFlags} --enable-win64"
+configurePhase
+buildPhase
+# checkPhase
+
+# Remove 64 bit gstreamer from PKG_CONFIG_PATH
+IFS=":" read -ra LIST_ARRAY <<< "$PKG_CONFIG_PATH"
+IFS=":" read -ra REMOVE_ARRAY <<< "@pkgconfig64remove@"
+NEW_LIST_ARRAY=()
+
+for ELEMENT in "${LIST_ARRAY[@]}"; do
+  TO_ADD=1
+  for REMOVE in "${REMOVE_ARRAY[@]}"; do
+    if [[ "$REMOVE" == "$ELEMENT" ]]; then
+      TO_ADD=0
+      break
+    fi
+  done
+
+  if [[ $TO_ADD -eq 1 ]]; then
+    NEW_LIST_ARRAY+=("$ELEMENT")
+  fi
+done
+PKG_CONFIG_PATH=$(IFS=":"; echo "${NEW_LIST_ARRAY[*]}")
+
+cd $TMP/wine-wow
+sourceRoot=`pwd`
+configureFlags="${preFlags} --with-wine64=../wine64"
+configurePhase
+buildPhase
+# checkPhase
+
+eval "$preInstall"
+cd $TMP/wine-wow && make install -j$NIX_BUILD_CORES
+cd $TMP/wine64 && make install -j$NIX_BUILD_CORES
+eval "$postInstall"
+fixupPhase

pkgs/applications/emulators/wine/cert-path.patch

@@ -0,0 +1,15 @@
+diff --git a/dlls/crypt32/unixlib.c b/dlls/crypt32/unixlib.c
+index 7cb521eb98b..5804b88be84 100644
+--- a/dlls/crypt32/unixlib.c
++++ b/dlls/crypt32/unixlib.c
+@@ -654,6 +654,10 @@ static void load_root_certs(void)
+ 
+     for (i = 0; i < ARRAY_SIZE(CRYPT_knownLocations) && list_empty(&root_cert_list); i++)
+         import_certs_from_path( CRYPT_knownLocations[i], TRUE );
++
++    char *nix_cert_file = getenv("NIX_SSL_CERT_FILE");
++    if (nix_cert_file != NULL)
++        import_certs_from_path(nix_cert_file, TRUE);
+ }
+ 
+ static NTSTATUS enum_root_certs( void *args )

pkgs/applications/emulators/wine/default.nix

@@ -0,0 +1,107 @@
+## Configuration:
+# Control you default wine config in nixpkgs-config:
+# wine = {
+#   release = "stable"; # "stable", "unstable", "staging", "wayland"
+#   build = "wineWow"; # "wine32", "wine64", "wineWow"
+# };
+# Make additional configurations on demand:
+# wine.override { wineBuild = "wine32"; wineRelease = "staging"; };
+{
+  lib,
+  stdenv,
+  callPackage,
+  darwin,
+  wineRelease ? "stable",
+  wineBuild ? if stdenv.hostPlatform.system == "x86_64-linux" then "wineWow" else "wine32",
+  gettextSupport ? false,
+  fontconfigSupport ? false,
+  alsaSupport ? false,
+  gtkSupport ? false,
+  openglSupport ? false,
+  tlsSupport ? false,
+  gstreamerSupport ? false,
+  cupsSupport ? false,
+  dbusSupport ? false,
+  openclSupport ? false,
+  cairoSupport ? false,
+  odbcSupport ? false,
+  netapiSupport ? false,
+  cursesSupport ? false,
+  vaSupport ? false,
+  pcapSupport ? false,
+  v4lSupport ? false,
+  saneSupport ? false,
+  gphoto2Support ? false,
+  krb5Support ? false,
+  pulseaudioSupport ? false,
+  udevSupport ? false,
+  xineramaSupport ? false,
+  vulkanSupport ? false,
+  sdlSupport ? false,
+  usbSupport ? false,
+  mingwSupport ? stdenv.hostPlatform.isDarwin,
+  waylandSupport ? false,
+  x11Support ? false,
+  embedInstallers ? false, # The Mono and Gecko MSI installers
+  moltenvk, # Allow users to override MoltenVK easily
+}:
+
+let
+  wine-build =
+    build: release:
+    lib.getAttr build (
+      callPackage ./packages.nix {
+        wineRelease = release;
+        supportFlags = {
+          inherit
+            alsaSupport
+            cairoSupport
+            cupsSupport
+            cursesSupport
+            dbusSupport
+            embedInstallers
+            fontconfigSupport
+            gettextSupport
+            gphoto2Support
+            gstreamerSupport
+            gtkSupport
+            krb5Support
+            mingwSupport
+            netapiSupport
+            odbcSupport
+            openclSupport
+            openglSupport
+            pcapSupport
+            pulseaudioSupport
+            saneSupport
+            sdlSupport
+            tlsSupport
+            udevSupport
+            usbSupport
+            v4lSupport
+            vaSupport
+            vulkanSupport
+            waylandSupport
+            x11Support
+            xineramaSupport
+            ;
+        };
+        inherit moltenvk;
+      }
+    );
+
+  baseRelease =
+    {
+      staging = "unstable";
+      yabridge = "yabridge";
+    }
+    .${wineRelease} or null;
+in
+if baseRelease != null then
+  callPackage ./staging.nix {
+    wineUnstable = (wine-build wineBuild baseRelease).override {
+      inherit wineRelease;
+    };
+  }
+else
+  wine-build wineBuild wineRelease

pkgs/applications/emulators/wine/fonts.nix

@@ -0,0 +1,32 @@
+{
+  stdenv,
+  lib,
+  callPackage,
+}:
+let
+  src = (callPackage ./sources.nix { }).stable;
+in
+stdenv.mkDerivation {
+  pname = "wine-fonts";
+  inherit (src) version;
+
+  sourceRoot = "wine-${src.version}/fonts";
+  inherit src;
+
+  installPhase = ''
+    install *.ttf -Dt $out/share/fonts/wine
+  '';
+
+  meta = {
+    description = "Microsoft replacement fonts by the Wine project";
+    homepage = "https://wiki.winehq.org/Create_Fonts";
+    license = with lib.licenses; [ lgpl21Plus ];
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      avnik
+      raskin
+      bendlas
+      johnazoidberg
+    ];
+  };
+}

pkgs/applications/emulators/wine/packages.nix

@@ -0,0 +1,119 @@
+{
+  stdenv_32bit,
+  lib,
+  pkgs,
+  pkgsi686Linux,
+  pkgsCross,
+  callPackage,
+  replaceVars,
+  moltenvk,
+  wineRelease ? "stable",
+  supportFlags,
+}:
+
+let
+  src = lib.getAttr wineRelease (callPackage ./sources.nix { });
+in
+with src;
+{
+  wine32 = pkgsi686Linux.callPackage ./base.nix {
+    pname = "wine";
+    inherit
+      src
+      version
+      supportFlags
+      patches
+      moltenvk
+      wineRelease
+      ;
+    pkgArches = [ pkgsi686Linux ];
+    geckos = [ gecko32 ];
+    mingwGccs = with pkgsCross; [ mingw32.buildPackages.gcc ];
+    monos = [ mono ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+  };
+  wine64 = callPackage ./base.nix {
+    pname = "wine64";
+    inherit
+      src
+      version
+      supportFlags
+      patches
+      moltenvk
+      wineRelease
+      ;
+    pkgArches = [ pkgs ];
+    mingwGccs = with pkgsCross; [ mingwW64.buildPackages.gcc ];
+    geckos = [ gecko64 ];
+    monos = [ mono ];
+    configureFlags = [ "--enable-win64" ];
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
+    mainProgram = "wine64";
+  };
+  wineWow = callPackage ./base.nix {
+    pname = "wine-wow";
+    inherit
+      src
+      version
+      supportFlags
+      patches
+      moltenvk
+      wineRelease
+      ;
+    stdenv = stdenv_32bit;
+    pkgArches = [
+      pkgs
+      pkgsi686Linux
+    ];
+    geckos = [
+      gecko32
+      gecko64
+    ];
+    mingwGccs = with pkgsCross; [
+      mingw32.buildPackages.gcc
+      mingwW64.buildPackages.gcc
+    ];
+    monos = [ mono ];
+    buildScript = replaceVars ./builder-wow.sh {
+      # pkgconfig has trouble picking the right architecture
+      pkgconfig64remove = lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
+        pkgs.glib
+        pkgs.gst_all_1.gstreamer
+      ];
+    };
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "wine64";
+  };
+  wineWow64 = callPackage ./base.nix {
+    pname = "wine-wow64";
+    inherit
+      src
+      version
+      patches
+      moltenvk
+      wineRelease
+      ;
+    supportFlags = supportFlags // {
+      mingwSupport = true;
+    }; # Required because we request "--enable-archs=x86_64"
+    pkgArches = [ pkgs ];
+    mingwGccs = with pkgsCross; [
+      mingw32.buildPackages.gcc
+      mingwW64.buildPackages.gcc
+    ];
+    geckos = [ gecko64 ];
+    monos = [ mono ];
+    configureFlags = [ "--enable-archs=x86_64,i386" ];
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
+    mainProgram = "wine";
+  };
+}

pkgs/applications/emulators/wine/setup-hook-darwin.sh

@@ -0,0 +1,37 @@
+
+fixupCFlagsForDarwin() {
+    # Because it’s getting called from a Darwin stdenv, MinGW will pick up on Darwin-specific
+    # flags, and the ./configure tests will fail to consider it a working cross-compiler.
+    # Strip them out, so Wine can use MinGW to build its DLLs instead of trying to use Clang.
+    # Ideally, it would be possible to build the DLLs on Windows (i.e., as part of `pkgsCross``),
+    # but that is not the case currently with Wine’s build system.
+    cflagsFilter='s|-F[^ ]*||g;s|-iframework [^ ]*||g;s|-isystem [^ ]*||g;s|  *| |g'
+
+    # libiconv and libintl aren’t needed by Wine, and having them causes linking to fail.
+    # The `CoreFoundation` reference is added by `linkSystemCoreFoundationFramework` in the
+    # Apple SDK’s setup hook. Remove that because MingW will fail due to file not found.
+    ldFlagsFilter='s|-lintl||g;s|-liconv||g;s|/nix/store/[^-]*-apple-framework-CoreFoundation[^ ]*||g'
+
+    # `cc-wrapper.sh`` supports getting flags from a system-specific salt. While it is currently a
+    # tuple, that’s not considered a stable interface, so the Wine derivation will provide them:
+    # - for Darwin: The source is `stdenv.cc.suffixSalt`; and
+    # - for MinGW: The source is the `suffixSalt`` attribute of each of the `mingwGccs`.
+    export NIX_CFLAGS_COMPILE_@darwinSuffixSalt@=${NIX_CFLAGS_COMPILE-}
+    export NIX_LDFLAGS_@darwinSuffixSalt@=${NIX_LDFLAGS-}
+    for mingwSalt in @mingwGccsSuffixSalts@; do
+        echo removing @darwinSuffixSalt@-specific flags from NIX_CFLAGS_COMPILE for $mingwSalt
+        export NIX_CFLAGS_COMPILE_$mingwSalt+="$(sed "$cflagsFilter" <<< "$NIX_CFLAGS_COMPILE")"
+        echo removing @darwinSuffixSalt@-specific flags from NIX_LDFLAGS for $mingwSalt
+        export NIX_LDFLAGS_$mingwSalt+="$(sed "$ldFlagsFilter;$cflagsFilter" <<< "$NIX_LDFLAGS")"
+    done
+
+    # Make sure the global flags aren’t accidentally influencing the platform-specific flags.
+    export NIX_CFLAGS_COMPILE=""
+    export NIX_LDFLAGS=""
+}
+
+# This is pretty hacky, but this hook _must_ run after `linkSystemCoreFoundationFramework`.
+function runFixupCFlagsForDarwinLast() {
+    preConfigureHooks+=(fixupCFlagsForDarwin)
+}
+postUnpackHooks+=(runFixupCFlagsForDarwinLast)

pkgs/applications/emulators/wine/sources.nix

@@ -0,0 +1,262 @@
+{
+  pkgs ? import <nixpkgs> { },
+}:
+## we default to importing <nixpkgs> here, so that you can use
+## a simple shell command to insert new hashes into this file
+## e.g. with emacs C-u M-x shell-command
+##
+##     nix-prefetch-url sources.nix -A {stable{,.mono,.gecko64,.gecko32}, unstable, staging, winetricks}
+
+# here we wrap fetchurl and fetchFromGitHub, in order to be able to pass additional args around it
+let
+  fetchurl = args@{ url, hash, ... }: pkgs.fetchurl { inherit url hash; } // args;
+  fetchFromGitHub =
+    args@{
+      owner,
+      repo,
+      rev,
+      hash,
+      ...
+    }:
+    pkgs.fetchFromGitHub {
+      inherit
+        owner
+        repo
+        rev
+        hash
+        ;
+    }
+    // args;
+  fetchFromGitLab =
+    args@{
+      domain,
+      owner,
+      repo,
+      rev,
+      hash,
+      ...
+    }:
+    pkgs.fetchFromGitLab {
+      inherit
+        domain
+        owner
+        repo
+        rev
+        hash
+        ;
+    }
+    // args;
+
+  updateScriptPreamble = ''
+    set -eou pipefail
+    PATH=${
+      with pkgs;
+      lib.makeBinPath [
+        common-updater-scripts
+        coreutils
+        curl
+        gnugrep
+        gnused
+        jq
+        nix
+      ]
+    }
+    sources_file=${__curPos.file}
+    source ${./update-lib.sh}
+  '';
+
+  # Needed for wine versions < 10.2 to fix compatibility with binutils 2.44
+  # https://github.com/NixOS/nixpkgs/issues/399714
+  # https://bugs.winehq.org/show_bug.cgi?id=57819
+  # https://gitlab.winehq.org/wine/wine/-/merge_requests/7328
+  patches-binutils-2_44-fix-wine-older-than-10_2 = [
+    (pkgs.fetchpatch {
+      name = "ntdll-use-signed-type";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/fd59962827a715d321f91c9bdb43f3e61f9ebbc.patch";
+      hash = "sha256-PvFom9NJ32XZO1gYor9Cuk8+eaRFvmG572OAtNx1tks=";
+    })
+    (pkgs.fetchpatch {
+      name = "winebuild-avoid using-idata-section";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/c9519f68ea04915a60704534ab3afec5ec1b8fd7.patch";
+      hash = "sha256-vA58SfAgCXoCT+NB4SRHi85AnI4kj9S2deHGp4L36vI=";
+    })
+  ];
+
+  inherit (pkgs) writeShellScript;
+in
+rec {
+
+  stable = fetchurl rec {
+    version = "10.0";
+    url = "https://dl.winehq.org/wine/source/10.0/wine-${version}.tar.xz";
+    hash = "sha256-xeCz9ffvr7MOnNTZxiS4XFgxcdM1SdkzzTQC80GsNgE=";
+
+    ## see http://wiki.winehq.org/Gecko
+    gecko32 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86.msi";
+      hash = "sha256-Js7MR3BrCRkI9/gUvdsHTGG+uAYzGOnvxaf3iYV3k9Y=";
+    };
+    gecko64 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86_64.msi";
+      hash = "sha256-5ZC32YijLWqkzx2Ko6o9M3Zv3Uz0yJwtzCCV7LKNBm8=";
+    };
+
+    ## see http://wiki.winehq.org/Mono
+    mono = fetchurl rec {
+      version = "8.1.0";
+      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
+      hash = "sha256-DtPsUzrvebLzEhVZMc97EIAAmsDFtMK8/rZ4rJSOCBA=";
+    };
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ]
+    ++ patches-binutils-2_44-fix-wine-older-than-10_2;
+
+    updateScript = writeShellScript "update-wine-stable" ''
+      ${updateScriptPreamble}
+      major=''${UPDATE_NIX_OLD_VERSION%%.*}
+      latest_stable=$(get_latest_wine_version "$major.0")
+
+      # Can't use autobump on stable because we don't want the path
+      # <source/7.0/wine-7.0.tar.xz> to become <source/7.0.1/wine-7.0.1.tar.xz>.
+      if [[ "$UPDATE_NIX_OLD_VERSION" != "$latest_stable" ]]; then
+          set_version_and_hash stable "$latest_stable" "$(nix-prefetch-url "$wine_url_base/source/$major.0/wine-$latest_stable.tar.xz")"
+      fi
+
+      do_update
+    '';
+  };
+
+  unstable = fetchurl rec {
+    # NOTE: Don't forget to change the hash for staging as well.
+    version = "10.15";
+    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
+    hash = "sha256-MH4hI3xui96iZvlG0x8J7SexlX35oDUW2Ccf0T4cJh0=";
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ];
+
+    # see https://gitlab.winehq.org/wine/wine-staging
+    staging = fetchFromGitLab {
+      inherit version;
+      hash = "sha256-VzHM4Qm0XDP7suCT5dmJgoDJmZ1DLg6qqOUVQzNc0g4=";
+      domain = "gitlab.winehq.org";
+      owner = "wine";
+      repo = "wine-staging";
+      rev = "v${version}";
+
+      disabledPatchsets = [ ];
+    };
+
+    ## see http://wiki.winehq.org/Gecko
+    gecko32 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86.msi";
+      hash = "sha256-Js7MR3BrCRkI9/gUvdsHTGG+uAYzGOnvxaf3iYV3k9Y=";
+    };
+    gecko64 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86_64.msi";
+      hash = "sha256-5ZC32YijLWqkzx2Ko6o9M3Zv3Uz0yJwtzCCV7LKNBm8=";
+    };
+
+    ## see http://wiki.winehq.org/Mono
+    mono = fetchurl rec {
+      version = "10.2.0";
+      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
+      hash = "sha256-Th7T8C6S0FMTPQPd++/PbbSk3CMamu0zZ7FxF6iIR9g=";
+    };
+
+    updateScript = writeShellScript "update-wine-unstable" ''
+      ${updateScriptPreamble}
+      major=''${UPDATE_NIX_OLD_VERSION%%.*}
+      latest_unstable=$(get_latest_wine_version "$major.x")
+      latest_gecko=$(get_latest_lib_version wine-gecko)
+      latest_mono=$(get_latest_lib_version wine-mono)
+
+      update_staging() {
+          staging_url=$(get_source_attr unstable.staging.url)
+          set_source_attr unstable.staging hash "\"$(to_sri "$(nix-prefetch-url --unpack "''${staging_url//$1/$2}")")\""
+      }
+
+      autobump unstable "$latest_unstable" "" update_staging
+      autobump unstable.gecko32 "$latest_gecko"
+      autobump unstable.gecko64 "$latest_gecko"
+      autobump unstable.mono "$latest_mono"
+
+      do_update
+    '';
+  };
+
+  yabridge = fetchurl rec {
+    # NOTE: This is a pinned version with staging patches; don't forget to update them as well
+    version = "9.21";
+    url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
+    hash = "sha256-REK0f/2bLqRXEA427V/U5vTYKdnbeaJeYFF1qYjKL/8=";
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ]
+    ++ patches-binutils-2_44-fix-wine-older-than-10_2;
+
+    # see https://gitlab.winehq.org/wine/wine-staging
+    staging = fetchFromGitLab {
+      inherit version;
+      hash = "sha256-FDNszRUvM1ewE9Ij4EkuihaX0Hf0eTb5r7KQHMdCX3U=";
+      domain = "gitlab.winehq.org";
+      owner = "wine";
+      repo = "wine-staging";
+      rev = "v${version}";
+
+      disabledPatchsets = [ ];
+    };
+
+    ## see http://wiki.winehq.org/Gecko
+    gecko32 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86.msi";
+      hash = "sha256-Js7MR3BrCRkI9/gUvdsHTGG+uAYzGOnvxaf3iYV3k9Y=";
+    };
+    gecko64 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86_64.msi";
+      hash = "sha256-5ZC32YijLWqkzx2Ko6o9M3Zv3Uz0yJwtzCCV7LKNBm8=";
+    };
+
+    ## see http://wiki.winehq.org/Mono
+    mono = fetchurl rec {
+      version = "9.3.0";
+      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
+      hash = "sha256-bKLArtCW/57CD69et2xrfX3oLZqIdax92fB5O/nD/TA=";
+    };
+  };
+
+  wayland = pkgs.lib.warnOnInstantiate "building wine with `wineRelease = \"wayland\"` is deprecated. Wine now builds with the wayland driver by default." stable; # added 2025-01-23
+
+  winetricks = fetchFromGitHub rec {
+    # https://github.com/Winetricks/winetricks/releases
+    version = "20250102";
+    hash = "sha256-Km2vVTYsLs091cjmNTW8Kqku3vdsEA0imTtZfqZWDQo=";
+    owner = "Winetricks";
+    repo = "winetricks";
+    rev = version;
+
+    updateScript = writeShellScript "update-winetricks" ''
+      ${updateScriptPreamble}
+      winetricks_repourl=$(get_source_attr winetricks.gitRepoUrl)
+
+      latest_winetricks=$(list-git-tags --url="$winetricks_repourl" | grep -E '^[0-9]{8}$' | sort --reverse --numeric-sort | head -n 1)
+
+      autobump winetricks "$latest_winetricks" 'nix-prefetch-url --unpack'
+
+      do_update
+    '';
+  };
+}

pkgs/applications/emulators/wine/staging.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  autoconf,
+  hexdump,
+  perl,
+  python3,
+  wineUnstable,
+  gitMinimal,
+}:
+
+with callPackage ./util.nix { };
+
+let
+  patch = wineUnstable.src.staging;
+  build-inputs = pkgNames: extra: (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
+in
+assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMinor patch.version;
+
+wineUnstable.overrideAttrs (self: {
+  buildInputs = build-inputs (
+    [
+      "perl"
+      "autoconf"
+      "gitMinimal"
+    ]
+    ++ lib.optional stdenv.hostPlatform.isLinux "util-linux"
+  ) self.buildInputs;
+  nativeBuildInputs = [
+    autoconf
+    hexdump
+    perl
+    python3
+    gitMinimal
+  ]
+  ++ self.nativeBuildInputs;
+
+  prePatch = self.prePatch or "" + ''
+    patchShebangs tools
+    cp -r ${patch}/patches ${patch}/staging .
+    chmod +w patches
+    patchShebangs ./patches/gitapply.sh
+    python3 ./staging/patchinstall.py DESTDIR="$PWD" --all ${
+      lib.concatMapStringsSep " " (ps: "-W ${ps}") patch.disabledPatchsets
+    }
+  '';
+})
+// {
+  meta = wineUnstable.meta // {
+    description = wineUnstable.meta.description + " (with staging patches)";
+  };
+}

pkgs/applications/emulators/wine/update-lib.sh

@@ -0,0 +1,49 @@
+wine_url_base=https://dl.winehq.org/wine
+
+sed_exprs=()
+
+get_source_attr() {
+    nix-instantiate --eval --json -E "(let pkgs = import ./. {}; in pkgs.callPackage $sources_file { inherit pkgs; }).$1" | jq -r
+}
+
+set_source_attr() {
+    path="$1"
+    name="$2"
+    value="$3"
+    line=$(nix-instantiate --eval -E "(builtins.unsafeGetAttrPos \"$name\" (let pkgs = import ./. {}; in pkgs.callPackage $sources_file { inherit pkgs; }).$path).line")
+    sed_exprs+=(-e "${line}s@[^ ].*\$@$name = $value;@")
+}
+
+set_version_and_hash() {
+    set_source_attr "$1" version "\"$2\""
+    set_source_attr "$1" hash "\"$(to_sri "$3")\""
+}
+
+get_latest_wine_version() {
+    list-directory-versions --pname=wine --url="$wine_url_base/source/$1/" | grep -v 'diff\|rc\|tar' | sort --reverse --version-sort -u | head -n 1
+}
+
+get_latest_lib_version() {
+    curl -s "$wine_url_base/$1/" | grep -o 'href="[0-9.]*/"' | sed 's_^href="\(.*\)/"_\1_' | sort --reverse --version-sort -u | head -n 1
+}
+
+to_sri() {
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$1"
+}
+
+autobump() {
+    attr="$1"
+    latest="$2"
+    fetcher="${3:-nix-prefetch-url}"
+    more="${4:-}"
+    version=$(get_source_attr "$attr.version")
+    if [[ "$version" != "$latest" ]]; then
+        url=$(get_source_attr "$attr.url")
+        set_version_and_hash "$attr" "$latest" "$($fetcher "${url//$version/$latest}")"
+        [[ -z "$more" ]] || $more "$version" "$latest"
+    fi
+}
+
+do_update() {
+    [[ "${#sed_exprs[@]}" -eq 0 ]] || sed -i "${sed_exprs[@]}" "$sources_file"
+}

pkgs/applications/emulators/wine/util.nix

@@ -0,0 +1,6 @@
+{ lib }:
+rec {
+  toPackages = pkgNames: pkgs: map (pn: lib.getAttr pn pkgs) pkgNames;
+  toBuildInputs = pkgArches: archPkgs: lib.concatLists (map archPkgs pkgArches);
+  mkBuildInputs = pkgArches: pkgNames: toBuildInputs pkgArches (toPackages pkgNames);
+}

pkgs/applications/emulators/wine/winetricks.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  perl,
+  which,
+  coreutils,
+  zenity,
+  curl,
+  cabextract,
+  unzip,
+  p7zip,
+  gnused,
+  gnugrep,
+  bash,
+  gawk,
+  gnutar,
+  gzip,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "winetricks";
+  version = src.version;
+
+  src = (callPackage ./sources.nix { }).winetricks;
+
+  buildInputs = [
+    perl
+    which
+  ];
+
+  # coreutils is for sha1sum
+  pathAdd = lib.makeBinPath [
+    perl
+    which
+    coreutils
+    zenity
+    curl
+    cabextract
+    unzip
+    p7zip
+    gnused
+    gnugrep
+    bash
+    gawk
+    gnutar
+    gzip
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  doCheck = false; # requires "bashate"
+
+  postInstall = ''
+    sed -i \
+      -e '2i PATH="${pathAdd}:$PATH"' \
+      "$out/bin/winetricks"
+  '';
+
+  passthru = {
+    inherit (src) updateScript;
+  };
+
+  meta = {
+    description = "Script to install DLLs needed to work around problems in Wine";
+    mainProgram = "winetricks";
+    license = lib.licenses.lgpl21;
+    homepage = "https://github.com/Winetricks/winetricks";
+    platforms = with lib.platforms; linux ++ darwin;
+  };
+}