push sheeet

2025-10-09 14:15:47 +02:00
commit 646b892680
49168 changed files with 5897842 additions and 0 deletions
--- a/pkgs/by-name/on/onagre/package.nix
+++ b/pkgs/by-name/on/onagre/package.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  rustPlatform,
+  cmake,
+  pkgconf,
+  freetype,
+  expat,
+  wayland,
+  xorg,
+  libxkbcommon,
+  pop-launcher,
+  vulkan-loader,
+  libGL,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "onagre";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "onagre-launcher";
+    repo = "onagre";
+    rev = "1.1.1";
+    hash = "sha256-yVkK3B7/ul0sOxPE3z2qkY/CnsZPQYqTpd64Wo/GXZI=";
+  };
+
+  cargoHash = "sha256-JsTBzkznFYiSOq41aptNa5akXTdkqJj3FwoHuvUlgpE=";
+
+  nativeBuildInputs = [
+    makeWrapper
+    cmake
+    pkgconf
+  ];
+  buildInputs = [
+    expat
+    freetype
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+  ];
+
+  postFixup =
+    let
+      rpath = lib.makeLibraryPath [
+        libGL
+        vulkan-loader
+        wayland
+        libxkbcommon
+      ];
+    in
+    ''
+      patchelf --set-rpath ${rpath} $out/bin/onagre
+      wrapProgram $out/bin/onagre \
+        --prefix PATH ':' ${
+          lib.makeBinPath [
+            pop-launcher
+          ]
+        }
+    '';
+
+  meta = with lib; {
+    description = "General purpose application launcher for X and wayland inspired by rofi/wofi and alfred";
+    homepage = "https://github.com/onagre-launcher/onagre";
+    license = licenses.mit;
+    maintainers = [
+      maintainers.jfvillablanca
+      maintainers.ilya-epifanov
+    ];
+    platforms = platforms.linux;
+    mainProgram = "onagre";
+  };
+}
--- a/pkgs/by-name/on/onboard/bool.patch
+++ b/pkgs/by-name/on/onboard/bool.patch
@@ -0,0 +1,10 @@
+Author: @vcunat
+
+    Don't redefine bool and use the standard one instead.
+
+--- a/Onboard/osk/osk_module.h
+++ b/Onboard/osk/osk_module.h
+@@ -28 +28 @@
+-typedef enum { false, true } bool;
+#include <stdbool.h>
+
--- a/pkgs/by-name/on/onboard/fix-paths.patch
+++ b/pkgs/by-name/on/onboard/fix-paths.patch
@@ -0,0 +1,11 @@
+--- a/Onboard/ClickSimulator.py
+++ b/Onboard/ClickSimulator.py
+@@ -479,7 +479,7 @@ class CSMousetweaks(ConfigObject, ClickSimulator):
+         self._daemon_running_notify_callbacks = []
+
+     def _launch_daemon(self, delay):
+-        self.launcher.launch_delayed(["mousetweaks"], delay)
+        self.launcher.launch_delayed(["@mousetweaks@/bin/mousetweaks"], delay)
+
+     def _set_connection(self, active):
+         ''' Update interface object, state and notify listeners '''
--- a/pkgs/by-name/on/onboard/hunspell-use-xdg-datadirs.patch
+++ b/pkgs/by-name/on/onboard/hunspell-use-xdg-datadirs.patch
@@ -0,0 +1,20 @@
+diff --git a/Onboard/SpellChecker.py b/Onboard/SpellChecker.py
+index 6a92757..46e755e 100644
+--- a/Onboard/SpellChecker.py
+++ b/Onboard/SpellChecker.py
+@@ -506,6 +506,10 @@ class hunspell(SCBackend):
+         if dicpath:
+             paths.extend(dicpath.split(pathsep))
+ 
+        datadirs = os.getenv("XDG_DATA_DIRS")
+        if datadirs:
+            paths.extend(map(lambda datadir: os.path.join(datadir, 'hunspell'), datadirs.split(pathsep)))
+
+         paths.extend(LIBDIRS)
+ 
+         home = os.getenv("HOME")
+@@ -723,4 +727,3 @@ class aspell_cmd(SCBackend):
+             _logger.error(_format("Failed to execute '{}', {}", \
+                             " ".join(args), e))
+         return [id for id in dict_ids if id]
+-
--- a/pkgs/by-name/on/onboard/package.nix
+++ b/pkgs/by-name/on/onboard/package.nix
@@ -0,0 +1,198 @@
+{
+  fetchurl,
+  fetchpatch,
+  stdenv,
+  lib,
+  replaceVars,
+  aspellWithDicts,
+  at-spi2-core ? null,
+  atspiSupport ? true,
+  bash,
+  glib,
+  dconf,
+  gobject-introspection,
+  gsettings-desktop-schemas,
+  gtk3,
+  hunspell,
+  hunspellDicts,
+  intltool,
+  isocodes,
+  libappindicator-gtk3,
+  libcanberra-gtk3,
+  mousetweaks,
+  udev,
+  libxkbcommon,
+  pkg-config,
+  procps,
+  python3,
+  wrapGAppsHook3,
+  xorg,
+  yelp,
+}:
+
+let
+
+  customHunspell = hunspell.withDicts (di: [ di.en-us ]);
+
+  majorVersion = "1.4";
+
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "onboard";
+  version = "${majorVersion}.1";
+  format = "setuptools";
+
+  src = fetchurl {
+    url = "https://launchpad.net/onboard/${majorVersion}/${version}/+download/${pname}-${version}.tar.gz";
+    sha256 = "0r9q38ikmr4in4dwqd8m9gh9xjbgxnfxglnjbfcapw8ybfnf3jh1";
+  };
+
+  patches = [
+    (replaceVars ./fix-paths.patch { inherit mousetweaks; })
+    # Allow loading hunspell dictionaries installed in NixOS system path
+    ./hunspell-use-xdg-datadirs.patch
+
+    # Python 3.12 fixes (otherwise crashes at startup)
+    (fetchpatch {
+      url = "https://github.com/void-linux/void-packages/raw/1be95325d320122efd5dedf7437839cfcca01f7a/srcpkgs/onboard/patches/python-3.12.patch";
+      hash = "sha256-Lw5wlaWFlP5rFlEWmlPo5Ux8idrmhET/X9yiu+2Akkk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/void-linux/void-packages/raw/1be95325d320122efd5dedf7437839cfcca01f7a/srcpkgs/onboard/patches/thread-state.patch";
+      hash = "sha256-fJfxD7HshroiEVkaKVBGV7py8tdOhbcprcmBQNuxR9U=";
+    })
+
+    # Fix for https://bugs.launchpad.net/onboard/+bug/1948723
+    (fetchpatch {
+      url = "https://github.com/void-linux/void-packages/raw/9ef46bf26ac5acc1af5809f11c97b19c5e2233ed/srcpkgs/onboard/patches/fix-brokenformat.patch";
+      hash = "sha256-r9mvJNWpPR1gsayuSSLpzIuafEKqtADYklre0Ju+KOM=";
+    })
+
+    ./bool.patch
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    intltool
+    pkg-config
+    wrapGAppsHook3
+    python3.pkgs.setuptools
+  ];
+
+  buildInputs = [
+    bash
+    glib
+    dconf
+    gsettings-desktop-schemas
+    gtk3
+    hunspell
+    isocodes
+    libappindicator-gtk3
+    libcanberra-gtk3
+    libxkbcommon
+    mousetweaks
+    udev
+    xorg.libXtst
+    xorg.libxkbfile
+  ]
+  ++ lib.optional atspiSupport at-spi2-core;
+
+  pythonPath = with python3.pkgs; [
+    dbus-python
+    distutils-extra
+    pyatspi
+    pycairo
+    pygobject3
+    systemd
+  ];
+
+  propagatedUserEnvPkgs = [ dconf ];
+
+  nativeCheckInputs = [
+    # for Onboard.SpellChecker.aspell_cmd doctests
+    (aspellWithDicts (dicts: with dicts; [ en ]))
+
+    # for Onboard.SpellChecker.hunspell_cmd doctests
+    customHunspell
+
+    # for Onboard.SpellChecker.hunspell doctests
+    hunspellDicts.en-us
+    hunspellDicts.es-es
+    hunspellDicts.it-it
+  ];
+
+  # Tests have never been enabled, and upstream uses nose as a test
+  # runner (though not as a library).
+  doCheck = false;
+
+  preBuild = ''
+    # Unnecessary file, has been removed upstream
+    # https://github.com/NixOS/nixpkgs/pull/24986#issuecomment-296114062
+    rm -r Onboard/pypredict/attic
+
+    substituteInPlace  ./scripts/sokSettings.py \
+      --replace "#!/usr/bin/python3" "" \
+      --replace "PYTHON_EXECUTABLE," "\"$out/bin/onboard-settings\"" \
+      --replace '"-cfrom Onboard.settings import Settings\ns = Settings(False)"' ""
+
+    chmod -x ./scripts/sokSettings.py
+
+    patchShebangs --host Onboard/ onboard-settings onboard
+
+    substituteInPlace setup.py \
+      --replace-fail "pkg-config" "${stdenv.cc.targetPrefix}pkg-config" \
+      --replace "/etc" "$out/etc"
+
+    substituteInPlace  ./Onboard/LanguageSupport.py \
+      --replace "/usr/share/xml/iso-codes" "${isocodes}/share/xml/iso-codes"
+
+    substituteInPlace  ./Onboard/Indicator.py \
+      --replace   "/usr/bin/yelp" "${yelp}/bin/yelp"
+
+    substituteInPlace  ./gnome/Onboard_Indicator@onboard.org/extension.js \
+      --replace "/usr/bin/yelp" "${yelp}/bin/yelp"
+
+    substituteInPlace  ./Onboard/SpellChecker.py \
+      --replace "/usr/lib" "$out/lib"
+
+    substituteInPlace  ./data/org.onboard.Onboard.service  \
+      --replace "/usr/bin" "$out/bin"
+
+    substituteInPlace  ./Onboard/utils.py \
+      --replace "/usr/share" "$out/share"
+    substituteInPlace  ./onboard-defaults.conf.example \
+      --replace "/usr/share" "$out/share"
+    substituteInPlace  ./Onboard/Config.py \
+      --replace "/usr/share/onboard" "$out/share/onboard"
+
+    substituteInPlace  ./Onboard/WordSuggestions.py \
+      --replace "/usr/bin" "$out/bin"
+
+    # killall is dangerous on non-gnu platforms. Use pkill instead.
+    substituteInPlace  ./setup.py \
+      --replace '"killall",' '"${procps}/bin/pkill", "-x",'
+  '';
+
+  # setuptools to get distutils with python 3.12
+  installPhase = ''
+    runHook preInstall
+    ${
+      (python3.pythonOnBuildForHost.withPackages (p: [ p.setuptools ])).interpreter
+    } setup.py install --prefix="$out"
+    cp onboard-default-settings.gschema.override.example $out/share/glib-2.0/schemas/10_onboard-default-settings.gschema.override
+    glib-compile-schemas $out/share/glib-2.0/schemas/
+    runHook postInstall
+  '';
+
+  # Remove ubuntu icons.
+  postFixup = ''
+    rm -rf  $out/share/icons/ubuntu-mono-*
+  '';
+
+  meta = with lib; {
+    homepage = "https://launchpad.net/onboard";
+    description = "Onscreen keyboard useful for tablet PC users and for mobility impaired users";
+    maintainers = [ ];
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/by-name/on/oncall/package.nix
+++ b/pkgs/by-name/on/oncall/package.nix
@@ -0,0 +1,110 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  fetchPypi,
+  oncall,
+  nixosTests,
+  fetchpatch,
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "oncall";
+  # Using newer revision for Falcon 4 patch to work
+  version = "0-unstable-2025-04-15";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "linkedin";
+    repo = "oncall";
+    #tag = "v${version}";
+    rev = "030f5d0286b253e4300d36de1954c7b2a7490a76";
+    hash = "sha256-Lox9aqYKsl/vg6mNwr0MoLmJQkC+kEf7AqvCCKhgo94=";
+  };
+
+  patches = [
+    # Add support for loading extra settings file
+    ./support_extra_config.patch
+
+    # Support storing assets in custom state dir
+    ./support_custom_state_dir.patch
+
+    # Log Python errors to uwsgi
+    ./verbose_logging.patch
+
+    # Add support for Falcon 4
+    # https://github.com/linkedin/oncall/pull/433
+    (fetchpatch {
+      url = "https://github.com/linkedin/oncall/commit/4ccf2239fb8c8aeda376f57735461174f48614f2.patch";
+      hash = "sha256-XT7Z6NUg2zxoRtgxaM0ZbBhXtO9xvhKv30Jo1ZaEGMU=";
+      name = "falcon_4_support.patch";
+    })
+  ];
+
+  dependencies = with python3.pkgs; [
+    beaker
+    falcon
+    falcon-cors
+    gevent
+    gunicorn
+    icalendar
+    irisclient
+    jinja2
+    phonenumbers
+    pymysql
+    python-ldap
+    pytz
+    pyyaml
+    ujson
+    webassets
+  ];
+
+  postInstall = ''
+    mkdir "$out/share"
+    cp -r configs db "$out/share/"
+  '';
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  disabledTestPaths = [
+    # Tests require running web server
+    "e2e/test_audit.py"
+    "e2e/test_events.py"
+    "e2e/test_ical.py"
+    "e2e/test_login.py"
+    "e2e/test_notification.py"
+    "e2e/test_override.py"
+    "e2e/test_pin.py"
+    "e2e/test_populate.py"
+    "e2e/test_roles.py"
+    "e2e/test_roster_suggest.py"
+    "e2e/test_rosters.py"
+    "e2e/test_schedules.py"
+    "e2e/test_services.py"
+    "e2e/test_subscription.py"
+    "e2e/test_teams.py"
+    "e2e/test_users.py"
+  ];
+
+  pythonImportsCheck = [
+    "oncall"
+  ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) oncall;
+    };
+    pythonPath = "${python3.pkgs.makePythonPath dependencies}:${oncall}/${python3.sitePackages}";
+  };
+
+  meta = {
+    description = "Calendar web-app designed for scheduling and managing on-call shifts";
+    homepage = "https://oncall.tools";
+    changelog = "https://github.com/linkedin/oncall/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ onny ];
+    mainProgram = "oncall";
+  };
+}
--- a/pkgs/by-name/on/oncall/support_custom_state_dir.patch
+++ b/pkgs/by-name/on/oncall/support_custom_state_dir.patch
@@ -0,0 +1,56 @@
+diff --git a/src/oncall/ui/__init__.py b/src/oncall/ui/__init__.py
+index a94fb17..364404a 100644
+--- a/src/oncall/ui/__init__.py
+++ b/src/oncall/ui/__init__.py
+@@ -18,8 +18,12 @@ from webassets.ext.jinja2 import AssetsExtension
+ from webassets.script import CommandLineEnvironment
+ 
+ STATIC_ROOT = environ.get('STATIC_ROOT', path.abspath(path.dirname(__file__)))
+SOURCE_ROOT = path.abspath(path.dirname(__file__))
+ assets_env = AssetsEnvironment(path.join(STATIC_ROOT, 'static'),
+                                url='/static')
+assets_env.cache = False
+assets_env.manifest = False
+assets_env.load_path = [ path.join(SOURCE_ROOT, 'static') ]
+ 
+ assets_env.register('libs', Bundle(
+     'js/jquery-3.3.1.min.js', 'js/handlebars-4.0.12.min.js', 'js/bootstrap.min.js',
+@@ -45,7 +49,7 @@ logger = logging.getLogger('webassets')
+ logger.addHandler(logging.StreamHandler())
+ 
+ jinja2_env = Jinja2Environment(extensions=[AssetsExtension], autoescape=True)
+-jinja2_env.loader = FileSystemLoader(path.join(STATIC_ROOT, 'templates'))
+jinja2_env.loader = FileSystemLoader(path.join(SOURCE_ROOT, 'templates'))
+ jinja2_env.assets_environment = assets_env
+ 
+ _filename_ascii_strip_re = re.compile(r'[^A-Za-z0-9_.-]')
+@@ -113,14 +117,15 @@ def secure_filename(filename):
+ class StaticResource(object):
+     allow_no_auth = True
+ 
+-    def __init__(self, path):
+    def __init__(self, path, root):
+         self.path = path.lstrip('/')
+        self.root = root
+ 
+     def on_get(self, req, resp, filename):
+         suffix = path.splitext(req.path)[1]
+         resp.content_type = mimes.get(suffix, 'application/octet-stream')
+ 
+-        filepath = path.join(STATIC_ROOT, self.path, secure_filename(filename))
+        filepath = path.join(self.root, self.path, secure_filename(filename))
+         try:
+             resp.stream = open(filepath, 'rb')
+             resp.content_length = path.getsize(filepath)
+@@ -153,8 +158,8 @@ def init(application, config):
+ 
+     application.add_sink(index, '/')
+     application.add_route('/static/bundles/{filename}',
+-                          StaticResource('/static/bundles'))
+                          StaticResource('/static/bundles', STATIC_ROOT))
+     application.add_route('/static/images/{filename}',
+-                          StaticResource('/static/images'))
+                          StaticResource('/static/images', SOURCE_ROOT))
+     application.add_route('/static/fonts/{filename}',
+-                          StaticResource('/static/fonts'))
+                          StaticResource('/static/fonts', SOURCE_ROOT))
--- a/pkgs/by-name/on/oncall/support_extra_config.patch
+++ b/pkgs/by-name/on/oncall/support_extra_config.patch
@@ -0,0 +1,120 @@
+diff --git a/src/oncall/bin/notifier.py b/src/oncall/bin/notifier.py
+index 25142b8..cbc92aa 100644
+--- a/src/oncall/bin/notifier.py
+++ b/src/oncall/bin/notifier.py
+@@ -32,11 +32,29 @@ send_queue = queue.Queue()
+ 
+ default_timezone = None
+ 
+def merge_dict(extend_me, extend_by):
+    if isinstance(extend_by, dict):
+        for k, v in extend_by.items():
+            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
+                merge_dict(extend_me[k], v)
+            else:
+                extend_me[k] = v
+    return extend_me
+ 
+ def load_config_file(config_path):
+     with open(config_path, 'r', encoding='utf-8') as h:
+         config = yaml.safe_load(h)
+ 
+    # Check for extra config files from environment variable
+    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
+    if extra_config_paths:
+        for extra_path in extra_config_paths.split(','):
+            extra_path = extra_path.strip()
+            if os.path.isfile(extra_path):
+                with open(extra_path, 'r') as f:
+                    extra_config = yaml.safe_load(f) or {}
+                config = merge_dict(config, extra_config)
+
+     if 'init_config_hook' in config:
+         try:
+             module = config['init_config_hook']
+diff --git a/src/oncall/user_sync/ldap_sync.py b/src/oncall/user_sync/ldap_sync.py
+index ef9a8ec..c5f027d 100644
+--- a/src/oncall/user_sync/ldap_sync.py
+++ b/src/oncall/user_sync/ldap_sync.py
+@@ -6,6 +6,7 @@ import time
+ import yaml
+ import logging
+ import ldap
+import os
+ 
+ from oncall import metrics
+ from ldap.controls import SimplePagedResultsControl
+@@ -447,9 +448,28 @@ def main(config):
+         logger.info('Sleeping for %s seconds' % sleep_time)
+         sleep(sleep_time)
+ 
+def merge_dict(extend_me, extend_by):
+    if isinstance(extend_by, dict):
+        for k, v in extend_by.items():
+            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
+                merge_dict(extend_me[k], v)
+            else:
+                extend_me[k] = v
+    return extend_me
+ 
+ if __name__ == '__main__':
+     config_path = sys.argv[1]
+     with open(config_path, 'r', encoding='utf-8') as config_file:
+         config = yaml.safe_load(config_file)
+
+    # Check for extra config files from environment variable
+    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
+    if extra_config_paths:
+        for extra_path in extra_config_paths.split(','):
+            extra_path = extra_path.strip()
+            if os.path.isfile(extra_path):
+                with open(extra_path, 'r') as f:
+                    extra_config = yaml.safe_load(f) or {}
+                config = merge_dict(config, extra_config)
+
+     main(config)
+diff --git a/src/oncall/utils.py b/src/oncall/utils.py
+index a0b695c..278ca1d 100644
+--- a/src/oncall/utils.py
+++ b/src/oncall/utils.py
+@@ -13,6 +13,7 @@ from pytz import timezone
+ from .constants import ONCALL_REMINDER
+ from . import constants
+ import re
+import os
+ 
+ invalid_char_reg = re.compile(r'[!"#%-,\.\/;->@\[-\^`\{-~]+')
+ DAY = 86400
+@@ -27,10 +28,31 @@ def insert_notification(x, y):
+ def update_notification(x, y):
+     pass
+ 
+def merge_dict(extend_me, extend_by):
+    if isinstance(extend_by, dict):
+        for k, v in extend_by.items():
+            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
+                merge_dict(extend_me[k], v)
+            else:
+                extend_me[k] = v
+    return extend_me
+ 
+ def read_config(config_path):
+
+     with open(config_path, 'r', encoding='utf8') as config_file:
+-        return yaml.safe_load(config_file)
+        config = yaml.safe_load(config_file)
+
+    # Check for extra config files from environment variable
+    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
+    if extra_config_paths:
+        for extra_path in extra_config_paths.split(','):
+            extra_path = extra_path.strip()
+            if os.path.isfile(extra_path):
+                with open(extra_path, 'r') as f:
+                    extra_config = yaml.safe_load(f) or {}
+                config = merge_dict(config, extra_config)
+
+    return config
+ 
+ 
+ def create_notification(context, team_id, role_ids, type_name, users_involved, cursor, **kwargs):
--- a/pkgs/by-name/on/oncall/verbose_logging.patch
+++ b/pkgs/by-name/on/oncall/verbose_logging.patch
@@ -0,0 +1,33 @@
+diff --git a/src/oncall/app.py b/src/oncall/app.py
+index 370fcf4..59f014e 100644
+--- a/src/oncall/app.py
+++ b/src/oncall/app.py
+@@ -62,9 +62,19 @@ class AuthMiddleware(object):
+ 
+ application = None
+ 
+def handle_uncaught_exception(req, resp, ex, params):
+    logging.exception('Unhandled error')
+    raise falcon.HTTPInternalServerError(title='App error')
+
+
+def handle_http_error(req, resp, ex, params):
+    logging.exception('HTTP error')
+    raise ex
+
+ 
+ def init_falcon_api(config):
+     global application
+
+     cors = CORS(allow_origins_list=config.get('allow_origins_list', []))
+     middlewares = [
+         SecurityHeaderMiddleware(),
+@@ -74,6 +84,8 @@ def init_falcon_api(config):
+     if config.get('require_auth'):
+         middlewares.append(AuthMiddleware())
+     application = falcon.App(middleware=middlewares)
+    application.add_error_handler(falcon.HTTPError, handle_http_error)
+    application.add_error_handler(Exception, handle_uncaught_exception)
+     application.req_options.auto_parse_form_urlencoded = False
+     application.set_error_serializer(json_error_serializer)
+     application.req_options.strip_url_path_trailing_slash = True
--- a/pkgs/by-name/on/ondir/package.nix
+++ b/pkgs/by-name/on/ondir/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "ondir";
+  version = "0.2.3";
+
+  src = fetchFromGitHub {
+    owner = "alecthomas";
+    repo = "ondir";
+    rev = "cb2f9f8b21e336165fc0a310d677fda75c8e8513";
+    hash = "sha256-XTZKFIzJ3xL8ae3zG8nsMhGWvpvRUAQ2b6q/Q1QvGd0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    make DESTDIR="$out" PREFIX= install
+    cp scripts.* $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Small program to automate tasks specific to certain directories";
+    longDescription = ''
+      It works by executing scripts in directories when you enter and leave them.
+      This is done by overriding the shell builtins cd, pushd, and popd,
+       which is a manual action.
+      The user is required to add a snippet to their shell initialisation file like .bashrc or .profile.
+
+      Which commands are executed on directory entry and leave is done
+       in predefined locations with a .ondirrc file.
+
+      See man ondir for more information
+    '';
+    homepage = "https://github.com/alecthomas/ondir/";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.michaelCTS ];
+    mainProgram = "ondir";
+  };
+}
--- a/pkgs/by-name/on/one-click-backup/package.nix
+++ b/pkgs/by-name/on/one-click-backup/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cmake,
+  ninja,
+  qt6,
+  extra-cmake-modules,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "one-click-backup";
+  version = "1.2.2.1";
+
+  src = fetchFromGitLab {
+    owner = "dev-nis";
+    repo = "nis-one-click-backup-qt";
+    rev = finalAttrs.version;
+    hash = "sha256-F+gA+Z4gZoNJYdy28uIjqiJcwcNsyUzl6BXsiIZO0gE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    ninja
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtdeclarative
+  ];
+
+  meta = with lib; {
+    description = "Simple Program to backup folders to an external location by copying them";
+    homepage = "https://gitlab.com/dev-nis/nis-one-click-backup-qt";
+    changelog = "https://gitlab.com/dev-nis/nis-one-click-backup-qt/-/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ NIS ];
+    mainProgram = "NIS_One-Click-Backup_Qt";
+    platforms = platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
--- a/pkgs/by-name/on/oneDNN/package.nix
+++ b/pkgs/by-name/on/oneDNN/package.nix
@@ -0,0 +1,53 @@
+{
+  cmake,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  llvmPackages,
+}:
+
+# This was originally called mkl-dnn, then it was renamed to dnnl, and it has
+# just recently been renamed again to oneDNN. See here for details:
+# https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
+stdenv.mkDerivation (finalAttrs: {
+  pname = "oneDNN";
+  version = "3.9.1";
+
+  src = fetchFromGitHub {
+    owner = "oneapi-src";
+    repo = "oneDNN";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-DbLW22LgG8wrBNMsxoUGlacHLcfIBwqyiv+HOmFDtxc=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
+
+  # Tests fail on some Hydra builders, because they do not support SSE4.2.
+  doCheck = false;
+
+  # Fixup bad cmake paths
+  postInstall = ''
+    substituteInPlace $out/lib/cmake/dnnl/dnnl-config.cmake \
+      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
+
+    substituteInPlace $out/lib/cmake/dnnl/dnnl-targets.cmake \
+      --replace "\''${_IMPORT_PREFIX}/" ""
+  '';
+
+  meta = {
+    changelog = "https://github.com/oneapi-src/oneDNN/releases/tag/v${finalAttrs.version}";
+    description = "oneAPI Deep Neural Network Library (oneDNN)";
+    homepage = "https://01.org/oneDNN";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bhipple ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/on/one_gadget/Gemfile
+++ b/pkgs/by-name/on/one_gadget/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'one_gadget'
--- a/pkgs/by-name/on/one_gadget/Gemfile.lock
+++ b/pkgs/by-name/on/one_gadget/Gemfile.lock
@@ -0,0 +1,17 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bindata (2.5.0)
+    elftools (1.1.3)
+      bindata (~> 2)
+    one_gadget (1.9.0)
+      elftools (>= 1.0.2, < 1.2.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  one_gadget
+
+BUNDLED WITH
+   2.5.7
--- a/pkgs/by-name/on/one_gadget/gemset.nix
+++ b/pkgs/by-name/on/one_gadget/gemset.nix
@@ -0,0 +1,34 @@
+{
+  bindata = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08r67nglsqnxrbn803szf5bdnqhchhq8kf2by94f37fcl65wpp19";
+      type = "gem";
+    };
+    version = "2.5.0";
+  };
+  elftools = {
+    dependencies = [ "bindata" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p96wj4sz3sfv9yxyl8z530554bkbf82vj24w6x7yf91qa1p8z6i";
+      type = "gem";
+    };
+    version = "1.1.3";
+  };
+  one_gadget = {
+    dependencies = [ "elftools" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1j9478h929jm5hq2fs3v8y37a7y2hhpli90mbps7yvka4ykci7mw";
+      type = "gem";
+    };
+    version = "1.9.0";
+  };
+}
--- a/pkgs/by-name/on/one_gadget/package.nix
+++ b/pkgs/by-name/on/one_gadget/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  binutils,
+  bundlerApp,
+  bundlerUpdateScript,
+  makeWrapper,
+}:
+
+bundlerApp {
+  pname = "one_gadget";
+  gemdir = ./.;
+  exes = [ "one_gadget" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/one_gadget --prefix PATH : ${binutils}/bin
+  '';
+
+  passthru.updateScript = bundlerUpdateScript "one_gadget";
+
+  meta = with lib; {
+    description = "Best tool for finding one gadget RCE in libc.so.6";
+    homepage = "https://github.com/david942j/one_gadget";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      artemist
+      nicknovitski
+    ];
+    mainProgram = "one_gadget";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/on/oneanime/package.nix
+++ b/pkgs/by-name/on/oneanime/package.nix
@@ -0,0 +1,194 @@
+{
+  lib,
+  fetchFromGitHub,
+  flutter329,
+  autoPatchelfHook,
+  makeDesktopItem,
+  copyDesktopItems,
+  alsa-lib,
+  libepoxy,
+  libpulseaudio,
+  libdrm,
+  libgbm,
+  buildGoModule,
+  stdenv,
+  mpv-unwrapped,
+  mpv,
+  mimalloc,
+  runCommand,
+  yq,
+  oneanime,
+  _experimental-update-script-combinators,
+  gitUpdater,
+}:
+
+let
+  libopencc = buildGoModule rec {
+    pname = "libopencc";
+    version = "1.0.0";
+
+    src = fetchFromGitHub {
+      owner = "Predidit";
+      repo = "open_chinese_convert_bridge";
+      tag = version;
+      hash = "sha256-kC5+rIBOcwn9POvQlKEzuYKKcbhuqVs+pFd4JSFgINQ=";
+    };
+
+    vendorHash = "sha256-ADODygC9VRCdeuxnkK4396yBny/ClRUdG3zAujPzpOM=";
+
+    buildPhase = ''
+      runHook preBuild
+
+      go build -buildmode=c-shared -o ./libopencc.so
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm0755 ./libopencc.so $out/lib/libopencc.so
+
+      runHook postInstall
+    '';
+
+    meta = {
+      homepage = "https://github.com/Predidit/open_chinese_convert_bridge";
+      license = with lib.licenses; [ gpl3Plus ];
+    };
+  };
+in
+flutter329.buildFlutterApplication rec {
+  pname = "oneanime";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "Predidit";
+    repo = "oneAnime";
+    tag = version;
+    hash = "sha256-VZdqbdKxzfGlS27WUSvSR2x7wU8uYMkWRU9QvxW22uQ=";
+  };
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  gitHashes =
+    let
+      media_kit-hash = "sha256-NTnEmU873mzB9YuD6hhRXKfF1WWGPjqvmvAH5ULayxI=";
+    in
+    {
+      flutter_open_chinese_convert = "sha256-uRPBBB5RUd8fiFaM8dg9Th2tvQYwnbsQrsiDSPMm5kk=";
+      media_kit = media_kit-hash;
+      media_kit_libs_android_video = media_kit-hash;
+      media_kit_libs_ios_video = media_kit-hash;
+      media_kit_libs_linux = media_kit-hash;
+      media_kit_libs_macos_video = media_kit-hash;
+      media_kit_libs_video = media_kit-hash;
+      media_kit_libs_windows_video = media_kit-hash;
+      media_kit_video = media_kit-hash;
+    };
+
+  customSourceBuilders = {
+    # unofficial media_kit_libs_linux
+    media_kit_libs_linux =
+      { version, src, ... }:
+      stdenv.mkDerivation rec {
+        pname = "media_kit_libs_linux";
+        inherit version src;
+        inherit (src) passthru;
+
+        postPatch = ''
+          sed -i '/set(MIMALLOC "mimalloc-/,/add_custom_target/d' libs/linux/media_kit_libs_linux/linux/CMakeLists.txt
+          sed -i '/set(PLUGIN_NAME "media_kit_libs_linux_plugin")/i add_custom_target("MIMALLOC_TARGET" ALL DEPENDS ${mimalloc}/lib/mimalloc.o)' libs/linux/media_kit_libs_linux/linux/CMakeLists.txt
+        '';
+
+        installPhase = ''
+          runHook preInstall
+
+          cp -r . $out
+
+          runHook postInstall
+        '';
+      };
+    # unofficial media_kit_video
+    media_kit_video =
+      { version, src, ... }:
+      stdenv.mkDerivation rec {
+        pname = "media_kit_video";
+        inherit version src;
+        inherit (src) passthru;
+
+        postPatch = ''
+          sed -i '/set(LIBMPV_ZIP_URL/,/if(MEDIA_KIT_LIBS_AVAILABLE)/{//!d; /set(LIBMPV_ZIP_URL/d}' media_kit_video/linux/CMakeLists.txt
+          sed -i '/if(MEDIA_KIT_LIBS_AVAILABLE)/i set(LIBMPV_HEADER_UNZIP_DIR "${mpv-unwrapped.dev}/include/mpv")' media_kit_video/linux/CMakeLists.txt
+          sed -i '/if(MEDIA_KIT_LIBS_AVAILABLE)/i set(LIBMPV_PATH "${mpv}/lib")' media_kit_video/linux/CMakeLists.txt
+          sed -i '/if(MEDIA_KIT_LIBS_AVAILABLE)/i set(LIBMPV_UNZIP_DIR "${mpv}/lib")' media_kit_video/linux/CMakeLists.txt
+        '';
+
+        installPhase = ''
+          runHook preInstall
+
+          cp -r . $out
+
+          runHook postInstall
+        '';
+      };
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "oneanime";
+      exec = "oneanime";
+      icon = "oneanime";
+      desktopName = "oneAnime";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    alsa-lib
+    libepoxy
+    libpulseaudio
+    libdrm
+    libgbm
+    mpv
+  ];
+
+  postPatch = ''
+    substituteInPlace lib/pages/init_page.dart \
+      --replace-fail "lib/opencc.so" "${libopencc}/lib/libopencc.so"
+  '';
+
+  postInstall = ''
+    ln -snf ${mpv}/lib/libmpv.so.2 $out/app/oneanime/lib/libmpv.so.2
+    install -Dm0644 assets/images/logo/logo_android_2.png  $out/share/pixmaps/oneanime.png
+  '';
+
+  passthru = {
+    pubspecSource =
+      runCommand "pubspec.lock.json"
+        {
+          nativeBuildInputs = [ yq ];
+          inherit (oneanime) src;
+        }
+        ''
+          cat $src/pubspec.lock | yq > $out
+        '';
+    updateScript = _experimental-update-script-combinators.sequence [
+      (gitUpdater { })
+      (_experimental-update-script-combinators.copyAttrOutputToFile "oneanime.pubspecSource" ./pubspec.lock.json)
+    ];
+  };
+
+  meta = {
+    description = "Anime1 third-party client with bullet screen";
+    homepage = "https://github.com/Predidit/oneAnime";
+    mainProgram = "oneanime";
+    license = with lib.licenses; [ gpl3Plus ];
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/on/oneanime/pubspec.lock.json
+++ b/pkgs/by-name/on/oneanime/pubspec.lock.json
--- a/pkgs/by-name/on/onedrive/package.nix
+++ b/pkgs/by-name/on/onedrive/package.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # native
+  autoreconfHook,
+  installShellFiles,
+  ldc,
+  pkg-config,
+
+  # host
+  coreutils,
+  curl,
+  dbus,
+  libnotify,
+  sqlite,
+  systemd,
+  testers,
+
+  # Boolean flags
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "onedrive";
+  version = "2.5.6";
+
+  src = fetchFromGitHub {
+    owner = "abraunegg";
+    repo = "onedrive";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AFaz1RkrtsdTZfaWobdcADbzsAhbdCzJPkQX6Pa7hN8=";
+  };
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    installShellFiles
+    ldc
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    dbus
+    libnotify
+    sqlite
+  ]
+  ++ lib.optionals withSystemd [ systemd ];
+
+  configureFlags = [
+    (lib.enableFeature true "notifications")
+    (lib.withFeatureAs withSystemd "systemdsystemunitdir" "${placeholder "out"}/lib/systemd/system")
+    (lib.withFeatureAs withSystemd "systemduserunitdir" "${placeholder "out"}/lib/systemd/user")
+  ];
+
+  # we could also pass --enable-completions to configure but we would then have to
+  # figure out the paths manually and pass those along.
+  postInstall = ''
+    installShellCompletion --cmd onedrive \
+      --bash contrib/completions/complete.bash \
+      --fish contrib/completions/complete.fish \
+      --zsh contrib/completions/complete.zsh
+
+    for s in $out/lib/systemd/user/onedrive.service $out/lib/systemd/system/onedrive@.service; do
+      substituteInPlace $s \
+        --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
+    done
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/abraunegg/onedrive";
+    description = "Complete tool to interact with OneDrive on Linux";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "onedrive";
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      bertof
+      guylamar2006
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/on/onedrivegui/package.nix
+++ b/pkgs/by-name/on/onedrivegui/package.nix
@@ -0,0 +1,115 @@
+{
+  lib,
+  python3Packages,
+  qt6,
+  fetchFromGitHub,
+  writeText,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeWrapper,
+  onedrive,
+
+  nix-update-script,
+}:
+
+let
+  version = "1.2.2";
+
+  setupPy = writeText "setup.py" ''
+    from setuptools import setup
+    setup(
+      name='onedrivegui',
+      version='${version}',
+      scripts=[
+        'src/OneDriveGUI.py',
+      ],
+    )
+  '';
+
+in
+python3Packages.buildPythonApplication rec {
+  pname = "onedrivegui";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bpozdena";
+    repo = "OneDriveGUI";
+    tag = "v${version}";
+    hash = "sha256-B563G4MfP0mjOyy9O3Iw5KSNB3PtRU7YViOT7trxTtg=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    qt6.wrapQtAppsHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+  ];
+
+  dependencies = with python3Packages; [
+    pyside6
+    requests
+  ];
+
+  # wrap manually to avoid having a bash script in $out/bin with a .py extension
+  dontWrapPythonPrograms = true;
+  dontWrapQtApps = true;
+
+  doCheck = false; # No tests defined
+  # pythonImportsCheck = [ "OneDriveGUI" ]; # requires a display
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "OneDriveGUI";
+      exec = "onedrivegui";
+      desktopName = "OneDriveGUI";
+      comment = "OneDrive GUI Client";
+      type = "Application";
+      icon = "OneDriveGUI";
+      terminal = false;
+      categories = [ "Utility" ];
+    })
+  ];
+
+  postPatch = ''
+    # Patch global_config.py so DIR_PATH points to shared files location
+    sed -i src/global_config.py -e "s@^DIR_PATH =.*@DIR_PATH = '$out/share/OneDriveGUI'@"
+    cp ${setupPy} ${setupPy.name}
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/OneDriveGUI
+    # we do not need the `ui` directory - only resources
+    cp -r src/resources $out/share/OneDriveGUI
+    install -Dm444 -t $/out/share/icons/hicolor/48x48/apps src/resources/images/OneDriveGUI.png
+    # we put our own executable wrapper in place instead
+    rm -r $out/bin/*
+
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/onedrivegui \
+      ''${qtWrapperArgs[@]} \
+      --prefix PATH : ${lib.makeBinPath [ onedrive ]} \
+      --prefix PYTHONPATH : ${
+        python3Packages.makePythonPath (dependencies ++ [ (placeholder "out") ])
+      } \
+      --add-flags $out/${python3Packages.python.sitePackages}/OneDriveGUI.py
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/bpozdena/OneDriveGUI";
+    description = "Simple GUI for Linux OneDrive Client, with multi-account support";
+    mainProgram = "onedrivegui";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ philipdb ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/on/onedriver/package.nix
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -0,0 +1,82 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  webkitgtk_4_1,
+  glib,
+  fuse,
+  installShellFiles,
+  wrapGAppsHook3,
+  glib-networking,
+  wrapperDir ? "/run/wrappers/bin",
+}:
+let
+  pname = "onedriver";
+  version = "0.14.1";
+
+  src = fetchFromGitHub {
+    owner = "jstaf";
+    repo = "onedriver";
+    rev = "v${version}";
+    hash = "sha256-mA5otgqXQAw2UYUOJaC1zyJuzEu2OS/pxmjJnWsVdxs=";
+  };
+in
+buildGoModule {
+  inherit pname version src;
+  vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+    wrapGAppsHook3
+  ];
+  buildInputs = [
+    webkitgtk_4_1
+    glib
+    fuse
+    glib-networking
+  ];
+
+  ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
+
+  subPackages = [
+    "cmd/onedriver"
+    "cmd/onedriver-launcher"
+  ];
+
+  postInstall = ''
+    echo "Running postInstall"
+    install -Dm644 ./pkg/resources/onedriver.svg $out/share/icons/onedriver/onedriver.svg
+    install -Dm644 ./pkg/resources/onedriver.png $out/share/icons/onedriver/onedriver.png
+    install -Dm644 ./pkg/resources/onedriver-128.png $out/share/icons/onedriver/onedriver-128.png
+
+    install -Dm644 ./pkg/resources/onedriver.desktop $out/share/applications/onedriver.desktop
+    install -Dm644 ./pkg/resources/onedriver@.service $out/lib/systemd/user/onedriver@.service
+
+    mkdir -p $out/share/man/man1
+    installManPage ./pkg/resources/onedriver.1
+
+    substituteInPlace $out/share/applications/onedriver.desktop \
+      --replace "/usr/bin/onedriver-launcher" "$out/bin/onedriver-launcher" \
+      --replace "/usr/share/icons" "$out/share/icons"
+
+    substituteInPlace $out/lib/systemd/user/onedriver@.service \
+      --replace "/usr/bin/onedriver" "$out/bin/onedriver" \
+      --replace "/usr/bin/fusermount" "${wrapperDir}/fusermount"
+  '';
+
+  meta = with lib; {
+    description = "Network filesystem for Linux";
+    longDescription = ''
+      onedriver is a network filesystem that gives your computer direct access to your files on Microsoft OneDrive.
+      This is not a sync client. Instead of syncing files, onedriver performs an on-demand download of files when
+      your computer attempts to use them. onedriver allows you to use files on OneDrive as if they were files on
+      your local computer.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.massimogengarelli ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/on/onefetch/package.nix
+++ b/pkgs/by-name/on/onefetch/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  cmake,
+  installShellFiles,
+  pkg-config,
+  zstd,
+  stdenv,
+  darwin,
+  gitMinimal,
+}:
+
+let
+  inherit (darwin) libresolv;
+in
+rustPlatform.buildRustPackage rec {
+  pname = "onefetch";
+  version = "2.25.0";
+
+  src = fetchFromGitHub {
+    owner = "o2sh";
+    repo = "onefetch";
+    rev = version;
+    hash = "sha256-ZaaSuHWkhJx0q1CBAiRhwoLeeyyoAj6/vP3AJwybjAo=";
+  };
+
+  cargoHash = "sha256-56Net4nNRndePhdsQPbmqiPHpOUGMmnQt6BuplQpvSU=";
+
+  cargoPatches = [
+    # enable pkg-config feature of zstd
+    ./zstd-pkg-config.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    zstd
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    libresolv
+  ];
+
+  nativeCheckInputs = [
+    gitMinimal
+  ];
+
+  preCheck = ''
+    git init
+    git config user.name nixbld
+    git config user.email nixbld@example.com
+    git add .
+    git commit -m test
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd onefetch \
+      --bash <($out/bin/onefetch --generate bash) \
+      --fish <($out/bin/onefetch --generate fish) \
+      --zsh <($out/bin/onefetch --generate zsh)
+  '';
+
+  meta = {
+    description = "Git repository summary on your terminal";
+    homepage = "https://github.com/o2sh/onefetch";
+    changelog = "https://github.com/o2sh/onefetch/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      Br1ght0ne
+      figsoda
+      kloenk
+    ];
+    mainProgram = "onefetch";
+  };
+}
--- a/pkgs/by-name/on/onefetch/zstd-pkg-config.patch
+++ b/pkgs/by-name/on/onefetch/zstd-pkg-config.patch
@@ -0,0 +1,24 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 839cdbc..9622d04 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -2819,6 +2819,7 @@ dependencies = [
+  "tokei",
+  "typetag",
+  "winres",
+ "zstd",
+ ]
+ 
+ [[package]]
+diff --git a/Cargo.toml b/Cargo.toml
+index 79cbb8c..410a969 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -68,6 +68,7 @@ time = { version = "0.3.37", features = ["formatting"] }
+ time-humanize = { version = "0.1.3", features = ["time"] }
+ tokei = "13.0.0-alpha.7"
+ typetag = "0.2"
+zstd = { version = "*", features = ["pkg-config"] }
+ 
+ [dev-dependencies]
+ criterion = "0.5.1"
--- a/pkgs/by-name/on/oneko/package.nix
+++ b/pkgs/by-name/on/oneko/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  imake,
+  gccmakedep,
+  libX11,
+  libXext,
+}:
+
+stdenv.mkDerivation rec {
+  version_name = "1.2.hanami.6";
+  version = "1.2.6";
+  pname = "oneko";
+  src = fetchFromGitHub {
+    owner = "IreneKnapp";
+    repo = "oneko";
+    rev = version_name;
+    sha256 = "0vx12v5fm8ar3f1g6jbpmd3b1q652d32nc67ahkf28djbqjgcbnc";
+  };
+  nativeBuildInputs = [
+    imake
+    gccmakedep
+  ];
+  buildInputs = [
+    libX11
+    libXext
+  ];
+
+  makeFlags = [
+    "BINDIR=$(out)/bin"
+    "MANPATH=$(out)/share/man"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-implicit-function-declaration"
+    "-Wno-endif-labels"
+    "-Wno-implicit-int"
+  ];
+
+  installTargets = [
+    "install"
+    "install.man"
+  ];
+
+  meta = with lib; {
+    description = "Creates a cute cat chasing around your mouse cursor";
+    longDescription = ''
+      Oneko changes your mouse cursor into a mouse
+      and creates a little cute cat, which starts
+      chasing around your mouse cursor.
+      When the cat is done catching the mouse, it starts sleeping.
+    '';
+    homepage = "https://github.com/IreneKnapp/oneko";
+    license = with licenses; [ publicDomain ];
+    maintainers = with maintainers; [
+      xaverdh
+      irenes
+    ];
+    platforms = platforms.unix;
+    mainProgram = "oneko";
+  };
+}
--- a/pkgs/by-name/on/oneshot/package.nix
+++ b/pkgs/by-name/on/oneshot/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  testers,
+  oneshot,
+}:
+
+buildGoModule rec {
+  pname = "oneshot";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "forestnode-io";
+    repo = "oneshot";
+    rev = "v${version}";
+    hash = "sha256-eEVjdFHZyk2bSVqrMJIsgZvvLoDOira8zTzX9oDNtHM=";
+  };
+
+  vendorHash = "sha256-TktSQMIHYXF9eyY6jyfE31WLXEq7VZU3qnVIMGjMMcA=";
+
+  subPackages = [ "cmd" ];
+
+  env.GOWORK = "off";
+
+  modRoot = "v2";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-extldflags=-static"
+    "-X github.com/forestnode-io/oneshot/v2/pkg/version.Version=${version}"
+    "-X github.com/forestnode-io/oneshot/v2/pkg/version.APIVersion=v1.0.0"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 555 -T $GOPATH/bin/cmd $out/bin/oneshot
+
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = oneshot;
+    command = "oneshot version";
+  };
+
+  meta = with lib; {
+    description = "First-come first-served single-fire HTTP server";
+    homepage = "https://www.oneshot.uno/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ milibopp ];
+    mainProgram = "oneshot";
+  };
+}
--- a/pkgs/by-name/on/onesixtyone/package.nix
+++ b/pkgs/by-name/on/onesixtyone/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "onesixtyone";
+  version = "unstable-2019-12-26";
+
+  src = fetchFromGitHub {
+    owner = "trailofbits";
+    repo = "onesixtyone";
+    rev = "9ce1dcdad73d45c8694086a4f90d7713be1cbdd7";
+    sha256 = "111nxn4pcbx6p9j8cjjxv1j1s7dgf7f4dix8acsmahwbpzinzkg3";
+  };
+
+  buildPhase = ''
+    $CC -o onesixtyone onesixtyone.c
+  '';
+
+  installPhase = ''
+    install -D onesixtyone $out/bin/onesixtyone
+  '';
+
+  meta = with lib; {
+    description = "Fast SNMP Scanner";
+    homepage = "https://github.com/trailofbits/onesixtyone";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.fishi0x01 ];
+    mainProgram = "onesixtyone";
+  };
+}
--- a/pkgs/by-name/on/onestepback/package.nix
+++ b/pkgs/by-name/on/onestepback/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  unzip,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "onestepback";
+  version = "0.997";
+
+  srcs = [
+    (fetchurl {
+      url = "http://www.vide.memoire.free.fr/pages/onestepback/OneStepBack-v${version}.zip";
+      hash = "sha256-uB6pfnTkMKeP71rAvn1olJJeCL84222UT5uxG72sywE=";
+    })
+    (fetchurl {
+      url = "http://www.vide.memoire.free.fr/pages/onestepback/OneStepBack-wm2-v${version}.zip";
+      hash = "sha256-Zdv4ZrQPficbCxPBKF3RFNavlSn/VV/efiZVUT86zRc=";
+    })
+  ];
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p  $out/share/themes
+    cp -a OneStepBack* $out/share/themes/
+    rm $out/share/themes/*/{LICENSE,README*}
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Gtk theme inspired by the NextStep look";
+    homepage = "http://www.vide.memoire.free.fr/pages/onestepback";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
--- a/pkgs/by-name/on/onetbb/fix-32-bit-powerpc-build.patch
+++ b/pkgs/by-name/on/onetbb/fix-32-bit-powerpc-build.patch
@@ -0,0 +1,38 @@
+From c828ae47b8f4bea7736d2f9d05460e2b529c9d7d Mon Sep 17 00:00:00 2001
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Date: Fri, 9 Dec 2022 12:36:11 +0100
+Subject: [PATCH] Add cmake check for libatomic requirement when building with
+ gcc (#980)
+
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+---
+ cmake/compilers/GNU.cmake | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/cmake/compilers/GNU.cmake b/cmake/compilers/GNU.cmake
+index cd76acfe1e..59f4e6934f 100644
+--- a/cmake/compilers/GNU.cmake
+++ b/cmake/compilers/GNU.cmake
+@@ -44,6 +44,22 @@ if (NOT MINGW)
+     set(TBB_COMMON_LINK_LIBS dl)
+ endif()
+ 
+# Check whether code with full atomics can be built without libatomic
+# see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81358
+include(CheckCXXSourceCompiles)
+check_cxx_source_compiles("#include <atomic>
+int main() {
+  std::atomic<uint8_t> w1;
+  std::atomic<uint16_t> w2;
+  std::atomic<uint32_t> w4;
+  std::atomic<uint64_t> w8;
+  return ++w1 + ++w2 + ++w4 + ++w8;
+}" TBB_BUILDS_WITHOUT_LIBATOMIC)
+
+if(NOT TBB_BUILDS_WITHOUT_LIBATOMIC)
+   set(TBB_COMMON_LINK_LIBS ${TBB_COMMON_LINK_LIBS} atomic)
+endif()
+
+ # Ignore -Werror set through add_compile_options() or added to CMAKE_CXX_FLAGS if TBB_STRICT is disabled.
+ if (NOT TBB_STRICT AND COMMAND tbb_remove_compile_flag)
+     tbb_remove_compile_flag(-Werror)
--- a/pkgs/by-name/on/onetbb/fix-libtbbmalloc-dlopen.patch
+++ b/pkgs/by-name/on/onetbb/fix-libtbbmalloc-dlopen.patch
@@ -0,0 +1,69 @@
+From 791d42ddacad829d19a4f66b77dc9ca410008db9 Mon Sep 17 00:00:00 2001
+From: Emily <hello@emily.moe>
+Date: Sat, 13 Sep 2025 03:16:16 +0100
+Subject: [PATCH] Use `dladdr` to keep `libtbbmalloc` loaded on POSIX
+
+This fixes issues that arise when `libtbbmalloc` cannot be loaded by
+relative path, makes the behaviour consistent with the Windows code
+path, and eliminates the duplication of `MALLOCLIB_NAME`.
+---
+ src/tbbmalloc/tbbmalloc.cpp | 34 +++++++++-------------------------
+ 1 file changed, 9 insertions(+), 25 deletions(-)
+
+diff --git a/src/tbbmalloc/tbbmalloc.cpp b/src/tbbmalloc/tbbmalloc.cpp
+index b72e03a74f..12d62445aa 100644
+--- a/src/tbbmalloc/tbbmalloc.cpp
+++ b/src/tbbmalloc/tbbmalloc.cpp
+@@ -1,5 +1,5 @@
+ /*
+-    Copyright (c) 2005-2023 Intel Corporation
+    Copyright (c) 2005-2025 Intel Corporation
+ 
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+@@ -32,25 +32,6 @@
+ namespace rml {
+ namespace internal {
+ 
+-#if TBB_USE_DEBUG
+-#define DEBUG_SUFFIX "_debug"
+-#else
+-#define DEBUG_SUFFIX
+-#endif /* TBB_USE_DEBUG */
+-
+-// MALLOCLIB_NAME is the name of the oneTBB memory allocator library.
+-#if _WIN32||_WIN64
+-#define MALLOCLIB_NAME "tbbmalloc" DEBUG_SUFFIX ".dll"
+-#elif __APPLE__
+-#define MALLOCLIB_NAME "libtbbmalloc" DEBUG_SUFFIX ".2.dylib"
+-#elif __FreeBSD__ || __NetBSD__ || __OpenBSD__ || __sun || _AIX || __ANDROID__
+-#define MALLOCLIB_NAME "libtbbmalloc" DEBUG_SUFFIX ".so"
+-#elif __unix__
+-#define MALLOCLIB_NAME "libtbbmalloc" DEBUG_SUFFIX  __TBB_STRING(.so.2)
+-#else
+-#error Unknown OS
+-#endif
+-
+ void init_tbbmalloc() {
+ #if __TBB_USE_ITT_NOTIFY
+     MallocInitializeITT();
+@@ -92,11 +73,14 @@ struct RegisterProcessShutdownNotification {
+     RegisterProcessShutdownNotification() {
+         // prevents unloading, POSIX case
+ 
+-        // We need better support for the library pinning
+-        // when dlopen can't find TBBmalloc library.
+-        // for example: void *ret = dlopen(MALLOCLIB_NAME, RTLD_NOW);
+-        // MALLOC_ASSERT(ret, "Allocator can't load itself.");
+-        dlopen(MALLOCLIB_NAME, RTLD_NOW);
+        Dl_info dlinfo;
+        int ret = dladdr((void*)&init_tbbmalloc, &dlinfo);
+        MALLOC_ASSERT(ret && dlinfo.dli_fname, "Allocator can't find itself.");
+        tbb::detail::suppress_unused_warning(ret);
+
+        void* lib = dlopen(dlinfo.dli_fname, RTLD_NOW);
+        MALLOC_ASSERT(lib, "Allocator can't load itself.");
+        tbb::detail::suppress_unused_warning(lib);
+     }
+ 
+     RegisterProcessShutdownNotification(RegisterProcessShutdownNotification&) = delete;
--- a/pkgs/by-name/on/onetbb/fix-musl-build.patch
+++ b/pkgs/by-name/on/onetbb/fix-musl-build.patch
@@ -0,0 +1,24 @@
+From 493774eb57f9c424fc8907d137665e687861ad94 Mon Sep 17 00:00:00 2001
+From: Ismael Luceno <ismael@iodev.co.uk>
+Date: Fri, 9 Sep 2022 16:18:18 +0200
+Subject: [PATCH] Fix build against musl libc
+
+Probably MALLOC_UNIXLIKE_OVERLOAD_ENABLED only works with glibc, so use
+__GLIBC__ in addition to __linux__ to define it.
+---
+ src/tbbmalloc_proxy/proxy.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tbbmalloc_proxy/proxy.h b/src/tbbmalloc_proxy/proxy.h
+index 5f0133f9e0..ba1a07c396 100644
+--- a/src/tbbmalloc_proxy/proxy.h
+++ b/src/tbbmalloc_proxy/proxy.h
+@@ -17,7 +17,7 @@
+ #ifndef _TBB_malloc_proxy_H_
+ #define _TBB_malloc_proxy_H_
+ 
+-#define MALLOC_UNIXLIKE_OVERLOAD_ENABLED __linux__
+#define MALLOC_UNIXLIKE_OVERLOAD_ENABLED (__linux__ && __GLIBC__)
+ #define MALLOC_ZONE_OVERLOAD_ENABLED __APPLE__
+ 
+ // MALLOC_UNIXLIKE_OVERLOAD_ENABLED depends on MALLOC_CHECK_RECURSION stuff
--- a/pkgs/by-name/on/onetbb/package.nix
+++ b/pkgs/by-name/on/onetbb/package.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  ninja,
+  ctestCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "onetbb";
+  version = "2022.2.0";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "oneapi-src";
+    repo = "oneTBB";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ASQPAGm5e4q7imvTVWlmj5ON4fGEao1L5m2C5wF7EhI=";
+  };
+
+  patches = [
+    # <https://github.com/uxlfoundation/oneTBB/pull/899>
+    ./fix-musl-build.patch
+
+    # <https://github.com/uxlfoundation/oneTBB/pull/987>
+    ./fix-32-bit-powerpc-build.patch
+
+    # Fix an assumption that `libtbbmalloc` can pass a relative path to
+    # `dlopen(3)` to find itself. This caused mysterious crashes on
+    # macOS, where we do not use run paths by default.
+    #
+    # <https://github.com/uxlfoundation/oneTBB/pull/1849>
+    ./fix-libtbbmalloc-dlopen.patch
+
+    # Only enable fcf-protection on x86 based processors
+    # <https://github.com/uxlfoundation/oneTBB/pull/1768>
+    # <https://github.com/uxlfoundation/oneTBB/pull/1792>
+    (fetchpatch {
+      url = "https://github.com/uxlfoundation/oneTBB/commit/65d46656f56200a7e89168824c4dbe4943421ff9.patch?full_index=1";
+      hash = "sha256-hhHDuvUsWSqs7AJ5smDYUP1yYZmjV2VISBeKHcFAfG4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/uxlfoundation/oneTBB/commit/e57411968661ab1205322ba1c84fc1cd90a306c6.patch";
+      hash = "sha256-PFixW4lYqA5oy4LSwewvxgJbjVKJceRHnp8mgW9zBF0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    ctestCheckHook
+  ];
+
+  doCheck = true;
+
+  dontUseNinjaCheck = true;
+
+  # The memory leak test fails on static Linux, despite passing on
+  # dynamic Musl.
+  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic) [
+    "test_arena_constraints"
+  ];
+
+  # Disable failing test on musl
+  # test/conformance/conformance_resumable_tasks.cpp:37:24: error: ‘suspend’ is not a member of ‘tbb::v1::task’; did you mean ‘tbb::detail::r1::suspend’?
+  postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
+    substituteInPlace test/CMakeLists.txt \
+      --replace-fail 'tbb_add_test(SUBDIR conformance NAME conformance_resumable_tasks DEPENDENCIES TBB::tbb)' ""
+  '';
+
+  env = {
+    # Fix build with modern gcc
+    # In member function 'void std::__atomic_base<_IntTp>::store(__int_type, std::memory_order) [with _ITp = bool]',
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=stringop-overflow";
+
+    # Fix undefined reference errors with version script under LLVM.
+    NIX_LDFLAGS = lib.optionalString (
+      stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
+    ) "--undefined-version";
+  };
+
+  meta = {
+    description = "oneAPI Threading Building Blocks";
+    homepage = "https://uxlfoundation.github.io/oneTBB/";
+    license = lib.licenses.asl20;
+    longDescription = ''
+      oneAPI Threading Building Blocks (oneTBB) is a runtime-based
+      parallel programming model for C++ code that uses tasks. The
+      template-based runtime library can help you harness the latent
+      performance of multi-core processors.
+    '';
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      silvanshade
+      thoughtpolice
+      tmarkus
+    ];
+  };
+})
--- a/pkgs/by-name/on/onetun/package.nix
+++ b/pkgs/by-name/on/onetun/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "onetun";
+  version = "0.3.10";
+
+  src = fetchFromGitHub {
+    owner = "aramperes";
+    repo = "onetun";
+    rev = "v${version}";
+    sha256 = "sha256-bggBBl2YQUncfOYIDsPgrHPwznCJQOlIOY3bbiZz7Rw=";
+  };
+
+  cargoHash = "sha256-VC7q2ZTdbBmvZ9l70uQz59paFIi8HXp5CPxfQC6cVmk=";
+
+  meta = {
+    description = "Cross-platform, user-space WireGuard port-forwarder that requires no root-access or system network configurations";
+    homepage = "https://github.com/aramperes/onetun";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dit7ya ];
+    mainProgram = "onetun";
+  };
+}
--- a/pkgs/by-name/on/oniguruma/package.nix
+++ b/pkgs/by-name/on/oniguruma/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoreconfHook,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "oniguruma";
+  version = "6.9.10";
+
+  # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
+  src = fetchurl {
+    url = "https://github.com/kkos/oniguruma/releases/download/v${version}/onig-${version}.tar.gz";
+    sha256 = "sha256-Klz8WuJZ5Ol/hraN//wVLNr/6U4gYLdwy4JyONdp/AU=";
+  };
+
+  outputs = [
+    "dev"
+    "lib"
+    "out"
+  ];
+  outputBin = "dev"; # onig-config
+
+  nativeBuildInputs = [ autoreconfHook ];
+  configureFlags = [ "--enable-posix-api=yes" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kkos/oniguruma";
+    description = "Regular expressions library";
+    mainProgram = "onig-config";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ artturin ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/on/onionbalance/package.nix
+++ b/pkgs/by-name/on/onionbalance/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitLab,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "onionbalance";
+  version = "0.2.4";
+
+  pyproject = true;
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    owner = "tpo";
+    repo = "onion-services/onionbalance";
+    tag = version;
+    hash = "sha256-amwKP9LJ7aHPECNUNTluFpgIFSRLxR7eHQxBxW5574I=";
+  };
+  dependencies = with python3Packages; [
+    cryptography
+    pycryptodomex
+    pyyaml
+    setproctitle
+    stem
+  ];
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  meta = {
+    description = "Tool for loadbalancing onion services";
+    homepage = "https://github.com/torproject/onionbalance";
+    changelog = "https://github.com/torproject/onionbalance/blob/${version}/docs/changelog.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.ForgottenBeast ];
+    mainProgram = "onionbalance";
+  };
+}
--- a/pkgs/by-name/on/onioncircuits/package.nix
+++ b/pkgs/by-name/on/onioncircuits/package.nix
@@ -0,0 +1,53 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  gobject-introspection,
+  intltool,
+  python3,
+  wrapGAppsHook3,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "onioncircuits";
+  version = "0.8.2";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.tails.boum.org";
+    owner = "tails";
+    repo = "onioncircuits";
+    rev = version;
+    sha256 = "sha256-hk4pwPTtj4wt58Wn3NbGc5yQt/FJGdcZC9BbNgvaMqY=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    intltool
+    wrapGAppsHook3
+  ];
+
+  build-system = with python3.pkgs; [
+    setuptools
+    distutils-extra
+  ];
+
+  dependencies = with python3.pkgs; [
+    pygobject3
+    stem
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/apparmor.d
+
+    cp apparmor/usr.bin.onioncircuits $out/etc/apparmor.d
+  '';
+
+  meta = with lib; {
+    homepage = "https://tails.boum.org";
+    description = "GTK application to display Tor circuits and streams";
+    mainProgram = "onioncircuits";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ wattmto ];
+  };
+}
--- a/pkgs/by-name/on/onionprobe/package.nix
+++ b/pkgs/by-name/on/onionprobe/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "onionprobe";
+  version = "1.4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-rjExMm1mkoeRiv+aNuC6Ieo0/X5sbsjuSiAHcnQxjFo=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    requests
+    stem
+    prometheus-client
+    pyyaml
+    pysocks
+    cryptography
+  ];
+
+  meta = {
+    description = "Tooling for onion service monitoring";
+    homepage = "https://onionservices.torproject.org/apps/web/onionprobe/";
+    changelog = "https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/blob/${version}/docs/changelog.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.ForgottenBeast ];
+    mainProgram = "onionprobe";
+  };
+}
--- a/pkgs/by-name/on/onionshare-gui/fix-paths-gui.patch
+++ b/pkgs/by-name/on/onionshare-gui/fix-paths-gui.patch
@@ -0,0 +1,61 @@
+--- a/onionshare/gui_common.py
+++ b/onionshare/gui_common.py
+@@ -482,52 +482,12 @@ class GuiCommon:
+         }
+ 
+     def get_tor_paths(self):
+-        if self.common.platform == "Linux":
+-            base_path = self.get_resource_path("tor")
+-            if base_path and os.path.isdir(base_path):
+-                self.common.log(
+-                    "GuiCommon", "get_tor_paths", "using paths in resources"
+-                )
+-                tor_path = os.path.join(base_path, "tor")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-            else:
+-                # Fallback to looking in the path
+-                self.common.log("GuiCommon", "get_tor_paths", "using paths from PATH")
+-                tor_path = shutil.which("tor")
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
+-        if self.common.platform == "Windows":
+-            base_path = self.get_resource_path("tor")
+-            tor_path = os.path.join(base_path, "tor.exe")
+-            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "meek-client.exe")
+-            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-        elif self.common.platform == "Darwin":
+-            base_path = self.get_resource_path("tor")
+-            tor_path = os.path.join(base_path, "tor")
+-            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-            meek_client_file_path = os.path.join(base_path, "meek-client")
+-            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-        elif self.common.platform == "BSD":
+-            tor_path = "/usr/local/bin/tor"
+-            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
+        tor_path = "@tor@/bin/tor"
+        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
+        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
+        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
+        meek_client_file_path = "@meek@/bin/meek-client"
+        snowflake_file_path = "@snowflake@/bin/snowflake-client"
+ 
+         return (
+             tor_path,
--- a/pkgs/by-name/on/onionshare-gui/package.nix
+++ b/pkgs/by-name/on/onionshare-gui/package.nix
@@ -0,0 +1,67 @@
+{
+  python3Packages,
+  onionshare,
+  replaceVars,
+  meek,
+  obfs4,
+  snowflake,
+  tor,
+  qt5,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "onionshare";
+  inherit (onionshare)
+    src
+    version
+    build-system
+    pythonRelaxDeps
+    ;
+  pyproject = true;
+
+  sourceRoot = "${src.name}/desktop";
+
+  patches = [
+    # hardcode store paths of dependencies
+    (replaceVars ./fix-paths-gui.patch {
+      inherit
+        meek
+        obfs4
+        snowflake
+        tor
+        ;
+      inherit (tor) geoip;
+    })
+  ];
+
+  dependencies = with python3Packages; [
+    onionshare
+    pyside6
+    python-gnupg
+    qrcode
+  ];
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+  buildInputs = [ qt5.qtwayland ];
+
+  postInstall = ''
+    mkdir -p $out/share/{appdata,applications,icons}
+    cp $src/desktop/org.onionshare.OnionShare.desktop $out/share/applications
+    cp $src/desktop/org.onionshare.OnionShare.svg $out/share/icons
+    cp $src/desktop/org.onionshare.OnionShare.appdata.xml $out/share/appdata
+  '';
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  doCheck = false;
+
+  pythonImportsCheck = [ "onionshare" ];
+
+  meta = onionshare.meta // {
+    mainProgram = "onionshare";
+  };
+}
--- a/pkgs/by-name/on/onionshare/fix-paths.patch
+++ b/pkgs/by-name/on/onionshare/fix-paths.patch
@@ -0,0 +1,82 @@
+--- a/onionshare_cli/common.py
+++ b/onionshare_cli/common.py
+@@ -318,73 +318,12 @@ class Common:
+         return path
+ 
+     def get_tor_paths(self):
+-        if self.platform == "Linux":
+-            tor_path = shutil.which("tor")
+-            if not tor_path:
+-                raise CannotFindTor()
+-            obfs4proxy_file_path = shutil.which("obfs4proxy")
+-            snowflake_file_path = shutil.which("snowflake-client")
+-            meek_client_file_path = shutil.which("meek-client")
+-            prefix = os.path.dirname(os.path.dirname(tor_path))
+-            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-        elif self.platform == "Windows":
+-            # In Windows, the Tor binaries are in the onionshare package, not the onionshare_cli package
+-            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
+-            tor_path = os.path.join(base_path, "tor.exe")
+-
+-            # If tor.exe isn't there, mayber we're running from the source tree
+-            if not os.path.exists(tor_path):
+-                self.log(
+-                    "Common", "get_tor_paths", f"Cannot find tor.exe at {tor_path}"
+-                )
+-                base_path = os.path.join(os.getcwd(), "onionshare", "resources", "tor")
+-
+-                tor_path = os.path.join(base_path, "tor.exe")
+-                if not os.path.exists(tor_path):
+-                    self.log(
+-                        "Common", "get_tor_paths", f"Cannot find tor.exe at {tor_path}"
+-                    )
+-                    raise CannotFindTor()
+-
+-            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "meek-client.exe")
+-            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-
+-        elif self.platform == "Darwin":
+-            # Let's see if we have tor binaries in the onionshare GUI package
+-            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
+-            tor_path = os.path.join(base_path, "tor")
+-            if os.path.exists(tor_path):
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-            else:
+-                # Fallback to looking in the path
+-                tor_path = shutil.which("tor")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
+-        elif self.platform == "BSD":
+-            tor_path = "/usr/local/bin/tor"
+-            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
+        tor_path = "@tor@/bin/tor"
+        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
+        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
+        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
+        snowflake_file_path = "@snowflake@/bin/snowflake-client"
+        meek_client_file_path = "@meek@/bin/meek-client"
+ 
+         return (
+             tor_path,
--- a/pkgs/by-name/on/onionshare/package.nix
+++ b/pkgs/by-name/on/onionshare/package.nix
@@ -0,0 +1,143 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+
+  # patches
+  replaceVars,
+  meek,
+  obfs4,
+  snowflake,
+  tor,
+
+  versionCheckHook,
+  gitUpdater,
+  onionshare-gui,
+  writableTmpDirAsHomeHook,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "onionshare-cli";
+  version = "2.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "onionshare";
+    repo = "onionshare";
+    tag = "v${version}";
+    hash = "sha256-DY5rSHkmiqLIa49gcbq7VfcMM1AMFTJ5FPQtS2kR2Zs=";
+  };
+
+  sourceRoot = "${src.name}/cli";
+
+  patches = [
+    # hardcode store paths of dependencies
+    (replaceVars ./fix-paths.patch {
+      inherit
+        meek
+        obfs4
+        snowflake
+        tor
+        ;
+      inherit (tor) geoip;
+    })
+  ];
+
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+
+  pythonRelaxDeps = true;
+
+  dependencies =
+    with python3Packages;
+    [
+      cffi
+      click
+      colorama
+      cython
+      eventlet
+      flask
+      flask-compress
+      flask-socketio
+      gevent
+      gevent-websocket
+      packaging
+      psutil
+      pynacl
+      pysocks
+      qrcode
+      requests
+      setuptools
+      stem
+      unidecode
+      urllib3
+      waitress
+      werkzeug
+      wheel
+    ]
+    ++ requests.optional-dependencies.socks;
+
+  buildInputs = [
+    obfs4
+    tor
+  ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ]
+  ++ (with python3Packages; [
+    pytestCheckHook
+  ]);
+
+  disabledTests =
+    lib.optionals stdenv.hostPlatform.isLinux [
+      "test_get_tor_paths_linux" # expects /usr instead of /nix/store
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # requires meek-client which is not packaged
+      "test_get_tor_paths_darwin"
+      # on darwin (and only on darwin) onionshare attempts to discover
+      # user's *real* homedir via /etc/passwd, making it more painful
+      # to fake
+      "test_receive_mode_webhook"
+    ];
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests = {
+      inherit onionshare-gui;
+    };
+  };
+
+  meta = {
+    description = "Securely and anonymously send and receive files";
+    longDescription = ''
+      OnionShare is an open source tool for securely and anonymously sending
+      and receiving files using Tor onion services. It works by starting a web
+      server directly on your computer and making it accessible as an
+      unguessable Tor web address that others can load in Tor Browser to
+      download files from you, or upload files to you. It doesn't require
+      setting up a separate server, using a third party file-sharing service,
+      or even logging into an account.
+
+      Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
+      any other way people typically send files to each other, when you use
+      OnionShare you don't give any companies access to the files that you're
+      sharing. So long as you share the unguessable web address in a secure way
+      (like pasting it in an encrypted messaging app), no one but you and the
+      person you're sharing with can access the files.
+    '';
+    homepage = "https://onionshare.org/";
+    changelog = "https://github.com/onionshare/onionshare/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      bbjubjub
+      dotlambda
+    ];
+    mainProgram = "onionshare-cli";
+  };
+}
--- a/pkgs/by-name/on/oniux/package.nix
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  perl,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "oniux";
+  version = "0.6.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    owner = "tpo/core";
+    repo = "oniux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-icrNKF9cGPBZPbaGCj2c8OtdP6A14whPoP39zhs4wlo=";
+  };
+
+  cargoHash = "sha256-juWtf0aX70xJTx9KpXOATyXARhk7aTaveUFN0OPKrbs=";
+
+  nativeBuildInputs = [
+    perl
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://gitlab.torproject.org/tpo/core/oniux";
+    description = "Isolate Applications over Tor using Linux Namespaces";
+    maintainers = with lib.maintainers; [ tnias ];
+    platforms = lib.platforms.linux;
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    mainProgram = "oniux";
+  };
+})
--- a/pkgs/by-name/on/online-judge-verify-helper/package.nix
+++ b/pkgs/by-name/on/online-judge-verify-helper/package.nix
@@ -0,0 +1,4 @@
+{
+  python3Packages,
+}:
+python3Packages.toPythonApplication python3Packages.online-judge-verify-helper
--- a/pkgs/by-name/on/onlykey-agent/package.nix
+++ b/pkgs/by-name/on/onlykey-agent/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+  onlykey-cli,
+}:
+
+let
+  bech32 =
+    with python3Packages;
+    buildPythonPackage rec {
+      pname = "bech32";
+      version = "1.2.0";
+      format = "setuptools";
+
+      src = fetchPypi {
+        inherit pname version;
+        sha256 = "sha256-fW24IUYDvXhx/PpsCCbvaLhbCr2Q+iHChanF4h0r2Jk=";
+      };
+    };
+
+  # onlykey requires a patched version of libagent
+  lib-agent =
+    with python3Packages;
+    libagent.overridePythonAttrs (oa: rec {
+      version = "1.0.6";
+      src = fetchPypi {
+        inherit version;
+        pname = "lib-agent";
+        sha256 = "sha256-IrJizIHDIPHo4tVduUat7u31zHo3Nt8gcMOyUUqkNu0=";
+      };
+      propagatedBuildInputs = oa.propagatedBuildInputs or [ ] ++ [
+        bech32
+        cryptography
+        cython
+        docutils
+        pycryptodome
+        pynacl
+        wheel
+      ];
+
+      # turn off testing because I can't get it to work
+      doCheck = false;
+      pythonImportsCheck = [ "libagent" ];
+
+      meta = oa.meta // {
+        description = "Using OnlyKey as hardware SSH and GPG agent";
+        homepage = "https://github.com/trustcrypto/onlykey-agent/tree/ledger";
+        maintainers = with lib.maintainers; [ kalbasit ];
+      };
+    });
+in
+python3Packages.buildPythonApplication rec {
+  pname = "onlykey-agent";
+  version = "1.1.15";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-SbGb7CjcD7cFPvASZtip56B4uxRiFKZBvbsf6sb8fds=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    lib-agent
+    onlykey-cli
+    setuptools
+  ];
+
+  # move the python library into the sitePackages.
+  postInstall = ''
+    mkdir $out/${python3Packages.python.sitePackages}/onlykey_agent
+    mv $out/bin/onlykey_agent.py $out/${python3Packages.python.sitePackages}/onlykey_agent/__init__.py
+    chmod a-x $out/${python3Packages.python.sitePackages}/onlykey_agent/__init__.py
+  '';
+
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "onlykey_agent" ];
+
+  meta = with lib; {
+    description = "Middleware that lets you use OnlyKey as a hardware SSH/GPG device";
+    homepage = "https://github.com/trustcrypto/onlykey-agent";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
--- a/pkgs/by-name/on/onlykey-cli/package.nix
+++ b/pkgs/by-name/on/onlykey-cli/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "onlykey-cli";
+  version = "1.2.10";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "onlykey";
+    hash = "sha256-ZmQnyZx9YlIIxMMdZ0U2zb+QANfcwrtG7iR1LpgzmBQ=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  pythonRemoveDeps = [
+    "Cython" # don't know why cython is listed as a runtime dependency, let's just remove it
+  ];
+
+  dependencies = with python3Packages; [
+    aenum
+    ecdsa
+    hidapi
+    onlykey-solo-python
+    prompt-toolkit
+    pynacl
+    six
+  ];
+
+  # Requires having the physical onlykey (a usb security key)
+  doCheck = false;
+  pythonImportsCheck = [ "onlykey.client" ];
+
+  meta = with lib; {
+    description = "OnlyKey client and command-line tool";
+    mainProgram = "onlykey-cli";
+    homepage = "https://github.com/trustcrypto/python-onlykey";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ranfdev ];
+  };
+}
--- a/pkgs/by-name/on/onlykey/package.nix
+++ b/pkgs/by-name/on/onlykey/package.nix
@@ -0,0 +1,77 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  fetchpatch2,
+  lib,
+  makeDesktopItem,
+  nix-update-script,
+  nwjs,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "onlykey";
+  version = "5.5.0";
+
+  src = fetchFromGitHub {
+    owner = "trustcrypto";
+    repo = "OnlyKey-App";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8MSdr+ghCBPeGp63Yi1T+gyEwXOEUW3vqi9CrCmozrw=";
+  };
+
+  patches = [
+    # Provides package-lock.json
+    (fetchpatch2 {
+      url = "https://github.com/trustcrypto/OnlyKey-App/commit/b8918cec80f5feda50c24a0aec3d6fb914ea8481.patch";
+      hash = "sha256-ULMZI7fo5SJGrfCRqZzZVoGOTDQ8q/NG/uXMjNkQ+qk=";
+    })
+  ];
+
+  desktopItem = makeDesktopItem {
+    name = "onlykey";
+    exec = "onlykey";
+    icon = "onlykey";
+    desktopName = "OnlyKey";
+    comment = finalAttrs.meta.description;
+    categories = [
+      "Utility"
+    ];
+    terminal = false;
+  };
+
+  npmDepsHash = "sha256-DpjB95KEHfAc4GBxY40uUjlN7ifBMUncufVTmTXqDo8=";
+
+  # when installing packages, nw tries to download nwjs in its postInstall
+  # script. There are currently no other postInstall scripts, so this
+  # should not break other things.
+  npmFlags = [ "--ignore-scripts" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share"
+    cp -r build "$out/share/onlykey"
+
+    ln -s "${finalAttrs.desktopItem}/share/applications" "$out/share/applications"
+
+    mkdir -p "$out/share/icons/hicolor/128x128/apps"
+    install -D resources/onlykey_logo_128.png "$out/share/icons/hicolor/128x128/apps/onlykey.png"
+
+    makeWrapper ${nwjs}/bin/nw "$out/bin/onlykey" \
+      --add-flags "$out/share/onlykey"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Setup and configure OnlyKey";
+    homepage = "https://github.com/trustcrypto/OnlyKey-App";
+    changelog = "https://github.com/trustcrypto/OnlyKey-App/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "onlykey";
+  };
+})
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
@@ -0,0 +1,197 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  buildFHSEnv,
+  # Alphabetic ordering below
+  alsa-lib,
+  at-spi2-atk,
+  atk,
+  autoPatchelfHook,
+  cairo,
+  curl,
+  dbus,
+  dconf,
+  dpkg,
+  fontconfig,
+  gcc-unwrapped,
+  gdk-pixbuf,
+  glib,
+  glibc,
+  gsettings-desktop-schemas,
+  gst_all_1,
+  gtk2,
+  gtk3,
+  libpulseaudio,
+  libudev0-shim,
+  libdrm,
+  makeWrapper,
+  libgbm,
+  noto-fonts-cjk-sans,
+  nspr,
+  nss,
+  pulseaudio,
+  qt5,
+  wrapGAppsHook3,
+  xkeyboard_config,
+  xorg,
+}:
+let
+
+  # Note on fonts:
+  #
+  # OnlyOffice does not distribute unfree fonts, but makes it easy to pick up
+  # any fonts you install. See:
+  #
+  # * https://helpcenter.onlyoffice.com/en/installation/docs-community-install-fonts-linux.aspx
+  # * https://www.onlyoffice.com/blog/2020/04/how-to-add-new-fonts-to-onlyoffice-desktop-editors/
+  #
+  # As recommended there, you should download
+  #
+  #     arial.ttf, calibri.ttf, cour.ttf, symbol.ttf, times.ttf, wingding.ttf
+  #
+  # into `~/.local/share/fonts/`, otherwise the default template fonts, and
+  # things like bullet points, will not look as expected.
+
+  # TODO: Find out which of these fonts we'd be allowed to distribute along
+  #       with this package, or how to make this easier for users otherwise.
+
+  runtimeLibs = lib.makeLibraryPath [
+    curl
+    glibc
+    gcc-unwrapped.lib
+    libudev0-shim
+    pulseaudio
+  ];
+
+  derivation = stdenv.mkDerivation rec {
+    pname = "onlyoffice-desktopeditors";
+    version = "9.0.0";
+    minor = null;
+    src = fetchurl {
+      url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
+      hash = "sha256-mGjFFuuplGINgjuIEHoO3AO4ppkum1lifj5ukbfWWS8=";
+    };
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+      makeWrapper
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-atk
+      atk
+      cairo
+      dbus
+      dconf
+      fontconfig
+      gdk-pixbuf
+      glib
+      gsettings-desktop-schemas
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+      gtk2
+      gtk3
+      libpulseaudio
+      libdrm
+      nspr
+      nss
+      libgbm
+      qt5.qtbase
+      qt5.qtdeclarative
+      qt5.qtsvg
+      qt5.qtwayland
+      xorg.libX11
+      xorg.libxcb
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXScrnSaver
+      xorg.libXtst
+    ];
+
+    dontWrapQtApps = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib,share}
+
+      mv usr/bin/* $out/bin
+      mv usr/share/* $out/share/
+      mv opt/onlyoffice/desktopeditors $out/share
+
+      for f in $out/share/desktopeditors/asc-de-*.png; do
+        size=$(basename "$f" ".png" | cut -d"-" -f3)
+        res="''${size}x''${size}"
+        mkdir -pv "$out/share/icons/hicolor/$res/apps"
+        ln -s "$f" "$out/share/icons/hicolor/$res/apps/onlyoffice-desktopeditors.png"
+      done;
+
+      substituteInPlace $out/bin/onlyoffice-desktopeditors \
+        --replace-fail "/opt/onlyoffice/" "$out/share/"
+
+      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale" \
+        --set QT_QPA_PLATFORM "xcb"
+        # the bundled version of qt does not support wayland
+      )
+    '';
+  };
+
+in
+
+# In order to download plugins, OnlyOffice uses /usr/bin/curl so we have to wrap it.
+# Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+# Fonts are also discovered by looking in /usr/share/fonts, so adding fonts to targetPkgs will include them
+buildFHSEnv {
+  inherit (derivation) pname version;
+
+  targetPkgs = pkgs': [
+    curl
+    derivation
+    noto-fonts-cjk-sans
+  ];
+
+  runScript = "/bin/onlyoffice-desktopeditors";
+
+  extraInstallCommands = ''
+    mkdir -p $out/share
+    ln -s ${derivation}/share/icons $out/share
+    cp -r ${derivation}/share/applications $out/share
+    substituteInPlace $out/share/applications/onlyoffice-desktopeditors.desktop \
+        --replace-fail "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    homepage = "https://www.onlyoffice.com/";
+    downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
+    changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [
+      nh2
+      gtrunsec
+    ];
+  };
+}
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+version="$(curl -sL "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+update-source-version onlyoffice-bin "$version"
--- a/pkgs/by-name/on/onlyoffice-documentserver/package.nix
+++ b/pkgs/by-name/on/onlyoffice-documentserver/package.nix
@@ -0,0 +1,176 @@
+{
+  lib,
+  stdenv,
+  buildFHSEnv,
+  corefonts,
+  dejavu_fonts,
+  dpkg,
+  fetchurl,
+  gcc-unwrapped,
+  liberation_ttf_v1,
+  writeScript,
+  xorg,
+}:
+
+let
+  # var/www/onlyoffice/documentserver/server/DocService/docservice
+  onlyoffice-documentserver = stdenv.mkDerivation rec {
+    pname = "onlyoffice-documentserver";
+    version = "8.3.3";
+
+    src = fetchurl (
+      {
+        "aarch64-linux" = {
+          url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${version}/onlyoffice-documentserver_arm64.deb";
+          sha256 = "sha256-wF5TdBEpNXeE8SMTmvgjuOp713Vf9gIifsI1yeujuA0=";
+        };
+        "x86_64-linux" = {
+          url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${version}/onlyoffice-documentserver_amd64.deb";
+          sha256 = "sha256-zEI9R5AOkE1gMZHL209l6HOh/yfZgmEvMw8+hb9kC+s=";
+        };
+      }
+      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}")
+    );
+
+    preferLocalBuild = true;
+
+    unpackCmd = "dpkg -x $curSrc source";
+
+    nativeBuildInputs = [
+      dpkg
+    ];
+
+    installPhase = ''
+      # replace dangling symlinks which are not copied into fhs with actually files
+      mkdir lib
+      for file in var/www/onlyoffice/documentserver/server/FileConverter/bin/*.so* ; do
+        ln -rs "$file" lib/$(basename "$file")
+      done
+
+      # NixOS uses systemd, not supervisor
+      rm -rf etc/supervisor
+
+      install -Dm755 usr/bin/documentserver-prepare4shutdown.sh -t $out/bin
+      # maintainer scripts which expect supervisorctl, try to write into the nix store or are handled by nixos modules
+      rm -rf usr/bin
+
+      # .deb default documentation
+      rm -rf usr/share
+
+      # required for bwrap --bind
+      mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/
+
+      # see usr/bin/documentserver-flush-cache.sh
+      cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js{.tpl,}
+      substituteInPlace var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js \
+        --replace-fail '{{HASH_POSTFIX}}' "$(basename $out | cut -d '-' -f 1)"
+
+      mv * $out/
+    '';
+
+    # stripping self extracting javascript binaries likely breaks them
+    dontStrip = true;
+
+    passthru = {
+      fhs = buildFHSEnv {
+        name = "onlyoffice-wrapper";
+
+        targetPkgs = pkgs: [
+          gcc-unwrapped.lib
+          onlyoffice-documentserver
+
+          # fonts
+          corefonts
+          dejavu_fonts
+          liberation_ttf_v1
+        ];
+
+        extraBuildCommands = ''
+          mkdir -p $out/var/{lib/onlyoffice,www}
+          cp -ar ${onlyoffice-documentserver}/var/www/* $out/var/www/
+        '';
+
+        extraBwrapArgs = [
+          "--bind var/lib/onlyoffice/ var/lib/onlyoffice/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/slide/themes/ var/www/onlyoffice/documentserver/sdkjs/slide/themes/"
+          "--bind var/lib/onlyoffice/documentserver/fonts/ var/www/onlyoffice/documentserver/fonts/"
+          "--bind var/lib/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/"
+        ];
+
+        runScript = writeScript "onlyoffice-documentserver-run-script" ''
+          export NODE_CONFIG_DIR=$2
+          export NODE_DISABLE_COLORS=1
+          export NODE_ENV=production-linux
+
+          if [[ $1 == DocService/docservice ]]; then
+            mkdir -p var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            # symlinking themes/src breaks discovery in allfontsgen
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/slide/themes/src
+            cp -r ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/slide/themes/src var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            chmod -R u+w var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+
+            # onlyoffice places generated files in those directores
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/common/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/
+            rm -rf var/www/onlyoffice/documentserver/server/FileConverter/bin/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/
+
+            # https://github.com/ONLYOFFICE/document-server-package/blob/master/common/documentserver/bin/documentserver-generate-allfonts.sh.m4
+            echo -n Generating AllFonts.js, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allfontsgen"\
+              --input="${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/core-fonts"\
+              --allfonts-web="var/www/onlyoffice/documentserver/sdkjs/common/AllFonts.js"\
+              --allfonts="var/www/onlyoffice/documentserver/server/FileConverter/bin/AllFonts.js"\
+              --images="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --selection="var/www/onlyoffice/documentserver/server/FileConverter/bin/font_selection.bin"\
+              --output-web="var/www/onlyoffice/documentserver/fonts"\
+              --use-system="true"
+            echo Done
+
+            echo -n Generating presentation themes, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="ios"\
+              --params="280,224"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="android"\
+              --params="280,224"
+            echo Done
+          fi
+
+          exec var/www/onlyoffice/documentserver/server/$1
+        '';
+      };
+    };
+
+    meta = with lib; {
+      description = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
+      mainProgram = "documentserver-prepare4shutdown.sh";
+      longDescription = ''
+        ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations,
+        fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
+      '';
+      homepage = "https://github.com/ONLYOFFICE/DocumentServer";
+      license = licenses.agpl3Plus;
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      sourceProvenance = [ sourceTypes.binaryNativeCode ];
+      maintainers = with maintainers; [ SuperSandro2000 ];
+    };
+  };
+in
+onlyoffice-documentserver
--- a/pkgs/by-name/on/onmetal-image/package.nix
+++ b/pkgs/by-name/on/onmetal-image/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "onmetal-image";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "onmetal";
+    repo = "onmetal-image";
+    rev = "v${version}";
+    hash = "sha256-KvOBvAIE9V2bj5prdcc8G5ifHsvybHBCYWrI4fWtdvE=";
+  };
+
+  vendorHash = "sha256-aCL8hLcBnIs5BJM7opIwcOLvOS3uL9mYXs1vOAMlX/M=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/onmetal-image
+
+    installShellCompletion --cmd onmetal-image \
+      --bash <($out/bin/onmetal-image completion bash) \
+      --fish <($out/bin/onmetal-image completion fish) \
+      --zsh <($out/bin/onmetal-image completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Onmetal OCI Image Specification, Library and Tooling";
+    homepage = "https://github.com/onmetal/onmetal-image";
+    license = licenses.asl20;
+    maintainers = [ ];
+    mainProgram = "onmetal-image";
+  };
+}
--- a/pkgs/by-name/on/onnxruntime/nvcc-gsl.patch
+++ b/pkgs/by-name/on/onnxruntime/nvcc-gsl.patch
@@ -0,0 +1,20 @@
+diff --git a/cmake/external/onnxruntime_external_deps.cmake b/cmake/external/onnxruntime_external_deps.cmake
+index ebf20ab21b..2aa5d9e908 100644
+--- a/cmake/external/onnxruntime_external_deps.cmake
+++ b/cmake/external/onnxruntime_external_deps.cmake
+@@ -403,15 +403,6 @@ if (CPUINFO_SUPPORTED)
+ endif()
+ 
+ if(onnxruntime_USE_CUDA)
+-  onnxruntime_fetchcontent_declare(
+-    GSL
+-    URL ${DEP_URL_microsoft_gsl}
+-    URL_HASH SHA1=${DEP_SHA1_microsoft_gsl}
+-    PATCH_COMMAND ${Patch_EXECUTABLE} --binary --ignore-whitespace -p1 < ${PROJECT_SOURCE_DIR}/patches/gsl/1064.patch
+-    EXCLUDE_FROM_ALL
+-    FIND_PACKAGE_ARGS 4.0 NAMES Microsoft.GSL
+-  )
+-else()
+   onnxruntime_fetchcontent_declare(
+     GSL
+     URL ${DEP_URL_microsoft_gsl}
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -0,0 +1,301 @@
+{
+  config,
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  abseil-cpp_202407,
+  cmake,
+  cpuinfo,
+  eigen,
+  flatbuffers_23,
+  glibcLocales,
+  gtest,
+  howard-hinnant-date,
+  libpng,
+  nlohmann_json,
+  pkg-config,
+  python3Packages,
+  re2,
+  zlib,
+  protobuf,
+  microsoft-gsl,
+  darwinMinVersionHook,
+  pythonSupport ? true,
+  cudaSupport ? config.cudaSupport,
+  ncclSupport ? config.cudaSupport,
+  withFullProtobuf ? false,
+  cudaPackages ? { },
+}@inputs:
+
+let
+  version = "1.22.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "onnxruntime";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-X8Pdtc0eR0iU+Xi2A1HrNo1xqCnoaxNjj4QFm/E3kSE=";
+  };
+
+  stdenv = throw "Use effectiveStdenv instead";
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else inputs.stdenv;
+
+  cudaArchitecturesString = cudaPackages.flags.cmakeCudaArchitecturesString;
+
+  mp11 = fetchFromGitHub {
+    owner = "boostorg";
+    repo = "mp11";
+    tag = "boost-1.82.0";
+    hash = "sha256-cLPvjkf2Au+B19PJNrUkTW/VPxybi1MpPxnIl4oo4/o=";
+  };
+
+  safeint = fetchFromGitHub {
+    owner = "dcleblanc";
+    repo = "safeint";
+    tag = "3.0.28";
+    hash = "sha256-pjwjrqq6dfiVsXIhbBtbolhiysiFlFTnx5XcX77f+C0=";
+  };
+
+  onnx = fetchFromGitHub {
+    owner = "onnx";
+    repo = "onnx";
+    tag = "v1.17.0";
+    hash = "sha256-9oORW0YlQ6SphqfbjcYb0dTlHc+1gzy9quH/Lj6By8Q=";
+  };
+
+  cutlass = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "cutlass";
+    tag = "v3.5.1";
+    hash = "sha256-sTGYN+bjtEqQ7Ootr/wvx3P9f8MCDSSj3qyCWjfdLEA=";
+  };
+
+  dlpack = fetchFromGitHub {
+    owner = "dmlc";
+    repo = "dlpack";
+    rev = "5c210da409e7f1e51ddf445134a4376fdbd70d7d";
+    hash = "sha256-YqgzCyNywixebpHGx16tUuczmFS5pjCz5WjR89mv9eI=";
+  };
+
+  isCudaJetson = cudaSupport && cudaPackages.flags.isJetsonBuild;
+in
+effectiveStdenv.mkDerivation rec {
+  pname = "onnxruntime";
+  inherit src version;
+
+  patches = [
+    # https://github.com/microsoft/onnxruntime/pull/24583
+    (fetchpatch {
+      name = "fix-compilation-with-gcc-15.patch";
+      url = "https://github.com/microsoft/onnxruntime/commit/f7619dc93f592ddfc10f12f7145f9781299163a0.patch";
+      hash = "sha256-jxfMB+/Zokcu5DSfZP7QV1E8mTrsLe/sMr+ZCX/Y3m0=";
+    })
+  ]
+  ++ lib.optionals cudaSupport [
+    # We apply the referenced 1064.patch ourselves to our nix dependency.
+    #  FIND_PACKAGE_ARGS for CUDA was added in https://github.com/microsoft/onnxruntime/commit/87744e5 so it might be possible to delete this patch after upgrading to 1.17.0
+    ./nvcc-gsl.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3Packages.python
+    protobuf
+  ]
+  ++ lib.optionals pythonSupport (
+    with python3Packages;
+    [
+      pip
+      python
+      pythonOutputDistHook
+      setuptools
+      wheel
+    ]
+  )
+  ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
+    cudaPackages.cudnn-frontend
+  ]
+  ++ lib.optionals isCudaJetson [
+    cudaPackages.autoAddCudaCompatRunpath
+  ];
+
+  buildInputs = [
+    eigen
+    glibcLocales
+    howard-hinnant-date
+    libpng
+    nlohmann_json
+    microsoft-gsl
+    zlib
+  ]
+  ++ lib.optionals (lib.meta.availableOn effectiveStdenv.hostPlatform cpuinfo) [
+    cpuinfo
+  ]
+  ++ lib.optionals pythonSupport (
+    with python3Packages;
+    [
+      numpy
+      pybind11
+      packaging
+    ]
+  )
+  ++ lib.optionals cudaSupport (
+    with cudaPackages;
+    [
+      cuda_cccl # cub/cub.cuh
+      libcublas # cublas_v2.h
+      libcurand # curand.h
+      libcusparse # cusparse.h
+      libcufft # cufft.h
+      cudnn # cudnn.h
+      cuda_cudart
+    ]
+    ++ lib.optionals (cudaSupport && ncclSupport) (
+      with cudaPackages;
+      [
+        nccl
+      ]
+    )
+  )
+  ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
+    (darwinMinVersionHook "13.3")
+  ];
+
+  nativeCheckInputs = [
+    gtest
+  ]
+  ++ lib.optionals pythonSupport (
+    with python3Packages;
+    [
+      pytest
+      sympy
+      onnx
+    ]
+  );
+
+  # TODO: build server, and move .so's to lib output
+  # Python's wheel is stored in a separate dist output
+  outputs = [
+    "out"
+    "dev"
+  ]
+  ++ lib.optionals pythonSupport [ "dist" ];
+
+  enableParallelBuilding = true;
+
+  cmakeDir = "../cmake";
+
+  cmakeFlags = [
+    (lib.cmakeBool "ABSL_ENABLE_INSTALL" true)
+    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+    (lib.cmakeBool "FETCHCONTENT_QUIET" false)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ABSEIL_CPP" "${abseil-cpp_202407.src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_DLPACK" "${dlpack}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FLATBUFFERS" "${flatbuffers_23.src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MP11" "${mp11}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ONNX" "${onnx}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RE2" "${re2.src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SAFEINT" "${safeint}")
+    (lib.cmakeFeature "FETCHCONTENT_TRY_FIND_PACKAGE_MODE" "ALWAYS")
+    # fails to find protoc on darwin, so specify it
+    (lib.cmakeFeature "ONNX_CUSTOM_PROTOC_EXECUTABLE" (lib.getExe protobuf))
+    (lib.cmakeBool "onnxruntime_BUILD_SHARED_LIB" true)
+    (lib.cmakeBool "onnxruntime_BUILD_UNIT_TESTS" doCheck)
+    (lib.cmakeBool "onnxruntime_USE_FULL_PROTOBUF" withFullProtobuf)
+    (lib.cmakeBool "onnxruntime_USE_CUDA" cudaSupport)
+    (lib.cmakeBool "onnxruntime_USE_NCCL" (cudaSupport && ncclSupport))
+    (lib.cmakeBool "onnxruntime_ENABLE_LTO" (!cudaSupport || cudaPackages.cudaOlder "12.8"))
+  ]
+  ++ lib.optionals pythonSupport [
+    (lib.cmakeBool "onnxruntime_ENABLE_PYTHON" true)
+  ]
+  ++ lib.optionals cudaSupport [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CUTLASS" "${cutlass}")
+    (lib.cmakeFeature "onnxruntime_CUDNN_HOME" "${cudaPackages.cudnn}")
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaArchitecturesString)
+    (lib.cmakeFeature "onnxruntime_NVCC_THREADS" "1")
+  ];
+
+  env = lib.optionalAttrs effectiveStdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+  };
+
+  doCheck =
+    !(
+      cudaSupport
+      || builtins.elem effectiveStdenv.buildPlatform.system [
+        # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox
+        "aarch64-linux"
+        # 1 - onnxruntime_test_all (Failed)
+        # 4761 tests from 311 test suites ran, 57 failed.
+        "loongarch64-linux"
+      ]
+    );
+
+  requiredSystemFeatures = lib.optionals cudaSupport [ "big-parallel" ];
+
+  hardeningEnable = lib.optionals (effectiveStdenv.hostPlatform.system == "loongarch64-linux") [
+    "nostrictaliasing"
+  ];
+
+  postPatch = ''
+    substituteInPlace cmake/libonnxruntime.pc.cmake.in \
+      --replace-fail '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
+    echo "find_package(cudnn_frontend REQUIRED)" > cmake/external/cudnn_frontend.cmake
+
+    # https://github.com/microsoft/onnxruntime/blob/c4f3742bb456a33ee9c826ce4e6939f8b84ce5b0/onnxruntime/core/platform/env.h#L249
+    substituteInPlace onnxruntime/core/platform/env.h --replace-fail \
+      "GetRuntimePath() const { return PathString(); }" \
+      "GetRuntimePath() const { return PathString(\"$out/lib/\"); }"
+  ''
+  + lib.optionalString (effectiveStdenv.hostPlatform.system == "aarch64-linux") ''
+    # https://github.com/NixOS/nixpkgs/pull/226734#issuecomment-1663028691
+    rm -v onnxruntime/test/optimizer/nhwc_transformer_test.cc
+  '';
+
+  postBuild = lib.optionalString pythonSupport ''
+    ${python3Packages.python.interpreter} ../setup.py bdist_wheel
+  '';
+
+  postInstall = ''
+    # perform parts of `tools/ci_build/github/linux/copy_strip_binary.sh`
+    install -m644 -Dt $out/include \
+      ../include/onnxruntime/core/framework/provider_options.h \
+      ../include/onnxruntime/core/providers/cpu/cpu_provider_factory.h \
+      ../include/onnxruntime/core/session/onnxruntime_*.h
+  '';
+
+  passthru = {
+    inherit cudaSupport cudaPackages; # for the python module
+    inherit protobuf;
+    tests = lib.optionalAttrs pythonSupport {
+      python = python3Packages.onnxruntime;
+    };
+  };
+
+  meta = {
+    description = "Cross-platform, high performance scoring engine for ML models";
+    longDescription = ''
+      ONNX Runtime is a performance-focused complete scoring engine
+      for Open Neural Network Exchange (ONNX) models, with an open
+      extensible architecture to continually address the latest developments
+      in AI and Deep Learning. ONNX Runtime stays up to date with the ONNX
+      standard with complete implementation of all ONNX operators, and
+      supports all ONNX releases (1.2+) with both future and backwards
+      compatibility.
+    '';
+    homepage = "https://github.com/microsoft/onnxruntime";
+    changelog = "https://github.com/microsoft/onnxruntime/releases/tag/v${version}";
+    # https://github.com/microsoft/onnxruntime/blob/master/BUILD.md#architectures
+    platforms = lib.platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      puffnfresh
+      ck3d
+    ];
+  };
+}
--- a/pkgs/by-name/on/onscripter-en/package.nix
+++ b/pkgs/by-name/on/onscripter-en/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  SDL,
+  SDL_image,
+  SDL_mixer,
+  SDL_ttf,
+  fetchFromGitHub,
+  freetype,
+  libjpeg,
+  libogg,
+  libpng,
+  libvorbis,
+  pkg-config,
+  smpeg,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "onscripter-en";
+  version = "20110930";
+
+  # The website is not available now. Let's use a Museoa backup
+  src = fetchFromGitHub {
+    owner = "museoa";
+    repo = "onscripter-en";
+    rev = finalAttrs.version;
+    hash = "sha256-Lc5ZlH2C4ER02NmQ6icfiqpzVQdVUnOmdywGjjjSYSg=";
+  };
+
+  nativeBuildInputs = [
+    SDL
+    pkg-config
+    smpeg
+  ];
+
+  buildInputs = [
+    SDL
+    SDL_image
+    SDL_mixer
+    SDL_ttf
+    freetype
+    libjpeg
+    libogg
+    libpng
+    libvorbis
+    smpeg
+  ];
+
+  configureFlags = [ "--no-werror" ];
+
+  strictDeps = true;
+
+  preBuild = ''
+    sed -i 's/.dll//g' Makefile
+  '';
+
+  meta = {
+    homepage = "https://github.com/museoa/onscripter-en";
+    description = "Japanese visual novel scripting engine";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "onscripter-en";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
--- a/pkgs/by-name/on/onyx/package.nix
+++ b/pkgs/by-name/on/onyx/package.nix
@@ -0,0 +1,64 @@
+{
+  fetchFromGitHub,
+  flutter335,
+  lib,
+  libsecret,
+  makeDesktopItem,
+}:
+
+flutter335.buildFlutterApplication rec {
+  pname = "onyx";
+  version = "2.0.12";
+
+  src = fetchFromGitHub {
+    owner = "onyx-lyon1";
+    repo = "onyx";
+    tag = "v${version}";
+    hash = "sha256-WQH1qhu5UFB/RToraO/zEU6BjzwhNWrsk+U8ZIs1VLM=";
+  };
+
+  sourceRoot = "${src.name}/apps/onyx";
+
+  buildInputs = [
+    libsecret
+  ];
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  gitHashes = {
+    drag_and_drop_lists = "sha256-moyKVIaqCCLeR5dvvd+DW7cpgPG4NCBp3+ohMEwT3FE=";
+    geolocator_android = "sha256-qXk7Tg/e2oc8/0eGcTCJ4Po+wCzUqfqWZMaHXflgyrE=";
+    dart_mappable = "sha256-i4KJXxZCV5L+er1pOkknh3hmZ/y+HcBKly29hG3+lDc=";
+    dart_mappable_builder = "sha256-i4KJXxZCV5L+er1pOkknh3hmZ/y+HcBKly29hG3+lDc=";
+    json_theme = "sha256-OuJBQDqytLds6BB4/GS01A4H9OZYt4g4QsK7ugO3o+I=";
+    workmanager = "sha256-a+IPLiWrRxKmWCJ9Bpv3WVH6JwTRiFPQdxSkeQEbfp4=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "onyx";
+      exec = "Onyx";
+      icon = "onyx";
+      desktopName = "Onyx";
+      genericName = "App for Claude Bernard University";
+      categories = [
+        "Education"
+        "Office"
+      ];
+      startupWMClass = "Onyx";
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 assets/icon_transparent.png $out/share/icons/hicolor/512x512/apps/onyx.png
+  '';
+
+  meta = {
+    description = "App for Claude Bernard University";
+    homepage = "https://onyx-lyon1.github.io/";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "Onyx";
+    maintainers = with lib.maintainers; [ eymeric ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/on/onyx/pubspec.lock.json
+++ b/pkgs/by-name/on/onyx/pubspec.lock.json