push sheeet

pkgs/tools/admin/aws-mfa/default.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchFromGitHub,
+  fetchpatch,
+  setuptools,
+  boto3,
+}:
+
+buildPythonApplication rec {
+  pname = "aws-mfa";
+  version = "0.0.12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "broamski";
+    repo = "aws-mfa";
+    rev = version;
+    hash = "sha256-XhnDri7QV8esKtx0SttWAvevE3SH2Yj2YMq/P4K6jK4=";
+  };
+
+  patches = [
+    # https://github.com/broamski/aws-mfa/pull/87
+    (fetchpatch {
+      name = "remove-duplicate-script.patch";
+      url = "https://github.com/broamski/aws-mfa/commit/0d1624022c71cb92bb4436964b87f0b2ffd677ec.patch";
+      hash = "sha256-Bv8ffPbDysz87wLg2Xip+0yxaBfbEmu+x6fSXI8BVjA=";
+    })
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    boto3
+  ];
+
+  # package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "awsmfa"
+  ];
+
+  meta = with lib; {
+    description = "Manage AWS MFA Security Credentials";
+    mainProgram = "aws-mfa";
+    homepage = "https://github.com/broamski/aws-mfa";
+    license = licenses.mit;
+    maintainers = [ ];
+  };
+}

pkgs/tools/admin/cdist/default.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchFromGitea,
+  six,
+  sphinxHook,
+  sphinx-rtd-theme,
+}:
+
+buildPythonApplication rec {
+  pname = "cdist";
+  version = "7.0.0";
+  format = "setuptools";
+  outputs = [
+    "out"
+    "man"
+    "doc"
+  ];
+
+  src = fetchFromGitea {
+    domain = "code.ungleich.ch";
+    owner = "ungleich-public";
+    repo = "cdist";
+    rev = version;
+    hash = "sha256-lIx0RtGQJdY2e00azI9yS6TV+5pCegpKOOD0dQmgMqA=";
+  };
+
+  nativeBuildInputs = [
+    six
+    sphinxHook
+    sphinx-rtd-theme
+  ];
+
+  sphinxRoot = "docs/src";
+
+  # "make man" creates symlinks in docs/src needed by sphinxHook.
+  postPatch = ''
+    echo "VERSION = '$version'" > cdist/version.py
+
+    make man
+  '';
+
+  preConfigure = ''
+    export HOME=/tmp
+  '';
+
+  # Test suite requires either non-chrooted environment or root.
+  #
+  # When "machine_type" explorer figures out that it is running inside
+  # chroot, it assumes that it has enough privileges to escape it.
+  doCheck = false;
+
+  pythonImportsCheck = [ "cdist" ];
+
+  postInstall = ''
+    mkdir -p $out/share
+    mv docs/dist/man $out/share
+  '';
+
+  meta = with lib; {
+    description = "Minimalistic configuration management system";
+    homepage = "https://www.sdi.st";
+    changelog = "https://code.ungleich.ch/ungleich-public/cdist/src/tag/${version}/docs/changelog";
+
+    # Mostly. There are still couple types that are gpl3-only.
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kaction ];
+    platforms = platforms.unix;
+  };
+}

pkgs/tools/admin/ibmcloud-cli/default.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  installShellFiles,
+  writableTmpDirAsHomeHook,
+}:
+let
+  arch =
+    with stdenv.hostPlatform;
+    if isx86_64 then
+      "amd64"
+    else if isAarch64 then
+      "arm64"
+    else if isi686 then
+      "386"
+    else if isPower64 && isLittleEndian then
+      "ppc64le"
+    else if isS390x then
+      "s390x"
+    else
+      throw "Unsupported arch: ${stdenv.hostPlatform.system}";
+  platform =
+    if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
+      "macos_arm64"
+    else if stdenv.hostPlatform.isDarwin then
+      "macos"
+    else
+      "linux_${arch}";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ibmcloud-cli";
+  version = "2.36.0";
+
+  src = fetchurl {
+    url = "https://download.clis.cloud.ibm.com/ibm-cloud-cli/${finalAttrs.version}/binaries/IBM_Cloud_CLI_${finalAttrs.version}_${platform}.tgz";
+    hash =
+      {
+        "x86_64-darwin" = "sha256-hIHFfUxAhpA+YIN7Bq65khFFj+3BCuYRtMq2WjQwqYQ=";
+        "aarch64-darwin" = "sha256-ZZ500RWagqhf63zwiQpV8y+gtCxGfbA36F97x67coUE=";
+        "x86_64-linux" = "sha256-+ZKlFvrDPm3ERq8/r7cjgsJWjUr8+sGFqYXdiSUPeXo=";
+        "aarch64-linux" = "sha256-ER/Ey3Jux3i8tC30/65awHdEd6efscUVjX/bFAk1b7c=";
+        "i686-linux" = "sha256-5A0kUegKVHSTZ+jRg5+07wvV4PkCvOPddvyC1ZLCbmI=";
+        "powerpc64le-linux" = "sha256-XcHrdA9i3Euc0yIjUtFrmIFMJi+onXRK+tHzNxmQwHg=";
+        "s390x-linux" = "sha256-loGQxvUqp9ngieVOVuZ6IhOKgyrVGBd+y9LdZtKEPwc=";
+      }
+      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+    writableTmpDirAsHomeHook
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 ibmcloud $out/bin/ibmcloud
+    mkdir -p $out/share/ibmcloud
+    cp LICENSE NOTICE $out/share/ibmcloud
+    installShellCompletion --cmd ibmcloud --bash <($out/bin/ibmcloud --generate-bash-completion)
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Command line client for IBM Cloud";
+    homepage = "https://cloud.ibm.com/docs/cli";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ emilytrau ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "i686-linux"
+      "powerpc64le-linux"
+      "s390x-linux"
+    ]
+    ++ lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "ibmcloud";
+  };
+})

pkgs/tools/admin/ibmcloud-cli/update.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update common-updater-scripts nix jq
+
+set -euo pipefail
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; ibmcloud-cli.version or (lib.getVersion ibmcloud-cli)" | tr -d '"')
+latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/IBM-Cloud/ibm-cloud-cli-release/releases/latest | jq --raw-output .tag_name | sed 's/^v//')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+update-source-version ibmcloud-cli $latestVersion || true
+
+for system in \
+    x86_64-linux \
+    aarch64-linux \
+    i686-linux \
+    powerpc64le-linux \
+    s390x-linux \
+    x86_64-darwin \
+    aarch64-darwin; do
+    tmp=$(mktemp -d)
+    curl -fsSL -o $tmp/ibmcloud-cli $(nix-instantiate --eval -E "with import ./. {}; ibmcloud-cli.src.url" --system "$system" | tr -d '"')
+    hash=$(nix --extra-experimental-features nix-command hash file $tmp/ibmcloud-cli)
+    update-source-version ibmcloud-cli $latestVersion $hash --system=$system --ignore-same-version
+    rm -rf $tmp
+done

pkgs/tools/admin/meraki-cli/default.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  argcomplete,
+  jinja2,
+  meraki,
+  rich,
+  fetchPypi,
+  buildPythonApplication,
+  pytestCheckHook,
+  requests-mock,
+  setuptools,
+}:
+
+buildPythonApplication rec {
+  pname = "meraki-cli";
+  version = "1.5.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "meraki_cli";
+    inherit version;
+    hash = "sha256-FHcKgppclc0L6yuCkpVYfr+jq8hNkt7Hq/44mpHMR20=";
+  };
+
+  disabledTests = [
+    # requires files not in PyPI tarball
+    "TestDocVersions"
+    "TestHelps"
+    # requires running "pip install"
+    "TestUpgrade"
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    argcomplete
+    jinja2
+    meraki
+    rich
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "meraki_cli"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/PackeTsar/meraki-cli";
+    description = "Simple CLI tool to automate and control your Cisco Meraki Dashboard";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dylanmtaylor ];
+    platforms = platforms.unix;
+    mainProgram = "meraki";
+  };
+}

pkgs/tools/admin/meshcentral/default.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  fetchzip,
+  fetchYarnDeps,
+  yarn2nix-moretea,
+  nodejs_20,
+  dos2unix,
+}:
+
+yarn2nix-moretea.mkYarnPackage {
+  version = "1.1.51";
+
+  src = fetchzip {
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.51.tgz";
+    sha256 = "1l3x1rhcw38pg0rh27qyfg2dm5biwnyzicdd6l07c3km4x6xi5pr";
+  };
+
+  patches = [
+    ./fix-js-include-paths.patch
+  ];
+
+  packageJSON = ./package.json;
+  yarnLock = ./yarn.lock;
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = ./yarn.lock;
+    hash = "sha256-jmsRlHJgSrUtXwRcfX+tMH4SmrKVtD7gEK1+oW5mYIs=";
+  };
+
+  # Tarball has CRLF line endings. This makes patching difficult, so let's convert them.
+  nativeBuildInputs = [ dos2unix ];
+  prePatch = ''
+    find . -name '*.js' -exec dos2unix {} +
+    ln -snf meshcentral.js bin/meshcentral
+  '';
+
+  preFixup = ''
+    mkdir -p $out/bin
+    chmod a+x $out/libexec/meshcentral/deps/meshcentral/meshcentral.js
+    sed -i '1i#!${nodejs_20}/bin/node' $out/libexec/meshcentral/deps/meshcentral/meshcentral.js
+    ln -s $out/libexec/meshcentral/deps/meshcentral/meshcentral.js $out/bin/meshcentral
+  '';
+
+  publishBinsFor = [ ];
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "Computer management web app";
+    homepage = "https://meshcentral.com/";
+    maintainers = with maintainers; [ ma27 ];
+    license = licenses.asl20;
+    mainProgram = "meshcentral";
+  };
+}

pkgs/tools/admin/meshcentral/fix-js-include-paths.patch

@@ -0,0 +1,31 @@
+diff --git a/pkcs7-modified.js b/pkcs7-modified.js
+index 661904a6..932a41ad 100644
+--- a/pkcs7-modified.js
++++ b/pkcs7-modified.js
+@@ -31,16 +31,16 @@ try {
+ } catch (ex) { }
+ 
+ if (forge == null) {
+-    forge = require('./node_modules/node-forge/lib/forge');
+-    require('./node_modules/node-forge/lib/aes');
+-    require('./node_modules/node-forge/lib/asn1');
+-    require('./node_modules/node-forge/lib/des');
+-    require('./node_modules/node-forge/lib/oids');
+-    require('./node_modules/node-forge/lib/pem');
+-    require('./node_modules/node-forge/lib/pkcs7asn1');
+-    require('./node_modules/node-forge/lib/random');
+-    require('./node_modules/node-forge/lib/util');
+-    require('./node_modules/node-forge/lib/x509');
++    forge = require('node-forge/lib/forge');
++    require('node-forge/lib/aes');
++    require('node-forge/lib/asn1');
++    require('node-forge/lib/des');
++    require('node-forge/lib/oids');
++    require('node-forge/lib/pem');
++    require('node-forge/lib/pkcs7asn1');
++    require('node-forge/lib/random');
++    require('node-forge/lib/util');
++    require('node-forge/lib/x509');
+ }
+ 
+ // shortcut for ASN.1 API

pkgs/tools/admin/meshcentral/package.json

@@ -0,0 +1,142 @@
+{
+  "name": "meshcentral",
+  "version": "1.1.51",
+  "keywords": [
+    "Remote Device Management",
+    "Remote Device Monitoring",
+    "Remote Desktop",
+    "Remote Terminal",
+    "Remote File Access",
+    "KVM",
+    "2FA",
+    "Two-Factor Authentication",
+    "Intel Active Management Technology",
+    "Intel AMT"
+  ],
+  "homepage": "https://meshcentral.com",
+  "description": "Web based remote computer management server",
+  "author": "Ylian Saint-Hilaire <ylianst@gmail.com>",
+  "main": "meshcentral.js",
+  "bin": {
+    "meshcentral": "bin/meshcentral"
+  },
+  "license": "Apache-2.0",
+  "files": [
+    "*.js",
+    "amt",
+    "bin",
+    "rdp",
+    "views",
+    "emails",
+    "agents",
+    "public",
+    "translate",
+    "readme.txt",
+    "license.txt",
+    "sample-config.json",
+    "sample-config-advanced.json"
+  ],
+  "dependencies": {
+    "@seald-io/nedb": "4.0.4",
+    "archiver": "7.0.1",
+    "body-parser": "1.20.3",
+    "cbor": "5.2.0",
+    "compression": "1.8.1",
+    "cookie-session": "2.1.1",
+    "express": "4.21.2",
+    "express-handlebars": "7.1.3",
+    "express-ws": "5.0.2",
+    "ipcheck": "0.1.0",
+    "minimist": "1.2.8",
+    "multiparty": "4.2.3",
+    "node-forge": "1.3.1",
+    "ua-client-hints-js": "0.1.2",
+    "ua-parser-js": "1.0.40",
+    "ws": "8.18.0",
+    "yauzl": "2.10.0"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Ylianst/MeshCentral.git"
+  },
+  "readme": "readme.md",
+  "optionalDependencies": {
+    "passport": "*",
+    "connect-flash": "*",
+    "passport-twitter": "*",
+    "passport-google-oauth20": "*",
+    "passport-github2": "*",
+    "passport-azure-oauth2": "*",
+    "jwt-simple": "*",
+    "openid-client": "5.7.1",
+    "passport-saml": "*",
+    "@duosecurity/duo_universal": "2.1.0",
+    "archiver": "7.0.1",
+    "body-parser": "1.20.3",
+    "cbor": "5.2.0",
+    "compression": "1.8.1",
+    "cookie-session": "2.1.1",
+    "express": "4.21.2",
+    "express-handlebars": "7.1.3",
+    "express-ws": "5.0.2",
+    "ipcheck": "0.1.0",
+    "minimist": "1.2.8",
+    "multiparty": "4.2.3",
+    "@seald-io/nedb": "*",
+    "node-forge": "1.3.1",
+    "ua-parser-js": "1.0.40",
+    "ua-client-hints-js": "0.1.2",
+    "ws": "8.18.0",
+    "yauzl": "2.10.0",
+    "node-windows": "0.1.14",
+    "loadavg-windows": "1.1.1",
+    "node-sspi": "0.2.10",
+    "ldapauth-fork": "5.0.5",
+    "ssh2": "1.16.0",
+    "svg-captcha": "1.4.0",
+    "image-size": "2.0.2",
+    "acme-client": "4.2.5",
+    "aedes": "0.39.0",
+    "mysql2": "3.11.4",
+    "@mysql/xdevapi": "8.0.33",
+    "mongodb": "4.17.2",
+    "pg": "8.14.1",
+    "mariadb": "3.4.0",
+    "acebase": "1.29.5",
+    "sqlite3": "5.1.7",
+    "node-vault": "0.10.2",
+    "https-proxy-agent": "7.0.2",
+    "mongojs": "3.1.0",
+    "nodemailer": "6.10.1",
+    "@sendgrid/mail": "*",
+    "jsdom": "22.1.0",
+    "esprima": "4.0.1",
+    "html-minifier-terser": "7.2.0",
+    "@crowdsec/express-bouncer": "0.1.0",
+    "prom-client": "*",
+    "archiver-zip-encrypted": "2.0.0",
+    "googleapis": "128.0.0",
+    "webdav": "5.8.0",
+    "minio": "8.0.2",
+    "wildleek": "2.0.0",
+    "yub": "0.11.1",
+    "otplib": "12.0.1",
+    "twilio": "4.19.0",
+    "plivo": "4.58.0",
+    "telnyx": "1.25.5",
+    "telegram": "2.19.8",
+    "input": "1.0.1",
+    "discord.js": "14.6.0",
+    "@xmpp/client": "0.13.1",
+    "node-pushover": "1.0.0",
+    "zulip": "0.1.0",
+    "web-push": "3.6.6",
+    "firebase-admin": "12.7.0",
+    "modern-syslog": "1.2.0",
+    "syslog": "0.1.1-1",
+    "heapdump": "0.3.15"
+  }
+}

pkgs/tools/admin/meshcentral/update.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodejs yarn prefetch-yarn-deps jq rsync common-updater-scripts moreutils
+
+set -exuo pipefail
+
+expr_dir=$(cd "$(dirname "$0")"; pwd)
+tmp=$(mktemp -dt update-meshcentral.XXXXXX)
+
+npm show --json meshcentral > "$tmp/npm.json"
+version=$(<"$tmp/npm.json" jq -r .version)
+tarball=$(<"$tmp/npm.json" jq -r .dist.tarball)
+
+prefetch=$(nix-prefetch-url --unpack --print-path "$tarball" | tr '\n' ' ')
+read -r hash storePath <<<"$prefetch"
+cd "$tmp"
+rsync -r --chmod=u=rwX "$storePath/" package/
+cd package
+
+# Very crude way of discovering optional dependencies. These are
+# fetched at runtime by stock upstream, but we don't allow that kind
+# of thing in nix :)
+awk <meshcentral.js "
+  BEGIN { RS=\"[\n;]\" }
+  match(\$0, /(modules|passport) = (\[.*\])$/, a) { print a[2] }
+  match(\$0, /(modules|passport).push\(('[^)]+')\)/, a) { print \"[\" a[2] \"]\" }
+" |
+    tr \' \" |
+    jq --slurp '[if type == "array" then .[] else . end] | flatten' |
+    # And an equally crude way of adding them to package.json. We
+    # can't use yarn add here, because that will blow up on
+    # dependencies which don't support the current platform. Even with
+    # --optional.
+    jq --slurpfile package package.json \
+       '(. | map(. | capture("(?<name>@?[^@]+)(@(?<version>.+))?") | { key: .name, value: (.version // "*")}) | from_entries) as $optionalDependencies | $package | .[] | .optionalDependencies |= . + $optionalDependencies' |
+    sponge package.json
+
+# Fetch all the optional dependencies, so we have them available in
+# yarn.lock/yarn.nix
+yarn install --ignore-scripts
+
+cp package.json "$expr_dir"
+cp yarn.lock "$expr_dir/yarn.lock"
+
+cd "$expr_dir/../../../.."
+update-source-version meshcentral "$version" "$hash" "$tarball"
+
+new_yarn_hash=$(prefetch-yarn-deps "$expr_dir/yarn.lock")
+new_yarn_hash=$(nix-hash --type sha256 --to-sri "$new_yarn_hash")
+old_yarn_hash=$(nix-instantiate --eval -A meshcentral.offlineCache.outputHash | tr -d '"')
+sed -i "$expr_dir/default.nix" -e "s|\"$old_yarn_hash\"|\"$new_yarn_hash\"|"
+
+# Only clean up if everything worked
+cd /
+rm -rf "$tmp"

pkgs/tools/admin/pulumi-bin/data.nix

@@ -0,0 +1,639 @@
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "3.201.0";
+  pulumiPkgs = {
+    x86_64-linux = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.201.0-linux-x64.tar.gz";
+        sha256 = "02k0h1kkvc1yz2bm5zip24n00sp7nv7l7badh13m7mylkcflfvg8";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.43.1-linux-amd64.tar.gz";
+        sha256 = "1fzdqgb7cvff7xwi4n35s1daby51mismnbw7fp136lz0qah8cqg6";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.1.0-linux-amd64.tar.gz";
+        sha256 = "1065l1ahklhl9b8f4lkaa6lv748lqqhpv8w3crgnznddnrz0g1sn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.86.1-linux-amd64.tar.gz";
+        sha256 = "10mz7gv2bm93hvkvqvhsvqhkcziyci2wbxmqj9ggplgv44k49w68";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.9.1-linux-amd64.tar.gz";
+        sha256 = "02pgy8m9f32ky69vs7kw7fn8b41l0y4w2gg7s15nw5c069vvnpy4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.29.0-linux-amd64.tar.gz";
+        sha256 = "0032ax8kazj8gxmxz6sgffv5r7y67vp92xwzlfpq4y6jlqiapwi9";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.8.0-linux-amd64.tar.gz";
+        sha256 = "1f1zj1m3alz9zvdab9fvqrlzjafzwx21wpnifi7fs3sf27p1vs2l";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.6.0-linux-amd64.tar.gz";
+        sha256 = "1kvcw8163ghfnrdgc2rzvhfc9npfql7c2d6y6p32j6arwf7h2k4m";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-linux-amd64.tar.gz";
+        sha256 = "0r0s72v99wx2ggb45ifs0hjy76nq8aa6z66zlxjb8wgda3yrsldz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.28.0-linux-amd64.tar.gz";
+        sha256 = "0agh234zr757kx6b41k1q7p9rpzb3jv30nkyzs5xqhjnv44lky97";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.10.0-linux-amd64.tar.gz";
+        sha256 = "0gjhdf6ai64k3kkdfvprpszc93b6yim622kk4m76s15kpcnnlnzz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-linux-amd64.tar.gz";
+        sha256 = "00gkdgb6s0wqjl6m69sc8dz320aiy2s751qqn73894jyaqa8v9zk";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.57.0-linux-amd64.tar.gz";
+        sha256 = "1bgbnmkc0g4yqspv9bfn7zmyf0rykibyshmjrjmhr3q32jz9ffyg";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.53.0-linux-amd64.tar.gz";
+        sha256 = "1vd4wcpkwb01wb3916nna3wwqhbym234jj6ggyayw0mawhrx52rm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.9.0-linux-amd64.tar.gz";
+        sha256 = "0b311liad597gbdk1yb5b2yyyxxr0kjgav1rbs1ans7fyfbp05kl";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-amd64.tar.gz";
+        sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v11.0.0-linux-amd64.tar.gz";
+        sha256 = "0sm8gqay51g12l20n08pih9vhpm2b95aj71zj6nmqiq5gym89v6z";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.2.0-linux-amd64.tar.gz";
+        sha256 = "042n9bsf1gp7h9wm2qcq6pw001fy8gmfwfbb7f3shlfchn7kws4g";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-linux-amd64.tar.gz";
+        sha256 = "192bz3xl0hiy3k68fgcb9mw6j1hb6ngrahf53h8zb7agikzwiy3m";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v9.3.0-linux-amd64.tar.gz";
+        sha256 = "0bl8r0d2zyd2yfx1wv84gxjjq5mp2kw52sv4vqpqihmzvcwr0rcv";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.32.0-linux-amd64.tar.gz";
+        sha256 = "1zra1ck64gs4nwqf62ksfmpbx24lxw6vsgi47j4v8q051m89fgq3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.25.0-linux-amd64.tar.gz";
+        sha256 = "02dwixm2islad74jm7d3b7n1a9lsrm028np4j47s0959hmkqq7c1";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.23.0-linux-amd64.tar.gz";
+        sha256 = "08i1k8m59dp56lafx8b0ggmgxl7dfqv8f4nljy4dh95h3bs7fdl2";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.3.0-linux-amd64.tar.gz";
+        sha256 = "01hqf1sq13s0qgcqsfnkk2ijd6g5cm74b3nxbvc0kf2ybcxvwsmv";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-linux-amd64.tar.gz";
+        sha256 = "1vvdn7p0m9kyb62r0g52ypidbm7060mhaz1iy0zd7915whxk900p";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-linux-amd64.tar.gz";
+        sha256 = "0sawhhcmnhgwdv3wl05z65parmrc74mgk2cpyhgp0hcvbpgagknj";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v5.3.3-linux-amd64.tar.gz";
+        sha256 = "1nm79hr1bl2dpxw905d9y5rjdvkzxwfbqbm3vp8314ljjkwmj918";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-linux-amd64.tar.gz";
+        sha256 = "1wyl8xr07b8gj933w7lxip36mc7xxqwb9i46826il7w67gb2vfb4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-linux-amd64.tar.gz";
+        sha256 = "1n3ndir2n1pq4mmnbkiqvv0rf3w4dgz3a9b221vimsi2lks212kw";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.7.0-linux-amd64.tar.gz";
+        sha256 = "18iaybm8sqg468a8fan2dm1lsyybch3l1wiawvz5qyh6ap5x2fv7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-linux-amd64.tar.gz";
+        sha256 = "038ibhpmm129xavmqfb5p2bd1sxf5hvw08qclkm7h38sgdzx0hk4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v1.0.11-linux-amd64.tar.gz";
+        sha256 = "0pppwgwl726rfy92fnya9afj3cciw13vzs9r60w2477i3250slqj";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.22.0-linux-amd64.tar.gz";
+        sha256 = "1m4nyymbsdjnzqb389b98g0vcyz5cdyzrdr38i5dl70mah89c2kz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-linux-amd64.tar.gz";
+        sha256 = "1vh28r2gk85a82c7jsa95n21my19hzavkyc9pjdpw517r63gvyjw";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.3.0-linux-amd64.tar.gz";
+        sha256 = "0vdrh5ss7vlmyv0a0mvrj2w9mrsazqrl7hcvwn5riym4ba0daq03";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.12.1-linux-amd64.tar.gz";
+        sha256 = "070kb73yix9aha55x9n4h6f4khp9a8wylqgvzdhsa7c7k35fx6q5";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-linux-amd64.tar.gz";
+        sha256 = "0p3rjsppf2zl7xwcs9qr2s262bxkilvzy8yi7nybydhfscl1rmrr";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-linux-amd64.tar.gz";
+        sha256 = "0pbf995jvp3fkvnqdv2ds0zf3yr88rh61i9q4ab7b3141hsghvha";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-amd64.tar.gz";
+        sha256 = "14qsnjafhd8ppachxr7j9541p5rbf1cakqlr7mra86fli1r49z9p";
+      }
+    ];
+    x86_64-darwin = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.201.0-darwin-x64.tar.gz";
+        sha256 = "054kg9b2akpd6l9m4wwx3hci7ajl6j63i9wlxvl04q0y1qxw2q3s";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.43.1-darwin-amd64.tar.gz";
+        sha256 = "1cdk1cc548lkylc9rgyghkhv5qqmpdgkgzbyxf8s5a019729fhq4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.1.0-darwin-amd64.tar.gz";
+        sha256 = "0kaa0wzf03j0s1wq3xw50yknai0qbkw2x2xjrxmw26x7y243f143";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.86.1-darwin-amd64.tar.gz";
+        sha256 = "1b8lwjbvppj7ssncfwqync169ydz7m8wx3zkxdvc8yw4ggcl2kxs";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.9.1-darwin-amd64.tar.gz";
+        sha256 = "09c2kdhad10c6g1j955dxkvvfapk6qqc8wdd69qcl85lkpgzn3cz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.29.0-darwin-amd64.tar.gz";
+        sha256 = "0xy3z460nw89i0zjj5bn0qwpqc18xcas4zk3wgvvrsk7v0jj1cin";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.8.0-darwin-amd64.tar.gz";
+        sha256 = "0iq60sxszffaqv6anh4hi2bx963k462g6y0ylpwx0662wi7d6m5w";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.6.0-darwin-amd64.tar.gz";
+        sha256 = "1cdpx3540y3kp76ml1qi0awfzvm3172bzc76khdbsdcz9b8f3kb7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-darwin-amd64.tar.gz";
+        sha256 = "124fk2mxxzc06dav25kk1wn8gqrys6607gg3nm53fk813wx76zg6";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.28.0-darwin-amd64.tar.gz";
+        sha256 = "0b7ryynm4np70d4si2i9jwjjqd1nd3b6m23fgv9c2cwwnrg2xmiz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.10.0-darwin-amd64.tar.gz";
+        sha256 = "0l1r3qdmf90g0fpi0jvac0v4phksnwqjhihx6rcnrcpc9ihfr2pa";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-darwin-amd64.tar.gz";
+        sha256 = "1n3afyncwk16cbkc8wch3370z08b2vabpvpp8g55xarhqvqk1qpz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.57.0-darwin-amd64.tar.gz";
+        sha256 = "1wgcbn02r9xv9lanfssm85ac9y1p712ba2jg2jh0hb9mmx7dvhrl";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.53.0-darwin-amd64.tar.gz";
+        sha256 = "1vpp01zh6g2p3s1x061hrkzl83qcahf5mw6cdhl0m0h425mbzvam";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.9.0-darwin-amd64.tar.gz";
+        sha256 = "0db5b2dp9gaklqqm2l90ssk1jpgvffl9l1250axjl6q132ga380v";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-amd64.tar.gz";
+        sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v11.0.0-darwin-amd64.tar.gz";
+        sha256 = "12yzgpz05pf1y401p94p063c2yj8i5mlmy5bxdd69n4537z17z02";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.2.0-darwin-amd64.tar.gz";
+        sha256 = "1bnh1g27vxihn3fkna5flphkkhwfj1kdyafrv3rylyw5iqq3kfl4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-darwin-amd64.tar.gz";
+        sha256 = "0bsfi36kihw2334gs39z9gwm6gwr0bypbcx7wfckj5zzml94jg6y";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v9.3.0-darwin-amd64.tar.gz";
+        sha256 = "01kncjmknz9ynhjyp06gn5n1d8010k4riz2zzh2sgsq9icvphh3b";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.32.0-darwin-amd64.tar.gz";
+        sha256 = "0ddd0pgpyywq291r9q8w6bn41r2px595017iihx4n2cnb1c4v6d5";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.25.0-darwin-amd64.tar.gz";
+        sha256 = "1q3nhm48rdxh2br72l8lgdks5m869v2ia67gwchkzsjjrjiysbqh";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.23.0-darwin-amd64.tar.gz";
+        sha256 = "1pdvqyfv4cn25h0hg830r2mv5d7g16032badf6f16azscdri81lv";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.3.0-darwin-amd64.tar.gz";
+        sha256 = "0d3mz66c182hkj61dzga9cd4fdwkw34s6cyv3jvchvfkpyl3d802";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-darwin-amd64.tar.gz";
+        sha256 = "0pzc0girgfy3p03rxzwm6n9g72x2qinn4g151dmwl0mdgn0bh8rh";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-darwin-amd64.tar.gz";
+        sha256 = "18hxq1kmaxb6xjajcm84zjc3crpaqh412mkrs0xai97p3pbdfkzn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v5.3.3-darwin-amd64.tar.gz";
+        sha256 = "1vdva946j07cmjvjw1kzf12ppwy7x2gin7bmkrqri07ahfibx9i2";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-darwin-amd64.tar.gz";
+        sha256 = "0vjjki7lzx4kxi91qfsm07vs2jz4nl3l816hcn3kkj22ypnx11w2";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-darwin-amd64.tar.gz";
+        sha256 = "1b3znzx5m20xlvmgj9njmip7q32fs6hm62zfckra73bqh2mc9492";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.7.0-darwin-amd64.tar.gz";
+        sha256 = "1cyh4zlaayyg4x6qzgc8pxm7kvc6b2xjm93v9rb25vbxb4yjv1nw";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-darwin-amd64.tar.gz";
+        sha256 = "0fvncj4wxlwkpk79xlpayb4l038igjx1n4fysk5ahvwanvpy8lxs";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v1.0.11-darwin-amd64.tar.gz";
+        sha256 = "1jpcyp3lqiz4aab331x7shhqxzp4m6nz68vhkyqksvdplzr9rj44";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.22.0-darwin-amd64.tar.gz";
+        sha256 = "1vk28vsx7ay73dalgp0nisp293g2all38afw92wvfgxcbdjzdssd";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-darwin-amd64.tar.gz";
+        sha256 = "1ji9zz1r7rj57w7spf6mwa9fxl1jgiy0qmxvlia21hpj60b536f5";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.3.0-darwin-amd64.tar.gz";
+        sha256 = "097kjmmyqdwaa9ghn228d52sjj2ypr3kqbgkfxvjmq494b5mf74s";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.12.1-darwin-amd64.tar.gz";
+        sha256 = "1c38gqm2vk9fwxyqmzzf27p8xdis9pa8ikj9pgwyjaf208b63gir";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-darwin-amd64.tar.gz";
+        sha256 = "0jrzy2dm6wnkxwk97njhvyw36gy9l1axcw2962drilc60zdc82mb";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-darwin-amd64.tar.gz";
+        sha256 = "1h43zanz810i2p0x12hp60r6k5rfkr5lvh49l32090xj1v6cr8la";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-amd64.tar.gz";
+        sha256 = "11wm9c125154brisncm9cgb41nbjl9q9h4bq6z0ym8v681qq0fc4";
+      }
+    ];
+    aarch64-linux = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.201.0-linux-arm64.tar.gz";
+        sha256 = "0wp8f8sa3s414ixxrkh1p0hy7bgj7v2zm2lbj1nn1804k6pff8cn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.43.1-linux-arm64.tar.gz";
+        sha256 = "1x7gc5782v45s9rr00har3fs43hf6phx23qhw2ann1d5fh026rip";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.1.0-linux-arm64.tar.gz";
+        sha256 = "0lsyrcyfl29313pas8gch8lqmmh9irqcyaailzf531i0r75yi6xc";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.86.1-linux-arm64.tar.gz";
+        sha256 = "11hbjq49a1znx38xk81q2gp2pdq99c8sz166xxb2cmrv84bm2xfi";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.9.1-linux-arm64.tar.gz";
+        sha256 = "03as3y5bflq1m8qfcx7h916vlxa7qn5xla2d1gi2q87gz4giki24";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.29.0-linux-arm64.tar.gz";
+        sha256 = "0v9a59cbzs5s9vylmbwfb5chydccdy1xkhp90ci2lz52yik45lg5";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.8.0-linux-arm64.tar.gz";
+        sha256 = "1lwr5cbf3g3zkk8mvdd17b8bmsjkxbzjg15y2lzsxb294r677b3l";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.6.0-linux-arm64.tar.gz";
+        sha256 = "17lndnmwmxshxz7n2zhgc07gr8cqfd06b1mgblyzbx8n2lc0x0sv";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-linux-arm64.tar.gz";
+        sha256 = "0mmkjim8q5wh0mikwjw3qzg87hm845777jyisz7256p211nrsmyx";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.28.0-linux-arm64.tar.gz";
+        sha256 = "0hg628ik9vvadxs249v4z53y36nzrw3bgjdh1fgjahx875z23m06";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.10.0-linux-arm64.tar.gz";
+        sha256 = "1l2a54qjgh5blwx8mw2i52m5yhff3izqirlh17ws3l04xcldd4d9";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-linux-arm64.tar.gz";
+        sha256 = "15n44dya58sqpirhpiicp1x6w9x15qf94a6vamk2h6jbzpfi7c03";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.57.0-linux-arm64.tar.gz";
+        sha256 = "0d02sl9l4mqhm6mb9rxdc0pc6dr7qkd6zzm4y3ff8dv84qn8sy9n";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.53.0-linux-arm64.tar.gz";
+        sha256 = "033lry88mpn9vfqim26hkjg13dc0jl9sqn28zhld1asx7sqbck3y";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.9.0-linux-arm64.tar.gz";
+        sha256 = "17gzapyqzj51nxza2wc4s2n9vgi52fzz6h84mn4k1vskvfvbpccs";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-arm64.tar.gz";
+        sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v11.0.0-linux-arm64.tar.gz";
+        sha256 = "0f4bxwj7liyijbsqh0r43s823n02gvpkk0rdxwhg1li4d1mpsqxp";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.2.0-linux-arm64.tar.gz";
+        sha256 = "0pizhar9xbhfwghyningb5vicwiw8lkbd2r97ipvwn4nwgvqzs30";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-linux-arm64.tar.gz";
+        sha256 = "1nfsgjfas5md9k67n90hcvcza7gg2iwp9wivmfzf49vz2k25iz44";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v9.3.0-linux-arm64.tar.gz";
+        sha256 = "0jynj7qz66jl47982gvg47fkdbgifb4030225vxz85a705ingjdl";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.32.0-linux-arm64.tar.gz";
+        sha256 = "0d8m2krbzxjhfm82dgf8p4vm3kk9gk98l798q4ayjrddqqb4mxq4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.25.0-linux-arm64.tar.gz";
+        sha256 = "0lxxdqx9g9zd0m3zzpgfcwv3h51sigzldh5fzrn2m6pnqniamqbw";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.23.0-linux-arm64.tar.gz";
+        sha256 = "0kqxz7y1n9zzpw3rv15kb55qvp14rvxh0vymddlrja7iqcvb8nd8";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.3.0-linux-arm64.tar.gz";
+        sha256 = "0acn838wpwl7kfwd4v50wdw45l9mrv6gfr3rnlh81dp39q6w4fl6";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-linux-arm64.tar.gz";
+        sha256 = "0by18hd8zyfl0xac4wanz5lq6sw6wmkclvy0va9cjpfgns916qsk";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-linux-arm64.tar.gz";
+        sha256 = "1gd9l1zdkg5faqlfvc5rl9gqchndxhxp742mx21hizhmp4rsv577";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v5.3.3-linux-arm64.tar.gz";
+        sha256 = "0hliswqz55f4mbx62j3g49qm1yfiaaf8hxglm399ngjvky758lzw";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-linux-arm64.tar.gz";
+        sha256 = "0arnnishqszj7s9a2azjk0a61n2sp3wb97snj9xpj9bp243w5lmf";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-linux-arm64.tar.gz";
+        sha256 = "02jix4w49n9mal8wg6ixgxvnd865ml7zx0lnz6prckfrzgrj36ih";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.7.0-linux-arm64.tar.gz";
+        sha256 = "05fwkafsjv5gd23fzkb2hv3xah9vvqr4w2sc9sjrzcwzghiw0pbh";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-linux-arm64.tar.gz";
+        sha256 = "19p5sszx3ij34c1x1rmcr6wm9zr2wqlnawbydzxbvkzjgdgmmn55";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v1.0.11-linux-arm64.tar.gz";
+        sha256 = "0glljz03v764n53n5l33ji64vj86ipdv5bkr03ijl8wrc22j5syy";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.22.0-linux-arm64.tar.gz";
+        sha256 = "1g1i84wn4im0xk7xn2phpmqqvgc4168mz98xicylk18p17645pfz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-linux-arm64.tar.gz";
+        sha256 = "1zbm7ql3rqypqmckbmlzbiy4akmqjkbzfkl7788q6sm7xh6bm8q1";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.3.0-linux-arm64.tar.gz";
+        sha256 = "1csiv24nmg1c8vb0ay36lsw7dpfim5hr9b3rhdawpsyjdi5s4hsd";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.12.1-linux-arm64.tar.gz";
+        sha256 = "1rfzj89s7avim702aqvkrmsg4d1qzajw1k5pr24jzrs4xiyarkzb";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-linux-arm64.tar.gz";
+        sha256 = "1sbxv37pi1yy6dvjz0yifj44l68mscxaf033a7nbgb3281r15lq1";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-linux-arm64.tar.gz";
+        sha256 = "113czcq1fm2dywn8q5v1z5lyz4l30b1433hrdjnfkr8qwzxncr48";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-arm64.tar.gz";
+        sha256 = "0fd3hgvkr3ch2r5hpmi7h70w4hkbjdyc7z534h151pyc5ssxw8bd";
+      }
+    ];
+    aarch64-darwin = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.201.0-darwin-arm64.tar.gz";
+        sha256 = "1ri8cg89aw43hwsiql4gbbm1qqllqh5pjmhkhf9i19i3c6lfjxz7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.43.1-darwin-arm64.tar.gz";
+        sha256 = "0cb42a83qmb0gciwdl7cr16sagpw7gbij4666p5r9fz1dsjrrq0a";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.1.0-darwin-arm64.tar.gz";
+        sha256 = "1jg74cslbxh741r19z8p4p9sgyn0qlf9vqd8gfdjv5cxa7phl2bm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.86.1-darwin-arm64.tar.gz";
+        sha256 = "1cglc5a507fy973wkk062wd22yn1pwn1pdn2laqqlk0n6y1hp33y";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.9.1-darwin-arm64.tar.gz";
+        sha256 = "0sqmpk1n98vs079qrs1nf9ifjmjz4s9s0f406c8r0cxpn3l08zvp";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.29.0-darwin-arm64.tar.gz";
+        sha256 = "1a13wviv678k1ls57vwvffkk6qa5fdc55zw2byid910m2bjs7bz0";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.8.0-darwin-arm64.tar.gz";
+        sha256 = "0k0kmjqc5iq3dhcvrxkz6d7kbj2q1s0cigqjqp7qpj5ppyss901g";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.6.0-darwin-arm64.tar.gz";
+        sha256 = "0b4srhyq2adbpzh74s0kcmfflayrk6c7jbq63s2l3zfq2zln4sbm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-darwin-arm64.tar.gz";
+        sha256 = "00gahf4jlihzywbsd7rmw73jrnjfdsqxhag4qm7ms90gwl5qspa4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.28.0-darwin-arm64.tar.gz";
+        sha256 = "0jidnrvvk2d6jdfx795yrnkpwmw1843nfylchhynlidf279z21vm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.10.0-darwin-arm64.tar.gz";
+        sha256 = "1cr924w029hah14j9cq0rsy2k0arph8r7dcmhi6zimw3wm0168dd";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-darwin-arm64.tar.gz";
+        sha256 = "1lva9jp2fbz58gfgsdbwlyrdd60wpy1xy55af7f8dmabgcc8j391";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.57.0-darwin-arm64.tar.gz";
+        sha256 = "06gdvb7d5mj7ggnjifi86nb2n7hyzv79rq5wh2dfl0fkf19qam69";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.53.0-darwin-arm64.tar.gz";
+        sha256 = "0v50vs1d1cm6dgfjz9adzka34hbws3j6hwr1s3vxk6f6apx9p3x0";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.9.0-darwin-arm64.tar.gz";
+        sha256 = "1r5i5hfq3qxic61fwz1m3s1lfcr60xkzkg4y8mqgp5vmfsgahqz7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-arm64.tar.gz";
+        sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v11.0.0-darwin-arm64.tar.gz";
+        sha256 = "0a1fy15bf66gvy7jvimbnycxb51z85svrpa9flly1ch3g7276w60";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.2.0-darwin-arm64.tar.gz";
+        sha256 = "1q2mj9j869q91sswczwb3lrh0bk9aixyv89b5ramg2k3r0f2vndx";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-darwin-arm64.tar.gz";
+        sha256 = "13il7mq0g853x1nllvxnhbhflrlqx8i11p4xkg46bvshay15xh9x";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v9.3.0-darwin-arm64.tar.gz";
+        sha256 = "0mf0pxpxjb2fpz4px3dg4b699fqvzf56crvrj00vyc6ld5hmmnpm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.32.0-darwin-arm64.tar.gz";
+        sha256 = "0caz4kgnnrmdr7n571xc7yqscac9jnjwwpjzbnvx4ib6a91wvsdn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.25.0-darwin-arm64.tar.gz";
+        sha256 = "17dr3i20y5f120mq4b8j85jwb5xwid3bbpw2vdfc1qgs1ib17yav";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.23.0-darwin-arm64.tar.gz";
+        sha256 = "17fl8apnlz4ifjzp1sq0fi4y1knxh1x2fvhlrg8j568f3svp41f8";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.3.0-darwin-arm64.tar.gz";
+        sha256 = "0pi9q7iwn670z4dzqqyivdh52dh19g2hsdffc35czj591pfccfvl";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-darwin-arm64.tar.gz";
+        sha256 = "1kkbgmhgp02qzxsh37m9x3jahwjnq5ls9dhjhgbxjjq6xalcqf79";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-darwin-arm64.tar.gz";
+        sha256 = "0n1wmplyj2c5qhaq0gplphi8p2i7g4jwrnlwzkv0m1wixrlx3fw5";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v5.3.3-darwin-arm64.tar.gz";
+        sha256 = "1bl3qcksqnd90jnmiyagi8sfwjcjkc0i9wrhq05pl4hx4wiv6ql2";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-darwin-arm64.tar.gz";
+        sha256 = "0k7w2a1zppw1pgy077iidvnlic21ynw4w7f15z3hw793inzj2wm3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-darwin-arm64.tar.gz";
+        sha256 = "1bb3bzybmfi5blagh13bm6q1avjbp80lmjdv4q5yc2dbfbs653xi";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.7.0-darwin-arm64.tar.gz";
+        sha256 = "1f409m7ls96vvx6x6lsfydp2vn809wy58s5cbh5p8s390s30q2zf";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-darwin-arm64.tar.gz";
+        sha256 = "1j1p8nrwmwnaxigprk6xv7m264mvy6fszq0p0ify0w6yxw0h9a2m";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v1.0.11-darwin-arm64.tar.gz";
+        sha256 = "1c4pn5nr8d97n9bqd7vz9gzlbi50hnfjylwwch445ylqp5l8gvqf";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.22.0-darwin-arm64.tar.gz";
+        sha256 = "05w2w7fjyhkfcb08gncyrl36ynay09qc2zrd9g0ykprcpps61h30";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-darwin-arm64.tar.gz";
+        sha256 = "1qih4kprfaa82p7mg4zg8amy8vp4c76vqkmwf3df2x8bn69jdrc0";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.3.0-darwin-arm64.tar.gz";
+        sha256 = "1p3nb3aazr47kiprq7k3js6x8jk87dsql6d4qkn6c60mbrm9mlal";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.12.1-darwin-arm64.tar.gz";
+        sha256 = "03qhd6p77d40dbcvr6ifw6ii37303jmcqhns63r8gmpbfkdg52a2";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-darwin-arm64.tar.gz";
+        sha256 = "1x3g6j9adkc1k937s271zqwk82w9w07fkm4d8dwcv85sf1m1phhj";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-darwin-arm64.tar.gz";
+        sha256 = "1ga7zvw6przmkbcpi3vq081g4bh8p4bzrfhi3jyxd6kh4slb3g9d";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-arm64.tar.gz";
+        sha256 = "1qaccfqw24g862ij2p49m78hnymg0j2nghshszqrg45v0d0qnknm";
+      }
+    ];
+  };
+}

pkgs/tools/admin/pulumi-bin/default.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  makeWrapper,
+  installShellFiles,
+}:
+
+let
+  data = import ./data.nix { };
+in
+stdenv.mkDerivation {
+  pname = "pulumi";
+  inherit (data) version;
+
+  postUnpack = ''
+    mv pulumi-* pulumi
+  '';
+
+  srcs = map fetchurl data.pulumiPkgs.${stdenv.hostPlatform.system};
+
+  installPhase = ''
+    install -D -t $out/bin/ *
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram $out/bin/pulumi --set LD_LIBRARY_PATH "${lib.getLib stdenv.cc.cc}/lib"
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd pulumi \
+      --bash <($out/bin/pulumi completion bash) \
+      --fish <($out/bin/pulumi completion fish) \
+      --zsh  <($out/bin/pulumi completion zsh)
+  '';
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    autoPatchelfHook
+    makeWrapper
+  ];
+  buildInputs = [ stdenv.cc.cc.libgcc or null ];
+
+  meta = with lib; {
+    homepage = "https://pulumi.io/";
+    description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = with licenses; [ asl20 ];
+    platforms = builtins.attrNames data.pulumiPkgs;
+    maintainers = with maintainers; [
+      ghuntley
+      peterromfeldhk
+      jlesquembre
+      cpcloud
+      wrbbz
+    ];
+    hydraPlatforms = [ ]; # Hydra fails with "Output limit exceeded"
+  };
+}

pkgs/tools/admin/pulumi-bin/update-pulumi-shell.nix

@@ -0,0 +1,9 @@
+{
+  nixpkgs ? import ../../../.. { },
+}:
+with nixpkgs;
+mkShell {
+  packages = [
+    pkgs.gh
+  ];
+}

pkgs/tools/admin/pulumi-bin/update.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env nix-shell
+#!nix-shell update-pulumi-shell.nix -i bash
+# shellcheck shell=bash
+# Bash 3 compatible for Darwin
+
+if [ -z "${GITHUB_TOKEN}" ] || [ $# -ne 1 ]; then
+  echo >&2 "usage: GITHUB_TOKEN=… ./update.sh pulumi-version"
+  exit 1
+fi
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Version of Pulumi from
+# https://www.pulumi.com/docs/get-started/install/versions/
+VERSION=$1
+
+# An array of plugin names. The respective repository inside Pulumi's
+# Github organization is called pulumi-$name by convention.
+
+declare -a pulumi_repos
+pulumi_repos=(
+  "aiven"
+  "akamai"
+  "alicloud"
+  "artifactory"
+  "auth0"
+  "aws"
+  "azure"
+  "azuread"
+  "azuredevops"
+  "cloudflare"
+  "consul"
+  "datadog"
+  "digitalocean"
+  "docker"
+  "equinix-metal"
+  "fastly"
+  "gcp"
+  "github"
+  "gitlab"
+  "google-native"
+  "hcloud"
+  "kubernetes"
+  "linode"
+  "mailgun"
+  "mysql"
+  "openstack"
+  "postgresql"
+  "random"
+  "snowflake"
+  "spotinst"
+  "sumologic"
+  "tailscale"
+  "tls"
+  "vault"
+  "venafi"
+  "vsphere"
+  "wavefront"
+  "yandex"
+)
+
+# Contains latest release ${VERSION} from
+# https://github.com/pulumi/pulumi-${NAME}/releases
+
+# Dynamically builds the plugin array, using the GitHub API for getting the
+# latest version.
+plugin_num=1
+plugins=()
+for key in "${pulumi_repos[@]}"; do
+  plugin="${key}=$(gh api "repos/pulumi/pulumi-${key}/releases/latest" --jq '.tag_name | sub("^v"; "")')"
+  printf "%20s: %s of %s\r" "${plugin}" "${plugin_num}" "${#pulumi_repos[@]}"
+  plugins+=("${plugin}")
+  sleep 1
+  ((++plugin_num))
+done
+printf "\n"
+
+function genMainSrc() {
+  local url="https://get.pulumi.com/releases/sdk/pulumi-v${VERSION}-${1}-${2}.tar.gz"
+  local sha256
+  sha256=$(nix-prefetch-url "$url")
+  echo "      {"
+  echo "        url = \"${url}\";"
+  echo "        sha256 = \"$sha256\";"
+  echo "      }"
+}
+
+function genSrc() {
+  local url="${1}"
+  local plug="${2}"
+  local tmpdir="${3}"
+
+  local sha256
+  sha256=$(nix-prefetch-url "$url")
+
+  {
+    if [ -n "$sha256" ]; then # file exists
+      echo "      {"
+      echo "        url = \"${url}\";"
+      echo "        sha256 = \"$sha256\";"
+      echo "      }"
+    else
+      echo "      # pulumi-resource-${plug} skipped (does not exist on remote)"
+    fi
+  } > "${tmpdir}/${plug}.nix"
+}
+
+function genSrcs() {
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+
+  for plugVers in "${plugins[@]}"; do
+    local plug=${plugVers%=*}
+    local version=${plugVers#*=}
+    # url as defined here
+    # https://github.com/pulumi/pulumi/blob/06d4dde8898b2a0de2c3c7ff8e45f97495b89d82/pkg/workspace/plugins.go#L197
+    local url="https://api.pulumi.com/releases/plugins/pulumi-resource-${plug}-v${version}-${1}-${2}.tar.gz"
+    genSrc "${url}" "${plug}" "${tmpdir}" &
+  done
+
+  wait
+
+  find "${tmpdir}" -name '*.nix' -print0 | sort -z | xargs -r0 cat
+  rm -r "${tmpdir}"
+}
+
+{
+  cat << EOF
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "${VERSION}";
+  pulumiPkgs = {
+EOF
+
+  echo "    x86_64-linux = ["
+  genMainSrc "linux" "x64"
+  genSrcs "linux" "amd64"
+  echo "    ];"
+
+  echo "    x86_64-darwin = ["
+  genMainSrc "darwin" "x64"
+  genSrcs "darwin" "amd64"
+  echo "    ];"
+
+  echo "    aarch64-linux = ["
+  genMainSrc "linux" "arm64"
+  genSrcs "linux" "arm64"
+  echo "    ];"
+
+  echo "    aarch64-darwin = ["
+  genMainSrc "darwin" "arm64"
+  genSrcs "darwin" "arm64"
+  echo "    ];"
+
+  echo "  };"
+  echo "}"
+
+} > "${SCRIPT_DIR}/data.nix"

pkgs/tools/admin/turbovnc/default.nix

@@ -0,0 +1,173 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nixosTests,
+
+  # Dependencies
+  bzip2,
+  cmake,
+  dri-pkgconfig-stub,
+  freetype,
+  libGL,
+  libgbm,
+  libjpeg_turbo,
+  makeWrapper,
+  mesa-gl-headers, # for built-in 3D software rendering using swrast
+  openjdk, # for the client with Java GUI
+  openjdk_headless, # for the server
+  openssh,
+  openssl,
+  pam,
+  perl,
+  pkg-config,
+  python3,
+  which,
+  xkbcomp,
+  xkeyboard_config,
+  xorg,
+  xterm,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "turbovnc";
+  version = "3.2.1";
+
+  src = fetchFromGitHub {
+    owner = "TurboVNC";
+    repo = "turbovnc";
+    rev = finalAttrs.version;
+    hash = "sha256-J+J4QRf21QLScgtwwSZCXoy0+6bwZFeXm4k4zk0h5Rs=";
+  };
+
+  # Notes:
+  # * SSH support does not require `openssh` on PATH, because turbovnc
+  #   uses a built-in SSH client ("JSch fork"), as commented on e.g.:
+  #   https://github.com/TurboVNC/turbovnc/releases/tag/3.2.1beta1
+  #
+  # TODO:
+  # * Build outputs that are unclear:
+  #   * `-- FONT_ENCODINGS_DIRECTORY = /var/empty/share/X11/fonts/encodings`
+  #     Maybe relevant what the tigervnc and tightvnc derivations
+  #     do with their `fontDirectories`?
+  #   * `XORG_REGISTRY_PATH = /var/empty/lib64/xorg`
+  #   * The thing about xorg `protocol.txt`
+  # * Add `enableClient ? true` flag that disables the client GUI
+  #   so that the server can be built without openjdk dependency.
+  # * Perhaps allow to build the client on non-Linux platforms.
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    openjdk_headless
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    bzip2
+    dri-pkgconfig-stub
+    freetype
+    libGL # for -DTVNC_SYSTEMX11=1
+    libgbm
+    libjpeg_turbo
+    openssl
+    pam
+    perl
+  ]
+  ++ (with xorg; [
+    libfontenc # for -DTVNC_SYSTEMX11=1
+    libSM
+    libX11
+    libXdamage # for -DTVNC_SYSTEMX11=1
+    libXdmcp # for -DTVNC_SYSTEMX11=1
+    libXext
+    libXfont2 # for -DTVNC_SYSTEMX11=1
+    libxkbfile # for -DTVNC_SYSTEMX11=1
+    libxshmfence
+    libXi
+    mesa-gl-headers # for -DTVNC_SYSTEMX11=1
+    pixman # for -DTVNC_SYSTEMX11=1
+    xorgproto
+    xtrans # for -DTVNC_SYSTEMX11=1
+  ]);
+
+  postPatch = ''
+    substituteInPlace unix/Xvnc/CMakeLists.txt --replace 'string(REGEX REPLACE "X11" "Xfont2" X11_Xfont2_LIB' 'set(X11_Xfont2_LIB ${xorg.libXfont2}/lib/libXfont2.so)  #'
+    substituteInPlace unix/Xvnc/CMakeLists.txt --replace 'string(REGEX REPLACE "X11" "fontenc" X11_Fontenc_LIB' 'set(X11_Fontenc_LIB ${xorg.libfontenc}/lib/libfontenc.so)  #'
+    substituteInPlace unix/Xvnc/CMakeLists.txt --replace 'string(REGEX REPLACE "X11" "pixman-1" X11_Pixman_LIB' 'set(X11_Pixman_LIB ${xorg.pixman}/lib/libpixman-1.so)  #'
+  '';
+
+  cmakeFlags = [
+    # For the 3D software rendering built into TurboVNC, pass the path
+    # to the swrast dri driver in Mesa.
+    # Can also be given at runtime to its `Xvnc` as:
+    #   -dridir /nix/store/...-mesa-20.1.10-drivers/lib/dri/
+    "-DXORG_DRI_DRIVER_PATH=${libGL.driverLink}/lib/dri"
+    # The build system doesn't find these files automatically.
+    "-DXKB_BASE_DIRECTORY=${xkeyboard_config}/share/X11/xkb"
+    "-DXKB_BIN_DIRECTORY=${xkbcomp}/bin"
+    # use system libs
+    # TurboVNC >= 3.1.4 no longer needs overrides to use system libraries
+    # instead of bundling them, see
+    # https://github.com/TurboVNC/turbovnc/releases/tag/3.2.1beta1:
+    # >  The TVNC_SYSTEMLIBS and TVNC_SYSTEMX11 CMake variables have been removed,
+    # > and the build system now behaves as if those variables are always on.
+    # > A new CMake variable (TVNC_ZLIBNG) can be used on x86 platforms
+    # > to disable the in-tree SIMD-accelerated zlib-ng implementation
+    # > and build against the system-supplied zlib implementation.
+    #
+    # We'd like to build against nixpkgs's `zlib-ng`, but if we pass
+    # `-DTVNC_ZLIBNG=0`, the above logic seems to imply that it looks
+    # for normal zlib as well, and the `./configure` output prints
+    #     -- zlib-ng disabled (TVNC_ZLIBNG = 0)
+    #     -- Found ZLIB: /nix/store/<...>/lib/libz.so (found version "1.3.1")
+    # so that seems to use normal `zlib`, even though it's not declared
+    # as a dependency here (probably it's part of `stdenv`).
+    # So for now, we use TruboVNC's in-tree `zlib-ng`.
+    #     "-DTVNC_ZLIBNG=0" # not given currently as explained above
+  ];
+
+  postInstall = ''
+    # turbovnc dlopen()s libssl.so depending on the requested encryption.
+    wrapProgram $out/bin/Xvnc \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl ]}
+
+    # `twm` is the default window manager that `vncserver` tries to start,
+    # and it has minimal dependencies (no non-Xorg).
+    # (This default is written by `vncserver` to `~/.vnc/xstartup.turbovnc`,
+    # see https://github.com/TurboVNC/turbovnc/blob/ffdb57d9/unix/vncserver.in#L201.)
+    # It checks for it using `which twm`.
+    # vncserver needs also needs `xauth` and we add in `xterm` for convenience
+    wrapProgram $out/bin/vncserver \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          which
+          xorg.twm
+          xorg.xauth
+          xterm
+        ]
+      }
+
+    # Patch /usr/bin/perl
+    patchShebangs $out/bin/vncserver
+
+    # The viewer is in Java and requires `JAVA_HOME` (which is a single
+    # path, cannot be multiple separated paths).
+    # For SSH support, `ssh` is required on `PATH`.
+    wrapProgram $out/bin/vncviewer \
+      --set JAVA_HOME "${lib.makeLibraryPath [ openjdk ]}/openjdk" \
+      --prefix PATH : ${lib.makeBinPath [ openssh ]}
+  '';
+
+  passthru.tests.turbovnc-headless-server = nixosTests.turbovnc-headless-server;
+
+  meta = {
+    homepage = "https://turbovnc.org/";
+    license = lib.licenses.gpl2Plus;
+    description = "High-speed version of VNC derived from TightVNC";
+    maintainers = with lib.maintainers; [ nh2 ];
+    platforms = with lib.platforms; linux;
+    changelog = "https://github.com/TurboVNC/turbovnc/blob/${finalAttrs.version}/ChangeLog.md";
+  };
+})

pkgs/tools/admin/winbox/default.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeBinaryWrapper,
+  wine,
+}:
+
+let
+  # The icon is also from the winbox AUR package (see above).
+  icon = fetchurl {
+    name = "winbox.png";
+    url = "https://aur.archlinux.org/cgit/aur.git/plain/winbox.png?h=winbox";
+    hash = "sha256-YD6u2N+1thRnEsXO6AHm138fRda9XEtUX5+EGTg004A=";
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "winbox";
+  version = "3.43";
+
+  src = fetchurl (
+    if (wine.meta.mainProgram == "wine64") then
+      {
+        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox64.exe";
+        hash = "sha256-W0HPUf2B6NCCaH9rUiFZz0q6IubfjtxIZyHU4JUHtuk=";
+      }
+    else
+      {
+        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox.exe";
+        hash = "sha256-pAOOTgmjQoXI2o2MKTDuOOpb7q0rb/zWATDNyAMOLms=";
+      }
+  );
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    copyDesktopItems
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,libexec,share/pixmaps}
+
+    ln -s "${icon}" "$out/share/pixmaps/winbox.png"
+
+    makeWrapper ${lib.getExe wine} $out/bin/winbox \
+      --add-flags $src
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "winbox";
+      desktopName = "Winbox";
+      comment = "GUI administration for Mikrotik RouterOS";
+      exec = "winbox";
+      icon = "winbox";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  meta = {
+    description = "Graphical configuration utility for RouterOS-based devices";
+    homepage = "https://mikrotik.com";
+    downloadPage = "https://mikrotik.com/download";
+    changelog = "https://wiki.mikrotik.com/wiki/Winbox_changelog";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    mainProgram = "winbox";
+    maintainers = with lib.maintainers; [ yrd ];
+  };
+})