push sheeet

2025-10-09 14:15:47 +02:00
commit 646b892680
49168 changed files with 5897842 additions and 0 deletions
--- a/pkgs/tools/misc/3llo/Gemfile
+++ b/pkgs/tools/misc/3llo/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem '3llo', '1.3.1'
--- a/pkgs/tools/misc/3llo/Gemfile.lock
+++ b/pkgs/tools/misc/3llo/Gemfile.lock
@@ -0,0 +1,27 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    3llo (1.3.1)
+      tty-prompt (~> 0.20)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
+    tty-color (0.6.0)
+    tty-cursor (0.7.1)
+    tty-prompt (0.23.1)
+      pastel (~> 0.8)
+      tty-reader (~> 0.8)
+    tty-reader (0.9.0)
+      tty-cursor (~> 0.7)
+      tty-screen (~> 0.8)
+      wisper (~> 2.0)
+    tty-screen (0.8.1)
+    wisper (2.0.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  3llo (= 1.3.1)
+
+BUNDLED WITH
+   2.2.33
--- a/pkgs/tools/misc/3llo/default.nix
+++ b/pkgs/tools/misc/3llo/default.nix
@@ -0,0 +1,16 @@
+{ lib, bundlerApp }:
+
+bundlerApp {
+  pname = "3llo";
+
+  gemdir = ./.;
+
+  exes = [ "3llo" ];
+
+  meta = with lib; {
+    description = "Trello interactive CLI on terminal";
+    license = licenses.mit;
+    homepage = "https://github.com/qcam/3llo";
+    maintainers = [ ];
+  };
+}
--- a/pkgs/tools/misc/3llo/gemset.nix
+++ b/pkgs/tools/misc/3llo/gemset.nix
@@ -0,0 +1,93 @@
+{
+  "3llo" = {
+    dependencies = [ "tty-prompt" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1w327skga2lpq9rbqqxy6w1r6k9k1l8prk5wmzrycvydn1wp7jk2";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  pastel = {
+    dependencies = [ "tty-color" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xash2gj08dfjvq4hy6l1z22s5v30fhizwgs10d6nviggpxsj7a8";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  tty-color = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0aik4kmhwwrmkysha7qibi2nyzb4c8kp42bd5vxnf8sf7b53g73g";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  tty-cursor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0j5zw041jgkmn605ya1zc151bxgxl6v192v2i26qhxx7ws2l2lvr";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+  tty-prompt = {
+    dependencies = [
+      "pastel"
+      "tty-reader"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1j4y8ik82azjxshgd4i1v4wwhsv3g9cngpygxqkkz69qaa8cxnzw";
+      type = "gem";
+    };
+    version = "0.23.1";
+  };
+  tty-reader = {
+    dependencies = [
+      "tty-cursor"
+      "tty-screen"
+      "wisper"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cf2k7w7d84hshg4kzrjvk9pkyc2g1m3nx2n1rpmdcf0hp4p4af6";
+      type = "gem";
+    };
+    version = "0.9.0";
+  };
+  tty-screen = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  wisper = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rpsi0ziy78cj82sbyyywby4d0aw0a5q84v65qd28vqn79fbq5yf";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
+}
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  ninja,
+  pkg-config,
+  perl,
+  go,
+  python3,
+  protobuf,
+  zlib,
+  gtest,
+  brotli,
+  lz4,
+  zstd,
+  pcre2,
+  fetchpatch2,
+  fmt,
+  udev,
+}:
+
+let
+  pythonEnv = python3.withPackages (ps: [ ps.protobuf ]);
+in
+
+stdenv.mkDerivation rec {
+  pname = "android-tools";
+  version = "35.0.2";
+
+  src = fetchurl {
+    url = "https://github.com/nmeum/android-tools/releases/download/${version}/android-tools-${version}.tar.xz";
+    hash = "sha256-0sMiIoAxXzbYv6XALXYytH42W/4ud+maNWT7ZXbwQJc=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/nmeum/android-tools/0c4d79943e23785589ce1881cbb5a9bc76d64d9b/patches/extras/0003-extras-libjsonpb-Fix-incompatibility-with-protobuf-v.patch";
+      stripLen = 1;
+      extraPrefix = "vendor/extras/";
+      hash = "sha256-PO6ZKP54ri2ujVa/uFXgMy/zMQjjIo4e/EPW2Cu6a1Q=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    perl
+    go
+  ];
+  buildInputs = [
+    protobuf
+    zlib
+    gtest
+    brotli
+    lz4
+    zstd
+    pcre2
+    fmt
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ udev ];
+  propagatedBuildInputs = [ pythonEnv ];
+
+  preConfigure = ''
+    export GOCACHE=$TMPDIR/go-cache
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeBool "CMAKE_FIND_PACKAGE_PREFER_CONFIG" true)
+    (lib.cmakeBool "protobuf_MODULE_COMPATIBLE" true)
+    (lib.cmakeBool "ANDROID_TOOLS_LIBUSB_ENABLE_UDEV" stdenv.hostPlatform.isLinux)
+    (lib.cmakeBool "ANDROID_TOOLS_USE_BUNDLED_LIBUSB" true)
+  ];
+
+  meta = {
+    description = "Android SDK platform tools";
+    longDescription = ''
+      Android SDK Platform-Tools is a component for the Android SDK. It
+      includes tools that interface with the Android platform, such as adb and
+      fastboot. These tools are required for Android app development. They're
+      also needed if you want to unlock your device bootloader and flash it
+      with a new system image.
+      Currently the following tools are supported:
+      - adb
+      - fastboot
+      - mke2fs.android (required by fastboot)
+      - simg2img, img2simg, append2simg
+      - lpdump, lpmake, lpadd, lpflash, lpunpack
+      - mkbootimg, unpack_bootimg, repack_bootimg, avbtool
+      - mkdtboimg
+    '';
+    # https://developer.android.com/studio/command-line#tools-platform
+    # https://developer.android.com/studio/releases/platform-tools
+    homepage = "https://github.com/nmeum/android-tools";
+    license = with lib.licenses; [
+      asl20
+      unicode-dfs-2015
+      mit
+    ];
+    platforms = lib.platforms.unix;
+    teams = [ lib.teams.android ];
+  };
+}
--- a/pkgs/tools/misc/antimicrox/default.nix
+++ b/pkgs/tools/misc/antimicrox/default.nix
@@ -0,0 +1,54 @@
+{
+  mkDerivation,
+  lib,
+  cmake,
+  extra-cmake-modules,
+  pkg-config,
+  SDL2,
+  qttools,
+  xorg,
+  fetchFromGitHub,
+  itstool,
+  udevCheckHook,
+}:
+
+mkDerivation rec {
+  pname = "antimicrox";
+  version = "3.5.1";
+
+  src = fetchFromGitHub {
+    owner = "AntiMicroX";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-ZIHhgyOpabWkdFZoha/Hj/1d8/b6qVolE6dn0xAFZVw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    pkg-config
+    itstool
+    udevCheckHook
+  ];
+  buildInputs = [
+    SDL2
+    qttools
+    xorg.libXtst
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+        --replace "/usr/lib/udev/rules.d/" "$out/lib/udev/rules.d/"
+  '';
+
+  doInstallCheck = true;
+
+  meta = with lib; {
+    description = "GUI for mapping keyboard and mouse controls to a gamepad";
+    inherit (src.meta) homepage;
+    maintainers = with maintainers; [ sbruder ];
+    license = licenses.gpl3Plus;
+    platforms = with platforms; linux;
+    mainProgram = "antimicrox";
+  };
+}
--- a/pkgs/tools/misc/anystyle-cli/Gemfile
+++ b/pkgs/tools/misc/anystyle-cli/Gemfile
@@ -0,0 +1,10 @@
+source 'https://rubygems.org'
+gemspec
+
+group :development, :test do
+  gem 'anystyle', github: 'inukshuk/anystyle'
+end
+
+group :debug do
+  gem 'debug', require: false
+end
--- a/pkgs/tools/misc/anystyle-cli/Gemfile.lock
+++ b/pkgs/tools/misc/anystyle-cli/Gemfile.lock
@@ -0,0 +1,70 @@
+GIT
+  remote: https://github.com/inukshuk/anystyle.git
+  revision: c6f5fb2fa6e8ce9456ad1e1e88d6bba5f3d7731d
+  specs:
+    anystyle (1.6.0)
+      anystyle-data (~> 1.3)
+      bibtex-ruby (~> 6.0)
+      namae (~> 1.0)
+      wapiti (~> 2.1)
+
+PATH
+  remote: .
+  specs:
+    anystyle-cli (1.5.0)
+      anystyle (~> 1.6)
+      gli (~> 2.17)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    anystyle-data (1.3.0)
+    bibtex-ruby (6.1.0)
+      latex-decode (~> 0.0)
+      racc (~> 1.7)
+    builder (3.3.0)
+    date (3.4.1)
+    debug (1.10.0)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    erb (5.0.1)
+    gli (2.22.2)
+      ostruct
+    io-console (0.8.0)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    latex-decode (0.4.0)
+    namae (1.2.0)
+      racc (~> 1.7)
+    ostruct (0.6.1)
+    pp (0.6.2)
+      prettyprint
+    prettyprint (0.2.0)
+    psych (5.2.6)
+      date
+      stringio
+    racc (1.8.1)
+    rdoc (6.14.0)
+      erb
+      psych (>= 4.0.0)
+    reline (0.6.1)
+      io-console (~> 0.5)
+    rexml (3.4.1)
+    stringio (3.1.7)
+    wapiti (2.1.0)
+      builder (~> 3.2)
+      rexml (~> 3.0)
+
+PLATFORMS
+  arm64-darwin-24
+  ruby
+
+DEPENDENCIES
+  anystyle!
+  anystyle-cli!
+  debug
+
+BUNDLED WITH
+   2.5.22
--- a/pkgs/tools/misc/anystyle-cli/anystyle-cli.gemspec
+++ b/pkgs/tools/misc/anystyle-cli/anystyle-cli.gemspec
@@ -0,0 +1,32 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib/', __FILE__)
+$:.unshift lib unless $:.include?(lib)
+
+require 'anystyle/cli/version'
+
+Gem::Specification.new do |s|
+  s.name         = 'anystyle-cli'
+  s.version      = AnyStyle::CLI::VERSION.dup
+  s.platform     = Gem::Platform::RUBY
+  s.authors      = ['Sylvester Keil']
+  s.email        = ['http://sylvester.keil.or.at']
+  s.homepage     = 'http://anystyle.io'
+  s.summary      = 'AnyStyle CLI'
+  s.description  = 'A command line interface to the AnyStyle Parser and Finder.'
+  s.license      = 'BSD-2-Clause'
+  s.require_path = 'lib'
+  s.bindir       = 'bin'
+  s.executables  = ['anystyle']
+  s.required_ruby_version = '>= 2.3'
+
+  s.add_runtime_dependency('anystyle', '~>1.6')
+  s.add_runtime_dependency('gli', '~>2.17')
+
+  s.files = `git ls-files`.split("\n") - %w{
+    .gitignore
+    Gemfile
+    anystyle-cli.gemspec
+  }
+end
+
+# vim: syntax=ruby
--- a/pkgs/tools/misc/anystyle-cli/default.nix
+++ b/pkgs/tools/misc/anystyle-cli/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildRubyGem,
+  bundlerEnv,
+  ruby,
+  poppler-utils,
+}:
+let
+  deps = bundlerEnv rec {
+    name = "anystyle-cli-${version}";
+    source.sha256 = lib.fakeSha256;
+    version = "1.5.0";
+    inherit ruby;
+    gemdir = ./.;
+    gemset = lib.recursiveUpdate (import ./gemset.nix) {
+      anystyle.source = {
+        remotes = [ "https://rubygems.org" ];
+        sha256 = "C/OrU7guHzHdY80upEXRfhWmUYDxpI54NIvIjKv0znw=";
+        type = "gem";
+      };
+    };
+  };
+in
+buildRubyGem rec {
+  inherit ruby;
+  gemName = "anystyle-cli";
+  pname = gemName;
+  version = "1.5.0";
+  source.sha256 = "Bkk00PBk/6noCXgAbr1XUcdBq5vpdeL0ES02eeNA594=";
+
+  propagatedBuildInputs = [ deps ];
+
+  preFixup = ''
+    wrapProgram $out/bin/anystyle --prefix PATH : ${poppler-utils}/bin
+  '';
+
+  meta = with lib; {
+    description = "Command line interface to the AnyStyle Parser and Finder";
+    homepage = "https://anystyle.io/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [
+      aschleck
+      shamilton
+    ];
+    mainProgram = "anystyle";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/anystyle-cli/gemset.nix
+++ b/pkgs/tools/misc/anystyle-cli/gemset.nix
@@ -0,0 +1,316 @@
+{
+  anystyle = {
+    dependencies = [
+      "anystyle-data"
+      "bibtex-ruby"
+      "namae"
+      "wapiti"
+    ];
+    groups = [
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      fetchSubmodules = false;
+      rev = "c6f5fb2fa6e8ce9456ad1e1e88d6bba5f3d7731d";
+      sha256 = "1fshijsay20dqcvjwrdifv6z1w4xyc3j2rn3648cvq57gjrmxwl2";
+      type = "git";
+      url = "https://github.com/inukshuk/anystyle.git";
+    };
+    version = "1.6.0";
+  };
+  anystyle-cli = {
+    dependencies = [
+      "anystyle"
+      "gli"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      path = ./.;
+      type = "path";
+    };
+    version = "1.5.0";
+  };
+  anystyle-data = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0l28mxgcfdbcrb4w0vn293spwxff9ahcmxfs5cws2yq0w5x656y4";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  bibtex-ruby = {
+    dependencies = [
+      "latex-decode"
+      "racc"
+    ];
+    groups = [ "extra" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ggx2j1gi46f1a6p45l1abk3nryfg1pj0cdlyrnilnqqpr1cfc96";
+      type = "gem";
+    };
+    version = "6.1.0";
+  };
+  builder = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pw3r2lyagsxkm71bf44v5b74f7l9r7di22brbyji9fwz791hya9";
+      type = "gem";
+    };
+    version = "3.3.0";
+  };
+  date = {
+    groups = [
+      "debug"
+      "default"
+      "extra"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kz6mc4b9m49iaans6cbx031j9y7ldghpi5fzsdh0n3ixwa8w9mz";
+      type = "gem";
+    };
+    version = "3.4.1";
+  };
+  debug = {
+    dependencies = [
+      "irb"
+      "reline"
+    ];
+    groups = [ "debug" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1977s95s9ns6mpbhg68pg6ggnpxxf8wly4244ihrx5vm92kqrqhi";
+      type = "gem";
+    };
+    version = "1.10.0";
+  };
+  erb = {
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08rc8pzri3g7c85c76x84j05hkk12jvalrm2m3n97k1n7f03j13n";
+      type = "gem";
+    };
+    version = "5.0.1";
+  };
+  gli = {
+    dependencies = [ "ostruct" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1c2x5wh3d3mz8vg5bs7c5is0zvc56j6a2b4biv5z1w5hi1n8s3jq";
+      type = "gem";
+    };
+    version = "2.22.2";
+  };
+  io-console = {
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18pgvl7lfjpichdfh1g50rpz0zpaqrpr52ybn9liv1v9pjn9ysnd";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  irb = {
+    dependencies = [
+      "pp"
+      "rdoc"
+      "reline"
+    ];
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1fpxa2m83rb7xlzs57daqwnzqjmz6j35xr7zb15s73975sak4br2";
+      type = "gem";
+    };
+    version = "1.15.2";
+  };
+  latex-decode = {
+    groups = [
+      "default"
+      "extra"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1y5xn3zwghpqr6lvs4s0mn5knms8zw3zk7jb58zkkiagb386nq72";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  namae = {
+    dependencies = [ "racc" ];
+    groups = [
+      "default"
+      "extra"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17fmp6p74ai2w984xayv3kz2nh44w81hqqvn4cfrim3g115wwh9m";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  ostruct = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05xqijcf80sza5pnlp1c8whdaay8x5dc13214ngh790zrizgp8q9";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  pp = {
+    dependencies = [ "prettyprint" ];
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zxnfxjni0r9l2x42fyq0sqpnaf5nakjbap8irgik4kg1h9c6zll";
+      type = "gem";
+    };
+    version = "0.6.2";
+  };
+  prettyprint = {
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14zicq3plqi217w6xahv7b8f7aj5kpxv1j1w98344ix9h5ay3j9b";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  psych = {
+    dependencies = [
+      "date"
+      "stringio"
+    ];
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vii1xc7x81hicdbp7dlllhmbw5w3jy20shj696n0vfbbnm2hhw1";
+      type = "gem";
+    };
+    version = "5.2.6";
+  };
+  racc = {
+    groups = [
+      "default"
+      "extra"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "psych"
+    ];
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nyp5vc9nm46nc3aq58f2lackgbip4ynxmznzi1qg6qjsxcdwiic";
+      type = "gem";
+    };
+    version = "6.14.0";
+  };
+  reline = {
+    dependencies = [ "io-console" ];
+    groups = [
+      "debug"
+      "default"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yvm0svcdk6377ng6l00g39ldkjijbqg4whdg2zcsa8hrgbwkz0s";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  rexml = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      type = "gem";
+    };
+    version = "3.4.1";
+  };
+  stringio = {
+    groups = [
+      "debug"
+      "default"
+      "extra"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yh78pg6lm28c3k0pfd2ipskii1fsraq46m6zjs5yc9a4k5vfy2v";
+      type = "gem";
+    };
+    version = "3.1.7";
+  };
+  wapiti = {
+    dependencies = [
+      "builder"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19bh7nb05pbkix43i7alfg8pzcqid31q5q0g06x2my7gcj79nhad";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+}
--- a/pkgs/tools/misc/bat-extras/buildBatExtrasPkg.nix
+++ b/pkgs/tools/misc/bat-extras/buildBatExtrasPkg.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  core,
+
+  bash,
+  bat,
+  fish,
+  getconf,
+  makeWrapper,
+  zsh,
+}:
+let
+  cleanArgs = lib.flip removeAttrs [
+    "dependencies"
+    "meta"
+  ];
+in
+{
+  name,
+  dependencies,
+  meta ? { },
+  ...
+}@args:
+stdenv.mkDerivation (
+  finalAttrs:
+  cleanArgs args
+  // {
+    inherit (core) version;
+
+    src = core;
+
+    nativeBuildInputs = [ makeWrapper ];
+    # Make the dependencies available to the tests.
+    buildInputs = dependencies;
+
+    # Patch shebangs now because our tests rely on them
+    postPatch = ''
+      patchShebangs --host bin/${name}
+    '';
+
+    dontConfigure = true;
+    dontBuild = true; # we've already built
+
+    doCheck = true;
+    nativeCheckInputs = [
+      bat
+      bash
+      fish
+      zsh
+    ]
+    ++ (lib.optionals stdenv.hostPlatform.isDarwin [ getconf ]);
+    checkPhase = ''
+      runHook preCheck
+      bash ./test.sh --compiled --suite ${name}
+      runHook postCheck
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      cp -p bin/${name} $out/bin/${name}
+    ''
+    + lib.optionalString (dependencies != [ ]) ''
+      wrapProgram $out/bin/${name} \
+        --prefix PATH : ${lib.makeBinPath dependencies}
+    ''
+    + ''
+      runHook postInstall
+    '';
+
+    # We already patched
+    dontPatchShebangs = true;
+
+    meta = core.meta // { mainProgram = name; } // meta;
+  }
+)
--- a/pkgs/tools/misc/bat-extras/default.nix
+++ b/pkgs/tools/misc/bat-extras/default.nix
@@ -0,0 +1,11 @@
+self: {
+  buildBatExtrasPkg = self.callPackage ./buildBatExtrasPkg.nix { };
+
+  core = self.callPackage ./modules/core.nix { };
+  batdiff = self.callPackage ./modules/batdiff.nix { };
+  batgrep = self.callPackage ./modules/batgrep.nix { };
+  batman = self.callPackage ./modules/batman.nix { };
+  batpipe = self.callPackage ./modules/batpipe.nix { };
+  batwatch = self.callPackage ./modules/batwatch.nix { };
+  prettybat = self.callPackage ./modules/prettybat.nix { };
+}
--- a/pkgs/tools/misc/bat-extras/modules/batdiff.nix
+++ b/pkgs/tools/misc/bat-extras/modules/batdiff.nix
@@ -0,0 +1,19 @@
+{
+  lib,
+  buildBatExtrasPkg,
+  less,
+  coreutils,
+  gitMinimal,
+  delta,
+  withDelta ? true,
+}:
+buildBatExtrasPkg {
+  name = "batdiff";
+  dependencies = [
+    less
+    coreutils
+    gitMinimal
+  ]
+  ++ lib.optional withDelta delta;
+  meta.description = "Diff a file against the current git index, or display the diff between two files";
+}
--- a/pkgs/tools/misc/bat-extras/modules/batgrep.nix
+++ b/pkgs/tools/misc/bat-extras/modules/batgrep.nix
@@ -0,0 +1,15 @@
+{
+  buildBatExtrasPkg,
+  less,
+  coreutils,
+  ripgrep,
+}:
+buildBatExtrasPkg {
+  name = "batgrep";
+  dependencies = [
+    less
+    coreutils
+    ripgrep
+  ];
+  meta.description = "Quickly search through and highlight files using ripgrep";
+}
--- a/pkgs/tools/misc/bat-extras/modules/batman.nix
+++ b/pkgs/tools/misc/bat-extras/modules/batman.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  stdenv,
+  buildBatExtrasPkg,
+  util-linux,
+}:
+buildBatExtrasPkg {
+  name = "batman";
+  dependencies = lib.optional stdenv.targetPlatform.isLinux util-linux;
+  meta.description = "Read system manual pages (man) using bat as the manual page formatter";
+}
--- a/pkgs/tools/misc/bat-extras/modules/batpipe.nix
+++ b/pkgs/tools/misc/bat-extras/modules/batpipe.nix
@@ -0,0 +1,9 @@
+{
+  buildBatExtrasPkg,
+  less,
+}:
+buildBatExtrasPkg {
+  name = "batpipe";
+  dependencies = [ less ];
+  meta.description = "Less (and soon bat) preprocessor for viewing more types of files in the terminal";
+}
--- a/pkgs/tools/misc/bat-extras/modules/batwatch.nix
+++ b/pkgs/tools/misc/bat-extras/modules/batwatch.nix
@@ -0,0 +1,18 @@
+{
+  lib,
+  buildBatExtrasPkg,
+  less,
+  coreutils,
+  entr,
+
+  withEntr ? true,
+}:
+buildBatExtrasPkg {
+  name = "batwatch";
+  dependencies = [
+    less
+    coreutils
+  ]
+  ++ lib.optional withEntr entr;
+  meta.description = "Watch for changes in one or more files, and print them with bat";
+}
--- a/pkgs/tools/misc/bat-extras/modules/core.nix
+++ b/pkgs/tools/misc/bat-extras/modules/core.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  bash,
+  bat,
+  fish,
+  getconf,
+  nix-update-script,
+  zsh,
+}:
+stdenv.mkDerivation rec {
+  pname = "bat-extras";
+  version = "2024.08.24";
+
+  src = fetchFromGitHub {
+    owner = "eth-p";
+    repo = "bat-extras";
+    tag = "v${version}";
+    hash = "sha256-xkND/w6UNC58dC8WrsifwjqU9ZI4yUUq+ZljkhhUNT8=";
+    fetchSubmodules = true;
+  };
+
+  # bat needs to be in the PATH during building so EXECUTABLE_BAT picks it up
+  nativeBuildInputs = [ bat ];
+
+  dontConfigure = true;
+
+  patches = [ ../patches/disable-theme-tests.patch ];
+
+  postPatch = ''
+    patchShebangs --build test.sh test/shimexec .test-framework/bin/best.sh
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    bash ./build.sh --minify=none --no-verify
+    runHook postBuild
+  '';
+
+  # Run the library tests as they don't have external dependencies
+  doCheck = true;
+  nativeCheckInputs = [
+    bash
+    fish
+    zsh
+  ]
+  ++ (lib.optionals stdenv.hostPlatform.isDarwin [ getconf ]);
+  checkPhase = ''
+    runHook preCheck
+    # test list repeats suites. Unique them
+    declare -A test_suites
+    while read -r action arg _; do
+      [[ "$action" == "test_suite" && "$arg" == lib_* ]] &&
+      test_suites+=(["$arg"]=1)
+    done <<<"$(./test.sh --compiled --list --porcelain)"
+    (( ''${#test_suites[@]} != 0 )) || {
+      echo "Couldn't find any library test suites"
+      exit 1
+    }
+    ./test.sh --compiled $(printf -- "--suite %q\n" "''${!test_suites[@]}")
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    cp -a . $out
+    runHook postInstall
+  '';
+
+  # A few random files have shebangs. Don't patch them, they don't make it into the final output.
+  # The per-script derivations will go ahead and patch the files they actually install.
+  dontPatchShebangs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Bash scripts that integrate bat with various command line tools";
+    homepage = "https://github.com/eth-p/bat-extras";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
+      bbigras
+      perchun
+    ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/tools/misc/bat-extras/modules/prettybat.nix
+++ b/pkgs/tools/misc/bat-extras/modules/prettybat.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  buildBatExtrasPkg,
+  shfmt,
+  clang-tools,
+  prettier,
+  rustfmt,
+
+  withShFmt ? true,
+  withPrettier ? true,
+  withClangTools ? true,
+  withRustFmt ? true,
+}:
+buildBatExtrasPkg {
+  name = "prettybat";
+  dependencies =
+    lib.optional withShFmt shfmt
+    ++ lib.optional withPrettier prettier
+    ++ lib.optional withClangTools clang-tools
+    ++ lib.optional withRustFmt rustfmt;
+  meta.description = "Pretty-print source code and highlight it with bat";
+}
--- a/pkgs/tools/misc/bat-extras/patches/disable-theme-tests.patch
+++ b/pkgs/tools/misc/bat-extras/patches/disable-theme-tests.patch
@@ -0,0 +1,42 @@
+Subject: [PATCH] skip tests depending on color theme
+===================================================================
+diff --git a/test/suite/batpipe.sh b/test/suite/batpipe.sh
+--- a/test/suite/batpipe.sh	(revision 36c77c171cc71b2ff3ec4cb781aa16ca3ad258b1)
+++ b/test/suite/batpipe.sh	(date 1736621098865)
+@@ -29,6 +29,7 @@
+ test:batpipe_term_width() {
+ 	description "Test support for BATPIPE_TERM_WIDTH"
+ 	snapshot STDOUT
+	skip "bat-extras does not support `--theme` flag"
+
+ 	export BATPIPE=color
+ 	export BATPIPE_DEBUG_PARENT_EXECUTABLE=less
+Index: test/suite/batgrep.sh
+===================================================================
+diff --git a/test/suite/batgrep.sh b/test/suite/batgrep.sh
+--- a/test/suite/batgrep.sh	(revision 36c77c171cc71b2ff3ec4cb781aa16ca3ad258b1)
+++ b/test/suite/batgrep.sh	(date 1736621086239)
+@@ -58,6 +58,7 @@
+ 	description "Snapshot test for colored output."
+ 	snapshot stdout
+ 	snapshot stderr
+	skip "bat-extras does not support `--theme` flag"
+
+ 	require_rg
+
+@@ -118,6 +119,7 @@
+ 	description "Should respect the BAT_STYLE variable."
+ 	snapshot stdout
+ 	snapshot stderr
+	skip "bat-extras does not support `--theme` flag"
+
+ 	require_rg
+
+@@ -128,6 +130,7 @@
+ 	description "Snapshot test for output without separator"
+ 	snapshot stdout
+ 	snapshot stderr
+	skip "bat-extras does not support `--theme` flag"
+
+ 	require_rg
+
--- a/pkgs/tools/misc/birdfont/default.nix
+++ b/pkgs/tools/misc/birdfont/default.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  python3,
+  xmlbird,
+  cairo,
+  gdk-pixbuf,
+  libgee,
+  glib,
+  gtk3,
+  webkitgtk_4_1,
+  libnotify,
+  sqlite,
+  vala,
+  gobject-introspection,
+  gsettings-desktop-schemas,
+  wrapGAppsHook3,
+  autoPatchelfHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "birdfont";
+  version = "2.33.6";
+
+  src = fetchFromGitHub {
+    owner = "johanmattssonm";
+    repo = "birdfont";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-7xVjY/yH7pMlUBpQc5Gb4t4My24Mx5KkARVp2KSr+Iw=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    pkg-config
+    vala
+    gobject-introspection
+    wrapGAppsHook3
+    autoPatchelfHook
+  ];
+  buildInputs = [
+    xmlbird
+    libgee
+    cairo
+    gdk-pixbuf
+    glib
+    gtk3
+    webkitgtk_4_1
+    libnotify
+    sqlite
+    gsettings-desktop-schemas
+  ];
+
+  postPatch = ''
+    substituteInPlace install.py \
+      --replace 'platform.version()' '"Nix"'
+
+    patchShebangs .
+  '';
+
+  buildPhase = "./build.py";
+
+  installPhase = "./install.py";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Font editor which can generate fonts in TTF, EOT, SVG and BIRDFONT format";
+    homepage = "https://birdfont.org";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+})
--- a/pkgs/tools/misc/birdfont/xmlbird.nix
+++ b/pkgs/tools/misc/birdfont/xmlbird.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  python3,
+  pkg-config,
+  vala,
+  glib,
+  gobject-introspection,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "xmlbird";
+  version = "1.2.15";
+
+  src = fetchurl {
+    url = "https://birdfont.org/${pname}-releases/lib${pname}-${version}.tar.xz";
+    sha256 = "sha256-8GX4ijF+AxaGGFlSxRPOAoUezRG6592jOrifz/mWTRM=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    pkg-config
+    vala
+    gobject-introspection
+  ];
+
+  buildInputs = [ glib ];
+
+  postPatch = ''
+    substituteInPlace configure \
+      --replace 'platform.dist()[0]' '"nix"'
+    patchShebangs .
+  '';
+
+  buildPhase = "./build.py";
+
+  installPhase = "./install.py";
+
+  meta = with lib; {
+    description = "XML parser for Vala and C programs";
+    homepage = "https://birdfont.org/xmlbird.php";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
--- a/pkgs/tools/misc/chef-cli/Gemfile
+++ b/pkgs/tools/misc/chef-cli/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem "chef-cli"
--- a/pkgs/tools/misc/chef-cli/Gemfile.lock
+++ b/pkgs/tools/misc/chef-cli/Gemfile.lock
@@ -0,0 +1,383 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (7.0.8.7)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    ast (2.4.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1110.0)
+    aws-sdk-core (3.225.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.102.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.189.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-secretsmanager (1.116.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    base64 (0.3.0)
+    bigdecimal (3.2.1)
+    builder (3.3.0)
+    chef (18.7.10)
+      addressable
+      aws-sdk-s3 (~> 1.91)
+      aws-sdk-secretsmanager (~> 1.46)
+      chef-config (= 18.7.10)
+      chef-utils (= 18.7.10)
+      chef-vault
+      chef-zero (>= 15.0.17)
+      corefoundation (~> 0.3.4)
+      diff-lcs (>= 1.2.4, < 1.6.0, != 1.4.0)
+      erubis (~> 2.7)
+      ffi (>= 1.15.5, <= 1.16.3)
+      ffi-libarchive (~> 1.0, >= 1.0.3)
+      ffi-yajl (~> 2.2)
+      iniparse (~> 1.4)
+      inspec-core (>= 5, < 6)
+      license-acceptance (>= 1.0.5, < 3)
+      mixlib-archive (>= 0.4, < 2.0)
+      mixlib-authentication (>= 2.1, < 4)
+      mixlib-cli (>= 2.1.1, < 3.0)
+      mixlib-log (>= 2.0.3, < 3.2)
+      mixlib-shellout (>= 3.1.1, < 4.0)
+      net-ftp
+      net-sftp (>= 2.1.2, < 5.0)
+      ohai (~> 18.0)
+      plist (~> 3.2)
+      proxifier2 (~> 1.1)
+      syslog-logger (~> 1.6)
+      train-core (~> 3.10, <= 3.12.13)
+      train-rest (>= 0.4.1)
+      train-winrm (~> 0.2.17)
+      unf_ext (~> 0.0.8.2)
+      uuidtools (>= 2.1.5, < 3.0)
+      vault (~> 0.18.2)
+    chef-cli (5.6.21)
+      addressable (>= 2.3.5, < 2.9)
+      chef (~> 18.0)
+      cookbook-omnifetch (~> 0.5)
+      diff-lcs (>= 1.2.4, < 1.6.0, != 1.4.0)
+      ffi-yajl (>= 1.0, < 3.0)
+      license-acceptance (>= 1.0.11, < 3)
+      minitar (~> 1.0)
+      mixlib-cli (>= 1.7, < 3.0)
+      mixlib-shellout (>= 2.0, < 4.0)
+      pastel (~> 0.7)
+      solve (> 2.0, < 5.0)
+    chef-config (18.7.10)
+      addressable
+      chef-utils (= 18.7.10)
+      fuzzyurl
+      mixlib-config (>= 2.2.12, < 4.0)
+      mixlib-shellout (>= 2.0, < 4.0)
+      tomlrb (~> 1.2)
+    chef-gyoku (1.4.5)
+      builder (>= 2.1.2)
+      rexml (~> 3.4)
+    chef-telemetry (1.1.1)
+      chef-config
+      concurrent-ruby (~> 1.0)
+    chef-utils (18.7.10)
+      concurrent-ruby
+    chef-vault (4.1.23)
+    chef-winrm (2.3.12)
+      builder (>= 2.1.2)
+      chef-gyoku (~> 1.4.0, <= 1.4.5)
+      erubi (~> 1.8)
+      ffi (>= 1.15.5, < 1.17.0)
+      gssapi (~> 1.2)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (= 2.7.0)
+      rexml (~> 3.3)
+      rubyntlm (~> 0.6.0, >= 0.6.3)
+    chef-winrm-elevated (1.2.5)
+      chef-winrm (>= 2.3.11)
+      chef-winrm-fs (>= 1.3.7)
+      erubi (~> 1.8)
+    chef-winrm-fs (1.3.7)
+      chef-winrm (>= 2.3.11)
+      erubi (>= 1.7)
+      logging (>= 1.6.1, < 3.0)
+      rubyzip (~> 2.0)
+    chef-zero (15.0.17)
+      activesupport (~> 7.0, < 7.1)
+      ffi-yajl (~> 2.2)
+      hashie (>= 2.0, < 5.0)
+      mixlib-log (>= 2.0, < 4.0)
+      rack (~> 3.1, >= 3.1.10)
+      rackup (~> 2.2, >= 2.2.1)
+      uuidtools (~> 2.1)
+      webrick
+    coderay (1.1.3)
+    concurrent-ruby (1.3.5)
+    cookbook-omnifetch (0.12.2)
+      mixlib-archive (>= 0.4, < 2.0)
+    cookstyle (8.1.4)
+      rubocop (= 1.75.8)
+    corefoundation (0.3.13)
+      ffi (>= 1.15.0)
+    date (3.4.1)
+    diff-lcs (1.5.1)
+    domain_name (0.6.20240107)
+    erubi (1.13.1)
+    erubis (2.7.0)
+    faraday (2.13.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
+    ffi (1.16.3)
+    ffi-libarchive (1.1.14)
+      ffi (~> 1.0)
+    ffi-yajl (2.6.0)
+      libyajl2 (>= 1.2)
+    fuzzyurl (0.9.0)
+    gssapi (1.3.1)
+      ffi (>= 1.0.1)
+    hashie (4.1.0)
+    http-accept (1.7.0)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    i18n (1.14.7)
+      concurrent-ruby (~> 1.0)
+    iniparse (1.5.0)
+    inspec-core (5.22.80)
+      addressable (~> 2.4)
+      chef-telemetry (~> 1.0, >= 1.0.8)
+      cookstyle
+      faraday (>= 1, < 3)
+      faraday-follow_redirects (~> 0.3)
+      hashie (>= 3.4, < 6.0)
+      license-acceptance (>= 0.2.13, < 3.0)
+      method_source (>= 0.8, < 2.0)
+      mixlib-log (~> 3.0, < 3.2)
+      multipart-post (~> 2.0)
+      parallel (~> 1.9)
+      parslet (>= 1.5, < 3.0)
+      pry (~> 0.13)
+      rspec (>= 3.9, <= 3.12)
+      rspec-its (~> 1.2)
+      rubyzip (>= 1.2.2, < 3.0)
+      semverse (~> 3.0)
+      sslshake (~> 1.2)
+      thor (>= 0.20, < 1.3.0)
+      tomlrb (>= 1.2, < 2.1)
+      train-core (~> 3.12.13)
+      tty-prompt (~> 0.17)
+      tty-table (~> 0.10)
+    ipaddress (0.8.3)
+    jmespath (1.6.2)
+    json (2.12.2)
+    language_server-protocol (3.17.0.5)
+    libyajl2 (2.1.0)
+    license-acceptance (2.1.13)
+      pastel (~> 0.7)
+      tomlrb (>= 1.2, < 3.0)
+      tty-box (~> 0.6)
+      tty-prompt (~> 0.20)
+    lint_roller (1.1.0)
+    little-plugger (1.1.4)
+    logger (1.7.0)
+    logging (2.4.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.14)
+    method_source (1.1.0)
+    mime-types (3.7.0)
+      logger
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2025.0527)
+    minitar (1.0.2)
+    minitest (5.25.5)
+    mixlib-archive (1.1.7)
+      mixlib-log
+    mixlib-authentication (3.0.10)
+    mixlib-cli (2.1.8)
+    mixlib-config (3.0.27)
+      tomlrb
+    mixlib-log (3.1.2.1)
+      ffi (< 1.17.0)
+    mixlib-shellout (3.3.9)
+      chef-utils
+    molinillo (0.8.0)
+    multi_json (1.15.0)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    net-ftp (0.3.8)
+      net-protocol
+      time
+    net-http (0.6.0)
+      uri
+    net-protocol (0.2.2)
+      timeout
+    net-scp (4.1.0)
+      net-ssh (>= 2.6.5, < 8.0.0)
+    net-sftp (4.0.0)
+      net-ssh (>= 5.0.0, < 8.0.0)
+    net-ssh (7.3.0)
+    netrc (0.11.0)
+    nori (2.7.0)
+      bigdecimal
+    ohai (18.2.6)
+      chef-config (>= 14.12, < 19)
+      chef-utils (>= 16.0, < 19)
+      ffi (~> 1.9, <= 1.17.0)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli (>= 1.7.0)
+      mixlib-config (>= 2.0, < 4.0)
+      mixlib-log (>= 2.0.1, < 4.0)
+      mixlib-shellout (~> 3.2, >= 3.2.5)
+      plist (~> 3.1)
+      train-core
+      wmi-lite (~> 1.0)
+    parallel (1.27.0)
+    parser (3.3.8.0)
+      ast (~> 2.4.1)
+      racc
+    parslet (2.0.0)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
+    plist (3.7.2)
+    prism (1.4.0)
+    proxifier2 (1.1.0)
+    pry (0.15.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    public_suffix (6.0.2)
+    racc (1.8.1)
+    rack (3.1.15)
+    rackup (2.2.1)
+      rack (>= 3)
+    rainbow (3.1.1)
+    regexp_parser (2.10.0)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
+    rexml (3.4.1)
+    rspec (3.12.0)
+      rspec-core (~> 3.12.0)
+      rspec-expectations (~> 3.12.0)
+      rspec-mocks (~> 3.12.0)
+    rspec-core (3.12.3)
+      rspec-support (~> 3.12.0)
+    rspec-expectations (3.12.4)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.12.0)
+    rspec-its (1.3.1)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.12.7)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.12.0)
+    rspec-support (3.12.2)
+    rubocop (1.75.8)
+      json (~> 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.45.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
+    ruby-progressbar (1.13.0)
+    rubyntlm (0.6.5)
+      base64
+    rubyzip (2.4.1)
+    semverse (3.0.2)
+    solve (4.0.4)
+      molinillo (~> 0.6)
+      semverse (>= 1.1, < 4.0)
+    sslshake (1.3.1)
+    strings (0.2.1)
+      strings-ansi (~> 0.2)
+      unicode-display_width (>= 1.5, < 3.0)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    syslog-logger (1.6.8)
+    thor (1.2.2)
+    time (0.4.1)
+      date
+    timeout (0.4.3)
+    tomlrb (1.3.0)
+    train-core (3.12.13)
+      addressable (~> 2.5)
+      ffi (!= 1.13.0)
+      json (>= 1.8, < 3.0)
+      mixlib-shellout (>= 2.0, < 4.0)
+      net-scp (>= 1.2, < 5.0)
+      net-ssh (>= 2.9, < 8.0)
+    train-rest (0.5.0)
+      aws-sigv4 (~> 1.5)
+      rest-client (~> 2.1)
+      train-core (~> 3.0)
+    train-winrm (0.2.19)
+      chef-winrm (~> 2.3.12)
+      chef-winrm-elevated (~> 1.2.5)
+      chef-winrm-fs (~> 1.3.7)
+    tty-box (0.7.0)
+      pastel (~> 0.8)
+      strings (~> 0.2.0)
+      tty-cursor (~> 0.7)
+    tty-color (0.6.0)
+    tty-cursor (0.7.1)
+    tty-prompt (0.23.1)
+      pastel (~> 0.8)
+      tty-reader (~> 0.8)
+    tty-reader (0.9.0)
+      tty-cursor (~> 0.7)
+      tty-screen (~> 0.8)
+      wisper (~> 2.0)
+    tty-screen (0.8.2)
+    tty-table (0.12.0)
+      pastel (~> 0.8)
+      strings (~> 0.2.0)
+      tty-screen (~> 0.8)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    unf_ext (0.0.8.2)
+    unicode-display_width (2.6.0)
+    unicode_utils (1.4.0)
+    uri (1.0.3)
+    uuidtools (2.2.0)
+    vault (0.18.2)
+      aws-sigv4
+    webrick (1.9.1)
+    wisper (2.0.1)
+    wmi-lite (1.0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  chef-cli
+
+BUNDLED WITH
+   2.6.6
--- a/pkgs/tools/misc/chef-cli/default.nix
+++ b/pkgs/tools/misc/chef-cli/default.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  ruby,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
+
+bundlerApp {
+  pname = "chef-cli";
+  gemdir = ./.;
+  inherit ruby;
+
+  exes = [ "chef-cli" ];
+
+  passthru.updateScript = bundlerUpdateScript "chef-cli";
+
+  meta = with lib; {
+    description = "Chef Infra Client is a powerful agent that applies your configurations on remote Linux, macOS, Windows and cloud-based systems";
+    homepage = "https://chef.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dylanmtaylor ];
+    mainProgram = "chef-cli";
+  };
+}
--- a/pkgs/tools/misc/chef-cli/gemset.nix
+++ b/pkgs/tools/misc/chef-cli/gemset.nix
--- a/pkgs/tools/misc/ckb-next/default.nix
+++ b/pkgs/tools/misc/ckb-next/default.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  wrapQtAppsHook,
+  fetchFromGitHub,
+  replaceVars,
+  udev,
+  stdenv,
+  pkg-config,
+  qtbase,
+  cmake,
+  zlib,
+  kmod,
+  libXdmcp,
+  qttools,
+  qtx11extras,
+  libdbusmenu,
+  gnused,
+  withPulseaudio ? stdenv.hostPlatform.isLinux,
+  libpulseaudio,
+  quazip,
+  udevCheckHook,
+}:
+
+stdenv.mkDerivation rec {
+  version = "0.6.2";
+  pname = "ckb-next";
+
+  src = fetchFromGitHub {
+    owner = "ckb-next";
+    repo = "ckb-next";
+    rev = "v${version}";
+    hash = "sha256-lA1FpUee2SpUQwJotbYhG0QX7LT5l2PP9lJ9F3uNtdU=";
+  };
+
+  buildInputs = [
+    udev
+    qtbase
+    zlib
+    libXdmcp
+    qttools
+    qtx11extras
+    libdbusmenu
+    quazip
+  ]
+  ++ lib.optional withPulseaudio libpulseaudio;
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    pkg-config
+    cmake
+    udevCheckHook
+  ];
+
+  cmakeFlags = [
+    "-DINSTALL_DIR_ANIMATIONS=libexec"
+    "-DUDEV_RULE_DIRECTORY=lib/udev/rules.d"
+    "-DFORCE_INIT_SYSTEM=systemd"
+    "-DDISABLE_UPDATER=1"
+  ];
+
+  patches = [
+    ./install-dirs.patch
+    (replaceVars ./modprobe.patch {
+      inherit kmod;
+    })
+  ];
+
+  doInstallCheck = true;
+
+  postInstall = ''
+    substituteInPlace "$out/lib/udev/rules.d/99-ckb-next-daemon.rules" \
+      --replace-fail "/usr/bin/env sed" "${lib.getExe gnused}"
+  '';
+
+  meta = with lib; {
+    description = "Driver and configuration tool for Corsair keyboards and mice";
+    homepage = "https://github.com/ckb-next/ckb-next";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    mainProgram = "ckb-next";
+    maintainers = [ ];
+  };
+}
--- a/pkgs/tools/misc/ckb-next/install-dirs.patch
+++ b/pkgs/tools/misc/ckb-next/install-dirs.patch
@@ -0,0 +1,13 @@
+diff --git a/src/daemon/CMakeLists.txt b/src/daemon/CMakeLists.txt
+index a04b80c..2969b3b 100644
+--- a/src/daemon/CMakeLists.txt
+++ b/src/daemon/CMakeLists.txt
+@@ -437,7 +437,7 @@ if ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "launchd")
+ elseif ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "systemd")
+     install(
+         FILES "${CMAKE_CURRENT_BINARY_DIR}/service/ckb-next-daemon.service"
+-        DESTINATION "${SYSTEMD_UNIT_INSTALL_DIR}"
+        DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/systemd/system"
+         PERMISSIONS
+         OWNER_READ OWNER_WRITE
+         GROUP_READ
--- a/pkgs/tools/misc/ckb-next/modprobe.patch
+++ b/pkgs/tools/misc/ckb-next/modprobe.patch
@@ -0,0 +1,26 @@
+diff --git a/src/daemon/input_linux.c b/src/daemon/input_linux.c
+index 933e628..c4f97f2 100644
+--- a/src/daemon/input_linux.c
+++ b/src/daemon/input_linux.c
+@@ -70,7 +70,7 @@ int os_inputopen(usbdevice* kb){
+ 
+     // If not available, load the module
+     if(fd < 0){
+-        if(system("modprobe uinput") != 0) {
+        if(system("@kmod@/bin/modprobe uinput") != 0) {
+             ckb_fatal("Failed to load uinput module");
+             return 1;
+         }
+diff --git a/src/gui/mainwindow.cpp b/src/gui/mainwindow.cpp
+index eeadaf8..87de71f 100644
+--- a/src/gui/mainwindow.cpp
+++ b/src/gui/mainwindow.cpp
+@@ -309,7 +309,7 @@ void MainWindow::updateVersion(){
+ #elif defined(Q_OS_LINUX)
+             if(!(QFileInfo("/dev/uinput").exists() || QFileInfo("/dev/input/uinput").exists())){
+                 QProcess modprobe;
+-                modprobe.start("modprobe", QStringList("uinput"));
+                modprobe.start("@kmod@/bin/modprobe", QStringList("uinput"));
+ 
+                 if(!modprobe.waitForFinished())
+                     qDebug() << "Modprobe error";
--- a/pkgs/tools/misc/cmdpack/default.nix
+++ b/pkgs/tools/misc/cmdpack/default.nix
@@ -0,0 +1,145 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+}:
+let
+  mkCmdPackDerivation =
+    {
+      pname,
+      postInstall ? "",
+      description,
+    }:
+    stdenv.mkDerivation {
+      inherit pname postInstall;
+
+      version = "1.03";
+
+      src = fetchurl {
+        url = "https://web.archive.org/web/20140330233023/http://www.neillcorlett.com/downloads/cmdpack-1.03-src.tar.gz";
+        sha256 = "0v0a9rpv59w8lsp1cs8f65568qj65kd9qp7854z1ivfxfpq0da2n";
+      };
+
+      buildPhase = ''
+        runHook preBuild
+
+        $CC -o "$pname" "src/$pname.c"
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        install -Dm555 -t "$out/bin" "$pname"
+
+        runHook postInstall
+      '';
+
+      meta = with lib; {
+        inherit description;
+
+        homepage = "https://web.archive.org/web/20140330233023/http://www.neillcorlett.com/cmdpack/";
+        platforms = platforms.all;
+        license = licenses.gpl3Plus;
+        maintainers = with maintainers; [ zane ];
+      };
+    };
+in
+{
+  bin2iso = mkCmdPackDerivation {
+    pname = "bin2iso";
+    description = "Convert CD .BIN to .ISO";
+  };
+
+  bincomp = mkCmdPackDerivation {
+    pname = "bincomp";
+    description = "Compare binary files";
+  };
+
+  brrrip = mkCmdPackDerivation {
+    pname = "brrrip";
+    description = "Rip SNES BRR sound samples";
+  };
+
+  byteshuf = mkCmdPackDerivation {
+    pname = "byteshuf";
+    description = "Shuffle or unshuffle bytes in a file";
+  };
+
+  byteswap = mkCmdPackDerivation {
+    pname = "byteswap";
+    description = "Swap byte order of files";
+  };
+
+  cdpatch = mkCmdPackDerivation {
+    pname = "cdpatch";
+    description = "CD-XA image insert/extract utility";
+  };
+
+  ecm = mkCmdPackDerivation {
+    pname = "ecm";
+    postInstall = "ln $out/bin/ecm $out/bin/unecm";
+    description = "Encoder/decoder for Error Code Modeler format";
+  };
+
+  fakecrc = mkCmdPackDerivation {
+    pname = "fakecrc";
+    description = "Fake the CRC32 of a file";
+  };
+
+  hax65816 = mkCmdPackDerivation {
+    pname = "hax65816";
+    description = "Simple 65816 disassembler";
+  };
+
+  id3point = mkCmdPackDerivation {
+    pname = "id3point";
+    description = "Pointless ID3v1 Tagger";
+  };
+
+  pecompat = mkCmdPackDerivation {
+    pname = "pecompat";
+    description = "Maximize compatibility of a Win32 PE file";
+  };
+
+  rels = mkCmdPackDerivation {
+    pname = "rels";
+    description = "Relative Searcher";
+  };
+
+  screamf = mkCmdPackDerivation {
+    pname = "screamf";
+    description = ".AMF to .S3M converter";
+  };
+
+  subfile = mkCmdPackDerivation {
+    pname = "subfile";
+    description = "Extract a portion of a file";
+  };
+
+  uips = mkCmdPackDerivation {
+    pname = "uips";
+    description = "Universal IPS patch create/apply utility";
+  };
+
+  usfv = mkCmdPackDerivation {
+    pname = "usfv";
+    description = "Universal SFV create/verify utility";
+  };
+
+  vb2rip = mkCmdPackDerivation {
+    pname = "vb2rip";
+    description = "VB2 sound format ripping utility";
+  };
+
+  wordadd = mkCmdPackDerivation {
+    pname = "wordadd";
+    description = "Addition word puzzle solver";
+  };
+
+  zerofill = mkCmdPackDerivation {
+    pname = "zerofill";
+    description = "Create a large, empty file";
+  };
+}
--- a/pkgs/tools/misc/coreboot-configurator/default.nix
+++ b/pkgs/tools/misc/coreboot-configurator/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchFromGitHub,
+  inkscape,
+  meson,
+  mkDerivation,
+  ninja,
+  # We will resolve pkexec from the path because it has a setuid wrapper on
+  # NixOS meaning that we cannot just use the path from the nix store.
+  # Using the path to the wrapper here would make the package incompatible
+  # with non-NixOS systems.
+  pkexecPath ? "pkexec",
+  pkg-config,
+  yaml-cpp,
+  nvramtool,
+  systemd,
+  qtbase,
+  qtsvg,
+  wrapQtAppsHook,
+}:
+
+mkDerivation {
+  pname = "coreboot-configurator";
+  version = "unstable-2023-01-17";
+
+  src = fetchFromGitHub {
+    owner = "StarLabsLtd";
+    repo = "coreboot-configurator";
+    rev = "944b575dc873c78627c352f9c1a1493981431a58";
+    sha256 = "sha256-ReWQNzeoyTF66hVnevf6Kkrnt0/PqRHd3oyyPYtx+0M=";
+  };
+
+  nativeBuildInputs = [
+    inkscape
+    meson
+    ninja
+    pkg-config
+    wrapQtAppsHook
+  ];
+  buildInputs = [
+    yaml-cpp
+    qtbase
+    qtsvg
+  ];
+
+  postPatch = ''
+    substituteInPlace src/application/*.cpp \
+      --replace '/usr/bin/pkexec' '${pkexecPath}' \
+      --replace '/usr/bin/systemctl' '${lib.getBin systemd}/systemctl' \
+      --replace '/usr/sbin/nvramtool' '${lib.getExe nvramtool}'
+
+    substituteInPlace src/resources/org.coreboot.nvramtool.policy \
+      --replace '/usr/sbin/nvramtool' '${lib.getExe nvramtool}'
+
+    substituteInPlace src/resources/org.coreboot.reboot.policy \
+      --replace '/usr/sbin/reboot' '${lib.getBin systemd}/reboot'
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/share/applications/coreboot-configurator.desktop \
+      --replace '/usr/bin/coreboot-configurator' 'coreboot-configurator'
+  '';
+
+  meta = with lib; {
+    description = "Simple GUI to change settings in Coreboot's CBFS";
+    homepage = "https://support.starlabs.systems/kb/guides/coreboot-configurator";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ danth ];
+    mainProgram = "coreboot-configurator";
+  };
+}
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@@ -0,0 +1,200 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  pkg-config,
+  zlib,
+  pciutils,
+  openssl,
+  coreutils,
+  acpica-tools,
+  makeWrapper,
+  gnugrep,
+  gnused,
+  file,
+  buildEnv,
+}:
+
+let
+  version = "25.06";
+
+  commonMeta = {
+    description = "Various coreboot-related tools";
+    homepage = "https://www.coreboot.org";
+    license = with lib.licenses; [
+      gpl2Only
+      gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [
+      felixsinger
+      jmbaur
+    ];
+    platforms = lib.platforms.linux;
+  };
+
+  generic =
+    {
+      pname,
+      path ? "util/${pname}",
+      ...
+    }@args:
+    stdenv.mkDerivation (
+      finalAttrs:
+      {
+        inherit pname version;
+
+        src = fetchgit {
+          url = "https://review.coreboot.org/coreboot";
+          rev = finalAttrs.version;
+          hash = "sha256-D7W8LtL6eeaKiRYoxVkcjeZ2aMIEXCvNakVtexe0mG8=";
+        };
+
+        enableParallelBuilding = true;
+
+        postPatch = ''
+          substituteInPlace 3rdparty/vboot/Makefile --replace 'ar qc ' '$$AR qc '
+          cd ${path}
+          patchShebangs .
+        '';
+
+        makeFlags = [
+          "INSTALL=install"
+          "PREFIX=${placeholder "out"}"
+        ];
+
+        meta = commonMeta // args.meta;
+      }
+      // (removeAttrs args [ "meta" ])
+    );
+
+  utils = {
+    msrtool = generic {
+      pname = "msrtool";
+      meta.description = "Dump chipset-specific MSR registers";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      buildInputs = [
+        pciutils
+        zlib
+      ];
+      preConfigure = "export INSTALL=install";
+    };
+    cbmem = generic {
+      pname = "cbmem";
+      meta.description = "Coreboot console log reader";
+    };
+    ifdtool = generic {
+      pname = "ifdtool";
+      meta.description = "Extract and dump Intel Firmware Descriptor information";
+    };
+    intelmetool = generic {
+      pname = "intelmetool";
+      meta.description = "Dump interesting things about Management Engine";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      buildInputs = [
+        pciutils
+        zlib
+      ];
+    };
+    cbfstool = generic {
+      pname = "cbfstool";
+      meta.description = "Management utility for CBFS formatted ROM images";
+    };
+    nvramtool = generic {
+      pname = "nvramtool";
+      meta.description = "Read and write coreboot parameters and display information from the coreboot table in CMOS/NVRAM";
+      meta.mainProgram = "nvramtool";
+    };
+    superiotool = generic {
+      pname = "superiotool";
+      meta.description = "User-space utility to detect Super I/O of a mainboard and provide detailed information about the register contents of the Super I/O";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      buildInputs = [
+        pciutils
+        zlib
+      ];
+    };
+    ectool = generic {
+      pname = "ectool";
+      meta.description = "Dump the RAM of a laptop's Embedded/Environmental Controller (EC)";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      preInstall = "mkdir -p $out/sbin";
+    };
+    inteltool = generic {
+      pname = "inteltool";
+      meta.description = "Provides information about Intel CPU/chipset hardware configuration (register contents, MSRs, etc)";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      buildInputs = [
+        pciutils
+        zlib
+      ];
+    };
+    amdfwtool = generic {
+      pname = "amdfwtool";
+      meta.description = "Create AMD firmware combination";
+      buildInputs = [ openssl ];
+      nativeBuildInputs = [ pkg-config ];
+      installPhase = ''
+        runHook preInstall
+
+        install -Dm755 amdfwtool $out/bin/amdfwtool
+
+        runHook postInstall
+      '';
+    };
+    acpidump-all = generic {
+      pname = "acpidump-all";
+      path = "util/acpi";
+      meta.description = "Walk through all ACPI tables with their addresses";
+      nativeBuildInputs = [ makeWrapper ];
+      dontBuild = true;
+      installPhase = ''
+        runHook preInstall
+
+        install -Dm755 acpidump-all $out/bin/acpidump-all
+
+        runHook postInstall
+      '';
+      postFixup = ''
+        wrapProgram $out/bin/acpidump-all \
+          --set PATH ${
+            lib.makeBinPath [
+              coreutils
+              acpica-tools
+              gnugrep
+              gnused
+              file
+            ]
+          }
+      '';
+    };
+  };
+
+in
+utils
+// {
+  coreboot-utils =
+    (buildEnv {
+      name = "coreboot-utils-${version}";
+      paths = lib.filter (lib.meta.availableOn stdenv.hostPlatform) (lib.attrValues utils);
+      postBuild = "rm -rf $out/sbin";
+    })
+    // {
+      inherit version;
+      meta = commonMeta;
+    };
+}
--- a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
+++ b/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
@@ -0,0 +1,69 @@
+From 8c9602e3a145e9596dc1a63c6ed67865814b6633 Mon Sep 17 00:00:00 2001
+From: Pádraig Brady <P@draigBrady.com>
+Date: Tue, 20 May 2025 16:03:44 +0100
+Subject: sort: fix buffer under-read (CWE-127)
+
+* src/sort.c (begfield): Check pointer adjustment
+to avoid Out-of-range pointer offset (CWE-823).
+(limfield): Likewise.
+* tests/sort/sort-field-limit.sh: Add a new test,
+which triggers with ASAN or Valgrind.
+* tests/local.mk: Reference the new test.
+* NEWS: Mention bug fix introduced in v7.2 (2009).
+Fixes https://bugs.gnu.org/78507
+---
+ NEWS                           |  5 +++++
+ src/sort.c                     | 12 ++++++++++--
+ tests/local.mk                 |  1 +
+ tests/sort/sort-field-limit.sh | 35 +++++++++++++++++++++++++++++++++++
+ 4 files changed, 51 insertions(+), 2 deletions(-)
+ create mode 100755 tests/sort/sort-field-limit.sh
+
+The new tests is NOT added in NixOS.
+
+diff --git a/NEWS b/NEWS
+index 6ff403206..923aa72f8 100644
+--- a/NEWS
+++ b/NEWS
+@@ -8,6 +8,11 @@ GNU coreutils NEWS                                    -*- outline -*-
+   copying to non-NFS files from NFSv4 files with trivial ACLs.
+   [bug introduced in coreutils-9.6]
+ 
+  sort with key character offsets of SIZE_MAX, could induce
+  a read of 1 byte before an allocated heap buffer. For example:
+  'sort +0.18446744073709551615R input' on 64 bit systems.
+  [bug introduced in coreutils-7.2]
+
+ 
+ * Noteworthy changes in release 9.7 (2025-04-09) [stable]
+ 
+diff --git a/src/sort.c b/src/sort.c
+index b10183b6f..7af1a2512 100644
+--- a/src/sort.c
+++ b/src/sort.c
+@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
+       ++ptr;
+ 
+   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
+-  ptr = MIN (lim, ptr + schar);
+  size_t remaining_bytes = lim - ptr;
+  if (schar < remaining_bytes)
+    ptr += schar;
+  else
+    ptr = lim;
+ 
+   return ptr;
+ }
+@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
+           ++ptr;
+ 
+       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
+-      ptr = MIN (lim, ptr + echar);
+      size_t remaining_bytes = lim - ptr;
+      if (echar < remaining_bytes)
+        ptr += echar;
+      else
+        ptr = lim;
+     }
+ 
+   return ptr;
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -0,0 +1,275 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoreconfHook,
+  buildPackages,
+  libiconv,
+  perl,
+  texinfo,
+  xz,
+  binlore,
+  coreutils,
+  gmpSupport ? true,
+  gmp,
+  aclSupport ? lib.meta.availableOn stdenv.hostPlatform acl,
+  acl,
+  attrSupport ? lib.meta.availableOn stdenv.hostPlatform attr,
+  attr,
+  selinuxSupport ? false,
+  libselinux,
+  libsepol,
+  # No openssl in default version, so openssl-induced rebuilds aren't too big.
+  # It makes *sum functions significantly faster.
+  minimal ? true,
+  withOpenssl ? !minimal,
+  openssl,
+  withPrefix ? false,
+  singleBinary ? "symlinks", # you can also pass "shebangs" or false
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus cannot use
+# fetchpatch! All mutable patches (generated by GitHub or cgit) that are needed
+# here should be included directly in Nixpkgs as files.
+
+assert aclSupport -> acl != null;
+assert selinuxSupport -> libselinux != null && libsepol != null;
+
+let
+  inherit (lib)
+    concatStringsSep
+    isString
+    optional
+    optionalAttrs
+    optionals
+    optionalString
+    ;
+  isCross = (stdenv.hostPlatform != stdenv.buildPlatform);
+in
+stdenv.mkDerivation rec {
+  pname = "coreutils" + (optionalString (!minimal) "-full");
+  version = "9.7";
+
+  src = fetchurl {
+    url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
+    hash = "sha256-6LsmrQKT+bWh/EP7QrqXDjEsZs6SwbCxZxPXUA2yUb8=";
+  };
+
+  patches = [
+    # Heap buffer overflow that's been here since coreutils 7.2 in 2009:
+    # https://www.openwall.com/lists/oss-security/2025/05/27/2
+    ./CVE-2025-5278.patch
+
+    # Fixes test-float-h failure on ppc64 with C23
+    # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
+    # Multiple upstream commits squashed with adjustments, see header
+    ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
+  ];
+
+  postPatch = ''
+    # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
+    sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
+    sed '2i echo Skipping du threshold test && exit 77' -i ./tests/du/threshold.sh
+    sed '2i echo Skipping cp reflink-auto test && exit 77' -i ./tests/cp/reflink-auto.sh
+    sed '2i echo Skipping cp sparse test && exit 77' -i ./tests/cp/sparse.sh
+    sed '2i echo Skipping env test && exit 77' -i ./tests/env/env.sh
+    sed '2i echo Skipping rm deep-2 test && exit 77' -i ./tests/rm/deep-2.sh
+    sed '2i echo Skipping du long-from-unreadable test && exit 77' -i ./tests/du/long-from-unreadable.sh
+
+    # The test tends to fail on cephfs
+    sed '2i echo Skipping df total-verify test && exit 77' -i ./tests/df/total-verify.sh
+
+    # Some target platforms, especially when building inside a container have
+    # issues with the inotify test.
+    sed '2i echo Skipping tail inotify dir recreate test && exit 77' -i ./tests/tail/inotify-dir-recreate.sh
+
+    # sandbox does not allow setgid
+    sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh
+    substituteInPlace ./tests/install/install-C.sh \
+      --replace 'mode3=2755' 'mode3=1755'
+
+    # Fails on systems with a rootfs. Looks like a bug in the test, see
+    # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
+    sed '2i print "Skipping df skip-rootfs test"; exit 77' -i ./tests/df/skip-rootfs.sh
+
+    # these tests fail in the unprivileged nix sandbox (without nix-daemon) as we break posix assumptions
+    for f in ./tests/chgrp/{basic.sh,recurse.sh,default-no-deref.sh,no-x.sh,posix-H.sh}; do
+      sed '2i echo Skipping chgrp && exit 77' -i "$f"
+    done
+    for f in gnulib-tests/{test-chown.c,test-fchownat.c,test-lchown.c}; do
+      echo "int main() { return 77; }" > "$f"
+    done
+
+    # We don't have localtime in the sandbox
+    for f in gnulib-tests/{test-localtime_r.c,test-localtime_r-mt.c}; do
+      echo "int main() { return 77; }" > "$f"
+    done
+
+    # These tests sometimes fail on ZFS-backed NFS filesystems
+    sed '2i echo "Skipping test: fails on zfs " && exit 77' -i gnulib-tests/test-file-has-acl-1.sh
+    sed '2i echo "Skipping test: fails on zfs " && exit 77' -i gnulib-tests/test-set-mode-acl-1.sh
+    sed '2i echo "Skipping test: ls/removed-directory" && exit 77' -i ./tests/ls/removed-directory.sh
+
+    # intermittent failures on builders, unknown reason
+    sed '2i echo Skipping du basic test && exit 77' -i ./tests/du/basic.sh
+
+    # fails when syscalls related to acl not being available, e.g. in sandboxed environment
+    sed '2i echo Skipping ls -al with acl test && exit 77' -i ./tests/ls/acl.sh
+  ''
+  + (optionalString (stdenv.hostPlatform.libc == "musl") (
+    concatStringsSep "\n" [
+      ''
+        echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
+        echo "int main() { return 77; }" > gnulib-tests/test-getlogin.c
+      ''
+    ]
+  ))
+  + (optionalString stdenv.hostPlatform.isAarch64 ''
+    # Sometimes fails: https://github.com/NixOS/nixpkgs/pull/143097#issuecomment-954462584
+    sed '2i echo Skipping cut huge range test && exit 77' -i ./tests/cut/cut-huge-range.sh
+  '')
+  + (optionalString stdenv.hostPlatform.isPower64
+    # test command fails to parse long fraction part on ppc64
+    # When fraction parsing is fixed, still wrong output due to fraction length mismatch
+    # https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78985
+    ''
+      sed '2i echo Skipping float sort-ing test && exit 77' -i ./tests/sort/sort-float.sh
+    ''
+  );
+
+  outputs = [
+    "out"
+    "info"
+  ];
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [
+    perl
+    xz.bin
+  ]
+  ++ optionals stdenv.hostPlatform.isCygwin [
+    # due to patch
+    autoreconfHook
+    texinfo
+  ];
+
+  buildInputs =
+    [ ]
+    ++ optional aclSupport acl
+    ++ optional attrSupport attr
+    ++ optional gmpSupport gmp
+    ++ optional withOpenssl openssl
+    ++ optionals selinuxSupport [
+      libselinux
+      libsepol
+    ]
+    # TODO(@Ericson2314): Investigate whether Darwin could benefit too
+    ++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv;
+
+  hardeningDisable = [ "trivialautovarinit" ];
+
+  configureFlags = [
+    "--with-packager=https://nixos.org"
+  ]
+  ++ optional (singleBinary != false) (
+    "--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}"
+  )
+  ++ optional withOpenssl "--with-openssl"
+  ++ optional stdenv.hostPlatform.isSunOS "ac_cv_func_inotify_init=no"
+  ++ optional withPrefix "--program-prefix=g"
+  # the shipped configure script doesn't enable nls, but using autoreconfHook
+  # does so which breaks the build
+  ++ optional stdenv.hostPlatform.isDarwin "--disable-nls"
+  # The VMULL-based CRC implementation produces incorrect results on musl.
+  # https://lists.gnu.org/archive/html/bug-coreutils/2025-02/msg00046.html
+  ++ optional (
+    stdenv.hostPlatform.config == "aarch64-unknown-linux-musl"
+  ) "utils_cv_vmull_intrinsic_exists=no"
+  ++ optionals (isCross && stdenv.hostPlatform.libc == "glibc") [
+    # TODO(19b98110126fde7cbb1127af7e3fe1568eacad3d): Needed for fstatfs() I
+    # don't know why it is not properly detected cross building with glibc.
+    "fu_cv_sys_stat_statfs2_bsize=yes"
+  ]
+  # /proc/uptime is available on Linux and produces accurate results even if
+  # the boot time is set to the epoch because the system has no RTC. We
+  # explicitly enable it for cases where it can't be detected automatically,
+  # such as when cross-compiling.
+  ++ optional stdenv.hostPlatform.isLinux "gl_cv_have_proc_uptime=yes";
+
+  # The tests are known broken on Cygwin
+  # (http://article.gmane.org/gmane.comp.gnu.core-utils.bugs/19025),
+  # Darwin (http://article.gmane.org/gmane.comp.gnu.core-utils.bugs/19351),
+  # and {Open,Free}BSD.
+  # With non-standard storeDir: https://github.com/NixOS/nix/issues/512
+  doCheck =
+    (!isCross)
+    && (stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl")
+    && !stdenv.hostPlatform.isAarch32;
+
+  # Prevents attempts of running 'help2man' on cross-built binaries.
+  PERL = if isCross then "missing" else null;
+
+  enableParallelBuilding = true;
+
+  NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
+  FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+  env.NIX_CFLAGS_COMPILE = toString (
+    [ ]
+    # Work around a bogus warning in conjunction with musl.
+    ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
+    ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
+  );
+
+  # Works around a bug with 8.26:
+  # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
+  preInstall = optionalString isCross ''
+    sed -i Makefile -e 's|^INSTALL =.*|INSTALL = ${buildPackages.coreutils}/bin/install -c|'
+  '';
+
+  postInstall =
+    optionalString (isCross && !minimal) ''
+      rm $out/share/man/man1/*
+      cp ${buildPackages.coreutils-full}/share/man/man1/* $out/share/man/man1
+    ''
+    # du: 8.7 M locale + 0.4 M man pages
+    + optionalString minimal ''
+      rm -r "$out/share"
+    '';
+
+  passthru =
+    { }
+    // optionalAttrs (singleBinary != false) {
+      # everything in the single binary gets the same verdict, so we
+      # override _that case_ with verdicts from separate binaries.
+      #
+      # binlore only spots exec in runcon on some platforms (i.e., not
+      # darwin; see comment on inverse case below)
+      binlore.out = binlore.synthesize coreutils ''
+        execer can bin/{chroot,env,install,nice,nohup,runcon,sort,split,stdbuf,timeout}
+        execer cannot bin/{[,b2sum,base32,base64,basename,basenc,cat,chcon,chgrp,chmod,chown,cksum,comm,cp,csplit,cut,date,dd,df,dir,dircolors,dirname,du,echo,expand,expr,factor,false,fmt,fold,groups,head,hostid,id,join,kill,link,ln,logname,ls,md5sum,mkdir,mkfifo,mknod,mktemp,mv,nl,nproc,numfmt,od,paste,pathchk,pinky,pr,printenv,printf,ptx,pwd,readlink,realpath,rm,rmdir,seq,sha1sum,sha224sum,sha256sum,sha384sum,sha512sum,shred,shuf,sleep,stat,stty,sum,sync,tac,tail,tee,test,touch,tr,true,truncate,tsort,tty,uname,unexpand,uniq,unlink,uptime,users,vdir,wc,who,whoami,yes}
+      '';
+    }
+    // optionalAttrs (singleBinary == false) {
+      # binlore only spots exec in runcon on some platforms (i.e., not
+      # darwin; I have a note that the behavior may need selinux?).
+      # hard-set it so people working on macOS don't miss cases of
+      # runcon until ofBorg fails.
+      binlore.out = binlore.synthesize coreutils ''
+        execer can bin/runcon
+      '';
+    };
+
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/coreutils/";
+    description = "GNU Core Utilities";
+    longDescription = ''
+      The GNU Core Utilities are the basic file, shell and text manipulation
+      utilities of the GNU operating system. These are the core utilities which
+      are expected to exist on every operating system.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ das_j ];
+    platforms = with platforms; unix ++ windows;
+    priority = 10;
+  };
+}
--- a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
+++ b/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
@@ -0,0 +1,230 @@
+Applies the following incremental gnulib commits:
+
+- 55a366a06fbd98bf13adc531579e3513cee97a32
+- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f
+- ce8e9de0bf34bc63dffc67ab384334c509175f64
+- 6164b4cb0887b5331a4e64449107decd37d32735
+
+With adjustments specific to the structure & differences in coreutils:
+
+- gnulib code is split across lib and gnulib-tests
+- A Makefile.in is used for the test flags instead of the fancy automake modules
+  in the upstream gnulib project, so we add -lm to the float test there.
+  Surrounding texts in this file are slightly different in every project.
+---
+diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in
+--- a/gnulib-tests/Makefile.in	2025-04-09 10:05:54.000000000 +0000
+++ b/gnulib-tests/Makefile.in	2025-07-09 10:00:23.767927263 +0000
+@@ -1496,7 +1496,7 @@
+ 	$(am__DEPENDENCIES_1)
+ test_float_h_SOURCES = test-float-h.c
+ test_float_h_OBJECTS = test-float-h.$(OBJEXT)
+-test_float_h_LDADD = $(LDADD)
+test_float_h_LDADD = $(LDADD) -lm
+ test_float_h_DEPENDENCIES = libtests.a ../lib/libcoreutils.a \
+ 	libtests.a ../lib/libcoreutils.a libtests.a \
+ 	$(am__DEPENDENCIES_1)
+diff '--color=auto' -ruN a/gnulib-tests/test-float-h.c b/gnulib-tests/test-float-h.c
+--- a/gnulib-tests/test-float-h.c	2025-01-01 09:32:30.000000000 +0000
+++ b/gnulib-tests/test-float-h.c	2025-07-09 10:00:13.837937094 +0000
+@@ -101,6 +101,8 @@
+ 
+ /* ------------------------------------------------------------------------- */
+ 
+#include <math.h>
+
+ #include "fpucw.h"
+ #include "isnanf-nolibm.h"
+ #include "isnand-nolibm.h"
+@@ -396,6 +398,44 @@
+ 
+ /* -------------------- Check macros for 'long double' -------------------- */
+ 
+static int
+test_isfinitel (long double volatile x)
+{
+  if (x != x)
+    return 0;
+  long double volatile zero = x * 0;
+  return zero == 0;
+}
+
+/* Return X after normalization.  This makes a difference on platforms
+   where long double can represent unnormalized values.  For example,
+   suppose x = 1 + 2**-106 on PowerPC with IBM long double where
+   FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105.
+   Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1.  */
+static long double
+normalize_long_double (long double volatile x)
+{
+  if (FLT_RADIX == 2 && test_isfinitel (x))
+    {
+      int xexp;
+      long double volatile
+        frac = frexpl (x, &xexp),
+        significand = frac * pow2l (LDBL_MANT_DIG),
+        normalized_significand = truncl (significand),
+        normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG);
+
+      /* The test_isfinitel defends against PowerPC with IBM long double,
+         which fritzes out near LDBL_MAX.  */
+      if (test_isfinitel (normalized_x))
+        x = normalized_x;
+    }
+  else
+    {
+      /* Hope that X is already normalized.  */
+    }
+  return x;
+}
+
+ static void
+ test_long_double (void)
+ {
+@@ -455,7 +495,7 @@
+     for (n = 0; n <= 2 * LDBL_MANT_DIG; n++)
+       {
+         volatile long double half_n = pow2l (- n); /* 2^-n */
+-        volatile long double x = me - half_n;
+        volatile long double x = normalize_long_double (me - half_n);
+         if (x < me)
+           ASSERT (x <= 1.0L);
+       }
+@@ -483,8 +523,12 @@
+   ASSERT (!LDBL_IS_IEC_60559);
+ #endif
+ 
+  printf("LDBL_NORM_MAX: %LF\n", LDBL_NORM_MAX);
+  printf("LDBL_MAX: %LF\n", LDBL_MAX);
+  printf("normalize_long_double(LDBL_MAX): %LF\n", normalize_long_double(LDBL_MAX));
+
+   /* Check the value of LDBL_NORM_MAX.  */
+-  ASSERT (LDBL_NORM_MAX == LDBL_MAX);
+  ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX));
+ 
+   /* Check the value of LDBL_SNAN.  */
+   ASSERT (isnanl (LDBL_SNAN));
+diff '--color=auto' -ruN a/lib/float.c b/lib/float.c
+--- a/lib/float.c	2025-01-01 09:32:29.000000000 +0000
+++ b/lib/float.c	2025-07-09 10:00:13.837937094 +0000
+@@ -23,7 +23,7 @@
+ #if GNULIB_defined_long_double_union
+ # if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
+ const union gl_long_double_union gl_LDBL_MAX =
+-  { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } };
+  { { DBL_MAX, DBL_MAX / 0x1p53 } };
+ # elif defined __i386__
+ const union gl_long_double_union gl_LDBL_MAX =
+   { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } };
+diff '--color=auto' -ruN a/lib/float.in.h b/lib/float.in.h
+--- a/lib/float.in.h	2025-01-01 09:32:29.000000000 +0000
+++ b/lib/float.in.h	2025-07-09 10:00:13.837937094 +0000
+@@ -113,44 +113,38 @@
+ # define LDBL_MAX_10_EXP 4932
+ #endif
+ 
+-/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are
+-   wrong.
+-   On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong.  */
+-#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__
+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of
+   LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong.  */
+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \
+     && defined __GNUC__)
+ # undef LDBL_MIN_EXP
+ # define LDBL_MIN_EXP DBL_MIN_EXP
+ # undef LDBL_MIN_10_EXP
+ # define LDBL_MIN_10_EXP DBL_MIN_10_EXP
+ # undef LDBL_MIN
+ # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */
+-#endif
+-#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
+ # undef LDBL_MAX
+-/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }.
+-   It is not easy to define:
+-     #define LDBL_MAX 1.79769313486231580793728971405302307166e308L
+-   is too small, whereas
+-     #define LDBL_MAX 1.79769313486231580793728971405302307167e308L
+-   is too large.  Apparently a bug in GCC decimal-to-binary conversion.
+-   Also, I can't get values larger than
+-     #define LDBL63 ((long double) (1ULL << 63))
+-     #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
+-     #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
+-     #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
+-     #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL)
+-   which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }.
+-   So, define it like this through a reference to an external variable
+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF,
+                                                   0x7C9FFFFF, 0xFFFFFFFF }.
+
+   Do not write it as a constant expression, as GCC would likely treat
+   that as infinity due to the vagaries of this platform's funky arithmetic.
+   Instead, define it through a reference to an external variable.
+   Like the following, but using a union to avoid type mismatches:
+ 
+-     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL };
+     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 };
+      extern const long double LDBL_MAX;
+ 
+-   or through a pointer cast
+   The following alternative would not work as well when GCC is optimizing:
+
+     #define LDBL_MAX (*(long double const *) (double[])
+                       { DBL_MAX, DBL_MAX / 0x1p53 })
+ 
+-     #define LDBL_MAX \
+-       (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL })
+   The following alternative would require GCC 6 or later:
+ 
+-   Unfortunately, this is not a constant expression, and the latter expression
+-   does not work well when GCC is optimizing..  */
+     #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53)
+
+   Unfortunately none of the alternatives are constant expressions.  */
+ # if !GNULIB_defined_long_double_union
+ union gl_long_double_union
+   {
+@@ -161,6 +155,8 @@
+ # endif
+ extern const union gl_long_double_union gl_LDBL_MAX;
+ # define LDBL_MAX (gl_LDBL_MAX.ld)
+# undef LDBL_NORM_MAX
+# define LDBL_NORM_MAX LDBL_MAX
+ #endif
+ 
+ /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong.
+@@ -181,6 +177,21 @@
+ # endif
+ #endif
+ 
+/* On PowerPC platforms, 'long double' has a double-double representation.
+   Up to ISO C 17, this was outside the scope of ISO C because it can represent
+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits>, such as
+   1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see
+   ISO C 17 § 5.2.4.2.2.(3).
+   In ISO C 23, wording has been included that makes this 'long double'
+   representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9).  In this setting,
+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits> are
+   called "unnormalized".  And since LDBL_EPSILON must be normalized (per
+   ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105.  */
+#if defined __powerpc__ && LDBL_MANT_DIG == 106
+# undef LDBL_EPSILON
+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */
+#endif
+
+ /* ============================ ISO C11 support ============================ */
+ 
+ /* 'float' properties */
+@@ -309,7 +320,11 @@
+ # endif
+ #endif
+ #ifndef LDBL_NORM_MAX
+-# define LDBL_NORM_MAX LDBL_MAX
+# ifdef __LDBL_NORM_MAX__
+#  define LDBL_NORM_MAX __LDBL_NORM_MAX__
+# else
+#  define LDBL_NORM_MAX LDBL_MAX
+# endif
+ #endif
+ #ifndef LDBL_SNAN
+ /* For sh, beware of <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111814>.  */
--- a/pkgs/tools/misc/cutecom/default.nix
+++ b/pkgs/tools/misc/cutecom/default.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  qtserialport,
+  cmake,
+  wrapQtAppsHook,
+}:
+
+stdenv.mkDerivation {
+  pname = "cutecom";
+  version = "0.51.0+patch";
+
+  src = fetchFromGitLab {
+    owner = "cutecom";
+    repo = "cutecom";
+    rev = "70d0c497acf8f298374052b2956bcf142ed5f6ca";
+    sha256 = "X8jeESt+x5PxK3rTNC1h1Tpvue2WH09QRnG2g1eMoEE=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "/Applications" "$out/Applications"
+  '';
+
+  buildInputs = [ qtserialport ];
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  postInstall =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/Applications
+      ''
+    else
+      ''
+        cd ..
+        mkdir -p "$out"/share/{applications,icons/hicolor/scalable/apps,man/man1}
+        cp cutecom.desktop "$out/share/applications"
+        cp images/cutecom.svg "$out/share/icons/hicolor/scalable/apps"
+        cp cutecom.1 "$out/share/man/man1"
+      '';
+
+  meta = with lib; {
+    description = "Graphical serial terminal";
+    homepage = "https://gitlab.com/cutecom/cutecom/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ bennofs ];
+    platforms = platforms.unix;
+    mainProgram = "cutecom";
+  };
+}
--- a/pkgs/tools/misc/dialogbox/default.nix
+++ b/pkgs/tools/misc/dialogbox/default.nix
@@ -0,0 +1,49 @@
+{
+  stdenv,
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  qmake,
+  qtbase,
+}:
+
+mkDerivation rec {
+  pname = "dialogbox";
+  version = "1.0+unstable=2020-11-16";
+
+  src = fetchFromGitHub {
+    owner = "martynets";
+    repo = pname;
+    rev = "6989740746f376becc989ab2698e77d14186a0f9";
+    hash = "sha256-paTas3KbV4yZ0ePnrOH1S3bLLHDddFml1h6b6azK4RQ=";
+  };
+
+  nativeBuildInputs = [
+    qmake
+  ];
+
+  buildInputs = [
+    qtbase
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{bin,share/doc/dialogbox}
+    install dist/dialogbox $out/bin
+    install README.md $out/share/doc/dialogbox/
+    cp -r demos $out/share/doc/dialogbox/demos
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    broken = stdenv.hostPlatform.isDarwin;
+    homepage = "https://github.com/martynets/dialogbox/";
+    description = "Qt-based scriptable engine providing GUI dialog boxes";
+    license = licenses.gpl3Plus;
+    maintainers = [ ];
+    platforms = platforms.unix;
+    mainProgram = "dialogbox";
+  };
+}
--- a/pkgs/tools/misc/dvtm/default.nix
+++ b/pkgs/tools/misc/dvtm/default.nix
@@ -0,0 +1,19 @@
+{ callPackage, fetchurl }:
+callPackage ./dvtm.nix rec {
+  pname = "dvtm";
+  version = "0.15";
+
+  src = fetchurl {
+    url = "https://www.brain-dump.org/projects/dvtm/dvtm-${version}.tar.gz";
+    sha256 = "0475w514b7i3gxk6khy8pfj2gx9l7lv2pwacmq92zn1abv01a84g";
+  };
+
+  patches = [
+    # https://github.com/martanne/dvtm/pull/69
+    # Use self-pipe instead of signal blocking fixes issues on darwin.
+    (fetchurl {
+      url = "https://github.com/martanne/dvtm/commit/1f1ed664d64603f3f1ce1388571227dc723901b2.patch";
+      sha256 = "1cby8x3ckvhzqa8yxlfrwzgm8wk7yz84kr9psdjr7xwpnca1cqrd";
+    })
+  ];
+}
--- a/pkgs/tools/misc/dvtm/dvtm.nix
+++ b/pkgs/tools/misc/dvtm/dvtm.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  ncurses,
+  customConfig ? null,
+  pname,
+  version,
+  src,
+  patches ? [ ],
+}:
+stdenv.mkDerivation {
+
+  inherit
+    pname
+    version
+    src
+    patches
+    ;
+
+  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
+
+  postPatch = lib.optionalString (customConfig != null) ''
+    cp ${builtins.toFile "config.h" customConfig} ./config.h
+  '';
+
+  nativeBuildInputs = [ ncurses ];
+  buildInputs = [ ncurses ];
+
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace /usr/share/terminfo $out/share/terminfo
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "Dynamic virtual terminal manager";
+    homepage = "http://www.brain-dump.org/projects/dvtm";
+    license = licenses.mit;
+    maintainers = [ ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/dvtm/unstable.nix
+++ b/pkgs/tools/misc/dvtm/unstable.nix
@@ -0,0 +1,31 @@
+{
+  callPackage,
+  fetchpatch,
+  fetchzip,
+}:
+
+let
+  rev = "7bcf43f8dbd5c4a67ec573a1248114caa75fa3c2";
+in
+callPackage ./dvtm.nix {
+  pname = "dvtm-unstable";
+  version = "unstable-2021-03-09";
+
+  src = fetchzip {
+    urls = [
+      "https://github.com/martanne/dvtm/archive/${rev}.tar.gz"
+      "https://git.sr.ht/~martanne/dvtm/archive/${rev}.tar.gz"
+    ];
+    hash = "sha256-UtkNsW0mvLfbPSAIIZ1yvX9xzIDtiBeXCjhN2R8JhDc=";
+  };
+
+  patches = [
+    # https://github.com/martanne/dvtm/pull/69
+    # Use self-pipe instead of signal blocking fixes issues on darwin.
+    (fetchpatch {
+      name = "use-self-pipe-fix-darwin";
+      url = "https://github.com/martanne/dvtm/commit/1f1ed664d64603f3f1ce1388571227dc723901b2.patch";
+      sha256 = "14j3kks7b1v6qq12442v1da3h7khp02rp0vi0qrz0rfgkg1zilpb";
+    })
+  ];
+}
--- a/pkgs/tools/misc/fffuu/default.nix
+++ b/pkgs/tools/misc/fffuu/default.nix
@@ -0,0 +1,57 @@
+{
+  mkDerivation,
+  haskellPackages,
+  fetchFromGitHub,
+  lib,
+}:
+
+mkDerivation {
+  pname = "fffuu";
+  version = "unstable-2018-05-26";
+
+  src = fetchFromGitHub {
+    owner = "diekmann";
+    repo = "Iptables_Semantics";
+    rev = "e0a2516bd885708fce875023b474ae341cbdee29";
+    sha256 = "1qc7p44dqja6qrjbjdc2xn7n9v41j5v59sgjnxjj5k0mxp58y1ch";
+  };
+
+  postPatch = ''
+    substituteInPlace haskell_tool/fffuu.cabal \
+      --replace "containers >=0.5 && <0.6" "containers >= 0.6" \
+      --replace "optparse-generic >= 1.2.3 && < 1.3" "optparse-generic >= 1.2.3" \
+      --replace "split >= 0.2.3 && <= 0.2.4" "split >= 0.2.3"
+  '';
+
+  preCompileBuildDriver = ''
+    cd haskell_tool
+  '';
+
+  isLibrary = false;
+
+  isExecutable = true;
+
+  # fails with sandbox
+  doCheck = false;
+
+  libraryHaskellDepends = with haskellPackages; [
+    base
+    containers
+    split
+    parsec
+    optparse-generic
+  ];
+
+  executableHaskellDepends = with haskellPackages; [ base ];
+
+  testHaskellDepends = with haskellPackages; [
+    tasty
+    tasty-hunit
+    tasty-golden
+  ];
+
+  description = "Fancy Formal Firewall Universal Understander";
+  homepage = "https://github.com/diekmann/Iptables_Semantics/tree/master/haskell_tool";
+  license = lib.licenses.bsd2;
+  maintainers = [ ];
+}
--- a/pkgs/tools/misc/file/32-bit-time_t.patch
+++ b/pkgs/tools/misc/file/32-bit-time_t.patch
@@ -0,0 +1,38 @@
+https://github.com/file/file/commit/218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1.patch
+
+From 218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 28 Jul 2023 14:38:25 +0000
+Subject: [PATCH] deal with 32 bit time_t
+
+---
+ src/file.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/file.h b/src/file.h
+index 2e0494d2f..78f574ea1 100644
+--- a/src/file.h
+++ b/src/file.h
+@@ -27,7 +27,7 @@
+  */
+ /*
+  * file.h - definitions for file(1) program
+- * @(#)$File: file.h,v 1.247 2023/07/27 19:40:22 christos Exp $
+ * @(#)$File: file.h,v 1.248 2023/07/28 14:38:25 christos Exp $
+  */
+ 
+ #ifndef __file_h__
+@@ -159,9 +159,11 @@
+ /*
+  * Dec 31, 23:59:59 9999
+  * we need to make sure that we don't exceed 9999 because some libc
+- * implementations like muslc crash otherwise
+ * implementations like muslc crash otherwise. If you are unlucky
+ * to be running on a system with a 32 bit time_t, then it is even less.
+  */
+-#define	MAX_CTIME	CAST(time_t, 0x3afff487cfULL)
+#define	MAX_CTIME \
+    CAST(time_t, sizeof(time_t) > 4 ? 0x3afff487cfULL : 0x7fffffffULL)
+ 
+ #define FILE_BADSIZE CAST(size_t, ~0ul)
+ #define MAXDESC	64		/* max len of text description/MIME type */
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  file,
+  zlib,
+  libgnurx,
+  updateAutotoolsGnuConfigScriptsHook,
+  testers,
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "file";
+  version = "5.45";
+
+  src = fetchurl {
+    urls = [
+      "https://astron.com/pub/file/file-${finalAttrs.version}.tar.gz"
+      "https://distfiles.macports.org/file/file-${finalAttrs.version}.tar.gz"
+    ];
+    hash = "sha256-/Jf1ECm7DiyfTjv/79r2ePDgOe6HK53lwAKm0Jx4TYI=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
+  patches = [
+    # Upstream patch to fix 32-bit tests.
+    #
+    # It is included in 5.46+, but we are not updating to it or a later version until:
+    #
+    # https://bugs.astron.com/view.php?id=622
+    # https://bugs.astron.com/view.php?id=638
+    #
+    # are resolved. See also description of the 1st bug here:
+    #
+    # https://github.com/NixOS/nixpkgs/pull/402318#issuecomment-2881163359
+    ./32-bit-time_t.patch
+  ];
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    updateAutotoolsGnuConfigScriptsHook
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
+  buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;
+
+  # https://bugs.astron.com/view.php?id=382
+  doCheck = !stdenv.buildPlatform.isMusl;
+
+  makeFlags = lib.optional stdenv.hostPlatform.isWindows "FILE_COMPILE=file";
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = with lib; {
+    homepage = "https://darwinsys.com/file";
+    description = "Program that shows the type of files";
+    maintainers = with maintainers; [ doronbehar ];
+    license = licenses.bsd2;
+    pkgConfigModules = [ "libmagic" ];
+    platforms = platforms.all;
+    mainProgram = "file";
+  };
+})
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  updateAutotoolsGnuConfigScriptsHook,
+  coreutils,
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation rec {
+  pname = "findutils";
+  version = "4.10.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
+    sha256 = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+  };
+
+  postPatch = ''
+    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${coreutils}/bin/echo";'
+  '';
+
+  patches = [ ./no-install-statedir.patch ];
+
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+  buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort
+
+  # Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
+  doCheck =
+    !stdenv.hostPlatform.isDarwin
+    && !stdenv.hostPlatform.isFreeBSD
+    && !(stdenv.hostPlatform.libc == "glibc" && stdenv.hostPlatform.isi686)
+    && (stdenv.hostPlatform.libc != "musl")
+    && stdenv.hostPlatform == stdenv.buildPlatform;
+
+  outputs = [
+    "out"
+    "info"
+    "locate"
+  ];
+
+  configureFlags = [
+    # "sort" need not be on the PATH as a run-time dep, so we need to tell
+    # configure where it is. Covers the cross and native case alike.
+    "SORT=${coreutils}/bin/sort"
+    "--localstatedir=/var/cache"
+  ];
+
+  CFLAGS = lib.optionals stdenv.hostPlatform.isDarwin [
+    # TODO: Revisit upstream issue https://savannah.gnu.org/bugs/?59972
+    # https://github.com/Homebrew/homebrew-core/pull/69761#issuecomment-770268478
+    "-D__nonnull\\(params\\)="
+  ];
+
+  postInstall = ''
+    moveToOutput bin/locate $locate
+    moveToOutput bin/updatedb $locate
+  '';
+
+  # can't move man pages in postInstall because the multi-output hook will move them back to $out
+  postFixup = ''
+    moveToOutput share/man/man5 $locate
+    moveToOutput share/man/man1/locate.1.gz $locate
+    moveToOutput share/man/man1/updatedb.1.gz $locate
+  '';
+
+  enableParallelBuilding = true;
+
+  # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment:
+  # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
+  # or you can check libc/include/sys/cdefs.h in bionic source code
+  hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
+
+  meta = {
+    homepage = "https://www.gnu.org/software/findutils/";
+    description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
+
+    longDescription = ''
+      The GNU Find Utilities are the basic directory searching
+      utilities of the GNU operating system.  These programs are
+      typically used in conjunction with other programs to provide
+      modular and powerful directory search and file locating
+      capabilities to other commands.
+
+      The tools supplied with this package are:
+
+          * find - search for files in a directory hierarchy;
+          * xargs - build and execute command lines from standard input.
+
+      The following are available in the locate output:
+
+          * locate - list files in databases that match a pattern;
+          * updatedb - update a file name database;
+    '';
+
+    platforms = lib.platforms.all;
+
+    license = lib.licenses.gpl3Plus;
+
+    mainProgram = "find";
+  };
+}
--- a/pkgs/tools/misc/findutils/no-install-statedir.patch
+++ b/pkgs/tools/misc/findutils/no-install-statedir.patch
@@ -0,0 +1,11 @@
+--- a/locate/Makefile.in
+++ b/locate/Makefile.in
+@@ -2357,7 +2357,7 @@ updatedb: updatedb.sh Makefile
+ 	chmod +x $@
+ 
+ install-data-hook:
+-	$(top_srcdir)/build-aux/mkinstalldirs $(DESTDIR)$(localstatedir)
+	#$(top_srcdir)/build-aux/mkinstalldirs $(DESTDIR)$(localstatedir)
+ 
+ dblocation.texi:
+ 	echo '@set LOCATE_DB $(LOCATE_DB)' > $@.tmp
--- a/pkgs/tools/misc/fltrdr/default.nix
+++ b/pkgs/tools/misc/fltrdr/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  icu,
+  openssl,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fltrdr";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    repo = "fltrdr";
+    owner = "octobanana";
+    rev = version;
+    sha256 = "1vpci7vqzcpdd21zgigyz38k77r9fc81dmiwsvfr8w7gad5sg6sj";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    icu
+    openssl
+  ];
+
+  meta = with lib; {
+    homepage = "https://octobanana.com/software/fltrdr";
+    description = "TUI text reader for the terminal";
+
+    longDescription = ''
+      Fltrdr, or flat-reader, is an interactive text reader for the terminal. It
+      is flat in the sense that the reader is word-based. It creates a
+      horizontal stream of words, ignoring all newline characters and reducing
+      extra whitespace. Its purpose is to facilitate reading, scanning, and
+      searching text. The program has a play mode that moves the reader forward
+      one word at a time, along with a configurable words per minute (WPM),
+      setting.
+    '';
+
+    platforms = platforms.linux; # can only test linux
+    license = licenses.mit;
+    maintainers = [ maintainers.matthiasbeyer ];
+    mainProgram = "fltrdr";
+  };
+}
--- a/pkgs/tools/misc/fluentd/Gemfile
+++ b/pkgs/tools/misc/fluentd/Gemfile
@@ -0,0 +1,13 @@
+source "https://rubygems.org"
+
+gem 'fluentd'
+gem 'fluent-plugin-record-reformer'
+gem 'fluent-plugin-s3'
+gem 'fluent-plugin-kinesis'
+gem 'fluent-plugin-kafka'
+gem 'fluent-plugin-elasticsearch'
+gem 'fluent-plugin-mongo'
+gem 'fluent-plugin-webhdfs'
+gem 'fluent-plugin-rewrite-tag-filter'
+gem 'fluent-plugin-cloudwatch-logs'
+gem 'fluent-plugin-concat'
--- a/pkgs/tools/misc/fluentd/Gemfile.lock
+++ b/pkgs/tools/misc/fluentd/Gemfile.lock
@@ -0,0 +1,172 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    aws-eventstream (1.3.2)
+    aws-partitions (1.1064.0)
+    aws-sdk-cloudwatchlogs (1.109.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-core (3.220.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-firehose (1.89.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-kinesis (1.74.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-kms (1.99.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.182.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-sqs (1.93.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.11.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    base64 (0.2.0)
+    bson (4.15.0)
+    concurrent-ruby (1.3.5)
+    cool.io (1.9.0)
+    csv (3.3.2)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    drb (2.2.1)
+    elastic-transport (8.4.0)
+      faraday (< 3)
+      multi_json
+    elasticsearch (8.17.1)
+      elastic-transport (~> 8.3)
+      elasticsearch-api (= 8.17.1)
+    elasticsearch-api (8.17.1)
+      multi_json
+    excon (1.2.5)
+      logger
+    faraday (2.12.2)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-excon (2.3.0)
+      excon (>= 1.0.0)
+      faraday (>= 2.11.0, < 3)
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
+    fluent-config-regexp-type (1.0.0)
+      fluentd (> 1.0.0, < 2)
+    fluent-plugin-cloudwatch-logs (0.14.3)
+      aws-sdk-cloudwatchlogs (~> 1.0)
+      fluentd (>= 1.8.0)
+    fluent-plugin-concat (2.5.0)
+      fluentd (>= 0.14.0, < 2)
+    fluent-plugin-elasticsearch (5.4.3)
+      elasticsearch
+      excon
+      faraday (>= 2.0.0)
+      faraday-excon (>= 2.0.0)
+      fluentd (>= 0.14.22)
+    fluent-plugin-kafka (0.19.3)
+      fluentd (>= 0.10.58, < 2)
+      ltsv
+      ruby-kafka (>= 1.5.0, < 2)
+    fluent-plugin-kinesis (3.5.0)
+      aws-sdk-firehose (~> 1, != 1.9, != 1.5, != 1.15)
+      aws-sdk-kinesis (~> 1, != 1.5, != 1.4, != 1.14)
+      fluentd (>= 0.14.22, < 2)
+      google-protobuf (~> 3)
+    fluent-plugin-mongo (1.6.0)
+      fluentd (>= 0.14.22, < 2)
+      mongo (>= 2.15.0, < 2.19.0)
+    fluent-plugin-record-reformer (0.9.1)
+      fluentd
+    fluent-plugin-rewrite-tag-filter (2.4.0)
+      fluent-config-regexp-type
+      fluentd (>= 0.14.2, < 2)
+    fluent-plugin-s3 (1.8.3)
+      aws-sdk-s3 (~> 1.60)
+      aws-sdk-sqs (~> 1.23)
+      fluentd (>= 0.14.22, < 2)
+    fluent-plugin-webhdfs (1.6.0)
+      fluentd (>= 0.14.22)
+      webhdfs (>= 0.11.0)
+    fluentd (1.18.0)
+      base64 (~> 0.2)
+      bundler
+      cool.io (>= 1.4.5, < 2.0.0)
+      csv (~> 3.2)
+      drb (~> 2.2)
+      http_parser.rb (>= 0.5.1, < 0.9.0)
+      logger (~> 1.6)
+      msgpack (>= 1.3.1, < 2.0.0)
+      serverengine (>= 2.3.2, < 3.0.0)
+      sigdump (~> 0.2.5)
+      strptime (>= 0.2.4, < 1.0.0)
+      tzinfo (>= 1.0, < 3.0)
+      tzinfo-data (~> 1.0)
+      webrick (~> 1.4)
+      yajl-ruby (~> 1.0)
+    google-protobuf (3.25.6)
+    google-protobuf (3.25.6-aarch64-linux)
+    google-protobuf (3.25.6-arm64-darwin)
+    google-protobuf (3.25.6-x86-linux)
+    google-protobuf (3.25.6-x86_64-darwin)
+    http_parser.rb (0.8.0)
+    jmespath (1.6.2)
+    json (2.10.1)
+    logger (1.6.6)
+    ltsv (0.1.2)
+    mongo (2.18.3)
+      bson (>= 4.14.1, < 5.0.0)
+    msgpack (1.8.0)
+    multi_json (1.15.0)
+    net-http (0.6.0)
+      uri
+    public_suffix (6.0.1)
+    rake (13.2.1)
+    ruby-kafka (1.5.0)
+      digest-crc
+    serverengine (2.4.0)
+      base64 (~> 0.1)
+      logger (~> 1.4)
+      sigdump (~> 0.2.2)
+    sigdump (0.2.5)
+    strptime (0.2.5)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    tzinfo-data (1.2025.1)
+      tzinfo (>= 1.0.0)
+    uri (1.0.3)
+    webhdfs (0.11.0)
+      addressable
+    webrick (1.9.1)
+    yajl-ruby (1.4.3)
+
+PLATFORMS
+  aarch64-linux
+  arm64-darwin
+  ruby
+  x86-linux
+  x86_64-darwin
+
+DEPENDENCIES
+  fluent-plugin-cloudwatch-logs
+  fluent-plugin-concat
+  fluent-plugin-elasticsearch
+  fluent-plugin-kafka
+  fluent-plugin-kinesis
+  fluent-plugin-mongo
+  fluent-plugin-record-reformer
+  fluent-plugin-rewrite-tag-filter
+  fluent-plugin-s3
+  fluent-plugin-webhdfs
+  fluentd
+
+BUNDLED WITH
+   2.6.2
--- a/pkgs/tools/misc/fluentd/default.nix
+++ b/pkgs/tools/misc/fluentd/default.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  bundlerEnv,
+  ruby,
+  bundlerUpdateScript,
+  nixosTests,
+}:
+
+bundlerEnv {
+  inherit ruby;
+
+  pname = "fluentd";
+  gemdir = ./.;
+
+  passthru.updateScript = bundlerUpdateScript "fluentd";
+  passthru.tests.fluentd = nixosTests.fluentd;
+
+  meta = with lib; {
+    description = "Data collector";
+    homepage = "https://www.fluentd.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      offline
+      nicknovitski
+    ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/fluentd/gemset.nix
+++ b/pkgs/tools/misc/fluentd/gemset.nix
@@ -0,0 +1,716 @@
+{
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      type = "gem";
+    };
+    version = "2.8.7";
+  };
+  aws-eventstream = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mvjjn8vh1c3nhibmjj9qcwxagj6m9yy961wblfqdmvhr9aklb3y";
+      type = "gem";
+    };
+    version = "1.3.2";
+  };
+  aws-partitions = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jdajznsdc0niv68xqp9sv29l9piyn32grq1y367l14hbm17mnf2";
+      type = "gem";
+    };
+    version = "1.1064.0";
+  };
+  aws-sdk-cloudwatchlogs = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1izd0al8i8wmi0cx18w4y8nriw623c21rb7c8vwpgk4mzd2kqxhw";
+      type = "gem";
+    };
+    version = "1.109.0";
+  };
+  aws-sdk-core = {
+    dependencies = [
+      "aws-eventstream"
+      "aws-partitions"
+      "aws-sigv4"
+      "base64"
+      "jmespath"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cjdqmy5hjbgzc0iac1i143va76qgp7jc7hg1aviy1n8cgywq44y";
+      type = "gem";
+    };
+    version = "3.220.1";
+  };
+  aws-sdk-firehose = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1sryh7fjg525ddwlbd37mi3ygjcc6qn9r0md64d6ssrvk2ah0v1i";
+      type = "gem";
+    };
+    version = "1.89.0";
+  };
+  aws-sdk-kinesis = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qfwsc373a674y8xcy8g1ykc84d21vbz0dqpbh1f1k2mny2cxz7s";
+      type = "gem";
+    };
+    version = "1.74.0";
+  };
+  aws-sdk-kms = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1a3mh89kfh6flqxw48wfv9wfwkj2zxazw096mqm56wnnzz1jyads";
+      type = "gem";
+    };
+    version = "1.99.0";
+  };
+  aws-sdk-s3 = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sdk-kms"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03a55dbihv6xvgfwhx0f35rwc7q3rr0555vfpxlwpdjw75wkbz6h";
+      type = "gem";
+    };
+    version = "1.182.0";
+  };
+  aws-sdk-sqs = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16b5jdnmk93l86nnqpij4zac7srx8c2yvx07xxbazmkawcnrd27g";
+      type = "gem";
+    };
+    version = "1.93.0";
+  };
+  aws-sigv4 = {
+    dependencies = [ "aws-eventstream" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nx1il781qg58nwjkkdn9fw741cjjnixfsh389234qm8j5lpka2h";
+      type = "gem";
+    };
+    version = "1.11.0";
+  };
+  base64 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  bson = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19vgs9rzzyvd7jfrzynjnc6518q0ffpfciyicfywbp77zl8nc9hk";
+      type = "gem";
+    };
+    version = "4.15.0";
+  };
+  concurrent-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      type = "gem";
+    };
+    version = "1.3.5";
+  };
+  "cool.io" = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cl3ri6zsnpm3hixmlkrmyjir1w7m9szjfizwvccn05qb40a4apa";
+      type = "gem";
+    };
+    version = "1.9.0";
+  };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kmx36jjh2sahd989vcvw74lrlv07dqc3rnxchc5sj2ywqsw3w3g";
+      type = "gem";
+    };
+    version = "3.3.2";
+  };
+  digest-crc = {
+    dependencies = [ "rake" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01wcsyhaadss4zzvqh12kvbq3hmkl5y4fck7pr608hd24qxc5bb4";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
+  drb = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  elastic-transport = {
+    dependencies = [
+      "faraday"
+      "multi_json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xz5q3zlbkwdb9zipallvqxdw6gnz8ljyz4w7b3pv1lar43f9sdm";
+      type = "gem";
+    };
+    version = "8.4.0";
+  };
+  elasticsearch = {
+    dependencies = [
+      "elastic-transport"
+      "elasticsearch-api"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nbwd1f5s060hiqcs2bmwzvsli3l3vcyyd3khxcxzzxvysqq0zb9";
+      type = "gem";
+    };
+    version = "8.17.1";
+  };
+  elasticsearch-api = {
+    dependencies = [ "multi_json" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1iwl70xid303nyhfv5342yj5kk37rjbgdzkjdi83fnvyhisi5166";
+      type = "gem";
+    };
+    version = "8.17.1";
+  };
+  excon = {
+    dependencies = [ "logger" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17asr18vawi08g3wbif0wdi8bnyj01d125saydl9j1f03fv0n16a";
+      type = "gem";
+    };
+    version = "1.2.5";
+  };
+  faraday = {
+    dependencies = [
+      "faraday-net_http"
+      "json"
+      "logger"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mls9g490k63rdmjc9shqshqzznfn1y21wawkxrwp2vvbk13jwqm";
+      type = "gem";
+    };
+    version = "2.12.2";
+  };
+  faraday-excon = {
+    dependencies = [
+      "excon"
+      "faraday"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xdmwnkkms7bnx0bpkdk52qcazjqa3skb7jmjr21cjr8mdsp3z65";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  faraday-net_http = {
+    dependencies = [ "net-http" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
+      type = "gem";
+    };
+    version = "3.4.0";
+  };
+  fluent-config-regexp-type = {
+    dependencies = [ "fluentd" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hk0vxcmlbid7n6piyv3x83j5gyiz7in397l9x3c6nh69wicy7gm";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  fluent-plugin-cloudwatch-logs = {
+    dependencies = [
+      "aws-sdk-cloudwatchlogs"
+      "fluentd"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "139d7qv4my818mhjp0104ns9dlndlvrb6dgxa2rkv6jlzlamjpjb";
+      type = "gem";
+    };
+    version = "0.14.3";
+  };
+  fluent-plugin-concat = {
+    dependencies = [ "fluentd" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b9z6hrjcsvccfimmgczzcbhvf2zwyqzvsdc29i2biqhk1mcwn3k";
+      type = "gem";
+    };
+    version = "2.5.0";
+  };
+  fluent-plugin-elasticsearch = {
+    dependencies = [
+      "elasticsearch"
+      "excon"
+      "faraday"
+      "faraday-excon"
+      "fluentd"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19psa92z4zsmbwz8n4rizkwws58qlgb30325rhmqpnsp9h8b0cbb";
+      type = "gem";
+    };
+    version = "5.4.3";
+  };
+  fluent-plugin-kafka = {
+    dependencies = [
+      "fluentd"
+      "ltsv"
+      "ruby-kafka"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p3z1z22ir442rrxv8f8ki50iv6hmx7q5zm0lglyfh6nmkpf6vv1";
+      type = "gem";
+    };
+    version = "0.19.3";
+  };
+  fluent-plugin-kinesis = {
+    dependencies = [
+      "aws-sdk-firehose"
+      "aws-sdk-kinesis"
+      "fluentd"
+      "google-protobuf"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12wx84a9h1xjldxa3yxxsmkyn620m2knw47dmfnr9rvgw2s4dlrz";
+      type = "gem";
+    };
+    version = "3.5.0";
+  };
+  fluent-plugin-mongo = {
+    dependencies = [
+      "fluentd"
+      "mongo"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1m3fa6fwpzxw08lnczsif5c7v33yryyvgb1lbp7a7qjhipvb6jfm";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  fluent-plugin-record-reformer = {
+    dependencies = [ "fluentd" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gwfrfyi9is4l9q4ih3c4l3c9qvyh00jnd2qajdpdh5xjj2m7akn";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
+  fluent-plugin-rewrite-tag-filter = {
+    dependencies = [
+      "fluent-config-regexp-type"
+      "fluentd"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vjvn8ph87cl2dl0dbaap69rciglsdma1y5ghn2vm5mvh5h7xbs6";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  fluent-plugin-s3 = {
+    dependencies = [
+      "aws-sdk-s3"
+      "aws-sdk-sqs"
+      "fluentd"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0c7l7y51j5fz99086ghj99rjv16frj5kl4wcclvfws1jc5c38mj9";
+      type = "gem";
+    };
+    version = "1.8.3";
+  };
+  fluent-plugin-webhdfs = {
+    dependencies = [
+      "fluentd"
+      "webhdfs"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mqj7fk1ylydkrjrph2n15n6bcn1vpgnjh4z2svxi2qsc5rnaki3";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  fluentd = {
+    dependencies = [
+      "base64"
+      "cool.io"
+      "csv"
+      "drb"
+      "http_parser.rb"
+      "logger"
+      "msgpack"
+      "serverengine"
+      "sigdump"
+      "strptime"
+      "tzinfo"
+      "tzinfo-data"
+      "webrick"
+      "yajl-ruby"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "100fd0ihgpqddkdqmbvlp51v09rnr4xb25l5lq776ai21hc4gj8d";
+      type = "gem";
+    };
+    version = "1.18.0";
+  };
+  google-protobuf = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0g0h7rwiivx93jddfws5pdkcpnhma3694k2jfv2i1k80qkrqnrmv";
+      type = "gem";
+    };
+    version = "3.25.6";
+  };
+  "http_parser.rb" = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gj4fmls0mf52dlr928gaq0c0cb0m3aqa9kaa6l0ikl2zbqk42as";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  jmespath = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cdw9vw2qly7q7r41s7phnac264rbsdqgj4l0h4nqgbjb157g393";
+      type = "gem";
+    };
+    version = "1.6.2";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1p4l5ycdxfsr8b51gnvlvhq6s21vmx9z4x617003zbqv3bcqmj6x";
+      type = "gem";
+    };
+    version = "2.10.1";
+  };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      type = "gem";
+    };
+    version = "1.6.6";
+  };
+  ltsv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wrjvc5079zhpn62k1yflrf7js6vaysrg1qwggf7bj2zi0p5rhys";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  mongo = {
+    dependencies = [ "bson" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xinxrx25q9hzl78bhm404vlfgm04csbgkr7kkrw47s53l9mghhf";
+      type = "gem";
+    };
+    version = "2.18.3";
+  };
+  msgpack = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cnpnbn2yivj9gxkh8mjklbgnpx6nf7b8j2hky01dl0040hy0k76";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  multi_json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  net-http = {
+    dependencies = [ "uri" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  public_suffix = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      type = "gem";
+    };
+    version = "6.0.1";
+  };
+  rake = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
+      type = "gem";
+    };
+    version = "13.2.1";
+  };
+  ruby-kafka = {
+    dependencies = [ "digest-crc" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "13i3fvjy0n1n1aa71b30nwx2xchhsps3yhi17r0s6ay7wr26jr7p";
+      type = "gem";
+    };
+    version = "1.5.0";
+  };
+  serverengine = {
+    dependencies = [
+      "base64"
+      "logger"
+      "sigdump"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1g26sbxwidgryn57nzxw25dq67ij037vml9ld28ckyl7y4qs8hja";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  sigdump = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hkj8fsl1swjfqvzgrwbyrwwn7403q95fficbll8nibhrqf6qw5v";
+      type = "gem";
+    };
+    version = "0.2.5";
+  };
+  strptime = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ycs0xz58kymf7yp4h56f0nid2z7g3s18dj7pa3p790pfzzpgvcq";
+      type = "gem";
+    };
+    version = "0.2.5";
+  };
+  tzinfo = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
+      type = "gem";
+    };
+    version = "2.0.6";
+  };
+  tzinfo-data = {
+    dependencies = [ "tzinfo" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02yz3x0qxnnwbf7k18yck5pggbnyy43rq0d5w2r6rwlk3981m31d";
+      type = "gem";
+    };
+    version = "1.2025.1";
+  };
+  uri = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  webhdfs = {
+    dependencies = [ "addressable" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "157b725w4795i4bk2318fbj4bg1r83kvnmnbjykgzypi94mfhc6i";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  webrick = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12d9n8hll67j737ym2zw4v23cn4vxyfkb6vyv1rzpwv6y6a3qbdl";
+      type = "gem";
+    };
+    version = "1.9.1";
+  };
+  yajl-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lni4jbyrlph7sz8y49q84pb0sbj82lgwvnjnsiv01xf26f4v5wc";
+      type = "gem";
+    };
+    version = "1.4.3";
+  };
+}
--- a/pkgs/tools/misc/gams/default.nix
+++ b/pkgs/tools/misc/gams/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  unzip,
+  file,
+  licenseFile ? null,
+  optgamsFile ? null,
+}:
+
+stdenv.mkDerivation rec {
+  version = "25.0.2";
+  pname = "gams";
+  src = fetchurl {
+    url = "https://d37drm4t2jghv5.cloudfront.net/distributions/${version}/linux/linux_x64_64_sfx.exe";
+    sha256 = "4f95389579f33ff7c2586838a2c19021aa0746279555cbb51aa6e0efd09bd297";
+  };
+  unpackCmd = "unzip $src";
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ file ];
+  dontBuild = true;
+
+  installPhase =
+    assert licenseFile != null;
+    ''
+      mkdir -p "$out/bin" "$out/share/gams"
+      cp -a * "$out/share/gams"
+
+      cp ${licenseFile} $out/share/gams/gamslice.txt
+    ''
+    + lib.optionalString (optgamsFile != null) ''
+      cp ${optgamsFile} $out/share/gams/optgams.def
+      ln -s $out/share/gams/optgams.def $out/bin/optgams.def
+    '';
+
+  postFixup = ''
+    for f in $out/share/gams/*; do
+      if [[ -x $f ]] && [[ -f $f ]] && [[ ! $f =~ .*\.so$ ]]; then
+        if patchelf \
+          --set-rpath "$out/share/gams" \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $f; then
+          ln -s $f $out/bin/$(basename $f)
+        fi
+      fi
+    done
+  '';
+
+  meta = with lib; {
+    description = "General Algebraic Modeling System";
+    longDescription = ''
+      The General Algebraic Modeling System is a high-level modeling system for mathematical optimization.
+      GAMS is designed for modeling and solving linear, nonlinear, and mixed-integer optimization problems.
+    '';
+    homepage = "https://www.gams.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.Scriptkiddi ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/misc/geekbench/4.nix
+++ b/pkgs/tools/misc/geekbench/4.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  addDriverRunpath,
+  makeWrapper,
+  ocl-icd,
+  vulkan-loader,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "geekbench";
+  version = "4.4.4";
+
+  src = fetchurl {
+    url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
+    sha256 = "sha256-KVsBE0ueWewmoVY/vzxX2sKhRTzityPNR+wmTwZBWiI=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+  buildInputs = [ stdenv.cc.cc ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r geekbench.plar geekbench4 geekbench_x86_64 $out/bin
+
+    for f in geekbench4 geekbench_x86_64 ; do
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${
+          lib.makeLibraryPath [
+            addDriverRunpath.driverLink
+            ocl-icd
+            vulkan-loader
+          ]
+        }"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform benchmark";
+    homepage = "https://geekbench.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.michalrus ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "geekbench4";
+  };
+}
--- a/pkgs/tools/misc/geekbench/5.nix
+++ b/pkgs/tools/misc/geekbench/5.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  addDriverRunpath,
+  makeWrapper,
+  ocl-icd,
+  vulkan-loader,
+}:
+
+let
+  inherit (stdenv.hostPlatform.uname) processor;
+  version = "5.5.1";
+  sources = {
+    "x86_64-linux" = {
+      url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
+      hash = "sha256-MgN+VcPcjzYP4Wt/uxiNMTh+p1mA5I2M8CgzDjI5xAQ=";
+    };
+    "aarch64-linux" = {
+      url = "https://cdn.geekbench.com/Geekbench-${version}-LinuxARMPreview.tar.gz";
+      hash = "sha256-nrPKnsMqvw6+HGQAKxkQi/6lPEEca1VrDCaJUUuMvW8=";
+    };
+  };
+in
+stdenv.mkDerivation {
+  inherit version;
+  pname = "geekbench";
+
+  src = fetchurl (
+    sources.${stdenv.system} or (throw "unsupported system ${stdenv.hostPlatform.system}")
+  );
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r geekbench.plar geekbench5 geekbench_${processor} $out/bin
+
+    for f in geekbench5 geekbench_${processor} ; do
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${
+          lib.makeLibraryPath [
+            addDriverRunpath.driverLink
+            ocl-icd
+            vulkan-loader
+          ]
+        }"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform benchmark";
+    homepage = "https://geekbench.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.michalrus ];
+    platforms = builtins.attrNames sources;
+    mainProgram = "geekbench5";
+  };
+}
--- a/pkgs/tools/misc/geekbench/6.nix
+++ b/pkgs/tools/misc/geekbench/6.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  addDriverRunpath,
+  makeWrapper,
+  ocl-icd,
+  vulkan-loader,
+}:
+
+let
+  inherit (stdenv.hostPlatform.uname) processor;
+  version = "6.4.0";
+  sources = {
+    "x86_64-linux" = {
+      url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
+      hash = "sha256-Q4MwU3dIFheKKSMxzCBZI8XoForaN41BuRGVMhJaUKw=";
+    };
+    "aarch64-linux" = {
+      url = "https://cdn.geekbench.com/Geekbench-${version}-LinuxARMPreview.tar.gz";
+      hash = "sha256-PZ95w2X4sqTLZGZ5wygt7WjSK4Gfgtdh/UCPo+8Ysc8=";
+    };
+  };
+  geekbench_avx2 = lib.optionalString stdenv.hostPlatform.isx86_64 "geekbench_avx2";
+in
+stdenv.mkDerivation {
+  inherit version;
+  pname = "geekbench";
+
+  src = fetchurl (
+    sources.${stdenv.system} or (throw "unsupported system ${stdenv.hostPlatform.system}")
+  );
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r geekbench.plar geekbench-workload.plar geekbench6 geekbench_${processor} ${geekbench_avx2} $out/bin
+
+    for f in geekbench6 geekbench_${processor} ${geekbench_avx2} ; do
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${
+          lib.makeLibraryPath [
+            addDriverRunpath.driverLink
+            ocl-icd
+            vulkan-loader
+          ]
+        }"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Cross-platform benchmark";
+    homepage = "https://geekbench.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      michalrus
+      asininemonkey
+    ];
+    platforms = builtins.attrNames sources;
+    mainProgram = "geekbench6";
+  };
+}
--- a/pkgs/tools/misc/graylog/6.0.nix
+++ b/pkgs/tools/misc/graylog/6.0.nix
@@ -0,0 +1,10 @@
+{ callPackage, lib, ... }:
+let
+  buildGraylog = callPackage ./graylog.nix { };
+in
+buildGraylog {
+  version = "6.0.14";
+  hash = "sha256-PH3xAO4bb5SvcqZoRoQeRaIBZdGfoRd3Kcnr603hYaI=";
+  maintainers = with lib.maintainers; [ bbenno ];
+  license = lib.licenses.sspl;
+}
--- a/pkgs/tools/misc/graylog/6.1.nix
+++ b/pkgs/tools/misc/graylog/6.1.nix
@@ -0,0 +1,10 @@
+{ callPackage, lib, ... }:
+let
+  buildGraylog = callPackage ./graylog.nix { };
+in
+buildGraylog {
+  version = "6.1.8";
+  hash = "sha256-omyV4BSY9SWDFyLcQCr0+LcjRecw9C1HtvsnCJrZX1U=";
+  maintainers = with lib.maintainers; [ bbenno ];
+  license = lib.licenses.sspl;
+}
--- a/pkgs/tools/misc/graylog/graylog.nix
+++ b/pkgs/tools/misc/graylog/graylog.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  openjdk11_headless,
+  openjdk17_headless,
+  systemd,
+  nixosTests,
+}:
+
+{
+  version,
+  hash,
+  maintainers,
+  license,
+}:
+stdenv.mkDerivation rec {
+  pname = "graylog_${lib.versions.majorMinor version}";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
+    inherit hash;
+  };
+
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+  makeWrapperArgs = [
+    "--set-default"
+    "JAVA_HOME"
+    "${if (lib.versionAtLeast version "5.0") then openjdk17_headless else openjdk11_headless}"
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ systemd ]}"
+  ];
+
+  passthru.tests = { inherit (nixosTests) graylog; };
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r {graylog.jar,bin,plugin} $out
+  ''
+  + lib.optionalString (lib.versionOlder version "4.3") ''
+    cp -r lib $out
+  ''
+  + ''
+    wrapProgram $out/bin/graylogctl $makeWrapperArgs
+  '';
+
+  meta = with lib; {
+    description = "Open source log management solution";
+    homepage = "https://www.graylog.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    inherit license;
+    inherit maintainers;
+    mainProgram = "graylogctl";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -0,0 +1,315 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  unzip,
+  graylogPackage,
+}:
+
+let
+  inherit (lib)
+    licenses
+    maintainers
+    platforms
+    sourceTypes
+    ;
+
+  glPlugin =
+    a@{
+      pluginName,
+      version,
+      installPhase ? ''
+        mkdir -p $out/bin
+        cp $src $out/bin/${pluginName}-${version}.jar
+      '',
+      ...
+    }:
+    stdenv.mkDerivation (
+      a
+      // {
+        inherit installPhase;
+        dontUnpack = true;
+        nativeBuildInputs = [ unzip ];
+        meta = a.meta // {
+          platforms = graylogPackage.meta.platforms;
+          maintainers = (a.meta.maintainers or [ ]) ++ [ maintainers.fadenb ];
+          sourceProvenance = with sourceTypes; [ binaryBytecode ];
+        };
+      }
+    );
+in
+{
+  aggregates = glPlugin rec {
+    name = "graylog-aggregates-${version}";
+    pluginName = "graylog-plugin-aggregates";
+    version = "2.4.0";
+    src = fetchurl {
+      url = "https://github.com/cvtienhoven/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1c48almnjr0b6nvzagnb9yddqbcjs7yhrd5yc5fx9q7w3vxi50zp";
+    };
+    meta = {
+      homepage = "https://github.com/cvtienhoven/graylog-plugin-aggregates";
+      description = "Plugin that enables users to execute term searches and get notified when the given criteria are met";
+    };
+  };
+  auth_sso = glPlugin rec {
+    name = "graylog-auth-sso-${version}";
+    pluginName = "graylog-plugin-auth-sso";
+    version = "3.3.0";
+    src = fetchurl {
+      url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1g47hlld8vzicd47b5i9n2816rbrhv18vjq8gp765c7mdg4a2jn8";
+    };
+    meta = {
+      homepage = "https://github.com/Graylog2/graylog-plugin-auth-sso";
+      description = "SSO support for Graylog through trusted HTTP headers set by load balancers or authentication proxies";
+    };
+  };
+  dnsresolver = glPlugin rec {
+    name = "graylog-dnsresolver-${version}";
+    pluginName = "graylog-plugin-dnsresolver";
+    version = "1.2.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0djlyd4w4mrrqfbrs20j1xw0fygqsb81snz437v9bf80avmcyzg1";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-dnsresolver";
+      description = "Message filter plugin can be used to do DNS lookups for the source field in Graylog messages";
+    };
+  };
+  enterprise-integrations = glPlugin rec {
+    name = "graylog-enterprise-integrations-${version}";
+    pluginName = "graylog-plugin-enterprise-integrations";
+    version = "3.3.9";
+    src = fetchurl {
+      url = "https://downloads.graylog.org/releases/graylog-enterprise-integrations/graylog-enterprise-integrations-plugins-${version}.tgz";
+      sha256 = "0yr2lmf50w8qw5amimmym6y4jxga4d7s7cbiqs5sqzvipgsknbwj";
+    };
+    installPhase = ''
+      mkdir -p $out/bin
+      tar --strip-components=2 -xf $src
+      cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
+    '';
+    meta = {
+      homepage = "https://docs.graylog.org/en/3.3/pages/integrations.html#enterprise";
+      description = "Integrations are tools that help Graylog work with external systems (unfree enterprise integrations)";
+      license = licenses.unfree;
+    };
+  };
+  filter-messagesize = glPlugin rec {
+    name = "graylog-filter-messagesize-${version}";
+    pluginName = "graylog-plugin-filter-messagesize";
+    version = "0.0.2";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1vx62yikd6d3lbwsfiyf9j6kx8drvn4xhffwv27fw5jzhfqr61ji";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-filter-messagesize";
+      description = "Prints out all messages that have an estimated size crossing a configured threshold during processing";
+    };
+  };
+  integrations = glPlugin rec {
+    name = "graylog-integrations-${version}";
+    pluginName = "graylog-plugin-integrations";
+    version = "3.3.9";
+    src = fetchurl {
+      url = "https://downloads.graylog.org/releases/graylog-integrations/graylog-integrations-plugins-${version}.tgz";
+      sha256 = "0q858ffmkinngyqqsaszcrx93zc4fg43ny0xb7vm0p4wd48hjyqc";
+    };
+    installPhase = ''
+      mkdir -p $out/bin
+      tar --strip-components=2 -xf $src
+      cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
+    '';
+    meta = {
+      homepage = "https://github.com/Graylog2/graylog-plugin-integrations";
+      description = "Collection of open source Graylog integrations that will be released together";
+    };
+  };
+  internal-logs = glPlugin rec {
+    name = "graylog-internal-logs-${version}";
+    pluginName = "graylog-plugin-internal-logs";
+    version = "2.4.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1jyy0wkjapv3xv5q957xxv2pcnd4n1yivkvkvg6cx7kv1ip75xwc";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-internal-logs";
+      description = "Graylog plugin to record internal logs of Graylog efficiently instead of sending them over the network";
+    };
+  };
+  ipanonymizer = glPlugin rec {
+    name = "graylog-ipanonymizer-${version}";
+    pluginName = "graylog-plugin-ipanonymizer";
+    version = "1.1.2";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0hd66751hp97ddkn29s1cmjmc2h1nrp431bq7d2wq16iyxxlygri";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-ipanonymizer";
+      description = "Graylog-server plugin that replaces the last octet of IP addresses in messages with xxx";
+    };
+  };
+  jabber = glPlugin rec {
+    name = "graylog-jabber-${version}";
+    pluginName = "graylog-plugin-jabber";
+    version = "2.4.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0zy27q8y0bv7i5nypsfxad4yiw121sbwzd194jsz2w08jhk3skl5";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-jabber";
+      description = "Jabber Alarmcallback Plugin for Graylog";
+    };
+  };
+  metrics = glPlugin rec {
+    name = "graylog-metrics-${version}";
+    pluginName = "graylog-plugin-metrics";
+    version = "1.3.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1v1yzmqp43kxigh3fymdwki7pn21sk2ym3kk4nn4qv4zzkhz59vp";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-metrics";
+      description = "Output plugin for integrating Graphite, Ganglia and StatsD with Graylog";
+    };
+  };
+  mongodb-profiler = glPlugin rec {
+    name = "graylog-mongodb-profiler-${version}";
+    pluginName = "graylog-plugin-mongodb-profiler";
+    version = "2.0.1";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1hadxyawdz234lal3dq5cy3zppl7ixxviw96iallyav83xyi23i8";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-mongodb-profiler";
+      description = "Graylog input plugin that reads MongoDB profiler data";
+    };
+  };
+  pagerduty = glPlugin rec {
+    name = "graylog-pagerduty-${version}";
+    pluginName = "graylog-plugin-pagerduty";
+    version = "2.0.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0xhcwfwn7c77giwjilv7k7aijnj9azrjbjgd0r3p6wdrw970f27r";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-pagerduty";
+      description = "Alarm callback plugin for integrating PagerDuty into Graylog";
+    };
+  };
+  redis = glPlugin rec {
+    name = "graylog-redis-${version}";
+    pluginName = "graylog-plugin-redis";
+    version = "0.1.1";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0dfgh6w293ssagas5y0ixwn0vf54i5iv61r5p2q0rbv2da6xvhbw";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-redis";
+      description = "Redis plugin for Graylog";
+    };
+  };
+  slack = glPlugin rec {
+    name = "graylog-slack-${version}";
+    pluginName = "graylog-plugin-slack";
+    version = "3.1.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "067p8g94b007gypwyyi8vb6qhwdanpk8ah57abik54vv14jxg94k";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-slack";
+      description = "Can notify Slack or Mattermost channels about triggered alerts in Graylog (Alarm Callback)";
+    };
+  };
+  smseagle = glPlugin rec {
+    name = "graylog-smseagle-${version}";
+    pluginName = "graylog-plugin-smseagle";
+    version = "1.0.1";
+    src = fetchurl {
+      url = "https://bitbucket.org/proximus/smseagle-graylog/raw/b99cfc349aafc7c94d4c2503f7c3c0bde67684d1/jar/graylog-plugin-smseagle-1.0.1.jar";
+      sha256 = "sha256-rvvftzPskXRGs1Z9dvd/wFbQoIoNtEQIFxMIpSuuvf0=";
+    };
+    meta = {
+      homepage = "https://bitbucket.org/proximus/smseagle-graylog/";
+      description = "Alert/notification callback plugin for integrating the SMSEagle into Graylog";
+      license = licenses.gpl3Only;
+    };
+  };
+  snmp = glPlugin rec {
+    name = "graylog-snmp-${version}";
+    pluginName = "graylog-plugin-snmp";
+    version = "0.3.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1hkaklwzcsvqq45b98chwqxqdgnnbj4dg68agsll13yq4zx37qpp";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-snmp";
+      description = "Graylog plugin to receive SNMP traps";
+    };
+  };
+  spaceweather = glPlugin rec {
+    name = "graylog-spaceweather-${version}";
+    pluginName = "graylog-plugin-spaceweather";
+    version = "1.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/spaceweather-input.jar";
+      sha256 = "1mwqy3fhyy4zdwyrzvbr565xwf96xs9d3l70l0khmrm848xf8wz4";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-spaceweather";
+      description = "Correlate proton density to the response time of your app and the ion temperature to your exception rate";
+    };
+  };
+  splunk = glPlugin rec {
+    name = "graylog-splunk-${version}";
+    pluginName = "graylog-plugin-splunk";
+    version = "0.5.0-rc.1";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/graylog-plugin-splunk/releases/download/0.5.0-rc.1/graylog-plugin-splunk-0.5.0-rc.1.jar";
+      sha256 = "sha256-EwF/Dc8GmMJBTxH9xGZizUIMTGSPedT4bprorN6X9Os=";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-splunk";
+      description = "Graylog output plugin that forwards one or more streams of data to Splunk via TCP";
+      license = licenses.gpl3Only;
+    };
+  };
+  twiliosms = glPlugin rec {
+    name = "graylog-twiliosms-${version}";
+    pluginName = "graylog-plugin-twiliosms";
+    version = "1.0.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0kwfv1zfj0fmxh9i6413bcsaxrn1vdwrzb6dphvg3dx27wxn1j1a";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-twiliosms";
+      description = "Alarm callback plugin for integrating the Twilio SMS API into Graylog";
+    };
+  };
+  twitter = glPlugin rec {
+    name = "graylog-twitter-${version}";
+    pluginName = "graylog-plugin-twitter";
+    version = "2.0.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1pi34swy9nzq35a823zzvqrjhb6wsg302z31vk2y656sw6ljjxyh";
+    };
+    meta = {
+      homepage = "https://github.com/graylog-labs/graylog-plugin-twitter";
+      description = "Graylog input plugin that reads Twitter messages based on keywords in realtime";
+    };
+  };
+}
--- a/pkgs/tools/misc/grub/add-hidden-menu-entries.patch
+++ b/pkgs/tools/misc/grub/add-hidden-menu-entries.patch
@@ -0,0 +1,204 @@
+diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
+index e9e9d94ef..54e08a1b4 100644
+--- a/grub-core/commands/legacycfg.c
+++ b/grub-core/commands/legacycfg.c
+@@ -143,7 +143,7 @@ legacy_file (const char *filename)
+ 	    args[0] = oldname;
+ 	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
+ 					NULL, NULL,
+-					entrysrc, 0);
+					entrysrc, 0, 0);
+ 	    grub_free (args);
+ 	    entrysrc[0] = 0;
+ 	    grub_free (oldname);
+@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+ 	}
+       args[0] = entryname;
+       grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
+-				  NULL, NULL, entrysrc, 0);
+				  NULL, NULL, entrysrc, 0, 0);
+       grub_free (args);
+     }
+ 
+diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
+index 720e6d8ea..50632ccce 100644
+--- a/grub-core/commands/menuentry.c
+++ b/grub-core/commands/menuentry.c
+@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
+ 			    char **classes, const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu)
+			    int submenu, int hidden)
+ {
+   int menu_hotkey = 0;
+   char **menu_args = NULL;
+@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
+   (*last)->args = menu_args;
+   (*last)->sourcecode = menu_sourcecode;
+   (*last)->submenu = submenu;
+  (*last)->hidden = hidden;
+
+  if (!hidden)
+    menu->size++;
+ 
+-  menu->size++;
+   return GRUB_ERR_NONE;
+ 
+  fail:
+@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				       users,
+ 				       ctxt->state[2].arg, 0,
+ 				       ctxt->state[3].arg,
+-				       ctxt->extcmd->cmd->name[0] == 's');
+				       ctxt->extcmd->cmd->name[0] == 's',
+               ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src = args[argc - 1];
+   args[argc - 1] = NULL;
+@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				  ctxt->state[0].args, ctxt->state[4].arg,
+ 				  users,
+ 				  ctxt->state[2].arg, prefix, src + 1,
+-				  ctxt->extcmd->cmd->name[0] == 's');
+				  ctxt->extcmd->cmd->name[0] == 's',
+          ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src[len - 1] = ch;
+   args[argc - 1] = src;
+@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+   return r;
+ }
+ 
+-static grub_extcmd_t cmd, cmd_sub;
+static grub_extcmd_t cmd, cmd_sub, cmd_hidden;
+ 
+ void
+ grub_menu_init (void)
+@@ -327,6 +332,12 @@ grub_menu_init (void)
+ 				  | GRUB_COMMAND_FLAG_EXTRACTOR,
+ 				  N_("BLOCK"), N_("Define a submenu."),
+ 				  options);
+  cmd_hidden = grub_register_extcmd ("hiddenentry", grub_cmd_menuentry,
+                  GRUB_COMMAND_FLAG_BLOCKS
+                  | GRUB_COMMAND_ACCEPT_DASH
+                  | GRUB_COMMAND_FLAG_EXTRACTOR,
+                  N_("BLOCK"), N_("Define a hidden menu entry."),
+                  options);
+ }
+ 
+ void
+diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
+index 6a90e091f..4236f55bc 100644
+--- a/grub-core/normal/menu.c
+++ b/grub-core/normal/menu.c
+@@ -37,6 +37,8 @@
+    entry failing to boot.  */
+ #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
+ 
+#define MENU_INCLUDE_HIDDEN 0x10000
+
+ grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
+ 				     int nested) = NULL;
+ 
+@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+ {
+   grub_menu_entry_t e;
+ 
+-  for (e = menu->entry_list; e && no > 0; e = e->next, no--)
+-    ;
+  if (no & MENU_INCLUDE_HIDDEN) {
+    no &= ~MENU_INCLUDE_HIDDEN;
+
+    for (e = menu->entry_list; e && no > 0; e = e->next, no--)
+      ;
+  } else {
+    for (e = menu->entry_list; e && no > 0; e = e->next, no--) {
+      /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+    }
+    while (e && e->hidden)
+      e = e->next;
+  }
+ 
+   return e;
+ }
+@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+   grub_menu_entry_t entry;
+   int i;
+ 
+-  for (i = 0, entry = menu->entry_list; i < menu->size;
+  for (i = 0, entry = menu->entry_list; entry;
+        i++, entry = entry->next)
+     if (entry->hotkey == hotkey)
+-      return i;
+      return i | MENU_INCLUDE_HIDDEN;
+ 
+   return -1;
+ }
+@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+       grub_menu_entry_t e = menu->entry_list;
+       int i;
+ 
+       /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+
+       grub_errno = GRUB_ERR_NONE;
+ 
+       for (i = 0; e; i++)
+@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+ 	      break;
+ 	    }
+ 	  e = e->next;
+
+    /* Skip hidden entries */
+    while (e && e->hidden)
+      e = e->next;
+ 	}
+ 
+       if (! e)
+diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
+index b1321eb26..d2e46cac8 100644
+--- a/grub-core/normal/menu_text.c
+++ b/grub-core/normal/menu_text.c
+@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+       print_entry (data->geo.first_entry_y + i, data->offset == i,
+ 		   e, data);
+       if (e)
+-	e = e->next;
+	      e = e->next;
+
+      /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+     }
+ 
+   grub_term_gotoxy (data->term,
+diff --git a/include/grub/menu.h b/include/grub/menu.h
+index ee2b5e910..eb8a86ba9 100644
+--- a/include/grub/menu.h
+++ b/include/grub/menu.h
+@@ -58,6 +58,8 @@ struct grub_menu_entry
+ 
+   int submenu;
+ 
+  int hidden;
+
+   /* The next element.  */
+   struct grub_menu_entry *next;
+ };
+diff --git a/include/grub/normal.h b/include/grub/normal.h
+index 218cbabcc..bcb412466 100644
+--- a/include/grub/normal.h
+++ b/include/grub/normal.h
+@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
+ 			    const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu);
+			    int submenu, int hidden);
+ 
+ grub_err_t
+ grub_normal_set_password (const char *user, const char *password);
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -0,0 +1,681 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  flex,
+  bison,
+  python3,
+  autoconf,
+  automake,
+  libtool,
+  bash,
+  gettext,
+  ncurses,
+  libusb-compat-0_1,
+  freetype,
+  qemu,
+  lvm2,
+  unifont,
+  pkg-config,
+  help2man,
+  fetchzip,
+  fetchpatch,
+  buildPackages,
+  nixosTests,
+  fuse, # only needed for grub-mount
+  runtimeShell,
+  zfs ? null,
+  efiSupport ? false,
+  zfsSupport ? false,
+  xenSupport ? false,
+  xenPvhSupport ? false,
+  kbdcompSupport ? false,
+  ckbcomp,
+}:
+
+let
+  pcSystems = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386";
+  };
+
+  efiSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "x86_64";
+    armv7l-linux.target = "arm";
+    aarch64-linux.target = "aarch64";
+    loongarch64-linux.target = "loongarch64";
+    riscv32-linux.target = "riscv32";
+    riscv64-linux.target = "riscv64";
+  };
+
+  # For aarch64, we need to use '--target=aarch64-efi' when building,
+  # but '--target=arm64-efi' when installing. Insanity!
+  efiSystemsInstall = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "x86_64";
+    armv7l-linux.target = "arm";
+    aarch64-linux.target = "arm64";
+    loongarch64-linux.target = "loongarch64";
+    riscv32-linux.target = "riscv32";
+    riscv64-linux.target = "riscv64";
+  };
+
+  xenSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "x86_64";
+  };
+
+  xenPvhSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386"; # Xen PVH is only i386 on x86.
+  };
+
+  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);
+
+  gnulib = fetchgit {
+    url = "https://https.git.savannah.gnu.org/git/gnulib.git";
+    # NOTE: keep in sync with bootstrap.conf!
+    rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
+    hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
+  };
+
+  # The locales are fetched from translationproject.org at build time,
+  # but those translations are not versioned/stable. For that reason
+  # we take them from the nearest release tarball instead:
+  locales = fetchzip {
+    url = "https://ftp.gnu.org/gnu/grub/grub-2.12.tar.gz";
+    hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w=";
+  };
+in
+
+assert zfsSupport -> zfs != null;
+assert !(efiSupport && (xenSupport || xenPvhSupport));
+assert !(xenSupport && xenPvhSupport);
+
+stdenv.mkDerivation rec {
+  pname = "grub";
+  version = "2.12";
+
+  src = fetchgit {
+    url = "https://https.git.savannah.gnu.org/git/grub.git";
+    tag = "grub-${version}";
+    hash = "sha256-lathsBb2f7urh8R86ihpTdwo3h1hAHnRiHd5gCLVpBc=";
+  };
+
+  patches = [
+    ./fix-bash-completion.patch
+    ./add-hidden-menu-entries.patch
+
+    # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
+    (fetchpatch {
+      name = "01_implement_grub_strlcpy.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f";
+      hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I=";
+    })
+    (fetchpatch {
+      name = "02_CVE-2024-45781.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba";
+      hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw=";
+    })
+    (fetchpatch {
+      name = "03_CVE-2024-45782_CVE-2024-56737.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3";
+      hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8=";
+    })
+    (fetchpatch {
+      name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d";
+      hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg=";
+    })
+    (fetchpatch {
+      name = "05_CVE-2024-45780.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3";
+      hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls=";
+    })
+    (fetchpatch {
+      name = "06_fs_f2fs_grub_errno_mount_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3";
+      hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q=";
+    })
+    (fetchpatch {
+      name = "07_CVE-2024-45783.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898";
+      hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM=";
+    })
+    (fetchpatch {
+      name = "08_fs_iso9660_grub_errno_mount_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97";
+      hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI=";
+    })
+    (fetchpatch {
+      name = "09_fs_iso9660_fix_invalid_free.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611";
+      hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI=";
+    })
+    (fetchpatch {
+      name = "10_fs_jfs_fix_oob_read_jfs_getent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb";
+      hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY=";
+    })
+    (fetchpatch {
+      name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7";
+      hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY=";
+    })
+    (fetchpatch {
+      name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef";
+      hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg=";
+    })
+    (fetchpatch {
+      name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28";
+      hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk=";
+    })
+    (fetchpatch {
+      name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c";
+      hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ=";
+    })
+    (fetchpatch {
+      name = "15_fs_ntfs_fix_out-of-bounds_read.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732";
+      hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI=";
+    })
+    (fetchpatch {
+      name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a";
+      hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM=";
+    })
+    (fetchpatch {
+      name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71";
+      hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E=";
+    })
+    # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions
+    # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html
+    (fetchpatch {
+      name = "19_fs_xfs_fix_out-of-bounds_read.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a";
+      hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE=";
+    })
+    (fetchpatch {
+      name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a";
+      hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg=";
+    })
+    (fetchpatch {
+      name = "21_kern_file_ensure_file_data_is_set.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17";
+      hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q=";
+    })
+    (fetchpatch {
+      name = "22_kern_file_implement_filesystem_reference_counting.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b";
+      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
+      hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3";
+      hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c";
+      hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173";
+      hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181";
+      hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95";
+      hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc";
+      hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8=";
+    })
+    (fetchpatch {
+      name = "23_CVE-2024-49504.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e";
+      hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y=";
+    })
+    (fetchpatch {
+      name = "24_disk_loopback_reference_tracking_for_the_loopback.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae";
+      hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA=";
+    })
+    (fetchpatch {
+      name = "25_kern_disk_limit_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b";
+      hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw=";
+    })
+    (fetchpatch {
+      name = "26_kern_partition_limit_recursion_in_part_iterate.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a";
+      hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI=";
+    })
+    (fetchpatch {
+      name = "27_script_execute_limit_the_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1";
+      hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo=";
+    })
+    (fetchpatch {
+      name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d";
+      hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4=";
+    })
+    (fetchpatch {
+      name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401";
+      hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac=";
+    })
+    (fetchpatch {
+      name = "30_CVE-2025-0624.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1";
+      hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0=";
+    })
+    (fetchpatch {
+      name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367";
+      hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4=";
+    })
+    (fetchpatch {
+      name = "32_CVE-2024-45774.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f";
+      hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4=";
+    })
+    (fetchpatch {
+      name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d";
+      hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk=";
+    })
+    # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49)
+    # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12
+    (fetchpatch {
+      name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99";
+      hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg=";
+    })
+    (fetchpatch {
+      name = "36_CVE-2024-45775.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872";
+      hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY=";
+    })
+    (fetchpatch {
+      name = "37_commands_ls_fix_NULL_dereference.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56";
+      hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI=";
+    })
+    (fetchpatch {
+      name = "38_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726";
+      hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw=";
+    })
+    (fetchpatch {
+      name = "39_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67";
+      hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA=";
+    })
+    (fetchpatch {
+      name = "40_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637";
+      hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms=";
+    })
+    (fetchpatch {
+      name = "41_CVE-2024-45776.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91";
+      hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY=";
+    })
+    (fetchpatch {
+      name = "42_CVE-2024-45777.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515";
+      hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo=";
+    })
+    (fetchpatch {
+      name = "43_CVE-2025-0690.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc";
+      hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY=";
+    })
+    (fetchpatch {
+      name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af";
+      hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY=";
+    })
+    (fetchpatch {
+      name = "45_CVE-2025-1118.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f";
+      hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc=";
+    })
+    (fetchpatch {
+      name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c";
+      hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA=";
+    })
+    (fetchpatch {
+      name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99";
+      hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE=";
+    })
+    (fetchpatch {
+      name = "48_CVE-2024-45778_CVE-2024-45779.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630";
+      hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI=";
+    })
+    (fetchpatch {
+      name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74";
+      hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE=";
+    })
+    (fetchpatch {
+      name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa";
+      hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ=";
+    })
+    (fetchpatch {
+      name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f";
+      hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E=";
+    })
+    (fetchpatch {
+      name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464";
+      hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0=";
+    })
+    (fetchpatch {
+      name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753";
+      hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4=";
+    })
+    (fetchpatch {
+      name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7";
+      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
+      hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek=";
+    })
+    (fetchpatch {
+      name = "55_CVE-2025-0678_CVE-2025-1125.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e";
+      hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4=";
+    })
+    (fetchpatch {
+      name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31";
+      hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys=";
+    })
+    (fetchpatch {
+      name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9";
+      hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA=";
+    })
+    (fetchpatch {
+      name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c";
+      hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk=";
+    })
+    (fetchpatch {
+      name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892";
+      hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0=";
+    })
+    (fetchpatch {
+      name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4";
+      hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o=";
+    })
+    (fetchpatch {
+      name = "61_net_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391";
+      hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg=";
+    })
+    (fetchpatch {
+      name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb";
+      hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk=";
+    })
+    (fetchpatch {
+      name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8";
+      hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388=";
+    })
+    (fetchpatch {
+      name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15";
+      hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU=";
+    })
+    (fetchpatch {
+      name = "65_script_execute_fix_potential_underflow_and_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e";
+      hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8=";
+    })
+    (fetchpatch {
+      name = "66_osdep_unix_getroot_fix_potential_underflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e";
+      hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc=";
+    })
+    (fetchpatch {
+      name = "67_misc_ensure_consistent_overflow_error_messages.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3";
+      hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI=";
+    })
+    (fetchpatch {
+      name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956";
+      hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I=";
+    })
+    (fetchpatch {
+      name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb";
+      hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM=";
+    })
+    (fetchpatch {
+      name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2";
+      hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI=";
+    })
+    (fetchpatch {
+      name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7";
+      hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg=";
+    })
+    (fetchpatch {
+      name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a";
+      hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8=";
+    })
+    (fetchpatch {
+      name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c";
+      hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4=";
+    })
+    (fetchpatch {
+      # Fixes 7e2f750f0a (security patch 14/73)
+      name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
+      hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
+    })
+  ];
+
+  postPatch =
+    if kbdcompSupport then
+      ''
+        sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
+      ''
+    else
+      ''
+        echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
+        echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
+      '';
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    bison
+    flex
+    python3
+    pkg-config
+    gettext
+    freetype
+    autoconf
+    automake
+    help2man
+  ];
+  buildInputs = [
+    ncurses
+    libusb-compat-0_1
+    freetype
+    lvm2
+    fuse
+    libtool
+    bash
+  ]
+  ++ lib.optional doCheck qemu
+  ++ lib.optional zfsSupport zfs;
+
+  strictDeps = true;
+
+  hardeningDisable = [ "all" ];
+
+  separateDebugInfo = !xenSupport;
+
+  preConfigure = ''
+     for i in "tests/util/"*.in
+     do
+       sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
+     done
+
+     # Apparently, the QEMU executable is no longer called
+     # `qemu-system-i386', even on i386.
+     #
+     # In addition, use `-nodefaults' to avoid errors like:
+     #
+     #  chardev: opening backend "stdio" failed
+     #  qemu: could not open serial device 'stdio': Invalid argument
+     #
+     # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
+     sed -i "tests/util/grub-shell.in" \
+         -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
+
+    unset CPP # setting CPP intereferes with dependency calculation
+
+    patchShebangs .
+
+    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+      echo "This version of GRUB requires a different gnulib revision!"
+      echo "We have: ${gnulib.rev}"
+      echo "GRUB needs: $GNULIB_REVISION"
+      exit 1
+    fi
+
+    cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po
+
+    ./bootstrap --no-git --gnulib-srcdir=${gnulib}
+
+    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
+  '';
+
+  postConfigure = ''
+    # make sure .po files are up to date to workaround
+    # parallel `msgmerge --update` on autogenerated .po files:
+    #   https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
+    make dist
+  '';
+
+  configureFlags = [
+    "--enable-grub-mount" # dep of os-prober
+  ]
+  ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # grub doesn't do cross-compilation as usual and tries to use unprefixed
+    # tools to target the host. Provide toolchain information explicitly for
+    # cross builds.
+    #
+    # Ref: # https://github.com/buildroot/buildroot/blob/master/boot/grub2/grub2.mk#L108
+    "TARGET_CC=${stdenv.cc.targetPrefix}cc"
+    "TARGET_NM=${stdenv.cc.targetPrefix}nm"
+    "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+    "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib"
+    "TARGET_STRIP=${stdenv.cc.targetPrefix}strip"
+  ]
+  ++ lib.optional zfsSupport "--enable-libzfs"
+  ++ lib.optionals efiSupport [
+    "--with-platform=efi"
+    "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}"
+    "--program-prefix="
+  ]
+  ++ lib.optionals xenSupport [
+    "--with-platform=xen"
+    "--target=${xenSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals xenPvhSupport [
+    "--with-platform=xen_pvh"
+    "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ];
+
+  # save target that grub is compiled for
+  grubTarget =
+    if efiSupport then
+      "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi"
+    else
+      lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";
+
+  doCheck = false;
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    # Avoid a runtime reference to gcc
+    sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
+    # just adding bash to buildInputs wasn't enough to fix the shebang
+    substituteInPlace $out/lib/grub/*/modinfo.sh \
+      --replace ${buildPackages.bash} "/usr/bin/bash"
+  '';
+
+  passthru.tests = {
+    nixos-grub = nixosTests.grub;
+    nixos-install-simple = nixosTests.installer.simple;
+    nixos-install-grub-uefi = nixosTests.installer.simpleUefiGrub;
+    nixos-install-grub-uefi-spec = nixosTests.installer.simpleUefiGrubSpecialisation;
+  };
+
+  meta = with lib; {
+    description = "GNU GRUB, the Grand Unified Boot Loader";
+
+    longDescription = ''
+      GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand
+      Unified Bootloader, which was originally designed and implemented by
+      Erich Stefan Boleyn.
+
+      Briefly, the boot loader is the first software program that runs when a
+      computer starts.  It is responsible for loading and transferring
+      control to the operating system kernel software (such as the Hurd or
+      the Linux).  The kernel, in turn, initializes the rest of the
+      operating system (e.g., GNU).
+    '';
+
+    homepage = "https://www.gnu.org/software/grub/";
+
+    license = licenses.gpl3Plus;
+
+    platforms =
+      if efiSupport then
+        lib.attrNames efiSystemsBuild
+      else if xenSupport then
+        lib.attrNames xenSystemsBuild
+      else if xenPvhSupport then
+        lib.attrNames xenPvhSystemsBuild
+      else
+        platforms.gnu ++ platforms.linux;
+
+    maintainers = [ ];
+  };
+}
--- a/pkgs/tools/misc/grub/fix-bash-completion.patch
+++ b/pkgs/tools/misc/grub/fix-bash-completion.patch
@@ -0,0 +1,24 @@
+diff -ubr grub-2.00-orig/util/bash-completion.d/grub-completion.bash.in grub-2.00/util/bash-completion.d/grub-completion.bash.in
+--- grub-2.00-orig/util/bash-completion.d/grub-completion.bash.in	2012-10-16 19:02:36.342733957 +0200
+++ grub-2.00/util/bash-completion.d/grub-completion.bash.in	2012-10-16 19:04:48.262733941 +0200
+@@ -17,6 +17,12 @@
+ # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ # bash completion for grub
+ 
+have()
+{
+    unset -v have
+    _have $1 && have=yes
+}
+
+ __grub_dir() {
+     local i c=1 boot_dir
+ 
+@@ -479,6 +485,7 @@
+ have ${__grub_script_check_program} && \
+  complete -F _grub_script_check -o filenames ${__grub_script_check_program}
+ 
+unset -f have
+ 
+ # Local variables:
+ # mode: shell-script
--- a/pkgs/tools/misc/grub4dos/default.nix
+++ b/pkgs/tools/misc/grub4dos/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nasm,
+}:
+
+let
+  arch =
+    if stdenv.hostPlatform.isi686 then
+      "i386"
+    else if stdenv.hostPlatform.isx86_64 then
+      "x86_64"
+    else
+      throw "Unknown architecture";
+in
+stdenv.mkDerivation {
+  pname = "grub4dos";
+  version = "0.4.6a-2019-05-12";
+
+  src = fetchFromGitHub {
+    owner = "chenall";
+    repo = "grub4dos";
+    rev = "e8224a2d20760139ffaeafa07838e2c3c54de783";
+    sha256 = "0i7n71za43qnlsxfvjrv1z5g1w5jl9snpbnas7rw97rry7cgyswf";
+  };
+
+  nativeBuildInputs = [ nasm ];
+
+  hardeningDisable = [ "stackprotector" ];
+
+  configureFlags = [ "--host=${arch}-pc-linux-gnu" ];
+
+  postInstall = ''
+    mv $out/lib/grub/${arch}-pc/* $out/lib/grub
+    rmdir $out/lib/grub/${arch}-pc
+    chmod +x $out/lib/grub/bootlace.com
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  # make[2]: *** No rule to make target 'pre_stage2_fullsize', needed by 'all-am'.  Stop.
+  enableParallelBuilding = false;
+
+  meta = with lib; {
+    homepage = "http://grub4dos.chenall.net/";
+    description = "GRUB for DOS is the dos extension of GRUB";
+    maintainers = [ ];
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    # Needs a port to modern binutils:
+    #   https://github.com/chenall/grub4dos/issues/160
+    broken = true;
+  };
+}
--- a/pkgs/tools/misc/gwe/default.nix
+++ b/pkgs/tools/misc/gwe/default.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  wrapGAppsHook3,
+  pkg-config,
+  meson,
+  ninja,
+  cmake,
+  gobject-introspection,
+  desktop-file-utils,
+  python3,
+  gtk3,
+  libdazzle,
+  libappindicator-gtk3,
+  libnotify,
+  nvidia_x11,
+}:
+
+let
+  pythonEnv = python3.withPackages (
+    pypkgs: with pypkgs; [
+      injector
+      matplotlib
+      peewee
+      pynvml
+      pygobject3
+      xlib
+      pyxdg
+      requests
+      rx
+      gtk3
+      reactivex
+      setuptools
+    ]
+  );
+in
+stdenv.mkDerivation rec {
+  pname = "gwe";
+  version = "0.15.9";
+
+  src = fetchFromGitLab {
+    owner = "leinardi";
+    repo = pname;
+    rev = version;
+    hash = "sha256-agq967QN1nsAOn+1Ce64+id7UlSS/K3XGsUUihWOztk=";
+  };
+
+  prePatch = ''
+    patchShebangs scripts/{make_local_manifest,meson_post_install}.py
+
+    substituteInPlace gwe/repository/nvidia_repository.py \
+      --replace "from py3nvml import py3nvml" "import pynvml" \
+      --replace "py3nvml.py3nvml" "pynvml" \
+      --replace "py3nvml" "pynvml"
+  '';
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    pkg-config
+    meson
+    ninja
+    cmake
+    gobject-introspection
+    desktop-file-utils
+    pythonEnv
+  ];
+
+  buildInputs = [
+    gtk3
+    libdazzle
+    libappindicator-gtk3
+    libnotify
+  ];
+
+  postInstall = ''
+    mv $out/bin/gwe $out/lib/gwe-bin
+
+    makeWrapper ${pythonEnv}/bin/python $out/bin/gwe \
+      --add-flags "$out/lib/gwe-bin" \
+      --prefix LD_LIBRARY_PATH : "/run/opengl-driver/lib" \
+      --prefix PATH : "${
+        builtins.concatStringsSep ":" [
+          (lib.makeBinPath [
+            nvidia_x11
+            nvidia_x11.settings
+          ])
+          "/run/wrappers/bin"
+        ]
+      }" \
+      --unset "SHELL" \
+      ''${gappsWrapperArgs[@]}
+  '';
+
+  meta = with lib; {
+    description = "System utility designed to provide information, control the fans and overclock your NVIDIA card";
+    homepage = "https://gitlab.com/leinardi/gwe";
+    platforms = platforms.linux;
+    license = licenses.gpl3Only;
+    maintainers = [ ];
+    mainProgram = "gwe";
+  };
+}
--- a/pkgs/tools/misc/haste-client/Gemfile
+++ b/pkgs/tools/misc/haste-client/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'haste'
--- a/pkgs/tools/misc/haste-client/Gemfile.lock
+++ b/pkgs/tools/misc/haste-client/Gemfile.lock
@@ -0,0 +1,19 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    faraday (0.17.3)
+      multipart-post (>= 1.2, < 3)
+    haste (0.2.3)
+      faraday (~> 0.9)
+      json
+    json (2.5.1)
+    multipart-post (2.1.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  haste
+
+BUNDLED WITH
+   2.1.4
--- a/pkgs/tools/misc/haste-client/default.nix
+++ b/pkgs/tools/misc/haste-client/default.nix
@@ -0,0 +1,19 @@
+{
+  lib,
+  bundlerApp,
+}:
+
+bundlerApp {
+  pname = "haste";
+  gemdir = ./.;
+  exes = [ "haste" ];
+
+  meta = with lib; {
+    description = "Command line interface to the AnyStyle Parser and Finder";
+    homepage = "https://rubygems.org/gems/haste";
+    license = licenses.mit;
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.unix;
+    mainProgram = "haste";
+  };
+}
--- a/pkgs/tools/misc/haste-client/gemset.nix
+++ b/pkgs/tools/misc/haste-client/gemset.nix
@@ -0,0 +1,653 @@
+{
+  faraday = {
+    dependencies = [ "multipart-post" ];
+    groups = [ "default" ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+        version = "1.8";
+      }
+      {
+        engine = "rbx";
+        version = "1.9";
+      }
+      {
+        engine = "rbx";
+        version = "2.0";
+      }
+      {
+        engine = "rbx";
+        version = "2.1";
+      }
+      {
+        engine = "rbx";
+        version = "2.2";
+      }
+      {
+        engine = "rbx";
+        version = "2.3";
+      }
+      {
+        engine = "rbx";
+        version = "2.4";
+      }
+      {
+        engine = "rbx";
+        version = "2.5";
+      }
+      {
+        engine = "rbx";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "13aghksmni2sl15y7wfpx6k5l3lfd8j9gdyqi6cbw6jgc7bqyyn2";
+      type = "gem";
+    };
+    version = "0.17.3";
+  };
+  haste = {
+    dependencies = [
+      "faraday"
+      "json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jaq0kvlxwvd0jq9pl707saqnaaal3dis13mqwfjbj121gr4hq4q";
+      type = "gem";
+    };
+    version = "0.2.3";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+        version = "1.8";
+      }
+      {
+        engine = "rbx";
+        version = "1.9";
+      }
+      {
+        engine = "rbx";
+        version = "2.0";
+      }
+      {
+        engine = "rbx";
+        version = "2.1";
+      }
+      {
+        engine = "rbx";
+        version = "2.2";
+      }
+      {
+        engine = "rbx";
+        version = "2.3";
+      }
+      {
+        engine = "rbx";
+        version = "2.4";
+      }
+      {
+        engine = "rbx";
+        version = "2.5";
+      }
+      {
+        engine = "rbx";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
+      type = "gem";
+    };
+    version = "2.5.1";
+  };
+  multipart-post = {
+    groups = [ "default" ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.8";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "1.9";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.0";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.1";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.2";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.3";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.4";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.5";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "maglev";
+        version = "2.6";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+      }
+      {
+        engine = "rbx";
+        version = "1.8";
+      }
+      {
+        engine = "rbx";
+        version = "1.9";
+      }
+      {
+        engine = "rbx";
+        version = "2.0";
+      }
+      {
+        engine = "rbx";
+        version = "2.1";
+      }
+      {
+        engine = "rbx";
+        version = "2.2";
+      }
+      {
+        engine = "rbx";
+        version = "2.3";
+      }
+      {
+        engine = "rbx";
+        version = "2.4";
+      }
+      {
+        engine = "rbx";
+        version = "2.5";
+      }
+      {
+        engine = "rbx";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.8";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "1.9";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.0";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.1";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.2";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.3";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.4";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.5";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+      {
+        engine = "ruby";
+        version = "2.6";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
+      type = "gem";
+    };
+    version = "2.1.1";
+  };
+}
--- a/pkgs/tools/misc/hdf5/1.10.nix
+++ b/pkgs/tools/misc/hdf5/1.10.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  removeReferencesTo,
+  cppSupport ? true,
+  zlibSupport ? true,
+  zlib,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  javaSupport ? false,
+  jdk,
+}:
+
+let
+  inherit (lib) optional;
+in
+
+stdenv.mkDerivation rec {
+  version = "1.10.11";
+  pname = "hdf5";
+  src = fetchurl {
+    url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${lib.versions.majorMinor version}/${pname}-${version}/src/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-Cvx32lxGIXcJR1u++8qRwMtvHqYozNjDYZbPbFpN4wQ=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  buildInputs = optional javaSupport jdk;
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  propagatedBuildInputs = optional zlibSupport zlib;
+
+  configureFlags =
+    optional enableShared "--enable-shared"
+    ++ optional javaSupport "--enable-java"
+    ++ optional cppSupport "--enable-cxx";
+
+  patches = [ ];
+
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    moveToOutput 'bin/h5cc' "''${!outputDev}"
+    moveToOutput 'bin/h5c++' "''${!outputDev}"
+    moveToOutput 'bin/h5fc' "''${!outputDev}"
+    moveToOutput 'bin/h5pcc' "''${!outputDev}"
+  '';
+
+  meta = {
+    description = "Data model, library, and file format for storing and managing data";
+    longDescription = ''
+      HDF5 supports an unlimited variety of datatypes, and is designed for flexible and efficient
+      I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing
+      applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and
+      applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
+    '';
+    license = lib.licenses.bsd3; # Lawrence Berkeley National Labs BSD 3-Clause variant
+    maintainers = with lib.maintainers; [ stephen-huan ];
+    homepage = "https://www.hdfgroup.org/HDF5/";
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -0,0 +1,149 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  removeReferencesTo,
+  cppSupport ? true,
+  fortranSupport ? false,
+  fortran,
+  zlibSupport ? true,
+  zlib,
+  szipSupport ? false,
+  szip,
+  mpiSupport ? false,
+  mpi,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  javaSupport ? false,
+  jdk,
+  usev110Api ? false,
+  threadsafe ? false,
+  python3,
+}:
+
+# cpp and mpi options are mutually exclusive
+# "-DALLOW_UNSUPPORTED=ON" could be used to force the build.
+assert !cppSupport || !mpiSupport;
+
+let
+  inherit (lib) optional optionals;
+in
+
+stdenv.mkDerivation rec {
+  version = "1.14.6";
+  pname =
+    "hdf5"
+    + lib.optionalString cppSupport "-cpp"
+    + lib.optionalString fortranSupport "-fortran"
+    + lib.optionalString mpiSupport "-mpi"
+    + lib.optionalString threadsafe "-threadsafe";
+
+  src = fetchFromGitHub {
+    owner = "HDFGroup";
+    repo = "hdf5";
+    rev = "hdf5_${version}";
+    hash = "sha256-mJTax+VWAL3Amkq3Ij8fxazY2nfpMOTxYMUQlTvY/rg=";
+  };
+
+  passthru = {
+    inherit
+      cppSupport
+      fortranSupport
+      fortran
+      zlibSupport
+      zlib
+      szipSupport
+      szip
+      mpiSupport
+      mpi
+      ;
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "bin"
+  ];
+
+  nativeBuildInputs = [
+    removeReferencesTo
+    cmake
+  ]
+  ++ optional fortranSupport fortran;
+
+  buildInputs =
+    optional fortranSupport fortran ++ optional szipSupport szip ++ optional javaSupport jdk;
+
+  propagatedBuildInputs = optional zlibSupport zlib ++ optional mpiSupport mpi;
+
+  cmakeFlags = [
+    "-DHDF5_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake"
+    "-DBUILD_STATIC_LIBS=${lib.boolToString enableStatic}"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin "-DHDF5_BUILD_WITH_INSTALL_NAME=ON"
+  ++ lib.optional cppSupport "-DHDF5_BUILD_CPP_LIB=ON"
+  ++ lib.optional fortranSupport "-DHDF5_BUILD_FORTRAN=ON"
+  ++ lib.optional szipSupport "-DHDF5_ENABLE_SZIP_SUPPORT=ON"
+  ++ lib.optionals mpiSupport [ "-DHDF5_ENABLE_PARALLEL=ON" ]
+  ++ lib.optional enableShared "-DBUILD_SHARED_LIBS=ON"
+  ++ lib.optional javaSupport "-DHDF5_BUILD_JAVA=ON"
+  ++ lib.optional usev110Api "-DDEFAULT_API_VERSION=v110"
+  ++ lib.optionals threadsafe [
+    "-DHDF5_ENABLE_THREADSAFE:BOOL=ON"
+    "-DHDF5_BUILD_HL_LIB=OFF"
+  ]
+  # broken in nixpkgs since around 1.14.3 -> 1.14.4.3
+  # https://github.com/HDFGroup/hdf5/issues/4208#issuecomment-2098698567
+  ++ lib.optional (
+    stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
+  ) "-DHDF5_ENABLE_NONSTANDARD_FEATURE_FLOAT16=OFF";
+
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    moveToOutput 'bin/' "''${!outputBin}"
+    moveToOutput 'bin/h5cc' "''${!outputDev}"
+    moveToOutput 'bin/h5c++' "''${!outputDev}"
+    moveToOutput 'bin/h5fc' "''${!outputDev}"
+    moveToOutput 'bin/h5pcc' "''${!outputDev}"
+    moveToOutput 'bin/h5hlcc' "''${!outputDev}"
+    moveToOutput 'bin/h5hlc++' "''${!outputDev}"
+  ''
+  +
+    lib.optionalString enableShared
+      # The shared build creates binaries with -shared suffixes,
+      # so we remove these suffixes.
+      ''
+        pushd ''${!outputBin}/bin
+        for file in *-shared; do
+          mv "$file" "''${file%%-shared}"
+        done
+        popd
+      ''
+  + lib.optionalString fortranSupport ''
+    mv $out/mod/shared $dev/include
+    rm -r $out/mod
+
+    find "$out" -type f -exec remove-references-to -t ${fortran} '{}' +
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru.tests = {
+    inherit (python3.pkgs) h5py;
+  };
+
+  meta = with lib; {
+    description = "Data model, library, and file format for storing and managing data";
+    longDescription = ''
+      HDF5 supports an unlimited variety of datatypes, and is designed for flexible and efficient
+      I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing
+      applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and
+      applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
+    '';
+    license = licenses.bsd3; # Lawrence Berkeley National Labs BSD 3-Clause variant
+    maintainers = [ maintainers.markuskowa ];
+    homepage = "https://www.hdfgroup.org/HDF5/";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/misc/html-proofer/Gemfile
+++ b/pkgs/tools/misc/html-proofer/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'html-proofer'
--- a/pkgs/tools/misc/html-proofer/Gemfile.lock
+++ b/pkgs/tools/misc/html-proofer/Gemfile.lock
@@ -0,0 +1,60 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    Ascii85 (1.1.0)
+    addressable (2.8.5)
+      public_suffix (>= 2.0.2, < 6.0)
+    afm (0.2.2)
+    async (2.6.3)
+      console (~> 1.10)
+      fiber-annotation
+      io-event (~> 1.1)
+      timers (~> 4.1)
+    console (1.23.1)
+      fiber-annotation
+      fiber-local
+    ethon (0.16.0)
+      ffi (>= 1.15.0)
+    ffi (1.15.5)
+    fiber-annotation (0.2.0)
+    fiber-local (1.0.0)
+    hashery (2.1.2)
+    html-proofer (5.0.8)
+      addressable (~> 2.3)
+      async (~> 2.1)
+      nokogiri (~> 1.16.0)
+      pdf-reader (~> 2.11)
+      rainbow (~> 3.0)
+      typhoeus (~> 1.3)
+      yell (~> 2.0)
+      zeitwerk (~> 2.5)
+    io-event (1.2.3)
+    mini_portile2 (2.8.4)
+    nokogiri (1.16.0)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    pdf-reader (2.11.0)
+      Ascii85 (~> 1.0)
+      afm (~> 0.2.1)
+      hashery (~> 2.0)
+      ruby-rc4
+      ttfunk
+    public_suffix (5.0.3)
+    racc (1.7.1)
+    rainbow (3.1.1)
+    ruby-rc4 (0.1.5)
+    timers (4.3.5)
+    ttfunk (1.7.0)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
+    yell (2.2.2)
+    zeitwerk (2.6.11)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  html-proofer
+
+BUNDLED WITH
+   2.4.17
--- a/pkgs/tools/misc/html-proofer/default.nix
+++ b/pkgs/tools/misc/html-proofer/default.nix
@@ -0,0 +1,26 @@
+{
+  bundlerEnv,
+  ruby,
+  lib,
+  bundlerUpdateScript,
+}:
+
+bundlerEnv rec {
+  name = "${pname}-${version}";
+  pname = "html-proofer";
+  version = (import ./gemset.nix).html-proofer.version;
+
+  inherit ruby;
+  gemdir = ./.;
+
+  passthru.updateScript = bundlerUpdateScript pname;
+
+  meta = with lib; {
+    description = "Tool to validate HTML files";
+    homepage = "https://github.com/gjtorikian/html-proofer";
+    license = licenses.mit;
+    maintainers = [ ];
+    platforms = platforms.unix;
+    mainProgram = "htmlproofer";
+  };
+}
--- a/pkgs/tools/misc/html-proofer/gemset.nix
+++ b/pkgs/tools/misc/html-proofer/gemset.nix
@@ -0,0 +1,276 @@
+{
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
+      type = "gem";
+    };
+    version = "2.8.5";
+  };
+  afm = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "06kj9hgd0z8pj27bxp2diwqh6fv7qhwwm17z64rhdc4sfn76jgn8";
+      type = "gem";
+    };
+    version = "0.2.2";
+  };
+  Ascii85 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ds4v9xgsyvijnlflak4dzf1qwmda9yd5bv8jwsb56nngd399rlw";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  async = {
+    dependencies = [
+      "console"
+      "fiber-annotation"
+      "io-event"
+      "timers"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0806cya8kq9glg6vifa9j4zjf81drwa84hdzx71ah98zz317hvhb";
+      type = "gem";
+    };
+    version = "2.6.3";
+  };
+  console = {
+    dependencies = [
+      "fiber-annotation"
+      "fiber-local"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04cpbx4bsw3k20xgvz6cs1gi41q9mmagc95x2zk6ar49a25z89sb";
+      type = "gem";
+    };
+    version = "1.23.1";
+  };
+  ethon = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17ix0mijpsy3y0c6ywrk5ibarmvqzjsirjyprpsy3hwax8fdm85v";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
+      type = "gem";
+    };
+    version = "1.15.5";
+  };
+  fiber-annotation = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "00vcmynyvhny8n4p799rrhcx0m033hivy0s1gn30ix8rs7qsvgvs";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  fiber-local = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vrxxb09fc7aicb9zb0pmn5akggjy21dmxkdl3w949y4q05rldr9";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  hashery = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qj8815bf7q6q7llm5rzdz279gzmpqmqqicxnzv066a020iwqffj";
+      type = "gem";
+    };
+    version = "2.1.2";
+  };
+  html-proofer = {
+    dependencies = [
+      "addressable"
+      "async"
+      "nokogiri"
+      "pdf-reader"
+      "rainbow"
+      "typhoeus"
+      "yell"
+      "zeitwerk"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lzh3lb3l2qid3sh3da0fgjdwdly2g5jia6drzpn1dn1b92a7wwm";
+      type = "gem";
+    };
+    version = "5.0.8";
+  };
+  io-event = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0046p1q98xrys4bzcx74k658fv1fiigdgcd0az0pm12n2hjcms6r";
+      type = "gem";
+    };
+    version = "1.2.3";
+  };
+  mini_portile2 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02mj8mpd6ck5gpcnsimx5brzggw5h5mmmpq2djdypfq16wcw82qq";
+      type = "gem";
+    };
+    version = "2.8.4";
+  };
+  nokogiri = {
+    dependencies = [
+      "mini_portile2"
+      "racc"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1l8b0i24h4irivyhwy9xmkjbggw86cxkzkiqdqg0jpcp9qc8h4rl";
+      type = "gem";
+    };
+    version = "1.16.0";
+  };
+  pdf-reader = {
+    dependencies = [
+      "Ascii85"
+      "afm"
+      "hashery"
+      "ruby-rc4"
+      "ttfunk"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09sx25jpnip2sp6wh5sn5ad7za78rfi95qp5iiczfh43z4jqa8q3";
+      type = "gem";
+    };
+    version = "2.11.0";
+  };
+  public_suffix = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0n9j7mczl15r3kwqrah09cxj8hxdfawiqxa60kga2bmxl9flfz9k";
+      type = "gem";
+    };
+    version = "5.0.3";
+  };
+  racc = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "11v3l46mwnlzlc371wr3x6yylpgafgwdf0q7hc7c1lzx6r414r5g";
+      type = "gem";
+    };
+    version = "1.7.1";
+  };
+  rainbow = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  ruby-rc4 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "00vci475258mmbvsdqkmqadlwn6gj9m01sp7b5a3zd90knil1k00";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
+  timers = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pjzipnmzfywvgsr3gxwj6nmg47lz4700g0q71jgcy1z6rb7dn7p";
+      type = "gem";
+    };
+    version = "4.3.5";
+  };
+  ttfunk = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "15iaxz9iak5643bq2bc0jkbjv8w2zn649lxgvh5wg48q9d4blw13";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  typhoeus = {
+    dependencies = [ "ethon" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1m22yrkmbj81rzhlny81j427qdvz57yk5wbcf3km0nf3bl6qiygz";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  yell = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1g16kcdhdfvczn7x81jiq6afg3bdxmb73skqjyjlkp5nqcy6y5hx";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  zeitwerk = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mwdd445w63khz13hpv17m2br5xngyjl3jdj08xizjbm78i2zrxd";
+      type = "gem";
+    };
+    version = "2.6.11";
+  };
+}
--- a/pkgs/tools/misc/isoimagewriter/default.nix
+++ b/pkgs/tools/misc/isoimagewriter/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  mkDerivation,
+  fetchurl,
+  cmake,
+  extra-cmake-modules,
+  wrapQtAppsHook,
+  karchive,
+  kcoreaddons,
+  kcrash,
+  kiconthemes,
+  kwidgetsaddons,
+  solid,
+  qgpgme,
+}:
+mkDerivation rec {
+  pname = "isoimagewriter";
+  version = "1.0.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/isoimagewriter/${version}/isoimagewriter-${version}.tar.xz";
+    hash = "sha256-ppAiMD7Bvra3tPDWjlnkGZ08mGh2fLnrI8bdGZngal0=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    wrapQtAppsHook
+  ];
+  buildInputs = [
+    karchive
+    kcoreaddons
+    kcrash
+    kiconthemes
+    kwidgetsaddons
+    solid
+    qgpgme
+  ];
+
+  meta = {
+    description = "Program to write hybrid ISO files onto USB disks";
+    homepage = "https://invent.kde.org/utilities/isoimagewriter";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ k900 ];
+    mainProgram = "isoimagewriter";
+  };
+}
--- a/pkgs/tools/misc/kronometer/default.nix
+++ b/pkgs/tools/misc/kronometer/default.nix
@@ -0,0 +1,37 @@
+{
+  mkDerivation,
+  fetchurl,
+  lib,
+  extra-cmake-modules,
+  kdoctools,
+  kconfig,
+  kcrash,
+  kinit,
+}:
+
+mkDerivation rec {
+  pname = "kronometer";
+  version = "2.3.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/kronometer/${version}/src/kronometer-${version}.tar.xz";
+    sha256 = "sha256-dbnhom8PRo0Bay3DzS2P0xQSrJaMXD51UadQL3z6xHY=";
+  };
+
+  meta = with lib; {
+    homepage = "https://kde.org/applications/utilities/kronometer/";
+    description = "Stopwatch application";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ peterhoeg ];
+    mainProgram = "kronometer";
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+    kdoctools
+  ];
+  propagatedBuildInputs = [
+    kconfig
+    kcrash
+    kinit
+  ];
+}
--- a/pkgs/tools/misc/lice/default.nix
+++ b/pkgs/tools/misc/lice/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "lice";
+  version = "0.6";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0skyyirbidknfdzdvsjga8zb4ar6xpd5ilvz11dfm2a9yxh3d59d";
+  };
+
+  propagatedBuildInputs = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  meta = with lib; {
+    description = "Print license based on selection and user options";
+    homepage = "https://github.com/licenses/lice";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ swflint ];
+    platforms = platforms.unix;
+    mainProgram = "lice";
+  };
+
+}
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  elk7Version,
+  enableUnfree ? true,
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  nixosTests,
+  jre,
+}:
+
+let
+  info = lib.splitString "-" stdenv.hostPlatform.system;
+  arch = lib.elemAt info 0;
+  plat = lib.elemAt info 1;
+  hashes =
+    if enableUnfree then
+      {
+        x86_64-linux = "sha512-9JzopnY43Osoy4/0G9gxJYlbCl1a9Qy2pL4GL1uyjJ3uSNoOskEBhhsqLp9BhtJXOaquuRDgbJnXhbBrlE0rKg==";
+        x86_64-darwin = "sha512-ZcdKWFrIQUmGtxoWbLc2F7g85quXfRqy62DyVPR/9zBtMTgFH0eG4Cj40ELpW7nYXZqglmAUTF/0mZZYUg2Ciw==";
+        aarch64-linux = "sha512-V2Nt/lup4ofgoMqpAH3OHF8Fp0PvC1M8nl6sCKmTf+ZXQYHNjAJkJwGJwHeQQ0L/348JHyCkeWL43dS7Jr6ZJQ==";
+      }
+    else
+      {
+        x86_64-linux = "sha512-L11ZUdXC8VDiSEVDBMous2OaMlAFgvkQ+eDbmbA9r/sDIXY8W7dx3jgPNXoorDtatTemwy8aXw1XJGaVmj4T3Q==";
+        x86_64-darwin = "sha512-az5ujFtwcuNNGuITDeGRu1FB2bb8/hIUmGMvm0Xcfvs0GZPnCZVY6ScsiHZYjT8X+qBYkn/httT3MYozrPOy4Q==";
+        aarch64-linux = "sha512-iVft0kZYhvFJ1NKCfdePhRxDljPTwV+3G7wV94iykYISgLTVoehzDTMdxUyfK/mmQhu3hmmHbVpw1jXjTrS7ng==";
+      };
+  this = stdenv.mkDerivation rec {
+    version = elk7Version;
+    pname = "logstash${lib.optionalString (!enableUnfree) "-oss"}";
+
+    src = fetchurl {
+      url = "https://artifacts.elastic.co/downloads/logstash/${pname}-${version}-${plat}-${arch}.tar.gz";
+      hash = hashes.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
+    };
+
+    dontBuild = true;
+    dontPatchELF = true;
+    dontStrip = true;
+    dontPatchShebangs = true;
+
+    nativeBuildInputs = [
+      makeWrapper
+    ];
+
+    buildInputs = [
+      jre
+    ];
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r {Gemfile*,modules,vendor,lib,bin,config,data,logstash-core,logstash-core-plugin-api} $out
+
+      patchShebangs $out/bin/logstash
+      patchShebangs $out/bin/logstash-plugin
+
+      wrapProgram $out/bin/logstash \
+         --set JAVA_HOME "${jre}"
+
+      wrapProgram $out/bin/logstash-plugin \
+         --set JAVA_HOME "${jre}"
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "Logstash is a data pipeline that helps you process logs and other event data from a variety of systems";
+      homepage = "https://www.elastic.co/products/logstash";
+      sourceProvenance = with sourceTypes; [
+        fromSource
+        binaryBytecode # source bundles dependencies as jars
+        binaryNativeCode # bundled jruby includes native code
+      ];
+      license = if enableUnfree then licenses.elastic20 else licenses.asl20;
+      platforms = platforms.unix;
+      maintainers = with maintainers; [
+        offline
+        basvandijk
+      ];
+    };
+    passthru.tests = lib.optionalAttrs (config.allowUnfree && enableUnfree) (
+      assert this.drvPath == nixosTests.elk.unfree.ELK-7.elkPackages.logstash.drvPath;
+      {
+        elk = nixosTests.elk.unfree.ELK-7;
+      }
+    );
+  };
+in
+this
--- a/pkgs/tools/misc/logstash/contrib.nix
+++ b/pkgs/tools/misc/logstash/contrib.nix
@@ -0,0 +1,37 @@
+{
+  stdenv,
+  lib,
+  fetchzip,
+}:
+
+# Note that plugins are supposed to be installed as:
+#   $path/logstash/{inputs,codecs,filters,outputs}/*.rb
+stdenv.mkDerivation rec {
+  version = "1.4.2";
+  pname = "logstash-contrib";
+
+  src = fetchzip {
+    url = "https://download.elasticsearch.org/logstash/logstash/logstash-contrib-${version}.tar.gz";
+    sha256 = "1yj8sf3b526gixh3c6zhgkfpg4f0c72p1lzhfhdx8b3lw7zjkj0k";
+  };
+
+  dontBuild = true;
+  dontPatchELF = true;
+  dontStrip = true;
+  dontPatchShebangs = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/logstash
+    cp -r lib/* $out
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Community-maintained logstash plugins";
+    homepage = "https://github.com/elasticsearch/logstash-contrib";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = [ ];
+  };
+}
--- a/pkgs/tools/misc/lolcat/Gemfile
+++ b/pkgs/tools/misc/lolcat/Gemfile
@@ -0,0 +1,2 @@
+source "https://rubygems.org"
+gem "lolcat"
--- a/pkgs/tools/misc/lolcat/Gemfile.lock
+++ b/pkgs/tools/misc/lolcat/Gemfile.lock
@@ -0,0 +1,19 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    lolcat (100.0.1)
+      manpages (~> 0.6.1)
+      optimist (~> 3.0.0)
+      paint (~> 2.1)
+    manpages (0.6.1)
+    optimist (3.0.1)
+    paint (2.3.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  lolcat
+
+BUNDLED WITH
+   2.5.22
--- a/pkgs/tools/misc/lolcat/default.nix
+++ b/pkgs/tools/misc/lolcat/default.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  bundlerApp,
+  ruby_3_4,
+  bundlerUpdateScript,
+}:
+
+(bundlerApp.override { ruby = ruby_3_4; }) {
+  pname = "lolcat";
+  gemdir = ./.;
+  exes = [ "lolcat" ];
+
+  passthru.updateScript = bundlerUpdateScript "lolcat";
+
+  meta = with lib; {
+    description = "Rainbow version of cat";
+    homepage = "https://github.com/busyloop/lolcat";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [
+      StillerHarpo
+      manveru
+      nicknovitski
+    ];
+    mainProgram = "lolcat";
+  };
+}
--- a/pkgs/tools/misc/lolcat/gemset.nix
+++ b/pkgs/tools/misc/lolcat/gemset.nix
@@ -0,0 +1,47 @@
+{
+  lolcat = {
+    dependencies = [
+      "manpages"
+      "optimist"
+      "paint"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "13p8i08vdqfg2bqyjkl8jsp7gw8cf6r68i8plp9zqavlqadqlg4q";
+      type = "gem";
+    };
+    version = "100.0.1";
+  };
+  manpages = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "11p6ilnfda6af15ks3xiz2pr0hkvdvadnk1xm4ahqlf84dld3fnd";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  optimist = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vg2chy1cfmdj6c1gryl8zvjhhmb3plwgyh1jfnpq4fnfqv7asrk";
+      type = "gem";
+    };
+    version = "3.0.1";
+  };
+  paint = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1r9vx3wcx0x2xqlh6zqc81wcsn9qjw3xprcsv5drsq9q80z64z9j";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+}
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  libxml2,
+  libxslt,
+  docbook-xsl,
+  docbook_xml_dtd_44,
+  perlPackages,
+  makeWrapper,
+  perl, # for pod2man
+  cctools,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "moreutils";
+  version = "0.70";
+
+  src = fetchgit {
+    url = "git://git.joeyh.name/moreutils";
+    tag = version;
+    hash = "sha256-71ACHzzk258U4q2L7GJ59mrMZG99M7nQkcH4gHafGP0=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    makeWrapper
+    perl
+    libxml2
+    libxslt
+    docbook-xsl
+    docbook_xml_dtd_44
+  ];
+  buildInputs = [
+    (perl.withPackages (p: [
+      p.IPCRun
+      p.TimeDate
+      p.TimeDuration
+    ]))
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools
+  ];
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "DOCBOOKXSL=${docbook-xsl}/xml/xsl/docbook"
+    "INSTALL_BIN=install"
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "git://git.joeyh.name/moreutils";
+  };
+
+  meta = with lib; {
+    description = "Growing collection of the unix tools that nobody thought to write long ago when unix was young";
+    homepage = "https://joeyh.name/code/moreutils/";
+    maintainers = with maintainers; [
+      koral
+      pSub
+    ];
+    platforms = platforms.all;
+    license = licenses.gpl2Plus;
+  };
+}
--- a/pkgs/tools/misc/mpy-utils/default.nix
+++ b/pkgs/tools/misc/mpy-utils/default.nix
@@ -0,0 +1,32 @@
+{
+  stdenv,
+  lib,
+  buildPythonApplication,
+  fetchPypi,
+  fusepy,
+  pyserial,
+}:
+
+buildPythonApplication rec {
+  pname = "mpy-utils";
+  version = "0.1.13";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-die8hseaidhs9X7mfFvV8C8zn0uyw08gcHNqmjl+2Z4=";
+  };
+
+  propagatedBuildInputs = [
+    fusepy
+    pyserial
+  ];
+
+  meta = with lib; {
+    description = "MicroPython development utility programs";
+    homepage = "https://github.com/nickzoic/mpy-utils";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aciceri ];
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+}
--- a/pkgs/tools/misc/nvfancontrol/default.nix
+++ b/pkgs/tools/misc/nvfancontrol/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  libXNVCtrl,
+  libX11,
+  libXext,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nvfancontrol";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "foucault";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-0WBQSnTYVc3sNmZf/KFzznMg9AVsyaBgdx/IvG1dZAw=";
+  };
+
+  cargoHash = "sha256-nJc1G9R0+o22H1KiBtzfdcIIfKrD+Dksl7HsZ2ICD7U=";
+
+  nativeBuildInputs = [
+    libXNVCtrl
+    libX11
+    libXext
+  ];
+
+  # Needed for static linking
+  preConfigure = ''
+    export LIBRARY_PATH=${libXNVCtrl}/lib:${libX11}/lib:${libXext}/lib
+  '';
+
+  meta = with lib; {
+    description = "Nvidia dynamic fan control for Linux";
+    homepage = "https://github.com/foucault/nvfancontrol";
+    changelog = "https://github.com/foucault/nvfancontrol/releases/tag/${version}";
+    license = with licenses; [ gpl3Only ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ devins2518 ];
+    mainProgram = "nvfancontrol";
+  };
+}
--- a/pkgs/tools/misc/ocs-url/default.nix
+++ b/pkgs/tools/misc/ocs-url/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  libsForQt5,
+}:
+
+let
+  version = "3.1.0";
+
+  main_src = fetchgit {
+    url = "https://www.opencode.net/dfn2/ocs-url.git";
+    rev = "release-${version}";
+    sha256 = "RvbkcSj8iUAHAEOyETwfH+3XnCCY/p8XM8LgVrZxrws=";
+  };
+
+  qtil_src = fetchgit {
+    url = "https://github.com/akiraohgaki/qtil";
+    rev = "v0.4.0";
+    sha256 = "XRSp0F7ggfkof1RNAnQU3+O9DcXDy81VR7NakITOXrw=";
+  };
+in
+
+stdenv.mkDerivation {
+  pname = "ocs-url";
+  inherit version;
+
+  srcs = [
+    main_src
+    qtil_src
+  ];
+  sourceRoot = main_src.name;
+
+  # We are NOT in $sourceRoot here
+  postUnpack = ''
+    mkdir -p $sourceRoot/lib/qtil
+    cp -r ${qtil_src.name}/* $sourceRoot/lib/qtil/
+  '';
+
+  buildInputs = with libsForQt5.qt5; [
+    qtbase
+    qtsvg
+    qtquickcontrols
+    qmake
+    wrapQtAppsHook
+  ];
+
+  meta = with lib; {
+    description = "Open Collaboration System for use with DE store websites";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ SohamG ];
+    platforms = platforms.linux;
+    mainProgram = "ocs-url";
+  };
+}
--- a/pkgs/tools/misc/online-judge-template-generator/default.nix
+++ b/pkgs/tools/misc/online-judge-template-generator/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonApplication,
+  appdirs,
+  beautifulsoup4,
+  colorlog,
+  fetchFromGitHub,
+  mako,
+  online-judge-api-client,
+  online-judge-tools,
+  ply,
+  pyyaml,
+  requests,
+  setuptools,
+  toml,
+}:
+
+buildPythonApplication rec {
+  pname = "online-judge-template-generator";
+  version = "4.8.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "online-judge-tools";
+    repo = "template-generator";
+    rev = "v${version}";
+    sha256 = "sha256-cS1ED1a92fEFqy6ht8UFjxocWIm35IA/VuaPSLsdlqg=";
+  };
+
+  propagatedBuildInputs = [
+    appdirs
+    beautifulsoup4
+    colorlog
+    mako
+    online-judge-api-client
+    online-judge-tools
+    ply
+    pyyaml
+    requests
+    setuptools
+    toml
+  ];
+
+  # Needs internet to run tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Analyze problems of competitive programming and automatically generate boilerplate";
+    homepage = "https://github.com/online-judge-tools/template-generator";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sei40kr ];
+  };
+}
--- a/pkgs/tools/misc/opentelemetry-collector/builder.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/builder.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "ocb";
+  # Also update `pkgs/tools/misc/opentelemetry-collector/releases.nix`
+  # whenever that version changes.
+  version = "0.135.0";
+
+  src = fetchFromGitHub {
+    owner = "open-telemetry";
+    repo = "opentelemetry-collector";
+    rev = "cmd/builder/v${version}";
+    hash = "sha256-ntRWAYbVbtZBqewXx4+YCZspRr+wSE2iGgmH8PEfj5o=";
+  };
+
+  sourceRoot = "${src.name}/cmd/builder";
+  vendorHash = "sha256-my52TJ2D9RXbIqSaY4PHwrYVd93dXXeg/srXHt1jcoI=";
+
+  env.CGO_ENABLED = 0;
+  ldflags = [
+    "-s"
+    "-w"
+    "-X go.opentelemetry.io/collector/cmd/builder/internal.version=${version}"
+  ];
+
+  # Some tests download new dependencies for a modified go.mod. Nix doesn't allow network access so skipping.
+  checkFlags = [
+    "-skip TestGenerateAndCompile|TestReplaceStatementsAreComplete|TestVersioning"
+  ];
+
+  # Rename to ocb (it's generated as "builder")
+  postInstall = ''
+    mv $out/bin/builder $out/bin/ocb
+  '';
+
+  meta = {
+    description = "OpenTelemetry Collector";
+    homepage = "https://github.com/open-telemetry/opentelemetry-collector.git";
+    changelog = "https://github.com/open-telemetry/opentelemetry-collector/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ davsanchez ];
+    mainProgram = "ocb";
+  };
+}
--- a/pkgs/tools/misc/opentelemetry-collector/releases.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/releases.nix
@@ -0,0 +1,174 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  nixosTests,
+  opentelemetry-collector-builder,
+  pkgs,
+  go,
+  git,
+  cacert,
+  stdenv,
+}:
+let
+  # This is the tool OTEL uses to build their distributions.
+  builder = "${opentelemetry-collector-builder}/bin/ocb";
+
+  # Keep the version in sync with the builder.
+  rev = opentelemetry-collector-builder.src.rev;
+
+  version = lib.removePrefix "cmd/builder/v" rev;
+
+  # This is a weird meta-repo where all the open-telemetry collectors are.
+  src = fetchFromGitHub {
+    owner = "open-telemetry";
+    repo = "opentelemetry-collector-releases";
+    rev = "v${version}";
+    hash = "sha256-/I6kYm/j2hO2OAZaWVIRYI1ejBTGMI3PzTjRLcmwziQ=";
+  };
+
+  # Then from this src, we use the tool to generate some go code, including
+  # the go.mod and go.sum files.
+  #
+  # The output depends on which release.
+  mkDistributionSource =
+    {
+      name,
+      hash,
+    }:
+    stdenv.mkDerivation {
+      inherit name;
+
+      nativeBuildInputs = [
+        cacert
+        git
+        go
+      ];
+
+      inherit src;
+
+      outputHash = hash;
+      outputHashMode = "recursive";
+      outputHashAlgo = if hash == "" then "sha256" else null;
+
+      patchPhase = ''
+        patchShebangs .
+      '';
+
+      configurePhase = ''
+        export HOME=$NIX_BUILD_TOP/home
+        export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
+      '';
+
+      buildPhase = ''
+        # Only generate the go code, skip compilation
+        ./scripts/build.sh -d ${name} -b ${builder} -s true
+      '';
+
+      installPhase = ''
+        mv ./distributions/${name}/_build $out
+
+        # Make it reproducible
+        rm $out/build.log
+      '';
+    };
+
+  # Then, finally, we build the project as a normal go module package.
+  mkDistribution =
+    {
+      name,
+      sourceHash,
+      vendorHash,
+      proxyVendor ? false,
+    }:
+    let
+      package = buildGoModule {
+        pname = name;
+        inherit version;
+
+        src = mkDistributionSource {
+          inherit name;
+          hash = sourceHash;
+        };
+
+        inherit proxyVendor vendorHash;
+
+        nativeBuildInputs = [ installShellFiles ];
+
+        # upstream strongly recommends disabling CGO
+        # additionally dependencies have had issues when GCO was enabled that weren't caught upstream
+        # https://github.com/open-telemetry/opentelemetry-collector/blob/main/CONTRIBUTING.md#using-cgo
+        env.CGO_ENABLED = 0;
+
+        ldflags = [
+          "-s"
+          "-w"
+        ];
+
+        postInstall = ''
+          # Fix binary name
+          mv $out/bin/* $out/bin/$pname
+
+          installShellCompletion --cmd ${name} \
+            --bash <($out/bin/${name} completion bash) \
+            --fish <($out/bin/${name} completion fish) \
+            --zsh <($out/bin/${name} completion zsh)
+        '';
+
+        passthru.tests = {
+          version = testers.testVersion {
+            inherit package version;
+            command = "${name} -v";
+          };
+        };
+
+        meta = with lib; {
+          homepage = "https://github.com/open-telemetry/opentelemetry-collector-releases";
+          description = "OpenTelemetry Collector Official Releases";
+          longDescription = ''
+            The OpenTelemetry Collector offers a vendor-agnostic implementation on how
+            to receive, process and export telemetry data. In addition, it removes the
+            need to run, operate and maintain multiple agents/collectors in order to
+            support open-source telemetry data formats (e.g. Jaeger, Prometheus, etc.)
+            sending to multiple open-source or commercial back-ends.
+          '';
+          license = licenses.asl20;
+          maintainers = with maintainers; [
+            uri-canva
+            jk
+            zimbatm
+          ];
+          mainProgram = name;
+        };
+      };
+    in
+    package;
+in
+lib.recurseIntoAttrs {
+  otelcol = mkDistribution {
+    name = "otelcol";
+    sourceHash = "sha256-XGQIHkRfCSdEnZlhodN38BKZGkgOPuUnxveG4yX0rMw=";
+    vendorHash = "sha256-0i+eHVBwYvEKf4kXfyOuN/gEkDk2/5s7+3HQjYCtI94=";
+  };
+
+  otelcol-contrib = mkDistribution {
+    name = "otelcol-contrib";
+    sourceHash = "sha256-87VmiafluGem4p5hRP+UmPuSJeXdXjZkubWzqhXtyJg=";
+    vendorHash = "sha256-/qSXvt8oQ0C3V49an7TNUw0bcNVnXd5Qmz5oCRp+KTE=";
+    proxyVendor = true; # hash mismatch between linux and darwin
+  };
+
+  otelcol-k8s = mkDistribution {
+    name = "otelcol-k8s";
+    sourceHash = "sha256-B5NbbQBIz3RZ/+jSxNhuY+zpfhHlg26cvUlMqlYXtq0=";
+    vendorHash = "sha256-2dGNrsskrCh76bTMuPYcRH+bMl/sE+KVn2mOqcF2PeI=";
+  };
+
+  otelcol-otlp = mkDistribution {
+    name = "otelcol-otlp";
+    sourceHash = "sha256-c83fzhC4XbvRHZ3XwXQgwsyW1TDiDs0T/bX3h53n2RE=";
+    vendorHash = "sha256-QVNQFsaACvlByQWwpl2emSIrL+how78WtU51YJ2AvAU=";
+  };
+}
--- a/pkgs/tools/misc/pandoc-acro/default.nix
+++ b/pkgs/tools/misc/pandoc-acro/default.nix
@@ -0,0 +1,71 @@
+{
+  buildPythonApplication,
+  fetchPypi,
+  pandocfilters,
+  panflute,
+  lib,
+  pandoc,
+  pandoc-acro,
+  texliveTeTeX,
+  runCommand,
+}:
+
+let
+  pname = "pandoc-acro";
+  version = "0.10.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-JMfSQXX+BCGdFQYPFB+r08WRnhT3aXfnBNINROxCUA0=";
+  };
+in
+buildPythonApplication {
+  format = "setuptools";
+  inherit pname version src;
+
+  propagatedBuildInputs = [
+    pandocfilters
+    panflute
+  ];
+
+  # Something in the tests does not typecheck, but the tool works well.
+  doCheck = false;
+
+  passthru.tests.example-doc =
+    let
+      env = {
+        nativeBuildInputs = [
+          pandoc
+          pandoc-acro
+          (texliveTeTeX.withPackages (
+            ps: with ps; [
+              acro
+              translations
+            ]
+          ))
+        ];
+      };
+    in
+    runCommand "pandoc-acro-example-docs" env ''
+      set -euo pipefail
+      exampleFile="${pname}-${version}/tests/example.md"
+      metadataFile="${pname}-${version}/tests/metadata.yaml"
+      tar --extract "--file=${src}" "$exampleFile" "$metadataFile"
+      mkdir $out
+
+      pandoc -F pandoc-acro "$exampleFile" "--metadata-file=$metadataFile" \
+        -T pdf -o $out/example.pdf
+      pandoc -F pandoc-acro  "$exampleFile" "--metadata-file=$metadataFile" \
+        -T txt -o $out/example.txt
+
+      ! grep -q "\+afaik" $out/example.txt
+    '';
+
+  meta = with lib; {
+    homepage = "https://pypi.org/project/pandoc-acro/";
+    description = "Pandoc filter which manages acronyms in Pandoc flavored Markdown sources";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ tfc ];
+    mainProgram = "pandoc-acro";
+  };
+}
--- a/pkgs/tools/misc/pandoc-drawio-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
@@ -0,0 +1,59 @@
+{
+  buildPythonApplication,
+  drawio-headless,
+  fetchFromGitHub,
+  lib,
+  pandoc,
+  pandocfilters,
+  runCommand,
+  texliveTeTeX,
+}:
+
+let
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "tfc";
+    repo = "pandoc-drawio-filter";
+    rev = version;
+    sha256 = "sha256-2XJSAfxqEmmamWIAM3vZqi0mZjUUugmR3zWw8Imjadk=";
+  };
+
+  pandoc-drawio-filter = buildPythonApplication {
+    format = "setuptools";
+    pname = "pandoc-drawio-filter";
+
+    inherit src version;
+
+    propagatedBuildInputs = [
+      drawio-headless
+      pandocfilters
+    ];
+
+    passthru.tests.example-doc =
+      let
+        env = {
+          nativeBuildInputs = [
+            pandoc
+            pandoc-drawio-filter
+            texliveTeTeX
+          ];
+        };
+      in
+      runCommand "$pandoc-drawio-filter-example-doc.pdf" env ''
+        cp -r ${src}/example/* .
+        pandoc -F pandoc-drawio example.md -T pdf -o $out
+      '';
+
+    meta = with lib; {
+      homepage = "https://github.com/tfc/pandoc-drawio-filter";
+      description = "Pandoc filter which converts draw.io diagrams to PDF";
+      license = licenses.mit;
+      maintainers = with maintainers; [ tfc ];
+      mainProgram = "pandoc-drawio";
+    };
+  };
+
+in
+
+pandoc-drawio-filter
--- a/pkgs/tools/misc/pandoc-eqnos/default.nix
+++ b/pkgs/tools/misc/pandoc-eqnos/default.nix
@@ -0,0 +1,37 @@
+{
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  pandoc-xnos,
+  setuptools,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-eqnos";
+  version = "2.5.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "tomduck";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-7GQdfGHhtQs6LZK+ZyMmcPSkoFfBWmATTMejMiFcS7Y=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ pandoc-xnos ];
+
+  # Different pandoc executables are not available
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standalone pandoc filter from the pandoc-xnos suite for numbering equations and equation references";
+    homepage = "https://github.com/tomduck/pandoc-eqnos";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ppenguin ];
+    mainProgram = "pandoc-eqnos";
+  };
+}
--- a/pkgs/tools/misc/pandoc-fignos/default.nix
+++ b/pkgs/tools/misc/pandoc-fignos/default.nix
@@ -0,0 +1,37 @@
+{
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  pandoc-xnos,
+  setuptools,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-fignos";
+  version = "2.4.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "tomduck";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-eDwAW0nLB4YqrWT3Ajt9bmX1A43wl+tOPm2St5VpCLk=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ pandoc-xnos ];
+
+  # Different pandoc executables are not available
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standalone pandoc filter from the pandoc-xnos suite for numbering figures and figure references";
+    homepage = "https://github.com/tomduck/pandoc-fignos";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ppenguin ];
+    mainProgram = "pandoc-fignos";
+  };
+}
--- a/pkgs/tools/misc/pandoc-imagine/default.nix
+++ b/pkgs/tools/misc/pandoc-imagine/default.nix
@@ -0,0 +1,39 @@
+{
+  fetchFromGitHub,
+  buildPythonApplication,
+  lib,
+  pandocfilters,
+  six,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-imagine";
+  version = "0.1.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    repo = "imagine";
+    owner = "hertogp";
+    rev = version;
+    sha256 = "sha256-IJAXrJakKjROF2xi9dsLvGzyGIyB+GDnx/Z7BRlwSqc=";
+  };
+
+  propagatedBuildInputs = [
+    pandocfilters
+    six
+  ];
+
+  # No tests in archive
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = src.meta.homepage;
+    description = ''
+      A pandoc filter that will turn code blocks tagged with certain classes
+      into images or ASCII art
+    '';
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ synthetica ];
+    mainProgram = "pandoc-imagine";
+  };
+}
--- a/pkgs/tools/misc/pandoc-include/default.nix
+++ b/pkgs/tools/misc/pandoc-include/default.nix
@@ -0,0 +1,48 @@
+{
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  natsort,
+  panflute,
+  lxml,
+  setuptools,
+  nix-update-script,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-include";
+  version = "1.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DCsunset";
+    repo = "pandoc-include";
+    tag = "v${version}";
+    hash = "sha256-8ldIywvCExnbMNs9m7iLwM1HrTRHl7j4t3JQuBt0Z7U=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  propagatedBuildInputs = [
+    natsort
+    panflute
+    lxml
+  ];
+
+  pythonImportsCheck = [ "pandoc_include.main" ];
+
+  meta = with lib; {
+    description = "Pandoc filter to allow file and header includes";
+    homepage = "https://github.com/DCsunset/pandoc-include";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      ppenguin
+      DCsunset
+    ];
+    mainProgram = "pandoc-include";
+  };
+}
--- a/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchPypi,
+  setuptools,
+  setuptools-scm,
+  pandocfilters,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-plantuml-filter";
+  version = "0.1.5";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-9qXeIZuCu44m9EoPCPL7MgEboEwN91OylLfbkwhkZYQ=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ pandocfilters ];
+
+  meta = {
+    homepage = "https://github.com/timofurrer/pandoc-plantuml-filter";
+    description = "Pandoc filter which converts PlantUML code blocks to PlantUML images";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cmcdragonkai ];
+    mainProgram = "pandoc-plantuml";
+  };
+}
--- a/pkgs/tools/misc/pandoc-secnos/default.nix
+++ b/pkgs/tools/misc/pandoc-secnos/default.nix
@@ -0,0 +1,41 @@
+{
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  pandoc-xnos,
+  setuptools,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-secnos";
+  version = "2.2.2";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "tomduck";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-J9KLZvioYM3Pl2UXjrEgd4PuLTwCLYy9SsJIzgw5/jU=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ pandoc-xnos ];
+
+  patches = [
+    ./patch/fix-manifest.patch
+  ];
+
+  # Different pandoc executables are not available
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standalone pandoc filter from the pandoc-xnos suite for numbering sections and section references";
+    homepage = "https://github.com/tomduck/pandoc-secnos";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ppenguin ];
+    mainProgram = "pandoc-secnos";
+  };
+}
--- a/pkgs/tools/misc/pandoc-secnos/patch/fix-manifest.patch
+++ b/pkgs/tools/misc/pandoc-secnos/patch/fix-manifest.patch
@@ -0,0 +1,39 @@
+From 165ee1f4c1208636254392335d34934dc50d273e Mon Sep 17 00:00:00 2001
+From: ppenguin <hieronymusv@gmail.com>
+Date: Tue, 15 Mar 2022 23:15:07 +0100
+Subject: [PATCH] fix setup.py to work in nixpkgs
+
+---
+ setup.py | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index d705846..d7345a2 100644
+--- a/setup.py
+++ b/setup.py
+@@ -42,10 +42,10 @@
+ 
+     author='Thomas J. Duck',
+     author_email='tomduck@tomduck.ca',
+-    description='Equation number filter for pandoc',
+    description='Section number filter for pandoc',
+     long_description=DESCRIPTION,
+     license='GPL',
+-    keywords='pandoc equation numbers filter',
+    keywords='pandoc section numbers filter',
+     url='https://github.com/tomduck/pandoc-secnos',
+     download_url='https://github.com/tomduck/pandoc-secnos/tarball/' + \
+                  __version__,
+@@ -63,12 +63,3 @@
+         'Programming Language :: Python'
+         ]
+ )
+-
+-# Check that the pandoc-secnos script is on the PATH
+-if not shutil.which('pandoc-secnos'):
+-    msg = """
+-          ERROR: `pandoc-secnos` script not found. This will need to 
+-          be corrected.  If you need help, please file an Issue at
+-          https://github.com/tomduck/pandoc-secnos/issues.\n"""
+-    print(textwrap.dedent(msg))
+-    sys.exit(-1)
--- a/pkgs/tools/misc/pandoc-tablenos/default.nix
+++ b/pkgs/tools/misc/pandoc-tablenos/default.nix
@@ -0,0 +1,37 @@
+{
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  pandoc-xnos,
+  setuptools,
+}:
+
+buildPythonApplication rec {
+  pname = "pandoc-tablenos";
+  version = "2.3.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "tomduck";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-FwzsRziY3PoySo9hIFuLw6tOO9oQij6oQEyoY8HgnII=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ pandoc-xnos ];
+
+  # Different pandoc executables are not available
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standalone pandoc filter from the pandoc-xnos suite for numbering tables and table references";
+    homepage = "https://github.com/tomduck/pandoc-tablenos";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ppenguin ];
+    mainProgram = "pandoc-tablenos";
+  };
+}
--- a/Show More
+++ b/Show More