push sheeet

pkgs/tools/package-management/akku/akku.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  autoreconfHook,
+  pkg-config,
+  git,
+  guile,
+  curl,
+}:
+stdenv.mkDerivation rec {
+  pname = "akku";
+  version = "1.1.0-unstable-2024-03-03";
+
+  src = fetchFromGitLab {
+    owner = "akkuscm";
+    repo = "akku";
+    rev = "cb996572fe0dbe74a42d2abeafadffaea2bf8ae3";
+    sha256 = "sha256-6xqASnFxzz0yE5oJnh15SOB74PVrVkMVwS3PwKAmgks=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  # akku calls curl commands
+  buildInputs = [
+    guile
+    curl
+    git
+  ];
+
+  # Use a dummy package index to bootstrap Akku
+  preBuild = ''
+    touch bootstrap.db
+  '';
+
+  makeFlags = [ "GUILE_AUTO_COMPILE=0" ];
+
+  meta = with lib; {
+    homepage = "https://akkuscm.org/";
+    description = "Language package manager for Scheme";
+    changelog = "https://gitlab.com/akkuscm/akku/-/raw/v${version}/NEWS.md";
+    platforms = platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [
+      nagy
+      konst-aa
+    ];
+    mainProgram = "akku";
+  };
+}

pkgs/tools/package-management/akku/akkuDerivation.nix

@@ -0,0 +1,128 @@
+{
+  stdenv,
+  akku,
+  chez,
+  guile,
+  chibi,
+  makeWrapper,
+  lib,
+  writeShellScriptBin,
+}:
+{
+  pname,
+  version,
+  src,
+  buildInputs ? [ ],
+  r7rs ? false,
+  nativeBuildInputs ? [ ],
+  ...
+}@args:
+let
+  parse-akku_ = writeShellScriptBin "parse-akku" "${guile}/bin/guile --no-auto-compile ${./parse-akku.scm} \"$@\"";
+  parse-akku = "${parse-akku_}/bin/parse-akku";
+in
+stdenv.mkDerivation (
+  {
+    inherit version src;
+
+    pname = "akku-${pname}";
+    propagatedBuildInputs = buildInputs;
+    buildInputs = [ ];
+    nativeBuildInputs = [
+      makeWrapper
+      akku
+      chez
+      chibi
+    ]
+    ++ nativeBuildInputs;
+    buildPhase = ''
+      runHook preBuild
+
+      # only install the project
+      rm -f Akku.lock Akku.manifest
+
+      akku install
+
+      # make sure akku metadata is present during testing and onwards
+      echo $PWD $CHEZSCHEMELIBDIRS \
+      | sed "s/:/ /g" \
+      | xargs find \
+      | grep "metadata.sls" \
+      | xargs ${parse-akku} merge ${pname} ${version} > temp___
+      mv temp___ .akku/lib/akku/metadata.sls
+
+      runHook postBuild
+    '';
+    checkPhase = ''
+      IS_R7RS=false
+      runHook preCheck
+
+
+      propagated_chez=$CHEZSCHEMELIBDIRS
+      propagated_chibi=$CHIBI_MODULE_PATH
+
+      export CHEZSCHEMELIBDIRS="$PWD/.akku/lib:$CHEZSCHEMELIBDIRS"
+      export CHIBI_MODULE_PATH="$PWD/.akku/lib:$CHIBI_MODULE_PATH"
+
+      # Run all test .sps files if they exist
+      # and run tests for libs mirrored from snow-fort.
+      for path in $(find test* -type f | grep -e "\.sps") \
+                  $(find . | grep "run-test" | grep "\.scm"); do
+        echo Running test: $path
+        [[ "\n$SKIP\n" =~ $(basename $path) ]] && continue
+        if [ -x $path ]; then
+          patchShebangs $path
+          ./$path
+        elif ${lib.trivial.boolToString r7rs}; then
+          chibi-scheme $path
+        else
+          scheme-script $path
+        fi
+      done
+
+      runHook postCheck
+
+      export CHEZSCHEMELIBDIRS=$propagated_chez
+      export CHIBI_MODULE_PATH=$propagated_chibi
+    '';
+    doCheck = true;
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/lib
+
+      cd .akku
+
+      rm -f bin/activate*
+
+      cp -rL lib $out/lib/scheme-libs
+      cp -rL bin $out/bin
+
+      [ -d ffi ]    && cp -rL ffi $out/lib
+      [ -d libobj ] && cp -rL libobj $out/lib
+
+      CHEZSCHEMELIBDIRS="$out/lib/scheme-libs:$CHEZSCHEMELIBDIRS"
+
+      # add support for other schemes
+      for f in $out/bin/*
+      do
+      patchShebangs $f
+      wrapProgram $f \
+        --prefix CHEZSCHEMELIBDIRS : $CHEZSCHEMELIBDIRS
+      done
+
+      runHook postInstall
+    '';
+    meta = {
+      inherit (akku.meta) platforms;
+    }
+    // args.meta or { };
+    setupHook = ./setup-hook.sh;
+  }
+  // removeAttrs args [
+    "name"
+    "buildInputs"
+    "meta"
+    "nativeBuildInputs"
+  ]
+)

pkgs/tools/package-management/akku/default.nix

@@ -0,0 +1,88 @@
+{
+  lib,
+  newScope,
+  fetchurl,
+}:
+lib.makeScope newScope (self: rec {
+  akkuDerivation = self.callPackage ./akkuDerivation.nix { };
+  akku = self.callPackage ./akku.nix { };
+
+  akkuPackages =
+    let
+      overrides = self.callPackage ./overrides.nix { };
+      makeAkkuPackage =
+        akkuself: pname:
+        {
+          version,
+          dependencies,
+          dev-dependencies,
+          license,
+          url,
+          sha256,
+          source,
+          synopsis ? "",
+          homepage ? "",
+          ...
+        }:
+        (akkuDerivation {
+          pname = "akku-${pname}";
+          inherit version;
+          src = fetchurl {
+            inherit url sha256;
+          };
+          buildInputs = map (x: akkuself.${x}) dependencies;
+          r7rs = source == "snow-fort";
+          nativeBuildInputs = map (x: akkuself.${x}) dev-dependencies;
+          unpackPhase = "tar xf $src";
+
+          meta.homepage = homepage;
+          meta.description = synopsis;
+          meta.license =
+            let
+              stringToLicense =
+                s:
+                (
+                  lib.licenses
+                  // (with lib.licenses; {
+                    "0bsd" = bsd0;
+                    "agpl" = agpl3Only;
+                    "apache-2.0" = asl20;
+                    "artistic" = artistic2;
+                    "bsd" = bsd3;
+                    "bsd-1-clause" = bsd1;
+                    "bsd-2-clause" = bsd2;
+                    "bsd-3-clause" = bsd3;
+                    "cc0-1.0" = cc0;
+                    "gpl" = gpl3Only;
+                    "gpl-2" = gpl2Only;
+                    "gpl-2.0-or-later" = gpl2Plus;
+                    "gplv2" = gpl2Only;
+                    "gpl-3" = gpl3Only;
+                    "gpl-3.0" = gpl3Only;
+                    "gpl-3.0-or-later" = gpl3Plus;
+                    "gplv3" = gpl3Only;
+                    "lgpl" = lgpl3Only;
+                    "lgpl-2" = lgpl2Only;
+                    "lgpl-2.0+" = lgpl2Plus;
+                    "lgpl-2.1" = lgpl21Only;
+                    "lgpl-2.1-or-later" = lgpl21Plus;
+                    "lgpl-3.0-or-later" = lgpl3Plus;
+                    "lgpl-3" = lgpl3Only;
+                    "lgplv3" = lgpl3Only;
+                    "public-domain" = publicDomain;
+                    "srfi" = bsd3;
+                    "unicode" = ucd;
+                    "xerox" = xerox;
+                    "zlib-acknowledgement" = zlib;
+                    "noassertion" = free;
+                  })
+                ).${s} or s;
+            in
+            if builtins.isList license then map stringToLicense license else stringToLicense license;
+        }).overrideAttrs
+          ({ "${pname}" = lib.id; } // overrides)."${pname}";
+      deps = lib.importTOML ./deps.toml;
+      packages = lib.makeScope self.newScope (akkuself: lib.mapAttrs (makeAkkuPackage akkuself) deps);
+    in
+    lib.recurseIntoAttrs packages;
+})

pkgs/tools/package-management/akku/overrides.nix

@@ -0,0 +1,159 @@
+{
+  stdenv,
+  lib,
+  akku,
+  curl,
+  git,
+}:
+let
+  joinOverrides =
+    overrides: pkg: old:
+    lib.attrsets.mergeAttrsList (map (o: o pkg old) overrides);
+  addToBuildInputs = extras: pkg: old: {
+    propagatedBuildInputs = old.propagatedBuildInputs ++ extras;
+  };
+  broken = lib.addMetaAttrs { broken = true; };
+  skipTests = pkg: old: { doCheck = false; };
+  # debugging
+  showLibs = pkg: old: { preCheck = "echo $CHEZSCHEMELIBDIRS"; };
+  runTests = pkg: old: { doCheck = true; };
+  brokenOnAarch64 = _: lib.addMetaAttrs { broken = stdenv.hostPlatform.isAarch64; };
+  brokenOnx86_64Darwin = lib.addMetaAttrs {
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
+  };
+  brokenOnDarwin = lib.addMetaAttrs { broken = stdenv.hostPlatform.isDarwin; };
+in
+{
+  chez-srfi = joinOverrides [
+    (pkg: old: {
+      preCheck = ''
+        SKIP='
+        multi-dimensional-arrays.sps
+        time.sps
+        tables-test.ikarus.sps
+        lazy.sps
+        pipeline-operators.sps
+        os-environment-variables.sps
+        '
+      '';
+    })
+  ];
+
+  akku-r7rs = pkg: old: {
+    preBuild = ''
+      # tests aren't exported modules
+      rm -rf tests
+    '';
+  };
+
+  akku = joinOverrides [
+    # uses chez
+    (addToBuildInputs [
+      curl
+      git
+    ])
+    (pkg: old: {
+      # bump akku to 1.1.0-unstable-2024-03-03
+      src = akku.src;
+    })
+    # not a tar archive
+    (pkg: old: {
+      unpackPhase = null;
+    })
+  ];
+
+  machine-code = pkg: old: {
+    # fails on hydra with 'Log limit exceeded'
+    postPatch = ''
+      rm tests/all-a64.sps
+    '';
+  };
+
+  # circular dependency on wak-trc-testing !?
+  wak-foof-loop = skipTests;
+
+  scheme-langserver = joinOverrides [
+    (pkg: old: {
+      preInstall = ''
+        # add the lsp executable to be installed
+        echo "#!/usr/bin/env scheme-script" > .akku/bin/scheme-langserver
+        cat run.ss >> .akku/bin/scheme-langserver
+        chmod +x .akku/bin/scheme-langserver
+      '';
+    })
+    skipTests
+  ];
+
+  # broken tests
+  xitomatl = skipTests;
+  ufo-threaded-function = skipTests;
+  ufo-try = skipTests;
+
+  # unsupported schemes, it seems.
+  loko-srfi = broken;
+  ac-d-bus = broken;
+
+  # todo:
+  # system-specific:
+
+  # scheme-langserver doesn't work because of this
+  ufo-thread-pool = brokenOnDarwin;
+
+  # broken everywhere:
+  chibi-math-linalg = broken;
+  chibi-mecab = broken;
+  chibi-ssl = broken;
+  chibi-voting = broken;
+  chibi-xgboost = broken;
+  dockerfile = broken;
+  in-progress-hash-bimaps = broken;
+  in-progress-hash-tables = broken;
+  rapid-analyze-library = broken;
+  rapid-args-fold = broken;
+  rapid-eliminate-mutable-variables = broken;
+  rapid-fix-letrec = broken;
+  rapid-graph = broken;
+  rapid-library-definition = broken;
+  rapid-mapping = broken;
+  rapid-read = broken;
+  rapid-set = broken;
+  rapid-syntax = broken;
+  read-char-if = broken;
+  shell-quote = broken;
+  srfi-19 = broken;
+  srfi-64 = broken;
+  srfi-179 = broken;
+  string-inflection = broken;
+  tex-parser = broken;
+  trivial-tar-writer = broken;
+  unpack-assoc = broken;
+  agave = broken;
+  box2d-lite = broken;
+  chez-soop = broken;
+  chez-stats = broken;
+  dataframe = broken;
+  dharmalab = broken;
+  dorodango = broken;
+  fectors = broken;
+  fs-fatfs = broken;
+  fs-partitions = broken;
+  gnuplot-pipe = broken;
+  http-pixiu = broken;
+  influx-client = broken;
+  linenoise = broken;
+  mpl = broken;
+  mummel = broken;
+  ocelotl = broken;
+  r6lint = broken;
+  r6rs-clos = broken;
+  r6rs-coap = broken;
+  r6rs-msgpack = broken;
+  scheme-bytestructures = broken;
+  surfage = broken;
+  swish = broken;
+  text-mode = broken;
+  thunderchez = broken;
+  wak-ssax = broken;
+  wak-sxml-tools = broken;
+  yxskaft = broken;
+}

pkgs/tools/package-management/akku/parse-akku.scm

@@ -0,0 +1,151 @@
+(import (srfi 1)
+        (srfi 28)
+        (ice-9 pretty-print))
+
+
+(define-syntax anif
+  (syntax-rules (:=)
+    ((_ (bool := sym) x y)
+     (let ((sym bool))
+       (if sym x y)))
+    ((_ b x)
+     (anif b x #f))))
+
+(define ref assoc-ref)
+
+(define (sref alist key)
+  ;; Used to reach b in pairs like (a . (b))
+  (anif ((ref alist key) := t)
+        (car t)
+        #f))
+
+(define (printf str . args)
+  (display (apply format (cons str args))))
+
+(define (->string x)
+  (cond
+    ((symbol? x) (symbol->string x))
+    ((number? x) (number->string x))
+    (else x)))
+
+(define (module-name->string module)
+  (if (pair? module)
+    (string-join (map ->string module) "-")
+    module))
+
+(define (normalize-deps deps)
+  (map (compose module-name->string car) deps))
+
+(define (parse-license license)
+  (let ((res (with-input-from-string license read)))
+    (if (pair? res)
+      (map (compose string-downcase ->string)
+           (filter (lambda (sym) (not (eq? sym 'AND))) res))
+      (string-downcase (->string res)))))
+
+(define (parse-version-info alist)
+  (let* ((lock (ref alist 'lock))
+         (url (sref (ref lock 'location) 'url))
+         (sha256 (sref (ref lock 'content) 'sha256))
+         (depends (normalize-deps (ref alist 'depends)))
+         (dev-depends
+           (anif ((ref alist 'depends/dev) := t)
+                 (normalize-deps t)
+                 (list)))
+         (license (parse-license (sref alist 'license))))
+    (append `((license ,license)
+              (url ,url)
+              (sha256 ,sha256)
+              (depends ,depends)
+              (dev-depends ,dev-depends))
+            alist)))
+
+(define (format-list lst)
+  (define (surround s)
+    (format "~s" s))
+  (string-append
+    "["
+    (apply string-join (list (map surround lst) ", "))
+    "]"))
+
+(define (write-package sexp)
+  (let* ((latest (parse-version-info (last (ref sexp 'versions))))
+         (license (sref latest 'license))
+         (url (sref latest 'url)))
+    (printf "[~a]\n" (module-name->string (sref sexp 'name)))
+    (printf "dependencies = ~a\n" (format-list (sref latest 'depends)))
+    (printf "dev-dependencies = ~a\n" (format-list (sref latest 'dev-depends)))
+    (if (pair? license)
+      (printf "license = ~a\n" (format-list license))
+      (printf "license = ~s\n" license))
+    (printf "url = ~s\n" url)
+    (printf "sha256 = ~s\n" (sref latest 'sha256))
+    (printf
+      "source = ~s\n"
+      (cond
+        ;; because #f could be returned
+        ((eqv? 0 (string-contains url "https://archive.akkuscm.org/")) "akku")
+        ((eqv? 0 (string-contains url "http://snow-fort.org/")) "snow-fort")
+        (else "UNKNOWN")))
+    (anif ((sref latest 'synopsis) := t)
+          (printf "synopsis = ~s\n" t))
+    (printf "version = ~s\n" (sref latest 'version))
+    (anif ((sref latest 'hompeage) := t)
+          (printf "homepage = ~s\n" t))
+    (newline)))
+
+(define (main-deps)
+  (let ((res (read)))
+    (if (eof-object? res)
+      (exit 0))
+    (write-package (cdr res))
+    (main-deps)))
+
+
+(define (read-meta meta)
+  (with-input-from-file meta read))
+
+(define (find-definition meta sym)
+  ;; cddr for
+  ;; (define sym definition ...)
+  ;;             ^
+  (cddr (find (lambda (a)
+                (and (pair? a)
+                     (eq? (car a) 'define)
+                     (eq? (cadr a) sym)))
+              meta)))
+
+(define (installed-libraries meta)
+  ;; cadar for
+  ;; ((quote ((chibi diff) (chibi diff-test))))
+  ;;         ^
+  (cadar (find-definition meta 'installed-libraries)))
+
+(define (installed-assets meta)
+  (cadar (find-definition meta 'installed-assets)))
+
+(define (main-merge name version self-path . rest-paths)
+  (let* ((self (read-meta self-path))
+         (metas (map read-meta (cons self-path rest-paths)))
+         (joined-libraries (append-map installed-libraries metas))
+         (joined-assets (append-map installed-assets metas)))
+    (set-car! (find-definition self 'installed-libraries)
+              `',(delete-duplicates joined-libraries))
+    (set-car! (find-definition self 'installed-assets)
+              `',(delete-duplicates joined-assets))
+    (set-car! (find-definition self 'main-package-name)
+              `',name)
+    (set-car! (find-definition self 'main-package-version)
+              `',version)
+    self))
+
+(case (string->symbol (cadr (command-line)))
+  ((deps)
+   (read)
+   (main-deps))
+  ((merge)
+   (pretty-print (apply main-merge (cddr (command-line)))))
+  (else
+    (display "mode not found")
+    (newline)))
+

pkgs/tools/package-management/akku/setup-hook.sh

@@ -0,0 +1,32 @@
+_AKKU="SPDX-License-Identifier: MIT"
+_AKKU="Copyright (c) The Akku.scm Developers"
+
+scheme_vars='
+CHEZSCHEMELIBDIRS
+GUILE_LOAD_PATH
+IKARUS_LIBRARY_PATH
+MOSH_LOADPATH
+PLTCOLLECTS
+SAGITTARIUS_LOADPATH
+VICARE_SOURCE_PATH
+YPSILON_SITELIB
+LARCENY_LIBPATH
+IRONSCHEME_LIBRARY_PATH
+LOKO_LIBRARY_PATH
+DIGAMMA_SITELIB
+CHIBI_MODULE_PATH
+GAUCHE_LOAD_PATH
+'
+
+addToAkkuEnv () {
+    adder="addToSearchPath"
+    for env_var in $scheme_vars; do
+        $adder $env_var "$1/lib/scheme-libs"
+    done
+    $adder GUILE_LOAD_COMPILED_PATH "$1/lib/libobj"
+    $adder LD_LIBRARY_PATH "$1/lib/ffi"
+    $adder DYLD_LIBRARY_PATH "$1/lib/ffi"
+}
+
+addEnvHooks "$targetOffset" addToAkkuEnv
+

pkgs/tools/package-management/akku/update.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=../../../../ -i bash -p guile curl
+
+curl -sSf https://archive.akkuscm.org/archive/Akku-index.scm | guile parse-akku.scm deps > deps.toml

pkgs/tools/package-management/apk-tools/default.nix

@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  pkg-config,
+  scdoc,
+  openssl,
+  zlib,
+  luaSupport ? stdenv.hostPlatform == stdenv.buildPlatform,
+  lua,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "apk-tools";
+  version = "2.14.10";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.alpinelinux.org";
+    owner = "alpine";
+    repo = "apk-tools";
+    rev = "v${version}";
+    sha256 = "sha256-9TSkcJe7FVdTtfcCmwp+IWMYa/OL9OXJwPcKLyj5AAA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    scdoc
+  ]
+  ++ lib.optionals luaSupport [
+    lua
+    lua.pkgs.lua-zlib
+  ];
+  buildInputs = [
+    openssl
+    zlib
+  ]
+  ++ lib.optional luaSupport lua;
+  strictDeps = true;
+
+  makeFlags = [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+    "SBINDIR=$(out)/bin"
+    "LIBDIR=$(out)/lib"
+    "LUA=${if luaSupport then "lua" else "no"}"
+    "LUA_LIBDIR=$(out)/lib/lua/${lib.versions.majorMinor lua.version}"
+    "MANDIR=$(out)/share/man"
+    "DOCDIR=$(out)/share/doc/apk"
+    "INCLUDEDIR=$(out)/include"
+    "PKGCONFIGDIR=$(out)/lib/pkgconfig"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=unused-result"
+    "-Wno-error=deprecated-declarations"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://gitlab.alpinelinux.org/alpine/apk-tools";
+    description = "Alpine Package Keeper";
+    maintainers = [ ];
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    mainProgram = "apk";
+  };
+}

pkgs/tools/package-management/appimage-run/default.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  appimageTools,
+  buildFHSEnv,
+  makeDesktopItem,
+  extraPkgs ? pkgs: [ ],
+  appimage-run-tests ? null,
+}:
+
+let
+  name = "appimage-run";
+
+  fhsArgs = appimageTools.defaultFhsEnvArgs;
+
+  desktopItem = makeDesktopItem {
+    inherit name;
+    exec = name;
+    desktopName = name;
+    genericName = "AppImage runner";
+    noDisplay = true;
+    mimeTypes = [
+      "application/vnd.appimage"
+      "application/x-iso9660-appimage"
+    ];
+    categories = [
+      "PackageManager"
+      "Utility"
+    ];
+  };
+in
+buildFHSEnv (
+  lib.recursiveUpdate fhsArgs {
+    inherit name;
+
+    targetPkgs = pkgs: [ appimageTools.appimage-exec ] ++ fhsArgs.targetPkgs pkgs ++ extraPkgs pkgs;
+    runScript = "appimage-exec.sh";
+
+    extraInstallCommands = ''
+      cp --recursive "${desktopItem}/share" "$out/"
+    '';
+
+    passthru.tests.appimage-run = appimage-run-tests;
+
+    meta.mainProgram = "appimage-run";
+  }
+)

pkgs/tools/package-management/appimage-run/test.nix

@@ -0,0 +1,50 @@
+{
+  runCommand,
+  fetchurl,
+  appimage-run,
+  glibcLocales,
+  file,
+  xdg-utils,
+}:
+let
+  # any AppImage usable on cli, really
+  sample-appImage = fetchurl {
+    url = "https://github.com/AppImage/AppImageKit/releases/download/12/appimagetool-x86_64.AppImage";
+    sha256 = "04ws94q71bwskmhizhwmaf41ma4wabvfgjgkagr8wf3vakgv866r";
+  };
+  owdtest = fetchurl {
+    url = "https://github.com/NixOS/nixpkgs/files/10099048/owdtest.AppImage.gz";
+    sha256 = "sha256-EEp9dxz/+l5XkNaVBFgv5v64sizQILnljRAzwXv/yV8=";
+  };
+in
+runCommand "appimage-run-tests"
+  {
+    buildInputs = [
+      appimage-run
+      glibcLocales
+      file
+      xdg-utils
+    ];
+    meta.platforms = [ "x86_64-linux" ];
+  }
+  ''
+    export HOME=$(mktemp -d)
+    set -x
+
+    # regression test for #101137, must come first
+    LANG=fr_FR appimage-run ${sample-appImage} --list ${sample-appImage}
+
+    # regression test for #108426
+    cp ${sample-appImage} foo.appImage
+    LANG=fr_FR appimage-run ${sample-appImage} --list foo.appImage
+    cp ${owdtest} owdtest.AppImage.gz
+    gunzip owdtest.AppImage.gz
+    appimage-run owdtest.AppImage
+
+    # Verify desktop entry
+    XDG_DATA_DIRS="${appimage-run}/share"
+    [[ "$(xdg-mime query default application/vnd.appimage)" == '${appimage-run.name}.desktop' ]]
+
+    set +x
+    touch $out
+  ''

pkgs/tools/package-management/disnix/default.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  pkg-config,
+  glib,
+  libxml2,
+  libxslt,
+  getopt,
+  dysnomia,
+  libintl,
+  libiconv,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "disnix";
+  version = "0.10.2";
+
+  src = fetchurl {
+    url = "https://github.com/svanderburg/disnix/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
+    sha256 = "0mc0wy8fca60w0d56cljq2cw1xigbp2dklb43fxa5xph94j3i49a";
+  };
+
+  patches = [
+    # https://github.com/svanderburg/disnix/pull/21
+    # fix implicit function declaration
+    (fetchpatch {
+      name = "add-stdlib.h.patch";
+      url = "https://github.com/svanderburg/disnix/commit/aa969f1d152acb35fc70c6c8db249b61f5a9eb41.patch";
+      hash = "sha256-RZNVVdZ7Rx8n7qzbJOw8BHL8f07mvh8IKpfsWexuVLU=";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    glib
+    libxml2
+    libxslt
+    getopt
+    libintl
+    libiconv
+    dysnomia
+  ];
+
+  meta = {
+    description = "Nix-based distributed service deployment tool";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [
+      sander
+      tomberek
+    ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/tools/package-management/disnix/dysnomia/default.nix

@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  netcat,
+
+  # Optional packages
+  systemd ? null,
+  ejabberd ? null,
+  mariadb ? null,
+  libpq ? null,
+  subversion ? null,
+  mongodb ? null,
+  mongodb-tools ? null,
+  influxdb ? null,
+  supervisor ? null,
+  docker ? null,
+  nginx ? null,
+  s6-rc ? null,
+  xinetd ? null,
+
+  # Configuration flags
+  enableApacheWebApplication ? false,
+  enableAxis2WebService ? false,
+  enableEjabberdDump ? false,
+  enableMySQLDatabase ? false,
+  enablePostgreSQLDatabase ? false,
+  enableSubversionRepository ? false,
+  enableTomcatWebApplication ? false,
+  enableMongoDatabase ? false,
+  enableInfluxDatabase ? false,
+  enableSupervisordProgram ? false,
+  enableDockerContainer ? false,
+  enableNginxWebApplication ? false,
+  enableXinetdService ? false,
+  enableS6RCService ? false,
+  enableLegacy ? false,
+  catalinaBaseDir ? "/var/tomcat",
+  jobTemplate ? "systemd",
+  getopt,
+}:
+
+assert enableMySQLDatabase -> mariadb != null;
+assert enablePostgreSQLDatabase -> libpq != null;
+assert enableSubversionRepository -> subversion != null;
+assert enableEjabberdDump -> ejabberd != null;
+assert enableMongoDatabase -> (mongodb != null && mongodb-tools != null);
+assert enableInfluxDatabase -> influxdb != null;
+assert enableSupervisordProgram -> supervisor != null;
+assert enableDockerContainer -> docker != null;
+assert enableNginxWebApplication -> nginx != null;
+assert enableS6RCService -> s6-rc != null;
+assert enableXinetdService -> xinetd != null;
+
+stdenv.mkDerivation rec {
+  pname = "dysnomia";
+  version = "0.10.2";
+  src = fetchurl {
+    url = "https://github.com/svanderburg/dysnomia/releases/download/dysnomia-${version}/dysnomia-${version}.tar.gz";
+    sha256 = "08ijqbijs2h584dvsb3z858ha385fqd5jfxc51lks9lxxv0sfkr4";
+  };
+
+  configureFlags = [
+    (if enableApacheWebApplication then "--with-apache" else "--without-apache")
+    (if enableAxis2WebService then "--with-axis2" else "--without-axis2")
+    (if enableEjabberdDump then "--with-ejabberd" else "--without-ejabberd")
+    (if enableMySQLDatabase then "--with-mysql" else "--without-mysql")
+    (if enablePostgreSQLDatabase then "--with-postgresql" else "--without-postgresql")
+    (if enableSubversionRepository then "--with-subversion" else "--without-subversion")
+    (if enableTomcatWebApplication then "--with-tomcat=${catalinaBaseDir}" else "--without-tomcat")
+    (if enableMongoDatabase then "--with-mongodb" else "--without-mongodb")
+    (if enableInfluxDatabase then "--with-influxdb" else "--without-influxdb")
+    (if enableSupervisordProgram then "--with-supervisord" else "--without-supervisord")
+    (if enableDockerContainer then "--with-docker" else "--without-docker")
+    (if enableNginxWebApplication then "--with-nginx" else "--without-nginx")
+    (if enableXinetdService then "--with-xinetd" else "--without-xinetd")
+    (if enableS6RCService then "--with-s6-rc" else "--without-s6-rc")
+    (if stdenv.hostPlatform.isDarwin then "--with-launchd" else "--without-launchd")
+    "--with-job-template=${jobTemplate}"
+  ]
+  ++ lib.optional enableLegacy "--enable-legacy";
+
+  buildInputs = [
+    getopt
+    netcat
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux systemd
+  ++ lib.optional enableEjabberdDump ejabberd
+  ++ lib.optional enableMySQLDatabase mariadb.out
+  ++ lib.optional enablePostgreSQLDatabase libpq
+  ++ lib.optional enableSubversionRepository subversion
+  ++ lib.optionals enableMongoDatabase [
+    mongodb
+    mongodb-tools
+  ]
+  ++ lib.optional enableInfluxDatabase influxdb
+  ++ lib.optional enableSupervisordProgram supervisor
+  ++ lib.optional enableDockerContainer docker
+  ++ lib.optional enableNginxWebApplication nginx
+  ++ lib.optional enableS6RCService s6-rc
+  ++ lib.optional enableXinetdService xinetd;
+
+  meta = {
+    description = "Automated deployment of mutable components and services for Disnix";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.sander ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/tools/package-management/elm-github-install/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'elm_install'

pkgs/tools/package-management/elm-github-install/Gemfile.lock

@@ -0,0 +1,39 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    adts (0.1.2)
+    commander (4.4.3)
+      highline (~> 1.7.2)
+    contracts (0.16.0)
+    elm_install (1.0.1)
+      adts (~> 0.1.2)
+      commander (~> 4.4, >= 4.4.2)
+      contracts (~> 0.16.0)
+      git (~> 1.3)
+      git_clone_url (~> 2.0)
+      hashdiff (~> 0.3.1)
+      indentation (~> 0.1.1)
+      smart_colored (~> 1.1, >= 1.1.1)
+      solve (~> 3.1)
+    git (1.3.0)
+    git_clone_url (2.0.0)
+      uri-ssh_git (>= 2.0)
+    hashdiff (0.3.4)
+    highline (1.7.8)
+    indentation (0.1.1)
+    molinillo (0.5.7)
+    semverse (2.0.0)
+    smart_colored (1.1.1)
+    solve (3.1.0)
+      molinillo (>= 0.5)
+      semverse (>= 1.1, < 3.0)
+    uri-ssh_git (2.0.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  elm_install
+
+BUNDLED WITH
+   2.1.4

pkgs/tools/package-management/elm-github-install/gemset.nix

@@ -0,0 +1,114 @@
+{
+  adts = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1793bfsgg8ca58b70xas9rglnspig41ih0iwqcad62s0grxzrjwz";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  commander = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qx76y05v29kgyjsfkai73gwfnqhypp1k8v024m9w7qzpv4mpxf";
+      type = "gem";
+    };
+    version = "4.4.3";
+  };
+  contracts = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "119f5p1n6r5svbx8h09za6a4vrsnj5i1pzr9cqdn9hj3wrxvyl3a";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  elm_install = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0d3fwhj54madabmzamss865kj8czicgaq5fbdll9kpapqvy6a2j5";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  git = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1waikaggw7a1d24nw0sh8fd419gbf7awh000qhsf411valycj6q3";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  git_clone_url = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qgq7pjl461si3m2gr28vwbx47dcbpyy682mcwra5y1klpkbcvr5";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  hashdiff = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n6hj7k7b9hazac0j48ypbak2nqi5wy4nh5cjra6xl3a92r8db0a";
+      type = "gem";
+    };
+    version = "0.3.4";
+  };
+  highline = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nf5lgdn6ni2lpfdn4gk3gi47fmnca2bdirabbjbz1fk9w4p8lkr";
+      type = "gem";
+    };
+    version = "1.7.8";
+  };
+  indentation = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ix64qgmm91xm1yiqxdcn9bqb1l6gwvkv7322yni34b3bd16lgvc";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
+  molinillo = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19h1nks0x2ljwyijs2rd1f9sh05j8xqvjaqk1rslp5nyy6h4a758";
+      type = "gem";
+    };
+    version = "0.5.7";
+  };
+  semverse = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cf6iv5wgwb7b8jf7il751223k9yahz9aym06s9r0prda5mwddyy";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  smart_colored = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hccah5iwsvn9rf7zdgl7mdbh0h63vfwy1c6d280cb9qkfj8rdny";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  solve = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bbzny2bl94mv1xwcfrxbi3fjhxxawlz6la7mip2wwz9kkaf376h";
+      type = "gem";
+    };
+    version = "3.1.0";
+  };
+  uri-ssh_git = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0klyyvivbjll2ry18d8fhm1rbxbzd4kqa9lskxyiha4ndlb22cqj";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+}

pkgs/tools/package-management/fpm/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'fpm'

pkgs/tools/package-management/fpm/Gemfile.lock

@@ -0,0 +1,36 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    arr-pm (0.0.12)
+    backports (3.25.1)
+    cabin (0.9.0)
+    clamp (1.3.2)
+    dotenv (3.1.7)
+    fpm (1.16.0)
+      arr-pm (~> 0.0.11)
+      backports (>= 2.6.2)
+      cabin (>= 0.6.0)
+      clamp (>= 1.0.0)
+      pleaserun (~> 0.0.29)
+      rexml
+      stud
+    insist (1.0.0)
+    mustache (0.99.8)
+    pleaserun (0.0.32)
+      cabin (> 0)
+      clamp
+      dotenv
+      insist
+      mustache (= 0.99.8)
+      stud
+    rexml (3.4.1)
+    stud (0.0.23)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  fpm
+
+BUNDLED WITH
+   2.6.2

pkgs/tools/package-management/fpm/default.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
+
+bundlerApp {
+  pname = "fpm";
+  gemdir = ./.;
+  exes = [ "fpm" ];
+
+  passthru.updateScript = bundlerUpdateScript "fpm";
+
+  meta = with lib; {
+    description = "Tool to build packages for multiple platforms with ease";
+    homepage = "https://github.com/jordansissel/fpm";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      manveru
+      nicknovitski
+    ];
+    platforms = platforms.unix;
+    mainProgram = "fpm";
+  };
+}

pkgs/tools/package-management/fpm/gemset.nix

@@ -0,0 +1,129 @@
+{
+  arr-pm = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fddw0vwdrr7v3a0lfqbmnd664j48a9psrjd3wh3k4i3flplizzx";
+      type = "gem";
+    };
+    version = "0.0.12";
+  };
+  backports = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n2awv56zgizrzvjn2snv98dpnwx78pfs090y4ycdfadnjfvr7s3";
+      type = "gem";
+    };
+    version = "3.25.1";
+  };
+  cabin = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0b3b8j3iqnagjfn1261b9ncaac9g44zrx1kcg81yg4z9i513kici";
+      type = "gem";
+    };
+    version = "0.9.0";
+  };
+  clamp = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08m0syh06bhx8dqn560ivjg96l5cs5s3l9jh2szsnlcdcyl9jsjg";
+      type = "gem";
+    };
+    version = "1.3.2";
+  };
+  dotenv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wrw6fm0s38cd6h55w79bkvjhcj2zfkargjpws4kilkmhr3xyw66";
+      type = "gem";
+    };
+    version = "3.1.7";
+  };
+  fpm = {
+    dependencies = [
+      "arr-pm"
+      "backports"
+      "cabin"
+      "clamp"
+      "pleaserun"
+      "rexml"
+      "stud"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1pxmglms9cz11dn72zz31hq2s2ndjkhj3qzjiqxrvpzv7ihzxsnr";
+      type = "gem";
+    };
+    version = "1.16.0";
+  };
+  insist = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bw3bdwns14mapbgb8cbjmr0amvwz8y72gyclq04xp43wpp5jrvg";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  mustache = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1g5hplm0k06vwxwqzwn1mq5bd02yp0h3rym4zwzw26aqi7drcsl2";
+      type = "gem";
+    };
+    version = "0.99.8";
+  };
+  pleaserun = {
+    dependencies = [
+      "cabin"
+      "clamp"
+      "dotenv"
+      "insist"
+      "mustache"
+      "stud"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1aykf0l8327bqkkf5xd9jcglsib973zpy37cfnlf4j0vp0cdpn2d";
+      type = "gem";
+    };
+    version = "0.0.32";
+  };
+  rexml = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      type = "gem";
+    };
+    version = "3.4.1";
+  };
+  stud = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qpb57cbpm9rwgsygqxifca0zma87drnlacv49cqs2n5iyi6z8kb";
+      type = "gem";
+    };
+    version = "0.0.23";
+  };
+}

pkgs/tools/package-management/fusesoc/default.nix

@@ -0,0 +1,56 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  iverilog,
+  verilator,
+  gnumake,
+  edalize,
+  fastjsonschema,
+  pyparsing,
+  pyyaml,
+  simplesat,
+  ipyxact,
+  setuptools-scm,
+}:
+buildPythonPackage rec {
+  pname = "fusesoc";
+  version = "2.2.1";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-M36bXBgY8hR33AVDlHoH8PZJG2Bi0KOEI07IMns7R4w=";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  propagatedBuildInputs = [
+    edalize
+    fastjsonschema
+    pyparsing
+    pyyaml
+    simplesat
+    ipyxact
+  ];
+
+  pythonImportsCheck = [ "fusesoc" ];
+
+  makeWrapperArgs = [
+    "--suffix PATH : ${
+      lib.makeBinPath [
+        iverilog
+        verilator
+        gnumake
+      ]
+    }"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/olofk/fusesoc";
+    description = "Package manager and build tools for HDL code";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd3;
+    mainProgram = "fusesoc";
+  };
+}

pkgs/tools/package-management/licensee/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'licensee'

pkgs/tools/package-management/licensee/Gemfile.lock

@@ -0,0 +1,48 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    dotenv (3.1.7)
+    faraday (2.12.2)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
+    json (2.9.1)
+    licensee (9.18.0)
+      dotenv (>= 2, < 4)
+      octokit (>= 4.20, < 10.0)
+      reverse_markdown (>= 1, < 4)
+      rugged (>= 0.24, < 2.0)
+      thor (>= 0.19, < 2.0)
+    logger (1.6.5)
+    mini_portile2 (2.8.8)
+    net-http (0.6.0)
+      uri
+    nokogiri (1.18.2)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    octokit (9.2.0)
+      faraday (>= 1, < 3)
+      sawyer (~> 0.9)
+    public_suffix (6.0.1)
+    racc (1.8.1)
+    reverse_markdown (3.0.0)
+      nokogiri
+    rugged (1.9.0)
+    sawyer (0.9.2)
+      addressable (>= 2.3.5)
+      faraday (>= 0.17.3, < 3)
+    thor (1.3.2)
+    uri (1.0.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  licensee
+
+BUNDLED WITH
+   2.5.22

pkgs/tools/package-management/licensee/default.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
+
+bundlerApp {
+  pname = "licensee";
+  gemdir = ./.;
+  exes = [ "licensee" ];
+
+  passthru.updateScript = bundlerUpdateScript "licensee";
+
+  meta = with lib; {
+    description = "Ruby Gem to detect under what license a project is distributed";
+    homepage = "https://licensee.github.io/licensee/";
+    license = licenses.mit;
+    maintainers = [ maintainers.sternenseemann ];
+    platforms = platforms.unix;
+    mainProgram = "licensee";
+  };
+}

pkgs/tools/package-management/licensee/gemset.nix

@@ -0,0 +1,210 @@
+{
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      type = "gem";
+    };
+    version = "2.8.7";
+  };
+  dotenv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wrw6fm0s38cd6h55w79bkvjhcj2zfkargjpws4kilkmhr3xyw66";
+      type = "gem";
+    };
+    version = "3.1.7";
+  };
+  faraday = {
+    dependencies = [
+      "faraday-net_http"
+      "json"
+      "logger"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mls9g490k63rdmjc9shqshqzznfn1y21wawkxrwp2vvbk13jwqm";
+      type = "gem";
+    };
+    version = "2.12.2";
+  };
+  faraday-net_http = {
+    dependencies = [ "net-http" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
+      type = "gem";
+    };
+    version = "3.4.0";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "048danb0x10mpch6mf88mky35zjn6wk4hpbqq68ssbq58i3fzgfj";
+      type = "gem";
+    };
+    version = "2.9.1";
+  };
+  licensee = {
+    dependencies = [
+      "dotenv"
+      "octokit"
+      "reverse_markdown"
+      "rugged"
+      "thor"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xyzk7gzi91l6xlwfvf2z0963jwd2csf987yk0ffbr5p9ycdp0ry";
+      type = "gem";
+    };
+    version = "9.18.0";
+  };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sz584vw17pwrrc5zg6yd8lqcgfpjf4qplq3s7fr0r3505nybky3";
+      type = "gem";
+    };
+    version = "1.6.5";
+  };
+  mini_portile2 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
+      type = "gem";
+    };
+    version = "2.8.8";
+  };
+  net-http = {
+    dependencies = [ "uri" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  nokogiri = {
+    dependencies = [
+      "mini_portile2"
+      "racc"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gzqcs1kkykj8lrnbxc1iwr1wqmmaml8l6wyxdvy0vqq6gxiqyck";
+      type = "gem";
+    };
+    version = "1.18.2";
+  };
+  octokit = {
+    dependencies = [
+      "faraday"
+      "sawyer"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05j3gz79gxkid3lc2balyllqik4v4swnm0rcvxz14m76bkrpz92g";
+      type = "gem";
+    };
+    version = "9.2.0";
+  };
+  public_suffix = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      type = "gem";
+    };
+    version = "6.0.1";
+  };
+  racc = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  reverse_markdown = {
+    dependencies = [ "nokogiri" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "195c7yra7amggqj7rir0yr09r4v29c2hgkbkb21mj0jsfs3868mb";
+      type = "gem";
+    };
+    version = "3.0.0";
+  };
+  rugged = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b7gcf6pxg4x607bica68dbz22b4kch33yi0ils6x3c8ql9akakz";
+      type = "gem";
+    };
+    version = "1.9.0";
+  };
+  sawyer = {
+    dependencies = [
+      "addressable"
+      "faraday"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jks1qjbmqm8f9kvwa81vqj39avaj9wdnzc531xm29a55bb74fps";
+      type = "gem";
+    };
+    version = "0.9.2";
+  };
+  thor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nmymd86a0vb39pzj2cwv57avdrl6pl3lf5bsz58q594kqxjkw7f";
+      type = "gem";
+    };
+    version = "1.3.2";
+  };
+  uri = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09qyg6a29cfgd46qid8qvx4sjbv596v19ym73xvhanbyxd6500xk";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+}

pkgs/tools/package-management/lix/common-lix.nix

@@ -0,0 +1,411 @@
+{
+  lib,
+  suffix ? "",
+  version,
+  src,
+  # For Lix versions >= 2.92, Rust sources are in the Lix repository root.
+  cargoDeps ? null,
+  # For previous versions, Rust sources are only in a subdirectory for
+  # `lix-doc`.
+  docCargoDeps ? null,
+  patches ? [ ],
+  knownVulnerabilities ? [ ],
+}@args:
+
+assert lib.assertMsg (
+  lib.versionOlder version "2.92" -> docCargoDeps != null
+) "`lix-doc` `cargoDeps` must be set for Lix < 2.92";
+assert lib.assertMsg (
+  lib.versionAtLeast version "2.92" -> cargoDeps != null
+) "`cargoDeps` must be set for Lix ≥ 2.92";
+
+{
+  stdenv,
+  meson,
+  bison,
+  boehmgc,
+  boost,
+  brotli,
+  busybox-sandbox-shell,
+  bzip2,
+  callPackage,
+  capnproto,
+  cargo,
+  curl,
+  cmake,
+  doxygen,
+  editline,
+  flex,
+  git,
+  gtest,
+  jq,
+  lib,
+  libarchive,
+  libcpuid,
+  libsodium,
+  libsystemtap,
+  llvmPackages,
+  lowdown,
+  lowdown-unsandboxed,
+  lsof,
+  mercurial,
+  mdbook,
+  mdbook-linkcheck,
+  nlohmann_json,
+  ninja,
+  openssl,
+  pkgsStatic,
+  rustc,
+  toml11,
+  pegtl,
+  buildPackages,
+  pkg-config,
+  rapidcheck,
+  sqlite,
+  systemtap-sdt,
+  util-linuxMinimal,
+  removeReferencesTo,
+  xz,
+  yq,
+  nixosTests,
+  rustPlatform,
+  # Only used for versions before 2.92.
+  lix-doc ? callPackage ./doc {
+    inherit src;
+    version = "${version}${suffix}";
+    cargoDeps = docCargoDeps;
+  },
+
+  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  enableStrictLLVMChecks ? true,
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
+  aws-sdk-cpp,
+  # FIXME support Darwin once https://github.com/NixOS/nixpkgs/pull/392918 lands
+  withDtrace ?
+    lib.meta.availableOn stdenv.hostPlatform libsystemtap
+    && lib.meta.availableOn stdenv.buildPlatform systemtap-sdt,
+  # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
+  withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
+  libseccomp,
+  pastaFod ? lib.meta.availableOn stdenv.hostPlatform passt,
+  passt,
+
+  confDir,
+  stateDir,
+  storeDir,
+}:
+let
+  isLLVMOnly = lib.versionAtLeast version "2.92";
+  hasExternalLixDoc = lib.versionOlder version "2.92";
+  isLegacyParser = lib.versionOlder version "2.91";
+  hasDtraceSupport = lib.versionAtLeast version "2.93";
+  parseToYAML = lib.versionAtLeast version "2.93";
+  usesCapnp = lib.versionAtLeast version "2.94";
+in
+# gcc miscompiles coroutines at least until 13.2, possibly longer
+# do not remove this check unless you are sure you (or your users) will not report bugs to Lix upstream about GCC miscompilations.
+assert lib.assertMsg (enableStrictLLVMChecks && isLLVMOnly -> stdenv.cc.isClang)
+  "Lix upstream strongly discourage the usage of GCC to compile Lix as there's known miscompilations in important places. If you are a compiler developer, please get in touch with us.";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lix";
+
+  version = "${version}${suffix}";
+  VERSION_SUFFIX = suffix;
+
+  inherit src patches;
+
+  outputs = [
+    "out"
+    "dev"
+  ]
+  ++ lib.optionals enableDocumentation [
+    "man"
+    "doc"
+    "devdoc"
+  ];
+
+  strictDeps = true;
+  disallowedReferences = lib.optionals isLLVMOnly [
+    # We don't want the Clang.
+    stdenv.cc.cc
+    # We don't want the underlying GCC neither!
+    stdenv.cc.cc.stdenv.cc.cc
+  ];
+  __structuredAttrs = true;
+
+  # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata.
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    # python3.withPackages does not splice properly, see https://github.com/NixOS/nixpkgs/issues/305858
+    (buildPackages.python3.withPackages (
+      p:
+      [ p.python-frontmatter ]
+      ++ lib.optionals (lib.versionOlder version "2.94") [ p.toml ]
+      ++ lib.optionals finalAttrs.doInstallCheck [
+        p.aiohttp
+        p.pytest
+        p.pytest-xdist
+      ]
+      ++ lib.optionals usesCapnp [ p.pycapnp ]
+    ))
+    pkg-config
+    flex
+    jq
+    meson
+    ninja
+    cmake
+    # Required for libstd++ assertions that leaks inside of the final binary.
+    removeReferencesTo
+
+    # Tests
+    git
+    mercurial
+    jq
+    lsof
+  ]
+  ++ lib.optionals isLLVMOnly [
+    rustc
+    cargo
+    rustPlatform.cargoSetupHook
+  ]
+  ++ lib.optionals isLegacyParser [ bison ]
+  ++ lib.optionals enableDocumentation [
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    mdbook-linkcheck
+    doxygen
+  ]
+  ++ lib.optionals (hasDtraceSupport && withDtrace) [ systemtap-sdt ]
+  ++ lib.optionals pastaFod [ passt ]
+  ++ lib.optionals parseToYAML [ yq ]
+  ++ lib.optionals usesCapnp [ capnproto ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linuxMinimal ];
+
+  buildInputs = [
+    boost
+    brotli
+    bzip2
+    curl
+    capnproto
+    editline
+    libsodium
+    openssl
+    sqlite
+    xz
+    gtest
+    libarchive
+    lowdown
+    rapidcheck
+    toml11
+  ]
+  ++ lib.optionals hasExternalLixDoc [ lix-doc ]
+  ++ lib.optionals (!isLegacyParser) [ pegtl ]
+  ++ lib.optionals (lib.versionOlder version "2.94") [ libsodium ]
+  # NOTE(Raito): I'd have expected that the LLVM packaging would inject the
+  # libunwind library path directly in the wrappers, but it does inject
+  # -lunwind without injecting the library path...
+  ++ lib.optionals stdenv.hostPlatform.isStatic [ llvmPackages.libunwind ]
+  ++ lib.optionals (stdenv.hostPlatform.isx86_64) [ libcpuid ]
+  ++ lib.optionals withLibseccomp [ libseccomp ]
+  ++ lib.optionals withAWS [ aws-sdk-cpp ]
+  ++ lib.optionals (hasDtraceSupport && withDtrace) [ libsystemtap ];
+
+  inherit cargoDeps;
+
+  env = {
+    # Meson allows referencing a /usr/share/cargo/registry shaped thing for subproject sources.
+    # Turns out the Nix-generated Cargo dependencies are named the same as they
+    # would be in a Cargo registry cache.
+    MESON_PACKAGE_CACHE_DIR =
+      if finalAttrs.cargoDeps != null then
+        finalAttrs.cargoDeps
+      else
+        "lix: no `MESON_PACKAGE_CACHE_DIR`, set `cargoDeps`";
+  };
+
+  propagatedBuildInputs = [
+    boehmgc
+    nlohmann_json
+  ];
+
+  postPatch = ''
+    patchShebangs --build tests doc/manual
+  '';
+
+  preConfigure =
+    # Copy libboost_context so we don't get all of Boost in our closure.
+    # https://github.com/NixOS/nixpkgs/issues/45462
+    lib.optionalString (lib.versionOlder version "2.91" && !enableStatic) ''
+      mkdir -p $out/lib
+      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+      rm -f $out/lib/*.a
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        chmod u+w $out/lib/*.so.*
+        patchelf --set-rpath $out/lib:${lib.getLib stdenv.cc.cc}/lib $out/lib/libboost_thread.so.*
+      ''}
+      ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+        for LIB in $out/lib/*.dylib; do
+          chmod u+w $LIB
+          install_name_tool -id $LIB $LIB
+          install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
+        done
+        install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
+      ''}
+    '';
+
+  # -O3 seems to anger a gcc bug and provide no performance benefit.
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114360
+  # We use -O2 upstream https://gerrit.lix.systems/c/lix/+/554
+  mesonBuildType = "debugoptimized";
+
+  mesonFlags = [
+    # Enable LTO, since it improves eval performance a fair amount
+    # LTO is disabled on:
+    # - static builds (strange linkage errors)
+    # - darwin builds (install test failures. see fj#568 & fj#832)
+    (lib.mesonBool "b_lto" (
+      !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isDarwin && (isLLVMOnly || stdenv.cc.isGNU)
+    ))
+    (lib.mesonEnable "gc" true)
+    (lib.mesonBool "enable-tests" true)
+    (lib.mesonBool "enable-docs" enableDocumentation)
+    (lib.mesonEnable "internal-api-docs" enableDocumentation)
+    (lib.mesonBool "enable-embedded-sandbox-shell" (
+      stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic
+    ))
+    (lib.mesonEnable "seccomp-sandboxing" withLibseccomp)
+
+    (lib.mesonOption "store-dir" storeDir)
+    (lib.mesonOption "state-dir" stateDir)
+    (lib.mesonOption "sysconfdir" confDir)
+  ]
+  ++ lib.optionals hasDtraceSupport [
+    (lib.mesonEnable "dtrace-probes" withDtrace)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+  ]
+  ++
+    lib.optionals
+      (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.94")
+      [
+        (lib.mesonOption "build-test-shell" "${pkgsStatic.busybox}/bin")
+      ];
+
+  ninjaFlags = [ "-v" ];
+
+  postInstall =
+    lib.optionalString enableDocumentation ''
+      mkdir -p $doc/nix-support
+      echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
+
+      mkdir -p $devdoc/nix-support
+      echo "devdoc internal-api $devdoc/share/doc/nix/internal-api" >> $devdoc/nix-support/hydra-build-products
+    ''
+    + lib.optionalString (lib.versionOlder version "2.94" && !hasExternalLixDoc) ''
+      # We do not need static archives.
+      rm $out/lib/liblix_doc.a
+    ''
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      mkdir -p $out/nix-support
+      echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
+    ''
+    + lib.optionalString (lib.versionOlder version "2.91" && stdenv.hostPlatform.isDarwin) ''
+      for lib in liblixutil.dylib liblixexpr.dylib; do
+        install_name_tool \
+          -change "${lib.getLib boost}/lib/libboost_context.dylib" \
+          "$out/lib/libboost_context.dylib" \
+          "$out/lib/$lib"
+      done
+    ''
+    + ''
+      # Drop all references to libstd++ include files due to `__FILE__` leaking in libstd++ assertions.
+      find "$out" -type f -exec remove-references-to -t ${stdenv.cc.cc.stdenv.cc.cc} '{}' +
+    '';
+
+  # This needs to run after _multioutDocs moves the docs to $doc
+  postFixup = lib.optionalString enableDocumentation ''
+    mkdir -p $devdoc/share/doc/nix
+    mv $doc/share/doc/nix/internal-api $devdoc/share/doc/nix
+  '';
+
+  doCheck = true;
+  mesonCheckFlags = [
+    "--suite=check"
+    "--print-errorlogs"
+  ];
+  checkInputs = [
+    gtest
+    rapidcheck
+  ];
+
+  doInstallCheck = true;
+  mesonInstallCheckFlags = [
+    "--suite=installcheck"
+    "--print-errorlogs"
+  ];
+
+  preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # socket path becomes too long otherwise
+    export TMPDIR=$NIX_BUILD_TOP
+    # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
+    # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
+    export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+  '';
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    flagsArray=($mesonInstallCheckFlags "''${mesonInstallCheckFlagsArray[@]}")
+    meson test --no-rebuild "''${flagsArray[@]}"
+    runHook postInstallCheck
+  '';
+  hardeningDisable = [
+    "shadowstack"
+    # strictoverflow is disabled because we trap on signed overflow instead
+    "strictoverflow"
+  ]
+  # fortify breaks the build with lto and musl for some reason
+  ++ lib.optional stdenv.hostPlatform.isMusl "fortify";
+
+  # hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
+  separateDebugInfo = stdenv.hostPlatform.isLinux && !enableStatic;
+  enableParallelBuilding = true;
+
+  # Used by (1) test which has dynamic port assignment.
+  __darwinAllowLocalNetworking = true;
+
+  passthru = {
+    inherit aws-sdk-cpp boehmgc;
+    tests = {
+      misc = nixosTests.nix-misc.default.passthru.override { nixPackage = finalAttrs.finalPackage; };
+      installer = nixosTests.installer.simple.override { selectNixPackage = _: finalAttrs.finalPackage; };
+    };
+  };
+
+  # point 'nix edit' and ofborg at the file that defines the attribute,
+  # not this common file.
+  pos = builtins.unsafeGetAttrPos "version" args;
+  meta = {
+    description = "Powerful package manager that makes package management reliable and reproducible";
+    longDescription = ''
+      Lix (a fork of Nix) is a powerful package manager for Linux and other Unix systems that
+      makes package management reliable and reproducible. It provides atomic
+      upgrades and rollbacks, side-by-side installation of multiple versions of
+      a package, multi-user package management and easy setup of build
+      environments.
+    '';
+    homepage = "https://lix.systems";
+    license = lib.licenses.lgpl21Plus;
+    teams = [ lib.teams.lix ];
+    platforms = lib.platforms.unix;
+    outputsToInstall = [ "out" ] ++ lib.optional enableDocumentation "man";
+    mainProgram = "nix";
+    inherit knownVulnerabilities;
+  };
+})

pkgs/tools/package-management/lix/common-nix-eval-jobs.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  suffix ? "",
+  version,
+  src,
+  patches ? [ ],
+}@args:
+
+{
+  stdenv,
+  lib,
+  lix,
+  boost,
+  capnproto,
+  nlohmann_json,
+  meson,
+  pkg-config,
+  ninja,
+  cmake,
+  buildPackages,
+}:
+
+stdenv.mkDerivation {
+  pname = "nix-eval-jobs";
+  version = "${version}${suffix}";
+  inherit src patches;
+  sourceRoot = if lib.versionAtLeast version "2.93" then "source/subprojects/nix-eval-jobs" else null;
+  buildInputs = [
+    nlohmann_json
+    lix
+    boost
+  ]
+  ++ lib.optionals (lib.versionAtLeast version "2.93") [
+    capnproto
+  ];
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    # nlohmann_json can be only discovered via cmake files
+    cmake
+  ]
+  ++ (lib.optional stdenv.cc.isClang [ buildPackages.clang-tools ]);
+
+  # point 'nix edit' and ofborg at the file that defines the attribute,
+  # not this common file.
+  pos = builtins.unsafeGetAttrPos "version" args;
+
+  # Since this package is intimately tied to a specific Nix release, we
+  # propagate the Nix used for building it to make it easier for users
+  # downstream to reference it.
+  passthru = {
+    nix = lix;
+  };
+
+  meta = {
+    description = "Hydra's builtin `hydra-eval-jobs` as a standalone tool";
+    mainProgram = "nix-eval-jobs";
+    homepage =
+      # Starting with 2.93, `nix-eval-jobs` lives in the `lix` repository.
+      if lib.versionAtLeast version "2.93" then
+        "https://git.lix.systems/lix-project/lix/src/branch/main/subprojects/nix-eval-jobs"
+      else
+        "https://git.lix.systems/lix-project/nix-eval-jobs";
+    license = lib.licenses.gpl3;
+    teams = [ lib.teams.lix ];
+    platforms = lib.platforms.unix;
+    broken = lib.versionOlder version "2.94" && stdenv.hostPlatform.isStatic;
+  };
+}

pkgs/tools/package-management/lix/default.nix

@@ -0,0 +1,270 @@
+{
+  lib,
+  config,
+  stdenv,
+  makeScopeWithSplicing',
+  generateSplicesForMkScope,
+  aws-sdk-cpp,
+  boehmgc,
+  callPackage,
+  fetchgit,
+  fetchFromGitHub,
+  fetchFromGitea,
+  fetchpatch2,
+  fetchpatch,
+  rustPlatform,
+  editline,
+  ncurses,
+  clangStdenv,
+  nixpkgs-review,
+  nix-direnv,
+  nix-fast-build,
+  haskell,
+  nix-serve-ng,
+  colmena,
+  nix-update,
+
+  storeDir ? "/nix/store",
+  stateDir ? "/nix/var",
+  confDir ? "/etc",
+}:
+let
+  makeLixScope =
+    {
+      attrName,
+      lix-args,
+      # Starting with 2.93, `nix-eval-jobs` lives in the `lix` repository.
+      nix-eval-jobs-args ? { inherit (lix-args) version src; },
+    }:
+    let
+      # GCC 13.2 is known to miscompile Lix coroutines (introduced in 2.92).
+      lixStdenv = if lib.versionAtLeast lix-args.version "2.92" then clangStdenv else stdenv;
+    in
+    makeScopeWithSplicing' {
+      otherSplices = generateSplicesForMkScope [
+        "lixPackageSets"
+        attrName
+      ];
+      f =
+        self:
+        lib.recurseIntoAttrs {
+          inherit
+            storeDir
+            stateDir
+            confDir
+            ;
+
+          boehmgc =
+            # TODO: Why is this called `boehmgc-nix_2_3`?
+            let
+              boehmgc-nix_2_3 = boehmgc.override {
+                enableLargeConfig = true;
+                initialMarkStackSize = 1048576;
+              };
+            in
+            # Since Lix 2.91 does not use boost coroutines, it does not need boehmgc patches either.
+            if lib.versionOlder lix-args.version "2.91" then
+              boehmgc-nix_2_3.overrideAttrs (drv: {
+                patches = (drv.patches or [ ]) ++ [
+                  # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
+                  ../nix/patches/boehmgc-coroutine-sp-fallback.patch
+                ];
+              })
+            else
+              boehmgc-nix_2_3;
+
+          aws-sdk-cpp =
+            (aws-sdk-cpp.override {
+              apis = [
+                "s3"
+                "transfer"
+              ];
+              customMemoryManagement = false;
+            }).overrideAttrs
+              {
+                # only a stripped down version is build which takes a lot less resources to build
+                requiredSystemFeatures = [ ];
+              };
+
+          editline = editline.override {
+            inherit ncurses;
+            enableTermcap = true;
+          };
+
+          # NOTE: The `common-*.nix` helpers contain a top-level function which
+          # takes the Lix source to build and version information. We use the
+          # outer `callPackage` for that.
+          #
+          # That *returns* another function which takes the actual build
+          # dependencies, and that uses the new scope's `self.callPackage` so
+          # that `nix-eval-jobs` can be built against the correct `lix` version.
+          lix = self.callPackage (callPackage ./common-lix.nix lix-args) {
+            stdenv = lixStdenv;
+          };
+
+          nixpkgs-review = nixpkgs-review.override {
+            nix = self.lix;
+          };
+
+          nix-direnv = nix-direnv.override {
+            nix = self.lix;
+          };
+
+          nix-eval-jobs = self.callPackage (callPackage ./common-nix-eval-jobs.nix nix-eval-jobs-args) {
+            stdenv = lixStdenv;
+          };
+
+          nix-fast-build = nix-fast-build.override {
+            inherit (self) nix-eval-jobs;
+          };
+
+          nix-serve-ng = lib.pipe (nix-serve-ng.override { nix = self.lix; }) [
+            (haskell.lib.compose.enableCabalFlag "lix")
+            (haskell.lib.compose.overrideCabal (drv: {
+              # https://github.com/aristanetworks/nix-serve-ng/issues/46
+              # Resetting (previous) broken flag since it may be related to C++ Nix
+              broken = lib.versionAtLeast self.lix.version "2.93";
+            }))
+          ];
+
+          colmena = colmena.override {
+            nix = self.lix;
+            inherit (self) nix-eval-jobs;
+          };
+
+          nix-update = nix-update.override {
+            nix = self.lix;
+            inherit (self) nixpkgs-review;
+          };
+        };
+    };
+
+  removedMessage = version: ''
+    Lix ${version} is now removed from this revision of Nixpkgs. Consider upgrading to stable or the latest version.
+
+          If you notice a problem while upgrading disrupting your workflows which did not occur in version ${version}, please reach out to the Lix team.
+  '';
+in
+lib.makeExtensible (
+  self:
+  {
+    inherit makeLixScope;
+
+    lix_2_93 = self.makeLixScope {
+      attrName = "lix_2_93";
+
+      lix-args = rec {
+        version = "2.93.3";
+
+        src = fetchFromGitea {
+          domain = "git.lix.systems";
+          owner = "lix-project";
+          repo = "lix";
+          rev = version;
+          hash = "sha256-Oqw04eboDM8rrUgAXiT7w5F2uGrQdt8sGX+Mk6mVXZQ=";
+        };
+
+        cargoDeps = rustPlatform.fetchCargoVendor {
+          name = "lix-${version}";
+          inherit src;
+          hash = "sha256-YMyNOXdlx0I30SkcmdW/6DU0BYc3ZOa2FMJSKMkr7I8=";
+        };
+
+        patches = [
+          # Support for lowdown >= 1.4, https://gerrit.lix.systems/c/lix/+/3731
+          (fetchpatch2 {
+            name = "lix-lowdown-1.4.0.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/858de5f47a1bfd33835ec97794ece339a88490f1.patch";
+            hash = "sha256-FfLO2dFSWV1qwcupIg8dYEhCHir2XX6/Hs89eLwd+SY=";
+          })
+
+          # Support for toml11 >= 4.0, https://gerrit.lix.systems/c/lix/+/3953
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-1.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/96a39dc464165a3e503a6dc7bd44518a116fe846.patch";
+            hash = "sha256-j1DOScY2IFvcouhoap9CQwIZf99MZ92HtY7CjInF/s4=";
+          })
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-2.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/699d3a63a6351edfdbc8c05f814cc93d6c3637ca.patch";
+            hash = "sha256-2iUynAdimxhe5ZSDB7DlzFG3tu1yWhq+lTvjf6+M0pM=";
+          })
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-3.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/ad52cbde2faa677b711ec950dae74e4aede965a4.patch";
+            hash = "sha256-ajQwafL3yZDJMVrR+D9eTGh7L0xbDbqhAUagRur4HDE=";
+          })
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-4.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/e29a1ccf0af2e2890ec7b7fde82f0e53a1d0aad9.patch";
+            hash = "sha256-sXqZxCUtZsO7uEVk2AZx3IkP8b8EPVghYboetcQTp2A=";
+          })
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-5.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/176b834464b7285b74a72d35df7470a46362ce60.patch";
+            hash = "sha256-/KIszfHf2XoB+GeVvXad2AV8pazffYdQRDtIXb9tbj8=";
+          })
+          (fetchpatch {
+            name = "lix-2.93-toml11-4-6.patch";
+            url = "https://git.lix.systems/lix-project/lix/commit/b6d5670bcffebdd43352ea79b36135e35a8148d9.patch";
+            hash = "sha256-f4s0TR5MhNMNM5TYLOR7K2/1rtZ389KDjTCKFVK0OcE=";
+          })
+        ];
+      };
+    };
+
+    git = self.makeLixScope {
+      attrName = "git";
+
+      lix-args = rec {
+        version = "2.94.0-pre-20251001_${builtins.substring 0 12 src.rev}";
+
+        src = fetchFromGitea {
+          domain = "git.lix.systems";
+          owner = "lix-project";
+          repo = "lix";
+          rev = "f1ef994f120a723839a6d837cc2b33914a30a4db";
+          hash = "sha256-Rmq98EchbKygPo+2g0nDsZ7QNMLe+loiMbflV5VKDzc=";
+        };
+
+        cargoDeps = rustPlatform.fetchCargoVendor {
+          name = "lix-${version}";
+          inherit src;
+          hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
+        };
+      };
+    };
+
+    latest = self.lix_2_93;
+
+    stable = self.lix_2_93;
+
+    # Previously, `nix-eval-jobs` was not packaged here, so we export an
+    # attribute with the previously-expected structure for compatibility. This
+    # is also available (for now) as `pkgs.lixVersions`.
+    renamedDeprecatedLixVersions =
+      let
+        mkAlias =
+          version:
+          lib.warnOnInstantiate "'lixVersions.${version}' has been renamed to 'lixPackageSets.${version}.lix'"
+            self.${version}.lix;
+      in
+      lib.dontRecurseIntoAttrs {
+        # NOTE: Do not add new versions of Lix here.
+        stable = mkAlias "stable";
+        latest = mkAlias "latest";
+      }
+      // lib.optionalAttrs config.allowAliases {
+        # Legacy removed versions. We keep their aliases until the lixPackageSets one is dropped.
+        lix_2_90 = mkAlias "lix_2_90";
+        lix_2_91 = mkAlias "lix_2_91";
+      };
+  }
+  // lib.optionalAttrs config.allowAliases {
+    # Removed versions.
+    # When removing a version, add an alias with a date attached to it so we can clean it up after a while.
+    lix_2_90 = throw (removedMessage "2.90"); # added in 2025-09-11
+    lix_2_91 = throw (removedMessage "2.91"); # added in 2025-09-11
+    lix_2_92 = throw (removedMessage "2.92"); # added in 2025-09-11
+  }
+)

pkgs/tools/package-management/lix/doc/default.nix

@@ -0,0 +1,16 @@
+{
+  src,
+  rustPlatform,
+  version,
+  cargoDeps,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "lix-doc";
+  sourceRoot = "${src.name or src}/lix-doc";
+  inherit
+    version
+    src
+    cargoDeps
+    ;
+}

pkgs/tools/package-management/nix-eval-jobs/default.nix

@@ -0,0 +1,67 @@
+{
+  lib,
+  boost,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  curl,
+  nlohmann_json,
+  pkg-config,
+  stdenv,
+  nixComponents,
+}:
+stdenv.mkDerivation rec {
+  pname = "nix-eval-jobs";
+  version = "2.31.0";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nix-eval-jobs";
+    tag = "v${version}";
+    hash = "sha256-VrHPtHxVIboqgnw+tlCQepgtBOhBvU5hxbMHsPo8LAc=";
+  };
+
+  buildInputs = [
+    boost
+    curl
+    nlohmann_json
+    nixComponents.nix-store
+    nixComponents.nix-fetchers
+    nixComponents.nix-expr
+    nixComponents.nix-flake
+    nixComponents.nix-main
+    nixComponents.nix-cmd
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  # Since this package is intimately tied to a specific Nix release, we
+  # propagate the Nix used for building it to make it easier for users
+  # downstream to reference it.
+  passthru = {
+    inherit nixComponents;
+    # For nix-fast-build
+    nix = nixComponents.nix-cli;
+  };
+
+  meta = {
+    description = "Hydra's builtin hydra-eval-jobs as a standalone";
+    homepage = "https://github.com/nix-community/nix-eval-jobs";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [
+      adisbladis
+      mic92
+    ];
+    platforms = lib.platforms.unix;
+    mainProgram = "nix-eval-jobs";
+  };
+}

pkgs/tools/package-management/nix-prefetch-scripts/default.nix

@@ -0,0 +1,110 @@
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  buildEnv,
+  bash,
+  breezy,
+  cacert,
+  coreutils,
+  cvs,
+  darcs,
+  findutils,
+  gawk,
+  gitMinimal,
+  git-lfs,
+  gnused,
+  jq,
+  mercurial,
+  pijul,
+  subversion,
+}:
+
+let
+  mkPrefetchScript =
+    tool: src: deps:
+    stdenv.mkDerivation {
+      name = "nix-prefetch-${tool}";
+
+      strictDeps = true;
+      nativeBuildInputs = [ makeWrapper ];
+      buildInputs = [ bash ];
+
+      dontUnpack = true;
+
+      installPhase = ''
+        install -vD ${src} $out/bin/$name;
+        wrapProgram $out/bin/$name \
+          --prefix PATH : ${
+            lib.makeBinPath (
+              deps
+              ++ [
+                coreutils
+                gnused
+              ]
+            )
+          } \
+          --set HOME /homeless-shelter
+      '';
+
+      preferLocalBuild = true;
+
+      meta = with lib; {
+        description = "Script used to obtain source hashes for fetch${tool}";
+        maintainers = with maintainers; [ bennofs ];
+        platforms = platforms.unix;
+        mainProgram = "nix-prefetch-${tool}";
+      };
+    };
+in
+rec {
+  # No explicit dependency on Nix, as these can be used inside builders,
+  # and thus will cause dependency loops. When used _outside_ builders,
+  # we expect people to have a Nix implementation available ambiently.
+  nix-prefetch-bzr = mkPrefetchScript "bzr" ../../../build-support/fetchbzr/nix-prefetch-bzr [
+    breezy
+  ];
+  nix-prefetch-cvs = mkPrefetchScript "cvs" ../../../build-support/fetchcvs/nix-prefetch-cvs [ cvs ];
+  nix-prefetch-darcs = mkPrefetchScript "darcs" ../../../build-support/fetchdarcs/nix-prefetch-darcs [
+    darcs
+    cacert
+    jq
+  ];
+  nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [
+    findutils
+    gawk
+    gitMinimal
+    git-lfs
+  ];
+  nix-prefetch-hg = mkPrefetchScript "hg" ../../../build-support/fetchhg/nix-prefetch-hg [
+    mercurial
+  ];
+  nix-prefetch-svn = mkPrefetchScript "svn" ../../../build-support/fetchsvn/nix-prefetch-svn [
+    subversion
+  ];
+  nix-prefetch-pijul = mkPrefetchScript "pijul" ../../../build-support/fetchpijul/nix-prefetch-pijul [
+    pijul
+    cacert
+    jq
+  ];
+
+  nix-prefetch-scripts = buildEnv {
+    name = "nix-prefetch-scripts";
+
+    paths = [
+      nix-prefetch-bzr
+      nix-prefetch-cvs
+      nix-prefetch-darcs
+      nix-prefetch-git
+      nix-prefetch-hg
+      nix-prefetch-svn
+      nix-prefetch-pijul
+    ];
+
+    meta = with lib; {
+      description = "Collection of all the nix-prefetch-* scripts which may be used to obtain source hashes";
+      maintainers = with maintainers; [ bennofs ];
+      platforms = platforms.unix;
+    };
+  };
+}

pkgs/tools/package-management/nix-visualize/default.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix,
+  python,
+  matplotlib,
+  networkx,
+  pandas,
+  pygraphviz,
+  setuptools,
+}:
+
+python.pkgs.buildPythonApplication {
+  version = "1.0.5-unstable-2024-01-17";
+  pname = "nix-visualize";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "craigmbooth";
+    repo = "nix-visualize";
+    rev = "5b9beae330ac940df56433d347494505e2038904";
+    hash = "sha256-VgEsR/Odddc7v6oq2tNcVwCYm08PhiqhZJueuEYCR0o=";
+  };
+
+  postInstall = ''
+    wrapProgram $out/bin/nix-visualize \
+      --prefix PATH : ${lib.makeBinPath [ nix ]}
+  '';
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    matplotlib
+    networkx
+    pandas
+    pygraphviz
+  ];
+
+  pythonImportsCheck = [ "nix_visualize" ];
+  # No tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Generate dependency graphs of a given nix package";
+    mainProgram = "nix-visualize";
+    homepage = "https://github.com/craigmbooth/nix-visualize";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ henrirosten ];
+  };
+}

pkgs/tools/package-management/nix/README.md

@@ -0,0 +1,41 @@
+# Steps for Testing New Releases
+
+## Patch Releases or Updating `nixVersions.{latest,git}`
+
+Branch to merge into: **master** or **release-$nixos-version**
+
+Build the affected Nix packages and run their tests on the following platforms: **x86_64-linux**, **aarch64-linux**, **x86_64-darwin**, and **aarch64-darwin**.
+If you lack the necessary hardware for these platforms, you may need to ask others for assistance with the builds.
+Alternatively, you can request access to the Nix community builder for all platforms [here](https://github.com/NixOS/aarch64-build-box) and [here](https://nix-community.org/community-builder/).
+
+To build all dependent packages, use:
+
+```
+nixpkgs-review pr <your-pull-request>
+```
+
+And to build all important NixOS tests, run:
+
+```
+# Replace $version with the actual Nix version
+nix-build nixVersions.nix_$version.tests
+```
+
+Be sure to also update the `nix-fallback-paths` whenever you do a patch release for `nixVersions.stable`
+
+```
+# Replace $version with the actual Nix version
+curl https://releases.nixos.org/nix/nix-$version/fallback-paths.nix > nixos/modules/installer/tools/nix-fallback-paths.nix
+```
+
+## Major Version Bumps
+
+If you're updating `nixVersions.stable`, follow all the steps mentioned above, but use the **staging** branch for your pull request (or **staging-next** after coordinating with the people in matrix `#staging:nixos.org`)
+This is necessary because, at the end of the staging-next cycle, the NixOS tests are built through the [staging-next-small](https://hydra.nixos.org/jobset/nixos/staging-next-small) jobset.
+Especially NixOS installer tests are important to look at here.
+
+There is a script to update minor versions:
+
+```
+./pkgs/tools/package-management/nix/update-all.sh
+```

pkgs/tools/package-management/nix/common-meson.nix

@@ -0,0 +1,286 @@
+{
+  lib,
+  fetchFromGitHub,
+  version,
+  suffix ? "",
+  hash ? null,
+  src ? fetchFromGitHub {
+    owner = "NixOS";
+    repo = "nix";
+    rev = version;
+    inherit hash;
+  },
+  patches ? [ ],
+  maintainers ? [
+    lib.maintainers.artturin
+    lib.maintainers.philiptaron
+    lib.maintainers.lovesegfault
+  ],
+  teams ? [ lib.teams.nix ],
+  self_attribute_name,
+}@args:
+assert (hash == null) -> (src != null);
+{
+  stdenv,
+  bison,
+  boehmgc,
+  boost,
+  brotli,
+  busybox-sandbox-shell,
+  bzip2,
+  callPackage,
+  cmake,
+  curl,
+  doxygen,
+  editline,
+  flex,
+  git,
+  gtest,
+  jq,
+  lib,
+  libarchive,
+  libblake3,
+  libcpuid,
+  libgit2,
+  libsodium,
+  lowdown,
+  lowdown-unsandboxed,
+  toml11,
+  man,
+  meson,
+  ninja,
+  mdbook,
+  mdbook-linkcheck,
+  nlohmann_json,
+  nixosTests,
+  openssl,
+  perl,
+  python3,
+  pkg-config,
+  rapidcheck,
+  rsync,
+  sqlite,
+  util-linuxMinimal,
+  xz,
+  enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
+  aws-sdk-cpp,
+  withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
+  libseccomp,
+
+  confDir,
+  stateDir,
+  storeDir,
+
+  # passthru tests
+  pkgsi686Linux,
+  pkgsStatic,
+  runCommand,
+  pkgs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nix";
+
+  version = "${version}${suffix}";
+  VERSION_SUFFIX = suffix;
+
+  inherit src patches;
+
+  outputs = [
+    "out"
+    "dev"
+  ]
+  ++ lib.optionals enableDocumentation [
+    "man"
+    "doc"
+  ];
+
+  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
+
+  hardeningDisable = [
+    "shadowstack"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isMusl "fortify";
+
+  nativeCheckInputs = [
+    git
+    man
+  ];
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    jq
+    meson
+    ninja
+    pkg-config
+    rsync
+  ]
+  ++ lib.optionals enableDocumentation [
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    mdbook-linkcheck
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    util-linuxMinimal
+  ]
+  ++ lib.optionals enableDocumentation [
+    python3
+    doxygen
+  ];
+
+  buildInputs = [
+    boost
+    brotli
+    bzip2
+    curl
+    editline
+    libgit2
+    libsodium
+    lowdown
+    openssl
+    sqlite
+    toml11
+    xz
+  ]
+  ++ lib.optionals (lib.versionAtLeast version "2.26") [
+    libblake3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+    libcpuid
+  ]
+  ++ lib.optionals withLibseccomp [
+    libseccomp
+  ]
+  ++ lib.optionals withAWS [
+    aws-sdk-cpp
+  ];
+
+  propagatedBuildInputs = [
+    boehmgc
+    nlohmann_json
+    libarchive
+  ];
+
+  checkInputs = [
+    gtest
+    rapidcheck
+  ];
+
+  postPatch = ''
+    patchShebangs --build tests
+  '';
+
+  preConfigure =
+    # Copy libboost_context so we don't get all of Boost in our closure.
+    # https://github.com/NixOS/nixpkgs/issues/45462
+    lib.optionalString (!enableStatic) ''
+      mkdir -p $out/lib
+      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+      rm -f $out/lib/*.a
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        chmod u+w $out/lib/*.so.*
+        patchelf --set-rpath $out/lib:${lib.getLib stdenv.cc.cc}/lib $out/lib/libboost_thread.so.*
+      ''}
+    '';
+
+  dontUseCmakeConfigure = true;
+
+  mesonFlags = [
+    (lib.mesonBool "unit-tests" (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
+    (lib.mesonBool "bindings" false)
+    (lib.mesonOption "libstore:store-dir" storeDir)
+    (lib.mesonOption "libstore:localstatedir" stateDir)
+    (lib.mesonOption "libstore:sysconfdir" confDir)
+    (lib.mesonEnable "libutil:cpuid" stdenv.hostPlatform.isx86_64)
+    (lib.mesonEnable "libstore:seccomp-sandboxing" withLibseccomp)
+    (lib.mesonBool "libstore:embedded-sandbox-shell" (
+      stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic
+    ))
+    (lib.mesonBool "doc-gen" enableDocumentation)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.mesonOption "libstore:sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+    # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
+  ]
+  ++ lib.optionals (stdenv.cc.isGNU && !enableStatic) [
+    # TODO: do we still need this?
+    # "--enable-lto"
+  ];
+
+  doCheck = true;
+
+  # socket path becomes too long otherwise
+  preInstallCheck =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export TMPDIR=$NIX_BUILD_TOP
+    ''
+    # See https://github.com/NixOS/nix/issues/5687
+    + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
+      echo "exit 0" > tests/functional/flakes/show.sh
+    ''
+    + ''
+      # nixStatic otherwise does not find its man pages in tests.
+      export MANPATH=$man/share/man:$MANPATH
+    '';
+
+  separateDebugInfo = stdenv.hostPlatform.isLinux && !enableStatic;
+
+  passthru = {
+    inherit aws-sdk-cpp boehmgc;
+
+    # TODO:
+    perl-bindings = perl.pkgs.toPerlModule (
+      callPackage ./nix-perl.nix {
+        nix = finalAttrs.finalPackage;
+      }
+    );
+
+    tests = import ./tests.nix {
+      inherit
+        runCommand
+        version
+        src
+        lib
+        stdenv
+        pkgs
+        pkgsi686Linux
+        pkgsStatic
+        nixosTests
+        self_attribute_name
+        ;
+      nix = finalAttrs.finalPackage;
+    };
+  };
+
+  # point 'nix edit' and ofborg at the file that defines the attribute,
+  # not this common file.
+  pos = builtins.unsafeGetAttrPos "version" args;
+  meta = with lib; {
+    description = "Powerful package manager that makes package management reliable and reproducible";
+    longDescription = ''
+      Nix is a powerful package manager for Linux and other Unix systems that
+      makes package management reliable and reproducible. It provides atomic
+      upgrades and rollbacks, side-by-side installation of multiple versions of
+      a package, multi-user package management and easy setup of build
+      environments.
+    '';
+    homepage = "https://nixos.org/";
+    license = licenses.lgpl21Plus;
+    inherit maintainers teams;
+    platforms = platforms.unix;
+    # Gets stuck in functional-tests in cross-trunk jobset and doesn't timeout
+    # https://hydra.nixos.org/build/298175022
+    # probably https://github.com/NixOS/nix/issues/13042
+    broken = stdenv.hostPlatform.system == "i686-linux" && stdenv.buildPlatform != stdenv.hostPlatform;
+    outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
+    mainProgram = "nix";
+  };
+})

pkgs/tools/package-management/nix/default.nix

@@ -0,0 +1,237 @@
+{
+  lib,
+  config,
+  stdenv,
+  nixDependencies,
+  generateSplicesForMkScope,
+  fetchFromGitHub,
+  runCommand,
+  pkgs,
+  pkgsi686Linux,
+  pkgsStatic,
+  nixosTests,
+
+  storeDir ? "/nix/store",
+  stateDir ? "/nix/var",
+  confDir ? "/etc",
+}:
+let
+  # Called for Nix == 2.28. Transitional until we always use
+  # per-component packages.
+  commonMeson =
+    args:
+    nixDependencies.callPackage (import ./common-meson.nix ({ inherit lib fetchFromGitHub; } // args)) {
+      inherit
+        storeDir
+        stateDir
+        confDir
+        ;
+    };
+
+  # Intentionally does not support overrideAttrs etc
+  # Use only for tests that are about the package relation to `pkgs` and/or NixOS.
+  addTestsShallowly =
+    tests: pkg:
+    pkg
+    // {
+      tests = pkg.tests // tests;
+      # In case someone reads the wrong attribute
+      passthru.tests = pkg.tests // tests;
+    };
+
+  addFallbackPathsCheck =
+    pkg:
+    addTestsShallowly {
+      nix-fallback-paths =
+        runCommand "test-nix-fallback-paths-version-equals-nix-stable"
+          {
+            paths = lib.concatStringsSep "\n" (
+              builtins.attrValues (import ../../../../nixos/modules/installer/tools/nix-fallback-paths.nix)
+            );
+          }
+          ''
+            # NOTE: name may contain cross compilation details between the pname
+            #       and version this is permitted thanks to ([^-]*-)*
+            if [[ "" != $(grep -vE 'nix-([^-]*-)*${
+              lib.strings.replaceStrings [ "." ] [ "\\." ] pkg.version
+            }$' <<< "$paths") ]]; then
+              echo "nix-fallback-paths not up to date with nixVersions.stable (nix-${pkg.version})"
+              echo "The following paths are not up to date:"
+              grep -v 'nix-${pkg.version}$' <<< "$paths"
+              echo
+              echo "Fix it by running in nixpkgs:"
+              echo
+              echo "curl https://releases.nixos.org/nix/nix-${pkg.version}/fallback-paths.nix >nixos/modules/installer/tools/nix-fallback-paths.nix"
+              echo
+              exit 1
+            else
+              echo "nix-fallback-paths versions up to date"
+              touch $out
+            fi
+          '';
+    } pkg;
+
+  # (meson based packaging)
+  # Add passthru tests to the package, and re-expose package set overriding
+  # functions. This will not incorporate the tests into the package set.
+  # TODO (roberth): add package-set level overriding to the "everything" package.
+  addTests =
+    selfAttributeName: pkg:
+    let
+      tests =
+        pkg.tests or { }
+        // import ./tests.nix {
+          inherit
+            runCommand
+            lib
+            stdenv
+            pkgs
+            pkgsi686Linux
+            pkgsStatic
+            nixosTests
+            ;
+          inherit (pkg) version src;
+          nix = pkg;
+          self_attribute_name = selfAttributeName;
+        };
+    in
+    # preserve old pkg, including overrideSource, etc
+    pkg
+    // {
+      tests = pkg.tests or { } // tests;
+      passthru = pkg.passthru or { } // {
+        tests =
+          lib.warn "nix.passthru.tests is deprecated. Use nix.tests instead." pkg.passthru.tests or { }
+          // tests;
+      };
+    };
+
+  # Factored out for when we have package sets for multiple versions of
+  # Nix.
+  #
+  # `nixPackages_*` would be the most regular name, analogous to
+  # `linuxPackages_*`, especially if we put other 3rd-party software in
+  # here, but `nixPackages_*` would also be *very* confusing to humans!
+  generateSplicesForNixComponents =
+    nixComponentsAttributeName:
+    generateSplicesForMkScope [
+      "nixVersions"
+      nixComponentsAttributeName
+    ];
+
+  maintainers = [
+    lib.maintainers.artturin
+    lib.maintainers.philiptaron
+    lib.maintainers.lovesegfault
+  ];
+  teams = [ lib.teams.nix ];
+
+in
+lib.makeExtensible (
+  self:
+  (
+    {
+      nix_2_28 = commonMeson {
+        version = "2.28.5";
+        hash = "sha256-oIfAHxO+BCtHXJXLHBnsKkGl1Pw+Uuq1PwNxl+lZ+Oc=";
+        self_attribute_name = "nix_2_28";
+      };
+
+      nixComponents_2_29 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.29.2";
+        inherit maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_29";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-50p2sG2RFuRnlS1/Vr5et0Rt+QDgfpNE2C2WWRztnbQ=";
+        };
+      };
+
+      nix_2_29 = addTests "nix_2_29" self.nixComponents_2_29.nix-everything;
+
+      nixComponents_2_30 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.30.3";
+        inherit maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_30";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-kBuwzMgIE9Tmve0Rpp+q+YCsE2mw9d62M/950ViWeJ0=";
+        };
+      };
+
+      nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
+
+      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.31.2";
+        inherit (self.nix_2_30.meta) maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-NLGXPLjENLeKVOg3OZgHXZ+1x6sPIKq9FHH8pxbCrDI=";
+        };
+      };
+
+      nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
+
+      nixComponents_2_32 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.32.0";
+        inherit (self.nix_2_31.meta) maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_32";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-OOd7dFe0tX0CVPygR7U6cqs5fiJAvFO1el1QmjDG1GM=";
+        };
+      };
+
+      nix_2_32 = addTests "nix_2_32" self.nixComponents_2_32.nix-everything;
+
+      nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.32pre20250919_${lib.substring 0 8 src.rev}";
+        inherit maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_git";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          rev = "07b96c1d14ab8695e5071fb73e19049fce8f3b6b";
+          hash = "sha256-9tR08zFwQ9JNohdfeb40wcLfRnicXpKrHF+FHFva/WA=";
+        };
+      };
+
+      git = addTests "git" self.nixComponents_git.nix-everything;
+
+      latest = self.nix_2_32;
+
+      # Read ./README.md before bumping a major release
+      stable = addFallbackPathsCheck self.nix_2_31;
+    }
+    // lib.optionalAttrs config.allowAliases (
+      lib.listToAttrs (
+        map (
+          minor:
+          let
+            attr = "nix_2_${toString minor}";
+          in
+          lib.nameValuePair attr (throw "${attr} has been removed")
+        ) (lib.range 4 23)
+      )
+      // {
+        nixComponents_2_27 = throw "nixComponents_2_27 has been removed. use nixComponents_git.";
+        nix_2_24 = throw "nix_2_24 has been removed. use nix_2_28.";
+        nix_2_26 = throw "nix_2_26 has been removed. use nix_2_28.";
+        nix_2_27 = throw "nix_2_27 has been removed. use nix_2_28.";
+        nix_2_25 = throw "nix_2_25 has been removed. use nix_2_28.";
+
+        minimum = throw "nixVersions.minimum has been removed. Use a specific version instead.";
+        unstable = throw "nixVersions.unstable has been removed. use nixVersions.latest or the nix flake.";
+      }
+    )
+  )
+)

pkgs/tools/package-management/nix/dependencies-scope.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  generateSplicesForMkScope,
+  newScope,
+  splicePackages,
+  callPackage,
+}:
+
+let
+  otherSplices = generateSplicesForMkScope [ "nixDependencies" ];
+in
+lib.makeScopeWithSplicing'
+  {
+    inherit splicePackages;
+    inherit newScope; # layered directly on pkgs, unlike nixComponents above
+  }
+  {
+    # Technically this should point to the nixDependencies set only, but
+    # this is ok as long as the scopes don't intersect.
+    inherit otherSplices;
+    f = (callPackage ./dependencies.nix { }).scopeFunction;
+  }

pkgs/tools/package-management/nix/dependencies.nix

@@ -0,0 +1,38 @@
+regular@{
+  lib,
+  boehmgc,
+  aws-sdk-cpp,
+  fetchFromGitHub,
+  pkgs,
+}:
+
+{
+  scopeFunction = scope: {
+    boehmgc = regular.boehmgc.override {
+      enableLargeConfig = true;
+
+      # Increase the initial mark stack size to avoid stack overflows, since these inhibit parallel
+      # marking (see `GC_mark_some()` in `mark.c`).
+      #
+      # Run Nix with `GC_PRINT_STATS=1` set to see if the mark stack is too small.
+      # Look for messages such as `Mark stack overflow`, `No room to copy back mark stack`, and
+      # `Grew mark stack to ... frames`.
+      initialMarkStackSize = 1048576;
+    };
+
+    aws-sdk-cpp = regular.aws-sdk-cpp.override {
+      # Nix only needs these AWS APIs.
+      apis = [
+        "identity-management"
+        "s3"
+        "transfer"
+      ];
+
+      # Don't use AWS' custom memory management.
+      customMemoryManagement = false;
+
+      # only a stripped down version is built which takes a lot less resources to build
+      requiredSystemFeatures = [ ];
+    };
+  };
+}

pkgs/tools/package-management/nix/modular/README.md

@@ -0,0 +1,17 @@
+# `nix/modular`
+
+This directory follows a directory structure similar to that in the upstream repo,
+to make comparisons easier.
+
+The files are maintained separately from the upstream repo, so differences are expected.
+
+## Comparison
+
+### No filesets
+
+Using filesets with a fetched source would require "IFD", as the fetching happens in a derivation, but the filtering must come afterwards, and be done by the evaluator.
+
+### `workDir` attribute
+
+The Nixpkgs for Nix inherits the `workDir` attribute that determines the location of the subproject to build.
+It is compared to this directory to produce the correct relative path, similar to upstream.

pkgs/tools/package-management/nix/modular/doc/manual/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  mkMesonDerivation,
+
+  meson,
+  ninja,
+  lowdown-unsandboxed,
+  mdbook,
+  mdbook-linkcheck,
+  jq,
+  python3,
+  rsync,
+  nix-cli,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-manual";
+  inherit version;
+
+  workDir = ./.;
+
+  # TODO the man pages should probably be separate
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  # Hack for sake of the dev shell
+  passthru.externalNativeBuildInputs = [
+    meson
+    ninja
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    mdbook-linkcheck
+    jq
+    python3
+    rsync
+  ];
+
+  nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
+    nix-cli
+  ];
+
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
+
+  postInstall = ''
+    mkdir -p ''$out/nix-support
+    echo "doc manual ''$out/share/doc/nix/manual" >> ''$out/nix-support/hydra-build-products
+  '';
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+})

pkgs/tools/package-management/nix/modular/packages.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  splicePackages,
+  nixDependencies,
+  pkgs,
+  maintainers,
+  teams,
+  otherSplices,
+  version,
+  src,
+}:
+let
+  officialRelease = true;
+
+  # A new scope, so that we can use `callPackage` to inject our own interdependencies
+  # without "polluting" the top level "`pkgs`" attrset.
+  # This also has the benefit of providing us with a distinct set of packages
+  # we can iterate over.
+  nixComponents =
+    lib.makeScopeWithSplicing'
+      {
+        inherit splicePackages;
+        inherit (nixDependencies) newScope;
+      }
+      {
+        inherit otherSplices;
+        f = import ./packaging/components.nix {
+          inherit
+            lib
+            maintainers
+            teams
+            officialRelease
+            pkgs
+            src
+            version
+            ;
+        };
+      };
+
+in
+nixComponents.overrideSource src

pkgs/tools/package-management/nix/modular/packaging/components.nix

@@ -0,0 +1,437 @@
+{
+  lib,
+  pkgs,
+  src,
+  officialRelease,
+  maintainers,
+  teams,
+  version,
+}:
+
+scope:
+
+let
+  inherit (scope)
+    callPackage
+    ;
+  inherit
+    (scope.callPackage (
+      { stdenv }:
+      {
+        inherit stdenv;
+      }
+    ) { })
+    stdenv
+    ;
+  inherit (pkgs.buildPackages)
+    meson
+    ninja
+    pkg-config
+    ;
+
+  root = ../.;
+
+  # Indirection for Nixpkgs to override when package.nix files are vendored
+  filesetToSource = lib.fileset.toSource;
+
+  /**
+    Given a set of layers, create a mkDerivation-like function
+  */
+  mkPackageBuilder =
+    exts: userFn: stdenv.mkDerivation (lib.extends (lib.composeManyExtensions exts) userFn);
+
+  setVersionLayer = finalAttrs: prevAttrs: {
+    preConfigure =
+      prevAttrs.preConfigure or ""
+      +
+      # Update the repo-global .version file.
+      # Symlink ./.version points there, but by default only workDir is writable.
+      ''
+        chmod u+w ./.version
+        echo ${finalAttrs.version} > ./.version
+      '';
+  };
+
+  localSourceLayer =
+    finalAttrs: prevAttrs:
+    let
+      workDirPath =
+        # Ideally we'd pick finalAttrs.workDir, but for now `mkDerivation` has
+        # the requirement that everything except passthru and meta must be
+        # serialized by mkDerivation, which doesn't work for this.
+        prevAttrs.workDir;
+
+      workDirSubpath = lib.path.removePrefix root workDirPath;
+      sources =
+        assert prevAttrs.fileset._type == "fileset";
+        prevAttrs.fileset;
+      src = lib.fileset.toSource {
+        fileset = sources;
+        inherit root;
+      };
+
+    in
+    {
+      sourceRoot = "${src.name}/" + workDirSubpath;
+      inherit src;
+
+      # Clear what `derivation` can't/shouldn't serialize; see prevAttrs.workDir.
+      fileset = null;
+      workDir = null;
+    };
+
+  resolveRelPath = p: lib.path.removePrefix root p;
+
+  makeFetchedSourceLayer =
+    finalScope: finalAttrs: prevAttrs:
+    let
+      workDirPath =
+        # Ideally we'd pick finalAttrs.workDir, but for now `mkDerivation` has
+        # the requirement that everything except passthru and meta must be
+        # serialized by mkDerivation, which doesn't work for this.
+        prevAttrs.workDir;
+
+      workDirSubpath = resolveRelPath workDirPath;
+
+    in
+    {
+      sourceRoot = "${finalScope.patchedSrc.name}/" + workDirSubpath;
+      src = finalScope.patchedSrc;
+      version =
+        let
+          n = lib.length finalScope.patches;
+        in
+        if n == 0 then prevAttrs.version else prevAttrs.version + "+${toString n}";
+
+      # Clear what `derivation` can't/shouldn't serialize; see prevAttrs.workDir.
+      fileset = null;
+      workDir = null;
+    };
+
+  mesonLayer = finalAttrs: prevAttrs: {
+    # NOTE:
+    # As of https://github.com/NixOS/nixpkgs/blob/8baf8241cea0c7b30e0b8ae73474cb3de83c1a30/pkgs/by-name/me/meson/setup-hook.sh#L26,
+    # `mesonBuildType` defaults to `plain` if not specified. We want our Nix-built binaries to be optimized by default.
+    # More on build types here: https://mesonbuild.com/Builtin-options.html#details-for-buildtype.
+    mesonBuildType = "release";
+    # NOTE:
+    # Users who are debugging Nix builds are expected to set the environment variable `mesonBuildType`, per the
+    # guidance in https://github.com/NixOS/nix/blob/8a3fc27f1b63a08ac983ee46435a56cf49ebaf4a/doc/manual/source/development/debugging.md?plain=1#L10.
+    # For this reason, we don't want to refer to `finalAttrs.mesonBuildType` here, but rather use the environment variable.
+    preConfigure =
+      prevAttrs.preConfigure or ""
+      +
+        lib.optionalString
+          (
+            !stdenv.hostPlatform.isWindows
+            # build failure
+            && !stdenv.hostPlatform.isStatic
+            # LTO breaks exception handling on x86-64-darwin.
+            && stdenv.system != "x86_64-darwin"
+          )
+          ''
+            case "$mesonBuildType" in
+            release|minsize) appendToVar mesonFlags "-Db_lto=true"  ;;
+            *)               appendToVar mesonFlags "-Db_lto=false" ;;
+            esac
+          '';
+    nativeBuildInputs = [
+      meson
+      ninja
+    ]
+    ++ prevAttrs.nativeBuildInputs or [ ];
+    mesonCheckFlags = prevAttrs.mesonCheckFlags or [ ] ++ [
+      "--print-errorlogs"
+    ];
+  };
+
+  mesonBuildLayer = finalAttrs: prevAttrs: {
+    nativeBuildInputs = prevAttrs.nativeBuildInputs or [ ] ++ [
+      pkg-config
+    ];
+    separateDebugInfo = !stdenv.hostPlatform.isStatic;
+    hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+  };
+
+  mesonLibraryLayer = finalAttrs: prevAttrs: {
+    # See https://github.com/NixOS/nix/pull/14105 -- enabling this only for Nix 2.32+ as there are
+    # reports of undefined behavior on previous versions. Note that this does //not// use
+    # `finalAttrs.version` in order to avoid infinite recursion.
+    ${if lib.versionOlder version "2.32" then null else "preConfigure"} =
+      let
+        interpositionFlags = [
+          "-fno-semantic-interposition"
+          "-Wl,-Bsymbolic-functions"
+        ];
+      in
+      # NOTE: By default GCC disables interprocedular optimizations (in particular inlining) for
+      # position-independent code and thus shared libraries.
+      # Since LD_PRELOAD tricks aren't worth losing out on optimizations, we disable it for good.
+      # This is not the case for Clang, where inlining is done by default even without -fno-semantic-interposition.
+      # https://reviews.llvm.org/D102453
+      # https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSpeedup
+      prevAttrs.preConfigure or ""
+      + lib.optionalString stdenv.cc.isGNU ''
+        export CFLAGS="''${CFLAGS:-} ${toString interpositionFlags}"
+        export CXXFLAGS="''${CXXFLAGS:-} ${toString interpositionFlags}"
+      '';
+    outputs = prevAttrs.outputs or [ "out" ] ++ [ "dev" ];
+  };
+
+  # Work around weird `--as-needed` linker behavior with BSD, see
+  # https://github.com/mesonbuild/meson/issues/3593
+  bsdNoLinkAsNeeded =
+    finalAttrs: prevAttrs:
+    lib.optionalAttrs stdenv.hostPlatform.isBSD {
+      mesonFlags = [ (lib.mesonBool "b_asneeded" false) ] ++ prevAttrs.mesonFlags or [ ];
+    };
+
+  nixDefaultsLayer = finalAttrs: prevAttrs: {
+    strictDeps = prevAttrs.strictDeps or true;
+    enableParallelBuilding = true;
+    pos = builtins.unsafeGetAttrPos "pname" prevAttrs;
+    meta = prevAttrs.meta or { } // {
+      homepage = prevAttrs.meta.homepage or "https://nixos.org/nix";
+      longDescription =
+        prevAttrs.longDescription or ''
+          Nix is a powerful package manager for mainly Linux and other Unix systems that
+          makes package management reliable and reproducible. It provides atomic
+          upgrades and rollbacks, side-by-side installation of multiple versions of
+          a package, multi-user package management and easy setup of build
+          environments.
+        '';
+      license = prevAttrs.meta.license or lib.licenses.lgpl21Plus;
+      maintainers = prevAttrs.meta.maintainers or [ ] ++ scope.maintainers;
+      teams = prevAttrs.meta.teams or [ ] ++ scope.teams;
+      platforms = prevAttrs.meta.platforms or (lib.platforms.unix ++ lib.platforms.windows);
+    };
+  };
+
+  /**
+    Append patches to the source layer.
+  */
+  appendPatches =
+    scope: patches:
+    scope.overrideScope (
+      finalScope: prevScope: {
+        patches = prevScope.patches ++ patches;
+      }
+    );
+
+  whenAtLeast = v: thing: if lib.versionAtLeast version v then thing else null;
+
+in
+
+# This becomes the pkgs.nixComponents attribute set
+{
+  inherit version;
+  inherit maintainers;
+  inherit teams;
+
+  inherit filesetToSource;
+
+  /**
+    A user-provided extension function to apply to each component derivation.
+  */
+  mesonComponentOverrides = finalAttrs: prevAttrs: { };
+
+  /**
+    An overridable derivation layer for handling the sources.
+  */
+  sourceLayer = localSourceLayer;
+
+  /**
+    Resolve a path value to either itself or a path in the `src`, depending
+    whether `overrideSource` was called.
+  */
+  resolvePath = p: p;
+
+  /**
+    Apply an extension function (i.e. overlay-shaped) to all component derivations.
+
+    Single argument: the extension function to apply (finalAttrs: prevAttrs: { ... })
+  */
+  overrideAllMesonComponents =
+    f:
+    scope.overrideScope (
+      finalScope: prevScope: {
+        mesonComponentOverrides = lib.composeExtensions scope.mesonComponentOverrides f;
+      }
+    );
+
+  /**
+    Provide an alternate source. This allows the expressions to be vendored without copying the sources,
+    but it does make the build non-granular; all components will use a complete source.
+
+    Filesets in the packaging expressions will be ignored.
+
+    Single argument: the source to use.
+
+    See also `appendPatches`
+  */
+  overrideSource =
+    src:
+    scope.overrideScope (
+      finalScope: prevScope: {
+        sourceLayer = makeFetchedSourceLayer finalScope;
+        /**
+          Unpatched source for the build of Nix. Packaging expressions will be ignored.
+        */
+        src = src;
+        /**
+          Patches for the whole Nix source. Changes to packaging expressions will be ignored.
+        */
+        patches = [ ];
+        /**
+          Fetched and patched source to be used in component derivations.
+        */
+        patchedSrc =
+          if finalScope.patches == [ ] then
+            src
+          else
+            pkgs.buildPackages.srcOnly (
+              pkgs.buildPackages.stdenvNoCC.mkDerivation {
+                name = "${finalScope.src.name or "nix-source"}-patched";
+                inherit (finalScope) src patches;
+              }
+            );
+
+        resolvePath = p: finalScope.patchedSrc + "/${resolveRelPath p}";
+        filesetToSource = { root, fileset }: finalScope.resolvePath root;
+
+        appendPatches = appendPatches finalScope;
+      }
+    );
+
+  /**
+    Append patches to be applied to the whole Nix source.
+    This affects all components.
+
+    Changes to the packaging expressions will be ignored.
+
+    Single argument: list of patches to apply
+
+    See also `overrideSource`
+  */
+  appendPatches =
+    patches:
+    # switch to "fetched" source first, so that patches apply to the whole tree.
+    (scope.overrideSource "${./..}").appendPatches patches;
+
+  mkMesonDerivation = mkPackageBuilder [
+    nixDefaultsLayer
+    scope.sourceLayer
+    setVersionLayer
+    mesonLayer
+    scope.mesonComponentOverrides
+  ];
+  mkMesonExecutable = mkPackageBuilder [
+    nixDefaultsLayer
+    bsdNoLinkAsNeeded
+    scope.sourceLayer
+    setVersionLayer
+    mesonLayer
+    mesonBuildLayer
+    scope.mesonComponentOverrides
+  ];
+  mkMesonLibrary = mkPackageBuilder [
+    nixDefaultsLayer
+    bsdNoLinkAsNeeded
+    scope.sourceLayer
+    mesonLayer
+    setVersionLayer
+    mesonBuildLayer
+    mesonLibraryLayer
+    scope.mesonComponentOverrides
+  ];
+
+  nix-util = callPackage ../src/libutil/package.nix { };
+  nix-util-c = callPackage ../src/libutil-c/package.nix { };
+  nix-util-test-support = callPackage ../src/libutil-test-support/package.nix { };
+  nix-util-tests = callPackage ../src/libutil-tests/package.nix { };
+
+  nix-store = callPackage ../src/libstore/package.nix { };
+  nix-store-c = callPackage ../src/libstore-c/package.nix { };
+  nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
+  nix-store-tests = callPackage ../src/libstore-tests/package.nix { };
+
+  nix-fetchers = callPackage ../src/libfetchers/package.nix { };
+  ${whenAtLeast "2.29pre" "nix-fetchers-c"} = callPackage ../src/libfetchers-c/package.nix { };
+  nix-fetchers-tests = callPackage ../src/libfetchers-tests/package.nix { };
+
+  nix-expr = callPackage ../src/libexpr/package.nix { };
+  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
+  nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
+  nix-expr-tests = callPackage ../src/libexpr-tests/package.nix { };
+
+  nix-flake = callPackage ../src/libflake/package.nix { };
+  nix-flake-c = callPackage ../src/libflake-c/package.nix { };
+  nix-flake-tests = callPackage ../src/libflake-tests/package.nix { };
+
+  nix-main = callPackage ../src/libmain/package.nix { };
+  nix-main-c = callPackage ../src/libmain-c/package.nix { };
+
+  nix-cmd = callPackage ../src/libcmd/package.nix { };
+
+  nix-cli = callPackage ../src/nix/package.nix { };
+
+  nix-functional-tests = callPackage ../tests/functional/package.nix { };
+
+  nix-manual = callPackage ../doc/manual/package.nix { };
+  nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
+  nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
+
+  nix-perl-bindings = callPackage ../src/perl/package.nix { };
+
+  nix-everything = callPackage ../packaging/everything.nix { } // {
+    # Note: no `passthru.overrideAllMesonComponents` etc
+    #       This would propagate into `nix.overrideAttrs f`, but then discard
+    #       `f` when `.overrideAllMesonComponents` is used.
+    #       Both "methods" should be views on the same fixpoint overriding mechanism
+    #       for that to work. For now, we intentionally don't support the broken
+    #       two-fixpoint solution.
+    /**
+      Apply an extension function (i.e. overlay-shaped) to all component derivations, and return the nix package.
+
+      Single argument: the extension function to apply (finalAttrs: prevAttrs: { ... })
+    */
+    overrideAllMesonComponents = f: (scope.overrideAllMesonComponents f).nix-everything;
+
+    /**
+      Append patches to be applied to the whole Nix source.
+      This affects all components.
+
+      Changes to the packaging expressions will be ignored.
+
+      Single argument: list of patches to apply
+
+      See also `overrideSource`
+    */
+    appendPatches = ps: (scope.appendPatches ps).nix-everything;
+
+    /**
+      Provide an alternate source. This allows the expressions to be vendored without copying the sources,
+      but it does make the build non-granular; all components will use a complete source.
+
+      Filesets in the packaging expressions will be ignored.
+
+      Single argument: the source to use.
+
+      See also `appendPatches`
+    */
+    overrideSource = src: (scope.overrideSource src).nix-everything;
+
+    /**
+      Override any internals of the Nix package set.
+
+      Single argument: the extension function to apply to the package set (finalScope: prevScope: { ... })
+
+      Example:
+      ```
+      overrideScope (finalScope: prevScope: { aws-sdk-cpp = null; })
+      ```
+    */
+    overrideScope = f: (scope.overrideScope f).nix-everything;
+
+  };
+}

pkgs/tools/package-management/nix/modular/packaging/everything.nix

@@ -0,0 +1,258 @@
+{
+  lib,
+  stdenv,
+  lndir,
+  buildEnv,
+
+  maintainers,
+  teams,
+
+  version,
+
+  nix-util,
+  nix-util-c,
+  nix-util-tests,
+
+  nix-store,
+  nix-store-c,
+  nix-store-tests,
+
+  nix-fetchers,
+  nix-fetchers-c,
+  nix-fetchers-tests,
+
+  nix-expr,
+  nix-expr-c,
+  nix-expr-tests,
+
+  nix-flake,
+  nix-flake-c,
+  nix-flake-tests,
+
+  nix-main,
+  nix-main-c,
+
+  nix-cmd,
+
+  nix-cli,
+
+  nix-functional-tests,
+
+  nix-manual,
+  nix-internal-api-docs,
+  nix-external-api-docs,
+
+  nix-perl-bindings,
+
+  testers,
+
+  patchedSrc ? null,
+}:
+
+let
+  libs = {
+    inherit
+      nix-util
+      nix-util-c
+      nix-store
+      nix-store-c
+      nix-fetchers
+      nix-expr
+      nix-expr-c
+      nix-flake
+      nix-flake-c
+      nix-main
+      nix-main-c
+      nix-cmd
+      ;
+  }
+  // lib.optionalAttrs (lib.versionAtLeast version "2.29pre") {
+    inherit
+      nix-fetchers-c
+      ;
+  }
+  //
+    lib.optionalAttrs
+      (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+      {
+        # Currently fails in static build
+        inherit
+          nix-perl-bindings
+          ;
+      };
+
+  devdoc = buildEnv {
+    name = "nix-${nix-cli.version}-devdoc";
+    paths = [
+      nix-internal-api-docs
+      nix-external-api-docs
+    ];
+  };
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nix";
+  version = nix-cli.version;
+
+  /**
+    This package uses a multi-output derivation, even though some outputs could
+    have been provided directly by the constituent component that provides it.
+
+    This is because not all tooling handles packages composed of arbitrary
+    outputs yet. This includes nix itself, https://github.com/NixOS/nix/issues/6507.
+
+    `devdoc` is also available, but not listed here, because this attribute is
+    not an output of the same derivation that provides `out`, `dev`, etc.
+  */
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];
+
+  /**
+    Unpacking is handled in this package's constituent components
+  */
+  dontUnpack = true;
+  /**
+    Building is handled in this package's constituent components
+  */
+  dontBuild = true;
+
+  /**
+    `doCheck` controles whether tests are added as build gate for the combined package.
+    This includes both the unit tests and the functional tests, but not the
+    integration tests that run in CI (the flake's `hydraJobs` and some of the `checks`).
+  */
+  doCheck = true;
+
+  /**
+    `fixupPhase` currently doesn't understand that a symlink output isn't writable.
+
+    We don't compile or link anything in this derivation, so fixups aren't needed.
+  */
+  dontFixup = true;
+
+  checkInputs = [
+    # Make sure the unit tests have passed
+    nix-util-tests.tests.run
+    nix-store-tests.tests.run
+    nix-expr-tests.tests.run
+    nix-fetchers-tests.tests.run
+    nix-flake-tests.tests.run
+
+    # Make sure the functional tests have passed
+    nix-functional-tests
+  ]
+  ++
+    lib.optionals (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+      [
+        # Perl currently fails in static build
+        # TODO: Split out tests into a separate derivation?
+        nix-perl-bindings
+      ];
+
+  nativeBuildInputs = [
+    lndir
+  ];
+
+  installPhase =
+    let
+      devPaths = lib.mapAttrsToList (_k: lib.getDev) finalAttrs.finalPackage.libs;
+    in
+    ''
+      mkdir -p $out $dev/nix-support
+
+      # Custom files
+      echo $libs >> $dev/nix-support/propagated-build-inputs
+      echo ${nix-cli} ${lib.escapeShellArgs devPaths} >> $dev/nix-support/propagated-build-inputs
+
+      # Merged outputs
+      lndir ${nix-cli} $out
+
+      for lib in ${lib.escapeShellArgs devPaths}; do
+        lndir $lib $dev
+      done
+
+      # Forwarded outputs
+      ln -sT ${nix-manual} $doc
+      ln -sT ${nix-manual.man} $man
+    '';
+
+  passthru = {
+    inherit (nix-cli) version;
+    src = patchedSrc;
+
+    /**
+      These are the libraries that are part of the Nix project. They are used
+      by the Nix CLI and other tools.
+
+      If you need to use these libraries in your project, we recommend to use
+      the `-c` C API libraries exclusively, if possible.
+
+      We also recommend that you build the complete package to ensure that the unit tests pass.
+      You could do this in CI, or by passing it in an unused environment variable. e.g in a `mkDerivation` call:
+
+      ```nix
+        buildInputs = [ nix.libs.nix-util-c nix.libs.nix-store-c ];
+        # Make sure the nix libs we use are ok
+        unusedInputsForTests = [ nix ];
+        disallowedReferences = nix.all;
+      ```
+    */
+    inherit libs;
+
+    /**
+      Developer documentation for `nix`, in `share/doc/nix/{internal,external}-api/`.
+
+      This is not a proper output; see `outputs` for context.
+    */
+    inherit devdoc;
+
+    /**
+      Extra tests that test this package, but do not run as part of the build.
+      See <https://nixos.org/manual/nixpkgs/stable/index.html#var-passthru-tests>
+    */
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
+    };
+  };
+
+  meta = {
+    mainProgram = "nix";
+    description = "Nix package manager";
+    longDescription = nix-cli.meta.longDescription;
+    homepage = nix-cli.meta.homepage;
+    license = nix-cli.meta.license;
+    maintainers = maintainers;
+    teams = teams;
+    platforms = nix-cli.meta.platforms;
+    outputsToInstall = [
+      "out"
+      "man"
+    ];
+    pkgConfigModules = [
+      "nix-cmd"
+      "nix-expr"
+      "nix-expr-c"
+      "nix-fetchers"
+    ]
+    ++ lib.optionals (lib.versionAtLeast version "2.29pre") [
+      "nix-fetchers-c"
+    ]
+    ++ [
+      "nix-flake"
+      "nix-flake-c"
+      "nix-main"
+      "nix-main-c"
+      "nix-store"
+      "nix-store-c"
+      "nix-util"
+      "nix-util-c"
+    ];
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  mkMesonDerivation,
+
+  doxygen,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-external-api-docs";
+  inherit version;
+
+  workDir = ./.;
+
+  nativeBuildInputs = [
+    doxygen
+  ];
+
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
+
+  postInstall = ''
+    mkdir -p ''${!outputDoc}/nix-support
+    echo "doc external-api-docs $out/share/doc/nix/external-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
+  '';
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+})

pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  mkMesonDerivation,
+
+  doxygen,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-internal-api-docs";
+  inherit version;
+
+  workDir = ./.;
+
+  nativeBuildInputs = [
+    doxygen
+  ];
+
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
+
+  postInstall = ''
+    mkdir -p ''${!outputDoc}/nix-support
+    echo "doc internal-api-docs $out/share/doc/nix/internal-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
+  '';
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+})

pkgs/tools/package-management/nix/modular/src/libcmd/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
+
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  nix-expr,
+  nix-flake,
+  nix-main,
+  editline,
+  readline,
+  lowdown,
+  nlohmann_json,
+
+  # Configuration Options
+
+  version,
+
+  # Whether to enable Markdown rendering in the Nix binary.
+  enableMarkdown ? !stdenv.hostPlatform.isWindows,
+
+  # Which interactive line editor library to use for Nix's repl.
+  #
+  # Currently supported choices are:
+  #
+  # - editline (default)
+  # - readline
+  readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline",
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-cmd";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    ({ inherit editline readline; }.${readlineFlavor})
+  ]
+  ++ lib.optional enableMarkdown lowdown;
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-store
+    nix-fetchers
+    nix-expr
+    nix-flake
+    nix-main
+    nlohmann_json
+  ];
+
+  mesonFlags = [
+    (lib.mesonEnable "markdown" enableMarkdown)
+    (lib.mesonOption "readline-flavor" readlineFlavor)
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-store-c,
+  nix-expr,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-expr-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-store-c
+    nix-expr
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-store-test-support,
+  nix-expr,
+  nix-expr-c,
+
+  rapidcheck,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-util-test-support";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-store-test-support
+    nix-expr
+    nix-expr-c
+    rapidcheck
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
+
+  nix-expr,
+  nix-expr-c,
+  nix-expr-test-support,
+
+  rapidcheck,
+  gtest,
+  runCommand,
+
+  # Configuration Options
+
+  version,
+  resolvePath,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix-expr-tests";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    nix-expr
+    nix-expr-c
+    nix-expr-test-support
+    rapidcheck
+    gtest
+  ];
+
+  mesonFlags = [
+  ];
+
+  passthru = {
+    tests = {
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = finalAttrs.pname + stdenv.hostPlatform.extensions.executable;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libexpr/package.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
+
+  bison,
+  flex,
+  cmake, # for resolving toml11 dep
+
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  boost,
+  boehmgc,
+  nlohmann_json,
+  toml11,
+
+  # Configuration Options
+
+  version,
+
+  # Whether to use garbage collection for the Nix language evaluator.
+  #
+  # If it is disabled, we just leak memory, but this is not as bad as it
+  # sounds so long as evaluation just takes places within short-lived
+  # processes. (When the process exits, the memory is reclaimed; it is
+  # only leaked *within* the process.)
+  #
+  # Temporarily disabled on Windows because the `GC_throw_bad_alloc`
+  # symbol is missing during linking.
+  enableGC ? !stdenv.hostPlatform.isWindows,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-expr";
+  inherit version;
+
+  workDir = ./.;
+
+  nativeBuildInputs = [
+    bison
+    flex
+    cmake
+  ];
+
+  buildInputs = [
+    toml11
+  ];
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-store
+    nix-fetchers
+  ]
+  ++ finalAttrs.passthru.externalPropagatedBuildInputs;
+
+  # Hack for sake of the dev shell
+  passthru.externalPropagatedBuildInputs = [
+    boost
+    nlohmann_json
+  ]
+  ++ lib.optional enableGC boehmgc;
+
+  mesonFlags = [
+    (lib.mesonEnable "gc" enableGC)
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libfetchers-c/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-store-c,
+  nix-expr-c,
+  nix-util-c,
+  nix-fetchers,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-fetchers-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util-c
+    nix-expr-c
+    nix-store-c
+    nix-fetchers
+  ];
+
+  mesonFlags = [ ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
+  writableTmpDirAsHomeHook,
+
+  nix-fetchers,
+  nix-fetchers-c,
+  nix-store-test-support,
+
+  libgit2,
+  rapidcheck,
+  gtest,
+  runCommand,
+
+  # Configuration Options
+
+  version,
+  resolvePath,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix-fetchers-tests";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    nix-fetchers
+    nix-store-test-support
+    rapidcheck
+    gtest
+  ]
+  ++ lib.optionals (lib.versionAtLeast version "2.29pre") [
+    nix-fetchers-c
+  ]
+  ++ lib.optionals (lib.versionAtLeast version "2.27") [
+    libgit2
+  ];
+
+  mesonFlags = [
+  ];
+
+  passthru = {
+    tests = {
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
+          }
+          ''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = finalAttrs.pname + stdenv.hostPlatform.extensions.executable;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util,
+  nix-store,
+  nlohmann_json,
+  libgit2,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-fetchers";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    libgit2
+  ];
+
+  propagatedBuildInputs = [
+    nix-store
+    nix-util
+    nlohmann_json
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-store-c,
+  nix-expr-c,
+  nix-fetchers-c,
+  nix-flake,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-flake-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-expr-c
+    nix-store-c
+  ]
+  ++ lib.optionals (lib.versionAtLeast version "2.29pre") [
+    nix-fetchers-c
+  ]
+  ++ [
+    nix-flake
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
+  writableTmpDirAsHomeHook,
+
+  nix-flake,
+  nix-flake-c,
+  nix-expr-test-support,
+
+  rapidcheck,
+  gtest,
+  runCommand,
+
+  # Configuration Options
+
+  version,
+  resolvePath,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix-flake-tests";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    nix-flake
+    nix-flake-c
+    nix-expr-test-support
+    rapidcheck
+    gtest
+  ];
+
+  mesonFlags = [
+  ];
+
+  passthru = {
+    tests = {
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
+          }
+          ''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            export NIX_CONFIG="extra-experimental-features = flakes"
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = finalAttrs.pname + stdenv.hostPlatform.extensions.executable;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libflake/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  nix-expr,
+  nlohmann_json,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-flake";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-store
+    nix-util
+    nix-fetchers
+    nix-expr
+    nlohmann_json
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util-c,
+  nix-store,
+  nix-store-c,
+  nix-main,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-main-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util-c
+    nix-store
+    nix-store-c
+    nix-main
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libmain/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  openssl,
+
+  nix-util,
+  nix-store,
+  nix-expr,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-main";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs =
+    lib.optionals (lib.versionAtLeast version "2.28") [
+      nix-expr
+    ]
+    ++ [
+      nix-util
+      nix-store
+      openssl
+    ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util-c,
+  nix-store,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-store-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util-c
+    nix-store
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util-test-support,
+  nix-store,
+  nix-store-c,
+
+  rapidcheck,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-store-test-support";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util-test-support
+    nix-store
+    nix-store-c
+    rapidcheck
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
+  writableTmpDirAsHomeHook,
+
+  nix-store,
+  nix-store-c,
+  nix-store-test-support,
+  sqlite,
+
+  rapidcheck,
+  gtest,
+  runCommand,
+
+  # Configuration Options
+
+  version,
+  filesetToSource,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix-store-tests";
+  inherit version;
+
+  workDir = ./.;
+
+  # Hack for sake of the dev shell
+  passthru.externalBuildInputs = [
+    sqlite
+    rapidcheck
+    gtest
+  ];
+
+  buildInputs = finalAttrs.passthru.externalBuildInputs ++ [
+    nix-store
+    nix-store-c
+    nix-store-test-support
+  ];
+
+  mesonFlags = [
+  ];
+
+  excludedTestPatterns = lib.optionals (lib.versionOlder finalAttrs.version "2.31") [
+    "nix_api_util_context.nix_store_real_path_binary_cache"
+  ];
+
+  passthru = {
+    tests = {
+      run =
+        let
+          # Some data is shared with the functional tests: they create it,
+          # we consume it.
+          data = filesetToSource {
+            root = ../..;
+            fileset = lib.fileset.unions [
+              ./data
+              ../../tests/functional/derivation
+            ];
+          };
+        in
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
+          }
+          ''
+            export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
+            export NIX_REMOTE=$HOME/store
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} \
+              --gtest_filter=-${lib.concatStringsSep ":" finalAttrs.excludedTestPatterns}
+            touch $out
+          '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = finalAttrs.pname + stdenv.hostPlatform.extensions.executable;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libstore/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
+
+  unixtools,
+
+  nix-util,
+  boost,
+  curl,
+  aws-sdk-cpp,
+  libseccomp,
+  nlohmann_json,
+  sqlite,
+
+  busybox-sandbox-shell ? null,
+
+  # Configuration Options
+
+  version,
+
+  embeddedSandboxShell ? stdenv.hostPlatform.isStatic,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-store";
+  inherit version;
+
+  workDir = ./.;
+
+  nativeBuildInputs = lib.optional embeddedSandboxShell unixtools.hexdump;
+
+  buildInputs = [
+    boost
+    curl
+    sqlite
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
+  # There have been issues building these dependencies
+  ++ lib.optional (
+    stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)
+  ) aws-sdk-cpp;
+
+  propagatedBuildInputs = [
+    nix-util
+    nlohmann_json
+  ];
+
+  mesonFlags = [
+    (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
+    (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-util-c";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  mkMesonLibrary,
+
+  nix-util,
+  nix-util-c,
+
+  rapidcheck,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-util-test-support";
+  inherit version;
+
+  workDir = ./.;
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-util-c
+    rapidcheck
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
+
+  nix-util,
+  nix-util-c,
+  nix-util-test-support,
+
+  rapidcheck,
+  gtest,
+  runCommand,
+
+  # Configuration Options
+
+  version,
+  resolvePath,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix-util-tests";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    nix-util
+    nix-util-c
+    nix-util-test-support
+    rapidcheck
+    gtest
+  ];
+
+  mesonFlags = [
+  ];
+
+  passthru = {
+    tests = {
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = finalAttrs.pname + stdenv.hostPlatform.extensions.executable;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/libutil/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
+
+  boost,
+  brotli,
+  libarchive,
+  libblake3,
+  libcpuid,
+  libsodium,
+  nlohmann_json,
+  openssl,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonLibrary (finalAttrs: {
+  pname = "nix-util";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    brotli
+  ]
+  ++ lib.optional (lib.versionAtLeast version "2.27") libblake3
+  ++ [
+    libsodium
+    openssl
+  ]
+  ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
+
+  propagatedBuildInputs = [
+    boost
+    libarchive
+    nlohmann_json
+  ];
+
+  mesonFlags = [
+    (lib.mesonEnable "cpuid" stdenv.hostPlatform.isx86_64)
+  ];
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/nix/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  mkMesonExecutable,
+
+  nix-store,
+  nix-expr,
+  nix-main,
+  nix-cmd,
+
+  # Configuration Options
+
+  version,
+}:
+
+mkMesonExecutable (finalAttrs: {
+  pname = "nix";
+  inherit version;
+
+  workDir = ./.;
+
+  buildInputs = [
+    nix-store
+    nix-expr
+    nix-main
+    nix-cmd
+  ];
+
+  mesonFlags = [
+  ];
+
+  meta = {
+    mainProgram = "nix";
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

pkgs/tools/package-management/nix/modular/src/perl/package.nix

@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  mkMesonDerivation,
+  pkg-config,
+  perl,
+  perlPackages,
+  nix-store,
+  version,
+  curl,
+  bzip2,
+  libsodium,
+}:
+
+perl.pkgs.toPerlModule (
+  mkMesonDerivation (finalAttrs: {
+    pname = "nix-perl";
+    inherit version;
+
+    workDir = ./.;
+
+    nativeBuildInputs = [
+      pkg-config
+      perl
+      curl
+    ];
+
+    buildInputs = [
+      nix-store
+    ]
+    ++ finalAttrs.passthru.externalBuildInputs;
+
+    # Hack for sake of the dev shell
+    passthru.externalBuildInputs = [
+      bzip2
+      libsodium
+    ];
+
+    # `perlPackages.Test2Harness` is marked broken for Darwin
+    doCheck = !stdenv.isDarwin;
+
+    nativeCheckInputs = [
+      perlPackages.Test2Harness
+    ];
+
+    preConfigure =
+      # "Inline" .version so its not a symlink, and includes the suffix
+      ''
+        chmod u+w .version
+        echo ${finalAttrs.version} > .version
+      '';
+
+    mesonFlags = [
+      (lib.mesonOption "dbi_path" "${perlPackages.DBI}/${perl.libPrefix}")
+      (lib.mesonOption "dbd_sqlite_path" "${perlPackages.DBDSQLite}/${perl.libPrefix}")
+      (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    ];
+
+    mesonCheckFlags = [
+      "--print-errorlogs"
+    ];
+
+    strictDeps = false;
+  })
+)

pkgs/tools/package-management/nix/modular/tests/functional/package.nix

@@ -0,0 +1,102 @@
+{
+  lib,
+  stdenv,
+  mkMesonDerivation,
+
+  meson,
+  ninja,
+  pkg-config,
+
+  jq,
+  git,
+  mercurial,
+  util-linux,
+
+  nix-store,
+  nix-expr,
+  nix-cli,
+  toml11,
+
+  busybox-sandbox-shell ? null,
+
+  # Configuration Options
+
+  pname ? "nix-functional-tests",
+  version,
+
+  # For running the functional tests against a different pre-built Nix.
+  test-daemon ? null,
+}:
+
+mkMesonDerivation (
+  finalAttrs:
+  {
+    inherit pname version;
+
+    workDir = ./.;
+
+    # Hack for sake of the dev shell
+    passthru.externalNativeBuildInputs = [
+      meson
+      ninja
+      pkg-config
+
+      jq
+      git
+      mercurial
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # For various sandboxing tests that needs a statically-linked shell,
+      # etc.
+      busybox-sandbox-shell
+      # For Overlay FS tests need `mount`, `umount`, and `unshare`.
+      # For `script` command (ensuring a TTY)
+      # TODO use `unixtools` to be precise over which executables instead?
+      util-linux
+    ];
+
+    nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
+      nix-cli
+    ];
+
+    buildInputs = [
+      nix-store
+      nix-expr
+    ];
+
+    preConfigure =
+      # TEMP hack for Meson before make is gone, where
+      # `src/nix-functional-tests` is during the transition a symlink and
+      # not the actual directory directory.
+      ''
+        cd $(readlink -e $PWD)
+        echo $PWD | grep tests/functional
+      '';
+
+    # `toml11` upgrade causes these to fail in 2.32+: https://github.com/NixOS/nixpkgs/pull/442682
+    # Remove when that PR lands in master.
+    ${if lib.versionAtLeast (lib.versions.majorMinor version) "2.32" then "preCheck" else null} =
+      lib.optionalString (lib.versionOlder toml11.version "4.0") ''
+        rm -f ../lang/eval-fail-fromTOML-{over,under}flow*
+      '';
+
+    mesonCheckFlags = [
+      "--print-errorlogs"
+    ];
+
+    doCheck = true;
+
+    installPhase = ''
+      mkdir $out
+    '';
+
+    meta = {
+      platforms = lib.platforms.unix;
+    };
+
+  }
+  // lib.optionalAttrs (test-daemon != null) {
+    NIX_DAEMON_PACKAGE = test-daemon;
+    _NIX_TEST_CLIENT_VERSION = nix-cli.version;
+  }
+)

pkgs/tools/package-management/nix/nix-perl.nix

@@ -0,0 +1,107 @@
+{
+  stdenv,
+  lib,
+  perl,
+  pkg-config,
+  curl,
+  nix,
+  libsodium,
+  boost,
+  autoreconfHook,
+  autoconf-archive,
+  xz,
+  meson,
+  ninja,
+  bzip2,
+  libarchive,
+}:
+
+let
+  atLeast223 = lib.versionAtLeast nix.version "2.23";
+  atLeast224 = lib.versionAtLeast nix.version "2.24";
+  atLeast226 = lib.versionAtLeast nix.version "2.26";
+
+  mkConfigureOption =
+    {
+      mesonOption,
+      autoconfOption,
+      value,
+    }:
+    let
+      setFlagTo =
+        if atLeast223 then lib.mesonOption mesonOption else lib.withFeatureAs true autoconfOption;
+    in
+    setFlagTo value;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nix-perl";
+  inherit (nix) version src;
+
+  postUnpack = "sourceRoot=$sourceRoot/${lib.optionalString atLeast224 "src"}/perl";
+
+  # TODO: Remove this once the nix build also uses meson
+  postPatch = lib.optionalString (atLeast224 && lib.versionOlder nix.version "2.27") ''
+    substituteInPlace lib/Nix/Store.xs \
+      --replace-fail 'config-util.hh' 'nix/config.h' \
+      --replace-fail 'config-store.hh' 'nix/config.h'
+  '';
+
+  buildInputs = [
+    boost
+    bzip2
+    curl
+    libsodium
+    nix
+    perl
+    xz
+  ]
+  ++ lib.optional atLeast226 libarchive;
+
+  # Not cross-safe since Nix checks for curl/perl via
+  # NEED_PROG/find_program, but both seem to be needed at runtime
+  # as well.
+  nativeBuildInputs = [
+    pkg-config
+    perl
+    curl
+  ]
+  ++ (
+    if atLeast223 then
+      [
+        meson
+        ninja
+      ]
+    else
+      [
+        autoconf-archive
+        autoreconfHook
+      ]
+  );
+
+  # `perlPackages.Test2Harness` is marked broken for Darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  nativeCheckInputs = [
+    perl.pkgs.Test2Harness
+  ];
+
+  ${if atLeast223 then "mesonFlags" else "configureFlags"} = [
+    (mkConfigureOption {
+      mesonOption = "dbi_path";
+      autoconfOption = "dbi";
+      value = "${perl.pkgs.DBI}/${perl.libPrefix}";
+    })
+    (mkConfigureOption {
+      mesonOption = "dbd_sqlite_path";
+      autoconfOption = "dbd-sqlite";
+      value = "${perl.pkgs.DBDSQLite}/${perl.libPrefix}";
+    })
+  ]
+  ++ lib.optionals atLeast223 [
+    (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+  ];
+
+  preConfigure = "export NIX_STATE_DIR=$TMPDIR";
+
+  passthru = { inherit perl; };
+})

pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch

@@ -0,0 +1,59 @@
+diff --git a/pthread_stop_world.c b/pthread_stop_world.c
+index 2b45489..0e6d8ef 100644
+--- a/pthread_stop_world.c
++++ b/pthread_stop_world.c
+@@ -776,6 +776,8 @@
+ /* world is stopped.  Should not fail if it isn't.                      */
+ GC_INNER void GC_push_all_stacks(void)
+ {
++    size_t stack_limit;
++    pthread_attr_t pattr;
+     GC_bool found_me = FALSE;
+     size_t nthreads = 0;
+     int i;
+@@ -868,6 +870,45 @@
+             hi = p->altstack + p->altstack_size;
+ #         endif
+           /* FIXME: Need to scan the normal stack too, but how ? */
++        } else {
++          #if defined(HAVE_PTHREAD_ATTR_GET_NP)
++          if (pthread_attr_init(&pattr) != 0) {
++            ABORT("GC_push_all_stacks: pthread_attr_init failed!");
++          }
++          if (pthread_attr_get_np(p->id, &pattr) != 0) {
++            ABORT("GC_push_all_stacks: pthread_attr_get_np failed!");
++          }
++          #elif defined(HAVE_PTHREAD_GETATTR_NP)
++          if (pthread_getattr_np(p->id, &pattr)) {
++            ABORT("GC_push_all_stacks: pthread_getattr_np failed!");
++          }
++          #else
++          /* assume default */
++          if (pthread_attr_init(&pattr) != 0) {
++            ABORT("GC_push_all_stacks: pthread_attr_init failed!");
++          }
++          #endif
++          if (pthread_attr_getstacksize(&pattr, &stack_limit)) {
++            ABORT("GC_push_all_stacks: pthread_attr_getstacksize failed!");
++          }
++          if (pthread_attr_destroy(&pattr)) {
++            ABORT("GC_push_all_stacks: pthread_attr_destroy failed!");
++          }
++          // When a thread goes into a coroutine, we lose its original sp until
++          // control flow returns to the thread.
++          // While in the coroutine, the sp points outside the thread stack,
++          // so we can detect this and push the entire thread stack instead,
++          // as an approximation.
++          // We assume that the coroutine has similarly added its entire stack.
++          // This could be made accurate by cooperating with the application
++          // via new functions and/or callbacks.
++          #ifndef STACK_GROWS_UP
++            if (lo >= hi || lo < hi - stack_limit) { // sp outside stack
++              lo = hi - stack_limit;
++            }
++          #else
++          #error "STACK_GROWS_UP not supported in boost_coroutine2 (as of june 2021), so we don't support it in Nix."
++          #endif
+         }
+ #       ifdef STACKPTR_CORRECTOR_AVAILABLE
+           if (GC_sp_corrector != 0)

pkgs/tools/package-management/nix/tests.nix

@@ -0,0 +1,70 @@
+{
+  runCommand,
+  version,
+  src,
+  nix,
+  lib,
+  stdenv,
+  pkgs,
+  pkgsi686Linux,
+  pkgsStatic,
+  nixosTests,
+  self_attribute_name,
+}:
+{
+  srcVersion =
+    runCommand "nix-src-version"
+      {
+        inherit version;
+      }
+      ''
+        # This file is an implementation detail, but it's a good sanity check
+        # If upstream changes that, we'll have to adapt.
+        srcVersion=$(cat ${src}/.version)
+        echo "Version in nix nix expression: $version"
+        echo "Version in nix.src: $srcVersion"
+        ${
+          if self_attribute_name == "git" then
+            # Major and minor must match, patch can be missing or have a suffix like a commit hash. That's all fine.
+            ''
+              majorMinor() {
+                echo "$1" | sed -n -e 's/\([0-9]*\.[0-9]*\).*/\1/p'
+              }
+              if (set -x; [ "$(majorMinor "$version")" != "$(majorMinor "$srcVersion")" ]); then
+                echo "Version mismatch!"
+                exit 1
+              fi
+            ''
+          else
+            # exact match
+            ''
+              if [ "$version" != "$srcVersion" ]; then
+                echo "Version mismatch!"
+                exit 1
+              fi
+            ''
+        }
+        touch $out
+      '';
+
+  /**
+    Intended to test `lib`, but also a good smoke test for Nix
+  */
+  nixpkgs-lib = import ../../../../lib/tests/test-with-nix.nix {
+    inherit lib pkgs;
+    inherit nix;
+  };
+}
+// lib.optionalAttrs stdenv.hostPlatform.isLinux {
+  # unfortunally nixpkgs pkgsStatic is too often broken including the dependency closure of nix
+  # nixStatic = pkgsStatic.nixVersions.${self_attribute_name};
+
+  # Basic smoke tests that needs to pass when upgrading nix.
+  # Note that this test does only test the nixVersions.stable attribute.
+  misc = nixosTests.nix-misc.default;
+  upgrade = nixosTests.nix-upgrade;
+  simpleUefiSystemdBoot = nixosTests.installer.simpleUefiSystemdBoot;
+}
+// lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
+  nixi686 = pkgsi686Linux.nixVersions.${self_attribute_name};
+}

pkgs/tools/package-management/nix/update-all.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update jq
+
+set -xeuo pipefail
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+NIXPKGS_DIR=$(readlink -f "$SCRIPT_DIR/../../../..")
+cd "$NIXPKGS_DIR"
+
+nix_versions=$(nix eval --impure --json --expr "with import ./. { config.allowAliases = false; }; builtins.filter (name: builtins.match \"nix_.*\" name != null) (builtins.attrNames nixVersions)" | jq -r '.[]')
+
+for name in $nix_versions; do
+    minor_version=${name#nix_*_}
+
+    nix-update --override-filename "$SCRIPT_DIR/default.nix" --version-regex "(2\\.${minor_version}\..+)" --build --commit "nixVersions.$name"
+done
+
+stable_version_full=$(nix eval --impure --json --expr "with import ./. { config.allowAliases = false; }; nixVersions.stable.version" | jq -r)
+
+# strip patch version
+stable_version_trimmed=${stable_version_full%.*}
+
+for name in $nix_versions; do
+    minor_version=${name#nix_*_}
+    if [[ "$name" = "nix_${stable_version_trimmed//./_}" ]]; then
+        curl https://releases.nixos.org/nix/nix-$stable_version_full/fallback-paths.nix > "$NIXPKGS_DIR/nixos/modules/installer/tools/nix-fallback-paths.nix"
+        # nix-update will commit the file if it has changed
+        git add "$NIXPKGS_DIR/nixos/modules/installer/tools/nix-fallback-paths.nix"
+        git commit -m "nix: update nix-fallback-paths to $stable_version_full"
+        break
+    fi
+done
+
+commit_json=$(curl -s https://api.github.com/repos/NixOS/nix/commits/master) # format: 2024-11-01T10:18:53Z
+date_of_commit=$(echo "$commit_json" | jq -r '.commit.author.date')
+suffix="pre$(date -d "$date_of_commit" +%Y%m%d)_"
+sed -i -e "s|\"pre[0-9]\{8\}_|\"$suffix|g" "$SCRIPT_DIR/default.nix"
+nix-update --override-filename "$SCRIPT_DIR/default.nix" --version branch --build --commit "nixVersions.git"

pkgs/tools/package-management/packagekit/default.nix

@@ -0,0 +1,123 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  gettext,
+  glib,
+  pkg-config,
+  polkit,
+  python3,
+  sqlite,
+  gobject-introspection,
+  vala,
+  gtk-doc,
+  boost,
+  meson,
+  ninja,
+  libxslt,
+  docbook-xsl-nons,
+  docbook_xml_dtd_42,
+  libxml2,
+  gst_all_1,
+  gtk3,
+  enableCommandNotFound ? false,
+  enableBashCompletion ? false,
+  bash-completion ? null,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemd,
+  nixosTests,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "packagekit";
+  version = "1.3.1";
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "PackageKit";
+    repo = "PackageKit";
+    rev = "v${version}";
+    hash = "sha256-8sgvD6pZ2n4Du44kTPsvYtSYpkMKCpfxeSrGjWeSw50=";
+  };
+
+  buildInputs = [
+    glib
+    polkit
+    python3
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gtk3
+    sqlite
+    boost
+  ]
+  ++ lib.optional enableSystemd systemd
+  ++ lib.optional enableBashCompletion bash-completion;
+  nativeBuildInputs = [
+    gobject-introspection
+    glib
+    vala
+    gettext
+    pkg-config
+    gtk-doc
+    meson
+    libxslt
+    docbook-xsl-nons
+    docbook_xml_dtd_42
+    libxml2
+    ninja
+  ];
+
+  mesonFlags = [
+    (if enableSystemd then "-Dsystemd=true" else "-Dsystem=false")
+    # often fails to build with nix updates
+    # and remounts /nix/store as rw
+    # https://github.com/NixOS/nixpkgs/issues/177946
+    #"-Dpackaging_backend=nix"
+    "-Ddbus_sys=${placeholder "out"}/share/dbus-1/system.d"
+    "-Ddbus_services=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "-Dcron=false"
+    "-Dgtk_doc=true"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+  ]
+  ++ lib.optional (!enableBashCompletion) "-Dbash_completion=false"
+  ++ lib.optional (!enableCommandNotFound) "-Dbash_command_not_found=false";
+
+  postPatch = ''
+    # HACK: we want packagekit to look in /etc for configs but install
+    # those files in $out/etc ; we just override the runtime paths here
+    # same for /var & $out/var
+    substituteInPlace etc/meson.build \
+      --replace "install_dir: join_paths(get_option('sysconfdir'), 'PackageKit')" "install_dir: join_paths('$out', 'etc', 'PackageKit')"
+    substituteInPlace data/meson.build \
+      --replace "install_dir: join_paths(get_option('localstatedir'), 'lib', 'PackageKit')," "install_dir: join_paths('$out', 'var', 'lib', 'PackageKit'),"
+  '';
+
+  passthru.tests = {
+    nixos-test = nixosTests.packagekit;
+  };
+
+  meta = with lib; {
+    description = "System to facilitate installing and updating packages";
+    longDescription = ''
+      PackageKit is a system designed to make installing and updating software
+      on your computer easier. The primary design goal is to unify all the
+      software graphical tools used in different distributions, and use some of
+      the latest technology like PolicyKit. The actual nuts-and-bolts distro
+      tool (dnf, apt, etc) is used by PackageKit using compiled and scripted
+      helpers. PackageKit isn't meant to replace these tools, instead providing
+      a common set of abstractions that can be used by standard GUI and text
+      mode package managers.
+    '';
+    homepage = "https://github.com/PackageKit/PackageKit";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ matthewbauer ];
+  };
+}

pkgs/tools/package-management/packagekit/qt.nix

@@ -0,0 +1,34 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  qttools,
+  packagekit,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "packagekit-qt";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "hughsie";
+    repo = "PackageKit-Qt";
+    tag = "v${version}";
+    hash = "sha256-ZHkOFPaOMLCectYKzQs9oQ70kv8APOdkjDRimHgld+c=";
+  };
+
+  buildInputs = [ packagekit ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qttools
+  ];
+
+  dontWrapQtApps = true;
+
+  meta = packagekit.meta // {
+    description = "System to facilitate installing and updating packages - Qt";
+  };
+}

pkgs/tools/package-management/protontricks/default.nix

@@ -0,0 +1,90 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchFromGitHub,
+  replaceVars,
+  writeShellScript,
+  steam-run,
+  fetchpatch2,
+  setuptools-scm,
+  vdf,
+  pillow,
+  winetricks,
+  yad,
+  pytestCheckHook,
+  nix-update-script,
+  extraCompatPaths ? "",
+}:
+
+buildPythonApplication rec {
+  pname = "protontricks";
+  version = "1.13.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Matoking";
+    repo = "protontricks";
+    tag = version;
+    hash = "sha256-6z6J31EBXf0FU3fWjjg3dX7OAOiN9Z3ONdKIweJiZBY=";
+  };
+
+  patches = [
+    # Use steam-run to run Proton binaries
+    (replaceVars ./steam-run.patch {
+      steamRun = lib.getExe steam-run;
+      bash = writeShellScript "steam-run-bash" ''
+        exec ${lib.getExe steam-run} bash "$@"
+      '';
+    })
+
+    # Revert vendored vdf since our vdf includes `appinfo.vdf` v29 support
+    (fetchpatch2 {
+      url = "https://github.com/Matoking/protontricks/commit/4198b7ea82369a91e3084d6e185f9b370f78eaec.patch";
+      revert = true;
+      hash = "sha256-1U/LiAliKtk3ygbIBsmoavXN0RSykiiegtml+bO8CnI=";
+    })
+  ];
+
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
+    vdf
+    pillow
+  ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        winetricks
+        yad
+      ]
+    }"
+    # Steam Runtime does not work outside of steam-run, so don't use it
+    "--set STEAM_RUNTIME 0"
+  ]
+  ++ lib.optional (extraCompatPaths != "") "--set STEAM_EXTRA_COMPAT_TOOLS_PATHS ${extraCompatPaths}";
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # From 1.6.0 release notes (https://github.com/Matoking/protontricks/releases/tag/1.6.0):
+  # In most cases the script is unnecessary and should be removed as part of the packaging process.
+  postInstall = ''
+    rm "$out/bin/protontricks-desktop-install"
+  '';
+
+  pythonImportsCheck = [ "protontricks" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Simple wrapper for running Winetricks commands for Proton-enabled games";
+    homepage = "https://github.com/Matoking/protontricks";
+    changelog = "https://github.com/Matoking/protontricks/blob/${src.tag}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kira-bruneau ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}

pkgs/tools/package-management/protontricks/steam-run.patch

@@ -0,0 +1,65 @@
+diff --git a/src/protontricks/data/scripts/bwrap_launcher.sh b/src/protontricks/data/scripts/bwrap_launcher.sh
+index 922c59d..54742a4 100644
+--- a/src/protontricks/data/scripts/bwrap_launcher.sh
++++ b/src/protontricks/data/scripts/bwrap_launcher.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!@bash@
+ # Helper script
+ set -o errexit
+ 
+diff --git a/src/protontricks/data/scripts/wine_launch.sh b/src/protontricks/data/scripts/wine_launch.sh
+index 1b0a0ce..127f13e 100644
+--- a/src/protontricks/data/scripts/wine_launch.sh
++++ b/src/protontricks/data/scripts/wine_launch.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!@bash@
+ # Helper script created by Protontricks to run Wine binaries using Steam Runtime
+ set -o errexit
+ 
+diff --git a/src/protontricks/data/scripts/wineserver_keepalive.sh b/src/protontricks/data/scripts/wineserver_keepalive.sh
+index 8168dae..cb3e7d9 100644
+--- a/src/protontricks/data/scripts/wineserver_keepalive.sh
++++ b/src/protontricks/data/scripts/wineserver_keepalive.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!@bash@
+ # A simple keepalive script that will ensure a wineserver process is kept alive
+ # for the duration of the Protontricks session.
+ # This is accomplished by launching a simple Windows batch script that will
+diff --git a/src/protontricks/util.py b/src/protontricks/util.py
+index 0c7de98..afea7e4 100644
+--- a/src/protontricks/util.py
++++ b/src/protontricks/util.py
+@@ -99,7 +99,7 @@ def get_host_library_paths():
+     # Since that command is unavailable with newer Steam Runtime releases,
+     # do it ourselves here.
+     result = run(
+-        ["/sbin/ldconfig", "-XNv"],
++        ["@steamRun@", "/sbin/ldconfig", "-XNv"],
+         check=True, stdout=PIPE, stderr=PIPE
+     )
+     lines = result.stdout.decode("utf-8").split("\n")
+diff --git a/tests/conftest.py b/tests/conftest.py
+index fdb44ed..4758799 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -175,7 +175,7 @@ def steam_runtime_dir(steam_dir):
+     """
+     (steam_dir.parent / "root" / "ubuntu12_32" / "steam-runtime").mkdir(parents=True)
+     (steam_dir.parent / "root" / "ubuntu12_32" / "steam-runtime" / "run.sh").write_text(
+-        "#!/bin/bash\n"
++        "#!/bin/sh\n"
+         """if [ "$1" = "--print-steam-runtime-library-paths" ]; then\n"""
+         "    echo 'fake_steam_runtime/lib:fake_steam_runtime/lib64'\n"
+         "fi"
+@@ -768,7 +768,7 @@ def xdg_user_dir_bin(home_dir):
+     # Only mock PICTURES and DOWNLOAD; mocking everything isn't necessary
+     # for the tests.
+     (home_dir / ".local" / "bin" / "xdg-user-dir").write_text(
+-        '#!/bin/bash\n'
++        '#!/bin/sh\n'
+         'if [[ "$1" == "PICTURES" ]]; then\n'
+         '    echo "$HOME/Pictures"\n'
+         'elif [[ "$1" == "DOWNLOAD" ]]; then\n'

pkgs/tools/package-management/rpm/default.nix

@@ -0,0 +1,147 @@
+{
+  stdenv,
+  lib,
+  pkg-config,
+  cmake,
+  fetchurl,
+  zlib,
+  bzip2,
+  file,
+  elfutils,
+  libarchive,
+  readline,
+  audit,
+  popt,
+  xz,
+  python3,
+  lua,
+  llvmPackages,
+  sqlite,
+  zstd,
+  libcap,
+  apple-sdk_13,
+  darwinMinVersionHook,
+  openssl,
+  #, libselinux
+  rpm-sequoia,
+  gettext,
+  systemd,
+  bubblewrap,
+  autoconf,
+  gnupg,
+
+  # Disable the unshare RPM plugin, which can be useful if
+  # RPM is ran within the Nix sandbox.
+  disableUnshare ? true,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rpm";
+  version = "4.20.1";
+
+  src = fetchurl {
+    url = "https://ftp.osuosl.org/pub/rpm/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    hash = "sha256-UmR+EmODZFM6tnHLyOSFyW+fCIidk/4O0QSmYyZhEk8=";
+  };
+
+  postPatch = ''
+    sed -i 's#''${Python3_SITEARCH}#${placeholder "out"}/${python3.sitePackages}#' python/CMakeLists.txt
+    sed -i 's#PATHS ENV MYPATH#PATHS ENV PATH#' CMakeLists.txt
+  ''
+  # clang: error: unknown argument: '-fhardened'
+  + lib.optionalString stdenv.cc.isClang ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "-fhardened" ""
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "dev"
+  ];
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoconf
+    python3
+    gettext
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ];
+  buildInputs = [
+    bzip2
+    zlib
+    zstd
+    file
+    libarchive
+    xz
+    lua
+    sqlite
+    openssl
+    readline
+    rpm-sequoia
+    gnupg
+  ]
+  ++ lib.optional stdenv.cc.isClang llvmPackages.openmp
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libcap
+    audit
+    systemd
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_13
+    (darwinMinVersionHook "13.0")
+  ];
+
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+    ./sighandler_t-macos.patch
+  ];
+
+  cmakeFlags = [
+    "-DWITH_DBUS=OFF"
+    # libselinux is missing propagatedBuildInputs
+    "-DWITH_SELINUX=OFF"
+
+    "-DCMAKE_INSTALL_LOCALSTATEDIR=/var"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "-DMKTREE_BACKEND=rootfs"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+    # Test suite rely on either podman or bubblewrap
+    "-DENABLE_TESTSUITE=OFF"
+
+    "-DWITH_CAP=OFF"
+    "-DWITH_AUDIT=OFF"
+    "-DWITH_ACL=OFF"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DWITH_LIBELF=OFF"
+    "-DWITH_LIBDW=OFF"
+  ]
+  ++ lib.optionals disableUnshare [
+    "-DHAVE_UNSHARE=OFF"
+  ];
+
+  # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
+  propagatedBuildInputs = [
+    popt
+  ]
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://www.rpm.org/";
+    license = with licenses; [
+      gpl2Plus
+      lgpl21Plus
+    ];
+    description = "RPM package manager";
+    maintainers = [ ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/tools/package-management/rpm/sighandler_t-macos.patch

@@ -0,0 +1,19 @@
+Revert "signal() returns sighandler_t, not void *"
+
+sadly, on darwin, sighandler_t is not defined
+
+This reverts commit 7bb4dfd0bcadc7c6177d6fe88a4bcccf7fac98b9
+
+diff --git a/build/rpmfc.c b/build/rpmfc.c
+index 86dd36d14..48643a321 100644
+--- a/build/rpmfc.c
++++ b/build/rpmfc.c
+@@ -295,7 +295,7 @@ static int getOutputFrom(ARGV_t argv,
+ 	return -1;
+     }
+     
+-    sighandler_t oldhandler = signal(SIGPIPE, SIG_IGN);
++    void *oldhandler = signal(SIGPIPE, SIG_IGN);
+ 
+     child = fork();
+     if (child < 0) {