Merge master into staging-next

nixos/modules/programs/singularity.nix

@@ -61,7 +61,12 @@ in
     };
     enableSuid = mkOption {
       type = types.bool;
-      default = true;
+      # SingularityCE requires SETUID for most things. Apptainer prefers user
+      # namespaces, e.g. `apptainer exec --nv` would fail if built
+      # `--with-suid`:
+      # > `FATAL: nvidia-container-cli not allowed in setuid mode`
+      default = cfg.package.projectName != "apptainer";
+      defaultText = literalExpression ''config.services.singularity.package.projectName != "apptainer"'';
       example = false;
       description = mdDoc ''
         Whether to enable the SUID support of Singularity/Apptainer.

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -28,12 +28,12 @@
         version = "2023-10-23";
       };
       ungoogled-patches = {
-        hash = "sha256-B1MNo8BdjMOmTvIr4uu3kg/MO1t+YLQz2S23L4Cye3E=";
-        rev = "120.0.6099.199-1";
+        hash = "sha256-qB1OrsfRCWfobKAAfcYJFmKc36ofF+VmjqPNbIPugJA=";
+        rev = "120.0.6099.216-1";
       };
     };
-    hash = "sha256-lT1CCwYj0hT4tCJb689mZwNecUsEwcfn2Ot8r9LBT+M=";
-    hash_deb_amd64 = "sha256-4BWLn0+gYNWG4DsolbY6WlTvXWl7tZIZrnqXlrGUGjQ=";
-    version = "120.0.6099.199";
+    hash = "sha256-yqk0bh68onWqML20Q8eDsTT9o+eKtta7kS9HL74do6Q=";
+    hash_deb_amd64 = "sha256-MxIyOXssQ1Ke5WZbBbB4FpDec+rn46m8+PbMdmxaQCA=";
+    version = "120.0.6099.216";
   };
 }

pkgs/applications/science/math/caffe/default.nix

@@ -153,7 +153,7 @@ stdenv.mkDerivation rec {
       || cudaSupport
       || !(leveldbSupport -> (leveldb != null && snappy != null))
       || !(cudnnSupport -> (hasCudnn && cudaSupport))
-      || !(ncclSupport -> cudaSupport)
+      || !(ncclSupport -> (cudaSupport && !nccl.meta.unsupported))
       || !(pythonSupport -> (python != null && numpy != null))
     ;
     license = licenses.bsd2;

pkgs/applications/version-management/gitnuro/default.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A FOSS Git multiplatform client based on Compose and JGit";
-    homepage = "https://gitnuro.jetpackduba.com";
+    homepage = "https://gitnuro.com/";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ zendo ];

pkgs/applications/virtualization/libnvidia-container/default.nix

@@ -116,6 +116,7 @@ stdenv.mkDerivation rec {
     description = "NVIDIA container runtime library";
     license = licenses.asl20;
     platforms = platforms.linux;
+    mainProgram = "nvidia-container-cli";
     maintainers = with maintainers; [ cpcloud ];
   };
 }

pkgs/applications/virtualization/nvidia-container-toolkit/default.nix

@@ -5,10 +5,16 @@
 , buildGoModule
 , linkFarm
 , writeShellScript
+, formats
 , containerRuntimePath
 , configTemplate
+, configTemplatePath ? null
 , libnvidia-container
 }:
+
+assert configTemplate != null -> (lib.isAttrs configTemplate && configTemplatePath == null);
+assert configTemplatePath != null -> (lib.isStringLike configTemplatePath && configTemplate == null);
+
 let
   isolatedContainerRuntimePath = linkFarm "isolated_container_runtime_path" [
     {
@@ -23,6 +29,8 @@ let
       echo >&2 "$(tput setaf 3)warning: \$XDG_CONFIG_HOME=$XDG_CONFIG_HOME$(tput sgr 0)"
     fi
   '';
+
+  configToml = if configTemplatePath != null then configTemplatePath else (formats.toml { }).generate "config.toml" configTemplate;
 in
 buildGoModule rec {
   pname = "container-toolkit/container-toolkit";
@@ -47,6 +55,14 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  preConfigure = ''
+    # Ensure the runc symlink isn't broken:
+    if ! readlink --quiet --canonicalize-existing "${isolatedContainerRuntimePath}/runc" ; then
+      echo "${isolatedContainerRuntimePath}/runc: broken symlink" >&2
+      exit 1
+    fi
+  '';
+
   checkFlags =
     let
       skippedTests = [
@@ -74,7 +90,7 @@ buildGoModule rec {
       --prefix PATH : ${isolatedContainerRuntimePath}:${libnvidia-container}/bin \
       --set-default XDG_CONFIG_HOME $out/etc
 
-    cp ${configTemplate} $out/etc/nvidia-container-runtime/config.toml
+    cp ${configToml} $out/etc/nvidia-container-runtime/config.toml
 
     substituteInPlace $out/etc/nvidia-container-runtime/config.toml \
       --subst-var-by glibcbin ${lib.getBin glibc}

pkgs/applications/virtualization/nvidia-container-toolkit/packages.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  newScope,
+  docker,
+  libnvidia-container,
+  runc,
+  symlinkJoin,
+}:
+
+# Note this scope isn't recursed into, at the time of writing.
+lib.makeScope newScope (
+  self: {
+
+    # The config is only exposed as an attrset so that the user may reach the
+    # deafult values, for inspectability purposes.
+    dockerConfig = {
+      disable-require = false;
+      #swarm-resource = "DOCKER_RESOURCE_GPU"
+
+      nvidia-container-cli = {
+        #root = "/run/nvidia/driver";
+        #path = "/usr/bin/nvidia-container-cli";
+        environment = [ ];
+        #debug = "/var/log/nvidia-container-runtime-hook.log";
+        ldcache = "/tmp/ld.so.cache";
+        load-kmods = true;
+        #no-cgroups = false;
+        #user = "root:video";
+        ldconfig = "@@glibcbin@/bin/ldconfig";
+      };
+    };
+    nvidia-container-toolkit-docker = self.callPackage ./. {
+      containerRuntimePath = "${docker}/libexec/docker/docker";
+      configTemplate = self.dockerConfig;
+    };
+
+    podmanConfig = {
+      disable-require = true;
+      #swarm-resource = "DOCKER_RESOURCE_GPU";
+
+      nvidia-container-cli = {
+        #root = "/run/nvidia/driver";
+        #path = "/usr/bin/nvidia-container-cli";
+        environment = [ ];
+        #debug = "/var/log/nvidia-container-runtime-hook.log";
+        ldcache = "/tmp/ld.so.cache";
+        load-kmods = true;
+        no-cgroups = true;
+        #user = "root:video";
+        ldconfig = "@@glibcbin@/bin/ldconfig";
+      };
+    };
+    nvidia-container-toolkit-podman = self.nvidia-container-toolkit-docker.override {
+      containerRuntimePath = lib.getExe runc;
+
+      configTemplate = self.podmanConfig;
+    };
+
+    nvidia-docker = symlinkJoin {
+      name = "nvidia-docker";
+      paths = [
+        libnvidia-container
+        self.nvidia-docker-unwrapped
+        self.nvidia-container-toolkit-docker
+      ];
+      inherit (self.nvidia-docker-unwrapped) meta;
+    };
+    nvidia-docker-unwrapped = self.callPackage ../nvidia-docker { };
+
+    nvidia-podman = symlinkJoin {
+      name = "nvidia-podman";
+      paths = [
+        libnvidia-container
+        self.nvidia-container-toolkit-podman
+      ];
+      inherit (self.nvidia-container-toolkit-podman) meta;
+    };
+  }
+)

pkgs/applications/virtualization/nvidia-docker/config.toml

@@ -1,13 +0,0 @@
-disable-require = false
-#swarm-resource = "DOCKER_RESOURCE_GPU"
-
-[nvidia-container-cli]
-#root = "/run/nvidia/driver"
-#path = "/usr/bin/nvidia-container-cli"
-environment = []
-#debug = "/var/log/nvidia-container-runtime-hook.log"
-ldcache = "/tmp/ld.so.cache"
-load-kmods = true
-#no-cgroups = false
-#user = "root:video"
-ldconfig = "@@glibcbin@/bin/ldconfig"

pkgs/applications/virtualization/nvidia-podman/config.toml

@@ -1,13 +0,0 @@
-disable-require = true
-#swarm-resource = "DOCKER_RESOURCE_GPU"
-
-[nvidia-container-cli]
-#root = "/run/nvidia/driver"
-#path = "/usr/bin/nvidia-container-cli"
-environment = []
-#debug = "/var/log/nvidia-container-runtime-hook.log"
-ldcache = "/tmp/ld.so.cache"
-load-kmods = true
-no-cgroups = true
-#user = "root:video"
-ldconfig = "@@glibcbin@/bin/ldconfig"

pkgs/applications/virtualization/singularity/apptainer/0001-ldCache-patch-for-driverLink.patch

@@ -0,0 +1,84 @@
+From 783ec26c0d83013baf04579a6a415d7f8776ac93 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Sun, 7 Jan 2024 11:48:24 +0000
+Subject: [PATCH] ldCache(): patch for @driverLink@
+
+---
+ internal/pkg/util/paths/resolve.go | 41 +++++++++++++++++++++++++++---
+ 1 file changed, 38 insertions(+), 3 deletions(-)
+
+diff --git a/internal/pkg/util/paths/resolve.go b/internal/pkg/util/paths/resolve.go
+index db45d9db1..9d0110b6b 100644
+--- a/internal/pkg/util/paths/resolve.go
++++ b/internal/pkg/util/paths/resolve.go
+@@ -14,6 +14,7 @@ import (
+ 	"fmt"
+ 	"os"
+ 	"os/exec"
++	"path"
+ 	"path/filepath"
+ 	"regexp"
+ 	"strings"
+@@ -154,14 +155,49 @@ func Resolve(fileList []string) ([]string, []string, error) {
+ // lists three variants of libEGL.so.1 that are in different locations, we only
+ // report the first, highest priority, variant.
+ func ldCache() (map[string]string, error) {
++    driverDirs := strings.Split("@driverLink@/lib", ":")
++    if machine, err := elfMachine(); err == nil && machine == elf.EM_386 {
++        driverDirs = strings.Split("@driverLink@-32/lib", ":")
++    }
++
++    soPattern, err := regexp.Compile(`[^\s]+\.so(\.\d+(\.\d+(\.\d+)?)?)?$`)
++    if err != nil {
++		return nil, fmt.Errorf("could not compile ldconfig regexp: %v", err)
++    }
++
++	ldCache := make(map[string]string)
++    for _, dirPath := range driverDirs {
++        dir, err := os.Open(dirPath)
++        if err != nil {
++            /* Maybe we're not running under NixOS */
++            continue
++        }
++        files, err := dir.ReadDir(-1)
++        if err != nil {
++            continue
++        }
++        for _, f := range files {
++            if !soPattern.MatchString(f.Name()) {
++                continue
++            }
++            libName := f.Name()
++            libPath := path.Join(dirPath, f.Name())
++			if _, ok := ldCache[libName]; !ok {
++				ldCache[libName] = libPath
++			}
++        }
++    }
++
+ 	// walk through the ldconfig output and add entries which contain the filenames
+ 	// returned by nvidia-container-cli OR the nvliblist.conf file contents
+ 	ldconfig, err := bin.FindBin("ldconfig")
+-	if err != nil {
++	if err != nil && len(ldCache) == 0 {
++        // Note that missing ldconfig is only an "error" as long
++        // as there's no driverLink
+ 		return nil, err
+ 	}
+ 	out, err := exec.Command(ldconfig, "-p").Output()
+-	if err != nil {
++	if err != nil && len(ldCache) == 0 {
+ 		return nil, fmt.Errorf("could not execute ldconfig: %v", err)
+ 	}
+ 
+@@ -173,7 +209,6 @@ func ldCache() (map[string]string, error) {
+ 	}
+ 
+ 	// store library name with associated path
+-	ldCache := make(map[string]string)
+ 	for _, match := range r.FindAllSubmatch(out, -1) {
+ 		if match != nil {
+ 			// libName is the "libnvidia-ml.so.1" (from the above example)
+-- 
+2.42.0
+

pkgs/applications/virtualization/singularity/generic.nix

@@ -27,12 +27,14 @@ in
 , buildGoModule
 , runCommandLocal
   # Native build inputs
+, addDriverRunpath
 , makeWrapper
 , pkg-config
 , util-linux
 , which
   # Build inputs
 , bash
+, callPackage
 , conmon
 , coreutils
 , cryptsetup
@@ -54,6 +56,9 @@ in
 , hello
   # Overridable configurations
 , enableNvidiaContainerCli ? true
+  # --nvccli currently requires extra privileges:
+  # https://github.com/apptainer/apptainer/issues/1893#issuecomment-1881240800
+, forceNvcCli ? false
   # Compile with seccomp support
   # SingularityCE 3.10.0 and above requires explicit --without-seccomp when libseccomp is not available.
 , enableSeccomp ? true
@@ -65,6 +70,7 @@ in
   # Whether to compile with SUID support
 , enableSuid ? false
 , starterSuidPath ? null
+, substituteAll
   # newuidmapPath and newgidmapPath are to support --fakeroot
   # where those SUID-ed executables are unavailable from the FHS system PATH.
   # Path to SUID-ed newuidmap executable
@@ -94,6 +100,10 @@ in
 (buildGoModule {
   inherit pname version src;
 
+  patches = lib.optionals (projectName == "apptainer") [
+    (substituteAll { src = ./apptainer/0001-ldCache-patch-for-driverLink.patch; inherit (addDriverRunpath) driverLink; })
+  ];
+
   # Override vendorHash with the output got from
   # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).goModules"
   # or with `null` when using vendored source tarball.
@@ -175,11 +185,18 @@ in
     if [[ ! -e .git || ! -e VERSION ]]; then
       echo "${version}" > VERSION
     fi
+
     # Patch shebangs for script run during build
     patchShebangs --build "$configureScript" makeit e2e scripts mlocal/scripts
+
     # Patching the hard-coded defaultPath by prefixing the packages in defaultPathInputs
     substituteInPlace cmd/internal/cli/actions.go \
       --replace "defaultPath = \"${defaultPathOriginal}\"" "defaultPath = \"''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}${defaultPathOriginal}\""
+
+    substituteInPlace internal/pkg/util/gpu/nvidia.go \
+      --replace \
+        'return fmt.Errorf("/usr/bin not writable in the container")' \
+        ""
   '';
 
   postConfigure = ''
@@ -212,7 +229,7 @@ in
     wrapProgram "$out/bin/${projectName}" \
       --prefix PATH : "''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}"
     # Make changes in the config file
-    ${lib.optionalString enableNvidiaContainerCli ''
+    ${lib.optionalString forceNvcCli ''
       substituteInPlace "$out/etc/${projectName}/${projectName}.conf" \
         --replace "use nvidia-container-cli = no" "use nvidia-container-cli = yes"
     ''}
@@ -264,5 +281,38 @@ in
         singularity = finalAttrs.finalPackage;
       };
     };
+    gpuChecks = lib.optionalAttrs (projectName == "apptainer") {
+      # Should be in tests, but Ofborg would skip image-hello-cowsay because
+      # saxpy is unfree.
+      image-saxpy = callPackage
+        ({ singularity-tools, cudaPackages }:
+          singularity-tools.buildImage {
+            name = "saxpy";
+            contents = [ cudaPackages.saxpy ];
+            memSize = 2048;
+            diskSize = 2048;
+            singularity = finalAttrs.finalPackage;
+          })
+        { };
+      saxpy =
+        callPackage
+          ({ runCommand, writeShellScriptBin }:
+            let
+              unwrapped = writeShellScriptBin "apptainer-cuda-saxpy"
+                ''
+                  ${lib.getExe finalAttrs.finalPackage} exec --nv $@ ${finalAttrs.passthru.tests.image-saxpy} saxpy
+                '';
+            in
+            runCommand "run-apptainer-cuda-saxpy"
+              {
+                requiredSystemFeatures = [ "cuda" ];
+                nativeBuildInputs = [ unwrapped ];
+                passthru = { inherit unwrapped; };
+              }
+              ''
+                apptainer-cuda-saxpy
+              '')
+          { };
+    };
   };
 })

pkgs/build-support/rust/build-rust-crate/build-crate.nix

@@ -51,7 +51,7 @@
     # configure & source common build functions
     LIB_RUSTC_OPTS="${libRustcOpts}"
     BIN_RUSTC_OPTS="${binRustcOpts}"
-    LIB_EXT="${stdenv.hostPlatform.extensions.sharedLibrary}"
+    LIB_EXT="${stdenv.hostPlatform.extensions.sharedLibrary or ""}"
     LIB_PATH="${libPath}"
     LIB_NAME="${libName}"
 

pkgs/by-name/gr/graplang/package.nix

@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchurl
+, flex
+, bison
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graplang";
+  version = "1.46";
+
+  outputs = [ "out" "man" ];
+
+  src = fetchurl {
+    url = "https://www.lunabase.org/~faber/Vault/software/grap/grap-${finalAttrs.version}.tar.gz";
+    hash = "sha512-7n+jLANU/x+wGrpjwYAnf45fQ5M91SwraiCbvUKe6XhWtilhGoT2yTlLkPlTihETTkizLyssW5gj5gbwNHaooA==";
+  };
+
+  nativeBuildInputs = [ flex bison ];
+
+  meta = with lib; {
+    description = "Language for typesetting graphs";
+    longDescription = ''
+      Grap is an Expressive language for describing graphs and incorporating
+      them in typeset documents.  It is implemented as a preprocessor to
+      Kernigan's pic language for describing languages, so any system that can
+      use pic can use grap. For sure, TeX and groff can use it.
+    '';
+    homepage = "https://www.lunabase.org/~faber/Vault/software/grap/";
+    changelog = "https://github.com/snorerot13/grap/blob/master/CHANGES";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ afh ];
+    mainProgram = "grap";
+  };
+})

pkgs/by-name/ja/jasp-desktop/cmake.patch

@@ -0,0 +1,46 @@
+diff --git a/Tools/CMake/Libraries.cmake b/Tools/CMake/Libraries.cmake
+index cc4681a..f484013 100644
+--- a/Tools/CMake/Libraries.cmake
++++ b/Tools/CMake/Libraries.cmake
+@@ -67,7 +67,7 @@ if((NOT LibArchive_FOUND) AND (NOT WIN32))
+   endif()
+ endif()
+ 
+-set(Boost_USE_STATIC_LIBS ON)
++add_definitions(-DBOOST_LOG_DYN_LINK)
+ find_package(
+   Boost 1.78 REQUIRED
+   COMPONENTS filesystem
+@@ -178,10 +178,10 @@ if(LINUX)
+     set(LIBREADSTAT_INCLUDE_DIRS /app/include)
+     set(LIBREADSTAT_LIBRARY_DIRS /app/lib)
+   else()
+-    set(LIBREADSTAT_INCLUDE_DIRS /usr/local/include /usr/include)
++    set(LIBREADSTAT_INCLUDE_DIRS @readstat@/include /usr/include)
+     # The last two library paths handle the two most common multiarch cases.
+     # Other multiarch-compliant paths may come up but should be rare.
+-    set(LIBREADSTAT_LIBRARY_DIRS /usr/local/lib /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/aarch64-linux-gnu)
++    set(LIBREADSTAT_LIBRARY_DIRS @readstat@/lib /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/aarch64-linux-gnu)
+   endif()
+ 
+   message(CHECK_START "Looking for libreadstat.so")
+diff --git a/Tools/CMake/Programs.cmake b/Tools/CMake/Programs.cmake
+index dbd089d..ef6857a 100644
+--- a/Tools/CMake/Programs.cmake
++++ b/Tools/CMake/Programs.cmake
+@@ -39,6 +39,7 @@ endif()
+ 
+ # ------ Linux Tools/Programs
+ 
++#[[
+ if(LINUX)
+ 
+   message(CHECK_START "Looking for 'gfortran'")
+@@ -81,6 +82,7 @@ if(LINUX)
+   endif()
+ 
+ endif()
++]]#
+ 
+ # ----------------------
+ 

pkgs/by-name/ja/jasp-desktop/modules.nix

@@ -0,0 +1,134 @@
+{ R
+, rPackages
+, fetchFromGitHub
+, jasp-src
+, jasp-version
+}:
+
+with rPackages;
+let
+  jaspColumnEncoder-src = fetchFromGitHub {
+    owner = "jasp-stats";
+    repo = "jaspColumnEncoder";
+    rev = "c54987bb25de8963866ae69ad3a6ae5a9a9f1240";
+    hash = "sha256-aWfRG7DXO1MYFvmMLkX/xtHvGeIhFRcRDrVBrhkvYuI=";
+  };
+
+  jaspGraphs = buildRPackage {
+    name = "jaspGraphs-${jasp-version}";
+    version = jasp-version;
+
+    src = jasp-src;
+    sourceRoot = "${jasp-src.name}/Engine/jaspGraphs";
+
+    propagatedBuildInputs = [ ggplot2 gridExtra gtable lifecycle jsonlite R6 RColorBrewer rlang scales viridisLite ];
+  };
+
+  jaspBase = buildRPackage {
+    name = "jaspBase-${jasp-version}";
+    version = jasp-version;
+
+    src = jasp-src;
+    sourceRoot = "${jasp-src.name}/Engine/jaspBase";
+
+    env.INCLUDE_DIR = "../inst/include/jaspColumnEncoder";
+
+    postPatch = ''
+      mkdir -p inst/include
+      cp -r --no-preserve=all ${jaspColumnEncoder-src} inst/include/jaspColumnEncoder
+    '';
+
+    propagatedBuildInputs = [ cli codetools ggplot2 gridExtra gridGraphics jaspGraphs jsonlite lifecycle modules officer pkgbuild plyr qgraph ragg R6 Rcpp renv remotes rjson rvg svglite systemfonts withr ];
+  };
+
+  stanova = buildRPackage {
+    name = "stanova";
+    src = fetchFromGitHub {
+      owner = "bayesstuff";
+      repo = "stanova";
+      rev = "988ad8e07cda1674b881570a85502be7795fbd4e";
+      hash = "sha256-tAeHqTHao2KVRNFBDWmuF++H31aNN6O1ss1Io500QBY=";
+    };
+    propagatedBuildInputs = [ emmeans lme4 coda rstan MASS ];
+  };
+
+  bstats = buildRPackage {
+    name = "bstats";
+    src = fetchFromGitHub {
+      owner = "AlexanderLyNL";
+      repo = "bstats";
+      rev = "42d34c18df08d233825bae34fdc0dfa0cd70ce8c";
+      hash = "sha256-N2KmbTPbyvzsZTWBRE2x7bteccnzokUWDOB4mOWUdJk=";
+    };
+    propagatedBuildInputs = [ hypergeo purrr SuppDists ];
+  };
+
+  flexplot = buildRPackage {
+    name = "flexplot";
+    src = fetchFromGitHub {
+      owner = "dustinfife";
+      repo = "flexplot";
+      rev = "4223ad5fb56028018b964d6f9f5aa5bac8710821";
+      hash = "sha256-L+Ed2bIWjq3ZIAGookp8dAjDSeldEbcwynwFVVZ9IcU=";
+    };
+    propagatedBuildInputs = [ cowplot MASS tibble withr dplyr magrittr forcats purrr plyr R6 ggplot2 patchwork ggsci lme4 party mgcv rlang ];
+  };
+
+  # conting has been removed from CRAN
+  conting' = buildRPackage {
+    name = "conting";
+    src = fetchFromGitHub {
+      owner = "vandenman";
+      repo = "conting";
+      rev = "03a4eb9a687e015d602022a01d4e638324c110c8";
+      hash = "sha256-Sp09YZz1WGyefn31Zy1qGufoKjtuEEZHO+wJvoLArf0=";
+    };
+    propagatedBuildInputs = [ mvtnorm gtools tseries coda ];
+  };
+
+  buildJaspModule = name: deps: buildRPackage {
+    name = "${name}-${jasp-version}";
+    version = jasp-version;
+    src = jasp-src;
+    sourceRoot = "${jasp-src.name}/Modules/${name}";
+    propagatedBuildInputs = deps;
+  };
+in
+{
+  engine = { inherit jaspBase jaspGraphs; };
+  modules = rec {
+    jaspAcceptanceSampling = buildJaspModule "jaspAcceptanceSampling" [ abtest BayesFactor conting' ggplot2 jaspBase jaspGraphs plyr stringr vcd vcdExtra AcceptanceSampling ];
+    jaspAnova = buildJaspModule "jaspAnova" [ afex BayesFactor boot car colorspace emmeans ggplot2 jaspBase jaspDescriptives jaspGraphs jaspTTests KernSmooth matrixStats multcomp onewaytests plyr stringi stringr restriktor ];
+    jaspAudit = buildJaspModule "jaspAudit" [ bstats extraDistr ggplot2 ggrepel jaspBase jaspGraphs jfa ];
+    jaspBain = buildJaspModule "jaspBain" [ bain lavaan ggplot2 semPlot stringr jaspBase jaspGraphs jaspSem ];
+    jaspBsts = buildJaspModule "jaspBsts" [ Boom bsts ggplot2 jaspBase jaspGraphs matrixStats reshape2 ];
+    jaspCircular = buildJaspModule "jaspCircular" [ jaspBase jaspGraphs circular ggplot2 ];
+    jaspCochrane = buildJaspModule "jaspCochrane" [ jaspBase jaspGraphs jaspDescriptives jaspMetaAnalysis ];
+    jaspDescriptives = buildJaspModule "jaspDescriptives" [ ggplot2 ggrepel jaspBase jaspGraphs ];
+    jaspDistributions = buildJaspModule "jaspDistributions" [ car fitdistrplus ggplot2 goftest gnorm jaspBase jaspGraphs MASS sgt sn ];
+    jaspEquivalenceTTests = buildJaspModule "jaspEquivalenceTTests" [ BayesFactor ggplot2 jaspBase jaspGraphs metaBMA TOSTER jaspTTests ];
+    jaspFactor = buildJaspModule "jaspFactor" [ ggplot2 jaspBase jaspGraphs jaspSem lavaan psych qgraph reshape2 semPlot GPArotation Rcsdp semTools ];
+    jaspFrequencies = buildJaspModule "jaspFrequencies" [ abtest BayesFactor conting' multibridge ggplot2 jaspBase jaspGraphs plyr stringr vcd vcdExtra ];
+    jaspJags = buildJaspModule "jaspJags" [ coda ggplot2 ggtext hexbin jaspBase jaspGraphs rjags scales stringr ];
+    jaspLearnBayes = buildJaspModule "jaspLearnBayes" [ extraDistr ggplot2 HDInterval jaspBase jaspGraphs MASS MCMCpack MGLM scales ggalluvial ragg runjags ggdist png posterior ];
+    jaspLearnStats = buildJaspModule "jaspLearnStats" [ extraDistr ggplot2 jaspBase jaspGraphs jaspDistributions jaspDescriptives jaspTTests ggforce tidyr igraph ];
+    jaspMachineLearning = buildJaspModule "jaspMachineLearning" [ kknn AUC cluster colorspace DALEX dbscan e1071 fpc gbm Gmedian ggparty ggdendro ggnetwork ggplot2 ggrepel ggridges glmnet jaspBase jaspGraphs MASS mvnormalTest neuralnet network partykit plyr randomForest rpart ROCR Rtsne signal ];
+    jaspMetaAnalysis = buildJaspModule "jaspMetaAnalysis" [ dplyr ggplot2 jaspBase jaspGraphs MASS metaBMA metafor psych purrr rstan stringr tibble tidyr weightr BayesTools RoBMA metamisc ggmcmc pema ];
+    jaspMixedModels = buildJaspModule "jaspMixedModels" [ afex emmeans ggplot2 ggpol jaspBase jaspGraphs lme4 loo mgcv rstan rstanarm stanova withr ];
+    jaspNetwork = buildJaspModule "jaspNetwork" [ bootnet BDgraph corpcor dplyr foreach ggplot2 gtools HDInterval huge IsingSampler jaspBase jaspGraphs mvtnorm qgraph reshape2 snow stringr ];
+    jaspPower = buildJaspModule "jaspPower" [ pwr jaspBase jaspGraphs ];
+    jaspPredictiveAnalytics = buildJaspModule "jaspPredictiveAnalytics" [ jaspBase jaspGraphs bsts bssm precrec reshape2 Boom lubridate prophet BART EBMAforecast imputeTS ];
+    jaspProcess = buildJaspModule "jaspProcess" [ dagitty ggplot2 ggraph jaspBase jaspGraphs ];
+    jaspProphet = buildJaspModule "jaspProphet" [ rstan ggplot2 jaspBase jaspGraphs prophet scales ];
+    jaspQualityControl = buildJaspModule "jaspQualityControl" [ car cowplot daewr desirability DoE_base EnvStats FAdist fitdistrplus FrF2 ggplot2 ggrepel goftest ggpp irr jaspBase jaspDescriptives jaspGraphs mle_tools psych qcc rsm Rspc tidyr tibble vipor weibullness ];
+    jaspRegression = buildJaspModule "jaspRegression" [ BAS boot bstats combinat emmeans ggplot2 ggrepel hmeasure jaspAnova jaspBase jaspDescriptives jaspGraphs jaspTTests lmtest logistf MASS matrixStats mdscore ppcor purrr Rcpp statmod VGAM ];
+    jaspReliability = buildJaspModule "jaspReliability" [ Bayesrel coda ggplot2 ggridges irr jaspBase jaspGraphs LaplacesDemon lme4 MASS psych ];
+    jaspRobustTTests = buildJaspModule "jaspRobustTTests" [ RoBTT ggplot2 jaspBase jaspGraphs ];
+    jaspSem = buildJaspModule "jaspSem" [ forcats ggplot2 jaspBase jaspGraphs lavaan cSEM reshape2 semPlot semTools stringr tibble tidyr ];
+    jaspSummaryStatistics = buildJaspModule "jaspSummaryStatistics" [ BayesFactor bstats jaspBase jaspFrequencies jaspGraphs jaspRegression jaspTTests jaspAnova jaspDescriptives SuppDists bayesplay ];
+    jaspSurvival = buildJaspModule "jaspSurvival" [ survival survminer jaspBase jaspGraphs ];
+    jaspTTests = buildJaspModule "jaspTTests" [ BayesFactor car ggplot2 jaspBase jaspGraphs logspline plotrix plyr ];
+    jaspTimeSeries = buildJaspModule "jaspTimeSeries" [ jaspBase jaspGraphs forecast ];
+    jaspVisualModeling = buildJaspModule "jaspVisualModeling" [ flexplot jaspBase jaspGraphs ];
+  };
+}

pkgs/by-name/ja/jasp-desktop/package.nix

@@ -0,0 +1,121 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, callPackage
+, buildEnv
+, linkFarm
+, substituteAll
+, R
+, rPackages
+, cmake
+, ninja
+, pkg-config
+, boost
+, libarchive
+, readstat
+, qt6
+}:
+
+let
+  version = "0.18.2";
+
+  src = fetchFromGitHub {
+    owner = "jasp-stats";
+    repo = "jasp-desktop";
+    rev = "v${version}";
+    hash = "sha256-W0wYvk5T9srE1cOyGgahfGxEookdOgVcnzqH9SkFyo8=";
+    fetchSubmodules = true;
+  };
+
+  inherit (callPackage ./modules.nix {
+    jasp-src = src;
+    jasp-version = version;
+  }) engine modules;
+
+  # Merges ${R}/lib/R with all used R packages (even propagated ones)
+  customREnv = buildEnv {
+    name = "jasp-${version}-env";
+    paths = [
+      "${R}/lib/R"
+      rPackages.RInside
+      engine.jaspBase # Should already be propagated from modules, but include it again, just in case
+    ] ++ lib.attrValues modules;
+  };
+
+  modulesDir = linkFarm "jasp-${version}-modules"
+    (lib.mapAttrsToList (name: drv: { name = name; path = "${drv}/library"; }) modules);
+in
+stdenv.mkDerivation {
+  pname = "jasp-desktop";
+  inherit version src;
+
+  patches = [
+    # remove unused cmake deps, ensure boost is dynamically linked, patch readstat path
+    (substituteAll {
+      src = ./cmake.patch;
+      inherit readstat;
+    })
+  ];
+
+  cmakeFlags = [
+    "-DGITHUB_PAT=dummy"
+    "-DGITHUB_PAT_DEF=dummy"
+    "-DINSTALL_R_FRAMEWORK=OFF"
+    "-DLINUX_LOCAL_BUILD=OFF"
+    "-DINSTALL_R_MODULES=OFF"
+    "-DCUSTOM_R_PATH=${customREnv}"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    customREnv
+    boost
+    libarchive
+    readstat
+  ] ++ (with qt6; [
+    qtbase
+    qtdeclarative
+    qtwebengine
+    qtsvg
+    qt5compat
+  ]);
+
+  env.NIX_LDFLAGS = "-L${rPackages.RInside}/library/RInside/lib";
+
+  postInstall = ''
+    # Remove unused cache locations
+    rm -r $out/lib64 $out/Modules
+
+    # Remove flatpak proxy script
+    rm $out/bin/org.jaspstats.JASP
+    substituteInPlace $out/share/applications/org.jaspstats.JASP.desktop \
+        --replace "Exec=org.jaspstats.JASP" "Exec=JASP"
+
+    # symlink modules from the store
+    ln -s ${modulesDir} $out/Modules
+  '';
+
+  passthru = {
+    inherit modules engine;
+    env = customREnv;
+  };
+
+  meta = {
+    changelog = "https://jasp-stats.org/release-notes";
+    description = "A complete statistical package for both Bayesian and Frequentist statistical methods";
+    homepage = "https://github.com/jasp-stats/jasp-desktop";
+    license = lib.licenses.agpl3;
+    mainProgram = "JASP";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    # JASP's cmake build steps are really different on Darwin
+    # Perhaps the Darwin-specific things could be changed to be the same as Linux
+    platforms = lib.platforms.linux;
+  };
+}
+

pkgs/by-name/nh/nh/package.nix

@@ -1,8 +1,9 @@
 { lib
 , rustPlatform
 , installShellFiles
-, makeWrapper
+, makeBinaryWrapper
 , fetchFromGitHub
+, nix-update-script
 , nvd
 , use-nom ? true
 , nix-output-monitor ? null
@@ -11,7 +12,7 @@
 assert use-nom -> nix-output-monitor != null;
 
 let
-  version = "3.4.12";
+  version = "3.5.1";
   runtimeDeps = [ nvd ] ++ lib.optionals use-nom [ nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
@@ -22,14 +23,14 @@ rustPlatform.buildRustPackage {
     owner = "ViperML";
     repo = "nh";
     rev = "refs/tags/v${version}";
-    hash = "sha256-V5TQ/1loQnegDjfLh61DxBWEQZivYEBq2kQpT0fn2cQ=";
+    hash = "sha256-q13oPB1fl45E+7cbV1P1VQt1GtGBaSbrHPtC0Y7q83c=";
   };
 
   strictDeps = true;
 
   nativeBuildInputs = [
     installShellFiles
-    makeWrapper
+    makeBinaryWrapper
   ];
 
   preFixup = ''
@@ -47,7 +48,9 @@ rustPlatform.buildRustPackage {
       ${lib.optionalString use-nom "--set-default NH_NOM 1"}
   '';
 
-  cargoHash = "sha256-Ul4DM8WmKvKG32zBXzpdzHZknpTQAVvrxFcEd/C1buA=";
+  cargoHash = "sha256-Jy873l3ZRBqljzV/GwLbkk1kpO6zNqeGmuMDSKUqyzM=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Yet another nix cli helper";

pkgs/development/compilers/go/1.20.nix

@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.20.12";
+  version = "1.20.13";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-xb+TR1HTHDFcHQu1+wIpZUX6bQiSNWb3pa/sgfLtJ9Y=";
+    hash = "sha256-D+dFxTDy8dZxk688XqJSRr4HeYnsUXjfJm6XXzUyRJ4=";
   };
 
   strictDeps = true;

pkgs/development/cuda-modules/cuda/overrides.nix

@@ -72,7 +72,7 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       env.autoPatchelfIgnoreMissingDeps =
         prevAttrs.env.autoPatchelfIgnoreMissingDeps + " libnvrm_gpu.so libnvrm_mem.so libnvdla_runtime.so";
       # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
-      brokenConditions = prevAttrs.brokenConditions // {
+      badPlatformsConditions = prevAttrs.badPlatformsConditions // {
         "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
           !final.flags.isJetsonBuild;
       };

pkgs/development/cuda-modules/cudatoolkit/default.nix

@@ -180,10 +180,17 @@ backendStdenv.mkDerivation rec {
     # This dependency is asked for by target-linux-x64/CollectX/RedHat/x86_64/libssl.so.10
     # - do we even want to use nvidia-shipped libssl?
     "libcom_err.so.2"
+  ] ++ lib.optionals (lib.versionOlder version "10.1") [
+    # For Cuda 10.0, nVidia also shipped a jre implementation which needed
+    # two old versions of ffmpeg which are not available in nixpkgs
+    "libavcodec.so.54"
+    "libavcodec.so.53"
+    "libavformat.so.54"
+    "libavformat.so.53"
   ];
 
   preFixup =
-    if lib.versionOlder version "11" then
+    if (lib.versionAtLeast version "10.1" && lib.versionOlder version "11") then
       ''
         ${lib.getExe' patchelf "patchelf"} $out/targets/*/lib/libnvrtc.so --add-needed libnvrtc-builtins.so
       ''

pkgs/development/cuda-modules/cudnn/shims.nix

@@ -1,10 +1,18 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
-{package, redistArch}:
 {
-  featureRelease.${redistArch}.outputs = {
-    lib = true;
-    static = true;
-    dev = true;
+  lib,
+  package,
+  # redistArch :: String
+  # String is "unsupported" if the given architecture is unsupported.
+  redistArch,
+}:
+{
+  featureRelease = lib.optionalAttrs (redistArch != "unsupported") {
+    ${redistArch}.outputs = {
+      lib = true;
+      static = true;
+      dev = true;
+    };
   };
   redistribRelease = {
     name = "NVIDIA CUDA Deep Neural Network library (cuDNN)";

pkgs/development/cuda-modules/cutensor/extension.nix

@@ -92,6 +92,7 @@ let
   # A release is supported if it has a libPath that matches our CUDA version for our platform.
   # LibPath are not constant across the same release -- one platform may support fewer
   # CUDA versions than another.
+  # redistArch :: String
   redistArch = flags.getRedistArch hostPlatform.system;
   # platformIsSupported :: Manifests -> Boolean
   platformIsSupported =

pkgs/development/cuda-modules/flags.nix

@@ -131,39 +131,29 @@ let
   # `linux-aarch64` redist (which is for Jetson devices) if we're building any Jetson devices.
   # Since both are based on aarch64, we can only have one or the other, otherwise there's an
   # ambiguity as to which should be used.
+  # NOTE: This function *will* be called by unsupported systems because `cudaPackages` is part of
+  # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
+  # systems gracefully.
   # getRedistArch :: String -> String
-  getRedistArch =
-    nixSystem:
-    if nixSystem == "aarch64-linux" then
-      if jetsonTargets != [] then "linux-aarch64" else "linux-sbsa"
-    else if nixSystem == "x86_64-linux" then
-      "linux-x86_64"
-    else if nixSystem == "ppc64le-linux" then
-      "linux-ppc64le"
-    else if nixSystem == "x86_64-windows" then
-      "windows-x86_64"
-    else
-      "unsupported";
+  getRedistArch = nixSystem: attrsets.attrByPath [ nixSystem ] "unsupported" {
+    aarch64-linux = if jetsonTargets != [] then "linux-aarch64" else "linux-sbsa";
+    x86_64-linux = "linux-x86_64";
+    ppc64le-linux = "linux-ppc64le";
+    x86_64-windows = "windows-x86_64";
+  };
 
   # Maps NVIDIA redist arch to Nix system.
-  # It is imperative that we include the boolean condition based on jetsonTargets to ensure
-  # we don't advertise availability of packages only available on server-grade ARM
-  # as being available for the Jetson, since both `linux-sbsa` and `linux-aarch64` are
-  # mapped to the Nix system `aarch64-linux`.
-  getNixSystem =
-    redistArch:
-    if redistArch == "linux-sbsa" && jetsonTargets == [] then
-      "aarch64-linux"
-    else if redistArch == "linux-aarch64" && jetsonTargets != [] then
-      "aarch64-linux"
-    else if redistArch == "linux-x86_64" then
-      "x86_64-linux"
-    else if redistArch == "linux-ppc64le" then
-      "ppc64le-linux"
-    else if redistArch == "windows-x86_64" then
-      "x86_64-windows"
-    else
-      "unsupported-${redistArch}";
+  # NOTE: This function *will* be called by unsupported systems because `cudaPackages` is part of
+  # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
+  # systems gracefully.
+  # getNixSystem :: String -> String
+  getNixSystem = redistArch: attrsets.attrByPath [ redistArch ] "unsupported-${redistArch}" {
+    linux-sbsa = "aarch64-linux";
+    linux-aarch64 = "aarch64-linux";
+    linux-x86_64 = "x86_64-linux";
+    linux-ppc64le = "ppc64le-linux";
+    windows-x86_64 = "x86_64-windows";
+  };
 
   formatCapabilities =
     {

pkgs/development/cuda-modules/generic-builders/manifest.nix

@@ -43,6 +43,9 @@ let
   # Get the redist architectures for which package provides distributables.
   # These are used by meta.platforms.
   supportedRedistArchs = builtins.attrNames featureRelease;
+  # redistArch :: String
+  # The redistArch is the name of the architecture for which the redistributable is built.
+  # It is `"unsupported"` if the redistributable is not supported on the target platform.
   redistArch = flags.getRedistArch hostPlatform.system;
 in
 backendStdenv.mkDerivation (
@@ -87,8 +90,18 @@ backendStdenv.mkDerivation (
           "sample"
           "python"
         ];
+        # Filter out outputs that don't exist in the redistributable.
+        # NOTE: In the case the redistributable isn't supported on the target platform,
+        # we will have `outputs = [ "out" ] ++ possibleOutputs`. This is of note because platforms which
+        # aren't supported would otherwise have evaluation errors when trying to access outputs other than `out`.
+        # The alternative would be to have `outputs = [ "out" ]` when`redistArch = "unsupported"`, but that would
+        # require adding guards throughout the entirety of the CUDA package set to ensure `cudaSupport` is true --
+        # recall that OfBorg will evaluate packages marked as broken and that `cudaPackages` will be evaluated with
+        # `cudaSupport = false`!
         additionalOutputs =
-          if redistArch == "unsupported" then possibleOutputs else builtins.filter hasOutput possibleOutputs;
+          if redistArch == "unsupported"
+          then possibleOutputs
+          else builtins.filter hasOutput possibleOutputs;
         # The out output is special -- it's the default output and we always include it.
         outputs = [ "out" ] ++ additionalOutputs;
       in
@@ -112,21 +125,32 @@ backendStdenv.mkDerivation (
       python = ["**/*.whl"];
     };
 
-    # Useful for introspecting why something went wrong.
-    # Maps descriptions of why the derivation would be marked broken to
-    # booleans indicating whether that description is true.
-    brokenConditions = {};
+    # Useful for introspecting why something went wrong. Maps descriptions of why the derivation would be marked as
+    # broken on have badPlatforms include the current platform.
 
-    src = fetchurl {
-      url =
-        if (builtins.hasAttr redistArch redistribRelease) then
-          "https://developer.download.nvidia.com/compute/${redistName}/redist/${
-            redistribRelease.${redistArch}.relative_path
-          }"
-        else
-          "cannot-construct-an-url-for-the-${redistArch}-platform";
-      sha256 = redistribRelease.${redistArch}.sha256 or lib.fakeHash;
-    };
+    # brokenConditions :: AttrSet Bool
+    # Sets `meta.broken = true` if any of the conditions are true.
+    # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
+    brokenConditions = { };
+
+    # badPlatformsConditions :: AttrSet Bool
+    # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
+    # Example: Broken on a specific architecture when some condition is met (like targeting Jetson).
+    badPlatformsConditions = { };
+
+    # src :: Optional Derivation
+    src = trivial.pipe redistArch [
+      # If redistArch doesn't exist in redistribRelease, return null.
+      (redistArch: redistribRelease.${redistArch} or null)
+      # If the release is non-null, fetch the source; otherwise, return null.
+      (trivial.mapNullable (
+        { relative_path, sha256, ... }:
+        fetchurl {
+          url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
+          inherit sha256;
+        }
+      ))
+    ];
 
     # Handle the pkg-config files:
     # 1. No FHS
@@ -297,17 +321,18 @@ backendStdenv.mkDerivation (
     meta = {
       description = "${redistribRelease.name}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
       sourceProvenance = [sourceTypes.binaryNativeCode];
-      platforms =
-        lists.concatMap
-          (
-            redistArch:
-            let
-              nixSystem = flags.getNixSystem redistArch;
-            in
-            lists.optionals (!(strings.hasPrefix "unsupported-" nixSystem)) [ nixSystem ]
-          )
-          supportedRedistArchs;
       broken = lists.any trivial.id (attrsets.attrValues finalAttrs.brokenConditions);
+      platforms = trivial.pipe supportedRedistArchs [
+        # Map each redist arch to the equivalent nix system or null if there is no equivalent.
+        (builtins.map flags.getNixSystem)
+        # Filter out unsupported systems
+        (builtins.filter (nixSystem: !(strings.hasPrefix "unsupported-" nixSystem)))
+      ];
+      badPlatforms =
+        let
+          isBadPlatform = lists.any trivial.id (attrsets.attrValues finalAttrs.badPlatformsConditions);
+        in
+        lists.optionals isBadPlatform finalAttrs.meta.platforms;
       license = licenses.unfree;
       maintainers = teams.cuda.members;
       # Force the use of the default, fat output by default (even though `dev` exists, which

pkgs/development/cuda-modules/generic-builders/multiplex.nix

@@ -20,7 +20,7 @@
   # The featureRelease is used to populate meta.platforms (by way of looking at the attribute names)
   # and to determine the outputs of the package.
   # shimFn :: {package, redistArch} -> AttrSet
-  shimsFn ? ({package, redistArch}: throw "shimsFn must be provided"),
+  shimsFn ? (throw "shimsFn must be provided"),
   # fixupFn :: Path
   # A path (or nix expression) to be evaluated with callPackage and then
   # provided to the package's overrideAttrs function.
@@ -29,16 +29,8 @@
   # - cudaVersion
   # - mkVersionedPackageName
   # - package
-  fixupFn ? (
-    {
-      final,
-      cudaVersion,
-      mkVersionedPackageName,
-      package,
-      ...
-    }:
-    throw "fixupFn must be provided"
-  ),
+  # - ...
+  fixupFn ? (throw "fixupFn must be provided"),
 }:
 let
   inherit (lib)
@@ -80,9 +72,11 @@ let
     && strings.versionAtLeast package.maxCudaVersion cudaVersion;
 
   # Get all of the packages for our given platform.
+  # redistArch :: String
+  # Value is `"unsupported"` if the platform is not supported.
   redistArch = flags.getRedistArch hostPlatform.system;
 
-  allReleases = builtins.concatMap (xs: xs) (builtins.attrValues releaseSets);
+  allReleases = lists.flatten (builtins.attrValues releaseSets);
 
   # All the supported packages we can build for our platform.
   # perSystemReleases :: List Package

pkgs/development/cuda-modules/nccl/default.nix

@@ -100,6 +100,9 @@ backendStdenv.mkDerivation (
       homepage = "https://developer.nvidia.com/nccl";
       license = licenses.bsd3;
       platforms = platforms.linux;
+      # NCCL is not supported on Jetson, because it does not use NVLink or PCI-e for inter-GPU communication.
+      # https://forums.developer.nvidia.com/t/can-jetson-orin-support-nccl/232845/9
+      badPlatforms = lib.optionals cudaFlags.isJetsonBuild [ "aarch64-linux" ];
       maintainers =
         with maintainers;
         [

pkgs/development/cuda-modules/saxpy/default.nix

@@ -36,7 +36,9 @@ backendStdenv.mkDerivation {
   buildInputs =
     lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
     ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
-      libcublas
+      libcublas.dev
+      libcublas.lib
+      libcublas.static
       cuda_cudart
     ]
     ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [cuda_cccl];

pkgs/development/cuda-modules/tensorrt/fixup.nix

@@ -11,18 +11,17 @@
 }:
 let
   inherit (lib)
+    attrsets
     maintainers
     meta
     strings
     versions
     ;
-  targetArch =
-    if hostPlatform.isx86_64 then
-      "x86_64-linux-gnu"
-    else if hostPlatform.isAarch64 then
-      "aarch64-linux-gnu"
-    else
-      "unsupported";
+  # targetArch :: String
+  targetArch = attrsets.attrByPath [ hostPlatform.system ] "unsupported" {
+    x86_64-linux = "x86_64-linux-gnu";
+    aarch64-linux = "aarch64-linux-gnu";
+  };
 in
 finalAttrs: prevAttrs: {
   # Useful for inspecting why something went wrong.
@@ -69,7 +68,7 @@ finalAttrs: prevAttrs: {
 
   preInstall =
     (prevAttrs.preInstall or "")
-    + ''
+    + strings.optionalString (targetArch != "unsupported") ''
       # Replace symlinks to bin and lib with the actual directories from targets.
       for dir in bin lib; do
         rm "$dir"

pkgs/development/cuda-modules/tensorrt/shims.nix

@@ -1,13 +1,21 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
-{package, redistArch}:
 {
-  featureRelease.${redistArch}.outputs = {
-    bin = true;
-    lib = true;
-    static = true;
-    dev = true;
-    sample = true;
-    python = true;
+  lib,
+  package,
+  # redistArch :: String
+  # String is `"unsupported"` if the given architecture is unsupported.
+  redistArch,
+}:
+{
+  featureRelease = lib.optionalAttrs (redistArch != "unsupported") {
+    ${redistArch}.outputs = {
+      bin = true;
+      lib = true;
+      static = true;
+      dev = true;
+      sample = true;
+      python = true;
+    };
   };
   redistribRelease = {
     name = "TensorRT: a high-performance deep learning interface";

pkgs/development/libraries/boost/1.84.nix

@@ -0,0 +1,14 @@
+{ callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.84.0";
+
+  src = fetchurl {
+    urls = [
+      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+      "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+    ];
+    # SHA256 from http://www.boost.org/users/history/version_1_84_0.html
+    sha256 = "cc4b893acf645c9d4b698e9a0f08ca8846aa5d6c68275c14c3e7949c24109454";
+  };
+})

pkgs/development/libraries/boost/default.nix

@@ -24,4 +24,5 @@ in {
   boost181 = makeBoost ./1.81.nix;
   boost182 = makeBoost ./1.82.nix;
   boost183 = makeBoost ./1.83.nix;
+  boost184 = makeBoost ./1.84.nix;
 }

pkgs/development/libraries/science/math/magma/generic.nix

@@ -159,7 +159,7 @@ stdenv.mkDerivation {
     description = "Matrix Algebra on GPU and Multicore Architectures";
     license = licenses.bsd3;
     homepage = "http://icl.cs.utk.edu/magma/index.html";
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ connorbaker ];
 
     # Cf. https://bitbucket.org/icl/magma/src/fcfe5aa61c1a4c664b36a73ebabbdbab82765e9f/CMakeLists.txt#lines-20

pkgs/development/libraries/xgboost/default.nix

@@ -14,7 +14,7 @@
 , rPackages
 }@inputs:
 
-assert ncclSupport -> cudaSupport;
+assert ncclSupport -> (cudaSupport && !cudaPackages.nccl.meta.unsupported);
 # Disable regular tests when building the R package
 # because 1) the R package runs its own tests and
 # 2) the R package creates a different binary shared

pkgs/development/python-modules/jaxlib/default.nix

@@ -64,7 +64,8 @@ let
     # aarch64-darwin is broken because of https://github.com/bazelbuild/rules_cc/pull/136
     # however even with that fix applied, it doesn't work for everyone:
     # https://github.com/NixOS/nixpkgs/pull/184395#issuecomment-1207287129
-    broken = stdenv.isDarwin;
+    # NOTE: We always build with NCCL; if it is unsupported, then our build is broken.
+    broken = stdenv.isDarwin || nccl.meta.unsupported;
   };
 
   cudatoolkit_joined = symlinkJoin {

pkgs/development/python-modules/torch/default.nix

@@ -7,7 +7,8 @@
   magma,
   magma-hip,
   magma-cuda-static,
-  useSystemNccl ? true,
+  # Use the system NCCL as long as we're targeting CUDA on a supported platform.
+  useSystemNccl ? (cudaSupport && !cudaPackages.nccl.meta.unsupported),
   MPISupport ? false, mpi,
   buildDocs ? false,
 
@@ -273,9 +274,11 @@ in buildPythonPackage rec {
   PYTORCH_BUILD_VERSION = version;
   PYTORCH_BUILD_NUMBER = 0;
 
-  USE_NCCL = setBool (cudaSupport && cudaPackages ? nccl);
-  USE_SYSTEM_NCCL = setBool useSystemNccl;                  # don't build pytorch's third_party NCCL
-  USE_STATIC_NCCL = setBool useSystemNccl;
+  # In-tree builds of NCCL are not supported.
+  # Use NCCL when cudaSupport is enabled and nccl is available.
+  USE_NCCL = setBool useSystemNccl;
+  USE_SYSTEM_NCCL = USE_NCCL;
+  USE_STATIC_NCCL = USE_NCCL;
 
   # Suppress a weird warning in mkl-dnn, part of ideep in pytorch
   # (upstream seems to have fixed this in the wrong place?)
@@ -363,7 +366,7 @@ in buildPythonPackage rec {
     ] ++ lists.optionals (cudaPackages ? cudnn) [
       cudnn.dev
       cudnn.lib
-    ] ++ lists.optionals (useSystemNccl && cudaPackages ? nccl) [
+    ] ++ lists.optionals useSystemNccl [
       # Some platforms do not support NCCL (i.e., Jetson)
       nccl.dev # Provides nccl.h AND a static copy of NCCL!
     ] ++ lists.optionals (strings.versionOlder cudaVersion "11.8") [

pkgs/development/r-modules/default.nix

@@ -618,7 +618,7 @@ let
     LCMCR = [ pkgs.gsl ];
     BNSP = [ pkgs.gsl ];
     scModels = [ pkgs.mpfr.dev ];
-    multibridge = [ pkgs.mpfr.dev ];
+    multibridge = with pkgs; [ pkg-config mpfr.dev ];
     RcppCWB = with pkgs; [ pcre.dev glib.dev ];
     redux = [ pkgs.hiredis ];
     RmecabKo = [ pkgs.mecab ];

pkgs/os-specific/darwin/xcode/default.nix

@@ -79,6 +79,8 @@ in lib.makeExtensible (self: {
   xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
   xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
   xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
+  xcode_15 = requireXcode "15" "sha256-ffqISt2Ayccln5BArKIjSdzbEgoSoNwq8TPLGysAE0c=";
+  xcode_15_1 = requireXcode "15.1" "sha256-0djqoSamU87rCpjo50Un3cFg9wKf+pSczRko6uumGM0=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
 

pkgs/servers/sabnzbd/default.nix

@@ -2,7 +2,7 @@
 , coreutils
 , fetchFromGitHub
 , python3
-, par2cmdline
+, par2cmdline-turbo
 , unzip
 , unrar
 , p7zip
@@ -45,7 +45,7 @@ let
     tempora
     zc_lockfile
   ]);
-  path = lib.makeBinPath [ coreutils par2cmdline unrar unzip p7zip util-linux ];
+  path = lib.makeBinPath [ coreutils par2cmdline-turbo unrar unzip p7zip util-linux ];
 in stdenv.mkDerivation rec {
   version = "4.2.1";
   pname = "sabnzbd";

pkgs/top-level/all-packages.nix

@@ -20669,6 +20669,7 @@ with pkgs;
     boost181
     boost182
     boost183
+    boost184
   ;
 
   boost = boost181;
@@ -24185,31 +24186,13 @@ with pkgs;
   nv-codec-headers-11 = callPackage ../development/libraries/nv-codec-headers/11_x.nix { };
   nv-codec-headers-12 = callPackage ../development/libraries/nv-codec-headers/12_x.nix { };
 
-  mkNvidiaContainerPkg = { name, containerRuntimePath, configTemplate, additionalPaths ? [] }:
-    let
-      nvidia-container-toolkit = callPackage ../applications/virtualization/nvidia-container-toolkit {
-        inherit containerRuntimePath configTemplate;
-      };
-    in symlinkJoin {
-      inherit name;
-      paths = [
-        libnvidia-container
-        nvidia-container-toolkit
-      ] ++ additionalPaths;
-    };
-
-  nvidia-docker = mkNvidiaContainerPkg {
-    name = "nvidia-docker";
-    containerRuntimePath = "${docker}/libexec/docker/runc";
-    configTemplate = ../applications/virtualization/nvidia-docker/config.toml;
-    additionalPaths = [ (callPackage ../applications/virtualization/nvidia-docker { }) ];
-  };
-
-  nvidia-podman = mkNvidiaContainerPkg {
-    name = "nvidia-podman";
-    containerRuntimePath = "${runc}/bin/runc";
-    configTemplate = ../applications/virtualization/nvidia-podman/config.toml;
-  };
+  nvidiaCtkPackages =
+    callPackage ../applications/virtualization/nvidia-container-toolkit/packages.nix
+      { };
+  inherit (nvidiaCtkPackages)
+    nvidia-docker
+    nvidia-podman
+    ;
 
   nvidia-vaapi-driver = lib.hiPrio (callPackage ../development/libraries/nvidia-vaapi-driver { });
 

pkgs/top-level/cuda-packages.nix

@@ -72,14 +72,7 @@ let
 
         # Loose packages
         cudatoolkit = final.callPackage ../development/cuda-modules/cudatoolkit {};
-        # SaxPy is only available after 11.4 because it requires redistributable versions of CUDA libraries.
-        saxpy = attrsets.optionalAttrs (strings.versionAtLeast cudaVersion "11.4") (
-          final.callPackage ../development/cuda-modules/saxpy {}
-        );
-      }
-      # NCCL is not supported on Jetson, because it does not use NVLink or PCI-e for inter-GPU communication.
-      # https://forums.developer.nvidia.com/t/can-jetson-orin-support-nccl/232845/9
-      // attrsets.optionalAttrs (!flags.isJetsonBuild) {
+        saxpy = final.callPackage ../development/cuda-modules/saxpy {};
         nccl = final.callPackage ../development/cuda-modules/nccl {};
         nccl-tests = final.callPackage ../development/cuda-modules/nccl-tests {};
       }

pkgs/top-level/darwin-packages.nix

@@ -196,6 +196,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     xcode_12 xcode_12_0_1 xcode_12_1 xcode_12_2 xcode_12_3 xcode_12_4 xcode_12_5 xcode_12_5_1
     xcode_13 xcode_13_1 xcode_13_2 xcode_13_3 xcode_13_3_1 xcode_13_4 xcode_13_4_1
     xcode_14 xcode_14_1
+    xcode_15 xcode_15_1
     xcode;
 
   CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };

pkgs/top-level/lua-packages.nix

@@ -59,6 +59,45 @@ rec {
   # a fork of luarocks used to generate nix lua derivations from rockspecs
   luarocks-nix = toLuaModule (callPackage ../development/tools/misc/luarocks/luarocks-nix.nix { });
 
+ lua-pam = callPackage({fetchFromGitHub, linux-pam, openpam}: buildLuaPackage rec {
+    pname = "lua-pam";
+    version = "unstable-2015-07-03";
+    # Needed for `disabled`, overridden in buildLuaPackage
+    name = "${pname}-${version}";
+
+    src = fetchFromGitHub {
+      owner = "devurandom";
+      repo = "lua-pam";
+      rev = "3818ee6346a976669d74a5cbc2a83ad2585c5953";
+      hash = "sha256-YlMZ5mM9Ij/9yRmgA0X1ahYVZMUx8Igj5OBvAMskqTg=";
+      fetchSubmodules = true;
+    };
+
+    # The makefile tries to link to `-llua<luaversion>`
+    LUA_LIBS = "-llua";
+
+    buildInputs = lib.optionals stdenv.isLinux [linux-pam]
+      ++ lib.optionals stdenv.isDarwin [openpam];
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm755 pam.so $out/lib/lua/${lua.luaversion}/pam.so
+
+      runHook postInstall
+    '';
+
+    # The package does not build with lua 5.4 or luaJIT
+    disabled = luaAtLeast "5.4" || isLuaJIT;
+
+    meta = with lib; {
+      description = "Lua module for PAM authentication";
+      homepage = "https://github.com/devurandom/lua-pam";
+      license = licenses.mit;
+      maintainers = with maintainers; [ traxys ];
+    };
+ }) {};
+
  lua-resty-core = callPackage ({ fetchFromGitHub }: buildLuaPackage rec {
     pname = "lua-resty-core";
     version = "0.1.24";