Merge staging-next into staging

CONTRIBUTING.md

@@ -323,7 +323,7 @@ All the review template samples provided in this section are generic and meant a
 
 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
 
-If a pull request contains documentation changes that might require feedback from the documentation team, ping @NixOS/documentation-team on the pull request.
+If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on the pull request.
 
 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
 

doc/README.md

@@ -159,24 +159,28 @@ In an effort to keep the Nixpkgs manual in a consistent style, please follow the
 In that case, please open an issue about the particular documentation convention and tag it with a "needs: documentation" label.
 
 - Put each sentence in its own line.
-  This makes reviewing documentation much easier, since GitHub's review system is based on lines.
+  This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
+  It also helps identifying long sentences at a glance.
 
-- Use the admonitions syntax for any callouts and examples (see [section above](#admonitions)).
+- Use the [admonition syntax](#admonitions) for callouts and examples.
 
-- If you provide an example involving Nix code, make your example into a fully-working package (something that can be passed to `pkgs.callPackage`).
+- Provide at least one example per function, and make examples self-contained.
-  This will help others quickly test that the example works, and will also make it easier if we start automatically testing all example code to make sure it works.
+  This is easier to understand for beginners.
-  For example, instead of providing something like:
+  It also helps with testing that it actually works – especially once we introduce automation.
 
-  ```
+  Example code should be such that it can be passed to `pkgs.callPackage`.
+  Instead of something like:
+
+  ```nix
   pkgs.dockerTools.buildLayeredImage {
     name = "hello";
     contents = [ pkgs.hello ];
   }
   ```
 
-  Provide something like:
+  Write something like:
 
-  ```
+  ```nix
   { dockerTools, hello }:
   dockerTools.buildLayeredImage {
     name = "hello";
@@ -200,6 +204,10 @@ In that case, please open an issue about the particular documentation convention
 
   : Tag of the generated image.
 
-      _Default value:_ the output path's hash.
+    _Default value:_ the output path's hash.
 
   ```
+
+## Getting help
+
+If you need documentation-specific help or reviews, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on your pull request.

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -1,6 +1,7 @@
 # Trivial build helpers {#chap-trivial-builders}
 
-Nixpkgs provides a couple of functions that help with building derivations. The most important one, `stdenv.mkDerivation`, has already been documented above. The following functions wrap `stdenv.mkDerivation`, making it easier to use in certain cases.
+Nixpkgs provides a variety of wrapper functions that help build commonly useful derivations.
+Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers creates a derivation, but the arguments passed are different (usually simpler) from those required by `stdenv.mkDerivation`.
 
 ## `runCommand` {#trivial-builder-runCommand}
 
@@ -58,63 +59,416 @@ Variant of `runCommand` that forces the derivation to be built locally, it is no
 This sets [`allowSubstitutes` to `false`](https://nixos.org/nix/manual/#adv-attr-allowSubstitutes), so only use `runCommandLocal` if you are certain the user will always have a builder for the `system` of the derivation. This should be true for most trivial use cases (e.g., just copying some files to a different location or adding symlinks) because there the `system` is usually the same as `builtins.currentSystem`.
 :::
 
-## `writeTextFile`, `writeText`, `writeTextDir`, `writeScript`, `writeScriptBin` {#trivial-builder-writeText}
+## Writing text files {#trivial-builder-text-writing}
 
-These functions write `text` to the Nix store. This is useful for creating scripts from Nix expressions. `writeTextFile` takes an attribute set and expects two arguments, `name` and `text`. `name` corresponds to the name used in the Nix store path. `text` will be the contents of the file. You can also set `executable` to true to make this file have the executable bit set.
+Nixpkgs provides the following functions for producing derivations which write text files or executable scripts into the Nix store.
+They are useful for creating files from Nix expression, and are all implemented as convenience wrappers around `writeTextFile`.
 
-Many more commands wrap `writeTextFile` including `writeText`, `writeTextDir`, `writeScript`, and `writeScriptBin`. These are convenience functions over `writeTextFile`.
+Each of these functions will cause a derivation to be produced.
+When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`builtins.toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
+
+:::: {.note}
+Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
+If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
+
+For example, if the file destination is a directory:
+
+```nix
+my-file = writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+  destination = "/share/my-file";
+}
+```
+
+Remember to append "/share/my-file" to the resulting store path when using it elsewhere:
+
+```nix
+writeShellScript "evaluate-my-file.sh" ''
+  cat ${my-file}/share/my-file
+'';
+```
+::::
+
+### `writeTextFile` {#trivial-builder-writeTextFile}
+
+Write a text file to the Nix store.
+
+`writeTextFile` takes an attribute set with the following possible attributes:
+
+`name` (String)
+
+: Corresponds to the name used in the Nix store path identifier.
+
+`text` (String)
+
+: The contents of the file.
+
+`executable` (Bool, _optional_)
+
+: Make this file have the executable bit set.
+
+  Default: `false`
+
+`destination` (String, _optional_)
+
+: A subpath under the derivation's output path into which to put the file.
+  Subdirectories are created automatically when the derivation is realised.
+
+  By default, the store path itself will be a file containing the text contents.
+
+  Default: `""`
+
+`checkPhase` (String, _optional_)
+
+: Commands to run after generating the file.
+
+  Default: `""`
+
+`meta` (Attribute set, _optional_)
+
+: Additional metadata for the derivation.
+
+  Default: `{}`
+
+`allowSubstitutes` (Bool, _optional_)
+
+: Whether to allow substituting from a binary cache.
+  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+
+  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
+  Set it to true if the `checkPhase` step is expensive.
+
+  Default: `false`
+
+`preferLocalBuild` (Bool, _optional_)
+
+: Whether to prefer building locally, even if faster [remote build machines](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters) are available.
+
+  Passed through to [`preferLocalBuild`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-preferLocalBuild) of the underlying call to `builtins.derivation`.
+
+  It defaults to `true` for the same reason `allowSubstitutes` defaults to `false`.
+
+  Default: `true`
+
+The resulting store path will include some variation of the name, and it will be a file unless `destination` is used, in which case it will be a directory.
+
+::: {.example #ex-writeTextFile}
+# Usage 1 of `writeTextFile`
+
+Write `my-file` to `/nix/store/<store path>/some/subpath/my-cool-script`, making it executable.
+Also run a check on the resulting file in a `checkPhase`, and supply values for the less-used options.
+
+```nix
+writeTextFile {
+  name = "my-cool-script";
+  text = ''
+    #!/bin/sh
+    echo "This is my cool script!"
+  '';
+  executable = true;
+  destination = "/some/subpath/my-cool-script";
+  checkPhase = ''
+    ${pkgs.shellcheck}/bin/shellcheck $out/some/subpath/my-cool-script
+  '';
+  meta = {
+    license = pkgs.lib.licenses.cc0;
+  };
+  allowSubstitutes = true;
+  preferLocalBuild = false;
+};
+```
+:::
+
+::: {.example #ex2-writeTextFile}
+# Usage 2 of `writeTextFile`
+
+Write the string `Contents of File` to `/nix/store/<store path>`.
+See also the [](#trivial-builder-writeText) helper function.
 
-Here are a few examples:
 ```nix
-# Writes my-file to /nix/store/<store path>
 writeTextFile {
   name = "my-file";
   text = ''
     Contents of File
   '';
 }
-# See also the `writeText` helper function below.
+```
+:::
 
-# Writes executable my-file to /nix/store/<store path>/bin/my-file
+::: {.example #ex3-writeTextFile}
+# Usage 3 of `writeTextFile`
+
+Write an executable script `my-script` to `/nix/store/<store path>/bin/my-script`.
+See also the [](#trivial-builder-writeScriptBin) helper function.
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    echo "hi"
+  '';
+  executable = true;
+  destination = "/bin/my-script";
+}
+```
+:::
+
+### `writeText` {#trivial-builder-writeText}
+
+Write a text file to the Nix store
+
+`writeText` takes the following arguments:
+a string.
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The store path will include the name, and it will be a file.
+
+::: {.example #ex-writeText}
+# Usage of `writeText`
+
+Write the string `Contents of File` to `/nix/store/<store path>`:
+
+```nix
+writeText "my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+}
+```
+
+### `writeTextDir` {#trivial-builder-writeTextDir}
+
+Write a text file within a subdirectory of the Nix store.
+
+`writeTextDir` takes the following arguments:
+
+`path` (String)
+
+: The destination within the Nix store path under which to create the file.
+
+`text` (String)
+
+: The contents of the file.
+
+The store path will be a directory.
+
+::: {.example #ex-writeTextDir}
+# Usage of `writeTextDir`
+
+Write the string `Contents of File` to `/nix/store/<store path>/share/my-file`:
+
+```nix
+writeTextDir "share/my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+  destination = "share/my-file";
+}
+```
+
+### `writeScript` {#trivial-builder-writeScript}
+
+Write an executable script file to the Nix store.
+
+`writeScript` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The store path will include the name, and it will be a file.
+
+::: {.example #ex-writeScript}
+# Usage of `writeScript`
+
+Write the string `Contents of File` to `/nix/store/<store path>` and make the file executable.
+
+```nix
+writeScript "my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
 writeTextFile {
   name = "my-file";
   text = ''
     Contents of File
   '';
   executable = true;
-  destination = "/bin/my-file";
 }
-# Writes contents of file to /nix/store/<store path>
+```
-writeText "my-file"
-  ''
-  Contents of File
-  '';
-# Writes contents of file to /nix/store/<store path>/share/my-file
-writeTextDir "share/my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path> and makes executable
-writeScript "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-writeScriptBin "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path> and makes executable.
-writeShellScript "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-writeShellScriptBin "my-file"
-  ''
-  Contents of File
-  '';
 
+### `writeScriptBin` {#trivial-builder-writeScriptBin}
+
+Write a script within a `bin` subirectory of a directory in the Nix store.
+This is for consistency with the convention of software packages placing executables under `bin`.
+
+`writeScriptBin` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path and within the file created under the store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
+The store path will include the the name, and it will be a directory.
+
+::: {.example #ex-writeScriptBin}
+# Usage of `writeScriptBin`
+
+```nix
+writeScriptBin "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    echo "hi"
+  '';
+  executable = true;
+  destination = "bin/my-script"
+}
+```
+
+### `writeShellScript` {#trivial-builder-writeShellScript}
+
+Write a Bash script to the store.
+
+`writeShellScript` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The store path will include the name, and it will be a file.
+
+This function is almost exactly like [](#trivial-builder-writeScript), except that it prepends to the file a [shebang](https://en.wikipedia.org/wiki/Shebang_%28Unix%29) line that points to the version of Bash used in Nixpkgs.
+<!-- this cannot be changed in practice, so there is no point pretending it's somehow generic -->
+
+::: {.example #ex-writeShellScript}
+# Usage of `writeShellScript`
+
+```nix
+writeShellScript "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    #! ${pkgs.runtimeShell}
+    echo "hi"
+  '';
+  executable = true;
+}
+```
+
+### `writeShellScriptBin` {#trivial-builder-writeShellScriptBin}
+
+Write a Bash script to a "bin" subdirectory of a directory in the Nix store.
+
+`writeShellScriptBin` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path and within the file generated under the store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
+The store path will include the the name, and it will be a directory.
+
+This function is a combination of [](#trivial-builder-writeShellScript) and [](#trivial-builder-writeScriptBin).
+
+::: {.example #ex-writeShellScriptBin}
+# Usage of `writeShellScriptBin`
+
+```nix
+writeShellScriptBin "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    #! ${pkgs.runtimeShell}
+    echo "hi"
+  '';
+  executable = true;
+  destination = "bin/my-script"
+}
 ```
 
 ## `concatTextFile`, `concatText`, `concatScript` {#trivial-builder-concatText}

maintainers/maintainer-list.nix

@@ -2867,12 +2867,6 @@
     githubId = 382011;
     name = "c4605";
   };
-  caadar = {
-    email = "v88m@posteo.net";
-    github = "caadar";
-    githubId = 15320726;
-    name = "Car Cdr";
-  };
   caarlos0 = {
     name = "Carlos A Becker";
     email = "carlos@becker.software";
@@ -17230,6 +17224,11 @@
     githubId = 3789764;
     name = "skykanin";
   };
+  slam-bert = {
+    github = "slam-bert";
+    githubId = 106779009;
+    name = "Slambert";
+  };
   slbtty = {
     email = "shenlebantongying@gmail.com";
     github = "shenlebantongying";

nixos/modules/services/system/kerberos/heimdal.nix

@@ -35,7 +35,7 @@ in
         mkdir -m 0755 -p ${stateDir}
       '';
       serviceConfig.ExecStart =
-        "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+        "${kerberos}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
       restartTriggers = [ kdcConfFile ];
     };
 
@@ -46,7 +46,7 @@ in
         mkdir -m 0755 -p ${stateDir}
       '';
       serviceConfig.ExecStart =
-        "${kerberos}/libexec/heimdal/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+        "${kerberos}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
       restartTriggers = [ kdcConfFile ];
     };
 
@@ -56,7 +56,7 @@ in
       preStart = ''
         mkdir -m 0755 -p ${stateDir}
       '';
-      serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
+      serviceConfig.ExecStart = "${kerberos}/libexec/kpasswdd";
       restartTriggers = [ kdcConfFile ];
     };
 

pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix

@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-vQ5bP2S1McZxD+Mjw0y/+GB8ntv8nQynM1cIWtUK7pU=";
+    hash = "sha256-egslb+8+RsDjpL5xQpdCU3QwFH59grRCkODQnAkZe/0=";
   };
 
-  vendorHash = "sha256-rDmmCwz/+FBzbREKIqwQulcOKwd4Y6/MITyNpB+pfwQ=";
+  vendorHash = "sha256-IFXIr0xYJCKM5VUHQV+4S/+FEAhFEjbMaU+9JWIh8cA=";
 
   patches = [
     ./Disable-inmemory-storage-driver-test.patch

pkgs/build-support/rust/build-rust-package/default.nix

@@ -44,7 +44,8 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
-, auditable ? !cargo-auditable.meta.broken
+# Enable except on aarch64 pkgsStatic, where we use lld for reasons
+, auditable ? !cargo-auditable.meta.broken && !(stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isDarwin)
 
 , depsExtraArgs ? {}
 

pkgs/build-support/rust/hooks/default.nix

@@ -66,10 +66,10 @@
 
         cargoConfig = ''
           [target."${stdenv.buildPlatform.rust.rustcTarget}"]
-          "linker" = "${rust.envVars.ccForBuild}"
+          "linker" = "${rust.envVars.linkerForBuild}"
           ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
             [target."${stdenv.hostPlatform.rust.rustcTarget}"]
-            "linker" = "${rust.envVars.ccForHost}"
+            "linker" = "${rust.envVars.linkerForHost}"
           ''}
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
         '';

pkgs/build-support/rust/lib/default.nix

@@ -12,10 +12,20 @@ rec {
   # hostPlatform-targeted compiler -- for example, `-m64` being
   # passed on a build=x86_64/host=aarch64 compilation.
   envVars = let
+
+    # As a workaround for https://github.com/rust-lang/rust/issues/89626 use lld on pkgsStatic aarch64
+    shouldUseLLD = platform: platform.isAarch64 && platform.isStatic && !stdenv.isDarwin;
+
     ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
     cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+    linkerForBuild = ccForBuild;
+
     ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
     cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+    linkerForHost = if shouldUseLLD stdenv.targetPlatform
+      && !stdenv.cc.bintools.isLLVM
+      then "${buildPackages.lld}/bin/ld.lld"
+      else ccForHost;
 
     # Unfortunately we must use the dangerous `targetPackages` here
     # because hooks are artificially phase-shifted one slot earlier
@@ -23,6 +33,10 @@ rec {
     # a targetPlatform to them).
     ccForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc";
     cxxForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++";
+    linkerForTarget = if shouldUseLLD targetPackages.stdenv.targetPlatform
+      && !targetPackages.stdenv.cc.bintools.isLLVM # whether stdenv's linker is lld already
+      then "${buildPackages.lld}/bin/ld.lld"
+      else ccForTarget;
 
     rustBuildPlatform = stdenv.buildPlatform.rust.rustcTarget;
     rustBuildPlatformSpec = stdenv.buildPlatform.rust.rustcTargetSpec;
@@ -32,9 +46,9 @@ rec {
     rustTargetPlatformSpec = stdenv.targetPlatform.rust.rustcTargetSpec;
   in {
     inherit
-      ccForBuild  cxxForBuild  rustBuildPlatform   rustBuildPlatformSpec
+      ccForBuild  cxxForBuild  linkerForBuild  rustBuildPlatform   rustBuildPlatformSpec
-      ccForHost   cxxForHost   rustHostPlatform    rustHostPlatformSpec
+      ccForHost   cxxForHost   linkerForHost   rustHostPlatform    rustHostPlatformSpec
-      ccForTarget cxxForTarget rustTargetPlatform  rustTargetPlatformSpec;
+      ccForTarget cxxForTarget linkerForTarget rustTargetPlatform  rustTargetPlatformSpec;
 
     # Prefix this onto a command invocation in order to set the
     # variables needed by cargo.
@@ -50,15 +64,15 @@ rec {
     + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
       "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
       "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
-      "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
+      "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForTarget}" \
     '' + ''
       "CC_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${ccForHost}" \
       "CXX_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${cxxForHost}" \
-      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForHost}" \
+      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForHost}" \
     '' + ''
       "CC_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${ccForBuild}" \
       "CXX_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${cxxForBuild}" \
-      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForBuild}" \
+      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForBuild}" \
       "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
       "HOST_CC=${buildPackages.stdenv.cc}/bin/cc" \
       "HOST_CXX=${buildPackages.stdenv.cc}/bin/c++" \

pkgs/build-support/trivial-builders/default.nix

@@ -182,101 +182,32 @@ rec {
         eval "$checkPhase"
       '';
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-     Writes a text file to nix store with no optional parameters available.
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-
-     Example:
-
-
-     # Writes contents of file to /nix/store/<store path>
-     writeText "my-file"
-     ''
-     Contents of File
-     '';
-
-
-  */
   writeText = name: text: writeTextFile { inherit name text; };
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-    Writes a text file to nix store in a specific directory with no
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-    optional parameters available.
-
-    Example:
-
-
-    # Writes contents of file to /nix/store/<store path>/share/my-file
-    writeTextDir "share/my-file"
-     ''
-     Contents of File
-     '';
-
-
-  */
   writeTextDir = path: text: writeTextFile {
     inherit text;
     name = builtins.baseNameOf path;
     destination = "/${path}";
   };
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-    Writes a text file to /nix/store/<store path> and marks the file as
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-    executable.
-
-    If passed as a build input, will be used as a setup hook. This makes setup
-    hooks more efficient to create: you don't need a derivation that copies
-    them to $out/nix-support/setup-hook, instead you can use the file as is.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path> and makes executable
-    writeScript "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
   writeScript = name: text: writeTextFile { inherit name text; executable = true; };
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-    Writes a text file to /nix/store/<store path>/bin/<name> and
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-    marks the file as executable.
-
-    Example:
-
-
-
-    # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-    writeScriptBin "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
   writeScriptBin = name: text: writeTextFile {
     inherit name text;
     executable = true;
     destination = "/bin/${name}";
   };
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-    Similar to writeScript. Writes a Shell script and checks its syntax.
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-    Automatically includes interpreter above the contents passed.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path> and makes executable.
-    writeShellScript "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
   writeShellScript = name: text:
     writeTextFile {
       inherit name;
@@ -290,22 +221,8 @@ rec {
       '';
     };
 
-  /*
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
-    Similar to writeShellScript and writeScriptBin.
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
-    Writes an executable Shell script to /nix/store/<store path>/bin/<name> and checks its syntax.
-    Automatically includes interpreter above the contents passed.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-    writeShellScriptBin "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
   writeShellScriptBin = name: text:
     writeTextFile {
       inherit name;

pkgs/by-name/README.md

@@ -1,11 +1,9 @@
 # Name-based package directories
 
 The structure of this directory maps almost directly to top-level package attributes.
-This is the recommended way to add new top-level packages to Nixpkgs [when possible](#limitations).
+Add new top-level packages to Nixpkgs using this mechanism [whenever possible](#limitations).
 
-Packages found in the named-based structure do not need to be explicitly added to the
+Packages found in the name-based structure are automatically included, without needing to be added to `all-packages.nix`. However if the implicit attribute defaults need to be changed for a package, this [must still be declared in `all-packages.nix`](#changing-implicit-attribute-defaults).
-`top-level/all-packages.nix` file unless they require overriding the default value
-of an implicit attribute (see below).
 
 ## Example
 

pkgs/by-name/au/audio-sharing/package.nix

@@ -0,0 +1,75 @@
+{ appstream-glib
+, cargo
+, desktop-file-utils
+, fetchFromGitLab
+, git
+, glib
+, gst_all_1
+, gtk4
+, lib
+, libadwaita
+, meson
+, ninja
+, nix-update-script
+, pkg-config
+, python3
+, rustPlatform
+, rustc
+, stdenv
+, wrapGAppsHook
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "audio-sharing";
+  version = "0.2.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "AudioSharing";
+    rev = finalAttrs.version;
+    hash = "sha256-ejNktgN9tfi4TzWDQJnESGcBkpvLVH34sukTFCBfo3U=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-c19DxHF4HFN0qTqC2CNzwko79uVeLeyrrXAvuyxeiOQ=";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    cargo
+    desktop-file-utils
+    git
+    meson
+    ninja
+    pkg-config
+    python3
+    rustc
+    wrapGAppsHook
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+  ]);
+
+  buildInputs = [
+    glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good # pulsesrc
+    gst_all_1.gst-rtsp-server
+    gst_all_1.gstreamer
+    gtk4
+    libadwaita
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    homepage = "https://gitlab.gnome.org/World/AudioSharing";
+    description = "Automatically share the current audio playback in the form of an RTSP stream";
+    maintainers = with maintainers; [ benediktbroich ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+})

pkgs/by-name/aw/aws-azure-login/package.nix

@@ -1,5 +1,7 @@
 { lib
+, callPackage
 , stdenv
+, chromium
 , fetchFromGitHub
 , fetchYarnDeps
 , makeWrapper
@@ -7,24 +9,23 @@
 , prefetch-yarn-deps
 , yarn
 }:
-
+stdenv.mkDerivation (finalAttrs: {
-stdenv.mkDerivation rec {
   pname = "aws-azure-login";
   version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "aws-azure-login";
     repo = "aws-azure-login";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-PvPnqaKD98h3dCjEOwF+Uc86xCJzn2b9XNHHn13h/2Y=";
   };
 
   offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = "sha256-SXQPRzF6b1FJl5HkyXNm3kGoNSDXux+0RYXBX93mOts=";
   };
 
-  nativeBuildInputs  = [
+  nativeBuildInputs = [
     makeWrapper
     nodejs
     prefetch-yarn-deps
@@ -60,17 +61,22 @@ stdenv.mkDerivation rec {
     cp -r . "$out/lib/node_modules/aws-azure-login"
 
     makeWrapper "${nodejs}/bin/node" "$out/bin/aws-azure-login" \
-      --add-flags "$out/lib/node_modules/aws-azure-login/lib/index.js"
+      --add-flags "$out/lib/node_modules/aws-azure-login/lib/index.js" \
+      --set PUPPETEER_EXECUTABLE_PATH "${lib.getExe chromium}"
 
     runHook postInstall
   '';
 
+  passthru.tests.aws-azure-login = callPackage ./tests.nix {
+    package = finalAttrs.finalPackage;
+  };
+
   meta = {
     description = "Use Azure AD SSO to log into the AWS via CLI";
     homepage = "https://github.com/aws-azure-login/aws-azure-login";
     license = lib.licenses.mit;
     mainProgram = "aws-azure-login";
-    maintainers = with lib.maintainers; [ yurrriq ];
+    maintainers = with lib.maintainers; [ l0b0 ];
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/aw/aws-azure-login/tests.nix

@@ -0,0 +1,24 @@
+{ lib
+, runCommand
+, package
+}:
+  runCommand "${package.pname}-tests"
+    {
+      HOME = "/tmp/home";
+    } ''
+    mkdir -p "''${HOME}/.aws"
+    cat > "''${HOME}/.aws/config" <<'EOF'
+    [profile my-profile]
+    azure_tenant_id=3f03e308-ada1-45f7-9cc3-ab777eaba2d3
+    azure_app_id_uri=4fbf61f5-7302-42e5-9585-b18ad0e4649d
+    azure_default_username=user@example.org
+    azure_default_role_arn=
+    azure_default_duration_hours=1
+    azure_default_remember_me=false
+    EOF
+
+    ! ${lib.getExe package} --profile=my-profile 2> stderr
+    [[ "$(cat stderr)" == 'Unable to recognize page state! A screenshot has been dumped to aws-azure-login-unrecognized-state.png. If this problem persists, try running with --mode=gui or --mode=debug' ]]
+
+    touch $out
+  ''

pkgs/by-name/di/disk-filltest/package.nix

@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "disk-filltest";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "bingmann";
+    repo = "disk-filltest";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cppofTzzJHrvG5SsafKgvCIiHc6E5740NyQdWWZxrGI=";
+  };
+
+  outputs = [ "out" "doc" "man" ];
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "prefix=${placeholder "out"}"
+    "man1dir=${placeholder "man"}/share/man/man1"
+  ];
+
+  postInstall = ''
+    install -D -m0644 -t $doc/share/doc/disk-filltest README
+  '';
+
+  meta = {
+    homepage = "https://panthema.net/2013/disk-filltest";
+    description = "Simple program to detect bad disks by filling them with random data";
+    longDescription = ''
+      disk-filltest is a tool to check storage disks for coming failures by
+      write files with pseudo-random data to the current directory until the
+      disk is full, read the files again and verify the sequence written. It
+      also can measure read/write speed while filling the disk.
+    '';
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "disk-filltest";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/gt/gtklp/package.nix

@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, autoreconfHook
+, cups
+, fetchurl
+, gettext
+, glib
+, gtk2
+, libtool
+, openssl
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklp";
+  version = "1.3.4";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/gtklp/gtklp-${finalAttrs.version}.src.tar.gz";
+    hash = "sha256-vgdgkEJZX6kyA047LXA4zvM5AewIY/ztu1GIrLa1O6s=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    cups
+  ];
+
+  buildInputs = [
+    cups
+    gettext
+    glib
+    gtk2
+    libtool
+    openssl
+  ];
+
+  outputs = [ "out" "doc" "man" ];
+
+  strictDeps = true;
+
+  patches = [
+    ./000-autoconf.patch
+    ./001-format-parameter.patch
+  ];
+
+  # Workaround build failure on -fno-common toolchains:
+  #   ld: libgtklp.a(libgtklp.o):libgtklp/libgtklp.h:83: multiple definition of `progressBar';
+  #     file.o:libgtklp/libgtklp.h:83: first defined here
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
+  postPatch = ''
+    substituteInPlace include/defaults.h \
+      --replace "netscape" "firefox" \
+      --replace "http://localhost:631/sum.html#STANDARD_OPTIONS" \
+                "http://localhost:631/help/"
+  '';
+
+  preInstall = ''
+    install -D -m0644 -t $doc/share/doc AUTHORS BUGS ChangeLog README USAGE
+  '';
+
+  meta = {
+    homepage = "https://gtklp.sirtobi.com";
+    description = "A GTK-based graphical frontend for CUPS";
+    license = with lib.licenses; [ gpl2Only ];
+    mainProgram = "gtklp";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/py/pyprland/package.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "1.6.10";
+  version = "1.6.11";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
     owner = "hyprland-community";
     repo = "pyprland";
     rev = version;
-    hash = "sha256-1JPEAVfGkIE3pRS1JNQJQXUI4YjtO/M6MpD7Q0pPR3E=";
+    hash = "sha256-intrvN6sPaokcY9If2GZvDaFdDFcHg4hO7LXXu0pLXU=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];

pkgs/by-name/rm/rmg/package.nix

@@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, boost
+, cmake
+, discord-rpc
+, freetype
+, hidapi
+, libpng
+, libsamplerate
+, minizip
+, nasm
+, pkg-config
+, qt6Packages
+, SDL2
+, speexdsp
+, vulkan-headers
+, vulkan-loader
+, which
+, xdg-user-dirs
+, zlib
+}:
+
+let
+  inherit (qt6Packages) qtbase qtsvg wrapQtAppsHook;
+in
+stdenv.mkDerivation rec {
+  pname = "rmg";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "Rosalie241";
+    repo = "RMG";
+    rev = "v${version}";
+    hash = "sha256-SAQJKfYoouJ2DLVks6oXiyiOI2/kgmyaHqt/FRfqKjI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    nasm
+    pkg-config
+    wrapQtAppsHook
+    which
+  ];
+
+  buildInputs = [
+    boost
+    discord-rpc
+    freetype
+    hidapi
+    libpng
+    libsamplerate
+    minizip
+    qtbase
+    qtsvg
+    SDL2
+    speexdsp
+    vulkan-headers
+    vulkan-loader
+    xdg-user-dirs
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DPORTABLE_INSTALL=OFF"
+    # mupen64plus-input-gca is written in Rust, so we can't build it with
+    # everything else.
+    "-DNO_RUST=ON"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Rosalie241/RMG";
+    description = "Rosalie's Mupen GUI";
+    longDescription = ''
+      Rosalie's Mupen GUI is a free and open-source mupen64plus front-end
+      written in C++. It offers a simple-to-use user interface.
+    '';
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    mainProgram = "RMG";
+    maintainers = with maintainers; [ slam-bert ];
+  };
+}

pkgs/by-name/ss/ssh-askpass-fullscreen/package.nix

@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gtk2
+, openssh
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssh-askpass-fullscreen";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "atj";
+    repo = "ssh-askpass-fullscreen";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-1GER+SxTpbMiYLwFCwLX/hLvzCIqutyvQc9DNJ7d1C0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk2
+    openssh
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://github.com/atj/ssh-askpass-fullscreen";
+    broken = stdenv.isDarwin;
+    description = "A small, fullscreen SSH askpass GUI using GTK+2";
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "ssh-askpass-fullscreen";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/zi/zircolite/package.nix

@@ -6,16 +6,18 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "zircolite";
-  version = "2.9.9";
+  version = "2.10.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "wagga40";
     repo = "Zircolite";
     rev = "refs/tags/${version}";
-    hash = "sha256-De1FLeYZY9eiBW18AVAMtYysC0b8AzO5HtFKxyzK9GY=";
+    hash = "sha256-r5MIoP+6CnAGsOtK4YLshLBVSZN2NVrwnkuHHDdLZrQ=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeBuildInputs = [
     makeWrapper
   ];

pkgs/development/libraries/kerberos/heimdal-make-missing-headers.patch

@@ -1,10 +0,0 @@
---- a/lib/hx509/Makefile.am 2018-03-21 15:41:38.622968809 +0100
-+++ b/lib/hx509/Makefile.am 2018-03-21 15:41:32.655162197 +0100
-@@ -9,6 +9,8 @@
-	sel-gram.h			\
-	$(gen_files_ocsp:.x=.c)		\
-	$(gen_files_pkcs10:.x=.c)	\
-+	ocsp_asn1.h			\
-+	pkcs10_asn1.h			\
-	hx509_err.c			\
-	hx509_err.h

pkgs/development/libraries/kerberos/heimdal.nix

@@ -1,63 +1,138 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, python3, perl, bison, flex
+{ lib
-, texinfo, perlPackages
+, stdenv
-, openldap, libcap_ng, sqlite, openssl, db, libedit, pam
+, fetchFromGitHub
-, CoreFoundation, Security, SystemConfiguration
+, autoreconfHook
+, pkg-config
+, python3
+, perl
+, bison
+, flex
+, texinfo
+, perlPackages
+
+, openldap
+, libcap_ng
+, sqlite
+, openssl
+, db
+, libedit
+, pam
+, krb5
+, libmicrohttpd
+, cjson
+
+, CoreFoundation
+, Security
+, SystemConfiguration
+
+, curl
+, jdk
+, unzip
+, which
+
+, nixosTests
+
+, withCJSON ? true
+, withCapNG ? stdenv.isLinux
+# libmicrohttpd should theoretically work for darwin as well, but something is broken.
+# It affects tests check-bx509d and check-httpkadmind.
+, withMicroHTTPD ? stdenv.isLinux
+, withOpenLDAP ? true
+, withOpenLDAPAsHDBModule ? false
+, withOpenSSL ? true
+, withSQLite3 ? true
 }:
 
-stdenv.mkDerivation rec {
+assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
+  OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
+'';
+
+stdenv.mkDerivation {
   pname = "heimdal";
-  version = "7.8.0";
+  version = "7.8.0-unstable-2023-11-29";
 
   src = fetchFromGitHub {
     owner = "heimdal";
     repo = "heimdal";
-    rev = "heimdal-${version}";
+    rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
-    sha256 = "sha256-iXOaar1S3y0xHdL0S+vS0uxoFQjy43kABxqE+KEhxjU=";
+    hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
   };
 
   outputs = [ "out" "dev" "man" "info" ];
 
-  patches = [ ./heimdal-make-missing-headers.patch ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+    perl
+    bison
+    flex
+    texinfo
+  ]
+  ++ (with perlPackages; [ JSON ]);
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python3 perl bison flex texinfo ]
+  buildInputs = [ db libedit pam ]
-    ++ (with perlPackages; [ JSON ]);
+    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
-  buildInputs = lib.optionals (stdenv.isLinux) [ libcap_ng ]
+    ++ lib.optionals (withCJSON) [ cjson ]
-    ++ [ db sqlite openssl libedit openldap pam]
+    ++ lib.optionals (withCapNG) [ libcap_ng ]
-    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ];
+    ++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
+    ++ lib.optionals (withOpenLDAP) [ openldap ]
+    ++ lib.optionals (withOpenSSL) [ openssl ]
+    ++ lib.optionals (withSQLite3) [ sqlite ];
 
-  ## ugly, X should be made an option
+  doCheck = true;
-  configureFlags = [
+  nativeCheckInputs = [
-    "--sysconfdir=/etc"
+    curl
-    "--localstatedir=/var"
+    jdk
-    "--infodir=$info/share/info"
+    unzip
-    "--enable-hdb-openldap-module"
+    which
-    "--with-sqlite3=${sqlite.dev}"
-
-  # ugly, --with-libedit is not enought, it fall back to bundled libedit
-    "--with-libedit-include=${libedit.dev}/include"
-    "--with-libedit-lib=${libedit}/lib"
-    "--with-openssl=${openssl.dev}"
-    "--without-x"
-    "--with-berkeley-db"
-    "--with-berkeley-db-include=${db.dev}/include"
-    "--with-openldap=${openldap.dev}"
-  ] ++ lib.optionals (stdenv.isLinux) [
-    "--with-capng"
   ];
 
-  postUnpack = ''
+  configureFlags = [
-    sed -i '/^DEFAULT_INCLUDES/ s,$, -I..,' source/cf/Makefile.am.common
+    "--with-libedit-include=${libedit.dev}/include"
-    sed -i -e 's/date/date --date="@$SOURCE_DATE_EPOCH"/' source/configure.ac
+    "--with-libedit-lib=${libedit}/lib"
+    "--with-berkeley-db-include=${db.dev}/include"
+    "--with-berkeley-db"
+
+    "--without-x"
+    "--disable-afs-string-to-key"
+  ] ++ lib.optionals (withCapNG) [
+    "--with-capng"
+  ] ++ lib.optionals (withCJSON) [
+    "--with-cjson=${cjson}"
+  ] ++ lib.optionals (withOpenLDAP) [
+    "--with-openldap=${openldap.dev}"
+  ] ++ lib.optionals (withOpenLDAPAsHDBModule) [
+    "--enable-hdb-openldap-module"
+  ] ++ lib.optionals (withSQLite3) [
+    "--with-sqlite3=${sqlite.dev}"
+  ];
+
+  # (check-ldap) slapd resides within ${openldap}/libexec,
+  #              which is not part of $PATH by default.
+  # (check-ldap) prepending ${openldap}/bin to the path to avoid
+  #              using the default installation of openldap on unsandboxed darwin systems,
+  #              which does not support the new mdb backend at the moment (2024-01-13).
+  # (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
+  #              but the heimdal tests still seem to expect bdb as the openldap backend.
+  #              This might be fixed upstream in a future update.
+  patchPhase = ''
+    runHook prePatch
+
+    substituteInPlace tests/ldap/slapd-init.in \
+      --replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
+    substituteInPlace tests/ldap/check-ldap.in \
+      --replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
+    substituteInPlace tests/ldap/slapd.conf \
+      --replace 'database	bdb' 'database mdb'
+
+    runHook postPatch
   '';
 
-  preConfigure = ''
+  # (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
-    configureFlagsArray+=(
+  #           which expects either USER or LOGNAME to be set.
-      "--bindir=$out/bin"
+  preCheck = lib.optionalString (stdenv.isDarwin) ''
-      "--sbindir=$out/sbin"
+    export USER=nix-builder
-      "--libexecdir=$out/libexec/heimdal"
-      "--mandir=$man/share/man"
-      "--infodir=$man/share/info"
-      "--includedir=$dev/include")
   '';
 
   # We need to build hcrypt for applications like samba
@@ -71,15 +146,12 @@ stdenv.mkDerivation rec {
     (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
     (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
 
-    # Do we need it?
-    rm $out/bin/su
-
     mkdir -p $dev/bin
     mv $out/bin/krb5-config $dev/bin/
 
     # asn1 compilers, move them to $dev
-    mv $out/libexec/heimdal/heimdal/* $dev/bin
+    mv $out/libexec/heimdal/* $dev/bin
-    rmdir $out/libexec/heimdal/heimdal
+    rmdir $out/libexec/heimdal
 
     # compile_et is needed for cross-compiling this package and samba
     mv lib/com_err/.libs/compile_et $dev/bin
@@ -90,11 +162,17 @@ stdenv.mkDerivation rec {
   #  hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
   #enableParallelBuilding = true;
 
+  passthru = {
+    implementation = "heimdal";
+    tests.nixos = nixosTests.kerberos.heimdal;
+  };
+
   meta = with lib; {
+    homepage = "https://www.heimdal.software";
+    changelog = "https://github.com/heimdal/heimdal/releases";
     description = "An implementation of Kerberos 5 (and some more stuff)";
     license = licenses.bsd3;
     platforms = platforms.unix;
+    maintainers = with maintainers; [ h7x4 ];
   };
-
-  passthru.implementation = "heimdal";
 }

pkgs/development/lisp-modules/nix-cl.nix

@@ -145,7 +145,7 @@ let
       ...
     } @ args:
 
-    stdenv.mkDerivation (rec {
+    (stdenv.mkDerivation (rec {
       inherit
         version nativeLibs javaLibs lispLibs systems asds
         pkg program flags faslExt
@@ -226,7 +226,14 @@ let
       meta = (args.meta or {}) // {
         maintainers = args.meta.maintainers or lib.teams.lisp.members;
       };
-    })));
+    })) // {
+      # Useful for overriding
+      # Overriding code would prefer to use pname from the attribute set
+      # However, pname is extended with the implementation name
+      # Moreover, it is used in the default list of systems to load
+      # So we pass the original pname
+      pname = args.pname;
+    }));
 
   # Build the set of lisp packages using `lisp`
   # These packages are defined manually for one reason or another:

pkgs/development/python-modules/nose-warnings-filters/default.nix

@@ -6,12 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "nose_warnings_filters";
+  pname = "nose-warnings-filters";
   version = "0.1.5";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "nose_warnings_filters";
+    inherit version;
     sha256 = "17dvfqfy2fm7a5cmiffw2dc3064kpx72fn5mlw01skm2rhn5nv25";
   };
 

pkgs/development/python-modules/pdoc-pyo3-sample-library/default.nix

@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, rustPlatform
+, cargo
+, rustc
+, libiconv
+}:
+
+buildPythonPackage rec {
+  pname = "pdoc-pyo3-sample-library";
+  version = "1.0.11";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "pdoc_pyo3_sample_library";
+    inherit version;
+    hash = "sha256-ZGMo7WgymkSDQu8tc4rTfWNsIWO0AlDPG0OzpKRq3oA=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit pname version src;
+    hash = "sha256-KrEBr998AV/bKcIoq0tX72/QwPD9bQplrS0Zw+JiSMQ=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    cargo
+    rustc
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
+
+  pythonImportsCheck = [ "pdoc_pyo3_sample_library" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = {
+    description = "A sample PyO3 library used in pdoc tests";
+    homepage = "https://github.com/mitmproxy/pdoc-pyo3-sample-library";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.pbsds ];
+  };
+}

pkgs/development/python-modules/pdoc/default.nix

@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , setuptools
 , jinja2
+, pdoc-pyo3-sample-library
 , pygments
 , markupsafe
 , astunparse
@@ -13,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "pdoc";
-  version = "14.1.0";
+  version = "14.2.0";
   disabled = pythonOlder "3.8";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitmproxy";
     repo = "pdoc";
     rev = "v${version}";
-    hash = "sha256-LQXhdzocw01URrmpDayK9rpsArvM/E44AE8Eok9DBwk=";
+    hash = "sha256-Mmmq4jqRQow+1jn5ZDVMtP1uxrYgHJK/IQrwFWNw8ag=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     hypothesis
+    pdoc-pyo3-sample-library
   ];
   disabledTestPaths = [
     # "test_snapshots" tries to match generated output against stored snapshots,

pkgs/development/python-modules/pure-protobuf/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "3.0.0";
+  version = "2.3.0";  # Komikku not launching w/ 3.0.0, #280551
 
   format = "pyproject";
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     rev = "refs/tags/${version}";
-    hash = "sha256-MjxJTX672LSEqZkH39vTD/+IhCTp6FL2z15S7Lxj6Dc=";
+    hash = "sha256-nJ3F8dUrqMeWqTV9ErGqrMvofJwBKwNUDfxWIqFh4nY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyopengl/default.nix

@@ -23,22 +23,26 @@ buildPythonPackage rec {
     # Theses lines are patching the name of dynamic libraries
     # so pyopengl can find them at runtime.
     substituteInPlace OpenGL/platform/glx.py \
-      --replace "'GL'" "'${pkgs.libGL}/lib/libGL${ext}'" \
+      --replace '"OpenGL",' '"${pkgs.libGL}/lib/libOpenGL${ext}",' \
-      --replace "'GLU'" "'${pkgs.libGLU}/lib/libGLU${ext}'" \
+      --replace '"GL",' '"${pkgs.libGL}/lib/libGL${ext}",' \
-      --replace "'glut'" "'${pkgs.freeglut}/lib/libglut${ext}'" \
+      --replace '"GLU",' '"${pkgs.libGLU}/lib/libGLU${ext}",' \
-      --replace "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
+      --replace '"GLX",' '"${pkgs.libglvnd}/lib/libGLX${ext}",' \
-      --replace "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}',"
+      --replace '"glut",' '"${pkgs.freeglut}/lib/libglut${ext}",' \
+      --replace '"GLESv1_CM",' '"${pkgs.libGL}/lib/libGLESv1_CM${ext}",' \
+      --replace '"GLESv2",' '"${pkgs.libGL}/lib/libGLESv2${ext}",' \
+      --replace '"gle",' '"${pkgs.gle}/lib/libgle${ext}",' \
+      --replace "'EGL'" "'${pkgs.libGL}/lib/libEGL${ext}'"
     substituteInPlace OpenGL/platform/egl.py \
       --replace "('OpenGL','GL')" "('${pkgs.libGL}/lib/libOpenGL${ext}', '${pkgs.libGL}/lib/libGL${ext}')" \
       --replace "'GLU'," "'${pkgs.libGLU}/lib/libGLU${ext}'," \
       --replace "'glut'," "'${pkgs.freeglut}/lib/libglut${ext}'," \
       --replace "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
       --replace "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}'," \
+      --replace "'gle'," '"${pkgs.gle}/lib/libgle${ext}",' \
       --replace "'EGL'," "'${pkgs.libGL}/lib/libEGL${ext}',"
     substituteInPlace OpenGL/platform/darwin.py \
       --replace "'OpenGL'," "'${pkgs.libGL}/lib/libGL${ext}'," \
       --replace "'GLUT'," "'${pkgs.freeglut}/lib/libglut${ext}',"
-    # TODO: patch 'gle' in OpenGL/platform/egl.py
   '' + ''
     # https://github.com/NixOS/nixpkgs/issues/76822
     # pyopengl introduced a new "robust" way of loading libraries in 3.1.4.
@@ -48,7 +52,7 @@ buildPythonPackage rec {
     # The following patch put back the "name" (i.e. the path) in the
     # list of possible files.
     substituteInPlace OpenGL/platform/ctypesloader.py \
-      --replace "filenames_to_try = []" "filenames_to_try = [name]"
+      --replace "filenames_to_try = [base_name]" "filenames_to_try = [name]"
   '';
 
   # Need to fix test runner
@@ -61,7 +65,7 @@ buildPythonPackage rec {
   pythonImportsCheck = "OpenGL";
 
   meta = with lib; {
-    homepage = "https://pyopengl.sourceforge.net/";
+    homepage = "https://mcfletch.github.io/pyopengl/";
     description = "PyOpenGL, the Python OpenGL bindings";
     longDescription = ''
       PyOpenGL is the cross platform Python binding to OpenGL and

pkgs/test/nixpkgs-check-by-name/README.md

@@ -45,6 +45,8 @@ The current ratchets are:
 
 - New manual definitions of `pkgs.${name}` (e.g. in `pkgs/top-level/all-packages.nix`) with `args = { }`
   (see [nix evaluation checks](#nix-evaluation-checks)) must not be introduced.
+- New top-level packages defined using `pkgs.callPackage` must be defined with a package directory.
+  - Once a top-level package uses `pkgs/by-name`, it also can't be moved back out of it.
 
 ## Development
 

pkgs/test/nixpkgs-check-by-name/default.nix

@@ -9,6 +9,7 @@
 }:
 let
   runtimeExprPath = ./src/eval.nix;
+  nixpkgsLibPath = ../../../lib;
   package =
     rustPlatform.buildRustPackage {
       name = "nixpkgs-check-by-name";
@@ -30,6 +31,8 @@ let
         export NIX_STATE_DIR=$TEST_ROOT/var/nix
         export NIX_STORE_DIR=$TEST_ROOT/store
 
+        export NIXPKGS_LIB_PATH=${nixpkgsLibPath}
+
         # Ensure that even if tests run in parallel, we don't get an error
         # We'd run into https://github.com/NixOS/nix/issues/2706 unless the store is initialised first
         nix-store --init
@@ -44,6 +47,7 @@ let
       '';
       passthru.shell = mkShell {
         env.NIX_CHECK_BY_NAME_EXPR_PATH = toString runtimeExprPath;
+        env.NIXPKGS_LIB_PATH = toString nixpkgsLibPath;
         inputsFrom = [ package ];
       };
     };

pkgs/test/nixpkgs-check-by-name/src/eval.nix

@@ -79,15 +79,37 @@ let
         };
       };
 
-  attrInfos = map (name: [
+  byNameAttrs = builtins.listToAttrs (map (name: {
-    name
+    inherit name;
-    (
+    value.ByName =
       if ! pkgs ? ${name} then
         { Missing = null; }
       else
-        { Existing = attrInfo name pkgs.${name}; }
+        { Existing = attrInfo name pkgs.${name}; };
-    )
+  }) attrs);
-  ]) attrs;
 
+  # Information on all attributes that exist but are not in pkgs/by-name.
+  # We need this to enforce pkgs/by-name for new packages
+  nonByNameAttrs = builtins.mapAttrs (name: value:
+    let
+      output = attrInfo name value;
+      result = builtins.tryEval (builtins.deepSeq output null);
+    in
+    {
+      NonByName =
+        if result.success then
+          { EvalSuccess = output; }
+        else
+          { EvalFailure = null; };
+    }
+  ) (builtins.removeAttrs pkgs attrs);
+
+  # All attributes
+  attributes = byNameAttrs // nonByNameAttrs;
 in
-attrInfos
+# We output them in the form [ [ <name> <value> ] ]` such that the Rust side
+# doesn't need to sort them again to get deterministic behavior (good for testing)
+map (name: [
+  name
+  attributes.${name}
+]) (builtins.attrNames attributes)

pkgs/test/nixpkgs-check-by-name/src/eval.rs

@@ -2,6 +2,8 @@ use crate::nixpkgs_problem::NixpkgsProblem;
 use crate::ratchet;
 use crate::structure;
 use crate::validation::{self, Validation::Success};
+use std::collections::HashMap;
+use std::ffi::OsString;
 use std::path::Path;
 
 use anyhow::Context;
@@ -11,6 +13,21 @@ use std::process;
 use tempfile::NamedTempFile;
 
 /// Attribute set of this structure is returned by eval.nix
+#[derive(Deserialize)]
+enum Attribute {
+    /// An attribute that should be defined via pkgs/by-name
+    ByName(ByNameAttribute),
+    /// An attribute not defined via pkgs/by-name
+    NonByName(NonByNameAttribute),
+}
+
+#[derive(Deserialize)]
+enum NonByNameAttribute {
+    /// The attribute doesn't evaluate
+    EvalFailure,
+    EvalSuccess(AttributeInfo),
+}
+
 #[derive(Deserialize)]
 enum ByNameAttribute {
     /// The attribute doesn't exist at all
@@ -56,7 +73,7 @@ enum CallPackageVariant {
 pub fn check_values(
     nixpkgs_path: &Path,
     package_names: Vec<String>,
-    eval_accessible_paths: &[&Path],
+    eval_nix_path: &HashMap<String, PathBuf>,
 ) -> validation::Result<ratchet::Nixpkgs> {
     // Write the list of packages we need to check into a temporary JSON file.
     // This can then get read by the Nix evaluation.
@@ -105,9 +122,13 @@ pub fn check_values(
         .arg(nixpkgs_path);
 
     // Also add extra paths that need to be accessible
-    for path in eval_accessible_paths {
+    for (name, path) in eval_nix_path {
         command.arg("-I");
-        command.arg(path);
+        let mut name_value = OsString::new();
+        name_value.push(name);
+        name_value.push("=");
+        name_value.push(path);
+        command.arg(name_value);
     }
     command.args(["-I", &expr_path]);
     command.arg(expr_path);
@@ -120,7 +141,7 @@ pub fn check_values(
         anyhow::bail!("Failed to run command {command:?}");
     }
     // Parse the resulting JSON value
-    let attributes: Vec<(String, ByNameAttribute)> = serde_json::from_slice(&result.stdout)
+    let attributes: Vec<(String, Attribute)> = serde_json::from_slice(&result.stdout)
         .with_context(|| {
             format!(
                 "Failed to deserialise {}",
@@ -133,30 +154,86 @@ pub fn check_values(
             let relative_package_file = structure::relative_file_for_package(&attribute_name);
 
             use ratchet::RatchetState::*;
+            use Attribute::*;
             use AttributeInfo::*;
             use ByNameAttribute::*;
             use CallPackageVariant::*;
+            use NonByNameAttribute::*;
 
             let check_result = match attribute_value {
-                Missing => NixpkgsProblem::UndefinedAttr {
+                // The attribute succeeds evaluation and is NOT defined in pkgs/by-name
+                NonByName(EvalSuccess(attribute_info)) => {
+                    let uses_by_name = match attribute_info {
+                        // In these cases the package doesn't qualify for being in pkgs/by-name,
+                        // so the UsesByName ratchet is already as tight as it can be
+                        NonAttributeSet => Success(Tight),
+                        NonCallPackage => Success(Tight),
+                        // This is an odd case when _internalCallByNamePackageFile is used to define a package.
+                        CallPackage(CallPackageInfo {
+                            call_package_variant: Auto,
+                            ..
+                        }) => NixpkgsProblem::InternalCallPackageUsed {
+                            attr_name: attribute_name.clone(),
+                        }
+                        .into(),
+                        // Only derivations can be in pkgs/by-name,
+                        // so this attribute doesn't qualify
+                        CallPackage(CallPackageInfo {
+                            is_derivation: false,
+                            ..
+                        }) => Success(Tight),
+
+                        // The case of an attribute that qualifies:
+                        // - Uses callPackage
+                        // - Is a derivation
+                        CallPackage(CallPackageInfo {
+                            is_derivation: true,
+                            call_package_variant: Manual { path, empty_arg },
+                        }) => Success(Loose(ratchet::UsesByName {
+                            call_package_path: path,
+                            empty_arg,
+                        })),
+                    };
+                    uses_by_name.map(|x| ratchet::Package {
+                        empty_non_auto_called: Tight,
+                        uses_by_name: x,
+                    })
+                }
+                NonByName(EvalFailure) => {
+                    // This is a bit of an odd case: We don't even _know_ whether this attribute
+                    // would qualify for using pkgs/by-name. We can either:
+                    // - Assume it's not using pkgs/by-name, which has the problem that if a
+                    //   package evaluation gets broken temporarily, the fix can remove it from
+                    //   pkgs/by-name again
+                    // - Assume it's using pkgs/by-name already, which has the problem that if a
+                    //   package evaluation gets broken temporarily, fixing it requires a move to
+                    //   pkgs/by-name
+                    // We choose the latter, since we want to move towards pkgs/by-name, not away
+                    // from it
+                    Success(ratchet::Package {
+                        empty_non_auto_called: Tight,
+                        uses_by_name: Tight,
+                    })
+                }
+                ByName(Missing) => NixpkgsProblem::UndefinedAttr {
                     relative_package_file: relative_package_file.clone(),
                     package_name: attribute_name.clone(),
                 }
                 .into(),
-                Existing(NonAttributeSet) => NixpkgsProblem::NonDerivation {
+                ByName(Existing(NonAttributeSet)) => NixpkgsProblem::NonDerivation {
                     relative_package_file: relative_package_file.clone(),
                     package_name: attribute_name.clone(),
                 }
                 .into(),
-                Existing(NonCallPackage) => NixpkgsProblem::WrongCallPackage {
+                ByName(Existing(NonCallPackage)) => NixpkgsProblem::WrongCallPackage {
                     relative_package_file: relative_package_file.clone(),
                     package_name: attribute_name.clone(),
                 }
                 .into(),
-                Existing(CallPackage(CallPackageInfo {
+                ByName(Existing(CallPackage(CallPackageInfo {
                     is_derivation,
                     call_package_variant,
-                })) => {
+                }))) => {
                     let check_result = if !is_derivation {
                         NixpkgsProblem::NonDerivation {
                             relative_package_file: relative_package_file.clone(),
@@ -170,6 +247,7 @@ pub fn check_values(
                     check_result.and(match &call_package_variant {
                         Auto => Success(ratchet::Package {
                             empty_non_auto_called: Tight,
+                            uses_by_name: Tight,
                         }),
                         Manual { path, empty_arg } => {
                             let correct_file = if let Some(call_package_path) = path {
@@ -186,6 +264,7 @@ pub fn check_values(
                                     } else {
                                         Tight
                                     },
+                                    uses_by_name: Tight,
                                 })
                             } else {
                                 NixpkgsProblem::WrongCallPackage {
@@ -203,7 +282,7 @@ pub fn check_values(
     ));
 
     Ok(check_result.map(|elems| ratchet::Nixpkgs {
-        package_names,
+        package_names: elems.iter().map(|(name, _)| name.to_owned()).collect(),
         package_map: elems.into_iter().collect(),
     }))
 }

pkgs/test/nixpkgs-check-by-name/src/main.rs

@@ -12,6 +12,7 @@ use crate::validation::Validation::Success;
 use anyhow::Context;
 use clap::Parser;
 use colored::Colorize;
+use std::collections::HashMap;
 use std::io;
 use std::path::{Path, PathBuf};
 use std::process::ExitCode;
@@ -44,7 +45,12 @@ pub struct Args {
 
 fn main() -> ExitCode {
     let args = Args::parse();
-    match process(&args.base, &args.nixpkgs, &[], &mut io::stderr()) {
+    match process(
+        &args.base,
+        &args.nixpkgs,
+        &HashMap::new(),
+        &mut io::stderr(),
+    ) {
         Ok(true) => {
             eprintln!("{}", "Validated successfully".green());
             ExitCode::SUCCESS
@@ -77,15 +83,15 @@ fn main() -> ExitCode {
 pub fn process<W: io::Write>(
     base_nixpkgs: &Path,
     main_nixpkgs: &Path,
-    eval_accessible_paths: &[&Path],
+    eval_nix_path: &HashMap<String, PathBuf>,
     error_writer: &mut W,
 ) -> anyhow::Result<bool> {
     // Check the main Nixpkgs first
-    let main_result = check_nixpkgs(main_nixpkgs, eval_accessible_paths, error_writer)?;
+    let main_result = check_nixpkgs(main_nixpkgs, eval_nix_path, error_writer)?;
     let check_result = main_result.result_map(|nixpkgs_version| {
         // If the main Nixpkgs doesn't have any problems, run the ratchet checks against the base
         // Nixpkgs
-        check_nixpkgs(base_nixpkgs, eval_accessible_paths, error_writer)?.result_map(
+        check_nixpkgs(base_nixpkgs, eval_nix_path, error_writer)?.result_map(
             |base_nixpkgs_version| {
                 Ok(ratchet::Nixpkgs::compare(
                     base_nixpkgs_version,
@@ -113,7 +119,7 @@ pub fn process<W: io::Write>(
 /// ratchet check against another result.
 pub fn check_nixpkgs<W: io::Write>(
     nixpkgs_path: &Path,
-    eval_accessible_paths: &[&Path],
+    eval_nix_path: &HashMap<String, PathBuf>,
     error_writer: &mut W,
 ) -> validation::Result<ratchet::Nixpkgs> {
     Ok({
@@ -134,7 +140,7 @@ pub fn check_nixpkgs<W: io::Write>(
         } else {
             check_structure(&nixpkgs_path)?.result_map(|package_names|
                 // Only if we could successfully parse the structure, we do the evaluation checks
-                eval::check_values(&nixpkgs_path, package_names, eval_accessible_paths))?
+                eval::check_values(&nixpkgs_path, package_names, eval_nix_path))?
         }
     })
 }
@@ -144,8 +150,10 @@ mod tests {
     use crate::process;
     use crate::utils;
     use anyhow::Context;
+    use std::collections::HashMap;
     use std::fs;
     use std::path::Path;
+    use std::path::PathBuf;
     use tempfile::{tempdir_in, TempDir};
 
     #[test]
@@ -226,7 +234,19 @@ mod tests {
     }
 
     fn test_nixpkgs(name: &str, path: &Path, expected_errors: &str) -> anyhow::Result<()> {
-        let extra_nix_path = Path::new("tests/mock-nixpkgs.nix");
+        let eval_nix_path = HashMap::from([
+            (
+                "test-nixpkgs".to_string(),
+                PathBuf::from("tests/mock-nixpkgs.nix"),
+            ),
+            (
+                "test-nixpkgs/lib".to_string(),
+                PathBuf::from(
+                    std::env::var("NIXPKGS_LIB_PATH")
+                        .with_context(|| "Could not get environment variable NIXPKGS_LIB_PATH")?,
+                ),
+            ),
+        ]);
 
         let base_path = path.join("base");
         let base_nixpkgs = if base_path.exists() {
@@ -238,7 +258,7 @@ mod tests {
         // We don't want coloring to mess up the tests
         let writer = temp_env::with_var("NO_COLOR", Some("1"), || -> anyhow::Result<_> {
             let mut writer = vec![];
-            process(base_nixpkgs, &path, &[&extra_nix_path], &mut writer)
+            process(base_nixpkgs, &path, &eval_nix_path, &mut writer)
                 .with_context(|| format!("Failed test case {name}"))?;
             Ok(writer)
         })?;

pkgs/test/nixpkgs-check-by-name/src/nixpkgs_problem.rs

@@ -1,3 +1,4 @@
+use crate::structure;
 use crate::utils::PACKAGE_NIX_FILENAME;
 use rnix::parser::ParseError;
 use std::ffi::OsString;
@@ -87,6 +88,19 @@ pub enum NixpkgsProblem {
         text: String,
         io_error: io::Error,
     },
+    InternalCallPackageUsed {
+        attr_name: String,
+    },
+    MovedOutOfByName {
+        package_name: String,
+        call_package_path: Option<PathBuf>,
+        empty_arg: bool,
+    },
+    NewPackageNotUsingByName {
+        package_name: String,
+        call_package_path: Option<PathBuf>,
+        empty_arg: bool,
+    },
 }
 
 impl fmt::Display for NixpkgsProblem {
@@ -213,6 +227,53 @@ impl fmt::Display for NixpkgsProblem {
                     subpath.display(),
                     text,
                 ),
+            NixpkgsProblem::InternalCallPackageUsed { attr_name } =>
+                write!(
+                    f,
+                    "pkgs.{attr_name}: This attribute is defined using `_internalCallByNamePackageFile`, which is an internal function not intended for manual use.",
+                ),
+            NixpkgsProblem::MovedOutOfByName { package_name, call_package_path, empty_arg } => {
+                let call_package_arg =
+                    if let Some(path) = &call_package_path {
+                        format!("./{}", path.display())
+                    } else {
+                        "...".into()
+                    };
+                if *empty_arg {
+                    write!(
+                        f,
+                        "pkgs.{package_name}: This top-level package was previously defined in {}, but is now manually defined as `callPackage {call_package_arg} {{ }}` (e.g. in `pkgs/top-level/all-packages.nix`). Please move the package back and remove the manual `callPackage`.",
+                        structure::relative_file_for_package(package_name).display(),
+                        )
+                } else {
+                    // This can happen if users mistakenly assume that for custom arguments,
+                    // pkgs/by-name can't be used.
+                    write!(
+                        f,
+                        "pkgs.{package_name}: This top-level package was previously defined in {}, but is now manually defined as `callPackage {call_package_arg} {{ ... }}` (e.g. in `pkgs/top-level/all-packages.nix`). While the manual `callPackage` is still needed, it's not necessary to move the package files.",
+                        structure::relative_file_for_package(package_name).display(),
+                        )
+                }
+            },
+            NixpkgsProblem::NewPackageNotUsingByName { package_name, call_package_path, empty_arg } => {
+                let call_package_arg =
+                    if let Some(path) = &call_package_path {
+                        format!("./{}", path.display())
+                    } else {
+                        "...".into()
+                    };
+                let extra =
+                    if *empty_arg {
+                        "Since the second `callPackage` argument is `{ }`, no manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is needed anymore."
+                    } else {
+                        "Since the second `callPackage` argument is not `{ }`, the manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is still needed."
+                    };
+                write!(
+                    f,
+                    "pkgs.{package_name}: This is a new top-level package of the form `callPackage {call_package_arg} {{ }}`. Please define it in {} instead. See `pkgs/by-name/README.md` for more details. {extra}",
+                    structure::relative_file_for_package(package_name).display(),
+                )
+            },
         }
     }
 }

pkgs/test/nixpkgs-check-by-name/src/ratchet.rs

@@ -6,11 +6,12 @@ use crate::nixpkgs_problem::NixpkgsProblem;
 use crate::structure;
 use crate::validation::{self, Validation, Validation::Success};
 use std::collections::HashMap;
+use std::path::PathBuf;
 
 /// The ratchet value for the entirety of Nixpkgs.
 #[derive(Default)]
 pub struct Nixpkgs {
-    /// Sorted list of attributes in package_map
+    /// Sorted list of packages in package_map
     pub package_names: Vec<String>,
     /// The ratchet values for all packages
     pub package_map: HashMap<String, Package>,
@@ -29,20 +30,30 @@ impl Nixpkgs {
     }
 }
 
-/// The ratchet value for a single package in `pkgs/by-name`
+/// The ratchet value for a top-level package
 pub struct Package {
     /// The ratchet value for the check for non-auto-called empty arguments
     pub empty_non_auto_called: RatchetState<EmptyNonAutoCalled>,
+
+    /// The ratchet value for the check for new packages using pkgs/by-name
+    pub uses_by_name: RatchetState<UsesByName>,
 }
 
 impl Package {
-    /// Validates the ratchet checks for a single package defined in `pkgs/by-name`
+    /// Validates the ratchet checks for a top-level package
     pub fn compare(name: &str, optional_from: Option<&Self>, to: &Self) -> Validation<()> {
-        RatchetState::<EmptyNonAutoCalled>::compare(
+        validation::sequence_([
-            name,
+            RatchetState::<EmptyNonAutoCalled>::compare(
-            optional_from.map(|x| &x.empty_non_auto_called),
+                name,
-            &to.empty_non_auto_called,
+                optional_from.map(|x| &x.empty_non_auto_called),
-        )
+                &to.empty_non_auto_called,
+            ),
+            RatchetState::<UsesByName>::compare(
+                name,
+                optional_from.map(|x| &x.uses_by_name),
+                &to.uses_by_name,
+            ),
+        ])
     }
 }
 
@@ -102,3 +113,34 @@ impl ToNixpkgsProblem for EmptyNonAutoCalled {
         }
     }
 }
+
+/// The ratchet value of an attribute
+/// for the check that new packages use pkgs/by-name
+///
+/// This checks that all new package defined using callPackage must be defined via pkgs/by-name
+/// It also checks that once a package uses pkgs/by-name, it can't switch back to all-packages.nix
+#[derive(Clone)]
+pub struct UsesByName {
+    /// The first callPackage argument, used for better errors
+    pub call_package_path: Option<PathBuf>,
+    /// Whether the second callPackage argument is empty, used for better errors
+    pub empty_arg: bool,
+}
+
+impl ToNixpkgsProblem for UsesByName {
+    fn to_nixpkgs_problem(name: &str, a: &Self, existed_before: bool) -> NixpkgsProblem {
+        if existed_before {
+            NixpkgsProblem::MovedOutOfByName {
+                package_name: name.to_owned(),
+                call_package_path: a.call_package_path.clone(),
+                empty_arg: a.empty_arg,
+            }
+        } else {
+            NixpkgsProblem::NewPackageNotUsingByName {
+                package_name: name.to_owned(),
+                call_package_path: a.call_package_path.clone(),
+                empty_arg: a.empty_arg,
+            }
+        }
+    }
+}

pkgs/test/nixpkgs-check-by-name/tests/broken-autocall/default.nix

@@ -1,4 +1,4 @@
 args:
 builtins.removeAttrs
-  (import ../mock-nixpkgs.nix { root = ./.; } args)
+  (import <test-nixpkgs> { root = ./.; } args)
   [ "foo" ]

pkgs/test/nixpkgs-check-by-name/tests/empty-base/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/incorrect-shard/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/internalCallPackage/all-packages.nix

@@ -0,0 +1,3 @@
+self: super: {
+  foo = self._internalCallByNamePackageFile ./foo.nix;
+}

pkgs/test/nixpkgs-check-by-name/tests/internalCallPackage/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/internalCallPackage/expected

@@ -0,0 +1 @@
+pkgs.foo: This attribute is defined using `_internalCallByNamePackageFile`, which is an internal function not intended for manual use.

pkgs/test/nixpkgs-check-by-name/tests/internalCallPackage/foo.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/invalid-package-name/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/invalid-shard-name/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/missing-package-nix/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/mock-nixpkgs.nix

@@ -25,30 +25,14 @@ It returns a Nixpkgs-like function that can be auto-called and evaluates to an a
 let
 
   # Simplified versions of lib functions
-  lib = {
+  lib = import <test-nixpkgs/lib>;
-    fix = f: let x = f x; in x;
-
-    extends = overlay: f: final:
-      let
-        prev = f final;
-      in
-      prev // overlay final prev;
-
-    callPackageWith = autoArgs: fn: args:
-      let
-        f = if builtins.isFunction fn then fn else import fn;
-        fargs = builtins.functionArgs f;
-        allArgs = builtins.intersectAttrs fargs autoArgs // args;
-      in
-      f allArgs;
-
-    isDerivation = value: value.type or null == "derivation";
-  };
 
   # The base fixed-point function to populate the resulting attribute set
   pkgsFun = self: {
     inherit lib;
-    callPackage = lib.callPackageWith self;
+    newScope = extra: lib.callPackageWith (self // extra);
+    callPackage = self.newScope { };
+    callPackages = lib.callPackagesWith self;
     someDrv = { type = "derivation"; };
   };
 

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/all-packages.nix

@@ -0,0 +1,10 @@
+self: super: {
+  foo1 = self.callPackage ({ someDrv }: someDrv) { };
+  foo2 = self.callPackage ./without-config.nix { };
+  foo3 = self.callPackage ({ someDrv, enableFoo }: someDrv) {
+    enableFoo = null;
+  };
+  foo4 = self.callPackage ./with-config.nix {
+    enableFoo = null;
+  };
+}

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/base/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/base/pkgs/by-name/fo/foo1/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/base/pkgs/by-name/fo/foo2/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/base/pkgs/by-name/fo/foo3/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/base/pkgs/by-name/fo/foo4/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/expected

@@ -0,0 +1,4 @@
+pkgs.foo1: This top-level package was previously defined in pkgs/by-name/fo/foo1/package.nix, but is now manually defined as `callPackage ... { }` (e.g. in `pkgs/top-level/all-packages.nix`). Please move the package back and remove the manual `callPackage`.
+pkgs.foo2: This top-level package was previously defined in pkgs/by-name/fo/foo2/package.nix, but is now manually defined as `callPackage ./without-config.nix { }` (e.g. in `pkgs/top-level/all-packages.nix`). Please move the package back and remove the manual `callPackage`.
+pkgs.foo3: This top-level package was previously defined in pkgs/by-name/fo/foo3/package.nix, but is now manually defined as `callPackage ... { ... }` (e.g. in `pkgs/top-level/all-packages.nix`). While the manual `callPackage` is still needed, it's not necessary to move the package files.
+pkgs.foo4: This top-level package was previously defined in pkgs/by-name/fo/foo4/package.nix, but is now manually defined as `callPackage ./with-config.nix { ... }` (e.g. in `pkgs/top-level/all-packages.nix`). While the manual `callPackage` is still needed, it's not necessary to move the package files.

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/with-config.nix

@@ -0,0 +1 @@
+{ someDrv, enableFoo }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/move-to-non-by-name/without-config.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/all-packages.nix

@@ -0,0 +1,11 @@
+self: super: {
+  before = self.callPackage ({ someDrv }: someDrv) { };
+  new1 = self.callPackage ({ someDrv }: someDrv) { };
+  new2 = self.callPackage ./without-config.nix { };
+  new3 = self.callPackage ({ someDrv, enableNew }: someDrv) {
+    enableNew = null;
+  };
+  new4 = self.callPackage ./with-config.nix {
+    enableNew = null;
+  };
+}

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/base/all-packages.nix

@@ -0,0 +1,5 @@
+self: super: {
+
+  before = self.callPackage ({ someDrv }: someDrv) { };
+
+}

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/base/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/expected

@@ -0,0 +1,4 @@
+pkgs.new1: This is a new top-level package of the form `callPackage ... { }`. Please define it in pkgs/by-name/ne/new1/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is `{ }`, no manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is needed anymore.
+pkgs.new2: This is a new top-level package of the form `callPackage ./without-config.nix { }`. Please define it in pkgs/by-name/ne/new2/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is `{ }`, no manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is needed anymore.
+pkgs.new3: This is a new top-level package of the form `callPackage ... { }`. Please define it in pkgs/by-name/ne/new3/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is not `{ }`, the manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is still needed.
+pkgs.new4: This is a new top-level package of the form `callPackage ./with-config.nix { }`. Please define it in pkgs/by-name/ne/new4/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is not `{ }`, the manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is still needed.

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/with-config.nix

@@ -0,0 +1 @@
+{ someDrv, enableNew }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/new-package-non-by-name/without-config.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/no-by-name/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/no-eval/all-packages.nix

@@ -0,0 +1,3 @@
+self: super: {
+  iDontEval = throw "I don't eval";
+}

pkgs/test/nixpkgs-check-by-name/tests/no-eval/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/no-eval/pkgs/by-name/fo/foo/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv

pkgs/test/nixpkgs-check-by-name/tests/non-attrs/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/non-derivation/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/one-letter/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/only-callPackage-derivations/all-packages.nix

@@ -0,0 +1,16 @@
+self: super: {
+  alternateCallPackage = self.myScope.callPackage ({ myScopeValue, someDrv }:
+    assert myScopeValue;
+    someDrv
+  ) { };
+
+  myScope = self.lib.makeScope self.newScope (self: {
+    myScopeValue = true;
+  });
+
+  myPackages = self.callPackages ({ someDrv }: {
+    a = someDrv;
+    b = someDrv;
+  }) { };
+  inherit (self.myPackages) a b;
+}

pkgs/test/nixpkgs-check-by-name/tests/only-callPackage-derivations/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-different-file/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/default.nix

@@ -1 +1 @@
-import ../../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/default.nix

@@ -1 +1 @@
-import ../../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-no-call-package/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-no-file/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/override-success/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/package-dir-is-file/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/package-nix-dir/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-absolute/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-escape/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-nix-path/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-parse-failure/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-path-subexpr/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/ref-success/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/shard-file/default.nix

@@ -1 +1 @@
-import ../mock-nixpkgs.nix { root = ./.; }
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/sorted-order/all-packages.nix

@@ -0,0 +1,6 @@
+self: super: {
+  a = self.callPackage ./pkgs/by-name/a/a/package.nix { };
+  b = self.callPackage ({ someDrv }: someDrv) { };
+  c = self.callPackage ./pkgs/by-name/c/c/package.nix { };
+  d = self.callPackage ({ someDrv }: someDrv) { };
+}

pkgs/test/nixpkgs-check-by-name/tests/sorted-order/default.nix

@@ -0,0 +1 @@
+import <test-nixpkgs> { root = ./.; }

pkgs/test/nixpkgs-check-by-name/tests/sorted-order/expected

@@ -0,0 +1,4 @@
+pkgs.a: This attribute is manually defined (most likely in pkgs/top-level/all-packages.nix), which is only allowed if the definition is of the form `pkgs.callPackage pkgs/by-name/a/a/package.nix { ... }` with a non-empty second argument.
+pkgs.b: This is a new top-level package of the form `callPackage ... { }`. Please define it in pkgs/by-name/b/b/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is `{ }`, no manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is needed anymore.
+pkgs.c: This attribute is manually defined (most likely in pkgs/top-level/all-packages.nix), which is only allowed if the definition is of the form `pkgs.callPackage pkgs/by-name/c/c/package.nix { ... }` with a non-empty second argument.
+pkgs.d: This is a new top-level package of the form `callPackage ... { }`. Please define it in pkgs/by-name/d/d/package.nix instead. See `pkgs/by-name/README.md` for more details. Since the second `callPackage` argument is `{ }`, no manual `callPackage` (e.g. in `pkgs/top-level/all-packages.nix`) is needed anymore.

pkgs/test/nixpkgs-check-by-name/tests/sorted-order/pkgs/by-name/a/a/package.nix

@@ -0,0 +1 @@
+{ someDrv }: someDrv