Merge staging-next into staging

14 files changed, 348 insertions, 129 deletions

diff --git a/doc/contributing/coding-conventions.chapter.md b/doc/contributing/coding-conventions.chapter.md
index 6473fa151a4..585b8d3679c 100644
--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@@ -453,6 +453,9 @@ In the file `pkgs/top-level/all-packages.nix` you can find fetch helpers, these
   }
   ```
 
+When fetching from GitHub, commits must always be referenced by their full commit hash. This is because GitHub shares commit hashes among all forks and returns `404 Not Found` when a short commit hash is ambiguous. It already happens for some short, 6-character commit hashes in `nixpkgs`.
+It is a practical vector for a denial-of-service attack by pushing large amounts of auto generated commits into forks and was already [demonstrated against GitHub Actions Beta](https://blog.teddykatz.com/2019/11/12/github-actions-dos.html).
+
 Find the value to put as `sha256` by running `nix-shell -p nix-prefetch-github --run "nix-prefetch-github --rev 1f795f9f44607cc5bec70d1300150bfefcef2aae NixOS nix"`. 
 
 ## Obtaining source hash {#sec-source-hashes}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a92d096d9fc..e80001cd843 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5643,6 +5643,16 @@
     githubId = 510202;
     name = "Ismaël Bouya";
   };
+  impl = {
+    email = "noah@noahfontes.com";
+    matrix = "@impl:matrix.org";
+    github = "impl";
+    githubId = 41129;
+    name = "Noah Fontes";
+    keys = [{
+      fingerprint = "F5B2 BE1B 9AAD 98FE 2916  5597 3665 FFF7 9D38 7BAA";
+    }];
+  };
   imsofi = {
     email = "sofi+git@mailbox.org";
     github = "imsofi";
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 6a1f199461a..34853b89041 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -15,10 +15,10 @@
 , libgccjit, targetPlatform, makeWrapper # native-comp params
 , fetchFromSavannah
 , systemd ? null
-, withX ? !stdenv.isDarwin
+, withX ? !stdenv.isDarwin && !withPgtk
 , withNS ? stdenv.isDarwin
 , withGTK2 ? false, gtk2-x11 ? null
-, withGTK3 ? false, gtk3-x11 ? null, gsettings-desktop-schemas ? null
+, withGTK3 ? withPgtk, gtk3-x11 ? null, gsettings-desktop-schemas ? null
 , withXwidgets ? false, webkitgtk ? null, wrapGAppsHook ? null, glib-networking ? null
 , withMotif ? false, motif ? null
 , withSQLite3 ? false
@@ -29,7 +29,7 @@
 , nativeComp ? true
 , withAthena ? false
 , withToolkitScrollBars ? true
-, withPgtk ? false
+, withPgtk ? false, gtk3 ? null
 , withXinput2 ? withX && lib.versionAtLeast version "29"
 , withImageMagick ? lib.versionOlder version "27" && (withX || withNS)
 , toolkit ? (
@@ -45,9 +45,10 @@ assert stdenv.isDarwin -> libXaw != null;       # fails to link otherwise
 assert withNS -> !withX;
 assert withNS -> stdenv.isDarwin;
 assert (withGTK2 && !withNS) -> withX;
-assert (withGTK3 && !withNS) -> withX;
-assert withGTK2 -> !withGTK3 && gtk2-x11 != null;
-assert withGTK3 -> !withGTK2 && gtk3-x11 != null;
+assert (withGTK3 && !withNS) -> withX || withPgtk;
+assert withGTK2 -> !withGTK3 && gtk2-x11 != null && !withPgtk;
+assert withGTK3 -> !withGTK2 && ((gtk3-x11 != null) || withPgtk);
+assert withPgtk -> withGTK3 && !withX && gtk3 != null;
 assert withXwidgets -> withGTK3 && webkitgtk != null;
 
 
@@ -134,7 +135,9 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
     ++ lib.optionals withImageMagick [ imagemagick ]
     ++ lib.optionals (stdenv.isLinux && withX) [ m17n_lib libotf ]
     ++ lib.optional (withX && withGTK2) gtk2-x11
-    ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
+    ++ lib.optional (withX && withGTK3) gtk3-x11
+    ++ lib.optional withGTK3 gsettings-desktop-schemas
+    ++ lib.optional withPgtk gtk3
     ++ lib.optional (withX && withMotif) motif
     ++ lib.optional withSQLite3 sqlite
     ++ lib.optional withWebP libwebp
diff --git a/pkgs/applications/misc/warpd/default.nix b/pkgs/applications/misc/warpd/default.nix
index e296eec1b34..185ad94f1a5 100644
--- a/pkgs/applications/misc/warpd/default.nix
+++ b/pkgs/applications/misc/warpd/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "warpd";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "rvaiya";
     repo = "warpd";
     rev = "v${version}";
-    sha256 = "AR/uLgNX1VLPEcfUd8cnplMiaoEJlUxQ55Fst62RnbI=";
+    sha256 = "sha256-QzMtPzuFVN8b4O250G38HAxerZewEu8MV/MDib7gh5A=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index ecca3fd4d2a..29c69389116 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -51,8 +51,7 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ lib.optionals pythonSupport [
-    "--with-python=${python}"
+    (lib.withFeatureAs pythonSupport "python" python)
   ] ++ lib.optionals (!cryptoSupport) [
     "--without-crypto"
   ];
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index 596e5dd0c78..0d297a35a83 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "php-cs-fixer";
-  version = "3.10.0";
+  version = "3.11.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "sha256-dhXktw9wctIwvIlME4c4yBw7qBffetiERt1C6QWCrQo=";
+    sha256 = "sha256-hnSHR/tDX1w/4SV6fafvUHg4JwTQJxfwKaKvEbUWJjs=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
index 8649e069827..dbf5b148b0f 100644
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "faraday-agent-parameters-types";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     pname = "faraday_agent_parameters_types";
     inherit version;
-    sha256 = "6155669db477c3330c0850814eabe231bbbadf9d2ec57b4f734994f76eaee0e7";
+    sha256 = "sha256-ldGCn0VzoMRFekCPMprNLpaL5Jts5MRv5Ym1qoJwjXA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/jam/default.nix b/pkgs/development/tools/build-managers/jam/default.nix
index c4d73785db4..192c27682ab 100644
--- a/pkgs/development/tools/build-managers/jam/default.nix
+++ b/pkgs/development/tools/build-managers/jam/default.nix
@@ -1,45 +1,88 @@
-{ lib, stdenv, fetchurl, bison }:
+{ lib, stdenv, fetchurl, bison, buildPackages }:
 
-stdenv.mkDerivation rec {
-  pname = "jam";
-  version = "2.6.1";
+let
+  mkJam = { meta ? { }, ... } @ args: stdenv.mkDerivation (args // {
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [ bison ];
 
-  src = fetchurl {
-    url = "https://swarm.workshop.perforce.com/projects/perforce_software-jam/download/main/${pname}-${version}.tar";
-    sha256 = "19xkvkpycxfsncxvin6yqrql3x3z9ypc1j8kzls5k659q4kv5rmc";
-  };
+    # Jambase expects ar to have flags.
+    preConfigure = ''
+      export AR="$AR rc"
+    '';
+
+    LOCATE_TARGET = "bin.unix";
 
-  nativeBuildInputs = [ bison ];
+    buildPhase = ''
+      runHook preBuild
+      make $makeFlags jam0
+      ./jam0 -j$NIX_BUILD_CORES -sCC=${buildPackages.stdenv.cc.targetPrefix}cc jambase.c
+      ./jam0 -j$NIX_BUILD_CORES
+      runHook postBuild
+    '';
 
-  preConfigure = ''
-    unset AR
-  '';
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin $out/doc/jam
+      cp bin.unix/jam $out/bin/jam
+      cp *.html $out/doc/jam
+      runHook postInstall
+    '';
 
-  buildPhase = ''
-    runHook preBuild
+    enableParallelBuilding = true;
 
-    make jam0
+    meta = with lib; meta // {
+      license = licenses.free;
+      mainProgram = "jam";
+      platforms = platforms.unix;
+    };
+  });
+in
+{
+  jam = let
+    pname = "jam";
+    version = "2.6.1";
+  in mkJam {
+    inherit pname version;
 
-    runHook postBuild
-  '';
+    src = fetchurl {
+      url = "https://swarm.workshop.perforce.com/projects/perforce_software-jam/download/main/${pname}-${version}.tar";
+      sha256 = "19xkvkpycxfsncxvin6yqrql3x3z9ypc1j8kzls5k659q4kv5rmc";
+    };
+
+    meta = with lib; {
+      description = "Just Another Make";
+      homepage = "https://www.perforce.com/resources/documentation/jam";
+      maintainers = with maintainers; [ impl orivej ];
+    };
+  };
 
-  installPhase = ''
-    runHook preInstall
+  ftjam = let
+    pname = "ftjam";
+    version = "2.5.2";
+  in mkJam {
+    inherit pname version;
 
-    ./jam0 -j$NIX_BUILD_CORES -sBINDIR=$out/bin install
-    mkdir -p $out/doc/jam
-    cp *.html $out/doc/jam
+    src = fetchurl {
+      url = "https://downloads.sourceforge.net/project/freetype/${pname}/${version}/${pname}-${version}.tar.bz2";
+      hash = "sha256-6JdzUAqSkS3pGOn+v/q+S2vOedaa8ZRDX04DK4ptZqM=";
+    };
 
-    runHook postInstall
-  '';
+    postPatch = ''
+      substituteInPlace Jamfile --replace strip ${stdenv.cc.targetPrefix}strip
+    '';
 
-  enableParallelBuilding = true;
+    # Doesn't understand how to cross compile once bootstrapped, so we'll just
+    # use the Makefile for the bootstrapping portion.
+    configurePlatforms = [ "build" "target" ];
+    configureFlags = [
+      "CC=${buildPackages.stdenv.cc.targetPrefix}cc"
+      "--host=${stdenv.buildPlatform.config}"
+    ];
 
-  meta = with lib; {
-    homepage = "https://www.perforce.com/resources/documentation/jam";
-    license = licenses.free;
-    description = "Just Another Make";
-    maintainers = with maintainers; [ orivej ];
-    platforms = platforms.unix;
+    meta = with lib; {
+      description = "FreeType's enhanced, backwards-compatible Jam clone";
+      homepage = "https://freetype.org/jam/";
+      maintainers = with maintainers; [ AndersonTorres impl ];
+    };
   };
 }
diff --git a/pkgs/development/tools/build-managers/jam/ftjam.nix b/pkgs/development/tools/build-managers/jam/ftjam.nix
deleted file mode 100644
index 1f106401c0d..00000000000
--- a/pkgs/development/tools/build-managers/jam/ftjam.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, bison
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ftjam";
-  version = "2.5.2";
-
-  src = fetchurl {
-    url = "https://downloads.sourceforge.net/project/freetype/${pname}/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-6JdzUAqSkS3pGOn+v/q+S2vOedaa8ZRDX04DK4ptZqM=";
-  };
-
-  nativeBuildInputs = [
-    bison
-  ];
-
-  preConfigure = ''
-    unset AR
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    make jam0
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    ./jam0 -j$NIX_BUILD_CORES -sBINDIR=$out/bin install
-    mkdir -p $out/doc/jam
-    cp *.html $out/doc/jam
-
-    runHook postInstall
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Freetype's enhanced, backwards-compatible Jam clone";
-    homepage = "https://freetype.org/jam/";
-    license = licenses.free;
-    maintainers = with maintainers; [ AndersonTorres ];
-    mainProgram = "jam";
-    platforms = platforms.unix;
-  };
-}
-# TODO: setup hook for Jam
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/000-sanitize.patch b/pkgs/tools/cd-dvd/ventoy-bin/000-sanitize.patch
new file mode 100644
index 00000000000..18e837e58c6
--- /dev/null
+++ b/pkgs/tools/cd-dvd/ventoy-bin/000-sanitize.patch
@@ -0,0 +1,214 @@
+Author: DuckSoft <realducksoft@gmail.com>
+
+I just cannot stand such a dirty package. 
+Let me do some optimisations.
+
+If you are interested to improve this patch, welcome to mail me.
+
+diff -rup old/tool/ventoy_lib.sh new/tool/ventoy_lib.sh
+--- tool/ventoy_lib.sh	2021-12-02 16:59:42.148650182 +0100
++++ tool/ventoy_lib.sh	2021-12-02 17:01:17.214720518 +0100
+@@ -29,7 +29,7 @@ vterr() {
+ }
+ 
+ vtdebug() {
+-    echo "$*" >> ./log.txt
++    echo "$*" >>/var/log/ventoy.log
+ }
+ 
+ vtoy_gen_uuid() {
+@@ -52,30 +52,6 @@ vtoy_gen_uuid() {
+ 
+ check_tool_work_ok() {
+     
+-    if echo 1 | hexdump > /dev/null; then
+-        vtdebug "hexdump test ok ..."
+-    else
+-        vtdebug "hexdump test fail ..."
+-        ventoy_false
+-        return
+-    fi
+-   
+-    if mkexfatfs -V > /dev/null; then
+-        vtdebug "mkexfatfs test ok ..."
+-    else
+-        vtdebug "mkexfatfs test fail ..."
+-        ventoy_false
+-        return
+-    fi
+-    
+-    if vtoycli fat -T; then
+-        vtdebug "vtoycli fat test ok ..."
+-    else
+-        vtdebug "vtoycli fat test fail ..."
+-        ventoy_false
+-        return
+-    fi
+-    
+     vtdebug "tool check success ..."
+     ventoy_true
+ }
+@@ -311,7 +287,7 @@ format_ventoy_disk_mbr() {
+     else
+     vtdebug "format disk by fdisk ..."
+     
+-fdisk $DISK >>./log.txt 2>&1 <<EOF
++fdisk $DISK >>/var/log/ventoy.log 2>&1 <<EOF
+ o
+ n
+ p
+diff -rup old/tool/VentoyWorker.sh new/tool/VentoyWorker.sh
+--- tool/VentoyWorker.sh	2021-12-02 16:59:31.485642239 +0100
++++ tool/VentoyWorker.sh	2021-12-02 17:02:00.326752183 +0100
+@@ -105,7 +105,7 @@ vtdebug "MODE=$MODE FORCE=$FORCE RESERVE
+ if check_tool_work_ok; then
+     vtdebug "check tool work ok"
+ else
+-    vterr "Some tools can not run on current system. Please check log.txt for details."
++    vterr "Some tools can not run on current system. Please check /var/log/ventoy.log for details."
+     exit 1
+ fi
+ 
+diff -rup old/Ventoy2Disk.sh new/Ventoy2Disk.sh
+--- Ventoy2Disk.sh	2021-12-02 16:59:05.205622608 +0100
++++ Ventoy2Disk.sh	2021-12-02 17:03:29.037816991 +0100
+@@ -32,48 +32,4 @@ echo "      https://www.ventoy.net"
+ echo '**********************************************'
+ echo ''
+ 
+-
+-if ! [ -f ./boot/boot.img ]; then
+-    if [ -d ./grub ]; then
+-        echo "Don't run Ventoy2Disk.sh here, please download the released install package, and run the script in it."
+-    else
+-        echo "Please run under the correct directory!" 
+-    fi
+-    exit 1
+-fi
+-
+-echo "############# Ventoy2Disk $* [$TOOLDIR] ################" >> ./log.txt
+-date >> ./log.txt
+-
+-#decompress tool
+-echo "decompress tools" >> ./log.txt
+-cd ./tool/$TOOLDIR
+-
+-ls *.xz > /dev/null 2>&1
+-if [ $? -eq 0 ]; then
+-    [ -f ./xzcat ] && chmod +x ./xzcat
+-
+-    for file in $(ls *.xz); do
+-        echo "decompress $file" >> ./log.txt
+-        xzcat $file > ${file%.xz}
+-        [ -f ./${file%.xz} ] && chmod +x ./${file%.xz}
+-        [ -f ./$file ] && rm -f ./$file
+-    done
+-fi
+-
+-cd ../../
+-chmod +x -R ./tool/$TOOLDIR
+-
+-
+-if [ -f /bin/bash ]; then
+-    /bin/bash ./tool/VentoyWorker.sh $*
+-else
+-    ash ./tool/VentoyWorker.sh $*
+-fi
+-
+-if [ -n "$OLDDIR" ]; then 
+-    CURDIR=$(pwd)
+-    if [ "$CURDIR" != "$OLDDIR" ]; then
+-        cd "$OLDDIR"
+-    fi
+-fi
++./tool/VentoyWorker.sh $*
+diff -rup old/VentoyPlugson.sh new/VentoyPlugson.sh
+--- VentoyPlugson.sh	2021-12-02 17:54:36.055868878 +0100
++++ VentoyPlugson.sh	2021-12-02 18:04:40.919633986 +0100
+@@ -25,8 +19,6 @@ if echo $machine | egrep -q 'aarch64|arm
+     TOOLDIR=aarch64
+ elif echo $machine | egrep -q 'x86_64|amd64'; then
+     TOOLDIR=x86_64
+-elif echo $machine | egrep -q 'mips64'; then
+-    TOOLDIR=mips64el
+ elif echo $machine | egrep -q 'i[3-6]86'; then
+     TOOLDIR=i386
+ else
+@@ -35,38 +27,6 @@ else
+ fi
+ 
+ 
+-if ! [ -f "$OLDDIR/tool/plugson.tar.xz" ]; then
+-    echo "Please run under the correct directory!" 
+-    exit 1
+-fi
+-
+-echo "############# VentoyPlugson $* [$TOOLDIR] ################" >> ./VentoyPlugson.log
+-date >> ./VentoyPlugson.log
+-
+-echo "decompress tools" >> ./VentoyPlugson.log
+-cd ./tool/$TOOLDIR
+-
+-ls *.xz > /dev/null 2>&1
+-if [ $? -eq 0 ]; then
+-    [ -f ./xzcat ] && chmod +x ./xzcat
+-
+-    for file in $(ls *.xz); do
+-        echo "decompress $file" >> ./VentoyPlugson.log
+-        xzcat $file > ${file%.xz}
+-        [ -f ./${file%.xz} ] && chmod +x ./${file%.xz}
+-        [ -f ./$file ] && rm -f ./$file
+-    done
+-fi
+-
+-cd ../../
+-chmod +x -R ./tool/$TOOLDIR
+-
+-if ! [ -f "$OLDDIR/tool/$TOOLDIR/Plugson" ]; then
+-    echo "$OLDDIR/tool/$TOOLDIR/Plugson does not exist!" 
+-    exit 1
+-fi
+-
+-
+ PATH=./tool/$TOOLDIR:$PATH
+ 
+ HOST="127.0.0.1"
+@@ -208,11 +168,3 @@ if [ -f /proc/$wID/maps ]; then
+ 
+     wait $wID
+ fi
+-
+-
+-if [ -n "$OLDDIR" ]; then 
+-    CURDIR=$(pwd)
+-    if [ "$CURDIR" != "$OLDDIR" ]; then
+-        cd "$OLDDIR"
+-    fi
+-fi
+diff -rup old/VentoyWeb.sh new/VentoyWeb.sh
+--- VentoyWeb.sh	2021-12-02 16:58:51.885612627 +0100
++++ VentoyWeb.sh	2021-12-02 17:04:43.437871014 +0100
+@@ -15,12 +15,6 @@ print_err() {
+     echo ""
+ }
+ 
+-uid=$(id -u)
+-if [ $uid -ne 0 ]; then
+-    print_err "Please use sudo or run the script as root."
+-    exit 1
+-fi
+-
+ OLDDIR=$(pwd)
+ 
+ if uname -m | egrep -q 'aarch64|arm64'; then
+@@ -85,8 +79,8 @@ if ps -ef | grep "V2DServer.*$HOST.*$POR
+     exit 1
+ fi
+ 
+-LOGFILE=log.txt
+-#delete the log.txt if it's more than 8MB
++LOGFILE=/var/log/ventoy.log
++#delete the ventoy.log if it's more than 8MB
+ if [ -f $LOGFILE ]; then
+     logsize=$(stat -c '%s' $LOGFILE)
+     if [ $logsize -gt 8388608 ]; then
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/default.nix b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
index 361739e980e..978eae33bc9 100644
--- a/pkgs/tools/cd-dvd/ventoy-bin/default.nix
+++ b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
@@ -4,8 +4,8 @@
 , fetchpatch
 , autoPatchelfHook
 , bash
-, coreutils
 , copyDesktopItems
+, coreutils
 , cryptsetup
 , dosfstools
 , e2fsprogs
@@ -15,14 +15,15 @@
 , gnused
 , gtk3
 , hexdump
-, makeWrapper
 , makeDesktopItem
+, makeWrapper
 , ntfs3g
 , parted
 , procps
-, qt5
+, qtbase
 , util-linux
 , which
+, wrapQtAppsHook
 , xfsprogs
 , xz
 , defaultGuiType ? ""
@@ -47,30 +48,24 @@ let
   }.${stdenv.hostPlatform.system}
     or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
 
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy-bin";
-  version = "1.0.78";
+  version = "1.0.79";
 
   src = fetchurl {
-    url = "https://github.com/ventoy/Ventoy/releases/download/v${version}/ventoy-${version}-linux.tar.gz";
-    hash = "sha256-vlSnnExtuh85yGFYUBeE7BRsVwl+kn7nSaIx2d3WICk=";
+    url = "https://github.com/ventoy/Ventoy/releases/download/v${finalAttrs.version}/ventoy-${finalAttrs.version}-linux.tar.gz";
+    hash = "sha256-azkoDquN/i01QHsd1wJG79kdhHhBvXzPXIRnjKHAHNE=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "sanitize.patch";
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/sanitize.patch?h=057f2d1eb496c7a3aaa8229e99a7f709428fa4c5";
-      sha256 = "sha256-iAtLtM+Q4OsXDK83eCnPNomeNSEqdRLFfK2x7ybPSpk=";
-    })
+    ./000-sanitize.patch
     ./001-add-mips64.diff
     ./002-fix-for-read-only-file-system.diff
   ];
 
   patchFlags = [ "-p0" ];
 
-  dontConfigure = true;
-  dontBuild = true;
-
   postPatch = ''
     # Fix permissions.
     find -type f -name \*.sh -exec chmod a+x '{}' \;
@@ -85,7 +80,7 @@ in stdenv.mkDerivation rec {
     makeWrapper
   ]
   ++ lib.optional (withQt5 || withGtk3) copyDesktopItems
-  ++ lib.optional withQt5 qt5.wrapQtAppsHook;
+  ++ lib.optional withQt5 wrapQtAppsHook;
 
   buildInputs = [
     bash
@@ -107,7 +102,7 @@ in stdenv.mkDerivation rec {
   ++ lib.optional withGtk3 gtk3
   ++ lib.optional withNtfs ntfs3g
   ++ lib.optional withXfs xfsprogs
-  ++ lib.optional withQt5 qt5.qtbase;
+  ++ lib.optional withQt5 qtbase;
 
   desktopItems = [
     (makeDesktopItem {
@@ -121,6 +116,9 @@ in stdenv.mkDerivation rec {
       startupNotify = true;
     })];
 
+  dontConfigure = true;
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -159,7 +157,7 @@ in stdenv.mkDerivation rec {
              VentoyPlugson.sh_ventoy-plugson; do
         local bin="''${f%_*}" wrapper="''${f#*_}"
         makeWrapper "$VENTOY_PATH/$bin" "$out/bin/$wrapper" \
-                    --prefix PATH : "${lib.makeBinPath buildInputs}" \
+                    --prefix PATH : "${lib.makeBinPath finalAttrs.buildInputs}" \
                     --chdir "$VENTOY_PATH"
     done
   ''
@@ -168,7 +166,7 @@ in stdenv.mkDerivation rec {
   + lib.optionalString (withGtk3 || withQt5) ''
     echo "${defaultGuiType}" > "$VENTOY_PATH/ventoy_gui_type"
     makeWrapper "$VENTOY_PATH/VentoyGUI.$ARCH" "$out/bin/ventoy-gui" \
-                --prefix PATH : "${lib.makeBinPath buildInputs}" \
+                --prefix PATH : "${lib.makeBinPath finalAttrs.buildInputs}" \
                 --chdir "$VENTOY_PATH"
     mkdir "$out"/share/{applications,pixmaps}
     ln -s "$VENTOY_PATH"/WebUI/static/img/VentoyLogo.png "$out"/share/pixmaps/
@@ -210,4 +208,4 @@ in stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     mainProgram = "ventoy";
   };
-}
+})
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index aa08aa7759d..c5089515db4 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.14.9";
+  version = "0.14.10";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nRvXAHvIAUmtP1Xny9RWNZsCLI2eiE7163h6qxS2v1I=";
+    sha256 = "sha256-izJMypTB7JCvSdTbsS85ez9HL7hM8DtPvnPXA0MvQC8=";
   };
 
-  cargoSha256 = "sha256-gF9pPOhWT+aaZdk7qyyDIPvJ76s6pkjaeyOLYYrHxo4=";
+  cargoSha256 = "sha256-3B1+pV7FyOD/e9fIKiAheIbb1vSFooc2qdnbL7LmzdQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/gopass/jsonapi.nix b/pkgs/tools/security/gopass/jsonapi.nix
index 5f6dab2e906..c4f73630257 100644
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.14.3";
+  version = "1.14.5";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uLsKxx2Yr0g3vf2AQqRqRzNsBX2D4+6wwxM+czthL+I=";
+    sha256 = "sha256-zEyzoIl5LiVbNSRebbcE70HxhOGYaZvArdHQqgvi1ns=";
   };
 
-  vendorSha256 = "sha256-QEqtyHb+/tpbbHLCSBw7uafAtKzKkmxoFGqFVHSR03I=";
+  vendorSha256 = "sha256-mcI8ys+Vs46BEaETzsf0f1f2CgjEIV4iwSF4FWgNjUY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c7b72ec39ce..3aec6e3e895 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1369,7 +1369,9 @@ with pkgs;
 
   veikk-linux-driver-gui = libsForQt5.callPackage ../tools/misc/veikk-linux-driver-gui { };
 
-  ventoy-bin = callPackage ../tools/cd-dvd/ventoy-bin { };
+  ventoy-bin = callPackage ../tools/cd-dvd/ventoy-bin {
+    inherit (libsForQt5) qtbase wrapQtAppsHook;
+  };
   ventoy-bin-full = ventoy-bin.override {
     withCryptsetup = true;
     withXfs = true;
@@ -16550,9 +16552,9 @@ with pkgs;
 
   itstool = callPackage ../development/tools/misc/itstool { };
 
-  jam = callPackage ../development/tools/build-managers/jam { };
-
-  ftjam = callPackage ../development/tools/build-managers/jam/ftjam.nix { };
+  inherit (callPackage ../development/tools/build-managers/jam { })
+    jam
+    ftjam;
 
   javacc = callPackage ../development/tools/parsing/javacc {
     # Upstream doesn't support anything newer than Java 8.