From f67035184352ac84cd2b59f45c68634bb1790742 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 17:43:45 +0000
Subject: [PATCH 01/28] Update PyOpenSSL to the second-latest version

The latest version 404s ?
---
 nix/pyopenssl.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/pyopenssl.nix b/nix/pyopenssl.nix
index b8966fad..100be478 100644
--- a/nix/pyopenssl.nix
+++ b/nix/pyopenssl.nix
@@ -1,10 +1,10 @@
 { pyopenssl, fetchPypi, isPyPy }:
 pyopenssl.overrideAttrs (old: rec {
   pname = "pyOpenSSL";
-  version = "23.2.0";
+  version = "24.1.0";
   name = "${pname}-${version}";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "J2+TH1WkUufeppxxc+mE6ypEB85BPJGKo0tV+C+bi6w=";
+    sha256 = "yr7Uv6pd+fGhbA72Sgy2Uxi1zQd6ftp9aXATHKL0Gm8=";
   };
 })

From aae9a87beca799dc689578df0e2fc27a059e7dcd Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 17:49:45 +0000
Subject: [PATCH 02/28] Update pycddl 0.4.0 to 0.6.3

---
 nix/pycddl.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/pycddl.nix b/nix/pycddl.nix
index 0f6a0329..9392add4 100644
--- a/nix/pycddl.nix
+++ b/nix/pycddl.nix
@@ -1,12 +1,12 @@
 { lib, fetchPypi, buildPythonPackage, rustPlatform }:
 buildPythonPackage rec {
   pname = "pycddl";
-  version = "0.4.0";
+  version = "0.6.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-w0CGbPeiXyS74HqZXyiXhvaAMUaIj5onwjl9gWKAjqY=";
+    sha256 = "sha256-lVybSr+QvyepdTZfiTjqU0ENu6TT87ZZXIECBA8nMV4=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -17,6 +17,6 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-g96eeaqN9taPED4u+UKUcoitf5aTGFrW2/TOHoHEVHs=";
+    hash = "sha256-VpJ/PLAwwuakwsNAtLDdWGXCxl6jGMTvsEhzIHk6a0g=";
   };
 }

From 99f3d4fe4e23061174b594a354838a9d0ca2e09a Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 19:54:09 +0000
Subject: [PATCH 03/28] Update flake8-isort 6.0.0 -> 6.1.0, add missing pip to
 flake8-black

---
 nix/flake8-black.nix | 3 ++-
 nix/flake8-isort.nix | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/nix/flake8-black.nix b/nix/flake8-black.nix
index a3e27ff1..96c3c1f5 100644
--- a/nix/flake8-black.nix
+++ b/nix/flake8-black.nix
@@ -4,6 +4,7 @@
 , black
 , tomli
 , setuptools
+, pip
 }:
 buildPythonPackage rec {
   pname = "flake8-black";
@@ -16,7 +17,7 @@ buildPythonPackage rec {
 
   format = "pyproject";
   # doCheck = false;
-  buildInputs = [ setuptools ];
+  buildInputs = [ setuptools pip ];
   propagatedBuildInputs = [ flake8 black tomli ];
   pythonImportsCheck = [ "flake8_black" ];
 }
diff --git a/nix/flake8-isort.nix b/nix/flake8-isort.nix
index 45a6d3e1..a7532b2c 100644
--- a/nix/flake8-isort.nix
+++ b/nix/flake8-isort.nix
@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "flake8-isort";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U39FOmYNfpA/YC7Po2E2sUDeJ531jQLrG2oMhOg8Uow=";
+    hash = "sha256-1GOTQ7rFQBlMWfsWGKwsKFs+J2CfNTvvb1CQTUDBZD4=";
   };
 
   doCheck = false;

From cd2f3615640d009ed0d13129a5d9e584bcffb09f Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 20:31:34 +0000
Subject: [PATCH 04/28] Upgrade Python compose 1.4.8 -> 1.6.2

---
 nix/compose.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/compose.nix b/nix/compose.nix
index 19facc18..6cc0bf41 100644
--- a/nix/compose.nix
+++ b/nix/compose.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "compose";
-  version = "1.4.8";
+  version = "1.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-mpRabfC4LE6xYlHmQbHb1yXxLDtH5idwN4GbUnCPGTo=";
+    sha256 = "sha256-yUP6goTByziSklOIhi4gPJiISE5M4/1RcVBnaWkNi00=";
   };
 
   meta = with lib; {

From ec45d0464d6765683c5f0e079718b2d535e95155 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 20:32:11 +0000
Subject: [PATCH 05/28] Upgrade mypy-zope 0.3.11 -> 1.0.9

---
 nix/mypy-zope.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/mypy-zope.nix b/nix/mypy-zope.nix
index ff0114f5..821b0299 100644
--- a/nix/mypy-zope.nix
+++ b/nix/mypy-zope.nix
@@ -5,12 +5,12 @@
 , zope_schema
 }:
 buildPythonPackage rec {
-  pname = "mypy-zope";
-  version = "0.3.11";
+  pname = "mypy_zope";
+  version = "1.0.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1CVfnwTUjHkIO71OL+oGUTpqx7jeBvjEzlY/2FFCygU=";
+    hash = "sha256-N9aYXfsFpMJ7Nc/0dXf9W62HjbSJPd7fVNFl9ziaHNs=";
   };
 
   # doCheck = false;

From cf1f181798969f12373d3bb513708b8ef941ed87 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 20:32:49 +0000
Subject: [PATCH 06/28] Upgrade types-PyYAML 6.0.12.9 -> 6.0.12.20240917

---
 nix/types-pyyaml.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/types-pyyaml.nix b/nix/types-pyyaml.nix
index 98cec85d..98b7b6f6 100644
--- a/nix/types-pyyaml.nix
+++ b/nix/types-pyyaml.nix
@@ -3,10 +3,10 @@
 }:
 buildPythonPackage rec {
   pname = "types-PyYAML";
-  version = "6.0.12.9";
+  version = "6.0.12.20240917";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xRsb1tmd3wqiiEp6MogQ6/cKQmLCkhldP0+aAAX57rY=";
+    hash = "sha256-0UBahvlXZoIjTvg7y05v/3yTBcix+61eC81Pfb3JxYc=";
   };
 }

From effca2d459fb518f404bf21fdc04fd049c84d54c Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 20:39:58 +0000
Subject: [PATCH 07/28] Add Python 3.11 and 3.12 to exposed packages

... and observe all the wonderful failure modes of Python minor
versions
---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 8971377d..43d7493e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,7 +31,7 @@
 
       # The names of the nixpkgs Python derivations for which we will expose
       # packages.
-      pyVersions = [ "python310" "python39" ];
+      pyVersions = [ "python312" "python311" "python310" "python39" ];
 
       # All of the versions our Tahoe-LAFS dependency for which we will expose
       # packages.

From 0405dc81e06605e7735740134b9b10ea2b63586b Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 20:41:19 +0000
Subject: [PATCH 08/28] Add newer Python versions to CI

---
 .circleci/config.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 57a69a8c..66af81c0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -515,6 +515,8 @@ workflows:
             py-version:
               - "39"
               - "310"
+              - "311"
+              - "312"
             tahoe-lafs:
               - "1_18_0"
               # This is usually not master@HEAD because it is still pinned to

From 77e28783b904dfda848ae9901dfdc6f97266c6cb Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 21:18:56 +0000
Subject: [PATCH 09/28] Vendor collections-extended and link to a version that
 works with Python 3.11

---
 nix/collections-extended.nix | 43 ++++++++++++++++++++++++++++++++++++
 nix/lib.nix                  |  3 +++
 2 files changed, 46 insertions(+)
 create mode 100644 nix/collections-extended.nix

diff --git a/nix/collections-extended.nix b/nix/collections-extended.nix
new file mode 100644
index 00000000..ae3028eb
--- /dev/null
+++ b/nix/collections-extended.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hypothesis,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
+  pythonAtLeast,
+}:
+
+buildPythonPackage rec {
+  pname = "collections-extended";
+  version = "2.0.2.post1";
+  format = "pyproject";
+
+  # https://github.com/mlenzen/collections-extended/issues/198
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.12";
+
+  src = fetchFromGitHub {
+    owner = "mlenzen";
+    repo = pname;
+    # This version includes our hero JP's patches for Python 3.11.
+    rev = "8b93390636d58d28012b8e9d22334ee64ca37d73";
+    hash = "sha256-e7RCpNsqyS1d3q0E+uaE4UOEQziueYsRkKEvy3gCHt0=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "collections_extended" ];
+
+  meta = with lib; {
+    description = "Extra Python Collections - bags (multisets), setlists (unique list/indexed set), RangeMap and IndexedDict";
+    homepage = "https://github.com/mlenzen/collections-extended";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ exarkun ];
+  };
+}
diff --git a/nix/lib.nix b/nix/lib.nix
index d25f5c45..c62144ca 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -89,6 +89,9 @@ rec {
         hypothesis = self.callPackage ./hypothesis.nix {
           inherit (super) hypothesis;
         };
+
+        # collections-extended isn't maintained anymore.
+        collections-extended = self.callPackage ./collections-extended.nix {};
       };
     }); in with python.pkgs;
     buildPythonPackage rec {

From b8321a1c04c585d84ae37e1a7ab24fafd9ff3a94 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 21:23:12 +0000
Subject: [PATCH 10/28] Vendor magic-wormhole-transit-relay: Only the current
 master tip is Python 3.12 ready.

---
 nix/lib.nix                          |  3 ++
 nix/magic-wormhole-transit-relay.nix | 50 ++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 nix/magic-wormhole-transit-relay.nix

diff --git a/nix/lib.nix b/nix/lib.nix
index c62144ca..d1389d1f 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -90,6 +90,9 @@ rec {
           inherit (super) hypothesis;
         };
 
+        # Only the current master tip is Python 3.12 ready.
+        magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
+
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
       };
diff --git a/nix/magic-wormhole-transit-relay.nix b/nix/magic-wormhole-transit-relay.nix
new file mode 100644
index 00000000..6ee1a896
--- /dev/null
+++ b/nix/magic-wormhole-transit-relay.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  autobahn,
+  mock,
+  twisted,
+  pythonOlder,
+  pythonAtLeast,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "magic-wormhole-transit-relay";
+  version = "0.3.1.post1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.13";
+
+  src = fetchFromGitHub {
+    owner = "magic-wormhole";
+    repo = "magic-wormhole-transit-relay";
+    rev = "3b298558e419b0f575f4026be02dd369a4e5f245";
+    hash = "sha256-y0gBtGiq6v+XKG4OP+xi0dUv/jF9FACDtYNqH7To+l4=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    autobahn
+    twisted
+  ];
+
+  pythonImportsCheck = [ "wormhole_transit_relay" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+    twisted
+  ];
+
+  meta = {
+    description = "Transit Relay server for Magic-Wormhole";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole-transit-relay";
+    changelog = "https://github.com/magic-wormhole/magic-wormhole-transit-relay/blob/${version}/NEWS.md";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.mjoerg ];
+  };
+}

From cdca04508336618be6f7e3e554ce71726fe0679d Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 21:42:20 +0000
Subject: [PATCH 11/28] Vendor magic-wormhole-mailbox-server: Only the current
 master tip is Python 3.12 ready.

---
 nix/lib.nix                           |  1 +
 nix/magic-wormhole-mailbox-server.nix | 63 +++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 nix/magic-wormhole-mailbox-server.nix

diff --git a/nix/lib.nix b/nix/lib.nix
index d1389d1f..d18dd123 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -92,6 +92,7 @@ rec {
 
         # Only the current master tip is Python 3.12 ready.
         magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
+        magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};
 
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
diff --git a/nix/magic-wormhole-mailbox-server.nix b/nix/magic-wormhole-mailbox-server.nix
new file mode 100644
index 00000000..6346d8da
--- /dev/null
+++ b/nix/magic-wormhole-mailbox-server.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  setuptools,
+  six,
+  attrs,
+  twisted,
+  autobahn,
+  treq,
+  mock,
+  pythonOlder,
+  pythonAtLeast,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "magic-wormhole-mailbox-server";
+  version = "0.4.1.post1";
+  pyproject = true;
+
+  # python 3.12 support: https://github.com/magic-wormhole/magic-wormhole-mailbox-server/issues/41
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.13";
+
+  src = fetchFromGitHub {
+    owner = "magic-wormhole";
+    repo = "magic-wormhole-mailbox-server";
+    rev = "30ecb6e3f6f487c915e7ff0acdf2e630cbe17dc8";
+    hash = "sha256-GvEFkpCcqvUZwA5wbqyELF53+NQ1YhX+ngHHsiWKiPs=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    attrs
+    six
+    twisted
+    autobahn
+  ] ++ autobahn.optional-dependencies.twisted ++ twisted.optional-dependencies.tls;
+
+  pythonImportsCheck = [ "wormhole_mailbox_server" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    treq
+    mock
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
+    # these tests fail in Darwin's sandbox
+    "src/wormhole_mailbox_server/test/test_web.py"
+  ];
+
+  meta = {
+    description = "Securely transfer data between computers";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server";
+    changelog = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/${version}/NEWS.md";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.mjoerg ];
+  };
+}

From ff696a524ad8cc482831bd37784618a7d5d83fb8 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 22:02:52 +0000
Subject: [PATCH 12/28] huh

---
 nix/collections-extended.nix          | 3 ++-
 nix/magic-wormhole-mailbox-server.nix | 2 +-
 nix/magic-wormhole-transit-relay.nix  | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/nix/collections-extended.nix b/nix/collections-extended.nix
index ae3028eb..85dfc034 100644
--- a/nix/collections-extended.nix
+++ b/nix/collections-extended.nix
@@ -15,7 +15,8 @@ buildPythonPackage rec {
   format = "pyproject";
 
   # https://github.com/mlenzen/collections-extended/issues/198
-  disabled = pythonOlder "3.6" || pythonAtLeast "3.12";
+  # My own running the test suggest Python 3.12 is still fine.
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.13";
 
   src = fetchFromGitHub {
     owner = "mlenzen";
diff --git a/nix/magic-wormhole-mailbox-server.nix b/nix/magic-wormhole-mailbox-server.nix
index 6346d8da..0672b6a2 100644
--- a/nix/magic-wormhole-mailbox-server.nix
+++ b/nix/magic-wormhole-mailbox-server.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "magic-wormhole";
     repo = "magic-wormhole-mailbox-server";
     rev = "30ecb6e3f6f487c915e7ff0acdf2e630cbe17dc8";
-    hash = "sha256-GvEFkpCcqvUZwA5wbqyELF53+NQ1YhX+ngHHsiWKiPs=";
+    hash = "sha256-AKdGmr9wCf6VBpeLWr9gxtxhZYLDJh9O2GXwOqliYUA=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/nix/magic-wormhole-transit-relay.nix b/nix/magic-wormhole-transit-relay.nix
index 6ee1a896..b44af295 100644
--- a/nix/magic-wormhole-transit-relay.nix
+++ b/nix/magic-wormhole-transit-relay.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "magic-wormhole";
     repo = "magic-wormhole-transit-relay";
     rev = "3b298558e419b0f575f4026be02dd369a4e5f245";
-    hash = "sha256-y0gBtGiq6v+XKG4OP+xi0dUv/jF9FACDtYNqH7To+l4=";
+    hash = "sha256-xPpA1rajFDYdlIoyqYNwZ1VmC2bQRC1qR61H15adn1g=";
   };
 
   nativeBuildInputs = [ setuptools ];

From 2aaa83d413686c7978a34e85104e9e911d9a24c8 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 22:57:52 +0000
Subject: [PATCH 13/28] vendor eliot because of their broken versioneer

---
 nix/eliot.nix | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++
 nix/lib.nix   |  6 -----
 2 files changed, 64 insertions(+), 6 deletions(-)
 create mode 100644 nix/eliot.nix

diff --git a/nix/eliot.nix b/nix/eliot.nix
new file mode 100644
index 00000000..6c522d94
--- /dev/null
+++ b/nix/eliot.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  aiocontextvars,
+  boltons,
+  hypothesis,
+  pyrsistent,
+  pytestCheckHook,
+  setuptools,
+  six,
+  testtools,
+  zope-interface,
+}:
+
+buildPythonPackage rec {
+  pname = "eliot";
+  version = "1.14.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-wvCZo+jV7PwidFdm58xmSkjbZLa4nZht/ycEkdhoMUk=";
+  };
+
+  propagatedBuildInputs = [
+    aiocontextvars
+    boltons
+    pyrsistent
+    setuptools
+    six
+    zope-interface
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+    testtools
+  ];
+
+  pythonImportsCheck = [ "eliot" ];
+
+  # Tests run eliot-prettyprint in out/bin.
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  disabledTests = [
+    "test_parse_stream"
+    # AttributeError: module 'inspect' has no attribute 'getargspec'
+    "test_default"
+  ];
+
+  meta = with lib; {
+    homepage = "https://eliot.readthedocs.io";
+    description = "Logging library that tells you why it happened";
+    mainProgram = "eliot-prettyprint";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dpausp ];
+  };
+}
diff --git a/nix/lib.nix b/nix/lib.nix
index d18dd123..c6cc60f2 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -84,12 +84,6 @@ rec {
         mypy-zope = self.callPackage ./mypy-zope.nix {};
         types-PyYAML = self.callPackage ./types-pyyaml.nix {};
 
-        # Hypothesis 6.54-ish has a bug that causes our test suite to fail.
-        # Get a newer one.
-        hypothesis = self.callPackage ./hypothesis.nix {
-          inherit (super) hypothesis;
-        };
-
         # Only the current master tip is Python 3.12 ready.
         magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
         magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};

From 07b6588b43cc94b99c944160f5dd66fb947b2a22 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Tue, 5 Nov 2024 23:05:41 +0000
Subject: [PATCH 14/28] Upgrade to eliot 1.15 for Python 3.12

---
 nix/eliot.nix | 12 +++++++-----
 nix/lib.nix   |  3 +++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/nix/eliot.nix b/nix/eliot.nix
index 6c522d94..b521e6d7 100644
--- a/nix/eliot.nix
+++ b/nix/eliot.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pythonOlder,
   aiocontextvars,
   boltons,
@@ -16,14 +16,16 @@
 
 buildPythonPackage rec {
   pname = "eliot";
-  version = "1.14.0";
+  version = "1.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-wvCZo+jV7PwidFdm58xmSkjbZLa4nZht/ycEkdhoMUk=";
+  src = fetchFromGitHub {
+    owner = "itamarst";
+    repo = "eliot";
+    rev = "1.15.0";
+    hash = "sha256-Ur7q7PZ5HH4ttD3b0HyBTe1B7eQ2nEWcTBR/Hjeg9yw=";
   };
 
   propagatedBuildInputs = [
diff --git a/nix/lib.nix b/nix/lib.nix
index c6cc60f2..25012b99 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -90,6 +90,9 @@ rec {
 
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
+
+        # eliot 1.15 upgrades its bundled versioneer and works with Python 3.12
+        eliot = self.callPackage ./eliot.nix {};
       };
     }); in with python.pkgs;
     buildPythonPackage rec {

From dd09c8ac2acad1425a7cefa8c9bef5e3ea634283 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Wed, 6 Nov 2024 17:47:49 +0000
Subject: [PATCH 15/28] Fetch new magic-wormhole-transit-relay nix expression

This is hot of nixpkgs-unstable at ff7d9a3, from only two weeks ago
---
 nix/magic-wormhole-transit-relay.nix | 36 ++++++++++++++++++----------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/nix/magic-wormhole-transit-relay.nix b/nix/magic-wormhole-transit-relay.nix
index b44af295..89366bc4 100644
--- a/nix/magic-wormhole-transit-relay.nix
+++ b/nix/magic-wormhole-transit-relay.nix
@@ -1,34 +1,37 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   setuptools,
   autobahn,
   mock,
   twisted,
-  pythonOlder,
-  pythonAtLeast,
+  python,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "magic-wormhole-transit-relay";
-  version = "0.3.1.post1";
+  version = "0.3.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.13";
-
-  src = fetchFromGitHub {
-    owner = "magic-wormhole";
-    repo = "magic-wormhole-transit-relay";
-    rev = "3b298558e419b0f575f4026be02dd369a4e5f245";
-    hash = "sha256-xPpA1rajFDYdlIoyqYNwZ1VmC2bQRC1qR61H15adn1g=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-LvLvvk008OYkhw+EIln9czuncVLtMQr0NJd0piiEkA4=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  postPatch = ''
+    # Passing the environment to twistd is necessary to preserve Python's site path.
+    substituteInPlace src/wormhole_transit_relay/test/test_backpressure.py --replace-fail \
+      'reactor.spawnProcess(proto, exe, args)' \
+      'reactor.spawnProcess(proto, exe, args, None)'
+  '';
+
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     autobahn
+    setuptools # pkg_resources is referenced at runtime
     twisted
   ];
 
@@ -40,6 +43,13 @@ buildPythonPackage rec {
     twisted
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  postCheck = ''
+    # Avoid collision with twisted's plugin cache (#164775).
+    rm "$out/${python.sitePackages}/twisted/plugins/dropin.cache"
+  '';
+
   meta = {
     description = "Transit Relay server for Magic-Wormhole";
     homepage = "https://github.com/magic-wormhole/magic-wormhole-transit-relay";

From 363398c44ab058608d5c1bda8da1000a1284f7ce Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Wed, 6 Nov 2024 18:00:53 +0000
Subject: [PATCH 16/28] magic-wormhole breaks with latest -transit-relay, so
 update it, but the update requires an upgraded spake2, so vendor that too

---
 nix/lib.nix            |   4 ++
 nix/magic-wormhole.nix | 147 +++++++++++++++++++++++++++++++++++++++++
 nix/spake2.nix         |  38 +++++++++++
 3 files changed, 189 insertions(+)
 create mode 100644 nix/magic-wormhole.nix
 create mode 100644 nix/spake2.nix

diff --git a/nix/lib.nix b/nix/lib.nix
index 25012b99..263ea7d2 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -87,6 +87,10 @@ rec {
         # Only the current master tip is Python 3.12 ready.
         magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
         magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};
+        # Magic Wormhole tests break with the updated version of transit-relay from above.
+        magic-wormhole = self.callPackage ./magic-wormhole.nix {};
+        # Latest magic-wormhole requires latest spake2
+        spake2 = self.callPackage ./spake2.nix {};
 
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
diff --git a/nix/magic-wormhole.nix b/nix/magic-wormhole.nix
new file mode 100644
index 00000000..6d64ee1a
--- /dev/null
+++ b/nix/magic-wormhole.nix
@@ -0,0 +1,147 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  pythonAtLeast,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  spake2,
+  pynacl,
+  six,
+  attrs,
+  twisted,
+  autobahn,
+  automat,
+  tqdm,
+  click,
+  humanize,
+  iterable-io,
+  txtorcon,
+  zipstream-ng,
+
+  # optional-dependencies
+  noiseprotocol,
+
+  # tests
+  nettools,
+  unixtools,
+  mock,
+  magic-wormhole-transit-relay,
+  magic-wormhole-mailbox-server,
+  pytestCheckHook,
+}:
+
+let
+  # magic-wormhole relies on the internal API of
+  # magic-wormhole-transit-relay < 0.3.0 for testing.
+  magic-wormhole-transit-relay_0_2_1 =
+    magic-wormhole-transit-relay.overridePythonAttrs
+      (oldAttrs: rec {
+        version = "0.2.1";
+
+        src = fetchPypi {
+          pname = "magic-wormhole-transit-relay";
+          inherit version;
+          hash = "sha256-y0gBtGiQ6v+XKG4OP+xi0dUv/jF9FACDtjNqH7To+l4=";
+        };
+
+        postPatch = "";
+
+        postCheck = "";
+
+        meta.broken = pythonAtLeast "3.12";
+      });
+in
+buildPythonPackage rec {
+  pname = "magic-wormhole";
+  version = "0.16.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-FObBRomNvaem0ZAmJiOmlBmVU2Pn5DTWSq0tIz1tlMk=";
+  };
+
+  postPatch =
+    # enable tests by fixing the location of the wormhole binary
+    ''
+      substituteInPlace src/wormhole/test/test_cli.py --replace-fail \
+        'locations = procutils.which("wormhole")' \
+        'return "${placeholder "out"}/bin/wormhole"'
+    ''
+    # fix the location of the ifconfig binary
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
+    '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    attrs
+    autobahn
+    automat
+    click
+    humanize
+    iterable-io
+    pynacl
+    six
+    spake2
+    tqdm
+    twisted
+    txtorcon
+    zipstream-ng
+  ] ++ autobahn.optional-dependencies.twisted ++ twisted.optional-dependencies.tls;
+
+  optional-dependencies = {
+    dilation = [ noiseprotocol ];
+  };
+
+  nativeCheckInputs =
+    # For Python 3.12, remove magic-wormhole-mailbox-server and magic-wormhole-transit-relay from test dependencies,
+    # which are not yet supported with this version.
+    lib.optionals
+      (!magic-wormhole-mailbox-server.meta.broken && !magic-wormhole-transit-relay_0_2_1.meta.broken)
+      [
+        magic-wormhole-mailbox-server
+        magic-wormhole-transit-relay_0_2_1
+      ]
+    ++ [
+      mock
+      pytestCheckHook
+    ]
+    ++ optional-dependencies.dilation
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ unixtools.locale ];
+
+  __darwinAllowLocalNetworking = true;
+
+  disabledTestPaths =
+    # For Python 3.12, remove the tests depending on magic-wormhole-mailbox-server and magic-wormhole-transit-relay,
+    # which are not yet supported with this version.
+    lib.optionals
+      (magic-wormhole-mailbox-server.meta.broken || magic-wormhole-transit-relay_0_2_1.meta.broken)
+      [
+        "src/wormhole/test/dilate/test_full.py"
+        "src/wormhole/test/test_args.py"
+        "src/wormhole/test/test_cli.py"
+        "src/wormhole/test/test_transit.py"
+        "src/wormhole/test/test_wormhole.py"
+        "src/wormhole/test/test_xfer_util.py"
+      ];
+
+  postInstall = ''
+    install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
+  '';
+
+  meta = {
+    changelog = "https://github.com/magic-wormhole/magic-wormhole/blob/${version}/NEWS.md";
+    description = "Securely transfer data between computers";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.mjoerg ];
+    mainProgram = "wormhole";
+  };
+}
diff --git a/nix/spake2.nix b/nix/spake2.nix
new file mode 100644
index 00000000..98602e7d
--- /dev/null
+++ b/nix/spake2.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch2,
+  setuptools,
+  cryptography,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "spake2";
+  version = "0.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "warner";
+    repo = "python-spake2";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WPMGH1OzG+5O+2lNl2sv06/dNardY+BHYDS290Z36vQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ cryptography ];
+
+  pythonImportsCheck = [ "spake2" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    changelog = "https://github.com/warner/python-spake2/blob/v${version}/NEWS";
+    description = "SPAKE2 password-authenticated key exchange library";
+    homepage = "https://github.com/warner/python-spake2";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

From 6c202a61ae81a788219959d525a93e061eb30070 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Wed, 6 Nov 2024 18:03:17 +0000
Subject: [PATCH 17/28] We use nixpkg's hypothesis now

---
 nix/hypothesis.nix | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 nix/hypothesis.nix

diff --git a/nix/hypothesis.nix b/nix/hypothesis.nix
deleted file mode 100644
index 7f475b82..00000000
--- a/nix/hypothesis.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ hypothesis, fetchFromGitHub }:
-hypothesis.overrideAttrs (old: rec {
-  version = "6.74.1";
-  name = "hypothesis-${version}";
-  src = fetchFromGitHub {
-    owner = "HypothesisWorks";
-    repo = "hypothesis";
-    rev = "hypothesis-python-${version}";
-    hash = "sha256-bzbC9TmqqvrgTkJ3aZjp3Dd9MgeGxOkj1bz03Ng2sCo=";
-  };
-})

From ecc470d7fe39599b169bc06ca684f9107a516a65 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Wed, 6 Nov 2024 18:11:54 +0000
Subject: [PATCH 18/28] recent tahoe-lafs requires pip and orjson to install

---
 nix/tahoe-lafs.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nix/tahoe-lafs.nix b/nix/tahoe-lafs.nix
index f2ae1a1d..6f6df041 100644
--- a/nix/tahoe-lafs.nix
+++ b/nix/tahoe-lafs.nix
@@ -42,5 +42,7 @@ buildPythonPackage {
     appdirs
     bcrypt
     aniso8601
+    pip
+    orjson
   ];
 }

From d19e68b5d45527b7204e816c1d814cd4242de87e Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Wed, 6 Nov 2024 18:48:51 +0000
Subject: [PATCH 19/28] Vendor eliot-tree to get latest version with Python
 3.12 fixes

---
 nix/eliot-tree.nix | 54 ++++++++++++++++++++++++++++++++++++++++++++++
 nix/lib.nix        |  3 ++-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 nix/eliot-tree.nix

diff --git a/nix/eliot-tree.nix b/nix/eliot-tree.nix
new file mode 100644
index 00000000..3a8c809f
--- /dev/null
+++ b/nix/eliot-tree.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "eliot-tree";
+  version = "21.0.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-hTl+r+QJPPQ7ss73lty3Wm7DLy2SKGmmgIuJx38ilO8=";
+  };
+
+  # Patch Python 3.12 incompatibilities in versioneer.py.
+  postPatch = ''
+    substituteInPlace versioneer.py \
+      --replace-fail SafeConfigParser ConfigParser \
+      --replace-fail readfp read_file
+  '';
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    colored
+    eliot
+    iso8601
+    jmespath
+    toolz
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+    testtools
+  ];
+
+  # Tests run eliot-tree in out/bin.
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  pythonImportsCheck = [ "eliottree" ];
+
+  meta = {
+    homepage = "https://github.com/jonathanj/eliottree";
+    changelog = "https://github.com/jonathanj/eliottree/blob/${version}/NEWS.rst";
+    description = "Render Eliot logs as an ASCII tree";
+    mainProgram = "eliot-tree";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dpausp ];
+  };
+}
diff --git a/nix/lib.nix b/nix/lib.nix
index 263ea7d2..8e037e5d 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -97,6 +97,7 @@ rec {
 
         # eliot 1.15 upgrades its bundled versioneer and works with Python 3.12
         eliot = self.callPackage ./eliot.nix {};
+        eliot-tree = self.callPackage ./eliot-tree.nix {};
       };
     }); in with python.pkgs;
     buildPythonPackage rec {
@@ -117,7 +118,7 @@ rec {
         testresources
         hypothesis
         openapi-spec-validator
-        (toPythonModule (pkgs.eliot-tree.override { python3Packages = python.pkgs; }))
+        (toPythonModule (eliot-tree.override { python3Packages = python.pkgs; }))
       ];
 
       postFixup = ''

From 230a21f6bf8a9a0d71b66d9a7afdc13b118f2bb5 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 7 Nov 2024 17:11:36 +0000
Subject: [PATCH 20/28] Update nix docker image for circleCI

... for no particular reason other than I'm updating everything anyway
---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 66af81c0..32163c58 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -55,7 +55,7 @@ aliases:
 
   - nix_docker: &NIX_DOCKER
       # Run in a highly Nix-capable environment.
-      - image: "nixos/nix:2.15.0"
+      - image: "nixos/nix:2.18.9"
 
   - nix_environ: &NIX_ENVIRON
       # Let us use features marked "experimental".  For example, most/all of

From 21aec55b37882342eddc474afebed192b4060073 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Fri, 8 Nov 2024 17:37:52 +0000
Subject: [PATCH 21/28] Remove ipython - it's getting in the way of our
 Python39 build

---
 nix/lib.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nix/lib.nix b/nix/lib.nix
index 8e037e5d..514be741 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -69,6 +69,9 @@ rec {
           # tokenize-rt = null;
         });
 
+        # Something wants ipython - it breaks Python39 though, so we turn it off.
+        ipython = null;
+
         tqdm = dontCheck super.tqdm;
 
         isort = dontCheck super.isort;

From 5baad6df7441ffee51c8996b57363e7bde3ba9d2 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Fri, 8 Nov 2024 18:06:32 +0000
Subject: [PATCH 22/28] Don't run Twisted runtimeDeps check: It fails to find
 zope-interface when using Python3.9

---
 nix/lib.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nix/lib.nix b/nix/lib.nix
index 514be741..bbba8753 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -101,6 +101,11 @@ rec {
         # eliot 1.15 upgrades its bundled versioneer and works with Python 3.12
         eliot = self.callPackage ./eliot.nix {};
         eliot-tree = self.callPackage ./eliot-tree.nix {};
+
+        # Twisted runtimeDeps check fails to find zope-interface on Python 3.9
+        twisted = super.twisted.overrideAttrs (old: {
+          dontCheckRuntimeDeps = true;
+        });
       };
     }); in with python.pkgs;
     buildPythonPackage rec {

From df68d0d6d9e05bfda50e4feaf7ac9b453f16da38 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Fri, 8 Nov 2024 18:34:47 +0000
Subject: [PATCH 23/28] CI gets a different fixed-output hash for
 magic-wormhole-transit-relay?

I believe GitHub returned different tarballs for the same versions in the past.
(They can't even reproducibly create a Tarball, eh?)
---
 nix/magic-wormhole-mailbox-server.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/magic-wormhole-mailbox-server.nix b/nix/magic-wormhole-mailbox-server.nix
index 0672b6a2..72f0dc4e 100644
--- a/nix/magic-wormhole-mailbox-server.nix
+++ b/nix/magic-wormhole-mailbox-server.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "magic-wormhole";
     repo = "magic-wormhole-mailbox-server";
     rev = "30ecb6e3f6f487c915e7ff0acdf2e630cbe17dc8";
-    hash = "sha256-AKdGmr9wCf6VBpeLWr9gxtxhZYLDJh9O2GXwOqliYUA=";
+    hash = "sha256-I07bQmWrGppxBvQyCndPlkc94KjBfcswVa8aTjHE66o=";
   };
 
   nativeBuildInputs = [ setuptools ];

From a9b5ca9c9c3eddab4207cfc4e8bd26b5c42f07a8 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 15 May 2025 15:30:42 +0000
Subject: [PATCH 24/28] WIP Try-fix latest Tahoe-LAFS (dev) - 1.20. release
 still broken

---
 flake.lock             |  8 +++----
 flake.nix              |  2 +-
 nix/tahoe-lafs.nix     | 19 ++++++++-------
 nix/tahoe-versions.nix | 53 ++++++++++++++++++++++++++++--------------
 4 files changed, 51 insertions(+), 31 deletions(-)

diff --git a/flake.lock b/flake.lock
index c89df84f..7faa297d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -115,16 +115,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1730327045,
-        "narHash": "sha256-xKel5kd1AbExymxoIfQ7pgcX6hjw9jCgbiBjiUfSVJ8=",
+        "lastModified": 1747209494,
+        "narHash": "sha256-fLise+ys+bpyjuUUkbwqo5W/UyIELvRz9lPBPoB0fbM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "080166c15633801df010977d9d7474b4a6c549d7",
+        "rev": "5d736263df906c5da72ab0f372427814de2f52f8",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 43d7493e..fc4ed462 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "A Tahoe-LAFS storage-system plugin which authorizes storage operations based on privacy-respecting tokens.";
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-24.05";
+    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-24.11";
     flake-utils.url = "github:numtide/flake-utils";
     challenge-bypass-ristretto.url = github:LeastAuthority/python-challenge-bypass-ristretto;
     challenge-bypass-ristretto.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/nix/tahoe-lafs.nix b/nix/tahoe-lafs.nix
index 6f6df041..876f555b 100644
--- a/nix/tahoe-lafs.nix
+++ b/nix/tahoe-lafs.nix
@@ -3,16 +3,17 @@ buildPythonPackage {
   pname = "tahoe-lafs";
   version = tahoe-lafs-version;
   src = tahoe-lafs-src;
+  pyproject = true;
 
-  postPatch =
-    (if postPatch == null then "" else postPatch) +
-    # This < is really trying to be a !=.  We provide a new-enough Autobahn
-    # that it actually works, so remove the constraint from the Python metadata.
-    ''
-      sed -i -e "s/autobahn < 22.4.1/autobahn/" setup.py
-    '';
+  # postPatch =
+  #   (if postPatch == null then "" else postPatch) +
+  #   # This < is really trying to be a !=.  We provide a new-enough Autobahn
+  #   # that it actually works, so remove the constraint from the Python metadata.
+  #   ''
+  #     sed -i -e "s/autobahn < 22.4.1/autobahn/" setup.py
+  #   '';
 
-  dontUseSetuptoolsCheck = true;
+  # dontUseSetuptoolsCheck = true;
   propagatedBuildInputs = with pythonPackages; [
     zfec
     zope_interface
@@ -30,6 +31,8 @@ buildPythonPackage {
     netifaces
     pyutil
     collections-extended
+    hatchling
+    hatch-vcs
     klein
     werkzeug
     treq
diff --git a/nix/tahoe-versions.nix b/nix/tahoe-versions.nix
index 2b114520..e842f802 100644
--- a/nix/tahoe-versions.nix
+++ b/nix/tahoe-versions.nix
@@ -7,6 +7,11 @@ let
     version = "1.18.0";
     sha256 = "sha256-cXpHDfNO3TGta5RGfauqHK7dfy9SM7BLidjP6TbjF/4=";
   };
+  v1_20_0 = fetchPypi {
+    pname = "tahoe-lafs";
+    version = "1.20.0";
+    sha256 = "sha256-cXpHDFNO3TGta5RGfauqHK7dfy9SM7BLidjP6TbjF/4=";
+  };
 in
 [
   {
@@ -21,6 +26,18 @@ in
     };
   }
 
+  {
+    # The version ends up in the output name and dots conflict with their use
+    # by Nix to select set attributes and end up require annoying quoting in
+    # command line usage.  Avoid that by using a different component separator
+    # (`_`).
+    version = "1_20_0";
+    buildArgs = {
+      version = "1.20.0";
+      src = v1_20_0;
+    };
+  }
+
   # Some other version.  Often probably a recent master revision, but who
   # knows.
   {
@@ -31,24 +48,24 @@ in
       # we'll call it something close to another version we know about.  If we
       # really need to know what version it was then the Nix derivation has
       # this information and we can dig it out.
-      version = "1.18.0.post1";
-      postPatch =
-        let
-          versionFileContents = version: ''
-            # This _version.py is generated by ZKAPAuthorizer's tahoe-lafs.nix.
-            # TODO: We can have more metadata after we switch to flakes.
-            # Then the `self` input will have a `sourceInfo` attribute telling
-            __pkgname__ = "tahoe-lafs"
-            real_version = "${version}"
-            full_version = "${version}"
-            branch = ""
-            verstr = "${version}"
-            __version__ = verstr
-          '';
-        in
-          ''
-            cp ${builtins.toFile "_version.py" (versionFileContents version)} src/allmydata/_version.py
-          '';
+      version = "1.20.0.post1";
+      # postPatch =
+      #   let
+      #     versionFileContents = version: ''
+      #       # This _version.py is generated by ZKAPAuthorizer's tahoe-lafs.nix.
+      #       # TODO: We can have more metadata after we switch to flakes.
+      #       # Then the `self` input will have a `sourceInfo` attribute telling
+      #       __pkgname__ = "tahoe-lafs"
+      #       real_version = "${version}"
+      #       full_version = "${version}"
+      #       branch = ""
+      #       verstr = "${version}"
+      #       __version__ = verstr
+      #     '';
+      #   in
+      #     ''
+      #       cp ${builtins.toFile "_version.py" (versionFileContents version)} src/allmydata/_version.py
+      #     '';
     };
   }
 ]

From 732ba499ddb7285b3c4d12170b2ad1ff93e66245 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 15 May 2025 15:53:38 +0000
Subject: [PATCH 25/28] WIP Got tests running with latest Tahoe-LAFS

---
 nix/lib.nix | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/nix/lib.nix b/nix/lib.nix
index bbba8753..7ca5238e 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -40,7 +40,7 @@ rec {
       # our override recursively to the package set until the return value is
       # the same as the input.
       packageOverrides = self: super: {
-        pycddl = self.callPackage ./pycddl.nix {};
+        # pycddl = self.callPackage ./pycddl.nix {};
 
         # The foolscap test suite has one failing test when run against the
         # new version of Twisted, so disable the test suite for now.  XXX
@@ -51,14 +51,14 @@ rec {
         compose = self.callPackage ./compose.nix {};
         tahoe-capabilities = self.callPackage ./tahoe-capabilities.nix {};
 
-        pyopenssl = self.callPackage ./pyopenssl.nix {
-          inherit (super) pyopenssl;
-        };
+        # pyopenssl = self.callPackage ./pyopenssl.nix {
+        #   inherit (super) pyopenssl;
+        # };
 
         # The klein test suite is a little broken so ... don't run it.
-        klein = dontCheck (self.callPackage ./klein.nix {
-          inherit (super) klein;
-        });
+        # klein = dontCheck (self.callPackage ./klein.nix {
+        #   inherit (super) klein;
+        # });
 
         # Disable some expensive dependencies that we don't care about.
         black = dontCheck (super.black.override {
@@ -82,24 +82,24 @@ rec {
           postPatch = tahoe-lafs.buildArgs.postPatch or null;
         };
 
-        flake8-isort = self.callPackage ./flake8-isort.nix {};
-        flake8-black = self.callPackage ./flake8-black.nix {};
-        mypy-zope = self.callPackage ./mypy-zope.nix {};
-        types-PyYAML = self.callPackage ./types-pyyaml.nix {};
+        # flake8-isort = self.callPackage ./flake8-isort.nix {};
+        # flake8-black = self.callPackage ./flake8-black.nix {};
+        # mypy-zope = self.callPackage ./mypy-zope.nix {};
+        # types-PyYAML = self.callPackage ./types-pyyaml.nix {};
 
         # Only the current master tip is Python 3.12 ready.
-        magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
-        magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};
+        # magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
+        # magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};
         # Magic Wormhole tests break with the updated version of transit-relay from above.
-        magic-wormhole = self.callPackage ./magic-wormhole.nix {};
+        # magic-wormhole = self.callPackage ./magic-wormhole.nix {};
         # Latest magic-wormhole requires latest spake2
-        spake2 = self.callPackage ./spake2.nix {};
+        # spake2 = self.callPackage ./spake2.nix {};
 
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
 
         # eliot 1.15 upgrades its bundled versioneer and works with Python 3.12
-        eliot = self.callPackage ./eliot.nix {};
+        # eliot = self.callPackage ./eliot.nix {};
         eliot-tree = self.callPackage ./eliot-tree.nix {};
 
         # Twisted runtimeDeps check fails to find zope-interface on Python 3.9
@@ -113,8 +113,8 @@ rec {
       pname = "ZKAPAuthorizer";
       # Don't forget to bump the version number in
       # src/_zkapauthorizer/__init__.py too.
-      version = "2022.8.21";
-      format = "setuptools";
+      version = "2025.5.15";
+      # format = "setuptools";
 
       # Should this be nativeCheckInputs?  It might matter for
       # cross-compilation.  It's not clear cross-compilation works for Python

From 41756ab4aa4047e6eefe1aebca181914fa591288 Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 15 May 2025 16:03:10 +0000
Subject: [PATCH 26/28] Make tahoe-lafs 1.20 work too

---
 nix/tahoe-versions.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/tahoe-versions.nix b/nix/tahoe-versions.nix
index e842f802..d6006295 100644
--- a/nix/tahoe-versions.nix
+++ b/nix/tahoe-versions.nix
@@ -8,9 +8,9 @@ let
     sha256 = "sha256-cXpHDfNO3TGta5RGfauqHK7dfy9SM7BLidjP6TbjF/4=";
   };
   v1_20_0 = fetchPypi {
-    pname = "tahoe-lafs";
+    pname = "tahoe_lafs";
     version = "1.20.0";
-    sha256 = "sha256-cXpHDFNO3TGta5RGfauqHK7dfy9SM7BLidjP6TbjF/4=";
+    sha256 = "sha256-0SH6t4TIraiV10Y++A5laX4pWqbET1CaPc5AE8pvV2g=";
   };
 in
 [

From 97c8ef51182eb9732f8e164eee332517c62daf1b Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 15 May 2025 16:22:36 +0000
Subject: [PATCH 27/28] Remove obsolete package overrides

---
 nix/eliot.nix                         |  66 ------------
 nix/flake8-black.nix                  |  23 ----
 nix/flake8-isort.nix                  |  18 ----
 nix/klein.nix                         |   9 --
 nix/lib.nix                           |  31 ------
 nix/magic-wormhole-mailbox-server.nix |  63 -----------
 nix/magic-wormhole-transit-relay.nix  |  60 -----------
 nix/magic-wormhole.nix                | 147 --------------------------
 nix/mypy-zope.nix                     |  19 ----
 nix/pycddl.nix                        |  22 ----
 nix/pyopenssl.nix                     |  10 --
 nix/spake2.nix                        |  38 -------
 nix/types-pyyaml.nix                  |  12 ---
 src/_zkapauthorizer/__init__.py       |   2 +-
 14 files changed, 1 insertion(+), 519 deletions(-)
 delete mode 100644 nix/eliot.nix
 delete mode 100644 nix/flake8-black.nix
 delete mode 100644 nix/flake8-isort.nix
 delete mode 100644 nix/klein.nix
 delete mode 100644 nix/magic-wormhole-mailbox-server.nix
 delete mode 100644 nix/magic-wormhole-transit-relay.nix
 delete mode 100644 nix/magic-wormhole.nix
 delete mode 100644 nix/mypy-zope.nix
 delete mode 100644 nix/pycddl.nix
 delete mode 100644 nix/pyopenssl.nix
 delete mode 100644 nix/spake2.nix
 delete mode 100644 nix/types-pyyaml.nix

diff --git a/nix/eliot.nix b/nix/eliot.nix
deleted file mode 100644
index b521e6d7..00000000
--- a/nix/eliot.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  aiocontextvars,
-  boltons,
-  hypothesis,
-  pyrsistent,
-  pytestCheckHook,
-  setuptools,
-  six,
-  testtools,
-  zope-interface,
-}:
-
-buildPythonPackage rec {
-  pname = "eliot";
-  version = "1.15.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "itamarst";
-    repo = "eliot";
-    rev = "1.15.0";
-    hash = "sha256-Ur7q7PZ5HH4ttD3b0HyBTe1B7eQ2nEWcTBR/Hjeg9yw=";
-  };
-
-  propagatedBuildInputs = [
-    aiocontextvars
-    boltons
-    pyrsistent
-    setuptools
-    six
-    zope-interface
-  ];
-
-  nativeCheckInputs = [
-    hypothesis
-    pytestCheckHook
-    testtools
-  ];
-
-  pythonImportsCheck = [ "eliot" ];
-
-  # Tests run eliot-prettyprint in out/bin.
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
-  disabledTests = [
-    "test_parse_stream"
-    # AttributeError: module 'inspect' has no attribute 'getargspec'
-    "test_default"
-  ];
-
-  meta = with lib; {
-    homepage = "https://eliot.readthedocs.io";
-    description = "Logging library that tells you why it happened";
-    mainProgram = "eliot-prettyprint";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ dpausp ];
-  };
-}
diff --git a/nix/flake8-black.nix b/nix/flake8-black.nix
deleted file mode 100644
index 96c3c1f5..00000000
--- a/nix/flake8-black.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ fetchPypi
-, buildPythonPackage
-, flake8
-, black
-, tomli
-, setuptools
-, pip
-}:
-buildPythonPackage rec {
-  pname = "flake8-black";
-  version = "0.3.6";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-DfvKMnR3d5KlvLKviHpMrXLHLQ6GyU4I46PeFRu0HDQ=";
-  };
-
-  format = "pyproject";
-  # doCheck = false;
-  buildInputs = [ setuptools pip ];
-  propagatedBuildInputs = [ flake8 black tomli ];
-  pythonImportsCheck = [ "flake8_black" ];
-}
diff --git a/nix/flake8-isort.nix b/nix/flake8-isort.nix
deleted file mode 100644
index a7532b2c..00000000
--- a/nix/flake8-isort.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ fetchPypi
-, buildPythonPackage
-, flake8
-, isort
-}:
-buildPythonPackage rec {
-  pname = "flake8-isort";
-  version = "6.1.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-1GOTQ7rFQBlMWfsWGKwsKFs+J2CfNTvvb1CQTUDBZD4=";
-  };
-
-  doCheck = false;
-  propagatedBuildInputs = [ flake8 isort ];
-  pythonImportsCheck = [ "flake8_isort" ];
-}
diff --git a/nix/klein.nix b/nix/klein.nix
deleted file mode 100644
index be442646..00000000
--- a/nix/klein.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ klein, fetchPypi }:
-klein.overrideAttrs (old: rec {
-  pname = "klein";
-  version = "23.5.0";
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-kGkSt6tBDZp/NRICg5w81zoqwHe9AHHIYcMfDu92Aoc=";
-  };
-})
diff --git a/nix/lib.nix b/nix/lib.nix
index 7ca5238e..0610753a 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -40,8 +40,6 @@ rec {
       # our override recursively to the package set until the return value is
       # the same as the input.
       packageOverrides = self: super: {
-        # pycddl = self.callPackage ./pycddl.nix {};
-
         # The foolscap test suite has one failing test when run against the
         # new version of Twisted, so disable the test suite for now.  XXX
         # Maybe we could just disable the one failing test,
@@ -51,15 +49,6 @@ rec {
         compose = self.callPackage ./compose.nix {};
         tahoe-capabilities = self.callPackage ./tahoe-capabilities.nix {};
 
-        # pyopenssl = self.callPackage ./pyopenssl.nix {
-        #   inherit (super) pyopenssl;
-        # };
-
-        # The klein test suite is a little broken so ... don't run it.
-        # klein = dontCheck (self.callPackage ./klein.nix {
-        #   inherit (super) klein;
-        # });
-
         # Disable some expensive dependencies that we don't care about.
         black = dontCheck (super.black.override {
           aiohttp = null;
@@ -82,30 +71,10 @@ rec {
           postPatch = tahoe-lafs.buildArgs.postPatch or null;
         };
 
-        # flake8-isort = self.callPackage ./flake8-isort.nix {};
-        # flake8-black = self.callPackage ./flake8-black.nix {};
-        # mypy-zope = self.callPackage ./mypy-zope.nix {};
-        # types-PyYAML = self.callPackage ./types-pyyaml.nix {};
-
-        # Only the current master tip is Python 3.12 ready.
-        # magic-wormhole-transit-relay = self.callPackage ./magic-wormhole-transit-relay.nix {};
-        # magic-wormhole-mailbox-server = self.callPackage ./magic-wormhole-mailbox-server.nix {};
-        # Magic Wormhole tests break with the updated version of transit-relay from above.
-        # magic-wormhole = self.callPackage ./magic-wormhole.nix {};
-        # Latest magic-wormhole requires latest spake2
-        # spake2 = self.callPackage ./spake2.nix {};
-
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
 
-        # eliot 1.15 upgrades its bundled versioneer and works with Python 3.12
-        # eliot = self.callPackage ./eliot.nix {};
         eliot-tree = self.callPackage ./eliot-tree.nix {};
-
-        # Twisted runtimeDeps check fails to find zope-interface on Python 3.9
-        twisted = super.twisted.overrideAttrs (old: {
-          dontCheckRuntimeDeps = true;
-        });
       };
     }); in with python.pkgs;
     buildPythonPackage rec {
diff --git a/nix/magic-wormhole-mailbox-server.nix b/nix/magic-wormhole-mailbox-server.nix
deleted file mode 100644
index 72f0dc4e..00000000
--- a/nix/magic-wormhole-mailbox-server.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  setuptools,
-  six,
-  attrs,
-  twisted,
-  autobahn,
-  treq,
-  mock,
-  pythonOlder,
-  pythonAtLeast,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "magic-wormhole-mailbox-server";
-  version = "0.4.1.post1";
-  pyproject = true;
-
-  # python 3.12 support: https://github.com/magic-wormhole/magic-wormhole-mailbox-server/issues/41
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.13";
-
-  src = fetchFromGitHub {
-    owner = "magic-wormhole";
-    repo = "magic-wormhole-mailbox-server";
-    rev = "30ecb6e3f6f487c915e7ff0acdf2e630cbe17dc8";
-    hash = "sha256-I07bQmWrGppxBvQyCndPlkc94KjBfcswVa8aTjHE66o=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [
-    attrs
-    six
-    twisted
-    autobahn
-  ] ++ autobahn.optional-dependencies.twisted ++ twisted.optional-dependencies.tls;
-
-  pythonImportsCheck = [ "wormhole_mailbox_server" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    treq
-    mock
-  ];
-
-  disabledTestPaths = lib.optionals stdenv.isDarwin [
-    # these tests fail in Darwin's sandbox
-    "src/wormhole_mailbox_server/test/test_web.py"
-  ];
-
-  meta = {
-    description = "Securely transfer data between computers";
-    homepage = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server";
-    changelog = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/${version}/NEWS.md";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.mjoerg ];
-  };
-}
diff --git a/nix/magic-wormhole-transit-relay.nix b/nix/magic-wormhole-transit-relay.nix
deleted file mode 100644
index 89366bc4..00000000
--- a/nix/magic-wormhole-transit-relay.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  setuptools,
-  autobahn,
-  mock,
-  twisted,
-  python,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "magic-wormhole-transit-relay";
-  version = "0.3.1";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LvLvvk008OYkhw+EIln9czuncVLtMQr0NJd0piiEkA4=";
-  };
-
-  postPatch = ''
-    # Passing the environment to twistd is necessary to preserve Python's site path.
-    substituteInPlace src/wormhole_transit_relay/test/test_backpressure.py --replace-fail \
-      'reactor.spawnProcess(proto, exe, args)' \
-      'reactor.spawnProcess(proto, exe, args, None)'
-  '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    autobahn
-    setuptools # pkg_resources is referenced at runtime
-    twisted
-  ];
-
-  pythonImportsCheck = [ "wormhole_transit_relay" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    mock
-    twisted
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  postCheck = ''
-    # Avoid collision with twisted's plugin cache (#164775).
-    rm "$out/${python.sitePackages}/twisted/plugins/dropin.cache"
-  '';
-
-  meta = {
-    description = "Transit Relay server for Magic-Wormhole";
-    homepage = "https://github.com/magic-wormhole/magic-wormhole-transit-relay";
-    changelog = "https://github.com/magic-wormhole/magic-wormhole-transit-relay/blob/${version}/NEWS.md";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.mjoerg ];
-  };
-}
diff --git a/nix/magic-wormhole.nix b/nix/magic-wormhole.nix
deleted file mode 100644
index 6d64ee1a..00000000
--- a/nix/magic-wormhole.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchPypi,
-  pythonAtLeast,
-
-  # build-system
-  setuptools,
-
-  # dependencies
-  spake2,
-  pynacl,
-  six,
-  attrs,
-  twisted,
-  autobahn,
-  automat,
-  tqdm,
-  click,
-  humanize,
-  iterable-io,
-  txtorcon,
-  zipstream-ng,
-
-  # optional-dependencies
-  noiseprotocol,
-
-  # tests
-  nettools,
-  unixtools,
-  mock,
-  magic-wormhole-transit-relay,
-  magic-wormhole-mailbox-server,
-  pytestCheckHook,
-}:
-
-let
-  # magic-wormhole relies on the internal API of
-  # magic-wormhole-transit-relay < 0.3.0 for testing.
-  magic-wormhole-transit-relay_0_2_1 =
-    magic-wormhole-transit-relay.overridePythonAttrs
-      (oldAttrs: rec {
-        version = "0.2.1";
-
-        src = fetchPypi {
-          pname = "magic-wormhole-transit-relay";
-          inherit version;
-          hash = "sha256-y0gBtGiQ6v+XKG4OP+xi0dUv/jF9FACDtjNqH7To+l4=";
-        };
-
-        postPatch = "";
-
-        postCheck = "";
-
-        meta.broken = pythonAtLeast "3.12";
-      });
-in
-buildPythonPackage rec {
-  pname = "magic-wormhole";
-  version = "0.16.0";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-FObBRomNvaem0ZAmJiOmlBmVU2Pn5DTWSq0tIz1tlMk=";
-  };
-
-  postPatch =
-    # enable tests by fixing the location of the wormhole binary
-    ''
-      substituteInPlace src/wormhole/test/test_cli.py --replace-fail \
-        'locations = procutils.which("wormhole")' \
-        'return "${placeholder "out"}/bin/wormhole"'
-    ''
-    # fix the location of the ifconfig binary
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
-    '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    attrs
-    autobahn
-    automat
-    click
-    humanize
-    iterable-io
-    pynacl
-    six
-    spake2
-    tqdm
-    twisted
-    txtorcon
-    zipstream-ng
-  ] ++ autobahn.optional-dependencies.twisted ++ twisted.optional-dependencies.tls;
-
-  optional-dependencies = {
-    dilation = [ noiseprotocol ];
-  };
-
-  nativeCheckInputs =
-    # For Python 3.12, remove magic-wormhole-mailbox-server and magic-wormhole-transit-relay from test dependencies,
-    # which are not yet supported with this version.
-    lib.optionals
-      (!magic-wormhole-mailbox-server.meta.broken && !magic-wormhole-transit-relay_0_2_1.meta.broken)
-      [
-        magic-wormhole-mailbox-server
-        magic-wormhole-transit-relay_0_2_1
-      ]
-    ++ [
-      mock
-      pytestCheckHook
-    ]
-    ++ optional-dependencies.dilation
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ unixtools.locale ];
-
-  __darwinAllowLocalNetworking = true;
-
-  disabledTestPaths =
-    # For Python 3.12, remove the tests depending on magic-wormhole-mailbox-server and magic-wormhole-transit-relay,
-    # which are not yet supported with this version.
-    lib.optionals
-      (magic-wormhole-mailbox-server.meta.broken || magic-wormhole-transit-relay_0_2_1.meta.broken)
-      [
-        "src/wormhole/test/dilate/test_full.py"
-        "src/wormhole/test/test_args.py"
-        "src/wormhole/test/test_cli.py"
-        "src/wormhole/test/test_transit.py"
-        "src/wormhole/test/test_wormhole.py"
-        "src/wormhole/test/test_xfer_util.py"
-      ];
-
-  postInstall = ''
-    install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
-  '';
-
-  meta = {
-    changelog = "https://github.com/magic-wormhole/magic-wormhole/blob/${version}/NEWS.md";
-    description = "Securely transfer data between computers";
-    homepage = "https://github.com/magic-wormhole/magic-wormhole";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.mjoerg ];
-    mainProgram = "wormhole";
-  };
-}
diff --git a/nix/mypy-zope.nix b/nix/mypy-zope.nix
deleted file mode 100644
index 821b0299..00000000
--- a/nix/mypy-zope.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ fetchPypi
-, buildPythonPackage
-, pythonPackages
-, zope_interface
-, zope_schema
-}:
-buildPythonPackage rec {
-  pname = "mypy_zope";
-  version = "1.0.9";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-N9aYXfsFpMJ7Nc/0dXf9W62HjbSJPd7fVNFl9ziaHNs=";
-  };
-
-  # doCheck = false;
-  propagatedBuildInputs = [ pythonPackages.mypy zope_interface zope_schema ];
-  pythonImportsCheck = [ "mypy_zope" ];
-}
diff --git a/nix/pycddl.nix b/nix/pycddl.nix
deleted file mode 100644
index 9392add4..00000000
--- a/nix/pycddl.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, fetchPypi, buildPythonPackage, rustPlatform }:
-buildPythonPackage rec {
-  pname = "pycddl";
-  version = "0.6.3";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-lVybSr+QvyepdTZfiTjqU0ENu6TT87ZZXIECBA8nMV4=";
-  };
-
-  nativeBuildInputs = with rustPlatform; [
-    maturinBuildHook
-    cargoSetupHook
-  ];
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-VpJ/PLAwwuakwsNAtLDdWGXCxl6jGMTvsEhzIHk6a0g=";
-  };
-}
diff --git a/nix/pyopenssl.nix b/nix/pyopenssl.nix
deleted file mode 100644
index 100be478..00000000
--- a/nix/pyopenssl.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ pyopenssl, fetchPypi, isPyPy }:
-pyopenssl.overrideAttrs (old: rec {
-  pname = "pyOpenSSL";
-  version = "24.1.0";
-  name = "${pname}-${version}";
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "yr7Uv6pd+fGhbA72Sgy2Uxi1zQd6ftp9aXATHKL0Gm8=";
-  };
-})
diff --git a/nix/spake2.nix b/nix/spake2.nix
deleted file mode 100644
index 98602e7d..00000000
--- a/nix/spake2.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch2,
-  setuptools,
-  cryptography,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "spake2";
-  version = "0.9";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "warner";
-    repo = "python-spake2";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-WPMGH1OzG+5O+2lNl2sv06/dNardY+BHYDS290Z36vQ=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ cryptography ];
-
-  pythonImportsCheck = [ "spake2" ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  meta = with lib; {
-    changelog = "https://github.com/warner/python-spake2/blob/v${version}/NEWS";
-    description = "SPAKE2 password-authenticated key exchange library";
-    homepage = "https://github.com/warner/python-spake2";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
diff --git a/nix/types-pyyaml.nix b/nix/types-pyyaml.nix
deleted file mode 100644
index 98b7b6f6..00000000
--- a/nix/types-pyyaml.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ fetchPypi
-, buildPythonPackage
-}:
-buildPythonPackage rec {
-  pname = "types-PyYAML";
-  version = "6.0.12.20240917";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0UBahvlXZoIjTvg7y05v/3yTBcix+61eC81Pfb3JxYc=";
-  };
-}
diff --git a/src/_zkapauthorizer/__init__.py b/src/_zkapauthorizer/__init__.py
index 85d5fbc5..7d6daaf0 100644
--- a/src/_zkapauthorizer/__init__.py
+++ b/src/_zkapauthorizer/__init__.py
@@ -28,4 +28,4 @@
 NAME = "privatestorageio-zkapauthz-v2"
 
 # Don't forget to bump the version number in nix/lib.nix too.
-__version__ = "2022.8.21"
+__version__ = "2025.5.15"

From 79587917925fa2aa3c2fb9c13ca8d70fa5129e6d Mon Sep 17 00:00:00 2001
From: Florian Sesser <florian@leastauthority.com>
Date: Thu, 15 May 2025 16:38:51 +0000
Subject: [PATCH 28/28] Use eliot-tree from nixpkgs

---
 nix/eliot-tree.nix | 54 ----------------------------------------------
 nix/lib.nix        |  4 +---
 2 files changed, 1 insertion(+), 57 deletions(-)
 delete mode 100644 nix/eliot-tree.nix

diff --git a/nix/eliot-tree.nix b/nix/eliot-tree.nix
deleted file mode 100644
index 3a8c809f..00000000
--- a/nix/eliot-tree.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchPypi,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "eliot-tree";
-  version = "21.0.0";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-hTl+r+QJPPQ7ss73lty3Wm7DLy2SKGmmgIuJx38ilO8=";
-  };
-
-  # Patch Python 3.12 incompatibilities in versioneer.py.
-  postPatch = ''
-    substituteInPlace versioneer.py \
-      --replace-fail SafeConfigParser ConfigParser \
-      --replace-fail readfp read_file
-  '';
-
-  build-system = with python3Packages; [ setuptools ];
-
-  dependencies = with python3Packages; [
-    colored
-    eliot
-    iso8601
-    jmespath
-    toolz
-  ];
-
-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    testtools
-  ];
-
-  # Tests run eliot-tree in out/bin.
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
-  pythonImportsCheck = [ "eliottree" ];
-
-  meta = {
-    homepage = "https://github.com/jonathanj/eliottree";
-    changelog = "https://github.com/jonathanj/eliottree/blob/${version}/NEWS.rst";
-    description = "Render Eliot logs as an ASCII tree";
-    mainProgram = "eliot-tree";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.dpausp ];
-  };
-}
diff --git a/nix/lib.nix b/nix/lib.nix
index 0610753a..559b5856 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -73,8 +73,6 @@ rec {
 
         # collections-extended isn't maintained anymore.
         collections-extended = self.callPackage ./collections-extended.nix {};
-
-        eliot-tree = self.callPackage ./eliot-tree.nix {};
       };
     }); in with python.pkgs;
     buildPythonPackage rec {
@@ -95,7 +93,7 @@ rec {
         testresources
         hypothesis
         openapi-spec-validator
-        (toPythonModule (eliot-tree.override { python3Packages = python.pkgs; }))
+        (toPythonModule (pkgs.eliot-tree.override { python3Packages = python.pkgs; }))
       ];
 
       postFixup = ''