MEGA MERGE

New apt list does not have Package: as the first entry for all packages

doc/maintainers.md

@@ -0,0 +1,30 @@
+# Maintainers
+
+## Role of a maintainer
+The responsibilities of maintainers are quite lax, and similar in spirit to
+[nixpkgs' maintainers][1]:
+
+    The main responsibility of a maintainer is to keep the packages they
+    maintain in a functioning state, and keep up with updates. In order to do
+    that, they are empowered to make decisions over the packages they maintain.
+
+    That being said, the maintainer is not alone in proposing changes to the
+    packages. Anybody (both bots and humans) can send PRs to bump or tweak the
+    package.
+
+In practice, this means that when updating or proposing changes to a package,
+we will notify maintainers by mentioning them in Gitea so they can test changes
+and give feedback.
+
+Since we do bi-yearly release cycles, there is no expectation from maintainers
+to update packages at each upstream release. Nevertheless, on each release cycle
+we may request help from maintainers when updating or testing their packages.
+
+## Becoming a maintainer
+
+
+You'll have to add yourself in the `maintainers.nix` list; your username should
+match your `bsc.es` email. Then you can add yourself to the `meta.maintainers`
+of any package you are interested in maintaining.
+
+[1]: [https://github.com/NixOS/nixpkgs/tree/nixos-25.05/maintainers]

flake.lock

@@ -1,64 +1,25 @@
 {
   "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": [],
-        "home-manager": [],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": [
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1750173260,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752436162,
-        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
+        "lastModified": 1764522689,
+        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "agenix": "agenix",
-        "nixpkgs": "nixpkgs",
-        "systems": "systems"
+        "nixpkgs": "nixpkgs"
       }
-    },
-    "systems": {
-      "flake": false,
-      "locked": {
-        "path": "./pkgs/systems.nix",
-        "type": "path"
-      },
-      "original": {
-        "path": "./pkgs/systems.nix",
-        "type": "path"
-      },
-      "parent": []
     }
   },
   "root": "root",

flake.nix

@@ -1,22 +1,13 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
-
-    systems.url = "path:./pkgs/systems.nix";
-    systems.flake = false;
-
-    agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
-    agenix.inputs.systems.follows = "systems";
-    agenix.inputs.darwin.follows = "";
-    agenix.inputs.home-manager.follows = "";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
-  outputs = { self, nixpkgs, agenix, ... }:
+  outputs = { self, nixpkgs, ... }:
 let
   mkConf = name: nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
-    specialArgs = { inherit nixpkgs agenix; theFlake = self; };
+    specialArgs = { inherit nixpkgs; theFlake = self; };
     modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
   };
   # For now we only support x86
@@ -52,6 +43,10 @@ in
     hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;
 
     # propagate nixpkgs lib, so we can do bscpkgs.lib
-    inherit (nixpkgs) lib;
+    lib = nixpkgs.lib // {
+      maintainers = nixpkgs.lib.maintainers // {
+        bsc = import ./pkgs/maintainers.nix;
+      };
+    };
   };
 }

m/common/base.nix

@@ -7,6 +7,7 @@
     ./base/august-shutdown.nix
     ./base/boot.nix
     ./base/env.nix
+    ./base/fish.nix
     ./base/fs.nix
     ./base/hw.nix
     ./base/net.nix

m/common/base/agenix.nix

@@ -1,9 +1,8 @@
-{ agenix, ... }:
+{ pkgs, ... }:
 
 {
-  imports = [ agenix.nixosModules.default ];
+  imports = [ ../../module/agenix.nix ];
 
-  environment.systemPackages = [
-    agenix.packages.x86_64-linux.default
-  ];
+  # Add agenix to system packages
+  environment.systemPackages = [ pkgs.agenix ];
 }

m/common/base/env.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 
 {
   environment.systemPackages = with pkgs; [
     vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
     nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
-    ncdu config.boot.kernelPackages.perf ldns pv
-    # From bsckgs overlay
-    osumb
+    ncdu perf ldns pv
+    nix-output-monitor
+    nixfmt-tree
+    # From jungle overlay
+    osumb nixgen
   ];
 
   programs.direnv.enable = true;
@@ -28,9 +30,22 @@
     VISUAL = "vim";
   };
 
-  programs.bash.promptInit = ''
-    PS1="\h\\$ "
-  '';
+  programs.bash.promptInit = # bash
+    ''
+      if echo "$PATH" | grep -qc '/nix/store'; then
+        # Inside a nix shell, dumb prompt
+        PS1="\h\\$ "
+      elif [ "$TERM" != "dumb" ] ; then
+        PROMPT_COLOR="1;31m"
+        ((UID)) && PROMPT_COLOR="1;32m"
+
+        PS1="\n\[\033[$PROMPT_COLOR\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\\$\[\033[0m\] "
+
+        if test "$TERM" = "xterm"; then
+          PS1="\[\033]2;\h:\u:\w\007\]$PS1"
+        fi
+      fi
+    '';
 
   time.timeZone = "Europe/Madrid";
   i18n.defaultLocale = "en_DK.UTF-8";

m/common/base/fish.nix

@@ -0,0 +1,3 @@
+{
+  programs.fish.enable = true;
+}

m/common/base/users.nix

@@ -87,6 +87,13 @@
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIIFiqXqt88VuUfyANkZyLJNiuroIITaGlOOTMhVDKjf abonerib@bsc"
         ];
+        shell = pkgs.fish;
+        packages = with pkgs; [
+          fzf
+          jujutsu
+          neovim
+          starship
+        ];
       };
 
       vlopez = {
@@ -180,6 +187,19 @@
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmMqKqPg4uocNOr3O41kLbZMOMJn3m2ZdN1JvTR96z3 bsccns@arnau-bsc"
         ];
       };
+
+      aaguirre = {
+        uid = 9655;
+        isNormalUser = true;
+        home = "/home/Computational/aaguirre";
+        description = "Alejandro Aguirre";
+        group = "Computational";
+        hosts = [ "apex" "hut" ];
+        hashedPassword = "$6$TXRXQT6jjBvxkxU6$E.sh5KspAm1qeG5Ct7OPHpo8REmbGDwjFGvqeGgTVz3GASGOAnPL7UMZsMAsAKBoahOw.v8LNno6XGrTEPzZH1";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
+        ];
+      };
     };
 
     groups = {

m/common/base/watchdog.nix

@@ -5,5 +5,5 @@
   boot.kernelModules = [ "ipmi_watchdog" ];
 
   # Enable systemd watchdog with 30 s interval
-  systemd.watchdog.runtimeTime = "30s";
+  systemd.settings.Manager.RuntimeWatchdogSec = 30;
 }

m/fox/configuration.nix

@@ -93,20 +93,4 @@
     wantedBy = [ "multi-user.target" ];
     serviceConfig.ExecStart = script;
   };
-
-  # Only allow SSH connections from users who have a SLURM allocation
-  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
-  security.pam.services.sshd.rules.account.slurm = {
-    control = "required";
-    enable = true;
-    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
-    args = [ "log_level=debug5" ];
-    order = 999999; # Make it last one
-  };
-
-  # Disable systemd session (pam_systemd.so) as it will conflict with the
-  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
-  # into the slurmstepd task and then into the systemd session, which is not
-  # what we want, otherwise it will linger even if all jobs are gone.
-  security.pam.services.sshd.startSession = lib.mkForce false;
 }

m/hut/configuration.nix

@@ -17,6 +17,7 @@
     ./postgresql.nix
     ./nginx.nix
     ./p.nix
+    ./ompss2-timer.nix
     #./pxe.nix
   ];
 

m/hut/gitea.nix

@@ -29,6 +29,9 @@
     };
   };
 
+  # Allow gitea user to send mail
+  users.users.gitea.extraGroups = [ "mail-robot" ];
+
   services.gitea-actions-runner.instances = {
     runrun = {
       enable = true;

m/hut/msmtp.nix

@@ -1,8 +1,11 @@
 { config, lib, ... }:
 {
+  # Robot user that can see the password to send mail from jungle-robot
+  users.groups.mail-robot = {};
+
   age.secrets.jungleRobotPassword = {
     file = ../../secrets/jungle-robot-password.age;
-    group = "gitea";
+    group = "mail-robot";
     mode = "440";
   };
 

m/hut/nginx.nix

@@ -4,8 +4,8 @@ let
     name = "jungle-web";
     src = pkgs.fetchgit {
       url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
     };
     buildInputs = [ pkgs.hugo ];
     buildPhase = ''

m/hut/ompss2-timer.nix

@@ -0,0 +1,85 @@
+{ config, pkgs, ... }:
+{
+  systemd.timers = {
+    "ompss2-closing" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-closing.service";
+        OnCalendar = [ "*-03-15 07:00:00" "*-09-15 07:00:00"];
+      };
+    };
+    "ompss2-freeze" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-freeze.service";
+        OnCalendar = [ "*-04-15 07:00:00" "*-10-15 07:00:00" ];
+      };
+    };
+    "ompss2-release" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-release.service";
+        OnCalendar = [ "*-05-15 07:00:00" "*-11-15 07:00:00" ];
+      };
+    };
+  };
+
+  systemd.services =
+  let
+    closing = pkgs.writeText "closing.txt"
+    ''
+      Subject: OmpSs-2 release enters closing period
+
+      Hi,
+
+      You have one month to merge the remaining features for the next OmpSs-2
+      release. Please, identify what needs to be merged and discuss it in the next
+      OmpSs-2 meeting.
+
+      Thanks!,
+      Jungle robot
+    '';
+    freeze = pkgs.writeText "freeze.txt"
+    ''
+      Subject: OmpSs-2 release enters freeze period
+
+      Hi,
+
+      The period to introduce new features or breaking changes is over, only bug
+      fixes are allowed now. During this time, please prepare the release notes
+      to be included in the next OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    release = pkgs.writeText "release.txt"
+    ''
+      Subject: OmpSs-2 release now
+
+      Hi,
+
+      The period to introduce bug fixes is now over. Please, proceed to do the
+      OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    mkServ = name: mail: {
+      "ompss2-${name}" = {
+        script = ''
+          set -eu
+          set -o pipefail
+          cat ${mail} | ${config.security.wrapperDir}/sendmail star@bsc.es
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          DynamicUser = true;
+          Group = "mail-robot";
+        };
+      };
+    };
+  in
+    (mkServ "closing" closing) //
+    (mkServ "freeze" freeze) //
+    (mkServ "release" release);
+}

m/module/agenix.nix

@@ -0,0 +1,357 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  cfg = config.age;
+
+  isDarwin = lib.attrsets.hasAttrByPath [ "environment" "darwinConfig" ] options;
+
+  ageBin = config.age.ageBin;
+
+  users = config.users.users;
+
+  sysusersEnabled =
+    if isDarwin then
+      false
+    else
+      options.systemd ? sysusers && (config.systemd.sysusers.enable || config.services.userborn.enable);
+
+  mountCommand =
+    if isDarwin then
+      ''
+        if ! diskutil info "${cfg.secretsMountPoint}" &> /dev/null; then
+            num_sectors=1048576
+            dev=$(hdiutil attach -nomount ram://"$num_sectors" | sed 's/[[:space:]]*$//')
+            newfs_hfs -v agenix "$dev"
+            mount -t hfs -o nobrowse,nodev,nosuid,-m=0751 "$dev" "${cfg.secretsMountPoint}"
+        fi
+      ''
+    else
+      ''
+        grep -q "${cfg.secretsMountPoint} ramfs" /proc/mounts ||
+          mount -t ramfs none "${cfg.secretsMountPoint}" -o nodev,nosuid,mode=0751
+      '';
+  newGeneration = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] creating new generation in ${cfg.secretsMountPoint}/$_agenix_generation"
+    mkdir -p "${cfg.secretsMountPoint}"
+    chmod 0751 "${cfg.secretsMountPoint}"
+    ${mountCommand}
+    mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
+    chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  chownGroup = if isDarwin then "admin" else "keys";
+  # chown the secrets mountpoint and the current generation to the keys group
+  # instead of leaving it root:root.
+  chownMountPoint = ''
+    chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  setTruePath = secretType: ''
+    ${
+      if secretType.symlink then
+        ''
+          _truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
+        ''
+      else
+        ''
+          _truePath="${secretType.path}"
+        ''
+    }
+  '';
+
+  installSecret = secretType: ''
+    ${setTruePath secretType}
+    echo "decrypting '${secretType.file}' to '$_truePath'..."
+    TMP_FILE="$_truePath.tmp"
+
+    IDENTITIES=()
+    for identity in ${toString cfg.identityPaths}; do
+      test -r "$identity" || continue
+      test -s "$identity" || continue
+      IDENTITIES+=(-i)
+      IDENTITIES+=("$identity")
+    done
+
+    test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
+
+    mkdir -p "$(dirname "$_truePath")"
+    [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
+    (
+      umask u=r,g=,o=
+      test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
+      test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
+      LANG=${
+        config.i18n.defaultLocale or "C"
+      } ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
+    )
+    chmod ${secretType.mode} "$TMP_FILE"
+    mv -f "$TMP_FILE" "$_truePath"
+
+    ${optionalString secretType.symlink ''
+      [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
+    ''}
+  '';
+
+  testIdentities = map (path: ''
+    test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
+  '') cfg.identityPaths;
+
+  cleanupAndLink = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
+    ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
+
+    (( _agenix_generation > 1 )) && {
+    echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
+    rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
+    }
+  '';
+
+  installSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] decrypting secrets...'" ]
+    ++ testIdentities
+    ++ (map installSecret (builtins.attrValues cfg.secrets))
+    ++ [ cleanupAndLink ]
+  );
+
+  chownSecret = secretType: ''
+    ${setTruePath secretType}
+    chown ${secretType.owner}:${secretType.group} "$_truePath"
+  '';
+
+  chownSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] chowning...'" ]
+    ++ [ chownMountPoint ]
+    ++ (map chownSecret (builtins.attrValues cfg.secrets))
+  );
+
+  secretType = types.submodule (
+    { config, ... }:
+    {
+      options = {
+        name = mkOption {
+          type = types.str;
+          default = config._module.args.name;
+          defaultText = literalExpression "config._module.args.name";
+          description = ''
+            Name of the file used in {option}`age.secretsDir`
+          '';
+        };
+        file = mkOption {
+          type = types.path;
+          description = ''
+            Age file the secret is loaded from.
+          '';
+        };
+        path = mkOption {
+          type = types.str;
+          default = "${cfg.secretsDir}/${config.name}";
+          defaultText = literalExpression ''
+            "''${cfg.secretsDir}/''${config.name}"
+          '';
+          description = ''
+            Path where the decrypted secret is installed.
+          '';
+        };
+        mode = mkOption {
+          type = types.str;
+          default = "0400";
+          description = ''
+            Permissions mode of the decrypted secret in a format understood by chmod.
+          '';
+        };
+        owner = mkOption {
+          type = types.str;
+          default = "0";
+          description = ''
+            User of the decrypted secret.
+          '';
+        };
+        group = mkOption {
+          type = types.str;
+          default = users.${config.owner}.group or "0";
+          defaultText = literalExpression ''
+            users.''${config.owner}.group or "0"
+          '';
+          description = ''
+            Group of the decrypted secret.
+          '';
+        };
+        symlink = mkEnableOption "symlinking secrets to their destination" // {
+          default = true;
+        };
+      };
+    }
+  );
+in
+{
+  imports = [
+    (mkRenamedOptionModule [ "age" "sshKeyPaths" ] [ "age" "identityPaths" ])
+  ];
+
+  options.age = {
+    ageBin = mkOption {
+      type = types.str;
+      default = "${pkgs.age}/bin/age";
+      defaultText = literalExpression ''
+        "''${pkgs.age}/bin/age"
+      '';
+      description = ''
+        The age executable to use.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrsOf secretType;
+      default = { };
+      description = ''
+        Attrset of secrets.
+      '';
+    };
+    secretsDir = mkOption {
+      type = types.path;
+      default = "/run/agenix";
+      description = ''
+        Folder where secrets are symlinked to
+      '';
+    };
+    secretsMountPoint = mkOption {
+      type =
+        types.addCheck types.str (
+          s:
+          (builtins.match "[ \t\n]*" s) == null # non-empty
+          && (builtins.match ".+/" s) == null
+        ) # without trailing slash
+        // {
+          description = "${types.str.description} (with check: non-empty without trailing slash)";
+        };
+      default = "/run/agenix.d";
+      description = ''
+        Where secrets are created before they are symlinked to {option}`age.secretsDir`
+      '';
+    };
+    identityPaths = mkOption {
+      type = types.listOf types.path;
+      default =
+        if isDarwin then
+          [
+            "/etc/ssh/ssh_host_ed25519_key"
+            "/etc/ssh/ssh_host_rsa_key"
+          ]
+        else if (config.services.openssh.enable or false) then
+          map (e: e.path) (
+            lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys
+          )
+        else
+          [ ];
+      defaultText = literalExpression ''
+        if isDarwin
+        then [
+          "/etc/ssh/ssh_host_ed25519_key"
+          "/etc/ssh/ssh_host_rsa_key"
+        ]
+        else if (config.services.openssh.enable or false)
+        then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
+        else [];
+      '';
+      description = ''
+        Path to SSH keys to be used as identities in age decryption.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.secrets != { }) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.identityPaths != [ ];
+          message = "age.identityPaths must be set, for example by enabling openssh.";
+        }
+      ];
+    }
+    (optionalAttrs (!isDarwin) {
+      # When using sysusers we no longer be started as an activation script
+      # because those are started in initrd while sysusers is started later.
+      systemd.services.agenix-install-secrets = mkIf sysusersEnabled {
+        wantedBy = [ "sysinit.target" ];
+        after = [ "systemd-sysusers.service" ];
+        unitConfig.DefaultDependencies = "no";
+
+        path = [ pkgs.mount ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = pkgs.writeShellScript "agenix-install" (concatLines [
+            newGeneration
+            installSecrets
+            chownSecrets
+          ]);
+          RemainAfterExit = true;
+        };
+      };
+
+      # Create a new directory full of secrets for symlinking (this helps
+      # ensure removed secrets are actually removed, or at least become
+      # invalid symlinks).
+      system.activationScripts = mkIf (!sysusersEnabled) {
+        agenixNewGeneration = {
+          text = newGeneration;
+          deps = [
+            "specialfs"
+          ];
+        };
+
+        agenixInstall = {
+          text = installSecrets;
+          deps = [
+            "agenixNewGeneration"
+            "specialfs"
+          ];
+        };
+
+        # So user passwords can be encrypted.
+        users.deps = [ "agenixInstall" ];
+
+        # Change ownership and group after users and groups are made.
+        agenixChown = {
+          text = chownSecrets;
+          deps = [
+            "users"
+            "groups"
+          ];
+        };
+
+        # So other activation scripts can depend on agenix being done.
+        agenix = {
+          text = "";
+          deps = [ "agenixChown" ];
+        };
+      };
+    })
+
+    (optionalAttrs isDarwin {
+      launchd.daemons.activate-agenix = {
+        script = ''
+          set -e
+          set -o pipefail
+          export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          ${newGeneration}
+          ${installSecrets}
+          ${chownSecrets}
+          exit 0
+        '';
+        serviceConfig = {
+          RunAtLoad = true;
+          KeepAlive.SuccessfulExit = false;
+        };
+      };
+    })
+  ]);
+}

m/module/debuginfod.nix

@@ -1,3 +1,10 @@
 {
-  services.nixseparatedebuginfod.enable = true;
+  services.nixseparatedebuginfod2 = {
+    enable = true;
+    substituters = [
+      "local:"
+      "https://cache.nixos.org"
+      "http://hut/cache"
+    ];
+  };
 }

m/module/slurm-client.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
@@ -21,4 +21,20 @@
   };
 
   services.slurm.client.enable = true;
+
+  # Only allow SSH connections from users who have a SLURM allocation
+  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
+  security.pam.services.sshd.rules.account.slurm = {
+    control = "required";
+    enable = true;
+    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
+    args = [ "log_level=debug5" ];
+    order = 999999; # Make it last one
+  };
+
+  # Disable systemd session (pam_systemd.so) as it will conflict with the
+  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
+  # into the slurmstepd task and then into the systemd session, which is not
+  # what we want, otherwise it will linger even if all jobs are gone.
+  security.pam.services.sshd.startSession = lib.mkForce false;
 }

m/module/slurm-common.nix

@@ -1,31 +1,6 @@
 { config, pkgs, ... }:
 
-let
-  suspendProgram = pkgs.writeShellScript "suspend.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Shutting down host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power off
-    done
-  '';
-
-  resumeProgram = pkgs.writeShellScript "resume.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Starting host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power on
-    done
-  '';
-
-in {
+{
   services.slurm = {
     controlMachine = "apex";
     clusterName = "jungle";
@@ -59,16 +34,6 @@ in {
       # the resources. Use the task/cgroup plugin to enable process containment.
       TaskPlugin=task/affinity,task/cgroup
 
-      # Power off unused nodes until they are requested
-      SuspendProgram=${suspendProgram}
-      SuspendTimeout=60
-      ResumeProgram=${resumeProgram}
-      ResumeTimeout=300
-      SuspendExcNodes=fox
-
-      # Turn the nodes off after 1 hour of inactivity
-      SuspendTime=3600
-
       # Reduce port range so we can allow only this range in the firewall
       SrunPortRange=60000-61000
 
@@ -86,9 +51,7 @@ in {
       # when a task runs (srun) so we can ssh early.
       PrologFlags=Alloc,Contain,X11
 
-      # LaunchParameters=ulimit_pam_adopt will set RLIMIT_RSS in processes
-      # adopted by the external step, similar to tasks running in regular steps
-      # LaunchParameters=ulimit_pam_adopt
+      LaunchParameters=use_interactive_step
       SlurmdDebug=debug5
       #DebugFlags=Protocol,Cgroup
     '';

m/tent/nginx.nix

@@ -4,8 +4,8 @@ let
     name = "jungle-web";
     src = pkgs.fetchgit {
       url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
     };
     buildInputs = [ pkgs.hugo ];
     buildPhase = ''

m/weasel/configuration.nix

@@ -1,9 +1,10 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
     ../common/ssf.nix
     ../module/hut-substituter.nix
+    ./hydra.nix
   ];
 
   # Select this using the ID to avoid mismatches
@@ -30,4 +31,22 @@
       prefixLength = 24;
     } ];
   };
+
+  services.nix-serve = {
+    enable = true;
+    bindAddress = "0.0.0.0";
+    port = 5000;
+    package = pkgs.haskell.lib.overrideSrc (pkgs.haskell.packages.ghc96.nix-serve-ng.override { nix = pkgs.nixVersions.nix_2_28; }) {
+      src = pkgs.fetchgit {
+        url = "https://jungle.bsc.es/git/abonerib/nix-serve-ng.git";
+        rev = "9c056641300a826db66b66d7e584b2541d38927a";
+        hash = "sha256-y69ZchFiZOU71eyeljcQgLxkLk5JUzZfanq8Yzw4MkI=";
+      };
+      version = "unstable";
+    };
+
+    secretKeyFile = "/var/cache-priv-key.pem";
+    # Public key:
+    # 10.0.40.6:8jBhIdXEBap+Qo+vc1/fnV9vj43A2oDk839EEheRr/U=
+  };
 }

m/weasel/hydra.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  services.hydra = {
+    enable = true;
+
+    # Wrap hydra so it puts quiet flag every time... This is dumb and annoying,
+    # but i can't override the systemd ExecStart without running into infinite
+    # recursion.
+    package = pkgs.symlinkJoin {
+      name = "hydra-quiet";
+      paths = [ pkgs.hydra ];
+      postBuild = ''
+        for prog in hydra-queue-runner hydra-evaluator ; do
+          prev=$(realpath $out/bin/$prog)
+          rm $out/bin/$prog
+          cat >$out/bin/$prog <<EOF
+        #!/bin/sh
+        args=()
+        for arg in "\$@"; do
+          if [ "\$arg" != "-v" ]; then
+            args+=("\$arg")
+          fi
+        done
+        exec $prev --quiet "\''${args[@]}"
+        EOF
+
+          chmod +x $out/bin/$prog
+        done
+      '';
+    };
+
+    hydraURL = "http://localhost:3001"; # externally visible URL
+    notificationSender = "hydra@jungle.bsc.es"; # e-mail of Hydra service
+    port = 3001;
+    # a standalone Hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+    buildMachinesFiles = [ ];
+    # you will probably also want, otherwise *everything* will be built from scratch
+    useSubstitutes = true;
+    listenHost = "0.0.0.0"; # Force IPv4
+  };
+
+  systemd.services.hydra-send-stats.enable = lib.mkForce false;
+
+  networking.firewall.allowedTCPPorts = [ config.services.hydra.port ];
+
+  nix.settings.extra-allowed-uris = [
+    "git+ssh://git@bscpm04.bsc.es"
+    "git+ssh://git@gitlab-internal.bsc.es"
+    "https://github.com"
+    "git+ssh://github.com"
+  ];
+}

overlay.nix

@@ -7,7 +7,11 @@ let
   callPackage = final.callPackage;
 
   bscPkgs = {
+    agenix = prev.callPackage ./pkgs/agenix/default.nix { };
     amd-uprof = prev.callPackage ./pkgs/amd-uprof/default.nix { };
+    aoccUnwrapped = callPackage ./pkgs/aocc/unwrapped.nix { };
+    aocc = callPackage ./pkgs/aocc/default.nix { };
+    stdenvAocc = final.overrideCC final.stdenv final.aocc;
     bench6 = callPackage ./pkgs/bench6/default.nix { };
     bigotes = callPackage ./pkgs/bigotes/default.nix { };
     clangOmpss2 = callPackage ./pkgs/llvm-ompss2/default.nix { };
@@ -18,7 +22,12 @@ let
     cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
     #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
     gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
+    gromacs = callPackage ./pkgs/gromacs/default.nix { enableSYCL = true; };
+    intel-apt = callPackage ./pkgs/intel-oneapi/packages.nix { };
     intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
+    intelPackages_2024 = final.intel-apt.hpckit_2024;
+    intelPackages_2025 = final.intel-apt.hpckit_2025;
+    intelPackages = final.intelPackages_2025;
     jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
     # FIXME: Extend this to all linuxPackages variants. Open problem, see:
     # https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
@@ -28,28 +37,45 @@ let
     linuxPackages_latest = prev.linuxPackages_latest.extend(_final: _prev: {
       amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
     });
+    llvm-intel = callPackage ./pkgs/llvm-intel/default.nix { };
     lmbench = callPackage ./pkgs/lmbench/default.nix { };
-    mcxx = callPackage ./pkgs/mcxx/default.nix { };
+    # Broken and unmantained
+    # mcxx = callPackage ./pkgs/mcxx/default.nix { };
     meteocat-exporter = prev.callPackage ./pkgs/meteocat-exporter/default.nix { };
     mpi = final.mpich; # Set MPICH as default
     mpich = callPackage ./pkgs/mpich/default.nix { mpich = prev.mpich; };
     nanos6 = callPackage ./pkgs/nanos6/default.nix { };
     nanos6Debug = final.nanos6.override { enableDebug = true; };
     nixtools = callPackage ./pkgs/nixtools/default.nix { };
+    nixgen = callPackage ./pkgs/nixgen/default.nix { };
     # Broken because of pkgsStatic.libcap
     # See: https://github.com/NixOS/nixpkgs/pull/268791
     #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
     nodes = callPackage ./pkgs/nodes/default.nix { };
     nosv = callPackage ./pkgs/nosv/default.nix { };
+    oneMath = callPackage ./pkgs/onemath/default.nix { };
     openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
     openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
     osumb = callPackage ./pkgs/osu/default.nix { };
     ovni = callPackage ./pkgs/ovni/default.nix { };
     ovniGit = final.ovni.override { useGit = true; };
+    papi = callPackage ./pkgs/papi/default.nix { papi = prev.papi; };
     paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
+    pertalde = callPackage ./pkgs/pertalde/default.nix { };
+    pocl = callPackage ./pkgs/pocl/default.nix { };
+    pocl-unpublished = callPackage ./pkgs/pocl/default.nix {
+      gitUrl = "git@github.com:pocl/unpublished.git";
+      gitBranch = "loopvec-next";
+      gitCommit = "74f7e2b5644b1c5598205c8cac1914bb4c5dadec";
+      enableNOSV = false;
+      enableOVNI = false;
+    };
+    pocl-noicd = callPackage ./pkgs/pocl/default.nix { enableICD = false; };
     prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
     #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
     #psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
+    rodinia = callPackage ./pkgs/rodinia/default.nix { };
+    slurm = import ./pkgs/slurm/default.nix { slurm = prev.slurm; };
     sonar = callPackage ./pkgs/sonar/default.nix { };
     stdenvClangOmpss2 = final.stdenv.override { cc = final.clangOmpss2; allowedRequisites = null; };
     stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.clangOmpss2Nanos6; allowedRequisites = null; };
@@ -57,8 +83,18 @@ let
     stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
+    tasycl = callPackage ./pkgs/tasycl/default.nix { };
+    tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
+    unified-runtime = callPackage ./pkgs/unified-runtime/default.nix { };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
+    taopencl = callPackage ./pkgs/taopencl/default.nix { };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
+
+    _cuda = prev._cuda.extend (_: _prev: final.lib.recursiveUpdate _prev {
+      extensions = _prev.extensions ++ [(finalAttrs: _: {
+        tacuda = finalAttrs.callPackage ./pkgs/tacuda/default.nix { };
+      })];
+    });
   };
 
   tests = rec {
@@ -66,6 +102,13 @@ let
     #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
     hello-c = callPackage ./test/compilers/hello-c.nix { };
     hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
+    hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
+    hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
+    hello-sycl-pocl = (callPackage ./test/compilers/hello-sycl.nix { }).withPocl;
+    hello-sycl-intel = (callPackage ./test/compilers/hello-sycl.nix { }).withIntel;
+    hello-syclompss-pocl = (callPackage ./test/compilers/icpx-ompss2.nix { }).withPocl;
+    hello-syclompss-intel = (callPackage ./test/compilers/icpx-ompss2.nix { }).withIntel;
+
     lto = callPackage ./test/compilers/lto.nix { };
     asan = callPackage ./test/compilers/asan.nix { };
     intel2023-icx-c   = hello-c.override   { stdenv = final.intelPackages_2023.stdenv; };
@@ -75,6 +118,13 @@ let
     intel2023-ifort   = callPackage ./test/compilers/hello-f.nix {
       stdenv = final.intelPackages_2023.stdenv-ifort;
     };
+    intel2024-icx-c   = hello-c.override   { stdenv = final.intelPackages_2024.stdenv; };
+    intel2025-icx-c   = hello-c.override   { stdenv = final.intelPackages_2025.stdenv; };
+    intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
+    intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
+    # intel2023-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
+    intel2024-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2024; };
+    intel2025-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2025; };
     clangOmpss2-lto   = lto.override       { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-asan  = asan.override      { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-task  = callPackage ./test/compilers/ompss2.nix {
@@ -92,20 +142,31 @@ let
     clangNosvOmpv-ld = callPackage ./test/compilers/clang-openmp-ld.nix {
       stdenv = final.stdenvClangOmpss2NodesOmpv;
     };
+
+    ocl-build = callPackage ./test/compilers/opencl.nix { };
+    ocl-build-noicd = callPackage ./test/compilers/opencl.nix { ocl-icd = final.pocl-noicd; };
+
+    pocl = callPackage ./test/compilers/pocl.nix { };
+    ocl-run-pocl = ocl-build.test-icd;
+    ocl-run-pocl-noicd = ocl-build-noicd.test-noicd;
+
+    sycl-ls = callPackage ./test/compilers/sycl-ls.nix { };
   };
 
   # For now, only build toplevel packages in CI/Hydra
   pkgsTopLevel = filterAttrs (_: isDerivation) bscPkgs;
 
   # Native build in that platform doesn't imply cross build works
-  canCrossCompile = platform: pkg:
+  canCrossCompile = platform: default: pkg:
     (isDerivation pkg) &&
-    # Must be defined explicitly
-    (pkg.meta.cross or false) &&
-    (meta.availableOn platform pkg);
+    # If meta.cross is undefined, use default
+    (pkg.meta.cross or default) &&
+    (meta.availableOn final.pkgsCross.${platform}.stdenv.hostPlatform pkg);
 
   # For now only RISC-V
-  crossSet = { riscv64 = final.pkgsCross.riscv64.bsc.pkgsTopLevel; };
+  crossSet = genAttrs [ "riscv64" ] (platform:
+    filterAttrs (_: canCrossCompile platform true)
+      final.pkgsCross.${platform}.bsc.pkgsTopLevel);
 
   buildList = name: paths:
     final.runCommandLocal name { } ''
@@ -125,10 +186,17 @@ let
   # For now only RISC-V
   crossList = buildList "ci-cross"
     (filter
-      (canCrossCompile final.pkgsCross.riscv64.stdenv.hostPlatform)
+      (canCrossCompile "riscv64" false) # opt-in (pkgs with: meta.cross = true)
         (builtins.attrValues crossSet.riscv64));
 
 in bscPkgs // {
+
+  lib = prev.lib // {
+    maintainers = prev.lib.maintainers // {
+      bsc = import ./pkgs/maintainers.nix;
+    };
+  };
+
   # Prevent accidental usage of bsc-ci attribute
   bsc-ci = throw "the bsc-ci attribute is deprecated, use bsc.ci";
 

pkgs/agenix/agenix.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+PACKAGE="agenix"
+
+function show_help () {
+  echo "$PACKAGE - edit and rekey age secret files"
+  echo " "
+  echo "$PACKAGE -e FILE [-i PRIVATE_KEY]"
+  echo "$PACKAGE -r [-i PRIVATE_KEY]"
+  echo ' '
+  echo 'options:'
+  echo '-h, --help                show help'
+  # shellcheck disable=SC2016
+  echo '-e, --edit FILE           edits FILE using $EDITOR'
+  echo '-r, --rekey               re-encrypts all secrets with specified recipients'
+  echo '-d, --decrypt FILE        decrypts FILE to STDOUT'
+  echo '-i, --identity            identity to use when decrypting'
+  echo '-v, --verbose             verbose output'
+  echo ' '
+  echo 'FILE an age-encrypted file'
+  echo ' '
+  echo 'PRIVATE_KEY a path to a private SSH key used to decrypt file'
+  echo ' '
+  echo 'EDITOR environment variable of editor to use when editing FILE'
+  echo ' '
+  echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
+  echo ' '
+  echo 'RULES environment variable with path to Nix file specifying recipient public keys.'
+  echo "Defaults to './secrets.nix'"
+  echo ' '
+  echo "agenix version: @version@"
+  echo "age binary path: @ageBin@"
+  echo "age version: $(@ageBin@ --version)"
+}
+
+function warn() {
+  printf '%s\n' "$*" >&2
+}
+
+function err() {
+  warn "$*"
+  exit 1
+}
+
+test $# -eq 0 && (show_help && exit 1)
+
+REKEY=0
+DECRYPT_ONLY=0
+DEFAULT_DECRYPT=(--decrypt)
+
+while test $# -gt 0; do
+  case "$1" in
+    -h|--help)
+      show_help
+      exit 0
+      ;;
+    -e|--edit)
+      shift
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -i|--identity)
+      shift
+      if test $# -gt 0; then
+        DEFAULT_DECRYPT+=(--identity "$1")
+      else
+        echo "no PRIVATE_KEY specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -r|--rekey)
+      shift
+      REKEY=1
+      ;;
+    -d|--decrypt)
+      shift
+      DECRYPT_ONLY=1
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -v|--verbose)
+      shift
+      set -x
+      ;;
+    *)
+      show_help
+      exit 1
+      ;;
+  esac
+done
+
+RULES=${RULES:-./secrets.nix}
+function cleanup {
+    if [ -n "${CLEARTEXT_DIR+x}" ]
+    then
+        rm -rf -- "$CLEARTEXT_DIR"
+    fi
+    if [ -n "${REENCRYPTED_DIR+x}" ]
+    then
+        rm -rf -- "$REENCRYPTED_DIR"
+    fi
+}
+trap "cleanup" 0 2 3 15
+
+function keys {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in rules.\"$1\".publicKeys)" | @jqBin@ -r .[]) || exit 1
+}
+
+function armor {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in (builtins.hasAttr \"armor\" rules.\"$1\" && rules.\"$1\".armor))") || exit 1
+}
+
+function decrypt {
+    FILE=$1
+    KEYS=$2
+    if [ -z "$KEYS" ]
+    then
+        err "There is no rule for $FILE in $RULES."
+    fi
+
+    if [ -f "$FILE" ]
+    then
+        DECRYPT=("${DEFAULT_DECRYPT[@]}")
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+            if [ -f "$HOME/.ssh/id_rsa" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_rsa")
+            fi
+            if [ -f "$HOME/.ssh/id_ed25519" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_ed25519")
+            fi
+        fi
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+          err "No identity found to decrypt $FILE. Try adding an SSH key at $HOME/.ssh/id_rsa or $HOME/.ssh/id_ed25519 or using the --identity flag to specify a file."
+        fi
+
+        @ageBin@ "${DECRYPT[@]}" -- "$FILE" || exit 1
+    fi
+}
+
+function edit {
+    FILE=$1
+    KEYS=$(keys "$FILE") || exit 1
+    ARMOR=$(armor "$FILE") || exit 1
+
+    CLEARTEXT_DIR=$(@mktempBin@ -d)
+    CLEARTEXT_FILE="$CLEARTEXT_DIR/$(basename -- "$FILE")"
+    DEFAULT_DECRYPT+=(-o "$CLEARTEXT_FILE")
+
+    decrypt "$FILE" "$KEYS" || exit 1
+
+    [ ! -f "$CLEARTEXT_FILE" ] || cp -- "$CLEARTEXT_FILE" "$CLEARTEXT_FILE.before"
+
+    [ -t 0 ] || EDITOR='cp -- /dev/stdin'
+
+    $EDITOR "$CLEARTEXT_FILE"
+
+    if [ ! -f "$CLEARTEXT_FILE" ]
+    then
+      warn "$FILE wasn't created."
+      return
+    fi
+    [ -f "$FILE" ] && [ "$EDITOR" != ":" ] && @diffBin@ -q -- "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return
+
+    ENCRYPT=()
+    if [[ "$ARMOR" == "true" ]]; then
+        ENCRYPT+=(--armor)
+    fi
+    while IFS= read -r key
+    do
+        if [ -n "$key" ]; then
+            ENCRYPT+=(--recipient "$key")
+        fi
+    done <<< "$KEYS"
+
+    REENCRYPTED_DIR=$(@mktempBin@ -d)
+    REENCRYPTED_FILE="$REENCRYPTED_DIR/$(basename -- "$FILE")"
+
+    ENCRYPT+=(-o "$REENCRYPTED_FILE")
+
+    @ageBin@ "${ENCRYPT[@]}" <"$CLEARTEXT_FILE" || exit 1
+
+    mkdir -p -- "$(dirname -- "$FILE")"
+
+    mv -f -- "$REENCRYPTED_FILE" "$FILE"
+}
+
+function rekey {
+    FILES=$( (@nixInstantiate@ --json --eval -E "(let rules = import $RULES; in builtins.attrNames rules)"  | @jqBin@ -r .[]) || exit 1)
+
+    for FILE in $FILES
+    do
+        warn "rekeying $FILE..."
+        EDITOR=: edit "$FILE"
+        cleanup
+    done
+}
+
+[ $REKEY -eq 1 ] && rekey && exit 0
+[ $DECRYPT_ONLY -eq 1 ] && DEFAULT_DECRYPT+=("-o" "-") && decrypt "${FILE}" "$(keys "$FILE")" && exit 0
+edit "$FILE" && cleanup && exit 0

pkgs/agenix/default.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  age,
+  jq,
+  nix,
+  mktemp,
+  diffutils,
+  replaceVars,
+  ageBin ? "${age}/bin/age",
+  shellcheck,
+}:
+let
+  bin = "${placeholder "out"}/bin/agenix";
+in
+stdenv.mkDerivation rec {
+  pname = "agenix";
+  version = "0.15.0";
+  src = replaceVars ./agenix.sh {
+    inherit ageBin version;
+    jqBin = "${jq}/bin/jq";
+    nixInstantiate = "${nix}/bin/nix-instantiate";
+    mktempBin = "${mktemp}/bin/mktemp";
+    diffBin = "${diffutils}/bin/diff";
+  };
+  dontUnpack = true;
+  doInstallCheck = true;
+  installCheckInputs = [ shellcheck ];
+  postInstallCheck = ''
+    shellcheck ${bin}
+    ${bin} -h | grep ${version}
+
+    test_tmp=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
+    export HOME="$test_tmp/home"
+    export NIX_STORE_DIR="$test_tmp/nix/store"
+    export NIX_STATE_DIR="$test_tmp/nix/var"
+    mkdir -p "$HOME" "$NIX_STORE_DIR" "$NIX_STATE_DIR"
+    function cleanup {
+      rm -rf "$test_tmp"
+    }
+    trap "cleanup" 0 2 3 15
+
+    mkdir -p $HOME/.ssh
+    cp -r "${./example}" $HOME/secrets
+    chmod -R u+rw $HOME/secrets
+    (
+    umask u=rw,g=r,o=r
+    cp ${./example_keys/user1.pub} $HOME/.ssh/id_ed25519.pub
+    chown $UID $HOME/.ssh/id_ed25519.pub
+    )
+    (
+    umask u=rw,g=,o=
+    cp ${./example_keys/user1} $HOME/.ssh/id_ed25519
+    chown $UID $HOME/.ssh/id_ed25519
+    )
+
+    cd $HOME/secrets
+    test $(${bin} -d secret1.age) = "hello"
+  '';
+
+  installPhase = ''
+    install -D $src ${bin}
+  '';
+
+  meta.description = "age-encrypted secrets for NixOS";
+}

pkgs/agenix/example/-leading-hyphen-filename.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA zirqdzZZ1E+sedBn7fbEHq4ntLEkokZ4GctarBBOHXY
+Rvs5YHaAUeCZyNwPedubPcHClWYIuXXWA5zadXPWY6w
+-> ssh-ed25519 KLPP8w BVp4rDkOYSQyn8oVeHFeinSqW+pdVtxBF9+5VM1yORY
+bMwppAi8Nhz0328taU4AzUkTVyWtSLvFZG6c5W/Fs78
+--- xCbqLhXAcOziO2wmbjTiSQfZvt5Rlsc4SCvF+iEzpQA
+<EFBFBD>KB<EFBFBD><EFBFBD>/<2F>Z<><5A>r<EFBFBD>%
<01><>4<EFBFBD><34><EFBFBD>Mq5<71><35>_<EFBFBD><5F>ݒ<><DD92><EFBFBD><EFBFBD><EFBFBD>11ܨqM;& <20><>Lr<4C><72><EFBFBD>f<EFBFBD><66><EFBFBD>]>N

pkgs/agenix/example/armored-secret.age

@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFYzWG1FQSBpZkZW
+aFpLNnJxc0VUMHRmZ2dZS0pjMGVENnR3OHd5K0RiT1RjRUhibFZBCnN5UG5vUjA3
+SXpsNGtiVUw4T0tIVFo5Wkk5QS9NQlBndzVvektiQ0ozc0kKLS0tIGxyY1Q4dEZ1
+VGZEanJyTFNta2JNRmpZb2FnK2JyS1hSVml1UGdMNWZKQXMKYla+wTXcRedyZoEb
+LVWaSx49WoUTU0KBPJg9RArxaeC23GoCDzR/aM/1DvYU
+-----END AGE ENCRYPTED FILE-----

pkgs/agenix/example/passwordfile-user1.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 KLPP8w s1DYZRlZuSsyhmZCF1lFB+E9vB8bZ/+ZhBRlx8nprwE
+nmYVCsVBrX2CFXXPU+D+bbkkIe/foofp+xoUrg9DHZw
+-> ssh-ed25519 V3XmEA Pwv3oCwcY0DX8rY48UNfsj9RumWsn4dbgorYHCwObgI
+FKxRYkL3JHtJxUwymWDF0rAtJ33BivDI6IfPsfumM90
+-> V'v(/u$-grease em/Vgf 2qDuk
+7I3iiQLPGi1COML9u/JeYkr7EqbSLoU
+--- 57WJRigUGtmcObrssS3s4PvmR8wgh1AOC/ijJn1s3xI
+<EFBFBD>'K<>ƷY&<26>7G<37>O<EFBFBD><4F>Fj
<13>k<EFBFBD>X<EFBFBD><58>BnuJ<75><4A>:9<>(<><7F><EFBFBD>X<EFBFBD>#<23>A<EFBFBD><41><EFBFBD><EFBFBD>ڧj<DAA7>,<02>_<17><><EFBFBD>?<3F>Z<EFBFBD><17>v<EFBFBD><76>V<EFBFBD>96]oks~%<25>c	<04>e^C<>%JQ5<51><H<>z}<7D>C<EFBFBD>,<2C>p<EFBFBD><70>*!W<><57><EFBFBD>A<EFBFBD><41><EFBFBD>҅dC<15>K)<10><>-<2D>y

pkgs/agenix/example/secret2.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA OB4+1FbPhQ3r6iGksM7peWX5it8NClpXIq/o5nnP7GA
+FmHVUj+A5i5+bDFgySQskmlvynnosJiWUTJmBRiNA9I
+--- tP+3mFVtd7ogVu1Lkboh55zoi5a77Ht08Uc/QuIviv4
+<EFBFBD><EFBFBD>X<EFBFBD>{<7B><>O<EFBFBD><4F><1F><04>tMXx<58>vӪ(<28>I<EFBFBD>myP<79><50><EFBFBD><EFBFBD>+3<>S3i

pkgs/agenix/example/secrets.nix

@@ -0,0 +1,23 @@
+let
+  user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
+  system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
+in
+{
+  "secret1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "secret2.age".publicKeys = [ user1 ];
+  "passwordfile-user1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "-leading-hyphen-filename.age".publicKeys = [
+    user1
+    system1
+  ];
+  "armored-secret.age" = {
+    publicKeys = [ user1 ];
+    armor = true;
+  };
+}

pkgs/agenix/example_keys/system1

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxAAAAJA3yvCWN8rw
+lgAAAAtzc2gtZWQyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxA
+AAAEA+J2V6AG1NriAIvnNKRauIEh1JE9HSdhvKJ68a5Fm0w/JDyIr/FSz1cJdcoW69R+Nr
+WzwGK/+3gJpqD1t8L2zEAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----

pkgs/agenix/example_keys/system1.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE

pkgs/agenix/example_keys/user1

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRwAAAJC2JJ8htiSf
+IQAAAAtzc2gtZWQyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRw
+AAAEDxt5gC/s53IxiKAjfZJVCCcFIsdeERdIgbYhLO719+Kb0idNvgGiucWgup/mP78zyC
+23uFjYq0evcWdjGQUaBHAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----

pkgs/agenix/example_keys/user1.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH

pkgs/agenix/update.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+# All operations are done relative to root
+GITROOT=$(git rev-parse --show-toplevel)
+cd "$GITROOT"
+
+REVISION=${1:-main}
+
+TMPCLONE=$(mktemp -d)
+trap "rm -rf ${TMPCLONE}" EXIT
+
+git clone https://github.com/ryantm/agenix.git --revision="$REVISION" "$TMPCLONE" --depth=1
+
+cp "${TMPCLONE}/pkgs/agenix.sh" pkgs/agenix/agenix.sh
+cp "${TMPCLONE}/pkgs/agenix.nix" pkgs/agenix/default.nix
+sed -i 's#../example#./example#' pkgs/agenix/default.nix
+
+cp "${TMPCLONE}/example/"* pkgs/agenix/example/
+cp "${TMPCLONE}/example_keys/"* pkgs/agenix/example_keys/
+
+cp "${TMPCLONE}/modules/age.nix" m/module/agenix.nix

pkgs/amd-uprof/default.nix

@@ -47,6 +47,7 @@ in
     inherit version;
     src = uprofSrc;
     dontStrip = true;
+    strictDeps = true;
     phases = [ "installPhase" "fixupPhase" ];
     nativeBuildInputs = [ autoPatchelfHook radare2 ];
     buildInputs = [
@@ -86,4 +87,13 @@ in
       patchelf --add-needed libnuma.so $out/bin/AMDuProfPcm
       set +x
     '';
+
+    meta = {
+      description = "Performance analysis tool-suite for x86 based applications";
+      homepage = "https://www.amd.com/es/developer/uprof.html";
+      platforms = [ "x86_64-linux" ];
+      license = lib.licenses.unfree;
+      maintainers = with lib.maintainers.bsc; [ rarias varcila ];
+    };
+
   }

pkgs/amd-uprof/driver.nix

@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
     set +x
   '';
   hardeningDisable = [ "pic" "format" ];
+  strictDeps = true;
   nativeBuildInputs = kernel.moduleBuildDependencies;
-  patches = [ ./makefile.patch ./hrtimer.patch ];
+  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
   makeFlags = [
     "KERNEL_VERSION=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -29,5 +30,7 @@ in stdenv.mkDerivation {
     description = "AMD Power Profiler Driver";
     homepage = "https://www.amd.com/es/developer/uprof.html";
     platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers.bsc; [ rarias varcila ];
   };
 }

pkgs/amd-uprof/remove-wr-rdmsrq.patch

@@ -0,0 +1,20 @@
+diff --git a/inc/PwrProfAsm.h b/inc/PwrProfAsm.h
+index d77770a..c93a0e9 100644
+--- a/inc/PwrProfAsm.h
++++ b/inc/PwrProfAsm.h
+@@ -347,6 +347,7 @@
+ 
+ #endif
+ 
++/*
+ #define rdmsrq(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \
+                               "rdmsr\n" \
+@@ -362,6 +363,7 @@
+                               :"c"(msr), "a"(val1), "d"(val2), "S"(val3), "D"(val4) \
+                             ); \
+     })
++*/
+ 
+ #define rdmsrpw(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \

pkgs/aocc/default.nix

@@ -0,0 +1,17 @@
+{
+  wrapCCWith,
+  aoccUnwrapped,
+}:
+
+let
+  cc = aoccUnwrapped;
+in
+wrapCCWith {
+  inherit cc;
+  nixSupport.cc-cflags = [ "-isystem ${cc}/include" ];
+
+  extraBuildCommands = ''
+    wrap aocc   $wrapper $ccPath/clang
+    wrap aocc++ $wrapper $ccPath/clang++
+  '';
+}

pkgs/aocc/unwrapped.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchurl,
+  stdenv,
+  autoPatchelfHook,
+  rocmPackages,
+  zlib,
+  libffi,
+  elfutils,
+}:
+
+let
+  # in newer nixpkgs the runtime is hsakmt
+  rocmRuntime = if rocmPackages ? hsakmt then rocmPackages.hsakmt else rocmPackages.rocm-runtime;
+in
+stdenv.mkDerivation {
+  pname = "aocc-compiler";
+  version = "5.0.0";
+
+  src = fetchurl {
+    url = "https://download.amd.com/developer/eula/aocc/aocc-5-0/aocc-compiler-5.0.0.tar";
+    sha256 = "sha256-lm+sLSx1np3m6WnBCtp6ezBsET9/HgfqN2gp7IY4Dao=";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [
+    elfutils
+    zlib
+    rocmRuntime
+    stdenv.cc.cc.lib
+  ];
+  phases = [
+    "unpackPhase"
+    "installPhase"
+    "fixupPhase"
+  ];
+  dontStrip = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -a . $out/
+
+    ln -s ${lib.getLib libffi}/lib/libffi.so $out/lib/libffi.so.6
+  '';
+
+  passthru = {
+    inherit rocmRuntime;
+    isClang = true; # Needed for wrapCCWith
+  };
+
+  meta.mainProgram = "clang";
+}

pkgs/bench6/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , bigotes
 , cmake
 , clangOmpss2
@@ -58,4 +59,13 @@ stdenv.mkDerivation rec {
   ];
   hardeningDisable = [ "all" ];
   dontStrip = true;
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/rarias/bench6";
+    description = "Set of micro-benchmarks for OmpSs-2 and several mini-apps";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
 }

pkgs/bigotes/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchFromGitHub
 , cmake
 }:
@@ -14,4 +15,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-ktxM3pXiL8YXSK+/IKWYadijhYXqGoLY6adLk36iigE=";
   };
   nativeBuildInputs = [ cmake ];
+
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://github.com/rodarima/bigotes";
+    description = "Versatile benchmark tool";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
 }

pkgs/cudainfo/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , cudatoolkit
 , cudaPackages
 , autoAddDriverRunpath
@@ -9,11 +10,14 @@
 stdenv.mkDerivation (finalAttrs: {
   name = "cudainfo";
   src = ./.;
-  buildInputs = [
+  strictDeps = true;
+  nativeBuildInputs = [
     cudatoolkit # Required for nvcc
-    cudaPackages.cuda_cudart.static # Required for -lcudart_static
     autoAddDriverRunpath
   ];
+  buildInputs = [
+    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+  ];
   installPhase = ''
     mkdir -p $out/bin
     cp -a cudainfo $out/bin
@@ -22,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "cudainfo-test";
     requiredSystemFeatures = [ "cuda" ];
     dontBuild = true;
+    strictDeps = true;
     nativeCheckInputs = [
       finalAttrs.finalPackage # The cudainfo package from above
       strace # When it fails, it will show the trace
@@ -40,4 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     installPhase = "touch $out";
   };
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+  };
 })

pkgs/extrae/default.nix

@@ -20,7 +20,7 @@
 #, python3Packages
 , installShellFiles
 , symlinkJoin
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 }:
 
 let
@@ -111,4 +111,13 @@ stdenv.mkDerivation rec {
 #    then [ "--enable-openmp" ]
 #    else []
 #  );
+
+  meta = {
+    homepage = "https://github.com/bsc-performance-tools/extrae";
+    description = "Instrumentation framework to generate execution traces of the most used parallel runtimes";
+    maintainers = [ ];
+    broken = true;
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+  };
 }

pkgs/gpi-2/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchurl
 , symlinkJoin
 , slurm
@@ -8,7 +9,6 @@
 , automake
 , libtool
 , mpi
-, rsync
 , gfortran
 }:
 
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   patches = [ ./rdma-core.patch ./max-mem.patch ];
 
@@ -43,13 +44,33 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-infiniband=${rdma-core-all}"
-    "--with-mpi=${mpiAll}"
+    "--with-mpi=yes" # fixes mpi detection when cross-compiling
     "--with-slurm"
     "CFLAGS=-fPIC"
     "CXXFLAGS=-fPIC"
   ];
 
-  buildInputs = [ slurm mpiAll rdma-core-all autoconf automake libtool rsync gfortran ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    gfortran
+    libtool
+  ];
+
+  buildInputs = [
+    slurm
+    mpiAll
+    rdma-core-all
+  ];
 
   hardeningDisable = [ "all" ];
+
+  meta = {
+    homepage = "https://pm.bsc.es/gitlab/interoperability/extern/GPI-2";
+    description = "GPI-2 extended for supporting Task-Aware GASPI (TAGASPI) library";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    cross = false; # infiniband detection does not work
+  };
 }

pkgs/gromacs/default.nix

@@ -0,0 +1,190 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  hwloc,
+  fftw,
+  perl,
+  blas,
+  lapack,
+  llvmPackages,
+  intelPackages ? null,
+  mpi,
+  cudaPackages,
+  plumed,
+  singlePrec ? true,
+  config,
+  enableSYCL ? false,
+  enableCuda ? config.cudaSupport,
+  enableMpi ? false,
+  enablePlumed ? false,
+  cpuAcceleration ? null,
+}:
+
+# CUDA is only implemented for single precission
+assert enableCuda -> singlePrec;
+
+assert !(enableSYCL && enableCuda);
+
+assert enableSYCL -> intelPackages != null;
+
+let
+  inherit (cudaPackages.flags) cmakeCudaArchitecturesString;
+
+  # Select reasonable defaults for all major platforms
+  # The possible values are defined in CMakeLists.txt:
+  # AUTO None SSE2 SSE4.1 AVX_128_FMA AVX_256 AVX2_256
+  # AVX2_128 AVX_512 AVX_512_KNL MIC ARM_NEON ARM_NEON_ASIMD
+  SIMD =
+    x:
+    if (cpuAcceleration != null) then
+      x
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      "SSE2"
+    else if stdenv.hostPlatform.system == "x86_64-linux" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "x86_64-darwin" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then
+      "ARM_NEON_ASIMD"
+    else
+      "None";
+
+  source =
+    if enablePlumed then
+      {
+        version = "2024.2";
+        hash = "sha256-gCp+M18uiVdw9XsVnk7DaOuw/yzm2sz3BsboAlw2hSs=";
+      }
+    else
+      {
+        version = "2025.3";
+        hash = "sha256-i9/KAmjz8Qp8o8BuWbYvc+oCQgxnIRwP85EvMteDPGU=";
+      };
+
+  stdenv' = if enableSYCL then intelPackages.stdenv else stdenv;
+
+in
+stdenv'.mkDerivation rec {
+  pname = "gromacs";
+  version = source.version;
+
+  src = fetchurl {
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
+    inherit (source) hash;
+  };
+
+  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
+
+  postPatch = lib.optionalString enablePlumed ''
+    plumed patch -p -e gromacs-${source.version}
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ]
+  ++ lib.optional enablePlumed plumed
+  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
+
+  env.MKLROOT = intelPackages.mkl;
+
+  buildInputs = [
+    fftw
+    perl
+    hwloc
+    blas
+    lapack
+  ]
+  ++ lib.optional enableMpi mpi
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_cccl
+    cudaPackages.cuda_cudart
+    cudaPackages.libcufft
+    cudaPackages.cuda_profiler_api
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+
+  propagatedBuildInputs = lib.optional enableMpi mpi;
+  propagatedUserEnvPkgs = lib.optional enableMpi mpi;
+
+  cmakeFlags = [
+    (lib.cmakeBool "GMX_HWLOC" true)
+    "-DGMX_SIMD:STRING=${SIMD cpuAcceleration}"
+    "-DGMX_OPENMP:BOOL=TRUE"
+    "-DBUILD_SHARED_LIBS=ON"
+  ]
+  ++ (
+    if singlePrec then
+      [
+        "-DGMX_DOUBLE=OFF"
+      ]
+    else
+      [
+        "-DGMX_DOUBLE=ON"
+        "-DGMX_DEFAULT_SUFFIX=OFF"
+      ]
+  )
+  ++ (
+    if enableMpi then
+      [
+        "-DGMX_MPI:BOOL=TRUE"
+        "-DGMX_THREAD_MPI:BOOL=FALSE"
+      ]
+    else
+      [
+        "-DGMX_MPI:BOOL=FALSE"
+      ]
+  )
+  ++ (lib.optionals enableSYCL [
+    "-DGMX_GPU=SYCL"
+    "-DGMX_OPENMP=OFF" # TODO: enable OpenMP with SYCL?
+  ])
+  ++ lib.optionals enableCuda [
+    "-DGMX_GPU=CUDA"
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cmakeCudaArchitecturesString)
+
+    # Gromacs seems to ignore and override the normal variables, so we add this ad hoc:
+    (lib.cmakeFeature "GMX_CUDA_TARGET_COMPUTE" cmakeCudaArchitecturesString)
+  ];
+
+  postInstall = ''
+    moveToOutput share/cmake $dev
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.gromacs.org";
+    license = licenses.lgpl21Plus;
+    description = "Molecular dynamics software package";
+    longDescription = ''
+      GROMACS is a versatile package to perform molecular dynamics,
+      i.e. simulate the Newtonian equations of motion for systems
+      with hundreds to millions of particles.
+
+      It is primarily designed for biochemical molecules like
+      proteins, lipids and nucleic acids that have a lot of
+      complicated bonded interactions, but since GROMACS is
+      extremely fast at calculating the nonbonded interactions (that
+      usually dominate simulations) many groups are also using it
+      for research on non-biological systems, e.g. polymers.
+
+      GROMACS supports all the usual algorithms you expect from a
+      modern molecular dynamics implementation, (check the online
+      reference or manual for details), but there are also quite a
+      few features that make it stand out from the competition.
+
+      See: https://www.gromacs.org/about.html for details.
+    '';
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      sheepforce
+      markuskowa
+    ];
+  };
+}

pkgs/gromacs/pkgconfig-2024.patch

@@ -0,0 +1,24 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..9b97ad57f7 100644
+--- a/src/external/muparser/muparser.pc.in
++++ b/src/external/muparser/muparser.pc.in
+@@ -1,7 +1,5 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @PACKAGE_NAME@
+ Description: Mathematical expressions parser library
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index ec1ed6684e..ca1105474a 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
++++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,4 +1,4 @@
+-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library

pkgs/gromacs/pkgconfig-2025.patch

@@ -0,0 +1,36 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..d26e84de8f 100644
+--- a/src/external/muparser/muparser.pc.in
++++ b/src/external/muparser/muparser.pc.in
+@@ -1,11 +1,9 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-
+-Name: @PACKAGE_NAME@
+-Description: Mathematical expressions parser library
+-Version: @MUPARSER_VERSION@
+-Requires:
+-Libs: -L${libdir} -lmuparser
+-Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++
++Name: @PACKAGE_NAME@
++Description: Mathematical expressions parser library
++Version: @MUPARSER_VERSION@
++Requires:
++Libs: -L${libdir} -lmuparser
++Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index af9b5a6dc0..5f58d549bf 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
++++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,5 +1,4 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library

pkgs/intel-compiler/icc2020.nix

@@ -1,4 +1,5 @@
 { stdenv
+, lib
 , fetchurl
 , rpmextract
 , autoPatchelfHook
@@ -59,4 +60,12 @@ stdenv.mkDerivation rec {
       rm $out/lib/*.dbg
     popd
   '';
+
+  meta = {
+    homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+    description = "Intel compiler";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+  };
 }

pkgs/intel-compiler/icc2021.nix

@@ -145,4 +145,12 @@ in
       popd
     '';
 
+    meta = {
+      homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+      description = "Intel compiler";
+      maintainers = with lib.maintainers.bsc; [ rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.unfree;
+    };
+
   }

pkgs/intel-mpi/default.nix

@@ -1,4 +1,5 @@
 { stdenv
+, lib
 , rpmextract
 , gcc
 , zlib
@@ -101,4 +102,12 @@ stdenv.mkDerivation rec {
     patchelf --set-rpath "$out/lib:${rdma-core}/lib:${libpsm2}/lib" $out/lib/libfabric.so
     echo "Patched RPATH in libfabric.so to: $(patchelf --print-rpath $out/lib/libfabric.so)"
   '';
+
+  meta = {
+    homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+    description = "Intel MPI";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+  };
 }

pkgs/intel-oneapi/2023.nix

@@ -10,7 +10,7 @@
 , zlib
 , autoPatchelfHook
 , libfabric
-, gcc13
+, gcc
 , wrapCCWith
 }:
 
@@ -26,7 +26,12 @@
 
 let
 
-  gcc = gcc13;
+  meta = {
+    description = "Intel oneapi hpckit package component";
+    homepage = "https://www.intel.com/content/www/us/en/developer/tools/oneapi/hpc-toolkit-download.html";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers.bsc; [ abonerib ];
+  };
 
   v = {
     hpckit   = "2023.1.0";
@@ -35,45 +40,19 @@ let
     mpi      = "2021.9.0";
   };
 
-  aptPackageIndex = stdenv.mkDerivation {
-    name = "intel-oneapi-packages";
-    srcs = [
-      # Run update.sh to update the package lists
-      ./amd64-packages ./all-packages
-    ];
-    phases = [ "installPhase" ];
-    installPhase = ''
-      awk -F': ' '\
-        BEGIN   { print "[ {" } \
-        NR>1 && /^Package: / { print "} {"; } \
-        /: /    { printf "%s = \"%s\";\n", $1, $2 } \
-        END     { print "} ]" }' $srcs > $out
-    '';
-  };
-
-  aptPackages = import aptPackageIndex;
-
-  apthost = "https://apt.repos.intel.com/oneapi/";
-
-  getSum = pkgList: name:
+  findMatch = name:
   let
-    matches = lib.filter (x: name == x.Package) pkgList;
-    #n = lib.length matches;
-    #match = builtins.trace (name + " -- ${builtins.toString n}") (lib.elemAt matches 0);
-    match = lib.elemAt matches 0;
-  in
-    match.SHA256;
-
-  getUrl = pkgList: name:
-  let
-    matches = lib.filter (x: name == x.Package) pkgList;
-    #match = assert lib.length matches == 1; lib.elemAt matches 0;
+    aptPackages = builtins.fromJSON (builtins.readFile ./packages.json);
+    matches = lib.filter (x: name == x.pname) aptPackages;
     n = lib.length matches;
-    match =
-      #builtins.trace (name + " -- n=${builtins.toString n}")
-      (lib.elemAt matches 0);
+    match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
+
+    apthost = "https://apt.repos.intel.com/oneapi/";
   in
-    apthost + match.Filename;
+    {
+      url = apthost + match.filename;
+      sha256 = match.sha256;
+    };
 
   uncompressDebs = debs: name: stdenv.mkDerivation {
     name = name;
@@ -87,14 +66,13 @@ let
         dpkg -x $src $out
       done
     '';
+
+    inherit meta;
   };
 
   joinDebs = name: names:
   let
-    urls = builtins.map (x: getUrl aptPackages x) names;
-    sums = builtins.map (x: getSum aptPackages x) names;
-    getsrc = url: sha256: builtins.fetchurl { inherit url sha256; };
-    debs = lib.zipListsWith getsrc urls sums;
+    debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
   in
     uncompressDebs debs "${name}-source";
 
@@ -121,6 +99,7 @@ let
 
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
     installPhase = ''
       mkdir -p $out/{bin,etc,lib,include}
       mkdir -p $out/share/man
@@ -145,6 +124,8 @@ let
         sed -i "s:I_MPI_SUBSTITUTE_INSTALLDIR:$out:g" "$i"
       done
     '';
+
+    inherit meta;
   };
 
   intel-tbb = stdenv.mkDerivation rec {
@@ -170,6 +151,7 @@ let
     ];
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
 
     autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];
 
@@ -183,6 +165,8 @@ let
         rsync -a lib/intel64/gcc4.8/ $out/lib/
       popd
     '';
+
+    inherit meta;
   };
 
   intel-compiler-shared = stdenv.mkDerivation rec {
@@ -211,6 +195,7 @@ let
     ];
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
 
     autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];
 
@@ -240,6 +225,8 @@ let
         popd
       popd
     '';
+
+    inherit meta;
   };
 
 
@@ -276,6 +263,7 @@ let
     phases = [ "installPhase" "fixupPhase" ];
 
     dontStrip = true;
+    strictDeps = true;
 
     installPhase = ''
       mkdir -p $out/{bin,lib,include}
@@ -305,6 +293,8 @@ let
         ln -s $out/lib $out/lib_lin
       popd
     '';
+
+    inherit meta;
   };
 
   intel-compiler = stdenv.mkDerivation rec {
@@ -362,6 +352,7 @@ let
     phases = [ "installPhase" "fixupPhase" ];
 
     dontStrip = true;
+    strictDeps = true;
 
     installPhase = ''
       mkdir -p $out/{bin,lib}
@@ -392,6 +383,8 @@ let
         rsync -a documentation/en/man/common/ $out/share/man/
       popd
     '';
+
+    inherit meta;
   };
 
   wrapIntel = { cc, mygcc, extraBuild ? "", extraInstall ? "" }:
@@ -453,7 +446,7 @@ let
     '';
   };
 
-  ifort-wrapper = wrapIntel rec {
+  ifort-wrapper = wrapIntel {
     cc = intel-compiler-fortran;
     mygcc = gcc;
     extraBuild = ''

pkgs/intel-oneapi/packages.nix

@@ -0,0 +1,297 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  dpkg,
+  fetchurl,
+
+  sqlite,
+  elfutils,
+}:
+
+let
+  inherit (builtins)
+    attrNames
+    attrValues
+    concatMap
+    elem
+    filter
+    fromJSON
+    getAttr
+    groupBy
+    head
+    isNull
+    listToAttrs
+    map
+    mapAttrs
+    readFile
+    replaceStrings
+    splitVersion
+    ;
+  inherit (lib)
+    converge
+    findFirst
+    groupBy'
+    hasPrefix
+    optional
+    pipe
+    take
+    toInt
+    toList
+    versionAtLeast
+    versionOlder
+    ;
+
+  aptData = fromJSON (readFile ./packages.json);
+
+  # Compare versions in debian control file syntax
+  # See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
+  #
+  # NOTE: this is not a proper version comparison
+  #
+  # A proper version solver, should aggregate dependencies with the same name
+  # and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
+  #
+  # But in the intel repo, there are no such "duplicated" dependencies to specify
+  # upper limits, which leads to issues when intel-hpckit-2021 depends on things
+  # like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
+  # basekit instead of the one from 2021.
+  #
+  # To mitigate this, >= is set to take the latest version with matching major
+  # and minor (only revision and patch are allowed to change)
+  compareVersions =
+    got: kind: want:
+    let
+      g0 = take 2 (splitVersion got);
+      w0 = take 2 (splitVersion want);
+    in
+    if isNull want then
+      true
+    else if kind == "=" then
+      got == want
+    else if kind == "<<" then
+      versionOlder got want
+    else if kind == "<=" then
+      versionAtLeast want got
+    else if kind == ">>" then
+      versionOlder want got
+    else if kind == ">=" then
+      (g0 == w0) && versionAtLeast got want # always match major version
+    else
+      throw "unknown operation: ${kind}";
+
+  findMatching =
+    {
+      pname,
+      kind,
+      version,
+    }:
+    findFirst (x: pname == x.pname && compareVersions x.version kind version) null aptData;
+
+  isIntel = pkg: (hasPrefix "intel-" pkg.pname);
+
+  expandDeps =
+    pkg: (map findMatching (filter isIntel pkg.dependencies)) ++ (optional (pkg.size != 0) pkg);
+
+  # get the oldest by major version. If they have the same major version, take
+  # the newest. This prevents most issues with resolutions
+  # versionOlder b a -> true if b is older than a (b `older` a)
+  getNewerInMajor =
+    a: b:
+    let
+      va = a.version;
+      vb = b.version;
+      va0 = head (splitVersion va);
+      vb0 = head (splitVersion vb);
+    in
+    if isNull a then
+      b
+    else if va0 != vb0 then
+      if va0 > vb0 then b else a
+    else if versionOlder vb va then
+      a
+    else
+      b;
+  removeDups = l: attrValues (groupBy' getNewerInMajor null (getAttr "provides") l);
+
+  _resolveDeps = converge (l: removeDups (concatMap expandDeps l));
+  resolveDeps =
+    pkg:
+    let
+      deps = _resolveDeps (toList pkg);
+      namedDeps = (map (x: "${x.pname}-${x.version}") deps);
+    in
+    builtins.traceVerbose (builtins.deepSeq namedDeps namedDeps) deps;
+
+  blacklist = [
+    "intel-basekit-env"
+    "intel-basekit-getting-started"
+    "intel-hpckit-env"
+    "intel-hpckit-getting-started"
+    "intel-oneapi-advisor"
+    "intel-oneapi-common-licensing"
+    "intel-oneapi-common-oneapi-vars"
+    "intel-oneapi-common-vars"
+    "intel-oneapi-compiler-cpp-eclipse-cfg"
+    "intel-oneapi-compiler-dpcpp-eclipse-cfg"
+    "intel-oneapi-condaindex"
+    "intel-oneapi-dev-utilities-eclipse-cfg"
+    "intel-oneapi-dpcpp-ct-eclipse-cfg"
+    "intel-oneapi-eclipse-ide"
+    "intel-oneapi-hpc-toolkit-getting-started"
+    "intel-oneapi-icc-eclipse-plugin-cpp"
+    "intel-oneapi-vtune"
+    "intel-oneapi-vtune-eclipse-plugin-vtune"
+  ];
+
+  isInBlacklist = pkg: elem pkg.provides blacklist;
+  removeBlacklist = filter (e: !(isInBlacklist e));
+
+  dpkgExtractAll =
+    pname: version:
+    { srcs, deps }:
+    stdenv.mkDerivation {
+      inherit pname version srcs;
+
+      nativeBuildInputs = [ dpkg ];
+      phases = [ "installPhase" ];
+
+      passthru = { inherit deps; };
+
+      installPhase = ''
+        mkdir -p $out
+        for src in $srcs; do
+          echo "Unpacking $src"
+          dpkg -x $src $out
+        done
+      '';
+    };
+
+  apthost = "https://apt.repos.intel.com/oneapi/";
+  fetchDeb =
+    p:
+    fetchurl {
+      url = apthost + p.filename;
+      inherit (p) sha256;
+    };
+
+  buildIntel =
+    pkg:
+    pipe pkg [
+      resolveDeps
+      removeBlacklist
+      (l: {
+        srcs = map fetchDeb l;
+        deps = l;
+      })
+      (dpkgExtractAll "${pkg.provides}-extracted" pkg.version)
+    ];
+
+  findHpcKit =
+    year:
+    findMatching {
+      pname = "intel-hpckit";
+      kind = "<<";
+      version = toString (year + 1);
+    };
+  years = map toInt (attrNames components);
+
+  patchIntel = callPackage ./patch_intel.nix { };
+
+  # Version information for each hpckit. This is used to normalize the paths
+  # so that files are in $out/{bin,lib,include...} instead of all over the place
+  # in $out/opt/intel/oneapi/*/*/{...}.
+  #
+  # The most important is the compiler component, which is used to build the
+  # stdenv for the hpckit.
+  #
+  # NOTE: this have to be manually specified, so we can avoid IFD. To add a
+  # new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
+  # build hpckit_2026.unpatched and use the values from
+  # result/opt/intel/oneapi/* to populate the attrset.
+  #
+  # WARN: if there are more than one version in the folders of the unpatched
+  # components, our dependency resolution hacks have probably failed and the
+  # package set may be broken.
+  components = {
+    "2025" = {
+      ishmem = "1.4";
+      pti = "0.13";
+      tcm = "1.4";
+      umf = "0.11";
+
+      ccl = "2021.16";
+      compiler = "2025.2";
+      dal = "2025.8";
+      debugger = "2025.2";
+      dev-utilities = "2025.2";
+      dnnl = "2025.2";
+      dpcpp-ct = "2025.2";
+      dpl = "2022.9";
+      ipp = "2022.2";
+      ippcp = "2025.2";
+      mkl = "2025.2";
+      mpi = "2021.16";
+      tbb = "2022.2";
+    };
+    "2024" = {
+      tcm = "1.1";
+
+      ccl = "2021.13";
+      compiler = "2024.2";
+      dal = "2024.6";
+      debugger = "2024.2";
+      dev-utilities = "2024.2";
+      diagnostics = "2024.2";
+      dnnl = "2024.2";
+      dpcpp-ct = "2024.2";
+      dpl = "2022.6";
+      ipp = "2021.12";
+      ippcp = "2021.12";
+      mkl = "2024.2";
+      mpi = "2021.13";
+      tbb = "2021.13";
+
+      extraPackages = [
+        sqlite
+        elfutils
+      ];
+    };
+  };
+
+  replaceDots = replaceStrings [ "." ] [ "_" ];
+
+in
+lib.recurseIntoAttrs (
+  listToAttrs (
+    map (
+      year:
+      let
+        year_str = toString year;
+      in
+      {
+        name = "hpckit_${year_str}";
+        value = patchIntel {
+          unpatched = buildIntel (findHpcKit year);
+          components = components.${year_str};
+        };
+      }
+    ) years
+  )
+)
+// {
+  apt = pipe aptData [
+    (groupBy (p: replaceDots p.provides))
+    (mapAttrs (
+      _: l:
+      listToAttrs (
+        map (pkg: {
+          name = replaceDots ("v" + pkg.version);
+          value = pkg;
+        }) l
+      )
+    ))
+  ];
+
+  inherit resolveDeps patchIntel buildIntel;
+}

pkgs/intel-oneapi/patch_intel.nix

@@ -0,0 +1,199 @@
+{
+  stdenv,
+  stdenvNoCC,
+  lib,
+  symlinkJoin,
+  autoPatchelfHook,
+  wrapCCWith,
+  overrideCC,
+  gcc,
+  hwloc,
+  libelf,
+  libffi_3_3,
+  libpsm2,
+  libuuid,
+  libxml2,
+  numactl,
+  ocl-icd,
+  openssl,
+  python3,
+  rdma-core,
+  ucx,
+  zlib,
+  writeTextFile,
+}:
+
+lib.makeOverridable (
+  {
+    unpatched,
+    components ? { },
+    extraPackages ? components.extraPackages or [ ],
+  }:
+
+  let
+    inherit (builtins)
+      attrValues
+      filter
+      mapAttrs
+      removeAttrs
+      ;
+
+    __components = removeAttrs components [ "extraPackages" ];
+    _components = __components;
+    # _components = lib.traceSeqN 2 {
+    #   inherit unpatched __components;
+    #   deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
+    # } __components;
+
+    wrapIntel =
+      cc:
+      let
+        targetConfig = stdenv.targetPlatform.config;
+      in
+      (wrapCCWith {
+        inherit cc;
+
+        nixSupport = {
+          cc-ldflags = [
+            "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
+            "-L${gcc.cc.lib}/lib"
+            "-L${cc}/lib"
+          ];
+          cc-cflags = [
+            "--gcc-toolchain=${gcc.cc}"
+            "-isystem \"${cc.original}/lib/clang/*/include\""
+            "-isystem ${cc}/include"
+            "-isystem ${cc}/include/intel64"
+            "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
+          ];
+          libcxx-cxxflags = [
+            # "--gcc-toolchain=${gcc.cc}"
+            "-isystem ${gcc.cc}/include/c++/${gcc.version}"
+            "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
+          ];
+        };
+
+        extraBuildCommands = ''
+          # FIXME: We should find a better way to modify the PATH instead of using
+          # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
+          echo 'path_backup="${gcc.cc}/bin:$path_backup"' >>$out/nix-support/cc-wrapper-hook
+
+          # Disable hardening by default
+          echo "" > $out/nix-support/add-hardening.sh
+
+          wrap icx  $wrapper $ccPath/icx
+          wrap icpx $wrapper $ccPath/icpx
+          wrap ifx  $wrapper $ccPath/ifx
+
+          ln -s $out/bin/icpx $out/bin/c++
+          ln -s $out/bin/icx  $out/bin/cc
+
+          ln -s $ccPath/sycl-ls $out/bin/sycl-ls
+          ln -s $ccPath/sycl-trace $out/bin/sycl-trace
+
+          sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
+
+          # Use this to detect when a compiler subprocess is called
+          # from icpx (--fsycl-host-compiler)
+          echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
+
+          # oneMath looks for sycl libraries in bin/../lib
+          ln -s ${cc}/lib $out/lib
+          ln -s ${cc}/include $out/include
+        '';
+      }).overrideAttrs
+        (old: {
+          installPhase = old.installPhase + ''
+            export named_cc="icx"
+            export named_cxx="icpx"
+            export named_fc="ifx"
+          '';
+        });
+
+  in
+  stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = lib.removeSuffix "-extracted" unpatched.pname;
+    inherit (unpatched) version;
+    src = unpatched;
+
+    phases = [
+      "installPhase"
+      "fixupPhase"
+    ];
+    buildInputs = [
+      libffi_3_3
+      libelf
+      libxml2
+      hwloc
+      numactl
+      libuuid
+      libpsm2
+      zlib
+      ocl-icd
+      rdma-core
+      ucx
+      openssl
+      python3
+      stdenv.cc.cc.lib
+    ]
+    ++ extraPackages;
+
+    autoPatchelfIgnoreMissingDeps = [
+      "libhwloc.so.5"
+      "libcuda.so.1"
+      "libze_loader.so.1"
+    ];
+
+    # There are broken symlinks that go outside packages, ignore them
+    dontCheckForBrokenSymlinks = true;
+
+    nativeBuildInputs = [ autoPatchelfHook ];
+    installPhase = ''
+      cp -r $src/opt/intel/oneapi/ $out
+    '';
+
+    passthru =
+      let
+        pkgs = mapAttrs (
+          folder: version:
+          let
+            original = "${finalAttrs.finalPackage}/${folder}/${version}";
+
+            etc-vendors = writeTextFile {
+              name = "intel-ocl-icd";
+              text = "${original}/lib/libintelocl.so";
+              destination = "/etc/OpenCL/vendors/intel.icd";
+            };
+          in
+          symlinkJoin {
+            pname = "intel-${folder}";
+            inherit version;
+            paths = [ original ] ++ lib.optionals (folder == "compiler") [ etc-vendors ];
+            passthru = { inherit original; };
+          }
+        ) _components;
+      in
+      pkgs
+      // {
+        inherit unpatched;
+        pkgs = lib.recurseIntoAttrs pkgs;
+        components = _components;
+
+        # This contains all packages properly symlinked into toplevel directories
+        # in $out.
+        #
+        # NOTE: there are clashes with packages that have symlinks outside their
+        # scope (libtcm and env/vars.sh)
+        all = symlinkJoin {
+          pname = finalAttrs.finalPackage.pname + "-symlinked";
+          inherit (finalAttrs.finalPackage) version;
+          paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
+        };
+
+        stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
+
+        cc = wrapIntel finalAttrs.finalPackage.pkgs.compiler;
+      };
+
+  })
+)

pkgs/intel-oneapi/process.jq

@@ -0,0 +1,29 @@
+#!/usr/bin/env -S jq -f
+
+def extract_fields: {
+        pname : .Package,
+        version : .Version,
+        provides : .Package | sub("[0-9.-]*$"; ""),
+        filename : .Filename,
+        size : ."Installed-Size" | tonumber,
+        sha256 : .SHA256,
+        dependencies : .Depends,
+    } ;
+
+# parses dependencies into a list of [{.pname, .kind, .version}]
+# some dependencies do not have a version specified, in which case, kind = version = null
+#
+# example dependencies:
+# intel-oneapi-common-vars (>= 2023.0.0-25325), intel-oneapi-common-licensing-2023.0.0
+
+def split_dependencies : map(try(.dependencies |= split(",\\s?"; "")) // .dependencies |= []) ;
+
+def match_version : capture("(?<pname>[a-zA-Z0-9_\\-.]*) *(\\((?<kind>[<>=]*) *(?<version>.*)\\))?"; "") ;
+
+def parse_dependencies : map_values(.dependencies.[] |= match_version) ;
+
+def sort_version_decreasing : sort_by(.version | split("[-.]"; "") | map(tonumber)) | reverse ;
+
+map(extract_fields) | split_dependencies | parse_dependencies | sort_version_decreasing
+
+# [.[] | select(.pname == "intel-hpckit") | .version]

pkgs/intel-oneapi/toJson.awk

@@ -0,0 +1,29 @@
+#!/usr/bin/env -S awk -f
+
+BEGIN   {
+    FS=": "
+
+    prev_empty=1
+    t="  "
+
+    print "[ {"
+}
+
+!NF { # empty line, update separator so next non empty line closes the dict
+    prev_empty=1
+    t="},\n{ "
+    next # skip line (we won't match anything else)
+}
+
+{
+    printf t "\"%s\" : \"%s\"\n", $1, $2
+
+    if (prev_empty) {
+        # we were the first after a group of empty lines, following ones have to
+        # have a comma
+        prev_empty=0
+        t=", "
+    }
+}
+
+END     { print "} ]" }

pkgs/intel-oneapi/update.sh

@@ -1,4 +1,11 @@
 #!/bin/sh
 
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o amd64-packages
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o all-packages
+out_64=$(mktemp intel-api.64.XXXXXX)
+out_all=$(mktemp intel-api.all.XXXXXX)
+trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
+
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
+
+# NOTE: we use `jq -r tostring` to minify the json (3.2Mb -> 2.3Mb)
+cat "$out_64" "$out_all" | ./toJson.awk | ./process.jq | jq -r tostring >packages.json

pkgs/llvm-intel/default.nix

@@ -0,0 +1,200 @@
+{
+  stdenv,
+  lib,
+  ninja,
+  addDriverRunpath,
+  cmake,
+  emhash,
+  fetchFromGitHub,
+  khronos-ocl-icd-loader,
+  libbacktrace,
+  opencl-headers,
+  parallel-hashmap,
+  perl,
+  pkg-config,
+  python3,
+  spirv-headers,
+  spirv-tools,
+  symlinkJoin,
+  zlib,
+
+  cudaPackages,
+  enableCuda ? true,
+}:
+
+let
+  version = "6.2.1";
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "llvm";
+    tag = "v${version}";
+    sha256 = "sha256-j8+DmGKO0qDF5JjH+DlkLKs1kBz6dS7ukwySd/Crqv0=";
+  };
+
+  pinned = {
+    inherit parallel-hashmap;
+
+    vc-intrinsics.src = fetchFromGitHub {
+      owner = "intel";
+      repo = "vc-intrinsics";
+      rev = "4e51b2467104a257c22788e343dafbdde72e28bb";
+      sha256 = "sha256-AHXeKbih4bzmcuu+tx2TeS7Ixmk54uS1vKFVxI6ZP8g=";
+    };
+
+    unified-memory-framework.src = fetchFromGitHub {
+      owner = "oneapi-src";
+      repo = "unified-memory-framework";
+      tag = "v0.11.0";
+      sha256 = "sha256-k8QdP2u1QOoeCZ6ps4sM8+1iZq/H3q0lqCfVk8mz9KI=";
+    };
+
+    ocl-headers = opencl-headers.overrideAttrs {
+      version = "2024.10.24";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "OpenCL-Headers";
+        tag = "v2024.10.24";
+        sha256 = "sha256-KDlruE0IG8d+lAChxYyc6dg5XOvqCMrMyO69sdAzejA=";
+      };
+    };
+
+    ocl-icd = khronos-ocl-icd-loader;
+
+    spirv-headers = spirv-headers.overrideAttrs {
+      version = "1.4.309.0";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "SPIRV-Headers";
+        tag = "vulkan-sdk-1.4.309.0";
+        sha256 = "sha256-Q1i6i5XimULuGufP6mimwDW674anAETUiIEvDQwvg5Y=";
+      };
+    };
+  };
+
+  fetchcontent_cmakeFlags = lib.mapAttrsToList (
+    name: value: (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_${lib.toUpper name}" (toString value.src))
+  ) pinned;
+
+  # Hack to fix #include <emhash/...>
+  emhash' = symlinkJoin {
+    name = "emhash";
+    paths = [ emhash ];
+    postBuild = ''
+      pushd $out/include
+      ln -s . emhash
+      popd
+    '';
+  };
+
+in
+stdenv.mkDerivation {
+  pname = "intel-llvm";
+  inherit src version;
+
+  enableParallelBuilding = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    perl
+    cmake
+    ninja
+    pkg-config
+    python3
+    spirv-tools
+    addDriverRunpath
+  ]
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = [
+    emhash'
+    libbacktrace
+    zlib
+
+    pinned.ocl-icd
+    pinned.ocl-headers
+    pinned.spirv-headers
+  ]
+  ++ lib.optionals enableCuda [
+    cudaPackages.cudatoolkit
+  ];
+
+  patches = [ ./fix-ur.patch ]; # Has been fixed in next release
+
+  preBuild = ''
+    chmod -R u+w /build/source
+  '';
+
+  cmakeDir = "../llvm";
+
+  cmakeFlags =
+    let
+      cmakeList = name: l: lib.cmakeOptionType "list" name (builtins.concatStringsSep ";" l);
+
+      LLVM_EXTERNAL_PROJECTS = [
+        "sycl"
+        "llvm-spirv"
+        "opencl"
+        "xpti"
+        "xptifw"
+        "compiler-rt"
+        "sycl-jit"
+      ]
+      ++ lib.optionals enableCuda [
+        "libclc"
+      ];
+    in
+    [
+      (lib.cmakeBool "LLVM_ENABLE_ASSERTIONS" true)
+
+      (cmakeList "LLVM_TARGETS_TO_BUILD" (
+        [
+          "host"
+          "SPIRV"
+        ]
+        ++ lib.optionals enableCuda [ "NVPTX" ]
+      ))
+      (cmakeList "LLVM_EXTERNAL_PROJECTS" LLVM_EXTERNAL_PROJECTS)
+      (cmakeList "LLVM_ENABLE_PROJECTS" ([ "clang" ] ++ LLVM_EXTERNAL_PROJECTS))
+
+      (lib.cmakeBool "UR_USE_EXTERNAL_UMF" false)
+      (lib.cmakeOptionType "path" "UR_OPENCL_INCLUDE_DIR" (toString pinned.ocl-headers))
+      (lib.cmakeOptionType "path" "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
+      (lib.cmakeFeature "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
+
+      (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+      (lib.cmakeBool "LLVM_BUILD_TOOLS" true)
+      (lib.cmakeBool "LLVM_ENABLE_ZSTD" true)
+      (lib.cmakeBool "LLVM_USE_STATIC_ZSTD" true)
+      (lib.cmakeBool "LLVM_ENABLE_DOXYGEN" false)
+      (lib.cmakeBool "LLVM_ENABLE_LLD" false)
+      (lib.cmakeBool "LLVM_ENABLE_SPHINX" false)
+      (lib.cmakeBool "LLVM_SPIRV_ENABLE_LIBSPIRV_DIS" false)
+      (lib.cmakeBool "SYCL_ENABLE_WERROR" false)
+      (lib.cmakeBool "SYCL_INCLUDE_TESTS" false)
+      (lib.cmakeBool "SYCL_ENABLE_EXTENSION_JIT" true)
+      (lib.cmakeBool "SYCL_ENABLE_MAJOR_RELEASE_PREVIEW_LIB" false)
+      (lib.cmakeBool "SYCL_ENABLE_XPTI_TRACING" true)
+      (lib.cmakeBool "XPTI_ENABLE_WERROR" false)
+
+      (cmakeList "SYCL_ENABLE_BACKENDS" ([ "opencl" ] ++ lib.optionals enableCuda [ "cuda" ]))
+    ]
+    ++ fetchcontent_cmakeFlags
+    ++ lib.optionals enableCuda [
+      (lib.cmakeOptionType "list" "LIBCLC_TARGETS_TO_BUILD" "nvptx64--nvidiacl")
+      (lib.cmakeBool "LIBCLC_GENERATE_REMANGLED_VARIANTS" true)
+      (lib.cmakeBool "LIBCLC_NATIVECPU_HOST_TARGET" false)
+    ];
+
+  meta = {
+    homepage = "https://github.com/intel/llvm";
+    description = "Intel staging area for llvm.org contribution";
+    maintainers = with lib.maintainers.bsc; [ abonerib ];
+    platforms = lib.platforms.linux;
+    license = [
+      lib.licenses.asl20
+      lib.licenses.llvm-exception
+    ];
+  };
+}

pkgs/llvm-intel/fix-ur.patch

@@ -0,0 +1,23 @@
+diff --git a/unified-runtime/source/adapters/cuda/CMakeLists.txt b/unified-runtime/source/adapters/cuda/CMakeLists.txt
+index a8401c71a..2ab363926 100644
+--- a/unified-runtime/source/adapters/cuda/CMakeLists.txt
++++ b/unified-runtime/source/adapters/cuda/CMakeLists.txt
+@@ -62,14 +62,14 @@ add_library(cudadrv SHARED IMPORTED GLOBAL)
+ if (WIN32)
+   set_target_properties(
+     cudadrv PROPERTIES 
+-      IMPORTED_IMPLIB               ${CUDA_cuda_driver_LIBRARY}
+-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
++      IMPORTED_IMPLIB               "${CUDA_cuda_driver_LIBRARY}"
++      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
+   )
+ else()
+   set_target_properties(
+     cudadrv PROPERTIES 
+-      IMPORTED_LOCATION             ${CUDA_cuda_driver_LIBRARY}
+-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
++      IMPORTED_LOCATION             "${CUDA_cuda_driver_LIBRARY}"
++      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
+   )
+ endif()
+ 

pkgs/llvm-ompss2/clang.nix

@@ -16,19 +16,19 @@
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/llvm-ompss/llvm-mono.git"
 , gitBranch ? "master"
-, gitCommit ? "880e2341c56bad1dc14e8c369fb3356bec19018e"
+, gitCommit ? "872ba63f86edaefc9787984ef3fae9f2f94e0124" # github-release-2025.11
 }:
 
 let
   stdenv = llvmPackages_latest.stdenv;
 
   release = rec {
-    version = "2025.06";
+    version = "2025.11";
     src = fetchFromGitHub {
       owner = "bsc-pm";
       repo = "llvm";
       rev = "refs/tags/github-release-${version}";
-      hash = "sha256-ww9PpRmtz/M9IyLiZ8rAehx2UW4VpQt+svf4XfKBzKo=";
+      hash = "sha256-UgwMTUkM9Z87dDH205swZFBeFhrcbLAxginViG40pBM=";
     };
   };
 
@@ -48,6 +48,7 @@ in stdenv.mkDerivation {
   inherit (source) src version;
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   passthru = {
     CC = "clang";
@@ -126,4 +127,12 @@ in stdenv.mkDerivation {
 # nanos6 installation, but this is would require a recompilation of clang each
 # time nanos6 is changed. Better to use the environment variable NANOS6_HOME,
 # and specify nanos6 at run time.
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
+    description = "C language family frontend for LLVM (for OmpSs-2)";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
+  };
 }

pkgs/llvm-ompss2/default.nix

@@ -3,6 +3,7 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
+, writeShellScript
 , openmp ? null
 , wrapCCWith
 , llvmPackages_latest
@@ -27,20 +28,17 @@ let
   # We need to replace the lld linker from bintools with our linker just built,
   # otherwise we run into incompatibility issues when mixing compiler and linker
   # versions.
-  bintools-unwrapped = llvmPackages_latest.tools.bintools-unwrapped.override {
+  bintools-unwrapped = llvmPackages_latest.bintools-unwrapped.override {
     lld = clangOmpss2Unwrapped;
   };
-  bintools = llvmPackages_latest.tools.bintools.override {
+  bintools = llvmPackages_latest.bintools.override {
     bintools = bintools-unwrapped;
   };
   targetConfig = stdenv.targetPlatform.config;
   inherit gcc;
   cc = clangOmpss2Unwrapped;
   gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-in wrapCCWith {
-  inherit cc bintools;
-  # extraPackages adds packages to depsTargetTargetPropagated
-  extraPackages = optional (openmp != null) openmp;
+
   extraBuildCommands = ''
     echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
     echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -57,14 +55,50 @@ in wrapCCWith {
     echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags
 
     wrap clang++  $wrapper $ccPath/clang++
-
-  '' + optionalString (openmp != null) ''
-    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
-  '' + optionalString (ompss2rt != null) ''
-    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
-    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
-  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-    echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
   '';
-}
 
+  envExports = lib.optionalString (openmp != null) ''
+      echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
+    '' + optionalString (ompss2rt != null) ''
+      echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
+      echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
+    '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
+      echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
+    '';
+
+  extraPackages = optional (openmp != null) openmp;
+
+  wrappedCC = wrapCCWith {
+    # extraPackages adds packages to depsTargetTargetPropagated
+    inherit cc bintools extraPackages;
+    extraBuildCommands = extraBuildCommands + envExports;
+  };
+
+  resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
+  in writeShellScript "remove-intel.sh" ''
+    if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
+      unset NIX_CFLAGS_COMPILE_${tconf}
+      unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
+
+      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+        echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
+      fi
+    fi
+  '';
+
+  intelExtraBuildCommands = ''
+    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
+    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
+  '';
+
+  wrappedCCIntel = wrapCCWith {
+    inherit cc bintools extraPackages;
+    # extraPackages adds packages to depsTargetTargetPropagated
+    extraBuildCommands = intelExtraBuildCommands + envExports;
+  };
+
+in wrappedCC.overrideAttrs (oldAttrs: {
+    passthru = oldAttrs.passthru // {
+      forIcpx = wrappedCCIntel;
+    };
+  })

pkgs/llvm-ompss2/openmp.nix

@@ -39,7 +39,9 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
-  ] ++ lib.optionals enableNosv [
+  ];
+
+  buildInputs = lib.optionals enableNosv [
     nosv
   ] ++ lib.optionals enableOvni [
     ovni
@@ -54,6 +56,7 @@ stdenv.mkDerivation rec {
   dontStrip = enableDebug;
 
   separateDebugInfo = true;
+  strictDeps = true;
 
   cmakeFlags = [
     "-DLIBOMP_OMPD_SUPPORT=OFF"
@@ -71,8 +74,38 @@ stdenv.mkDerivation rec {
     rm -f $out/libllvmrt/libomp.*
   '';
 
+  doInstallCheck = true;
+  # There are not cmake flags to force nOS-V, it enables it when found through
+  # pkg-config. If enableNosv is set, but we fail to find it at build time,
+  # the build will succeed but won't use nOS-V (libompv won't be created).
+  # This is a sanity check to ensure that after install we have the proper
+  # files.
+  installCheckPhase =
+    if enableNosv then
+      ''
+        test -f $out/lib/libompv.so
+        test -f $out/libllvmrt/libompv.so
+        test ! -f $out/lib/libomp.so
+        test ! -f $out/libllvmrt/libomp.so
+      ''
+    else
+      ''
+        test -f $out/lib/libomp.so
+        test -f $out/libllvmrt/libomp.so
+        test ! -f $out/lib/libompv.so
+        test ! -f $out/libllvmrt/libompv.so
+      '';
+
   passthru = {
     inherit nosv;
   };
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
+    description = "Support for the OpenMP language (with nOS-V)";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
+  };
 }
 

pkgs/lmbench/default.nix

@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   enableParallelBuilding = false;
+  strictDeps = true;
 
   preBuild = ''
     makeFlagsArray+=(
@@ -42,8 +43,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "lmbench";
-    homepage = "http://www.bitmover.com/lmbench/";
-    maintainers = [ ];
+    homepage = "https://github.com/intel/lmbench";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
     platforms = lib.platforms.all;
+    license = lib.licenses.gpl2Plus;
   };
 }

pkgs/maintainers.nix

@@ -0,0 +1,7 @@
+builtins.mapAttrs (name: value: { email = name + "@bsc.es"; } // value) {
+  abonerib.name = "Aleix Boné";
+  arocanon.name = "Aleix Roca";
+  rarias.name = "Rodrigo Arias";
+  rpenacob.name = "Raúl Peñacoba";
+  varcila.name = "Vincent Arcila";
+}

pkgs/mcxx/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchFromGitHub
 , autoreconfHook
 , nanos6
@@ -62,4 +63,13 @@ stdenv.mkDerivation rec {
 # Fails with "memory exhausted" with bison 3.7.1
 #    "--enable-bison-regeneration"
   ];
+
+  meta = {
+    broken = true;
+    homepage = "https://github.com/bsc-pm/mcxx";
+    description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
 }

pkgs/mcxx/git.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchFromGitHub
 , autoreconfHook
 , nanos6
@@ -57,4 +58,12 @@ stdenv.mkDerivation rec {
 # Fails with "memory exhausted" with bison 3.7.1
 #    "--enable-bison-regeneration"
   ];
+
+  meta = {
+    homepage = "https://github.com/bsc-pm/mcxx";
+    description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
 }

pkgs/mcxx/rarias.nix

@@ -1,4 +1,5 @@
 { stdenv
+, lib
 , fetchgit
 , autoreconfHook
 , nanos6
@@ -56,4 +57,12 @@ stdenv.mkDerivation rec {
   #preBuild = ''
   #  make generate_builtins_ia32 GXX_X86_BUILTINS=${gcc}/bin/g++
   #'';
+  #
+  meta = {
+    homepage = "https://github.com/bsc-pm/mcxx";
+    description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
 }

pkgs/meteocat-exporter/default.nix

@@ -1,12 +1,15 @@
 { python3Packages, lib }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "meteocat-exporter";
   version = "1.0";
 
+  pyproject = true;
+
   src = ./.;
 
   doCheck = false;
+  strictDeps = true;
 
   build-system = with python3Packages; [
     setuptools

pkgs/mpich/default.nix

@@ -6,6 +6,13 @@
 , pmix
 , gfortran
 , symlinkJoin
+# Disabled when cross-compiling
+# To fix cross compilation, we should fill the values in:
+# https://github.com/pmodels/mpich/blob/main/maint/fcrosscompile/cross_values.txt.in
+# For each arch
+, enableFortran ? stdenv.hostPlatform == stdenv.buildPlatform
+, perl
+, targetPackages
 }:
 
 let
@@ -15,10 +22,13 @@ let
     paths = [ pmix.dev pmix.out ];
   };
 in mpich.overrideAttrs (old: {
-  buildInput = old.buildInputs ++ [
+  buildInputs = old.buildInputs ++ [
     libfabric
     pmixAll
   ];
+  nativeBuildInputs = old.nativeBuildInputs ++ [
+    perl
+  ];
   configureFlags = [
     "--enable-shared"
     "--enable-sharedlib"
@@ -31,6 +41,22 @@ in mpich.overrideAttrs (old: {
   ] ++ lib.optionals (lib.versionAtLeast gfortran.version "10") [
     "FFLAGS=-fallow-argument-mismatch" # https://github.com/pmodels/mpich/issues/4300
     "FCFLAGS=-fallow-argument-mismatch"
+  ] ++ lib.optionals (!enableFortran) [
+    "--disable-fortran"
   ];
+
+  preFixup = ''
+    sed -i 's:^CC=.*:CC=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' $out/bin/mpicc
+    sed -i 's:^CXX=.*:CXX=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++:' $out/bin/mpicxx
+  '' + lib.optionalString enableFortran ''
+    sed -i 's:^FC=.*:FC=${targetPackages.gfortran or gfortran}/bin/${targetPackages.gfortran.targetPrefix or gfortran.targetPrefix}gfortran:' $out/bin/mpifort
+  '';
+
   hardeningDisable = [ "all" ];
+  strictDeps = true;
+
+  meta = old.meta // {
+    maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
+    cross = true;
+  };
 })

pkgs/nanos6/default.nix

@@ -16,7 +16,7 @@
 , jemallocNanos6 ? null
 , cachelineBytes ? 64
 , enableGlibcxxDebug ? false
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/nanos6/nanos6"
 , gitBranch ? "master"
@@ -80,7 +80,8 @@ in
       (optional enableGlibcxxDebug "CXXFLAGS=-D_GLIBCXX_DEBUG") ++
       # Most nanos6 api symbols are resolved at runtime, so prefer
       # ifunc by default
-      (optional isCross "--with-symbol-resolution=ifunc");
+      (optional isCross "--with-symbol-resolution=ifunc") ++
+      (optional enablePapi "--with-papi=${papi}");
 
     postConfigure = lib.optionalString (!enableDebug) ''
       # Disable debug
@@ -95,16 +96,14 @@ in
     dontStrip = enableDebug;
     separateDebugInfo = true;
 
+    strictDeps = true;
+
     nativeBuildInputs = [
       autoconf
       automake
       libtool
       pkg-config
-
-      # TODO: papi_version is needed for configure:
-      # ./configure: line 27378: papi_version: command not found
-      # This probably breaks cross-compilation
-    ] ++ lib.optionals enablePapi [ papi ];
+    ];
 
     buildInputs = [
       boost
@@ -119,11 +118,12 @@ in
       echo "export NANOS6_HOME=$out" >> $out/nix-support/setup-hook
     '';
 
-    meta = with lib; {
+    meta = {
       homepage = "https://github.com/bsc-pm/nanos6";
       description = "Nanos6 runtime for OmpSs-2" +
         optionalString (enableDebug) " (with debug symbols)";
-      platforms = platforms.linux;
-      license = licenses.gpl3;
+      maintainers = with lib.maintainers.bsc; [ rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
     };
   })

pkgs/nanos6/jemalloc.nix

@@ -1,4 +1,4 @@
-{ jemalloc }:
+{ jemalloc, lib }:
 
 jemalloc.overrideAttrs (old: {
   configureFlags = old.configureFlags ++ [
@@ -8,5 +8,6 @@ jemalloc.overrideAttrs (old: {
   hardeningDisable = [ "all" ];
   meta = old.meta // {
     description = old.meta.description + " (for Nanos6)";
+    maintainers = (old.meta.maintainers or []) ++ (with lib.maintainers.bsc; [ rarias ]);
   };
 })

pkgs/nix-wrap/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , bashInteractive
 , busybox
 , nix
@@ -86,5 +87,14 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp ${nix_conf} $out/share/nix.conf
   '';
+
+  meta = {
+    homepage = null;
+    description = "nix bubblewrap wrapper";
+    maintainers = [ ];
+    broken = true;
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+  };
 }
 

pkgs/nixgen/default.nix

@@ -0,0 +1,23 @@
+{
+  stdenv
+, lib
+}:
+
+stdenv.mkDerivation {
+  pname = "nixgen";
+  version = "0.0.1";
+  src = ./nixgen;
+  dontUnpack = true;
+  strictDeps = true;
+  phases = [ "installPhase" ];
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a $src $out/bin/nixgen
+  '';
+  meta = {
+    description = "Quickly generate flake.nix from command line";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
+}

pkgs/nixgen/nixgen

@@ -0,0 +1,97 @@
+#!/bin/sh
+#
+# Copyright (c) 2025, Barcelona Supercomputing Center (BSC)
+# SPDX-License-Identifier: GPL-3.0+
+# Author: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
+
+function usage() {
+  echo "USAGE: nixgen [-f] [package [...]] [-b package [...]]" >&2
+  echo "  Generates a flake.nix file with the given packages." >&2
+  echo "  After flake.nix is created, use 'nix develop' to enter the shell." >&2
+  echo "OPTIONS" >&2
+  echo "  -f               Overwrite existing flake.nix (default: no)." >&2
+  echo "  packages...      Add these packages to the shell." >&2
+  echo "  -b packages...   Add the dependencies needed to build these packages." >&2
+  echo "EXAMPLE" >&2
+  echo "  $ nixgen ovni bigotes -b nosv tampi" >&2
+  echo "  Adds the packages ovni and bigotes as well as all required dependencies" >&2
+  echo "  to build nosv and tampi." >&2
+  echo "AUTHOR" >&2
+  echo "  Rodrigo Arias Mallo <rodrigo.arias@bsc.es>" >&2
+  exit 1
+}
+
+mode=package
+packages=
+inputsFrom=
+force=
+
+if [[ $# -eq 0 ]]; then
+  usage
+fi
+
+while [[ $# -gt 0 ]]; do
+    case $1 in -b)
+      mode=build
+      shift
+      ;;
+    -f)
+      force=1
+      shift
+      ;;
+    -h)
+      usage
+      ;;
+    -*|--*)
+      echo "error: unknown option $1" >&2
+      exit 1
+      ;;
+    *)
+      if [ "$mode" == "package" ]; then
+        packages+="${packages:+ }$1"
+      else
+        inputsFrom+="${inputsFrom:+ }$1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+if [ ! "$force" -a -e flake.nix ]; then
+  echo "error: flake.nix exists, force overwrite with -f" >&2
+  exit 1
+fi
+
+cat > flake.nix <<EOF
+{
+  inputs.jungle.url = "git+https://jungle.bsc.es/git/rarias/jungle";
+  outputs = { self, jungle }:
+  let
+    nixpkgs = jungle.inputs.nixpkgs;
+    customOverlay = (final: prev: {
+      # Example overlay, for now empty
+    });
+    pkgs = import nixpkgs {
+      system = "x86_64-linux";
+      overlays = [
+        # Apply jungle overlay to get our BSC custom packages
+        jungle.outputs.bscOverlay
+        # And on top apply our local changes to customize for cluster
+        customOverlay
+      ];
+    };
+  in {
+    devShells.x86_64-linux.default = pkgs.mkShell {
+      pname = "devshell";
+      # Include these packages in the shell
+      packages = with pkgs; [
+        $packages
+      ];
+      # The dependencies needed to build these packages will be also included
+      inputsFrom = with pkgs; [
+        $inputsFrom
+      ];
+    };
+  };
+}
+EOF

pkgs/nixtools/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , glibc
 }:
 
@@ -15,4 +16,12 @@ stdenv.mkDerivation rec {
   makeFlags = [ "DESTDIR=$(out)" ];
   preBuild = "env";
   dontPatchShebangs = true;
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/rarias/nixtools";
+    description = "nix bubblewrap wrapper";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+  };
 }

pkgs/nodes/default.nix

@@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , pkg-config
-, perl
 , numactl
 , hwloc
 , boost
@@ -11,22 +10,23 @@
 , ovni
 , nosv
 , clangOmpss2
+, which
 , useGit ? false
 , gitUrl ? "ssh://git@gitlab-internal.bsc.es/nos-v/nodes.git"
 , gitBranch ? "master"
-, gitCommit ? "6002ec9ae6eb876d962cc34366952a3b26599ba6"
+, gitCommit ? "511489e71504a44381e0930562e7ac80ac69a848" # version-1.4
 }:
 
 with lib;
 
 let
   release = rec {
-    version = "1.3";
+    version = "1.4";
     src = fetchFromGitHub {
       owner = "bsc-pm";
       repo = "nodes";
       rev = "version-${version}";
-      hash = "sha256-cFb9pxcjtkMmH0CsGgUO9LTdXDNh7MCqicgGWawLrsU=";
+      hash = "sha256-+lR/R0l3fGZO3XG7whMorFW2y2YZ0ZFnLeOHyQYrAsQ=";
     };
   };
 
@@ -48,6 +48,7 @@ in
     enableParallelBuilding = true;
     dontStrip = true;
     separateDebugInfo = true;
+    strictDeps = true;
 
     configureFlags = [
       "--with-nosv=${nosv}"
@@ -59,6 +60,7 @@ in
     doCheck = false;
     nativeCheckInputs = [
       clangOmpss2
+      which
     ];
 
     # The "bindnow" flags are incompatible with ifunc resolution mechanism. We
@@ -81,4 +83,12 @@ in
     passthru = {
       inherit nosv;
     };
+
+    meta = {
+      homepage = "https://gitlab.bsc.es/nos-v/nodes";
+      description = "Runtime library designed to work on top of the nOS-V runtime";
+      maintainers = with lib.maintainers.bsc; [ abonerib rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
+    };
   }

pkgs/nosv/default.nix

@@ -7,25 +7,25 @@
 , numactl
 , hwloc
 , papi
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , cacheline ? 64 # bits
 , ovni ? null
 , useGit ? false
 , gitUrl ? "git@gitlab-internal.bsc.es:nos-v/nos-v.git"
 , gitBranch ? "master"
-, gitCommit ? "9f47063873c3aa9d6a47482a82c5000a8c813dd8"
+, gitCommit ? "1108e4786b58e0feb9a16fa093010b763eb2f8e8" # version 4.0.0
 }:
 
 with lib;
 
 let
   release = rec {
-    version = "3.2.0";
+    version = "4.0.0";
     src = fetchFromGitHub {
       owner = "bsc-pm";
       repo = "nos-v";
       rev = "${version}";
-      hash = "sha256-yaz92426EM8trdkBJlISmAoG9KJCDTvoAW/HKrasvOw=";
+      hash = "sha256-llaq73bd/YxLVKNlMebnUHKa4z3sdcsuDUoVwUxNuw8=";
     };
   };
 
@@ -40,16 +40,17 @@ let
 
   source = if (useGit) then git else release;
 in
-  stdenv.mkDerivation rec {
+  stdenv.mkDerivation {
     pname = "nosv";
     inherit (source) src version;
     hardeningDisable = [ "all" ];
     dontStrip = true;
     separateDebugInfo = true;
+    strictDeps = true;
     configureFlags = [
       "--with-ovni=${ovni}"
       "CACHELINE_WIDTH=${toString cacheline}"
-    ];
+    ] ++ lib.optionals enablePapi [ "--with-papi=${papi}" ];
     nativeBuildInputs = [
       autoreconfHook
       pkg-config
@@ -59,4 +60,13 @@ in
       hwloc
       ovni
     ] ++ lib.optionals enablePapi [ papi ];
+    patches = [ ./fix-papi.patch ];
+
+    meta = {
+      homepage = "https://gitlab.bsc.es/nos-v/nos-v";
+      description = "Tasking library enables the co-execution of multiple applications with system-wide scheduling and a centralized management of resources";
+      maintainers = with lib.maintainers.bsc; [ abonerib rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
+    };
   }

pkgs/nosv/fix-papi.patch

@@ -0,0 +1,136 @@
+Commit ID: c09633f172ce4075e0a05a33f6dcbe8e03e1202a
+Change ID: onmwypnnrysktutwsvotqovzponvwrxs
+Bookmarks: fix/papi fix/papi@git fix/papi@origin
+Author   : Aleix Boné <aleix.boneribo@bsc.es> (2025-12-10 11:14:14)
+Committer: Aleix Boné <aleix.boneribo@bsc.es> (2025-12-12 12:56:48)
+
+    Improve PAPI m4 module for cross compilation
+
+diff --git a/m4/papi.m4 b/m4/papi.m4
+index de90584870..8398f856f5 100644
+--- a/m4/papi.m4
++++ b/m4/papi.m4
+@@ -1,6 +1,6 @@
+ #	This file is part of Nanos6 and is licensed under the terms contained in the COPYING file.
+ #
+-#	Copyright (C) 2021-2022 Barcelona Supercomputing Center (BSC)
++#	Copyright (C) 2021-2025 Barcelona Supercomputing Center (BSC)
+ 
+ AC_DEFUN([AC_CHECK_PAPI],
+ 	[
+@@ -8,34 +8,38 @@
+ 			[papi],
+ 			[AS_HELP_STRING([--with-papi=prefix], [specify the installation prefix of PAPI])],
+ 			[ ac_cv_use_papi_prefix=$withval ],
+-			[ ac_cv_use_papi_prefix="" ]
++			[ ac_cv_use_papi_prefix="check" ]
+ 		)
+ 
+ 		if test x"${ac_cv_use_papi_prefix}" = x"no"; then
+ 			AC_MSG_CHECKING([the PAPI installation prefix])
+ 			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+ 			ac_use_papi=no
+-		elif test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-			AC_MSG_CHECKING([the PAPI installation prefix])
+-			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+-			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
+-			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
+-			ac_use_papi=yes
+-		else
++		elif test x"${ac_cv_use_papi_prefix}" = x""; then
++			AC_MSG_RESULT([invalid prefix])
++			AC_MSG_ERROR([papi prefix specified but empty])
++		elif test x"${ac_cv_use_papi_prefix}" = x"yes" -o x"${ac_cv_use_papi_prefix}" = x"check"; then
+ 			PKG_CHECK_MODULES(
+ 				[papi],
+-				[papi],
++				[papi >= 5.6.0],
+ 				[
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([retrieved from pkg-config])
+ 					papi_CFLAGS="${papi_CFLAGS}"
+ 					ac_use_papi=yes
++					ac_papi_version_correct=yes
+ 				], [
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([not available])
+ 					ac_use_papi=no
+ 				]
+ 			)
++		else
++			AC_MSG_CHECKING([the PAPI installation prefix])
++			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
++			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
++			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
++			ac_use_papi=yes
+ 		fi
+ 
+ 		if test x"${ac_use_papi}" = x"yes" ; then
+@@ -53,10 +57,10 @@
+ 					ac_use_papi=yes
+ 				],
+ 				[
+-					if test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-						AC_MSG_ERROR([PAPI cannot be found.])
++					if test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
++						AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 					else
+-						AC_MSG_WARN([PAPI cannot be found.])
++						AC_MSG_WARN([PAPI >= 5.6.0 not available.])
+ 					fi
+ 					ac_use_papi=no
+ 				]
+@@ -64,30 +68,38 @@
+ 
+ 			CFLAGS="${ac_save_CFLAGS}"
+ 			LIBS="${ac_save_LIBS}"
++		elif test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
++			AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 		fi
+ 
+-		if test x"${ac_use_papi}" = x"yes" ; then
+-			if test x"${ac_cv_use_papi_prefix}" != x"" ; then
++		if test x"${ac_use_papi}" = x"yes" -a x"${ac_papi_version_correct}" != x"yes" ; then
++			if test x"${ac_cv_use_papi_prefix}" != x"yes" -a x"${ac_cv_use_papi_prefix}" != x"check" ; then
+ 				papiBinary=${ac_cv_use_papi_prefix}/bin/papi_version
+ 			else
+ 				papiBinary=papi_version
+ 			fi
+-			papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
+ 
+-			AX_COMPARE_VERSION(
+-				[[${papiVersion}]],
+-				[[ge]],
+-				[[5.6.0]],
+-				[[ac_papi_version_correct=yes]],
+-				[[ac_papi_version_correct=no]]
+-			)
+ 
+-			if test x"${ac_papi_version_correct}" != x"yes" ; then
+-				AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
+-				ac_use_papi=no
++			if test x"$cross_compiling" = x"yes" ; then
++				AC_MSG_WARN([Cross-compiling detected, skipping PAPI version check])
+ 			else
+-				AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
+-				AC_MSG_RESULT([${ac_papi_version_correct}])
++				papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
++
++				AX_COMPARE_VERSION(
++					[[${papiVersion}]],
++					[[ge]],
++					[[5.6.0]],
++					[[ac_papi_version_correct=yes]],
++					[[ac_papi_version_correct=no]]
++				)
++
++				if test x"${ac_papi_version_correct}" != x"yes" ; then
++					AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
++					ac_use_papi=no
++				else
++					AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
++					AC_MSG_RESULT([${ac_papi_version_correct}])
++				fi
+ 			fi
+ 		fi
+ 

pkgs/onemath/default.nix

@@ -0,0 +1,91 @@
+{
+  lib,
+  fetchFromGitHub,
+  cmake,
+  withCFlags,
+  intelPackages,
+
+  mklSupport ? true,
+
+  config,
+
+  cudaSupport ? config.cudaSupport,
+  cudaPackages ? { },
+
+  rocmSupport ? config.rocmSupport,
+  hipTargets ? null, # only one target at a time supported
+  rocmPackages ? { },
+}:
+
+let
+  # rocmSupport is not enough, we need a specific target
+  enableHip = rocmSupport && hipTargets != null;
+
+  stdenv = withCFlags (lib.optionals cudaSupport [
+    "--cuda-path=${cudaPackages.cudatoolkit}"
+  ]) intelPackages.stdenv;
+in
+
+# at least one backend has to be enabled
+assert mklSupport || cudaSupport || enableHip;
+
+stdenv.mkDerivation rec {
+  pname = "oneMath";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "uxlfoundation";
+    repo = "oneMath";
+    rev = "v${version}";
+    sha256 = "sha256-xK8lKI3oqKlx3xtvdScpMq+HXAuoYCP0BZdkEqnJP5o=";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_MKLCPU_BACKEND" mklSupport)
+    (lib.cmakeBool "ENABLE_MKLGPU_BACKEND" mklSupport)
+
+    (lib.cmakeBool "ENABLE_CUBLAS_BACKEND" cudaSupport)
+    (lib.cmakeBool "ENABLE_CUFFT_BACKEND" cudaSupport)
+    (lib.cmakeBool "ENABLE_CURAND_BACKEND" cudaSupport)
+    (lib.cmakeBool "ENABLE_CUSOLVER_BACKEND" cudaSupport)
+    (lib.cmakeBool "ENABLE_CUSPARSE_BACKEND" cudaSupport)
+
+    (lib.cmakeBool "ENABLE_ROCBLAS_BACKEND" enableHip)
+    (lib.cmakeBool "ENABLE_ROCFFT_BACKEND" enableHip)
+    (lib.cmakeBool "ENABLE_ROCSOLVER_BACKEND" enableHip)
+    (lib.cmakeBool "ENABLE_ROCRAND_BACKEND" enableHip)
+    (lib.cmakeBool "ENABLE_ROCSPARSE_BACKEND" enableHip)
+
+    (lib.cmakeBool "BUILD_FUNCTIONAL_TESTS" false)
+    (lib.cmakeBool "BUILD_EXAMPLES" false)
+  ]
+  ++ lib.optionals enableHip [
+    (lib.cmakeFeature "HIP_TARGETS" hipTargets)
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs =
+    lib.optionals (mklSupport) [
+      intelPackages.mkl
+      intelPackages.tbb
+    ]
+    ++ lib.optionals (enableHip) [
+      rocmPackages.rocmPath
+      rocmPackages.rocblas
+      rocmPackages.rocfft
+      rocmPackages.rocsolver
+      rocmPackages.rocrand
+      rocmPackages.rocsparse
+    ]
+    ++ lib.optionals (cudaSupport) [
+      (lib.getDev cudaPackages.cuda_cudart)
+      cudaPackages.cudatoolkit
+
+      cudaPackages.libcublas
+      cudaPackages.libcurand
+      cudaPackages.libcufft
+      cudaPackages.libcusparse
+      cudaPackages.libcusolver
+    ];
+
+}

pkgs/osu/default.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   enableParallelBuilding = true;
+  strictDeps = true;
   nativeBuildInputs = [ mpiAll ];
   buildInputs = [ mpiAll ];
   hardeningDisable = [ "all" ];
@@ -32,6 +33,11 @@ stdenv.mkDerivation rec {
       "CXX=mpicxx"
   ];
 
+  env = {
+    MPICH_CC="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+    MPICH_CXX="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+  };
+
   postInstall = ''
     mkdir -p $out/bin
     for f in $(find $out -executable -type f); do
@@ -44,5 +50,6 @@ stdenv.mkDerivation rec {
     homepage = "http://mvapich.cse.ohio-state.edu/benchmarks/";
     maintainers = [ ];
     platforms = lib.platforms.all;
+    cross = true;
   };
 }

pkgs/ovni/default.nix

@@ -7,7 +7,7 @@
 , useGit ? false
 , gitBranch ? "master"
 , gitUrl ? "ssh://git@bscpm04.bsc.es/rarias/ovni.git"
-, gitCommit ? "e4f62382076f0cf0b1d08175cf57cc0bc51abc61"
+, gitCommit ? "06432668f346c8bdc1006fabc23e94ccb81b0d8b" # version 1.13.0
 , enableDebug ? false
 # Only enable MPI if the build is native (fails on cross-compilation)
 , useMpi ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform)
@@ -15,13 +15,13 @@
 
 let
   release = rec {
-    version = "1.12.0";
+    version = "1.13.0";
     src = fetchFromGitHub {
       owner = "bsc-pm";
       repo = "ovni";
       rev = "${version}";
-      hash = "sha256-H04JvsVKrdqr3ON7JhU0g17jjlg/jzQ7eTfx9vUNd3E=";
-    } // { shortRev = "a73afcf"; };
+      hash = "sha256-0l2ryIyWNiZqeYdVlnj/WnQGS3xFCY4ICG8JedX424w=";
+    } // { shortRev = "0643266"; };
   };
 
   git = rec {
@@ -40,6 +40,7 @@ in
     inherit (source) src version;
     dontStrip = true;
     separateDebugInfo = true;
+    strictDeps = true;
     postPatch = ''
       patchShebangs --build test/
     '';
@@ -55,7 +56,13 @@ in
     doCheck = true;
     checkTarget = "test";
     hardeningDisable = [ "all" ];
+
     meta = {
+      homepage = "https://ovni.readthedocs.io";
+      description = "Obtuse but Versatile Nanoscale Instrumentation";
+      maintainers = with lib.maintainers.bsc; [ rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
       cross = true;
     };
   }

pkgs/papi/default.nix

@@ -0,0 +1,22 @@
+{
+  stdenv,
+  papi,
+}:
+
+if stdenv.hostPlatform == stdenv.buildPlatform then
+  papi
+else
+  papi.overrideAttrs (old: {
+    configureFlags = (old.configureFlags or [ ]) ++ [
+      "--enable-perf_event_uncore=no"
+      "--with-sysdetect=no"
+      "--with-ffsll"
+      "--with-tls=__thread"
+      "--with-virtualtimer=clock_thread_cputime_id"
+      "--with-walltimer=clock_realtime"
+      "--with-perf-events"
+      "--with-CPU=${stdenv.hostPlatform.uname.processor}"
+      "--with-arch=${stdenv.hostPlatform.uname.processor}"
+    ];
+    patches = (old.patches or [ ]) ++ [ ./fix-ar-cross.patch ];
+  })

pkgs/papi/fix-ar-cross.patch

@@ -0,0 +1,19 @@
+diff --git a/sde_lib/Makefile b/sde_lib/Makefile
+index 8518f92..90a9953 100644
+--- a/sde_lib/Makefile
++++ b/sde_lib/Makefile
+@@ -1,4 +1,5 @@
+ CC ?= gcc
++AR ?= ar
+ SDE_INC = -I. -I..
+ SDE_LD = -ldl -pthread
+ CFLAGS += -Wextra -Wall -O2
+@@ -18,7 +19,7 @@ dynamic: $(DOBJS)
+ 	rm -f *_d.o
+ 
+ static: $(SOBJS)
+-	ar rs libsde.a $(SOBJS)
++	$(AR) rs libsde.a $(SOBJS)
+ 	rm -f *_s.o
+ 
+ clean:

pkgs/paraver/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchFromGitHub
 , autoreconfHook
 , boost
@@ -11,7 +12,7 @@
 , paraverKernel
 , openssl
 , glibcLocales
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
 
   dontStrip = true;
   enableParallelBuilding = true;
+  strictDeps = true;
 
   preConfigure = ''
     export CFLAGS="-O3"
@@ -63,7 +65,7 @@ stdenv.mkDerivation rec {
     autoconf
     automake
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -88,4 +90,18 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man
     mv $out/share/doc/wxparaver_help_contents/man $out/share/man/man1
   '';
+
+  meta = {
+    homepage = "https://tools.bsc.es/paraver";
+    downloadPage = "https://github.com/bsc-performance-tools/wxparaver";
+    description = "Performance analyzer based on event traces";
+    longDescription = ''
+      Trace-based visualization and analysis tool designed to study quantitative
+      detailed metrics and obtain qualitative knowledge of the performance of
+      applications, libraries, processors and whole architectures
+    '';
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+  };
 }

pkgs/paraver/kernel.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , fetchFromGitHub
 , autoreconfHook
 , boost
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   dontStrip = true;
+  strictDeps = true;
 
   preConfigure = ''
     export CFLAGS="-O3 -DPARALLEL_ENABLED"
@@ -57,4 +59,13 @@ stdenv.mkDerivation rec {
     xml2
     zlib
   ];
+
+  meta = {
+    homepage = "https://tools.bsc.es/paraver";
+    downloadPage = "https://github.com/bsc-performance-tools/paraver-kernel";
+    description = "Kernel library used by wxparaver";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+  };
 }

pkgs/pertalde/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  cargo,
+  rustPlatform,
+  rustc,
+}:
+
+let
+  pname = "pertalde";
+  version = "0.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-KdS5yNYR+8z81hMBTl9oNiLi17cVLyoZBNNR88T/gOY=";
+  };
+in
+python3.pkgs.buildPythonApplication {
+  inherit pname version src;
+  pyproject = true;
+  strictDeps = true;
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-dQ8EKlYZq+Urtb+0zxRi/Vh/ormIGCNKHy/9entyb7g=";
+  };
+
+  # error[E0554]: `#![feature]` may not be used on the stable release channel
+  env.RUSTC_BOOTSTRAP = true;
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  meta = {
+    description = "Some command-line utilities on paraver traces";
+    homepage = "https://pypi.org/project/pertalde/";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers.bsc; [ abonerib ];
+    mainProgram = "ptd";
+  };
+}

pkgs/pocl/0001-cmake-do-not-use-suffix.patch

@@ -0,0 +1,26 @@
+From ccf301659caac9b5e973ba1f2d32352acf617a98 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 16:45:05 +0200
+Subject: [PATCH] cmake: do not use suffix
+
+---
+ cmake/LLVM.cmake                              |  3 ++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index f4dbda065..e29144dce 100644
+--- a/cmake/LLVM.cmake
++++ b/cmake/LLVM.cmake
+@@ -65,6 +65,9 @@ else()
+     message(WARNING "Cannot determine llvm binary suffix from ${LLVM_CONFIG}")
+   endif()
+   message(STATUS "LLVM binaries suffix : ${LLVM_BINARY_SUFFIX}")
++
++  # We don't want suffixes in nix
++  set(LLVM_BINARY_SUFFIX "")
+ endif()
+ 
+ get_filename_component(LLVM_CONFIG_LOCATION "${LLVM_CONFIG}" DIRECTORY)
+-- 
+2.45.1
+

pkgs/pocl/0001-cmake-native-build-tools.patch

@@ -0,0 +1,33 @@
+From f24b456c50f587b05cc8f2699c94d8cdefc5b13e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 17:11:11 +0200
+Subject: [PATCH] cmake: native build tools
+
+---
+ cmake/LLVM.cmake                    |   7 +-
+ 1 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index e29144dce..b9f14ce6a 100644
+--- a/cmake/LLVM.cmake
++++ b/cmake/LLVM.cmake
+@@ -269,10 +269,15 @@ endforeach()
+ 
+ ####################################################################
+ 
++if(DEFINED LLVM_NATIVE_TOOL_DIR)
++  set(TOOL_DIR "${LLVM_NATIVE_TOOL_DIR}")
++  message(STATUS "TOOL_DIR=${TOOL_DIR}")
++endif()
++
+ macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
+   find_program(${OUTPUT_VAR}
+     NAMES "${PROG_NAME}${LLVM_BINARY_SUFFIX}${CMAKE_EXECUTABLE_SUFFIX}"
+-    HINTS "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
++    HINTS "${TOOL_DIR}" "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
+     DOC "${DOCSTRING}"
+     NO_CMAKE_PATH
+     NO_CMAKE_ENVIRONMENT_PATH
+-- 
+2.45.1
+

pkgs/pocl/0001-cmake-use-clang-from-cmake-variable.patch

@@ -0,0 +1,48 @@
+From 4688b5ce895761c884ae15fc0234ed8d623b988b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 15:41:47 +0200
+Subject: [PATCH] cmake: use clang from cmake variable
+
+---
+ cmake/LLVM.cmake | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index 71b786dc7..f4dbda065 100644
+--- a/cmake/LLVM.cmake
++++ b/cmake/LLVM.cmake
+@@ -281,11 +281,29 @@ macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
+   endif()
+ endmacro()
+ 
+-find_program_or_die( CLANG "clang" "clang binary")
++# -DCMAKE_C_COMPILER=riscv64-unknown-linux-gnu-clang -DCMAKE_CXX_COMPILER=riscv64-unknown-linux-gnu-clang++
++
++# if(DEFINED CLANG_EXECUTABLE)
++if(DEFINED CMAKE_C_COMPILER)
++  # set(CLANG "${CLANG_EXECUTABLE}")
++  set(CLANG "${CMAKE_C_COMPILER}")
++  message(STATUS "Using CLANG_EXECUTABLE: ${CLANG}")
++else()
++  find_program_or_die( CLANG "clang" "clang binary")
++endif()
+ execute_process(COMMAND "${CLANG}" "--version" OUTPUT_VARIABLE LLVM_CLANG_VERSION RESULT_VARIABLE CLANG_RES)
++
+ # TODO this should be optional
+-find_program_or_die( CLANGXX "clang++" "clang++ binary")
++# if(DEFINED CLANGXX_EXECUTABLE)
++if(DEFINED CMAKE_CXX_COMPILER)
++  # set(CLANGXX "${CLANGXX_EXECUTABLE}")
++  set(CLANGXX "${CMAKE_CXX_COMPILER}")
++  message(STATUS "Using CLANGXX_EXECUTABLE: ${CLANGXX}")
++else()
++  find_program_or_die( CLANGXX "clang++" "clang++ binary")
++endif()
+ execute_process(COMMAND "${CLANGXX}" "--version" OUTPUT_VARIABLE LLVM_CLANGXX_VERSION RESULT_VARIABLE CLANGXX_RES)
++
+ if(CLANGXX_RES OR CLANG_RES)
+   message(FATAL_ERROR "Failed running clang/clang++ --version")
+ endif()
+-- 
+2.45.1
+

pkgs/pocl/default.nix

@@ -0,0 +1,255 @@
+{
+  lib,
+  llvmPackages,
+  ninja,
+  cmake,
+  hwloc,
+  ocl-icd,
+  opencl-headers,
+  getconf,
+  pkg-config,
+  spirv-llvm-translator,
+  spirv-tools,
+  libxml2, # required for statically linked llvm
+  python3,
+  writableTmpDirAsHomeHook,
+  writeText,
+  runCommand,
+  opencl-cts,
+
+  fetchFromGitHub,
+
+  useGit ? false,
+  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/pocl/pocl.git",
+  gitBranch ? "new-device",
+  gitCommit ? "dd10c2221b31223cbb796182df6a07f11c7541f5",
+
+  staticLLVM ? true,
+  enableICD ? true,
+  enableSPIRV ? true,
+  enableHWLOC ? true,
+  enableRemoteServer ? false,
+  enableRemoteClient ? false,
+  enableDistroVariants ? false,
+
+  lttng-ust,
+  enableLTTNG ? false,
+
+  onetbb,
+  enableTBB ? false,
+
+  nosv ? null,
+  ovni ? null,
+  enableNOSV ? useGit,
+  enableOVNI ? useGit,
+
+  buildPackages,
+  targetPackages,
+  nix-update-script,
+}:
+
+assert (enableNOSV || enableOVNI) -> useGit;
+
+let
+
+  release = rec {
+    version = "7.1";
+    src = fetchFromGitHub {
+      owner = "pocl";
+      repo = "pocl";
+      tag = "v${version}";
+      hash = "sha256-bS6vTIjLO7YLs7qYLKW0cYYbEJ/hRS/+IjjAKbkj8ac=";
+    };
+  };
+
+  git = rec {
+    version = src.shortRev;
+    src = builtins.fetchGit {
+      url = gitUrl;
+      ref = gitBranch;
+      rev = gitCommit;
+    };
+  };
+
+  source = if (useGit) then git else release;
+
+  stdenv = llvmPackages.stdenv;
+
+  buildLlvmPackages = buildPackages.llvmPackages;
+
+  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+
+  featureList = lib.concatStringsSep "+" (
+    (lib.optionals enableICD [ "icd" ])
+    ++ (lib.optionals enableNOSV [ "nosv" ])
+    ++ (lib.optionals enableOVNI [ "ovni" ])
+    ++ (lib.optionals enableSPIRV [ "spirv" ])
+    ++ (lib.optionals enableTBB [ "tbb" ])
+    ++ (lib.optionals enableRemoteClient [ "server" ])
+    ++ (lib.optionals enableRemoteServer [ "client" ])
+  );
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pocl";
+  version = featureList + "-" + source.version;
+  inherit (source) src;
+
+  patches = lib.optionals useGit [
+    ./0001-cmake-use-clang-from-cmake-variable.patch
+    ./0001-cmake-do-not-use-suffix.patch
+    ./0001-cmake-native-build-tools.patch
+  ];
+
+  cmakeFlags = [
+    # TODO: all these are broken when cross compiling. Upstream has refactored
+    # all the cmake infra for cross compilation, but it's not in a release yet
+    (lib.cmakeOptionType "filepath" "WITH_LLVM_CONFIG" (
+      lib.getExe' buildLlvmPackages.llvm.dev "llvm-config"
+    ))
+    (lib.cmakeOptionType "filepath" "CLANG" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang"))
+    (lib.cmakeOptionType "filepath" "CLANGXX" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang++"))
+    (lib.cmakeOptionType "path" "CLANG_RESOURCE_DIR" "${llvmPackages.stdenv.cc}/resource-root")
+
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+
+    (lib.cmakeBool "ENABLE_RELOCATION" true)
+    (lib.cmakeBool "ENABLE_POCL_BUILDING" true)
+    (lib.cmakeBool "POCL_ICD_ABSOLUTE_PATH" true)
+
+    (lib.cmakeBool "ENABLE_TBB_DEVICE" enableTBB)
+    (lib.cmakeBool "ENABLE_ICD" enableICD)
+    (lib.cmakeBool "ENABLE_HWLOC" enableHWLOC)
+    (lib.cmakeBool "ENABLE_LTTNG" enableLTTNG)
+
+    (lib.cmakeBool "ENABLE_REMOTE_CLIENT" enableRemoteClient)
+    (lib.cmakeBool "ENABLE_REMOTE_SERVER" enableRemoteServer)
+
+    # avoid the runtime linker pulling in a different llvm e.g. from graphics drivers
+    (lib.cmakeBool "STATIC_LLVM" staticLLVM)
+  ]
+  ++ lib.optionals (enableNOSV || enableOVNI) [
+    (lib.cmakeBool "ENABLE_NOSV" enableNOSV)
+    (lib.cmakeBool "ENABLE_OVNI" enableOVNI)
+  ]
+  ++ lib.optionals (!isCross && enableDistroVariants) [
+    (lib.cmakeFeature "KERNELLIB_HOST_CPU_VARIANTS" "distro") # TODO: check if we can do it when cross compiling
+  ]
+  ++ lib.optionals isCross [
+    (lib.cmakeFeature "CMAKE_SYSTEM_NAME" "Linux")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PROGRAM" "NEVER")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_LIBRARY" "ONLY")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_INCLUDE" "ONLY")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PACKAGE" "ONLY")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV [
+    (lib.cmakeFeature "LLC_TRIPLE" "riscv64-unknown-linux-gnu")
+    (lib.cmakeFeature "LLC_HOST_CPU" "rv64g")
+    (lib.cmakeFeature "CLANG_MARCH_FLAG" "-march=")
+  ];
+
+  # Fixes error: ld: cannot find -lgcc / -lgcc_s when linking from libpocl on
+  # host
+  preConfigure = ''
+    cmakeFlagsArray+=(
+      -DEXTRA_HOST_LD_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
+      -DEXTRA_KERNEL_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
+    )
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    getconf
+    ninja
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    opencl-headers
+    llvmPackages.libclang
+    llvmPackages.llvm
+  ]
+  ++ lib.optionals staticLLVM [ libxml2 ]
+  ++ lib.optionals enableNOSV [ nosv ]
+  ++ lib.optionals enableOVNI [ ovni ]
+  ++ lib.optionals enableHWLOC [ hwloc ]
+  ++ lib.optionals enableTBB [ onetbb ]
+  ++ lib.optionals enableICD [ ocl-icd ]
+  ++ lib.optionals enableLTTNG [ lttng-ust ]
+  ++ lib.optionals enableSPIRV [
+    (spirv-llvm-translator.override { inherit (llvmPackages) llvm; })
+    spirv-tools
+  ];
+
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook # needed for POCL_CACHE_DIR
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = lib.optionalString enableICD ''
+    runHook preInstallCheck
+
+    export OCL_ICD_VENDORS=$out/etc/OpenCL/vendors
+    $out/bin/poclcc -o poclcc.cl.pocl $src/examples/poclcc/poclcc.cl
+
+    runHook postInstallCheck
+  '';
+
+  setupHook = lib.optionalDrvAttr enableICD (
+    writeText "setup-hook" ''
+      addToSearchPath OCL_ICD_VENDORS @out@/etc/OpenCL/vendors
+    ''
+  );
+
+  passthru =
+    let
+      self = finalAttrs.finalPackage;
+    in
+    {
+      updateScript = nix-update-script { };
+      git = self.override { useGit = true; };
+
+      withICD = enableICD;
+
+      test = {
+        # Run builtin tests (causes a rebuild)
+        self = self.overrideAttrs { doCheck = true; };
+
+        # Run basic test from Khronos OpenCL Conformance Test Suite
+        # WARN: despite its name, test_basic is very exhaustive, and can take more
+        # than 1 hour in a marenostrum5 node.
+        cts =
+          assert enableICD;
+          lib.genAttrs [ "api" "basic" "c11_atomics" "printf" "svm" ] (
+            name:
+            runCommand "pocl-cts-test_${name}" {
+              nativeBuildInputs = [ self ];
+              requiredSystemFeatures = [ "sys-devices" ];
+              env = {
+                POCL_DEBUG = "error,warn";
+                POCL_CACHE_DIR = "/build/pocl_cache";
+              };
+            } "${opencl-cts}/bin/Release/test_${name} | tee $out"
+          );
+      };
+    };
+
+  env.HWLOC_SYNTHETIC = lib.optionalDrvAttr enableHWLOC "node:1 core:1 pu:1";
+
+  propagatedBuildInputs = [ stdenv.cc.cc ];
+
+  meta = with lib; {
+    description = "A portable open source (MIT-licensed) implementation of the OpenCL standard";
+    homepage = "http://portablecl.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      leixb
+      jansol
+      xddxdd
+      bsc.maintainers.leixb
+    ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+})

pkgs/rodinia/default.nix

@@ -0,0 +1,58 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  ocl-icd,
+  opencl-headers,
+}:
+
+stdenv.mkDerivation {
+  pname = "rodinia-opencl";
+  version = "3.1";
+  src = fetchurl {
+    url = "http://www.cs.virginia.edu/~skadron/lava/Rodinia/Packages/rodinia_3.1.tar.bz2";
+    hash = "sha256-+uusfBHtj4/Pa/LX6FwwhvwtEfciBNbfwo3FsujyrP0=";
+  };
+
+  patches = [
+    ./rodinia-fixes.patch
+    ./rodinia-rm.patch
+  ];
+  buildInputs = [
+    opencl-headers
+    ocl-icd
+  ];
+  buildFlags = [
+    "OPENCL"
+    "--always-make"
+  ];
+
+  preBuild = ''
+    mkdir -p bin/linux/{cuda,omp,opencl}
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share
+    cp -r bin data opencl $out
+    cp LICENSE README $out/share
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://rodinia.cs.virginia.edu/";
+    description = "Test Suite of Compute-Intensive Applications with Accelerators";
+    maintainers = with lib.maintainers.bsc; [ abonerib ];
+    platforms = lib.platforms.linux;
+    license = {
+      deprecated = false;
+      free = false;
+      fullName = "Rodinia License";
+      redistributable = true;
+      shortName = "rodinia";
+      url = "https://www.cs.virginia.edu/~skadron/lava/rodinia/license.htm";
+    };
+  };
+}

pkgs/slurm-exporter/default.nix

@@ -13,6 +13,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-A1dd9T9SIEHDCiVT2UwV6T02BSLh9ej6LC/2l54hgwI=";
   doCheck = false;
+  strictDeps = true;
 
   meta = with lib; {
     description = "Prometheus SLURM Exporter";

pkgs/sonar/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , autoreconfHook
 , fetchFromGitHub
 , ovni
@@ -17,6 +18,7 @@ stdenv.mkDerivation rec {
   };
   hardeningDisable = [ "all" ];
   dontStrip = true;
+  strictDeps = true;
   configureFlags = [ "--with-ovni=${ovni}" ];
 
   nativeBuildInputs = [
@@ -27,4 +29,13 @@ stdenv.mkDerivation rec {
     ovni
     mpi
   ];
+
+  meta = {
+    homepage = "https://github.com/bsc-pm/sonar";
+    description = "Set of runtime libraries which instrument parallel programming models through the ovni instrumentation library";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+    cross = true;
+  };
 }

pkgs/systems.nix

@@ -1,4 +0,0 @@
-# See https://github.com/nix-systems/nix-systems
-[
-  "x86_64-linux"
-]