Bind mount /home as /nfs/home in apex and owls

Fixes: rarias/jungle#232

flake.lock

@@ -1,107 +1,25 @@
 {
   "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1750173260,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752436162,
-        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
+        "lastModified": 1767634882,
+        "narHash": "sha256-2GffSfQxe3sedHzK+sTKlYo/NTIAGzbFCIsNMUPAAnk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "rev": "3c9db02515ef1d9b6b709fc60ba9a540957f661c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "agenix": "agenix",
         "nixpkgs": "nixpkgs"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -1,15 +1,13 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
-    agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
-  outputs = { self, nixpkgs, agenix, ... }:
+  outputs = { self, nixpkgs, ... }:
 let
   mkConf = name: nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
-    specialArgs = { inherit nixpkgs agenix; theFlake = self; };
+    specialArgs = { inherit nixpkgs; theFlake = self; };
     modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
   };
   # For now we only support x86

keys.nix

@@ -22,8 +22,9 @@ rec {
     storage    = [ bay lake2 ];
     monitor    = [ hut ];
     login      = [ apex ];
+    services   = [ tent ];
 
-    system     = storage ++ monitor ++ login;
+    system     = storage ++ monitor ++ login ++ services;
     safe       = system ++ compute;
     all        = safe ++ playground;
   };

m/apex/configuration.nix

@@ -7,6 +7,7 @@
     ../module/ceph.nix
     ../module/hut-substituter.nix
     ../module/slurm-server.nix
+    ../module/nfs-home-bind.nix
     ./nfs.nix
     ./wireguard.nix
   ];
@@ -57,6 +58,18 @@
     };
   };
 
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    bantime-increment = {
+      enable = true; # Double ban time on each attack
+      maxtime = "7d"; # Ban up to a week
+    };
+  };
+
+  # Disable SSH login with password, allow only keypair
+  services.openssh.settings.PasswordAuthentication = false;
+
   networking.firewall = {
     extraCommands = ''
       # Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our

m/apex/nfs.nix

@@ -7,7 +7,7 @@
     mountdPort = 4002;
     statdPort = 4000;
     exports = ''
-      /home 10.0.40.0/24(rw,async,no_subtree_check,no_root_squash)
+      /home 10.0.40.0/21(rw,async,no_subtree_check,no_root_squash)
       /home 10.106.0.0/24(rw,async,no_subtree_check,no_root_squash)
     '';
   };
@@ -15,19 +15,19 @@
     # Check with `rpcinfo -p`
     extraCommands = ''
       # Accept NFS traffic from compute nodes but not from the outside
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
       # Same but UDP
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
 
       # Accept NFS traffic from wg0
       iptables -A nixos-fw -p tcp -i wg0 -s 10.106.0.0/24 --dport 111   -j nixos-fw-accept

m/bay/configuration.nix

@@ -24,7 +24,7 @@
       address = "10.0.40.40";
       prefixLength = 24;
     } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
       address = "10.0.42.40";
       prefixLength = 24;
     } ];
@@ -35,7 +35,7 @@
         # Accept monitoring requests from hut
         iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept
         # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
       '';
     };
   };

m/common/base/agenix.nix

@@ -1,9 +1,8 @@
-{ agenix, ... }:
+{ pkgs, ... }:
 
 {
-  imports = [ agenix.nixosModules.default ];
+  imports = [ ../../module/agenix.nix ];
 
-  environment.systemPackages = [
-    agenix.packages.x86_64-linux.default
-  ];
+  # Add agenix to system packages
+  environment.systemPackages = [ pkgs.agenix ];
 }

m/common/base/env.nix

@@ -1,11 +1,36 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 
 {
   environment.systemPackages = with pkgs; [
-    vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
-    nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
-    ncdu config.boot.kernelPackages.perf ldns pv
-    # From bsckgs overlay
+    cmake
+    ethtool
+    file
+    freeipmi
+    git
+    gnumake
+    home-manager
+    htop
+    ipmitool
+    ldns
+    lm_sensors
+    ncdu
+    nix-diff
+    nix-index
+    nix-output-monitor
+    nixfmt-tree
+    nixos-option
+    pciutils
+    perf
+    pv
+    ripgrep
+    tcpdump
+    tmux
+    tree
+    vim
+    wget
+
+    # From jungle overlay
+    nixgen
     osumb
   ];
 

m/common/base/users.nix

@@ -134,11 +134,12 @@
         home = "/home/Computational/varcila";
         description = "Vincent Arcila";
         group = "Computational";
-        hosts = [ "apex" "hut" "tent" "fox" ];
+        hosts = [ "apex" "hut" "tent" "fox" "owl1" "owl2" ];
         hashedPassword = "$6$oB0Tcn99DcM4Ch$Vn1A0ulLTn/8B2oFPi9wWl/NOsJzaFAWjqekwcuC9sMC7cgxEVb.Nk5XSzQ2xzYcNe5MLtmzkVYnRS1CqP39Y0";
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
         ];
+        shell = pkgs.zsh;
       };
 
       pmartin1 = {
@@ -180,6 +181,45 @@
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmMqKqPg4uocNOr3O41kLbZMOMJn3m2ZdN1JvTR96z3 bsccns@arnau-bsc"
         ];
       };
+
+      aaguirre = {
+        uid = 9655;
+        isNormalUser = true;
+        home = "/home/Computational/aaguirre";
+        description = "Alejandro Aguirre";
+        group = "Computational";
+        hosts = [ "apex" "hut" ];
+        hashedPassword = "$6$TXRXQT6jjBvxkxU6$E.sh5KspAm1qeG5Ct7OPHpo8REmbGDwjFGvqeGgTVz3GASGOAnPL7UMZsMAsAKBoahOw.v8LNno6XGrTEPzZH1";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
+        ];
+      };
+
+      emonteir = {
+        uid = 9656;
+        isNormalUser = true;
+        home = "/home/Computational/emonteir";
+        description = "Erwin Royson Monteiro";
+        group = "Computational";
+        hosts = [ "apex" "fox" ];
+        hashedPassword = "$6$0mU88zd3ZuK5NiJQ$DFWL5RMLH6esQM5UyhBCiiNryw4lDDmvJp7Usz3tmevnsiSJr6u0RsUKAnR/K8GRBFrV1.GocrgNjKjik5GY//";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKZKot/Y3F5Wq9pQIXlCbyvQuVVeWMCsAC96Nd+LTcG erwin@Oreo"
+        ];
+      };
+
+      ssanzmar = {
+        uid = 9657;
+        isNormalUser = true;
+        home = "/home/Computational/ssanzmar";
+        description = "Sergio Sanz Martínez";
+        group = "Computational";
+        hosts = [ "apex" "fox" ];
+        hashedPassword = "$6$HUjNDJeJMmNQ6M64$laXSOZcXg6o4v2r8Jm8Xj9kmqw7veCY32po3TVDPRR4WlyxvOeqwoKr4NjlUlPPpKN55Oot3ZYHi.9iNXsH5E1";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIELrsRRHXryrdA2ZBx5XmdGxL4DC5bmJydhBeTWQ0SQ sergio.sanz.martinez@estudiantat.upc.edu"
+        ];
+      };
     };
 
     groups = {

m/common/base/watchdog.nix

@@ -5,5 +5,5 @@
   boot.kernelModules = [ "ipmi_watchdog" ];
 
   # Enable systemd watchdog with 30 s interval
-  systemd.watchdog.runtimeTime = "30s";
+  systemd.settings.Manager.RuntimeWatchdogSec = 30;
 }

m/eudy/kernel/perf.nix

@@ -1,11 +1,6 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
 {
-  # add the perf tool
-  environment.systemPackages = with pkgs; [
-    config.boot.kernelPackages.perf
-  ];
-
   # allow non-root users to read tracing data from the kernel
   boot.kernel.sysctl."kernel.perf_event_paranoid" = -2;
   boot.kernel.sysctl."kernel.kptr_restrict" = 0;

m/fox/configuration.nix

@@ -93,20 +93,4 @@
     wantedBy = [ "multi-user.target" ];
     serviceConfig.ExecStart = script;
   };
-
-  # Only allow SSH connections from users who have a SLURM allocation
-  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
-  security.pam.services.sshd.rules.account.slurm = {
-    control = "required";
-    enable = true;
-    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
-    args = [ "log_level=debug5" ];
-    order = 999999; # Make it last one
-  };
-
-  # Disable systemd session (pam_systemd.so) as it will conflict with the
-  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
-  # into the slurmstepd task and then into the systemd session, which is not
-  # what we want, otherwise it will linger even if all jobs are gone.
-  security.pam.services.sshd.startSession = lib.mkForce false;
 }

m/hut/configuration.nix

@@ -17,6 +17,7 @@
     ./postgresql.nix
     ./nginx.nix
     ./p.nix
+    ./ompss2-timer.nix
     #./pxe.nix
   ];
 
@@ -44,7 +45,7 @@
       address = "10.0.40.7";
       prefixLength = 24;
     } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
       address = "10.0.42.7";
       prefixLength = 24;
     } ];

m/hut/gitea.nix

@@ -29,6 +29,9 @@
     };
   };
 
+  # Allow gitea user to send mail
+  users.users.gitea.extraGroups = [ "mail-robot" ];
+
   services.gitea-actions-runner.instances = {
     runrun = {
       enable = true;

m/hut/gitlab-runner.nix

@@ -51,6 +51,7 @@
           "/nix/store:/nix/store:ro"
           "/nix/var/nix/db:/nix/var/nix/db:ro"
           "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          "/var/run/postgresql/:/var/run/postgresql/"
         ];
         dockerExtraHosts = [
           # Required to pass the proxy via hut
@@ -60,6 +61,8 @@
         registrationFlags = [
           # Increase build log length to 64 MiB
           "--output-limit 65536"
+          # Allow the runner to be used in multiple projects
+          "--locked=false"
         ];
         preBuildScript = pkgs.writeScript "setup-container" ''
           mkdir -p -m 0755 /nix/var/log/nix/drvs

m/hut/monitoring.nix

@@ -5,7 +5,7 @@
     ../module/slurm-exporter.nix
     ../module/meteocat-exporter.nix
     ../module/upc-qaire-exporter.nix
-    ./gpfs-probe.nix
+    ./ssh-robot-probes.nix
     ../module/nix-daemon-exporter.nix
   ];
 
@@ -111,6 +111,7 @@
             "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
             "127.0.0.1:9341" # Slurm exporter
             "127.0.0.1:9966" # GPFS custom exporter
+            "127.0.0.1:9967" # SLURM custom exporter
             "127.0.0.1:9999" # Nix-daemon custom exporter
             "127.0.0.1:9929" # Meteocat custom exporter
             "127.0.0.1:9928" # UPC Qaire custom exporter

m/hut/msmtp.nix

@@ -1,8 +1,11 @@
 { config, lib, ... }:
 {
+  # Robot user that can see the password to send mail from jungle-robot
+  users.groups.mail-robot = {};
+
   age.secrets.jungleRobotPassword = {
     file = ../../secrets/jungle-robot-password.age;
-    group = "gitea";
+    group = "mail-robot";
     mode = "440";
   };
 

m/hut/nginx.nix

@@ -4,8 +4,8 @@ let
     name = "jungle-web";
     src = pkgs.fetchgit {
       url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
+      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
     };
     buildInputs = [ pkgs.hugo ];
     buildPhase = ''

m/hut/ompss2-timer.nix

@@ -0,0 +1,88 @@
+{ config, pkgs, ... }:
+{
+  systemd.timers = {
+    "ompss2-closing" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-closing.service";
+        OnCalendar = [ "*-03-15 07:00:00" "*-09-15 07:00:00"];
+      };
+    };
+    "ompss2-freeze" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-freeze.service";
+        OnCalendar = [ "*-04-15 07:00:00" "*-10-15 07:00:00" ];
+      };
+    };
+    "ompss2-release" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-release.service";
+        OnCalendar = [ "*-05-15 07:00:00" "*-11-15 07:00:00" ];
+      };
+    };
+  };
+
+  systemd.services =
+  let
+    closing = pkgs.writeText "closing.txt"
+    ''
+      Subject: OmpSs-2 release enters closing period
+      To: star@bsc.es
+
+      Hi,
+
+      You have one month to merge the remaining features for the next OmpSs-2
+      release. Please, identify what needs to be merged and discuss it in the next
+      OmpSs-2 meeting.
+
+      Thanks!,
+      Jungle robot
+    '';
+    freeze = pkgs.writeText "freeze.txt"
+    ''
+      Subject: OmpSs-2 release enters freeze period
+      To: star@bsc.es
+
+      Hi,
+
+      The period to introduce new features or breaking changes is over, only bug
+      fixes are allowed now. During this time, please prepare the release notes
+      to be included in the next OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    release = pkgs.writeText "release.txt"
+    ''
+      Subject: OmpSs-2 release now
+      To: star@bsc.es
+
+      Hi,
+
+      The period to introduce bug fixes is now over. Please, proceed to do the
+      OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    mkServ = name: mail: {
+      "ompss2-${name}" = {
+        script = ''
+          set -eu
+          set -o pipefail
+          cat ${mail} | ${config.security.wrapperDir}/sendmail -t star@bsc.es
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          DynamicUser = true;
+          Group = "mail-robot";
+        };
+      };
+    };
+  in
+    (mkServ "closing" closing) //
+    (mkServ "freeze" freeze) //
+    (mkServ "release" release);
+}

m/hut/postgresql.nix

@@ -8,12 +8,14 @@
       { name = "anavarro"; ensureClauses.superuser = true; }
       { name = "rarias";   ensureClauses.superuser = true; }
       { name = "grafana"; }
+      { name = "gitlab-runner"; }
     ];
     authentication = ''
-      #type  database     DBuser    auth-method
-      local  perftestsdb  rarias    trust
-      local  perftestsdb  anavarro  trust
-      local  perftestsdb  grafana   trust
+      #type  database     DBuser         auth-method
+      local  perftestsdb  rarias         trust
+      local  perftestsdb  anavarro       trust
+      local  perftestsdb  grafana        trust
+      local  perftestsdb  gitlab-runner  trust
     '';
   };
 }

m/hut/sblame-probe.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+cat <<EOF
+HTTP/1.1 200 OK
+Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
+
+EOF
+ssh bsc015557@glogin2.bsc.es "timeout 3 command sblame -E"

m/hut/ssh-robot-probes.nix

@@ -6,6 +6,12 @@ let
       chmod +x $out
     ''
   ;
+  sblame-probe-script = pkgs.runCommand "sblame-probe.sh" { }
+    ''
+      cp ${./sblame-probe.sh} $out;
+      chmod +x $out
+    ''
+  ;
 in
 {
   # Use a new user to handle the SSH keys
@@ -28,4 +34,17 @@ in
       Group = "ssh-robot";
     };
   };
+
+  systemd.services.sblame-probe = {
+    description = "Daemon to report SLURM statistics via SSH";
+    path = [ pkgs.openssh pkgs.netcat ];
+    after = [ "network.target" ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9967,fork EXEC:${sblame-probe-script}";
+      User = "ssh-robot";
+      Group = "ssh-robot";
+    };
+  };
 }

m/lake2/configuration.nix

@@ -46,7 +46,7 @@
       address = "10.0.40.42";
       prefixLength = 24;
     } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
       address = "10.0.42.42";
       prefixLength = 24;
     } ];
@@ -57,7 +57,7 @@
         # Accept monitoring requests from hut
         iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept
         # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
       '';
     };
   };

m/module/agenix.nix

@@ -0,0 +1,357 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  cfg = config.age;
+
+  isDarwin = lib.attrsets.hasAttrByPath [ "environment" "darwinConfig" ] options;
+
+  ageBin = config.age.ageBin;
+
+  users = config.users.users;
+
+  sysusersEnabled =
+    if isDarwin then
+      false
+    else
+      options.systemd ? sysusers && (config.systemd.sysusers.enable || config.services.userborn.enable);
+
+  mountCommand =
+    if isDarwin then
+      ''
+        if ! diskutil info "${cfg.secretsMountPoint}" &> /dev/null; then
+            num_sectors=1048576
+            dev=$(hdiutil attach -nomount ram://"$num_sectors" | sed 's/[[:space:]]*$//')
+            newfs_hfs -v agenix "$dev"
+            mount -t hfs -o nobrowse,nodev,nosuid,-m=0751 "$dev" "${cfg.secretsMountPoint}"
+        fi
+      ''
+    else
+      ''
+        grep -q "${cfg.secretsMountPoint} ramfs" /proc/mounts ||
+          mount -t ramfs none "${cfg.secretsMountPoint}" -o nodev,nosuid,mode=0751
+      '';
+  newGeneration = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] creating new generation in ${cfg.secretsMountPoint}/$_agenix_generation"
+    mkdir -p "${cfg.secretsMountPoint}"
+    chmod 0751 "${cfg.secretsMountPoint}"
+    ${mountCommand}
+    mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
+    chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  chownGroup = if isDarwin then "admin" else "keys";
+  # chown the secrets mountpoint and the current generation to the keys group
+  # instead of leaving it root:root.
+  chownMountPoint = ''
+    chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  setTruePath = secretType: ''
+    ${
+      if secretType.symlink then
+        ''
+          _truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
+        ''
+      else
+        ''
+          _truePath="${secretType.path}"
+        ''
+    }
+  '';
+
+  installSecret = secretType: ''
+    ${setTruePath secretType}
+    echo "decrypting '${secretType.file}' to '$_truePath'..."
+    TMP_FILE="$_truePath.tmp"
+
+    IDENTITIES=()
+    for identity in ${toString cfg.identityPaths}; do
+      test -r "$identity" || continue
+      test -s "$identity" || continue
+      IDENTITIES+=(-i)
+      IDENTITIES+=("$identity")
+    done
+
+    test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
+
+    mkdir -p "$(dirname "$_truePath")"
+    [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
+    (
+      umask u=r,g=,o=
+      test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
+      test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
+      LANG=${
+        config.i18n.defaultLocale or "C"
+      } ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
+    )
+    chmod ${secretType.mode} "$TMP_FILE"
+    mv -f "$TMP_FILE" "$_truePath"
+
+    ${optionalString secretType.symlink ''
+      [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
+    ''}
+  '';
+
+  testIdentities = map (path: ''
+    test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
+  '') cfg.identityPaths;
+
+  cleanupAndLink = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
+    ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
+
+    (( _agenix_generation > 1 )) && {
+    echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
+    rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
+    }
+  '';
+
+  installSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] decrypting secrets...'" ]
+    ++ testIdentities
+    ++ (map installSecret (builtins.attrValues cfg.secrets))
+    ++ [ cleanupAndLink ]
+  );
+
+  chownSecret = secretType: ''
+    ${setTruePath secretType}
+    chown ${secretType.owner}:${secretType.group} "$_truePath"
+  '';
+
+  chownSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] chowning...'" ]
+    ++ [ chownMountPoint ]
+    ++ (map chownSecret (builtins.attrValues cfg.secrets))
+  );
+
+  secretType = types.submodule (
+    { config, ... }:
+    {
+      options = {
+        name = mkOption {
+          type = types.str;
+          default = config._module.args.name;
+          defaultText = literalExpression "config._module.args.name";
+          description = ''
+            Name of the file used in {option}`age.secretsDir`
+          '';
+        };
+        file = mkOption {
+          type = types.path;
+          description = ''
+            Age file the secret is loaded from.
+          '';
+        };
+        path = mkOption {
+          type = types.str;
+          default = "${cfg.secretsDir}/${config.name}";
+          defaultText = literalExpression ''
+            "''${cfg.secretsDir}/''${config.name}"
+          '';
+          description = ''
+            Path where the decrypted secret is installed.
+          '';
+        };
+        mode = mkOption {
+          type = types.str;
+          default = "0400";
+          description = ''
+            Permissions mode of the decrypted secret in a format understood by chmod.
+          '';
+        };
+        owner = mkOption {
+          type = types.str;
+          default = "0";
+          description = ''
+            User of the decrypted secret.
+          '';
+        };
+        group = mkOption {
+          type = types.str;
+          default = users.${config.owner}.group or "0";
+          defaultText = literalExpression ''
+            users.''${config.owner}.group or "0"
+          '';
+          description = ''
+            Group of the decrypted secret.
+          '';
+        };
+        symlink = mkEnableOption "symlinking secrets to their destination" // {
+          default = true;
+        };
+      };
+    }
+  );
+in
+{
+  imports = [
+    (mkRenamedOptionModule [ "age" "sshKeyPaths" ] [ "age" "identityPaths" ])
+  ];
+
+  options.age = {
+    ageBin = mkOption {
+      type = types.str;
+      default = "${pkgs.age}/bin/age";
+      defaultText = literalExpression ''
+        "''${pkgs.age}/bin/age"
+      '';
+      description = ''
+        The age executable to use.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrsOf secretType;
+      default = { };
+      description = ''
+        Attrset of secrets.
+      '';
+    };
+    secretsDir = mkOption {
+      type = types.path;
+      default = "/run/agenix";
+      description = ''
+        Folder where secrets are symlinked to
+      '';
+    };
+    secretsMountPoint = mkOption {
+      type =
+        types.addCheck types.str (
+          s:
+          (builtins.match "[ \t\n]*" s) == null # non-empty
+          && (builtins.match ".+/" s) == null
+        ) # without trailing slash
+        // {
+          description = "${types.str.description} (with check: non-empty without trailing slash)";
+        };
+      default = "/run/agenix.d";
+      description = ''
+        Where secrets are created before they are symlinked to {option}`age.secretsDir`
+      '';
+    };
+    identityPaths = mkOption {
+      type = types.listOf types.path;
+      default =
+        if isDarwin then
+          [
+            "/etc/ssh/ssh_host_ed25519_key"
+            "/etc/ssh/ssh_host_rsa_key"
+          ]
+        else if (config.services.openssh.enable or false) then
+          map (e: e.path) (
+            lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys
+          )
+        else
+          [ ];
+      defaultText = literalExpression ''
+        if isDarwin
+        then [
+          "/etc/ssh/ssh_host_ed25519_key"
+          "/etc/ssh/ssh_host_rsa_key"
+        ]
+        else if (config.services.openssh.enable or false)
+        then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
+        else [];
+      '';
+      description = ''
+        Path to SSH keys to be used as identities in age decryption.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.secrets != { }) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.identityPaths != [ ];
+          message = "age.identityPaths must be set, for example by enabling openssh.";
+        }
+      ];
+    }
+    (optionalAttrs (!isDarwin) {
+      # When using sysusers we no longer be started as an activation script
+      # because those are started in initrd while sysusers is started later.
+      systemd.services.agenix-install-secrets = mkIf sysusersEnabled {
+        wantedBy = [ "sysinit.target" ];
+        after = [ "systemd-sysusers.service" ];
+        unitConfig.DefaultDependencies = "no";
+
+        path = [ pkgs.mount ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = pkgs.writeShellScript "agenix-install" (concatLines [
+            newGeneration
+            installSecrets
+            chownSecrets
+          ]);
+          RemainAfterExit = true;
+        };
+      };
+
+      # Create a new directory full of secrets for symlinking (this helps
+      # ensure removed secrets are actually removed, or at least become
+      # invalid symlinks).
+      system.activationScripts = mkIf (!sysusersEnabled) {
+        agenixNewGeneration = {
+          text = newGeneration;
+          deps = [
+            "specialfs"
+          ];
+        };
+
+        agenixInstall = {
+          text = installSecrets;
+          deps = [
+            "agenixNewGeneration"
+            "specialfs"
+          ];
+        };
+
+        # So user passwords can be encrypted.
+        users.deps = [ "agenixInstall" ];
+
+        # Change ownership and group after users and groups are made.
+        agenixChown = {
+          text = chownSecrets;
+          deps = [
+            "users"
+            "groups"
+          ];
+        };
+
+        # So other activation scripts can depend on agenix being done.
+        agenix = {
+          text = "";
+          deps = [ "agenixChown" ];
+        };
+      };
+    })
+
+    (optionalAttrs isDarwin {
+      launchd.daemons.activate-agenix = {
+        script = ''
+          set -e
+          set -o pipefail
+          export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          ${newGeneration}
+          ${installSecrets}
+          ${chownSecrets}
+          exit 0
+        '';
+        serviceConfig = {
+          RunAtLoad = true;
+          KeepAlive.SuccessfulExit = false;
+        };
+      };
+    })
+  ]);
+}

m/module/debuginfod.nix

@@ -1,3 +1,10 @@
 {
-  services.nixseparatedebuginfod.enable = true;
+  services.nixseparatedebuginfod2 = {
+    enable = true;
+    substituters = [
+      "local:"
+      "https://cache.nixos.org"
+      "http://hut/cache"
+    ];
+  };
 }

m/module/nfs-home-bind.nix

@@ -0,0 +1,8 @@
+{
+  # Alias nfs home
+  fileSystems."/nfs/home" = {
+    device = "/home";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+}

m/module/slurm-client.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
@@ -21,4 +21,20 @@
   };
 
   services.slurm.client.enable = true;
+
+  # Only allow SSH connections from users who have a SLURM allocation
+  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
+  security.pam.services.sshd.rules.account.slurm = {
+    control = "required";
+    enable = true;
+    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
+    args = [ "log_level=debug5" ];
+    order = 999999; # Make it last one
+  };
+
+  # Disable systemd session (pam_systemd.so) as it will conflict with the
+  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
+  # into the slurmstepd task and then into the systemd session, which is not
+  # what we want, otherwise it will linger even if all jobs are gone.
+  security.pam.services.sshd.startSession = lib.mkForce false;
 }

m/module/slurm-common.nix

@@ -1,31 +1,6 @@
 { config, pkgs, ... }:
 
-let
-  suspendProgram = pkgs.writeShellScript "suspend.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Shutting down host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power off
-    done
-  '';
-
-  resumeProgram = pkgs.writeShellScript "resume.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Starting host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power on
-    done
-  '';
-
-in {
+{
   services.slurm = {
     controlMachine = "apex";
     clusterName = "jungle";
@@ -59,16 +34,6 @@ in {
       # the resources. Use the task/cgroup plugin to enable process containment.
       TaskPlugin=task/affinity,task/cgroup
 
-      # Power off unused nodes until they are requested
-      SuspendProgram=${suspendProgram}
-      SuspendTimeout=60
-      ResumeProgram=${resumeProgram}
-      ResumeTimeout=300
-      SuspendExcNodes=fox
-
-      # Turn the nodes off after 1 hour of inactivity
-      SuspendTime=3600
-
       # Reduce port range so we can allow only this range in the firewall
       SrunPortRange=60000-61000
 
@@ -86,9 +51,7 @@ in {
       # when a task runs (srun) so we can ssh early.
       PrologFlags=Alloc,Contain,X11
 
-      # LaunchParameters=ulimit_pam_adopt will set RLIMIT_RSS in processes
-      # adopted by the external step, similar to tasks running in regular steps
-      # LaunchParameters=ulimit_pam_adopt
+      LaunchParameters=use_interactive_step
       SlurmdDebug=debug5
       #DebugFlags=Protocol,Cgroup
     '';

m/module/tc1-board.nix

@@ -0,0 +1,27 @@
+{ lib, pkgs, ... }:
+
+{
+  # Allow user access to FTDI USB device
+  services.udev.packages = lib.singleton (pkgs.writeTextFile {
+    # Needs to be < 73
+    name = "60-ftdi-tc1.rules";
+    text = ''
+      # Bus 003 Device 003: ID 0403:6011 Future Technology Devices International, Ltd FT4232H Quad HS USB-UART/FIFO IC
+      # Use := to make sure it doesn't get changed later
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6011", MODE:="0666"
+    '';
+    destination = "/etc/udev/rules.d/60-ftdi-tc1.rules";
+  });
+
+  # Allow access to USB for docker in GitLab runner
+  services.gitlab-runner = {
+    services.gitlab-bsc-docker = {
+      registrationFlags = [
+        # We need raw access to the USB port to reboot the board
+        "--docker-devices /dev/bus/usb/003/003"
+        # And TTY access for the serial port
+        "--docker-devices /dev/ttyUSB2"
+      ];
+    };
+  };
+}

m/owl1/configuration.nix

@@ -9,6 +9,7 @@
     ../module/slurm-firewall.nix
     ../module/debuginfod.nix
     ../module/hut-substituter.nix
+    ../module/nfs-home-bind.nix
   ];
 
   # Select the this using the ID to avoid mismatches
@@ -20,7 +21,7 @@
       address = "10.0.40.1";
       prefixLength = 24;
     } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
       address = "10.0.42.1";
       prefixLength = 24;
     } ];

m/owl2/configuration.nix

@@ -9,6 +9,7 @@
     ../module/slurm-firewall.nix
     ../module/debuginfod.nix
     ../module/hut-substituter.nix
+    ../module/nfs-home-bind.nix
   ];
 
   # Select the this using the ID to avoid mismatches
@@ -21,7 +22,7 @@
       prefixLength = 24;
     } ];
     # Watch out! The OmniPath device is not in the same place here:
-    interfaces.ibp129s0.ipv4.addresses = [ {
+    interfaces.ibs801.ipv4.addresses = [ {
       address = "10.0.42.2";
       prefixLength = 24;
     } ];

m/tent/configuration.nix

@@ -16,6 +16,8 @@
     ../module/p.nix
     ../module/vpn-dac.nix
     ../module/hut-substituter.nix
+    ../module/tc1-board.nix
+    ../module/ceph.nix
   ];
 
   # Select the this using the ID to avoid mismatches
@@ -63,6 +65,13 @@
     fsType = "ext4";
   };
 
+  # Mount the NFS home
+  fileSystems."/nfs/home" = {
+    device = "10.106.0.30:/home";
+    fsType = "nfs";
+    options = [ "nfsvers=3" "rsize=1024" "wsize=1024" "cto" "nofail" ];
+  };
+
   # Make a /vault/$USER directory for each user.
   systemd.services.create-vault-dirs = let
     # Take only normal users in tent

m/tent/gitea.nix

@@ -1,4 +1,7 @@
 { config, lib, ... }:
+let
+  cfg = config.services.gitea;
+in
 {
   services.gitea = {
     enable = true;
@@ -26,5 +29,54 @@
         SENDMAIL_ARGS = "--";
       };
     };
+
+    dump = {
+      enable = false; # Do not enable NixOS module, use our custom systemd script below
+      backupDir = "/vault/backup/gitea";
+    };
   };
+
+  systemd.services.gitea-backup = let
+    exe = lib.getExe cfg.package;
+  in {
+    description = "Gitea daily backup";
+    after = [ "gitea.service" ];
+    path = [ cfg.package ];
+
+    environment = {
+      USER = cfg.user;
+      HOME = cfg.stateDir;
+      GITEA_WORK_DIR = cfg.stateDir;
+      GITEA_CUSTOM = cfg.customDir;
+    };
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+      WorkingDirectory = cfg.dump.backupDir;
+    };
+
+    script = ''
+      name="gitea-dump-$(date +%a).${cfg.dump.type}"
+      ${exe} dump --type ${cfg.dump.type} --file - >"$name.tmp"
+      mv "$name.tmp" "$name"
+      cp "$name" "/ceph/backup/gitea/$name"
+    '';
+  };
+
+  # Create also the /ceph directories if needed
+  systemd.tmpfiles.rules = [
+    "d /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
+    "z /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
+  ];
+
+  systemd.timers.gitea-backup = {
+    description = "Update timer for gitea-backup";
+    partOf = [ "gitea-backup.service" ];
+    wantedBy = [ "timers.target" ];
+    timerConfig.OnCalendar = cfg.dump.interval;
+  };
+
+  # Allow gitea user to send mail
+  users.users.gitea.extraGroups = [ "mail-robot" ];
 }

m/tent/gitlab-runner.nix

@@ -43,6 +43,7 @@
         registrationFlags = [
           # Increase build log length to 64 MiB
           "--output-limit 65536"
+          "--docker-network-mode host"
         ];
         preBuildScript = pkgs.writeScript "setup-container" ''
           mkdir -p -m 0755 /nix/var/log/nix/drvs

m/tent/nginx.nix

@@ -4,8 +4,8 @@ let
     name = "jungle-web";
     src = pkgs.fetchgit {
       url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
+      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
     };
     buildInputs = [ pkgs.hugo ];
     buildPhase = ''

m/weasel/configuration.nix

@@ -25,7 +25,7 @@
       address = "10.0.40.6";
       prefixLength = 24;
     } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
       address = "10.0.42.6";
       prefixLength = 24;
     } ];

overlay.nix

@@ -7,6 +7,7 @@ let
   callPackage = final.callPackage;
 
   bscPkgs = {
+    agenix = prev.callPackage ./pkgs/agenix/default.nix { };
     amd-uprof = prev.callPackage ./pkgs/amd-uprof/default.nix { };
     bench6 = callPackage ./pkgs/bench6/default.nix { };
     bigotes = callPackage ./pkgs/bigotes/default.nix { };
@@ -18,7 +19,13 @@ let
     cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
     #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
     gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
-    intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
+    gromacs = callPackage ./pkgs/gromacs/default.nix { enableSYCL = true; };
+    wrapIntel = callPackage ./pkgs/intel-oneapi/common/wrapper.nix { };
+    intel-apt = callPackage ./pkgs/intel-oneapi/deb/packages.nix { };
+    intelPackages_2023 = callPackage ./pkgs/intel-oneapi/deb/2023.nix { };
+    intelPackages_2024 = final.intel-apt.hpckit-2024;
+    intelPackages_2025 = final.intel-apt.hpckit-2025;
+    intelPackages = final.intelPackages_2025;
     jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
     # FIXME: Extend this to all linuxPackages variants. Open problem, see:
     # https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
@@ -28,28 +35,36 @@ let
     linuxPackages_latest = prev.linuxPackages_latest.extend(_final: _prev: {
       amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
     });
+    llvm-intel-unwrapped = callPackage ./pkgs/intel-oneapi/open/default.nix { };
+    llvm-intel = final.wrapIntel { cc = final.llvm-intel-unwrapped; };
     lmbench = callPackage ./pkgs/lmbench/default.nix { };
-    mcxx = callPackage ./pkgs/mcxx/default.nix { };
+    # Broken and unmantained
+    # mcxx = callPackage ./pkgs/mcxx/default.nix { };
     meteocat-exporter = prev.callPackage ./pkgs/meteocat-exporter/default.nix { };
     mpi = final.mpich; # Set MPICH as default
     mpich = callPackage ./pkgs/mpich/default.nix { mpich = prev.mpich; };
     nanos6 = callPackage ./pkgs/nanos6/default.nix { };
     nanos6Debug = final.nanos6.override { enableDebug = true; };
     nixtools = callPackage ./pkgs/nixtools/default.nix { };
-    # Broken because of pkgsStatic.libcap
-    # See: https://github.com/NixOS/nixpkgs/pull/268791
-    #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
+    nixgen = callPackage ./pkgs/nixgen/default.nix { };
+    nix-portable = callPackage ./pkgs/nix-portable/default.nix { };
+    nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
     nodes = callPackage ./pkgs/nodes/default.nix { };
     nosv = callPackage ./pkgs/nosv/default.nix { };
+    oneMath = callPackage ./pkgs/onemath/default.nix { };
     openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
     openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
     osumb = callPackage ./pkgs/osu/default.nix { };
     ovni = callPackage ./pkgs/ovni/default.nix { };
     ovniGit = final.ovni.override { useGit = true; };
+    papi = callPackage ./pkgs/papi/default.nix { papi = prev.papi; };
     paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
+    pocl = callPackage ./pkgs/pocl/default.nix { };
+    pocl-noicd = callPackage ./pkgs/pocl/default.nix { enableICD = false; };
     prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
     #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
     #psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
+    slurm = import ./pkgs/slurm/default.nix { slurm = prev.slurm; };
     sonar = callPackage ./pkgs/sonar/default.nix { };
     stdenvClangOmpss2 = final.stdenv.override { cc = final.clangOmpss2; allowedRequisites = null; };
     stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.clangOmpss2Nanos6; allowedRequisites = null; };
@@ -57,6 +72,8 @@ let
     stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
+    tasycl = callPackage ./pkgs/tasycl/default.nix { };
+    tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
@@ -66,6 +83,13 @@ let
     #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
     hello-c = callPackage ./test/compilers/hello-c.nix { };
     hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
+    hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
+    hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
+    hello-sycl-pocl = (callPackage ./test/compilers/hello-sycl.nix { }).withPocl;
+    hello-sycl-intel = (callPackage ./test/compilers/hello-sycl.nix { }).withIntel;
+    hello-syclompss-pocl = (callPackage ./test/compilers/icpx-ompss2.nix { }).withPocl;
+    hello-syclompss-intel = (callPackage ./test/compilers/icpx-ompss2.nix { }).withIntel;
+
     lto = callPackage ./test/compilers/lto.nix { };
     asan = callPackage ./test/compilers/asan.nix { };
     intel2023-icx-c   = hello-c.override   { stdenv = final.intelPackages_2023.stdenv; };
@@ -75,6 +99,17 @@ let
     intel2023-ifort   = callPackage ./test/compilers/hello-f.nix {
       stdenv = final.intelPackages_2023.stdenv-ifort;
     };
+    intel2024-icx-c   = hello-c.override   { stdenv = final.intelPackages_2024.stdenv; };
+    intel2025-icx-c   = hello-c.override   { stdenv = final.intelPackages_2025.stdenv; };
+    intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
+    intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
+    # intel2023-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
+    intel2024-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2024; };
+    intel2025-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2025; };
+    oneapi-c          = hello-c.override    { inherit (final.llvm-intel) stdenv; };
+    oneapi-cpp        = hello-cpp.override  { inherit (final.llvm-intel) stdenv; };
+    oneapi-sycl       = hello-sycl.override { intelPackages = final.llvm-intel; };
+    oneapi-syclompss  = hello-syclompss.override { intelPackages = final.llvm-intel; };
     clangOmpss2-lto   = lto.override       { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-asan  = asan.override      { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-task  = callPackage ./test/compilers/ompss2.nix {
@@ -92,20 +127,31 @@ let
     clangNosvOmpv-ld = callPackage ./test/compilers/clang-openmp-ld.nix {
       stdenv = final.stdenvClangOmpss2NodesOmpv;
     };
+
+    ocl-build = callPackage ./test/compilers/opencl.nix { };
+    ocl-build-noicd = callPackage ./test/compilers/opencl.nix { ocl-icd = final.pocl-noicd; };
+
+    pocl = callPackage ./test/compilers/pocl.nix { };
+    ocl-run-pocl = ocl-build.test-icd;
+    ocl-run-pocl-noicd = ocl-build-noicd.test-noicd;
+
+    sycl-ls = callPackage ./test/compilers/sycl-ls.nix { };
   };
 
   # For now, only build toplevel packages in CI/Hydra
   pkgsTopLevel = filterAttrs (_: isDerivation) bscPkgs;
 
   # Native build in that platform doesn't imply cross build works
-  canCrossCompile = platform: pkg:
+  canCrossCompile = platform: default: pkg:
     (isDerivation pkg) &&
-    # Must be defined explicitly
-    (pkg.meta.cross or false) &&
-    (meta.availableOn platform pkg);
+    # If meta.cross is undefined, use default
+    (pkg.meta.cross or default) &&
+    (meta.availableOn final.pkgsCross.${platform}.stdenv.hostPlatform pkg);
 
   # For now only RISC-V
-  crossSet = { riscv64 = final.pkgsCross.riscv64.bsc.pkgsTopLevel; };
+  crossSet = genAttrs [ "riscv64" ] (platform:
+    filterAttrs (_: canCrossCompile platform true)
+      final.pkgsCross.${platform}.bsc.pkgsTopLevel);
 
   buildList = name: paths:
     final.runCommandLocal name { } ''
@@ -125,7 +171,7 @@ let
   # For now only RISC-V
   crossList = buildList "ci-cross"
     (filter
-      (canCrossCompile final.pkgsCross.riscv64.stdenv.hostPlatform)
+      (canCrossCompile "riscv64" false) # opt-in (pkgs with: meta.cross = true)
         (builtins.attrValues crossSet.riscv64));
 
 in bscPkgs // {

pkgs/agenix/agenix.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+PACKAGE="agenix"
+
+function show_help () {
+  echo "$PACKAGE - edit and rekey age secret files"
+  echo " "
+  echo "$PACKAGE -e FILE [-i PRIVATE_KEY]"
+  echo "$PACKAGE -r [-i PRIVATE_KEY]"
+  echo ' '
+  echo 'options:'
+  echo '-h, --help                show help'
+  # shellcheck disable=SC2016
+  echo '-e, --edit FILE           edits FILE using $EDITOR'
+  echo '-r, --rekey               re-encrypts all secrets with specified recipients'
+  echo '-d, --decrypt FILE        decrypts FILE to STDOUT'
+  echo '-i, --identity            identity to use when decrypting'
+  echo '-v, --verbose             verbose output'
+  echo ' '
+  echo 'FILE an age-encrypted file'
+  echo ' '
+  echo 'PRIVATE_KEY a path to a private SSH key used to decrypt file'
+  echo ' '
+  echo 'EDITOR environment variable of editor to use when editing FILE'
+  echo ' '
+  echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
+  echo ' '
+  echo 'RULES environment variable with path to Nix file specifying recipient public keys.'
+  echo "Defaults to './secrets.nix'"
+  echo ' '
+  echo "agenix version: @version@"
+  echo "age binary path: @ageBin@"
+  echo "age version: $(@ageBin@ --version)"
+}
+
+function warn() {
+  printf '%s\n' "$*" >&2
+}
+
+function err() {
+  warn "$*"
+  exit 1
+}
+
+test $# -eq 0 && (show_help && exit 1)
+
+REKEY=0
+DECRYPT_ONLY=0
+DEFAULT_DECRYPT=(--decrypt)
+
+while test $# -gt 0; do
+  case "$1" in
+    -h|--help)
+      show_help
+      exit 0
+      ;;
+    -e|--edit)
+      shift
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -i|--identity)
+      shift
+      if test $# -gt 0; then
+        DEFAULT_DECRYPT+=(--identity "$1")
+      else
+        echo "no PRIVATE_KEY specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -r|--rekey)
+      shift
+      REKEY=1
+      ;;
+    -d|--decrypt)
+      shift
+      DECRYPT_ONLY=1
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -v|--verbose)
+      shift
+      set -x
+      ;;
+    *)
+      show_help
+      exit 1
+      ;;
+  esac
+done
+
+RULES=${RULES:-./secrets.nix}
+function cleanup {
+    if [ -n "${CLEARTEXT_DIR+x}" ]
+    then
+        rm -rf -- "$CLEARTEXT_DIR"
+    fi
+    if [ -n "${REENCRYPTED_DIR+x}" ]
+    then
+        rm -rf -- "$REENCRYPTED_DIR"
+    fi
+}
+trap "cleanup" 0 2 3 15
+
+function keys {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in rules.\"$1\".publicKeys)" | @jqBin@ -r .[]) || exit 1
+}
+
+function armor {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in (builtins.hasAttr \"armor\" rules.\"$1\" && rules.\"$1\".armor))") || exit 1
+}
+
+function decrypt {
+    FILE=$1
+    KEYS=$2
+    if [ -z "$KEYS" ]
+    then
+        err "There is no rule for $FILE in $RULES."
+    fi
+
+    if [ -f "$FILE" ]
+    then
+        DECRYPT=("${DEFAULT_DECRYPT[@]}")
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+            if [ -f "$HOME/.ssh/id_rsa" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_rsa")
+            fi
+            if [ -f "$HOME/.ssh/id_ed25519" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_ed25519")
+            fi
+        fi
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+          err "No identity found to decrypt $FILE. Try adding an SSH key at $HOME/.ssh/id_rsa or $HOME/.ssh/id_ed25519 or using the --identity flag to specify a file."
+        fi
+
+        @ageBin@ "${DECRYPT[@]}" -- "$FILE" || exit 1
+    fi
+}
+
+function edit {
+    FILE=$1
+    KEYS=$(keys "$FILE") || exit 1
+    ARMOR=$(armor "$FILE") || exit 1
+
+    CLEARTEXT_DIR=$(@mktempBin@ -d)
+    CLEARTEXT_FILE="$CLEARTEXT_DIR/$(basename -- "$FILE")"
+    DEFAULT_DECRYPT+=(-o "$CLEARTEXT_FILE")
+
+    decrypt "$FILE" "$KEYS" || exit 1
+
+    [ ! -f "$CLEARTEXT_FILE" ] || cp -- "$CLEARTEXT_FILE" "$CLEARTEXT_FILE.before"
+
+    [ -t 0 ] || EDITOR='cp -- /dev/stdin'
+
+    $EDITOR "$CLEARTEXT_FILE"
+
+    if [ ! -f "$CLEARTEXT_FILE" ]
+    then
+      warn "$FILE wasn't created."
+      return
+    fi
+    [ -f "$FILE" ] && [ "$EDITOR" != ":" ] && @diffBin@ -q -- "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return
+
+    ENCRYPT=()
+    if [[ "$ARMOR" == "true" ]]; then
+        ENCRYPT+=(--armor)
+    fi
+    while IFS= read -r key
+    do
+        if [ -n "$key" ]; then
+            ENCRYPT+=(--recipient "$key")
+        fi
+    done <<< "$KEYS"
+
+    REENCRYPTED_DIR=$(@mktempBin@ -d)
+    REENCRYPTED_FILE="$REENCRYPTED_DIR/$(basename -- "$FILE")"
+
+    ENCRYPT+=(-o "$REENCRYPTED_FILE")
+
+    @ageBin@ "${ENCRYPT[@]}" <"$CLEARTEXT_FILE" || exit 1
+
+    mkdir -p -- "$(dirname -- "$FILE")"
+
+    mv -f -- "$REENCRYPTED_FILE" "$FILE"
+}
+
+function rekey {
+    FILES=$( (@nixInstantiate@ --json --eval -E "(let rules = import $RULES; in builtins.attrNames rules)"  | @jqBin@ -r .[]) || exit 1)
+
+    for FILE in $FILES
+    do
+        warn "rekeying $FILE..."
+        EDITOR=: edit "$FILE"
+        cleanup
+    done
+}
+
+[ $REKEY -eq 1 ] && rekey && exit 0
+[ $DECRYPT_ONLY -eq 1 ] && DEFAULT_DECRYPT+=("-o" "-") && decrypt "${FILE}" "$(keys "$FILE")" && exit 0
+edit "$FILE" && cleanup && exit 0

pkgs/agenix/default.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  age,
+  jq,
+  nix,
+  mktemp,
+  diffutils,
+  replaceVars,
+  ageBin ? "${age}/bin/age",
+  shellcheck,
+}:
+let
+  bin = "${placeholder "out"}/bin/agenix";
+in
+stdenv.mkDerivation rec {
+  pname = "agenix";
+  version = "0.15.0";
+  src = replaceVars ./agenix.sh {
+    inherit ageBin version;
+    jqBin = "${jq}/bin/jq";
+    nixInstantiate = "${nix}/bin/nix-instantiate";
+    mktempBin = "${mktemp}/bin/mktemp";
+    diffBin = "${diffutils}/bin/diff";
+  };
+  dontUnpack = true;
+  doInstallCheck = true;
+  installCheckInputs = [ shellcheck ];
+  postInstallCheck = ''
+    shellcheck ${bin}
+    ${bin} -h | grep ${version}
+
+    test_tmp=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
+    export HOME="$test_tmp/home"
+    export NIX_STORE_DIR="$test_tmp/nix/store"
+    export NIX_STATE_DIR="$test_tmp/nix/var"
+    mkdir -p "$HOME" "$NIX_STORE_DIR" "$NIX_STATE_DIR"
+    function cleanup {
+      rm -rf "$test_tmp"
+    }
+    trap "cleanup" 0 2 3 15
+
+    mkdir -p $HOME/.ssh
+    cp -r "${./example}" $HOME/secrets
+    chmod -R u+rw $HOME/secrets
+    (
+    umask u=rw,g=r,o=r
+    cp ${./example_keys/user1.pub} $HOME/.ssh/id_ed25519.pub
+    chown $UID $HOME/.ssh/id_ed25519.pub
+    )
+    (
+    umask u=rw,g=,o=
+    cp ${./example_keys/user1} $HOME/.ssh/id_ed25519
+    chown $UID $HOME/.ssh/id_ed25519
+    )
+
+    cd $HOME/secrets
+    test $(${bin} -d secret1.age) = "hello"
+  '';
+
+  installPhase = ''
+    install -D $src ${bin}
+  '';
+
+  meta.description = "age-encrypted secrets for NixOS";
+}

pkgs/agenix/example/-leading-hyphen-filename.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA zirqdzZZ1E+sedBn7fbEHq4ntLEkokZ4GctarBBOHXY
+Rvs5YHaAUeCZyNwPedubPcHClWYIuXXWA5zadXPWY6w
+-> ssh-ed25519 KLPP8w BVp4rDkOYSQyn8oVeHFeinSqW+pdVtxBF9+5VM1yORY
+bMwppAi8Nhz0328taU4AzUkTVyWtSLvFZG6c5W/Fs78
+--- xCbqLhXAcOziO2wmbjTiSQfZvt5Rlsc4SCvF+iEzpQA
+<EFBFBD>KB<EFBFBD><EFBFBD>/<2F>Z<><5A>r<EFBFBD>%
<01><>4<EFBFBD><34><EFBFBD>Mq5<71><35>_<EFBFBD><5F>ݒ<><DD92><EFBFBD><EFBFBD><EFBFBD>11ܨqM;& <20><>Lr<4C><72><EFBFBD>f<EFBFBD><66><EFBFBD>]>N

pkgs/agenix/example/armored-secret.age

@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFYzWG1FQSBpZkZW
+aFpLNnJxc0VUMHRmZ2dZS0pjMGVENnR3OHd5K0RiT1RjRUhibFZBCnN5UG5vUjA3
+SXpsNGtiVUw4T0tIVFo5Wkk5QS9NQlBndzVvektiQ0ozc0kKLS0tIGxyY1Q4dEZ1
+VGZEanJyTFNta2JNRmpZb2FnK2JyS1hSVml1UGdMNWZKQXMKYla+wTXcRedyZoEb
+LVWaSx49WoUTU0KBPJg9RArxaeC23GoCDzR/aM/1DvYU
+-----END AGE ENCRYPTED FILE-----

pkgs/agenix/example/passwordfile-user1.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 KLPP8w s1DYZRlZuSsyhmZCF1lFB+E9vB8bZ/+ZhBRlx8nprwE
+nmYVCsVBrX2CFXXPU+D+bbkkIe/foofp+xoUrg9DHZw
+-> ssh-ed25519 V3XmEA Pwv3oCwcY0DX8rY48UNfsj9RumWsn4dbgorYHCwObgI
+FKxRYkL3JHtJxUwymWDF0rAtJ33BivDI6IfPsfumM90
+-> V'v(/u$-grease em/Vgf 2qDuk
+7I3iiQLPGi1COML9u/JeYkr7EqbSLoU
+--- 57WJRigUGtmcObrssS3s4PvmR8wgh1AOC/ijJn1s3xI
+<EFBFBD>'K<>ƷY&<26>7G<37>O<EFBFBD><4F>Fj
<13>k<EFBFBD>X<EFBFBD><58>BnuJ<75><4A>:9<>(<><7F><EFBFBD>X<EFBFBD>#<23>A<EFBFBD><41><EFBFBD><EFBFBD>ڧj<DAA7>,<02>_<17><><EFBFBD>?<3F>Z<EFBFBD><17>v<EFBFBD><76>V<EFBFBD>96]oks~%<25>c	<04>e^C<>%JQ5<51><H<>z}<7D>C<EFBFBD>,<2C>p<EFBFBD><70>*!W<><57><EFBFBD>A<EFBFBD><41><EFBFBD>҅dC<15>K)<10><>-<2D>y

pkgs/agenix/example/secret2.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA OB4+1FbPhQ3r6iGksM7peWX5it8NClpXIq/o5nnP7GA
+FmHVUj+A5i5+bDFgySQskmlvynnosJiWUTJmBRiNA9I
+--- tP+3mFVtd7ogVu1Lkboh55zoi5a77Ht08Uc/QuIviv4
+<EFBFBD><EFBFBD>X<EFBFBD>{<7B><>O<EFBFBD><4F><1F><04>tMXx<58>vӪ(<28>I<EFBFBD>myP<79><50><EFBFBD><EFBFBD>+3<>S3i

pkgs/agenix/example/secrets.nix

@@ -0,0 +1,23 @@
+let
+  user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
+  system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
+in
+{
+  "secret1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "secret2.age".publicKeys = [ user1 ];
+  "passwordfile-user1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "-leading-hyphen-filename.age".publicKeys = [
+    user1
+    system1
+  ];
+  "armored-secret.age" = {
+    publicKeys = [ user1 ];
+    armor = true;
+  };
+}

pkgs/agenix/example_keys/system1

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxAAAAJA3yvCWN8rw
+lgAAAAtzc2gtZWQyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxA
+AAAEA+J2V6AG1NriAIvnNKRauIEh1JE9HSdhvKJ68a5Fm0w/JDyIr/FSz1cJdcoW69R+Nr
+WzwGK/+3gJpqD1t8L2zEAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----

pkgs/agenix/example_keys/system1.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE

pkgs/agenix/example_keys/user1

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRwAAAJC2JJ8htiSf
+IQAAAAtzc2gtZWQyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRw
+AAAEDxt5gC/s53IxiKAjfZJVCCcFIsdeERdIgbYhLO719+Kb0idNvgGiucWgup/mP78zyC
+23uFjYq0evcWdjGQUaBHAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----

pkgs/agenix/example_keys/user1.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH

pkgs/agenix/update.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+# All operations are done relative to root
+GITROOT=$(git rev-parse --show-toplevel)
+cd "$GITROOT"
+
+REVISION=${1:-main}
+
+TMPCLONE=$(mktemp -d)
+trap "rm -rf ${TMPCLONE}" EXIT
+
+git clone https://github.com/ryantm/agenix.git --revision="$REVISION" "$TMPCLONE" --depth=1
+
+cp "${TMPCLONE}/pkgs/agenix.sh" pkgs/agenix/agenix.sh
+cp "${TMPCLONE}/pkgs/agenix.nix" pkgs/agenix/default.nix
+sed -i 's#../example#./example#' pkgs/agenix/default.nix
+
+cp "${TMPCLONE}/example/"* pkgs/agenix/example/
+cp "${TMPCLONE}/example_keys/"* pkgs/agenix/example_keys/
+
+cp "${TMPCLONE}/modules/age.nix" m/module/agenix.nix

pkgs/amd-uprof/default.nix

@@ -1,8 +1,6 @@
 { stdenv
 , lib
-, curl
-, cacert
-, runCommandLocal
+, fetchurl
 , autoPatchelfHook
 , elfutils
 , glib
@@ -26,27 +24,24 @@ let
   tarball = "AMDuProf_Linux_x64_${version}.tar.bz2";
 
   # NOTE: Remember to update the radare2 patch below if AMDuProfPcm changes.
-  uprofSrc = runCommandLocal tarball {
-    nativeBuildInputs = [ curl ];
-    outputHash = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
-    SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt";
-  } ''
-    curl \
-    -o $out \
-    'https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}' \
-    -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0' \
-    -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-    -H 'Accept-Language: en-US,en;q=0.5' \
-    -H 'Accept-Encoding: gzip, deflate, br, zstd' \
-    -H 'Referer: https://www.amd.com/' 2>&1 | tr '\r' '\n'
-  '';
+  src = fetchurl {
+    url = "https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}";
+    sha256 = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
+    curlOptsList = [
+      "-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
+      "-H" "'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'"
+      "-H" "Accept-Language: en-US,en;q=0.5"
+      "-H" "Accept-Encoding: gzip, deflate, br, zstd"
+      "-H" "Referer: https://www.amd.com/"
+    ];
+  };
 
 in
   stdenv.mkDerivation {
     pname = "AMD-uProf";
-    inherit version;
-    src = uprofSrc;
+    inherit src version;
     dontStrip = true;
+    strictDeps = true;
     phases = [ "installPhase" "fixupPhase" ];
     nativeBuildInputs = [ autoPatchelfHook radare2 ];
     buildInputs = [
@@ -90,7 +85,7 @@ in
     meta = {
       description = "Performance analysis tool-suite for x86 based applications";
       homepage = "https://www.amd.com/es/developer/uprof.html";
-      platforms = lib.platforms.linux;
+      platforms = [ "x86_64-linux" ];
       license = lib.licenses.unfree;
       maintainers = with lib.maintainers.bsc; [ rarias varcila ];
     };

pkgs/amd-uprof/driver.nix

@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
     set +x
   '';
   hardeningDisable = [ "pic" "format" ];
+  strictDeps = true;
   nativeBuildInputs = kernel.moduleBuildDependencies;
-  patches = [ ./makefile.patch ./hrtimer.patch ];
+  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
   makeFlags = [
     "KERNEL_VERSION=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"

pkgs/amd-uprof/remove-wr-rdmsrq.patch

@@ -0,0 +1,20 @@
+diff --git a/inc/PwrProfAsm.h b/inc/PwrProfAsm.h
+index d77770a..c93a0e9 100644
+--- a/inc/PwrProfAsm.h
++++ b/inc/PwrProfAsm.h
+@@ -347,6 +347,7 @@
+ 
+ #endif
+ 
++/*
+ #define rdmsrq(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \
+                               "rdmsr\n" \
+@@ -362,6 +363,7 @@
+                               :"c"(msr), "a"(val1), "d"(val2), "S"(val3), "D"(val4) \
+                             ); \
+     })
++*/
+ 
+ #define rdmsrpw(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \

pkgs/babeltrace/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchurl, pkg-config, glib, libuuid, popt, elfutils, swig4, python3 }:
+
+stdenv.mkDerivation rec {
+  name = "babeltrace-1.5.8";
+
+  src = fetchurl {
+    url = "https://www.efficios.com/files/babeltrace/${name}.tar.bz2";
+    sha256 = "1hkg3phnamxfrhwzmiiirbhdgckzfkqwhajl0lmr1wfps7j47wcz";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib libuuid popt elfutils swig4 python3 ];
+
+  meta = with lib; {
+    description = "Command-line tool and library to read and convert LTTng tracefiles";
+    homepage = "https://www.efficios.com/babeltrace";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bjornfor ];
+  };
+
+  configureFlags = [
+    "--enable-python-bindings"
+  ];
+}

pkgs/babeltrace2/default.nix

@@ -0,0 +1,34 @@
+{
+  stdenv
+, fetchurl
+, pkg-config
+, glib
+, libuuid
+, popt
+, elfutils
+, python3
+, swig4
+, ncurses
+, breakpointHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "babeltrace2";
+  version = "2.0.3";
+
+  src = fetchurl {
+    url = "https://www.efficios.com/files/babeltrace/${pname}-${version}.tar.bz2";
+    sha256 = "1804pyq7fz6rkcz4r1abkkn0pfnss13m6fd8if32s42l4lajadm5";
+  };
+
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib libuuid popt elfutils python3 swig4 ncurses breakpointHook ];
+  hardeningDisable = [ "all" ];
+
+  configureFlags = [
+    "--enable-python-plugins"
+    "--enable-python-bindings"
+  ];
+
+}

pkgs/bench6/default.nix

@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
   ];
   hardeningDisable = [ "all" ];
   dontStrip = true;
+  strictDeps = true;
 
   meta = {
     homepage = "https://gitlab.pm.bsc.es/rarias/bench6";

pkgs/bigotes/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation {
   };
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   meta = {
     homepage = "https://github.com/rodarima/bigotes";
     description = "Versatile benchmark tool";

pkgs/clsync/default.nix

@@ -0,0 +1,54 @@
+{ stdenv
+, fetchFromGitHub
+, libcap
+, libcgroup
+, libmhash
+, doxygen
+, graphviz
+, autoreconfHook
+, pkg-config
+, glib
+}:
+
+let
+  version = "0.4.4";
+
+in stdenv.mkDerivation {
+  pname = "clsync";
+  inherit version;
+
+  src = fetchFromGitHub {
+    repo = "clsync";
+    owner = "clsync";
+    rev = "v${version}";
+    sha256 = "0sdiyfwp0iqr6l1sirm51pirzmhi4jzgky5pzfj24nn71q3fwqgz";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  buildInputs = [
+    autoreconfHook
+    libcap
+    libcgroup
+    libmhash
+    doxygen
+    graphviz
+    pkg-config
+    glib
+  ];
+
+  preConfigure = ''
+    ./configure --help
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "File live sync daemon based on inotify/kqueue/bsm (Linux, FreeBSD), written in GNU C";
+    homepage = "https://github.com/clsync/clsync";
+    license = licenses.gpl3Plus;
+    maintainers = [ ];
+    platforms = platforms.linux;
+  };
+}
+

pkgs/cn6/default.nix

@@ -0,0 +1,51 @@
+{
+  stdenv
+, lib
+, babeltrace2
+, pkg-config
+, uthash
+, enableTest ? false
+, mpi ? null
+, clangOmpss2 ? null
+, tampi ? null
+}:
+
+with lib;
+
+assert (enableTest -> (mpi != null));
+assert (enableTest -> (clangOmpss2 != null));
+assert (enableTest -> (tampi != null));
+
+stdenv.mkDerivation rec {
+  pname = "cn6";
+  version = "${src.shortRev}";
+
+  buildInputs = [
+    babeltrace2
+    pkg-config
+    uthash
+    mpi
+  ] ++ optionals (enableTest) [ mpi clangOmpss2 tampi ];
+
+  src = builtins.fetchGit {
+    url = "ssh://git@bscpm04.bsc.es/rarias/cn6.git";
+    ref = "master";
+    rev = "c72c3b66b720c2a33950f536fc819051c8f20a69";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postBuild = optionalString (enableTest) ''
+    (
+      cd test
+      make timediff timediff_mpi
+    )
+  '';
+
+  postInstall = optionalString (enableTest) ''
+    (
+      cd test
+      cp timediff timediff_mpi sync-err.sh $out/bin/
+    )
+  '';
+}

pkgs/cpuid/default.nix

@@ -0,0 +1,21 @@
+{
+  stdenv
+, perl # For the pod2man command
+}:
+
+stdenv.mkDerivation rec {
+  version = "20201006";
+  pname = "cpuid";
+
+  buildInputs = [ perl ];
+
+  # Replace /usr install directory for $out
+  postPatch = ''
+    sed -i "s@/usr@$out@g" Makefile
+  '';
+
+  src = builtins.fetchTarball {
+    url = "http://www.etallen.com/cpuid/${pname}-${version}.src.tar.gz";
+    sha256 = "04qhs938gs1kjxpsrnfy6lbsircsprfyh4db62s5cf83a1nrwn9w";
+  };
+}

pkgs/cudainfo/default.nix

@@ -1,5 +1,6 @@
 {
   stdenv
+, lib
 , cudatoolkit
 , cudaPackages
 , autoAddDriverRunpath
@@ -9,11 +10,14 @@
 stdenv.mkDerivation (finalAttrs: {
   name = "cudainfo";
   src = ./.;
-  buildInputs = [
+  strictDeps = true;
+  nativeBuildInputs = [
     cudatoolkit # Required for nvcc
-    cudaPackages.cuda_cudart.static # Required for -lcudart_static
     autoAddDriverRunpath
   ];
+  buildInputs = [
+    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+  ];
   installPhase = ''
     mkdir -p $out/bin
     cp -a cudainfo $out/bin
@@ -22,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "cudainfo-test";
     requiredSystemFeatures = [ "cuda" ];
     dontBuild = true;
+    strictDeps = true;
     nativeCheckInputs = [
       finalAttrs.finalPackage # The cudainfo package from above
       strace # When it fails, it will show the trace
@@ -40,4 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     installPhase = "touch $out";
   };
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+  };
 })

pkgs/dummy/default.nix

@@ -0,0 +1,25 @@
+{
+  stdenv
+}:
+
+stdenv.mkDerivation rec {
+  name = "dummy";
+
+  src = null;
+  dontUnpack = true;
+  dontBuild = true;
+
+  programPath = "/bin/dummy";
+
+  installPhase = ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/dummy <<EOF
+    #!/bin/sh
+    echo Hello worlda!
+
+    EOF
+
+    chmod +x $out/bin/dummy
+  '';
+}

pkgs/extrae/default.nix

@@ -20,7 +20,7 @@
 #, python3Packages
 , installShellFiles
 , symlinkJoin
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 }:
 
 let

pkgs/fftw/default.nix

@@ -0,0 +1,58 @@
+{ fetchurl, stdenv, lib, llvmPackages ? null, precision ? "double", perl, mpi }:
+
+with lib;
+
+assert stdenv.cc.isClang -> llvmPackages != null;
+assert elem precision [ "single" "double" "long-double" "quad-precision" ];
+
+let
+  version = "3.3.8";
+  withDoc = stdenv.cc.isGNU;
+in
+
+stdenv.mkDerivation {
+  name = "fftw-${precision}-${version}";
+
+  src = fetchurl {
+    urls = [
+      "http://fftw.org/fftw-${version}.tar.gz"
+      "ftp://ftp.fftw.org/pub/fftw/fftw-${version}.tar.gz"
+    ];
+    sha256 = "00z3k8fq561wq2khssqg0kallk0504dzlx989x3vvicjdqpjc4v1";
+  };
+
+  outputs = [ "out" "dev" "man" ]
+    ++ optional withDoc "info"; # it's dev-doc only
+  outputBin = "dev"; # fftw-wisdom
+
+  buildInputs = [ mpi ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # TODO: This may mismatch the LLVM version sin the stdenv, see #79818.
+    llvmPackages.openmp
+  ];
+
+  configureFlags =
+    [ "--enable-shared"
+      "--enable-threads"
+      "--enable-mpi"
+      "--disable-openmp"
+    ]
+    ++ optional (precision != "double") "--enable-${precision}"
+    # all x86_64 have sse2
+    # however, not all float sizes fit
+    ++ optional (stdenv.isx86_64 && (precision == "single" || precision == "double") )  "--enable-sse2"
+    # doc generation causes Fortran wrapper generation which hard-codes gcc
+    ++ optional (!withDoc) "--disable-doc";
+
+  enableParallelBuilding = true;
+
+  checkInputs = [ perl ];
+
+  meta = with lib; {
+    description = "Fastest Fourier Transform in the West library";
+    homepage = "http://www.fftw.org/";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.spwhitt ];
+    platforms = platforms.unix;
+  };
+}

pkgs/gpi-2/default.nix

@@ -9,7 +9,6 @@
 , automake
 , libtool
 , mpi
-, rsync
 , gfortran
 }:
 
@@ -34,6 +33,7 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   patches = [ ./rdma-core.patch ./max-mem.patch ];
 
@@ -44,13 +44,24 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-infiniband=${rdma-core-all}"
-    "--with-mpi=${mpiAll}"
+    "--with-mpi=yes" # fixes mpi detection when cross-compiling
     "--with-slurm"
     "CFLAGS=-fPIC"
     "CXXFLAGS=-fPIC"
   ];
 
-  buildInputs = [ slurm mpiAll rdma-core-all autoconf automake libtool rsync gfortran ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    gfortran
+    libtool
+  ];
+
+  buildInputs = [
+    slurm
+    mpiAll
+    rdma-core-all
+  ];
 
   hardeningDisable = [ "all" ];
 
@@ -60,5 +71,6 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers.bsc; [ rarias ];
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3Plus;
+    cross = false; # infiniband detection does not work
   };
 }

pkgs/groff/0001-Fix-cross-compilation-by-looking-for-ar.patch

@@ -0,0 +1,46 @@
+From 1454525f70b43a6957b7c9e1870e997368787da3 Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Fri, 8 Nov 2019 21:59:21 -0500
+Subject: [PATCH] Fix cross-compilation by looking for `ar`.
+
+---
+ Makefile.am  | 2 +-
+ configure.ac | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index d18c49b8..b1b53338 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -494,7 +494,7 @@ CCC=@CXX@
+ # INSTALL_INFO
+ # LN_S
+ 
+-AR=ar
++AR=@AR@
+ ETAGS=etags
+ ETAGSFLAGS=
+ # Flag that tells etags to assume C++.
+diff --git a/configure.ac b/configure.ac
+index 28e75f17..2449b9f5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -37,6 +37,7 @@ AC_CONFIG_AUX_DIR([build-aux])
+ 
+ AC_CONFIG_HEADERS([src/include/config.h:src/include/config.hin])
+ AC_CONFIG_SRCDIR([src/roff/groff/groff.cpp])
++AC_CONFIG_MACRO_DIR([m4])
+ 
+ AC_USE_SYSTEM_EXTENSIONS
+ 
+@@ -72,6 +73,7 @@ GROFF_DOC_CHECK
+ GROFF_MAKEINFO
+ GROFF_TEXI2DVI
+ AC_PROG_RANLIB
++AC_CHECK_TOOL([AR], [ar], [ar])
+ GROFF_INSTALL_SH
+ GROFF_INSTALL_INFO
+ AC_PROG_INSTALL
+-- 
+2.23.0
+

pkgs/groff/default.nix

@@ -0,0 +1,127 @@
+{ stdenv, lib, fetchurl, perl
+, ghostscript #for postscript and html output
+, psutils, netpbm #for html output
+, buildPackages
+, autoreconfHook
+, pkg-config
+, texinfo
+}:
+
+stdenv.mkDerivation rec {
+  pname = "groff";
+  version = "1.22.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/groff/${pname}-${version}.tar.gz";
+    sha256 = "14q2mldnr1vx0l9lqp9v2f6iww24gj28iyh4j2211hyynx67p3p7";
+  };
+
+  enableParallelBuilding = false;
+
+  patches = [
+    ./0001-Fix-cross-compilation-by-looking-for-ar.patch
+  ];
+
+  postPatch = lib.optionalString (psutils != null) ''
+    substituteInPlace src/preproc/html/pre-html.cpp \
+      --replace "psselect" "${psutils}/bin/psselect"
+  '' + lib.optionalString (netpbm != null) ''
+    substituteInPlace src/preproc/html/pre-html.cpp \
+      --replace "pnmcut" "${lib.getBin netpbm}/bin/pnmcut" \
+      --replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
+      --replace "pnmtopng" "${lib.getBin netpbm}/bin/pnmtopng"
+    substituteInPlace tmac/www.tmac.in \
+      --replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
+      --replace "pngtopnm" "${lib.getBin netpbm}/bin/pngtopnm" \
+      --replace "@PNMTOPS_NOSETPAGE@" "${lib.getBin netpbm}/bin/pnmtops -nosetpage"
+  '';
+
+  buildInputs = [ ghostscript psutils netpbm perl ];
+  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+
+  # Builds running without a chroot environment may detect the presence
+  # of /usr/X11 in the host system, leading to an impure build of the
+  # package. To avoid this issue, X11 support is explicitly disabled.
+  # Note: If we ever want to *enable* X11 support, then we'll probably
+  # have to pass "--with-appresdir", too.
+  configureFlags = [
+    "--without-x"
+  ] ++ lib.optionals (ghostscript != null) [
+    "--with-gs=${ghostscript}/bin/gs"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
+  ];
+
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    # Trick to get the build system find the proper 'native' groff
+    # http://www.mail-archive.com/bug-groff@gnu.org/msg01335.html
+    "GROFF_BIN_PATH=${buildPackages.groff}/bin"
+    "GROFFBIN=${buildPackages.groff}/bin/groff"
+  ];
+
+  doCheck = true;
+
+  postInstall = ''
+    for f in 'man.local' 'mdoc.local'; do
+        cat '${./site.tmac}' >>"$out/share/groff/site-tmac/$f"
+    done
+
+    moveToOutput bin/gropdf $out
+    moveToOutput bin/pdfmom $out
+    moveToOutput bin/roff2text $out
+    moveToOutput bin/roff2pdf $out
+    moveToOutput bin/roff2ps $out
+    moveToOutput bin/roff2dvi $out
+    moveToOutput bin/roff2ps $out
+    moveToOutput bin/roff2html $out
+    moveToOutput bin/glilypond $out
+    moveToOutput bin/mmroff $out
+    moveToOutput bin/roff2x $out
+    moveToOutput bin/afmtodit $out
+    moveToOutput bin/gperl $out
+    moveToOutput bin/chem $out
+    moveToOutput share/groff/${version}/font/devpdf $out
+
+    # idk if this is needed, but Fedora does it
+    moveToOutput share/groff/${version}/tmac/pdf.tmac $out
+
+    moveToOutput bin/gpinyin $out
+    moveToOutput lib/groff/gpinyin $out
+    substituteInPlace $out/bin/gpinyin \
+      --replace $out/lib/groff/gpinyin $out/lib/groff/gpinyin
+
+    moveToOutput bin/groffer $out
+    moveToOutput lib/groff/groffer $out
+    substituteInPlace $out/bin/groffer \
+      --replace $out/lib/groff/groffer $out/lib/groff/groffer
+
+    moveToOutput bin/grog $out
+    moveToOutput lib/groff/grog $out
+    substituteInPlace $out/bin/grog \
+      --replace $out/lib/groff/grog $out/lib/groff/grog
+
+  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    find $out/ -type f -print0 | xargs --null sed -i 's|${buildPackages.perl}|${perl}|'
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/groff/";
+    description = "GNU Troff, a typesetting package that reads plain text and produces formatted output";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ pSub ];
+
+    longDescription = ''
+      groff is the GNU implementation of troff, a document formatting
+      system.  Included in this release are implementations of troff,
+      pic, eqn, tbl, grn, refer, -man, -mdoc, -mom, and -ms macros,
+      and drivers for PostScript, TeX dvi format, HP LaserJet 4
+      printers, Canon CAPSL printers, HTML and XHTML format (beta
+      status), and typewriter-like devices.  Also included is a
+      modified version of the Berkeley -me macros, the enhanced
+      version gxditview of the X11 xditview previewer, and an
+      implementation of the -mm macros.
+    '';
+
+  };
+}

pkgs/groff/site.tmac

@@ -0,0 +1,16 @@
+.
+.if n \{\
+.  \" Character translations for non-keyboard
+.  \" characters - to make them searchable
+.  if '\*[.T]'utf8' \{\
+.    char \- \N'45'
+.    char - \N'45'
+.    char ' \N'39'
+.    char \' \N'39'
+.  \}
+.
+.  \" Shut off SGR by default (groff colors)
+.  \" Require GROFF_SGR envvar defined to turn it on
+.  if '\V[GROFF_SGR]'' \
+.    output x X tty: sgr 0
+.\}

pkgs/gromacs/default.nix

@@ -0,0 +1,191 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  hwloc,
+  fftw,
+  perl,
+  blas,
+  lapack,
+  llvmPackages,
+  intelPackages ? null,
+  mpi,
+  cudaPackages,
+  plumed,
+  singlePrec ? true,
+  config,
+  enableSYCL ? false,
+  enableCuda ? config.cudaSupport,
+  enableMpi ? false,
+  enablePlumed ? false,
+  cpuAcceleration ? null,
+}:
+
+# CUDA is only implemented for single precission
+assert enableCuda -> singlePrec;
+
+assert !(enableSYCL && enableCuda);
+
+assert enableSYCL -> intelPackages != null;
+
+let
+  inherit (cudaPackages.flags) cmakeCudaArchitecturesString;
+
+  # Select reasonable defaults for all major platforms
+  # The possible values are defined in CMakeLists.txt:
+  # AUTO None SSE2 SSE4.1 AVX_128_FMA AVX_256 AVX2_256
+  # AVX2_128 AVX_512 AVX_512_KNL MIC ARM_NEON ARM_NEON_ASIMD
+  SIMD =
+    x:
+    if (cpuAcceleration != null) then
+      x
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      "SSE2"
+    else if stdenv.hostPlatform.system == "x86_64-linux" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "x86_64-darwin" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then
+      "ARM_NEON_ASIMD"
+    else
+      "None";
+
+  source =
+    if enablePlumed then
+      {
+        version = "2024.2";
+        hash = "sha256-gCp+M18uiVdw9XsVnk7DaOuw/yzm2sz3BsboAlw2hSs=";
+      }
+    else
+      {
+        version = "2025.3";
+        hash = "sha256-i9/KAmjz8Qp8o8BuWbYvc+oCQgxnIRwP85EvMteDPGU=";
+      };
+
+  stdenv' = if enableSYCL then intelPackages.stdenv else stdenv;
+
+in
+stdenv'.mkDerivation rec {
+  pname = "gromacs";
+  version = source.version;
+
+  src = fetchurl {
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
+    inherit (source) hash;
+  };
+
+  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
+
+  postPatch = lib.optionalString enablePlumed ''
+    plumed patch -p -e gromacs-${source.version}
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ]
+  ++ lib.optional enablePlumed plumed
+  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
+
+  env.MKLROOT = intelPackages.mkl;
+
+  buildInputs = [
+    fftw
+    perl
+    hwloc
+    blas
+    lapack
+  ]
+  ++ lib.optional enableMpi mpi
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_cccl
+    cudaPackages.cuda_cudart
+    cudaPackages.libcufft
+    cudaPackages.cuda_profiler_api
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+
+  propagatedBuildInputs = lib.optional enableMpi mpi;
+  propagatedUserEnvPkgs = lib.optional enableMpi mpi;
+
+  cmakeFlags = [
+    (lib.cmakeBool "GMX_HWLOC" true)
+    "-DGMX_SIMD:STRING=${SIMD cpuAcceleration}"
+    "-DGMX_OPENMP:BOOL=TRUE"
+    "-DBUILD_SHARED_LIBS=ON"
+  ]
+  ++ (
+    if singlePrec then
+      [
+        "-DGMX_DOUBLE=OFF"
+      ]
+    else
+      [
+        "-DGMX_DOUBLE=ON"
+        "-DGMX_DEFAULT_SUFFIX=OFF"
+      ]
+  )
+  ++ (
+    if enableMpi then
+      [
+        "-DGMX_MPI:BOOL=TRUE"
+        "-DGMX_THREAD_MPI:BOOL=FALSE"
+      ]
+    else
+      [
+        "-DGMX_MPI:BOOL=FALSE"
+      ]
+  )
+  ++ (lib.optionals enableSYCL [
+    "-DGMX_GPU=SYCL"
+    "-DGMX_OPENMP=OFF" # TODO: enable OpenMP with SYCL?
+  ])
+  ++ lib.optionals enableCuda [
+    "-DGMX_GPU=CUDA"
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cmakeCudaArchitecturesString)
+
+    # Gromacs seems to ignore and override the normal variables, so we add this ad hoc:
+    (lib.cmakeFeature "GMX_CUDA_TARGET_COMPUTE" cmakeCudaArchitecturesString)
+  ];
+
+  postInstall = ''
+    moveToOutput share/cmake $dev
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.gromacs.org";
+    license = licenses.lgpl21Plus;
+    description = "Molecular dynamics software package";
+    longDescription = ''
+      GROMACS is a versatile package to perform molecular dynamics,
+      i.e. simulate the Newtonian equations of motion for systems
+      with hundreds to millions of particles.
+
+      It is primarily designed for biochemical molecules like
+      proteins, lipids and nucleic acids that have a lot of
+      complicated bonded interactions, but since GROMACS is
+      extremely fast at calculating the nonbonded interactions (that
+      usually dominate simulations) many groups are also using it
+      for research on non-biological systems, e.g. polymers.
+
+      GROMACS supports all the usual algorithms you expect from a
+      modern molecular dynamics implementation, (check the online
+      reference or manual for details), but there are also quite a
+      few features that make it stand out from the competition.
+
+      See: https://www.gromacs.org/about.html for details.
+    '';
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      sheepforce
+      markuskowa
+      bsc.abonerib
+    ];
+  };
+}

pkgs/gromacs/pkgconfig-2024.patch

@@ -0,0 +1,24 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..9b97ad57f7 100644
+--- a/src/external/muparser/muparser.pc.in
++++ b/src/external/muparser/muparser.pc.in
+@@ -1,7 +1,5 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @PACKAGE_NAME@
+ Description: Mathematical expressions parser library
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index ec1ed6684e..ca1105474a 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
++++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,4 +1,4 @@
+-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library

pkgs/gromacs/pkgconfig-2025.patch

@@ -0,0 +1,36 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..d26e84de8f 100644
+--- a/src/external/muparser/muparser.pc.in
++++ b/src/external/muparser/muparser.pc.in
+@@ -1,11 +1,9 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-
+-Name: @PACKAGE_NAME@
+-Description: Mathematical expressions parser library
+-Version: @MUPARSER_VERSION@
+-Requires:
+-Libs: -L${libdir} -lmuparser
+-Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++
++Name: @PACKAGE_NAME@
++Description: Mathematical expressions parser library
++Version: @MUPARSER_VERSION@
++Requires:
++Libs: -L${libdir} -lmuparser
++Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index af9b5a6dc0..5f58d549bf 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
++++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,5 +1,4 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library

pkgs/hwloc/1.11.6/default.nix

@@ -0,0 +1,70 @@
+{ stdenv, lib, fetchurl, pkg-config, expat, ncurses
+, pciutils, numactl }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "hwloc-1.11.6";
+
+  src = fetchurl {
+    url = "http://www.open-mpi.org/software/hwloc/v1.11/downloads/${name}.tar.bz2";
+    sha256 = "1yl7dm2qplwmnidd712zy12qfvxk28k8ccs694n42ybwdjwzg1bn";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  # Filter out `null' inputs.  This allows users to `.override' the
+  # derivation and set optional dependencies to `null'.
+  buildInputs = filter (x: x != null)
+   ([ expat ncurses ]
+     ++  (optionals stdenv.isLinux [ numactl ]));
+
+  propagatedBuildInputs =
+    # Since `libpci' appears in `hwloc.pc', it must be propagated.
+    optional stdenv.isLinux pciutils;
+
+  enableParallelBuilding = true;
+
+  postInstall =
+    optionalString (stdenv.isLinux && numactl != null)
+      '' if [ -d "${numactl}/lib64" ]
+         then
+             numalibdir="${numactl}/lib64"
+         else
+             numalibdir="${numactl}/lib"
+             test -d "$numalibdir"
+         fi
+
+         sed -i "$out/lib/libhwloc.la" \
+             -e "s|-lnuma|-L$numalibdir -lnuma|g"
+      '';
+
+  # Checks disabled because they're impure (hardware dependent) and
+  # fail on some build machines.
+  doCheck = false;
+
+  meta = {
+    description = "Portable abstraction of hierarchical architectures for high-performance computing";
+    longDescription = ''
+       hwloc provides a portable abstraction (across OS,
+       versions, architectures, ...) of the hierarchical topology of
+       modern architectures, including NUMA memory nodes, sockets,
+       shared caches, cores and simultaneous multithreading.  It also
+       gathers various attributes such as cache and memory
+       information.  It primarily aims at helping high-performance
+       computing applications with gathering information about the
+       hardware so as to exploit it accordingly and efficiently.
+
+       hwloc may display the topology in multiple convenient
+       formats.  It also offers a powerful programming interface to
+       gather information about the hardware, bind processes, and much
+       more.
+    '';
+
+    # http://www.open-mpi.org/projects/hwloc/license.php
+    license = licenses.bsd3;
+    homepage = http://www.open-mpi.org/projects/hwloc/;
+    maintainers = [ ];
+    platforms = platforms.all;
+  };
+}

pkgs/intel-compiler/default.nix

@@ -0,0 +1,40 @@
+{
+  stdenv
+, gcc
+, iccUnwrapped
+, wrapCCWith
+, intelLicense
+}:
+
+let
+  targetConfig = stdenv.targetPlatform.config;
+  inherit gcc;
+in wrapCCWith rec {
+  cc = iccUnwrapped;
+  extraBuildCommands = ''
+    echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-cflags
+    echo "-isystem ${iccUnwrapped}/include" >> $out/nix-support/cc-cflags
+    echo "-isystem ${iccUnwrapped}/include/intel64" >> $out/nix-support/cc-cflags
+    echo "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-ldflags
+    echo "-L${gcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
+
+    cat "${iccUnwrapped}/nix-support/propagated-build-inputs" >> \
+      $out/nix-support/propagated-build-inputs
+
+    echo "export INTEL_LICENSE_FILE=${intelLicense}" \
+      >> $out/nix-support/setup-hook
+
+    # Create the wrappers for icc and icpc
+    if [ -e $ccPath/icc ]; then
+      wrap icc  $wrapper $ccPath/icc
+    fi
+
+    if [ -e $ccPath/icpc ]; then
+      wrap icpc $wrapper $ccPath/icpc
+    fi
+
+    if [ -e $ccPath/ifort ]; then
+      wrap ifort $wrapper $ccPath/ifort
+    fi
+  '';
+}

pkgs/intel-compiler/icc2020.nix

@@ -0,0 +1,71 @@
+{ stdenv
+, lib
+, fetchurl
+, rpmextract
+, autoPatchelfHook
+, gcc
+, intel-mpi
+}:
+
+stdenv.mkDerivation rec {
+  version = "${year}.${v_a}.${v_b}";
+  name = "intel-compiler-${version}";
+
+  passthru = {
+    CC = "icc";
+    CXX = "icpc";
+  };
+
+  # From Arch Linux PKGBUILD
+  dir_nr="17114";
+  year="2020";
+  v_a="4";
+  v_b="304";
+  update="4";
+  composer_xe_dir="compilers_and_libraries_${year}.${v_a}.${v_b}";
+  tgz="parallel_studio_xe_2020_update${update}_professional_edition.tgz";
+
+  src = fetchurl {
+    url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/tec/${dir_nr}/${tgz}";
+    sha256 = "1rn9kk5bjj0jfv853b09dxrx7kzvv8dlyzw3hl9ijx9mqr09lrzr";
+  };
+
+  buildInputs = [
+    rpmextract
+    autoPatchelfHook
+    gcc.cc.lib
+    gcc
+    intel-mpi
+  ];
+
+  # The gcc package is required for building other programs
+  propagatedBuildInputs = [ gcc ];
+
+  installPhase = ''
+    pwd
+    ls -l rpm
+    rpmextract rpm/intel-icc-*.rpm
+    rpmextract rpm/intel-comp-*.rpm
+    rpmextract rpm/intel-c-comp-*.rpm
+    rpmextract rpm/intel-openmp*.rpm
+    rpmextract rpm/intel-ifort*.rpm
+
+    mkdir -p $out/{bin,lib,include}
+
+    pushd ./opt/intel/${composer_xe_dir}/linux/
+      cp -a bin/intel64/* $out/bin/
+      cp -a compiler/include/* $out/include/
+      cp -a compiler/lib/intel64_lin/* $out/lib/
+      ln -s lib $out/lib_lin
+      rm $out/lib/*.dbg
+    popd
+  '';
+
+  meta = {
+    homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+    description = "Intel compiler";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+  };
+}

pkgs/intel-compiler/icc2021.nix

@@ -0,0 +1,156 @@
+{ stdenv
+, lib
+, fetchurl
+, dpkg
+, rsync
+, libffi
+, libelf
+, libxml2
+, hwloc
+, autoPatchelfHook
+}:
+
+with lib;
+
+let
+
+  getsrc = url: sha256: fetchurl { inherit url sha256; };
+
+  version = "2021.2.0";
+  _debpkgrel = "610";
+  tbbrel = "357";
+
+  # Shorhands
+  main     = "intel-oneapi-dpcpp-cpp";
+  compiler = "intel-oneapi-compiler-dpcpp-cpp";
+  shared   = "intel-oneapi-compiler-shared";
+  openmp   = "intel-oneapi-openmp";
+  tbb      = "intel-oneapi-tbb";
+
+  # From Arch Linux PKGBUILD:
+  # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=intel-oneapi-compiler-dpcpp-cpp
+  debs = [
+    # From intel-oneapi-compiler-dpcpp-cpp
+    "${main}-${version}-${version}-${_debpkgrel}_amd64.deb"
+    "${compiler}-common-${version}-${version}-${_debpkgrel}_all.deb"
+    "${compiler}-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
+
+    # From intel-oneapi-compiler-shared
+    "${shared}-${version}-${version}-${_debpkgrel}_amd64.deb"
+    "${shared}-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
+    "${shared}-common-${version}-${version}-${_debpkgrel}_all.deb"
+    "${shared}-common-runtime-${version}-${version}-${_debpkgrel}_all.deb"
+    "${compiler}-classic-fortran-shared-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
+
+    # From intel-oneapi-openmp
+    "${openmp}-${version}-${version}-${_debpkgrel}_amd64.deb"
+    "${openmp}-common-${version}-${version}-${_debpkgrel}_all.deb"
+
+    # From intel-oneapi-tbb
+    "${tbb}-${version}-${version}-${tbbrel}_amd64.deb"
+    "${tbb}-devel-${version}-${version}-${tbbrel}_amd64.deb"
+    "${tbb}-common-${version}-${version}-${tbbrel}_all.deb"
+    "${tbb}-common-devel-${version}-${version}-${tbbrel}_all.deb"
+  ];
+
+  apthost = "https://apt.repos.intel.com/oneapi/pool/main/";
+  urls = map (x: apthost + x) debs;
+
+  sums = [
+    # From intel-oneapi-compiler-dpcpp-cpp
+    "0pwsfzkazr9yf6v6lgwb3p2in6ch3rlcc9qcfarkyqn052p760kk"
+    "0vzsanldhs4ym4gsfn0zjqm03x53ma1zjkj24hpkhpsvlr2r069w"
+    "0nx62v6g0wl70lqdh7sh7gfgxbynhrrips9gpj9if60ngz6fm21m"
+
+    # From intel-oneapi-compiler-shared
+    "1al80pcy2r3q2r2pm04sva7rd3z6y287mkdv5jq4p5bfd8yi14d4"
+    "07rp0cjmbgj48wly9dm6ibxzbsanmgrsjjqr7mx688ms6qbhv314"
+    "1pf4xckyyhssjknhs6hwampjsz2qjlg81jw2fc441zaccwf25yf3"
+    "0hk0x4wq60g9wnn9j051v25zcmbasjdzp34xfvrihmcvyws0s69g"
+    "0dhbw8kshw4abqc9zf891z5ic0x13x3kvhk56nrqkqgcfwps9w8a"
+
+    # From intel-oneapi-openmp
+    "1wqy2sjwlqdh72zhfrxl9pm106hjzfdbbm98cxigbg20fb5lbv5a"
+    "19nbqypvqcf8c3mwriaqrmp5igjpwvwrb9mq2fxa5i40w7bhlxjl"
+
+    # From intel-oneapi-tbb
+    "1dpii3g861kimky0x7dqcj6hg7zb6i5kw1wgwrxdc5yxhi5slbm9"
+    "0bl1flm6w0w9nzrh34ig4p9qz2gbdgw9q14as2pwp8flicd8p899"
+    "0w3kip6q713v1xlfc10ai4v15cbwmbqrv8r1f5x6pfqdbb0bpmbv"
+    "0v95nmddyi0mjjdvm07w9fm3vq4a0wkx7zxlyzn2f4xg38qc5j73"
+  ];
+
+in
+  stdenv.mkDerivation {
+    inherit version;
+    name = "intel-compiler-${version}";
+
+    passthru = {
+      CC = "icc";
+      CXX = "icpc";
+    };
+
+    srcs = zipListsWith getsrc urls sums;
+
+    buildInputs = [
+      dpkg
+      rsync
+      libffi
+      libelf
+      libxml2
+      hwloc
+      autoPatchelfHook
+      stdenv.cc.cc.lib
+    ];
+
+    dontBuild = true;
+    dontStrip = true;
+
+    # The gcc package is required for building other programs
+    #propagatedBuildInputs = [ gcc ];
+
+    unpackCmd = ''
+      dpkg -x $curSrc .
+    '';
+
+    # FIXME: Some dependencies are missing
+    autoPatchelfIgnoreMissingDeps = true;
+    #autoPatchelfIgnoreMissingDeps = [ "*" ];
+
+    # Compiler
+    installPhase = ''
+      mkdir -p $out/{bin,lib,include}
+
+      pushd intel/oneapi/compiler/${version}/linux
+        # Binaries
+        rsync -a bin/ $out/bin/
+        rsync -a bin/intel64/ $out/bin/
+
+        # Libraries
+        rsync -a --exclude=oclfpga lib/ $out/lib/
+        rsync -a compiler/lib/intel64_lin/ $out/lib/
+
+        # Headers
+        rsync -a include/ $out/include/
+        rsync -a compiler/include/ $out/include/
+      popd
+
+      # TBB
+      pushd intel/oneapi/tbb/${version}
+        # Libraries
+        rsync -a lib/intel64/gcc4.8/ $out/lib/
+
+        # Headers
+        rsync -a include/ $out/include/
+      popd
+    '';
+
+    meta = {
+      homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+      description = "Intel compiler";
+      maintainers = with lib.maintainers.bsc; [ rarias ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.unfree;
+    };
+
+  }

pkgs/intel-compiler/license.nix

@@ -0,0 +1,39 @@
+{ stdenv
+, requireFile
+}:
+
+stdenv.mkDerivation rec {
+  name = "intel-compiler-license";
+  version = "2019.7.217";
+
+  src = requireFile {
+    name = "license.lic";
+    sha256 = "0rgmsqkhpqcfny8j7msa4sgz3prhh248ylh69gjh12dkra77prsj";
+    message = ''
+      The Intel Compiler requires a license. You can get one (free of charge) if
+      you meet the requeriments at the website:
+
+        https://software.intel.com/content/www/us/en/develop/articles/qualify-for-free-software.html#opensourcecontributor
+
+      Or you can use your own license. Add it to the store with:
+
+        $ nix-store --add-fixed sha256 license.lic
+        /nix/store/2p9v0nvsl3scshjx348z6j32rh7ac0db-license.lic
+
+      Notice that the name must match exactly "license.lic".
+
+      Then update the hash in the bsc/intel-compiler/license.nix file using the
+      nix-hash command with:
+
+        $ nix-hash --type sha256 --base32 --flat /nix/store/2p9v0nvsl3scshjx348z6j32rh7ac0db-license.lic
+        06g2xgm1lch6zqfkhb768wacdx46kf61mfvj5wfpyssw0anr0x9q
+    '';
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp $src $out/
+  '';
+}

pkgs/intel-compiler/wrapper2021.nix

@@ -0,0 +1,29 @@
+{
+  stdenv
+, gcc
+, iccUnwrapped
+, wrapCCWith
+}:
+
+let
+  targetConfig = stdenv.targetPlatform.config;
+  inherit gcc;
+in wrapCCWith rec {
+  cc = iccUnwrapped;
+  extraBuildCommands = ''
+    echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-cflags
+    echo "-isystem ${iccUnwrapped}/include" >> $out/nix-support/cc-cflags
+    echo "-isystem ${iccUnwrapped}/include/icc" >> $out/nix-support/cc-cflags
+    echo "-isystem ${gcc.cc}/include/c++/${gcc.version}" >> $out/nix-support/cc-cflags
+    echo "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}" >> $out/nix-support/cc-cflags
+
+    echo "-L${iccUnwrapped}/lib" >> $out/nix-support/cc-ldflags
+    echo "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-ldflags
+    echo "-L${gcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
+
+    # Create the wrappers for icx*
+    wrap lld  $wrapper $ccPath/lld
+    wrap icx  $wrapper $ccPath/icx
+    wrap icpx  $wrapper $ccPath/icpx
+  '';
+}

pkgs/intel-mpi/default.nix

@@ -0,0 +1,113 @@
+{ stdenv
+, lib
+, rpmextract
+, gcc
+, zlib
+, ucx
+, numactl
+, rdma-core
+, libpsm2
+, patchelf
+, autoPatchelfHook
+, enableDebug ? false
+# The _mt version seems to cause seg-faults and deadlocks with the libpsm2
+# provider library with programs that call the MPI library without any locking
+# mechanism. See https://pm.bsc.es/gitlab/rarias/bscpkgs/-/issues/28. By
+# default, we use the non-mt variant, which provides a big lock. If you want to
+# use it, take a look at the I_MPI_THREAD_SPLIT env-var as well.
+, enableMt ? false
+}:
+
+let
+
+  lib_variant = (if enableDebug then "debug" else "release");
+
+  # See https://software.intel.com/content/www/us/en/develop/documentation/mpi-developer-reference-linux/top/environment-variable-reference/other-environment-variables.html
+  lib_mt = (if enableMt then "_mt" else "");
+  lib_name = "${lib_variant}${lib_mt}";
+
+in
+
+stdenv.mkDerivation rec {
+  name = "intel-mpi-${version}";
+  version = "2019.10.317";
+  dir_nr = "17534";
+
+  src = builtins.fetchTarball {
+    url = "http://registrationcenter-download.intel.com/akdlm/irc_nas/tec/${dir_nr}/l_mpi_${version}.tgz";
+    sha256 = "00nimgqywr20dv1ns5kg4r8539gvharn0xfj48i7mhbg8kwf8s08";
+  };
+
+  buildInputs = [
+    rpmextract
+    autoPatchelfHook
+    gcc.cc.lib
+    zlib
+    ucx
+    numactl
+    rdma-core
+    libpsm2
+    patchelf
+  ];
+
+  postUnpack = ''
+    pushd $sourceRoot
+      rpmextract rpm/intel-mpi-*.rpm
+      # Predictable name
+      mv opt/intel/compilers_and_libraries_* opt/intel/compilers_and_libraries
+    popd
+    sourceRoot="$sourceRoot/opt/intel/compilers_and_libraries/linux/mpi/intel64"
+  '';
+
+  patches = [
+    ./mpicc.patch
+    ./mpicxx.patch
+  ];
+
+  postPatch = ''
+    for i in bin/mpi* ; do
+      echo "Fixing paths in $i"
+      sed -i "s:I_MPI_SUBSTITUTE_INSTALLDIR:$out:g" "$i"
+    done     
+  '';
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out
+    mv etc $out
+    mv bin $out 
+    mv include $out 
+    mkdir $out/lib
+    cp -a lib/lib* $out/lib
+    cp -a lib/${lib_name}/lib* $out/lib
+    cp -a libfabric/lib/* $out/lib
+    cp -a libfabric/lib/prov/* $out/lib
+    cp -a libfabric/bin/* $out/bin
+    ln -s . $out/intel64
+    rm $out/lib/libmpi.dbg
+
+    # Fixup Intel PSM2 library missing (now located at PSMX2)
+    ln -s $out/lib/libpsmx2-fi.so $out/lib/libpsm2-fi.so
+  '';
+
+  dontAutoPatchelf = true;
+
+  # The rpath of libfabric.so bundled with Intel MPI is patched to include the
+  # rdma-core lib path, as is required for dlopen to find the rdma components.
+  # TODO: Try the upstream libfabric library with rdma support, so we can avoid
+  # this hack.
+  postFixup = ''
+    autoPatchelf -- $out
+    patchelf --set-rpath "$out/lib:${rdma-core}/lib:${libpsm2}/lib" $out/lib/libfabric.so
+    echo "Patched RPATH in libfabric.so to: $(patchelf --print-rpath $out/lib/libfabric.so)"
+  '';
+
+  meta = {
+    homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
+    description = "Intel MPI";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+  };
+}

pkgs/intel-mpi/mpicc.patch

@@ -0,0 +1,20 @@
+--- a/bin/mpicc	2021-02-04 18:15:11.233632360 +0100
++++ b/bin/mpicc	2021-02-05 09:33:49.493598479 +0100
+@@ -50,7 +50,7 @@
+ if [ x"$opt_args" == x"" ]; then
+     case "${compiler_short_name}" in
+     icc|icx)    "$dir"/mpiicc -cc=$compiler_name "$@" ;;
+-    cc|*gcc*|clang*) "$dir"/mpigcc -cc=$compiler_name "$@" ;;
++    cc|*gcc*|clang*|mcc|echo) "$dir"/mpigcc -cc=$compiler_name "$@" ;;
+     mpicc)  "$dir"/mpigcc "$@" ;;    
+     *)  
+             echo "Error: unsupported compiler name '$compiler_name'."
+@@ -60,7 +60,7 @@
+ else
+     case "${compiler_short_name}" in
+     icc|icx)    "$dir"/mpiicc -cc=$compiler_name "$@" $opt_args ;;
+-    cc|*gcc*|clang*) "$dir"/mpigcc -cc=$compiler_name "$@" $opt_args ;;
++    cc|*gcc*|clang*|mcc|echo) "$dir"/mpigcc -cc=$compiler_name "$@" $opt_args ;;
+     mpicc)  "$dir"/mpigcc "$@" $opt_args ;;    
+     *)  
+             echo "Error: unsupported compiler name '$compiler_name'."

pkgs/intel-mpi/mpicxx.patch

@@ -0,0 +1,20 @@
+--- a/bin/mpicxx	2021-02-04 18:15:11.233632360 +0100
++++ b/bin/mpicxx	2021-02-05 09:36:21.396922569 +0100
+@@ -50,7 +50,7 @@
+ if [ x"$opt_args" == x"" ]; then
+     case "${compiler_short_name}" in
+     icc|icpc|dpcpp)   "$dir"/mpiicpc -cxx=$compiler_name "$@" ;;
+-    *g++*)        "$dir"/mpigxx -cxx=$compiler_name "$@" ;;
++    *g++*|clang*++|mcxx|echo) "$dir"/mpigxx -cxx=$compiler_name "$@" ;;
+     mpicxx)     "$dir"/mpigxx "$@" ;;
+     *)  
+             echo "Error: unsupported compiler name '$compiler_name'."
+@@ -60,7 +60,7 @@
+ else
+     case "${compiler_short_name}" in
+     icc|icpc|dpcpp)   "$dir"/mpiicpc -cxx=$compiler_name "$@" $opt_args ;;
+-    *g++*)        "$dir"/mpigxx -cxx=$compiler_name "$@" $opt_args ;;
++    *g++*|clang*++|mcxx|echo) "$dir"/mpigxx -cxx=$compiler_name "$@" $opt_args ;;
+     mpicxx)     "$dir"/mpigxx "$@" $opt_args ;;
+     *)  
+             echo "Error: unsupported compiler name '$compiler_name'."

pkgs/intel-oneapi/common/wrapper.nix

@@ -0,0 +1,77 @@
+{
+  stdenv,
+  lib,
+  gcc,
+  libgcc,
+  overrideCC,
+  wrapCCWith,
+}:
+
+{
+  cc,
+  extraPath ? lib.makeBinPath (
+    [ gcc.cc ] ++ (lib.optionals (cc.enableCuda or false) [ cc.cudaPackages.cudatoolkit ])
+  ),
+  extraBuildCommands ? "",
+  extraInstallCommands ? "",
+}:
+
+let
+  targetConfig = stdenv.targetPlatform.config;
+in
+(wrapCCWith {
+  inherit cc;
+
+  nixSupport = {
+    cc-ldflags = [
+      "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
+      "-L${gcc.cc.lib}/lib"
+      "-L${libgcc.out}/lib"
+      "-L${gcc.libc}/lib"
+      "-L${cc}/lib"
+    ];
+    cc-cflags = [
+      "--gcc-toolchain=${gcc.cc}"
+      "-isystem ${cc.original or cc}/lib/clang/${toString cc.llvmMajorVersion}/include"
+      "-isystem ${cc}/include"
+      "-isystem ${cc}/include/intel64"
+      "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
+    ];
+    libcxx-cxxflags = [
+      "-isystem ${gcc.cc}/include/c++/${gcc.version}"
+      "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
+    ];
+  };
+
+  extraBuildCommands = ''
+    # FIXME: We should find a better way to modify the PATH instead of using
+    # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
+    echo 'path_backup="${extraPath}:$path_backup"' >>$out/nix-support/cc-wrapper-hook
+
+    # Disable hardening by default
+    echo "" > $out/nix-support/add-hardening.sh
+
+    pushd $ccPath
+    for i in $ {llvm,sycl}-* ; do
+      ln -s $ccPath/$i $out/bin/$i
+    done
+    popd
+
+    # Use this to detect when a compiler subprocess is called
+    # from icpx (--fsycl-host-compiler)
+    echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
+
+    # oneMath looks for sycl libraries in bin/../lib
+    ln -s ${cc}/lib $out/lib
+    ln -s ${cc}/include $out/include
+  ''
+  + extraBuildCommands;
+}).overrideAttrs
+  (finalAttrs: prevAttrs: {
+    installPhase = prevAttrs.installPhase + extraInstallCommands;
+    passthru.stdenv = overrideCC stdenv finalAttrs.finalPackage;
+    meta = (prevAttrs.meta or { }) // {
+      maintainers = with lib.maintainers.bsc; [ abonerib ];
+      platforms = lib.platforms.linux;
+    };
+  })

pkgs/intel-oneapi/deb/2023.nix

@@ -10,7 +10,7 @@
 , zlib
 , autoPatchelfHook
 , libfabric
-, gcc13
+, gcc
 , wrapCCWith
 }:
 
@@ -33,8 +33,6 @@ let
     maintainers = with lib.maintainers.bsc; [ abonerib ];
   };
 
-  gcc = gcc13;
-
   v = {
     hpckit   = "2023.1.0";
     compiler = "2023.1.0";
@@ -42,45 +40,19 @@ let
     mpi      = "2021.9.0";
   };
 
-  aptPackageIndex = stdenv.mkDerivation {
-    name = "intel-oneapi-packages";
-    srcs = [
-      # Run update.sh to update the package lists
-      ./amd64-packages ./all-packages
-    ];
-    phases = [ "installPhase" ];
-    installPhase = ''
-      awk -F': ' '\
-        BEGIN   { print "[ {" } \
-        NR>1 && /^Package: / { print "} {"; } \
-        /: /    { printf "%s = \"%s\";\n", $1, $2 } \
-        END     { print "} ]" }' $srcs > $out
-    '';
-  };
-
-  aptPackages = import aptPackageIndex;
-
-  apthost = "https://apt.repos.intel.com/oneapi/";
-
-  getSum = pkgList: name:
+  findMatch = name:
   let
-    matches = lib.filter (x: name == x.Package) pkgList;
-    #n = lib.length matches;
-    #match = builtins.trace (name + " -- ${builtins.toString n}") (lib.elemAt matches 0);
-    match = lib.elemAt matches 0;
-  in
-    match.SHA256;
-
-  getUrl = pkgList: name:
-  let
-    matches = lib.filter (x: name == x.Package) pkgList;
-    #match = assert lib.length matches == 1; lib.elemAt matches 0;
+    aptPackages = builtins.getAttr "hpckit-2023-1-0" (builtins.fromTOML (builtins.readFile ./packages.toml));
+    matches = lib.filter (x: lib.hasPrefix name (x.name + "-" + x.version)) aptPackages;
     n = lib.length matches;
-    match =
-      #builtins.trace (name + " -- n=${builtins.toString n}")
-      (lib.elemAt matches 0);
+    match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
+
+    apthost = "https://apt.repos.intel.com/oneapi/";
   in
-    apthost + match.Filename;
+    {
+      url = apthost + match.file;
+      sha256 = match.sha256;
+    };
 
   uncompressDebs = debs: name: stdenv.mkDerivation {
     name = name;
@@ -100,10 +72,7 @@ let
 
   joinDebs = name: names:
   let
-    urls = builtins.map (x: getUrl aptPackages x) names;
-    sums = builtins.map (x: getSum aptPackages x) names;
-    getsrc = url: sha256: builtins.fetchurl { inherit url sha256; };
-    debs = lib.zipListsWith getsrc urls sums;
+    debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
   in
     uncompressDebs debs "${name}-source";
 
@@ -130,6 +99,7 @@ let
 
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
     installPhase = ''
       mkdir -p $out/{bin,etc,lib,include}
       mkdir -p $out/share/man
@@ -181,6 +151,7 @@ let
     ];
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
 
     autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];
 
@@ -224,6 +195,7 @@ let
     ];
     phases = [ "installPhase" "fixupPhase" ];
     dontStrip = true;
+    strictDeps = true;
 
     autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];
 
@@ -291,6 +263,7 @@ let
     phases = [ "installPhase" "fixupPhase" ];
 
     dontStrip = true;
+    strictDeps = true;
 
     installPhase = ''
       mkdir -p $out/{bin,lib,include}
@@ -330,7 +303,7 @@ let
     src = joinDebs pname [
       # C/C++
       "intel-oneapi-dpcpp-cpp-${version}"
-      "intel-oneapi-compiler-dpcpp-cpp-${version}"
+      # "intel-oneapi-compiler-dpcpp-cpp-${version}"
       "intel-oneapi-compiler-dpcpp-cpp-common-${version}"
       "intel-oneapi-compiler-dpcpp-cpp-runtime-${version}"
       "intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-${version}"
@@ -379,6 +352,7 @@ let
     phases = [ "installPhase" "fixupPhase" ];
 
     dontStrip = true;
+    strictDeps = true;
 
     installPhase = ''
       mkdir -p $out/{bin,lib}
@@ -472,7 +446,7 @@ let
     '';
   };
 
-  ifort-wrapper = wrapIntel rec {
+  ifort-wrapper = wrapIntel {
     cc = intel-compiler-fortran;
     mygcc = gcc;
     extraBuild = ''

pkgs/intel-oneapi/deb/packages.nix

@@ -0,0 +1,150 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  dpkg,
+  fetchurl,
+
+  sqlite,
+  elfutils,
+
+  intelAptRepoURL ? "https://apt.repos.intel.com/oneapi/",
+}:
+
+let
+  inherit (builtins) map mapAttrs readFile;
+
+  fetchDeb =
+    p:
+    fetchurl {
+      url = intelAptRepoURL + p.file;
+      inherit (p) sha256;
+    };
+
+  dpkgExtractAll =
+    pname: version:
+    { srcs, deps }:
+    stdenv.mkDerivation {
+      inherit pname version srcs;
+
+      nativeBuildInputs = [ dpkg ];
+      phases = [ "installPhase" ];
+
+      passthru = { inherit deps; };
+
+      installPhase = ''
+        mkdir -p $out
+        for src in $srcs; do
+          echo "Unpacking $src"
+          dpkg -x $src $out
+        done
+      '';
+    };
+
+  extractKit =
+    name: version: pkg:
+    dpkgExtractAll "${name}-extracted" version {
+      srcs = map fetchDeb pkg;
+      deps = pkg;
+    };
+
+  patchIntel = callPackage ./patch_intel.nix { };
+
+  # Version information for each hpckit. This is used to normalize the paths
+  # so that files are in $out/{bin,lib,include...} instead of all over the place
+  # in $out/opt/intel/oneapi/*/*/{...}.
+  #
+  # The most important is the compiler component, which is used to build the
+  # stdenv for the hpckit.
+  #
+  # NOTE: this have to be manually specified, so we can avoid IFD. To add a
+  # new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
+  # build hpckit_2026.unpatched and use the values from
+  # result/opt/intel/oneapi/* to populate the attrset.
+  #
+  # WARN: if there are more than one version in the folders of the unpatched
+  # components, our dependency resolution hacks have probably failed and the
+  # package set may be broken.
+  components = {
+    # hpckit-2023 = {
+    #   ccl = "2021.10.0";
+    #   compiler = "2023.2.4";
+    #   # conda_channel = "linux-64"; # TODO: which package pulls this?
+    #   dal = "2023.2.0";
+    #   debugger = "2023.2.0";
+    #   dev-utilities = "2021.10.0";
+    #   diagnostics = "2022.4.0";
+    #   dnnl = "2023.2.0";
+    #   dpcpp-ct = "2023.2.0";
+    #   dpl = "2022.2.0";
+    #   ipp = "2021.9.0";
+    #   ippcp = "2021.8.0";
+    #   itac = "2021.10.0";
+    #   mkl = "2023.2.0";
+    #   mpi = "2021.10.0";
+    #   tbb = "2021.10.0";
+    #
+    #   llvmMajorVersion = 14;
+    # };
+
+    hpckit-2024 = {
+      tcm = "1.1";
+
+      ccl = "2021.13";
+      compiler = "2024.2";
+      dal = "2024.6";
+      debugger = "2024.2";
+      dev-utilities = "2024.2";
+      diagnostics = "2024.2";
+      dnnl = "2024.2";
+      dpcpp-ct = "2024.2";
+      dpl = "2022.6";
+      ipp = "2021.12";
+      ippcp = "2021.12";
+      mkl = "2024.2";
+      mpi = "2021.13";
+      tbb = "2021.13";
+
+      llvmMajorVersion = 19;
+
+      extraPackages = [
+        sqlite
+        elfutils
+      ];
+    };
+
+    hpckit-2025 = {
+      ishmem = "1.5";
+      tcm = "1.4";
+      umf = "1.0";
+
+      ccl = "2021.17";
+      compiler = "2025.3";
+      dal = "2025.10";
+      debugger = "2025.3";
+      dev-utilities = "2025.3";
+      dnnl = "2025.3";
+      dpcpp-ct = "2025.3";
+      dpl = "2022.10";
+      ipp = "2022.3";
+      ippcp = "2025.3";
+      mkl = "2025.3";
+      mpi = "2021.17";
+      tbb = "2022.3";
+
+      llvmMajorVersion = 21;
+    };
+  };
+
+  kit = fromTOML (readFile ./packages.toml);
+in
+mapAttrs (
+  name: value:
+  patchIntel {
+    unpatched = extractKit "hpckit" kit.meta.${name}.version value;
+    components = components.${name};
+  }
+) (removeAttrs kit [ "meta" ])
+// {
+  inherit patchIntel extractKit kit;
+}

pkgs/intel-oneapi/deb/packages.toml

@@ -0,0 +1,975 @@
+[meta.hpckit-2023-1-0]
+version="2023.1.0-46346"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ccl"
+version="2021.9.0-43543"
+file="pool/main/intel-oneapi-ccl-2021.9.0-2021.9.0-43543_amd64.deb"
+sha256="153807818d0f67bf351acdcb30520e34d3b21e57d2feecb35bbffce741b220ab"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ccl-devel"
+version="2021.9.0-43543"
+file="pool/main/intel-oneapi-ccl-devel-2021.9.0-2021.9.0-43543_amd64.deb"
+sha256="4271cd383fc618633566340b7f8ae1fcf7882f208dffcf854d50c10f4389cf72"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-clck"
+version="2021.7.3-45658"
+file="pool/main/intel-oneapi-clck-2021.7.3-2021.7.3-45658_amd64.deb"
+sha256="045a5e1f1135cfef146f7b5211dcad3afd5608bef283c7f03a920bf686a86586"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="8a85a64359f8ea49d82a0a1e89d9a456d3447f917c5a0682d2f6b3d09c6fe48e"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-common"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-common-2023.1.0-2023.1.0-46305_all.deb"
+sha256="d38895ab3046195929b7109b8bf80b3a0cd14507fda096ab7d0577aaea79b727"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-runtime"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-runtime-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="2b12ab367bbf7e07d1f9da0b3ec6b3dd409703cb08802cd1e87b78192d90cf39"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-classic-fortran-shared-runtime"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-classic-fortran-shared-runtime-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="354e65a469a9ab8e5c72684ff8c2dc5731356bc7be45012eff23e75302624edf"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-common"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-common-2023.1.0-2023.1.0-46305_all.deb"
+sha256="9c117b25ddee699d1a8162ab101b9c23beeea5e9a3f2409414ee6bbc78d6593b"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-dpcpp-cpp-runtime"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-runtime-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="d0eec67fe7e3b36c8c5b1d07a17779f739fd2fd1881f6b1848169faffcb855c6"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-fortran"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-fortran-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="c8c73b7a88ed594c53a424dc3ed1dc497259da960dad5eb902982f5c31059e8d"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-fortran-common"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-fortran-common-2023.1.0-2023.1.0-46305_all.deb"
+sha256="312bc5e47b7254c5637110a31c48509e09bdcb4af07a8edfddc3d190cd83d9b7"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-fortran-runtime"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-fortran-runtime-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="bb137c02afd6c372e0734c424e2087c9509fbe2f154eee1f363e39368f794334"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-shared"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-shared-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="014104b9721d7fca7bb2529ed810f27e9a73410698e9cc643ded7f909a7f17cf"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-shared-common"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-shared-common-2023.1.0-2023.1.0-46305_all.deb"
+sha256="894eaf13bfe840d2f5df49685e9f5bb9ca8212bc2c8ddf848adcabb3806db8bd"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-compiler-shared-runtime"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-compiler-shared-runtime-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="fa3f4c23f527f1ced767fef56c022e252daedd08fab752ec653985f178d509b6"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dal"
+version="2023.1.0-46349"
+file="pool/main/intel-oneapi-dal-2023.1.0-2023.1.0-46349_amd64.deb"
+sha256="1c7c79398aad2010590ac092087bd8430232cf79bd859b8f3a5ac08bf8b1e9f9"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dal-common"
+version="2023.1.0-46349"
+file="pool/main/intel-oneapi-dal-common-2023.1.0-2023.1.0-46349_all.deb"
+sha256="ffa4620fe6deeb71779ecc8ea6e4b113d93d0abb326632ec87a2be6aa62b579f"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dal-common-devel"
+version="2023.1.0-46349"
+file="pool/main/intel-oneapi-dal-common-devel-2023.1.0-2023.1.0-46349_all.deb"
+sha256="72f539982ef75acc8d236144529715d656f35b3ffff486f5205295aa97fe097b"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dal-devel"
+version="2023.1.0-46349"
+file="pool/main/intel-oneapi-dal-devel-2023.1.0-2023.1.0-46349_amd64.deb"
+sha256="202b28dc9cba1d978d3dd296b66fb2de266adb53f8c1aaeead3dd70d713756d6"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dev-utilities"
+version="2021.9.0-44447"
+file="pool/main/intel-oneapi-dev-utilities-2021.9.0-2021.9.0-44447_amd64.deb"
+sha256="2d34f9d4f746b2b6468ed033628ffbe7838bf1d0bafcc3650d13d5740b10157f"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-diagnostics-utility"
+version="2022.3.0-43897"
+file="pool/main/intel-oneapi-diagnostics-utility-2022.3.0-43897_amd64.deb"
+sha256="0dcb568c586269c34acf055a2531eda75b1e79beaeca2587f3a87daf5167a86f"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dnnl"
+version="2023.1.0-46343"
+file="pool/main/intel-oneapi-dnnl-2023.1.0-46343_amd64.deb"
+sha256="e60916a5849ba8faacd46f9633cdd6e9623fc45828696afe5d8308b7a6fcd96e"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dnnl-devel"
+version="2023.1.0-46343"
+file="pool/main/intel-oneapi-dnnl-devel-2023.1.0-46343_amd64.deb"
+sha256="5a014e468825ad12b674b88a8b549e6a607bf8a8caf2e100e525e41ac9302db6"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dpcpp-cpp"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-dpcpp-cpp-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="5acd0dc9fc540355bc19317be5d79686f2acb90ac28486dd0717c423e4c94326"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dpcpp-ct"
+version="2023.1.0-44450"
+file="pool/main/intel-oneapi-dpcpp-ct-2023.1.0-2023.1.0-44450_amd64.deb"
+sha256="062a8186d07999286875f13de68b7516c10ed4466c408b03558b318e2cffa291"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dpcpp-debugger"
+version="2023.1.0-43513"
+file="pool/main/intel-oneapi-dpcpp-debugger-2023.1.0-2023.1.0-43513_amd64.deb"
+sha256="910daada72c1754f3784906a105788f9de226c84b0147c38c63ce4345ab5455e"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-dpcpp-debugger-eclipse-cfg"
+version="2023.1.0-43513"
+file="pool/main/intel-oneapi-dpcpp-debugger-eclipse-cfg-2023.1.0-43513_all.deb"
+sha256="389ace7ca89e567cf63dbc083dfea3c2ecef645f5461aca35cda02e5410ced8a"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ipp"
+version="2021.8.0-46345"
+file="pool/main/intel-oneapi-ipp-2021.8.0-2021.8.0-46345_amd64.deb"
+sha256="2e7e6bdf92b650bcb56e5f72224289531b35de870e16b46b2000ee1276185186"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ipp-common"
+version="2021.8.0-46345"
+file="pool/main/intel-oneapi-ipp-common-2021.8.0-2021.8.0-46345_all.deb"
+sha256="d367b5eb7135fd16e78be64e31be8fabf82bdd7ff5b7e20c0cab7aa89da82612"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ipp-common-devel"
+version="2021.8.0-46345"
+file="pool/main/intel-oneapi-ipp-common-devel-2021.8.0-2021.8.0-46345_all.deb"
+sha256="16f5d9448492023b701b36dbe860ede13fb771ca60d5165464151f4fec086423"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ipp-devel"
+version="2021.8.0-46345"
+file="pool/main/intel-oneapi-ipp-devel-2021.8.0-2021.8.0-46345_amd64.deb"
+sha256="0651c32a8875ffad2c627aae8c120366b51ae5bf62aa3fb3ac478e635aeeb871"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ippcp"
+version="2021.7.0-43492"
+file="pool/main/intel-oneapi-ippcp-2021.7.0-2021.7.0-43492_amd64.deb"
+sha256="51c8ba51ffb8aa8d8fb89cb0e33e52ba6a1b415e6dcfa8dbf3e6c111f33f67d9"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ippcp-common"
+version="2021.7.0-43492"
+file="pool/main/intel-oneapi-ippcp-common-2021.7.0-2021.7.0-43492_all.deb"
+sha256="acda55e5e660fb0a15183310aaf5acd42b2a5aef82395964e2aa2d74012b8fde"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ippcp-common-devel"
+version="2021.7.0-43492"
+file="pool/main/intel-oneapi-ippcp-common-devel-2021.7.0-2021.7.0-43492_all.deb"
+sha256="d2c7e3f1c6a1cb0c84bfeb8ab1d398dc5dd4ebd48569a2a1d4d64292bb4bf938"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-ippcp-devel"
+version="2021.7.0-43492"
+file="pool/main/intel-oneapi-ippcp-devel-2021.7.0-2021.7.0-43492_amd64.deb"
+sha256="8b682da8d14c940779845385b9a68b9a71c5a488791ea1c3f64d4eb317abd23f"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-itac"
+version="2021.9.0-43491"
+file="pool/main/intel-oneapi-itac-2021.9.0-2021.9.0-43491_amd64.deb"
+sha256="b8b393e0f7f027f56e3d6c3fe06c2bf84fe40783701a0849fd13982d9e8eff50"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-libdpstd-devel"
+version="2022.1.0-43490"
+file="pool/main/intel-oneapi-libdpstd-devel-2022.1.0-2022.1.0-43490_amd64.deb"
+sha256="133b98eec6558ffee3cec65bcadcda097497cd390a63c3da09f77a7d7d225ded"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mkl"
+version="2023.1.0-46342"
+file="pool/main/intel-oneapi-mkl-2023.1.0-2023.1.0-46342_amd64.deb"
+sha256="0581a867bed4ef620812bc05faa35228b7439d4f1d33f0eb4483f7eb8cafe8aa"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mkl-common"
+version="2023.1.0-46342"
+file="pool/main/intel-oneapi-mkl-common-2023.1.0-2023.1.0-46342_all.deb"
+sha256="50c1537cd8252b443802325a6938f607b4b3801c552e77aacaa8d9d9dfc8c34e"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mkl-common-devel"
+version="2023.1.0-46342"
+file="pool/main/intel-oneapi-mkl-common-devel-2023.1.0-2023.1.0-46342_all.deb"
+sha256="bb096792ea3669a0977beb0949c49238e0e43e3bc48a7f63abc5fdb856562651"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mkl-devel"
+version="2023.1.0-46342"
+file="pool/main/intel-oneapi-mkl-devel-2023.1.0-2023.1.0-46342_amd64.deb"
+sha256="1eeb94ad7aeebd55873cb64f2ba3db5a202e3c6f17c7d3095742aeb95c72f2cd"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mpi"
+version="2021.9.0-43482"
+file="pool/main/intel-oneapi-mpi-2021.9.0-2021.9.0-43482_amd64.deb"
+sha256="ccef71d5992198bca7b40111addb854062c0796427180c42d51553a949a2f7b4"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-mpi-devel"
+version="2021.9.0-43482"
+file="pool/main/intel-oneapi-mpi-devel-2021.9.0-2021.9.0-43482_amd64.deb"
+sha256="8702f4df9030597352e10f28ccc9635f3f17a3e128d18622a82ffa440471ba4e"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-openmp"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-openmp-2023.1.0-2023.1.0-46305_amd64.deb"
+sha256="6455ee16e4b5ab482ca57a607c20b7387ebc74ab0e1787d2a0beb7ad38c74443"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-openmp-common"
+version="2023.1.0-46305"
+file="pool/main/intel-oneapi-openmp-common-2023.1.0-2023.1.0-46305_all.deb"
+sha256="d4cb4adfbfc1ba289996f4b55e85fef73348ee193314552b08a3c59c2af2c8e0"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-tbb"
+version="2021.9.0-43484"
+file="pool/main/intel-oneapi-tbb-2021.9.0-2021.9.0-43484_amd64.deb"
+sha256="5a5b041a76e1def25b57c3aa3a3d6f60af761115770193c61185eec2c21f6e65"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-tbb-common"
+version="2021.9.0-43484"
+file="pool/main/intel-oneapi-tbb-common-2021.9.0-2021.9.0-43484_all.deb"
+sha256="cdad350bed77e0f695d28c0a1468c5b21b32ff9d6db960e5c11d466ea17c634a"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-tbb-common-devel"
+version="2021.9.0-43484"
+file="pool/main/intel-oneapi-tbb-common-devel-2021.9.0-2021.9.0-43484_all.deb"
+sha256="919783c69c8fe7d78ba592801630da2dc6031bfec9c56363bc09ff3ce762d9b8"
+
+[[hpckit-2023-1-0]]
+name="intel-oneapi-tbb-devel"
+version="2021.9.0-43484"
+file="pool/main/intel-oneapi-tbb-devel-2021.9.0-2021.9.0-43484_amd64.deb"
+sha256="dec4a9c18b10039dac5bd8a7c3158c9521cc018a986bff58a36d7a5daadfc3e3"
+
+[meta.hpckit-2024]
+version="2024.2.1-77"
+
+[[hpckit-2024]]
+name="intel-oneapi-ccl"
+version="2021.13.1-31"
+file="pool/main/intel-oneapi-ccl-2021.13-2021.13.1-31_amd64.deb"
+sha256="a2c0e8548336c97ba76152dc121d09599c0b87f442215882216177d09748afd7"
+
+[[hpckit-2024]]
+name="intel-oneapi-ccl-devel"
+version="2021.13.1-31"
+file="pool/main/intel-oneapi-ccl-devel-2021.13-2021.13.1-31_amd64.deb"
+sha256="e643cf40e6b878cda5d1d5b6faa1f1591d10b7117454133d67558cb511e2a988"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-dpcpp-cpp-common"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-common-2024.2-2024.2.1-1079_all.deb"
+sha256="9435fa27dff15a63dc8f57badffd0c8f5b4e259ea5f3b842b5e0bdc27eb629bd"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-dpcpp-cpp-runtime"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-runtime-2024.2-2024.2.1-1079_amd64.deb"
+sha256="89e862808730ce2a6e71ffbe04742c8148e056a54f616f9b9fa791c5865f8ed8"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-fortran"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-fortran-2024.2-2024.2.1-1079_amd64.deb"
+sha256="39b06723ee859f520297b2ab1895d1c5fd93bb313c107f94b7c277630be3cb94"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-fortran-common"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-fortran-common-2024.2-2024.2.1-1079_all.deb"
+sha256="8a0b2ad4017336fe607600eaf958199c3c0a65a258b11cbc4d54e1f4ca9c67ca"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-fortran-runtime"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-fortran-runtime-2024.2-2024.2.1-1079_amd64.deb"
+sha256="1f88e312f361d1aecf92c992f8d86127f935fd1bbe92bbe17d5ec9503538a0b1"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-shared"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-shared-2024.2-2024.2.1-1079_amd64.deb"
+sha256="0fe148b6cc0d3bafe8a9cb71d2fd47473eb7a9df76f14369440c1cd2fd2b76c4"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-shared-common"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-shared-common-2024.2-2024.2.1-1079_all.deb"
+sha256="dbc61ca434fa0ab12fd70e7b19d796eac2fbd60f9b3309ace233226c74169f0a"
+
+[[hpckit-2024]]
+name="intel-oneapi-compiler-shared-runtime"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-compiler-shared-runtime-2024.2-2024.2.1-1079_amd64.deb"
+sha256="0ede7ca5d7bd0266d072e5b948ade26b8dcb384aa4f202d0178540d6e94a67ad"
+
+[[hpckit-2024]]
+name="intel-oneapi-dal"
+version="2024.6.0-416"
+file="pool/main/intel-oneapi-dal-2024.6-2024.6.0-416_amd64.deb"
+sha256="f8c30b452512332ab357913be00a9a96f2285a757f9e25ec1725af9479c94abe"
+
+[[hpckit-2024]]
+name="intel-oneapi-dal-common"
+version="2024.6.0-416"
+file="pool/main/intel-oneapi-dal-common-2024.6-2024.6.0-416_all.deb"
+sha256="511f5e6c2efaec93252f5c83801af0445297353d5e31f566c59b57f6e1f87cfe"
+
+[[hpckit-2024]]
+name="intel-oneapi-dal-common-devel"
+version="2024.6.0-416"
+file="pool/main/intel-oneapi-dal-common-devel-2024.6-2024.6.0-416_all.deb"
+sha256="572c8f27df4a6e1500040918c808edf5ad20efbb2efc26076038eae16816cb98"
+
+[[hpckit-2024]]
+name="intel-oneapi-dal-devel"
+version="2024.6.0-416"
+file="pool/main/intel-oneapi-dal-devel-2024.6-2024.6.0-416_amd64.deb"
+sha256="aff98af4aa133589e400371aa7db91d119fb74b5d4736948ca1e63bcd7c265e5"
+
+[[hpckit-2024]]
+name="intel-oneapi-dev-utilities"
+version="2024.2.1-11"
+file="pool/main/intel-oneapi-dev-utilities-2024.2-2024.2.1-11_amd64.deb"
+sha256="de5db5005c9458aea2b00531d5737b7b5018d76c36283aa715f44757a4608c08"
+
+[[hpckit-2024]]
+name="intel-oneapi-diagnostics-utility"
+version="2024.2.1-13"
+file="pool/main/intel-oneapi-diagnostics-utility-2024.2-2024.2.1-13_amd64.deb"
+sha256="a876443134a971810f874e340ecfd10307766bb42f1f649e4cb13e714d13e8b9"
+
+[[hpckit-2024]]
+name="intel-oneapi-dnnl"
+version="2024.2.1-74"
+file="pool/main/intel-oneapi-dnnl-2024.2-2024.2.1-74_amd64.deb"
+sha256="5f31be37bb55d7486a703dc305180f8055ab40ddfe1b114f68401e5568415d3b"
+
+[[hpckit-2024]]
+name="intel-oneapi-dnnl-devel"
+version="2024.2.1-74"
+file="pool/main/intel-oneapi-dnnl-devel-2024.2-2024.2.1-74_amd64.deb"
+sha256="4f5d1ceb675713f9678d1256320f85199c6ae26ebfe0e51767511468699edbf8"
+
+[[hpckit-2024]]
+name="intel-oneapi-dpcpp-cpp"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-dpcpp-cpp-2024.2-2024.2.1-1079_amd64.deb"
+sha256="bcfef41a59ec2e5dc9092569a4d6de61dffed6ab4e34386a06ed427bcd4f0b67"
+
+[[hpckit-2024]]
+name="intel-oneapi-dpcpp-ct"
+version="2024.2.1-62"
+file="pool/main/intel-oneapi-dpcpp-ct-2024.2-2024.2.1-62_amd64.deb"
+sha256="5d3d34a085ab2423d84e69955b22dc1358360ee1c4be4f2f9c4a88428fc9b244"
+
+[[hpckit-2024]]
+name="intel-oneapi-dpcpp-debugger"
+version="2024.2.1-67"
+file="pool/main/intel-oneapi-dpcpp-debugger-2024.2-2024.2.1-67_amd64.deb"
+sha256="494e5f6f1beaa78367cde9b57a804c1b6d8d7fa1ab395805d4e5309e9b75114d"
+
+[[hpckit-2024]]
+name="intel-oneapi-ipp"
+version="2021.12.1-14"
+file="pool/main/intel-oneapi-ipp-2021.12-2021.12.1-14_amd64.deb"
+sha256="b05ed95530e9a2a56d1c628ead3f6c6e1806b056863f87d6a20f1f619b98e833"
+
+[[hpckit-2024]]
+name="intel-oneapi-ipp-common"
+version="2021.12.1-14"
+file="pool/main/intel-oneapi-ipp-common-2021.12-2021.12.1-14_all.deb"
+sha256="09b37bb4ed060958b31684e923e302cd43f08da119936a107548355b8974ad9e"
+
+[[hpckit-2024]]
+name="intel-oneapi-ipp-common-devel"
+version="2021.12.1-14"
+file="pool/main/intel-oneapi-ipp-common-devel-2021.12-2021.12.1-14_all.deb"
+sha256="b49c425f10f05ca060d0e63fd2298ef13a8de79d31354857e0fee9afb5a8ffdd"
+
+[[hpckit-2024]]
+name="intel-oneapi-ipp-devel"
+version="2021.12.1-14"
+file="pool/main/intel-oneapi-ipp-devel-2021.12-2021.12.1-14_amd64.deb"
+sha256="46193460bce2b8f17a0990e75acce9e1dd48fc995df5dc206b113a2a34cc2145"
+
+[[hpckit-2024]]
+name="intel-oneapi-ippcp"
+version="2021.12.1-12"
+file="pool/main/intel-oneapi-ippcp-2021.12-2021.12.1-12_amd64.deb"
+sha256="8aa7ff2bc8cb35ca150657c44e150c341d23ebe2775a4fc417d1976f6d004772"
+
+[[hpckit-2024]]
+name="intel-oneapi-ippcp-common"
+version="2021.12.1-12"
+file="pool/main/intel-oneapi-ippcp-common-2021.12-2021.12.1-12_all.deb"
+sha256="a47dcaa7d79c9f72de55e31f47e1af25073bb2677353cf97fbf0a06af8a34df9"
+
+[[hpckit-2024]]
+name="intel-oneapi-ippcp-common-devel"
+version="2021.12.1-12"
+file="pool/main/intel-oneapi-ippcp-common-devel-2021.12-2021.12.1-12_all.deb"
+sha256="2a36e254f7b21e0bbbdedd904741c58aa9d8f92e992eed19ec112253dca30e69"
+
+[[hpckit-2024]]
+name="intel-oneapi-ippcp-devel"
+version="2021.12.1-12"
+file="pool/main/intel-oneapi-ippcp-devel-2021.12-2021.12.1-12_amd64.deb"
+sha256="21a1ccffe1e2b632ed9c3295ecac99ba646978938d701b8f9bb5f936d8f85ac9"
+
+[[hpckit-2024]]
+name="intel-oneapi-libdpstd-devel"
+version="2022.6.1-12"
+file="pool/main/intel-oneapi-libdpstd-devel-2022.6-2022.6.1-12_amd64.deb"
+sha256="c2dbe75d54ce0d66a85d17642496067e3bdca6c55828a3a2e3f8a7fcf017a331"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-classic-include"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-classic-include-2024.2-2024.2.2-15_amd64.deb"
+sha256="c561650b0a29f68a2a64b2b08013eacc7c4c474c78ecc9a97e377600008230e5"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-classic-include-common"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-classic-include-common-2024.2-2024.2.2-15_all.deb"
+sha256="d693457a4d5b1ac4fa9ef3b33fe840d13d585c7c53481ba1bae50574c8c35632"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-cluster"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-cluster-2024.2-2024.2.2-15_amd64.deb"
+sha256="987c2f088d1bcaf0c09f5a07f75d46d8badc0c5043e8f950c0cc21ce66f8449f"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-cluster-devel"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-cluster-devel-2024.2-2024.2.2-15_amd64.deb"
+sha256="237ea66178e0f1ca17ad84a602ae18095dfa68654bceff8f012c35add7e2f75a"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-cluster-devel-common"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-cluster-devel-common-2024.2-2024.2.2-15_all.deb"
+sha256="139579e6c551a4d40a90a32760ca81a7b0dd020a38d8d55edd1fd37a67c2425c"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-core"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-core-2024.2-2024.2.2-15_amd64.deb"
+sha256="38790ffe5e4bae6b58e987888d3f201b2da5378d724d0748ed08cfb44adc7293"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-core-common"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-core-common-2024.2-2024.2.2-15_all.deb"
+sha256="3782e65378ad8c5ab313d400ddb629475dd0f29a54deb4e7bd242c102f336d04"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-core-devel"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-core-devel-2024.2-2024.2.2-15_amd64.deb"
+sha256="c723a51b2dc413cc92e6916d607bb770cc3358e49e6f3e46593cabedaea5ebf8"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-core-devel-common"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-core-devel-common-2024.2-2024.2.2-15_all.deb"
+sha256="e57684820dbd38baf21fa38c78c32046aae73408dfcfbc2fbfcff09ef4b31a10"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-2024.2-2024.2.2-15_amd64.deb"
+sha256="96b9cf9ed87a298c17ddb7fa9be1f2f9bb75bcfb2d10e4a768e89d33641bcefc"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-blas"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-blas-2024.2-2024.2.2-15_amd64.deb"
+sha256="17bc5c87e632e695d34b99c4ad9a355c6151bf4da049b111326c2ab690c2203a"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-data-fitting"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-data-fitting-2024.2-2024.2.2-15_amd64.deb"
+sha256="26ed10e928b68a03e64db96b0d889f7654579bf687a2f2f4c199c3c18daacc66"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-devel"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-devel-2024.2-2024.2.2-15_amd64.deb"
+sha256="bc0052e3703da2e5531f8b2a826bcfcca968db66a9e9d3a3e59fa2fa7e54eb23"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-devel-common"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-devel-common-2024.2-2024.2.2-15_all.deb"
+sha256="0da183623695e91e79d7260770b6a7e32b935f0cdaaa5eb22e9684cd68dae0b0"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-dft"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-dft-2024.2-2024.2.2-15_amd64.deb"
+sha256="e3e6eaaf801b3df3ae99f38e700dbd858b877b7691c7e55aef9937d469a359ab"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-include"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-include-2024.2-2024.2.2-15_amd64.deb"
+sha256="7e86492fbcb1e708e034b2638b1032ea346387f60f9dd2253824784492a9561d"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-lapack"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-lapack-2024.2-2024.2.2-15_amd64.deb"
+sha256="bf1b104b52f8b22c1ae92e20e23901970e7736aabfc5ab41ba7b0cfd450aeeec"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-rng"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-rng-2024.2-2024.2.2-15_amd64.deb"
+sha256="8be435fc7b16634d8e7b12a09b80b399c594f53a8d0a12efa332fe422efaa608"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-sparse"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-sparse-2024.2-2024.2.2-15_amd64.deb"
+sha256="01fb7b7586d3d59c9c4beff3b871c406fb3a801b85712940175a003d6d3d69f8"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-stats"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-stats-2024.2-2024.2.2-15_amd64.deb"
+sha256="e741dc0dabbc0955fb1d1f0a4ad73e7326b880d859f2c1caf18cb2384761811f"
+
+[[hpckit-2024]]
+name="intel-oneapi-mkl-sycl-vm"
+version="2024.2.2-15"
+file="pool/main/intel-oneapi-mkl-sycl-vm-2024.2-2024.2.2-15_amd64.deb"
+sha256="40f44c1e90781757d342edc242359d2567013b6d32aeff3dfca6f1e77777d995"
+
+[[hpckit-2024]]
+name="intel-oneapi-mpi"
+version="2021.13.1-767"
+file="pool/main/intel-oneapi-mpi-2021.13-2021.13.1-767_amd64.deb"
+sha256="4a60fd1ea52b0c0cb052c0f9309c5e6e4aa8cac05e9da4b7cf3157dde02bd7bd"
+
+[[hpckit-2024]]
+name="intel-oneapi-mpi-devel"
+version="2021.13.1-767"
+file="pool/main/intel-oneapi-mpi-devel-2021.13-2021.13.1-767_amd64.deb"
+sha256="47fb46dfaeee395547cf54714cd9d20d3e37cf5714676e28d0eb828c538b5805"
+
+[[hpckit-2024]]
+name="intel-oneapi-openmp"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-openmp-2024.2-2024.2.1-1079_amd64.deb"
+sha256="6b8722f3e6da876cc7044d00f7132d79f3dc83841b360cd57c907a09375846d2"
+
+[[hpckit-2024]]
+name="intel-oneapi-openmp-common"
+version="2024.2.1-1079"
+file="pool/main/intel-oneapi-openmp-common-2024.2-2024.2.1-1079_all.deb"
+sha256="5a540a4f3b226a16ec6effddd39e3a97ef0ea83e9a6f01ca03f9bd0305f92739"
+
+[[hpckit-2024]]
+name="intel-oneapi-tbb"
+version="2021.13.1-12"
+file="pool/main/intel-oneapi-tbb-2021.13-2021.13.1-12_amd64.deb"
+sha256="b6cc5bd80ce18f62ab38f5c54dcf75ef8e2957589eedf0913bcde029d0c7ca1a"
+
+[[hpckit-2024]]
+name="intel-oneapi-tbb-common"
+version="2021.13.1-12"
+file="pool/main/intel-oneapi-tbb-common-2021.13-2021.13.1-12_all.deb"
+sha256="435be0d78831997ce465b19dbaa8411d8fca90ca4abc998f74200c67116420a0"
+
+[[hpckit-2024]]
+name="intel-oneapi-tbb-common-devel"
+version="2021.13.1-12"
+file="pool/main/intel-oneapi-tbb-common-devel-2021.13-2021.13.1-12_all.deb"
+sha256="3dae6c0139b32651e46652799aa49fda8cbef59911934cb27ec7444260641bc0"
+
+[[hpckit-2024]]
+name="intel-oneapi-tbb-devel"
+version="2021.13.1-12"
+file="pool/main/intel-oneapi-tbb-devel-2021.13-2021.13.1-12_amd64.deb"
+sha256="55961b5f4782b5ebf05d1a0f7da7fb80bcc2bf75d229c094507f2659b91931ee"
+
+[[hpckit-2024]]
+name="intel-oneapi-tcm"
+version="1.1.1-11"
+file="pool/main/intel-oneapi-tcm-1.1-1.1.1-11_amd64.deb"
+sha256="53535a5d16d66755e7de3db9bd8e25b42d426ed9c90e4ac5bcb121bebf1b2ede"
+
+[[hpckit-2024]]
+name="intel-oneapi-tlt"
+version="2024.2.0-705"
+file="pool/main/intel-oneapi-tlt-2024.2-2024.2.0-705_amd64.deb"
+sha256="b7eb4614de1e10fd691616365ec0b6e3b23712a9377999df1ebb2f2c0589f2aa"
+
+[meta.hpckit-2025]
+version="2025.3.1-52"
+
+[[hpckit-2025]]
+name="intel-oneapi-ccl"
+version="2021.17.2-5"
+file="pool/main/intel-oneapi-ccl-2021.17-2021.17.2-5_amd64.deb"
+sha256="744cedaf2cd244309f6d1b0bb3236939a8f6bed7406b0da57dd4dda9f3296b67"
+
+[[hpckit-2025]]
+name="intel-oneapi-ccl-devel"
+version="2021.17.2-5"
+file="pool/main/intel-oneapi-ccl-devel-2021.17-2021.17.2-5_amd64.deb"
+sha256="cd2d2c494a3ab986f4c4fa63effe0aed9073028ba1572ff2ec877a1ff2af2053"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-dpcpp-cpp-common"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-common-2025.3-2025.3.2-832_all.deb"
+sha256="864f9aa601dda75c25594f390f98b3637b0c5a81d2f7dea6612e10de831e7183"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-dpcpp-cpp-runtime"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-dpcpp-cpp-runtime-2025.3-2025.3.2-832_amd64.deb"
+sha256="65b3aa66a191c5b3df08ba35a64fcb42e751897ca3cb9093b9ee42e53feda890"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-fortran"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-fortran-2025.3-2025.3.2-832_amd64.deb"
+sha256="3caf41f6c545712839b624d10f194c3d2ba614397b66dbdf7ff4d1fbd2b58ee8"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-fortran-common"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-fortran-common-2025.3-2025.3.2-832_all.deb"
+sha256="eb85bad42db5926e658e42d1e0e1cb89f386cf87e78fe343b693afaa91cb6b06"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-fortran-runtime"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-fortran-runtime-2025.3-2025.3.2-832_amd64.deb"
+sha256="1acf0feba0e85fe963be8ff358ebcea850c0be4a874af98f31ef3b9a85254522"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-shared"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-shared-2025.3-2025.3.2-832_amd64.deb"
+sha256="85f0fd9843ba5cd8d8854e101c289c1f61e0f73465afccca938cc9ce936e7a2d"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-shared-common"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-shared-common-2025.3-2025.3.2-832_all.deb"
+sha256="d07cac0683a1f9a667bae175b2649b62d9a340d4871f8d22ea3948730c10d5a5"
+
+[[hpckit-2025]]
+name="intel-oneapi-compiler-shared-runtime"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-compiler-shared-runtime-2025.3-2025.3.2-832_amd64.deb"
+sha256="1363f7350e384de53230eaad5bae6b8cfc564048b012289eb1f4f9b11d9a0dec"
+
+[[hpckit-2025]]
+name="intel-oneapi-dal"
+version="2025.10.1-19"
+file="pool/main/intel-oneapi-dal-2025.10-2025.10.1-19_amd64.deb"
+sha256="943339a9a8438132014280f304beac30ee6ff895625fa4fbd4254124bed1f7b8"
+
+[[hpckit-2025]]
+name="intel-oneapi-dal-devel"
+version="2025.10.1-19"
+file="pool/main/intel-oneapi-dal-devel-2025.10-2025.10.1-19_amd64.deb"
+sha256="631b47f87fea0da5e975cd61ebf006a3ae77170dc741dfd2a09df179257326eb"
+
+[[hpckit-2025]]
+name="intel-oneapi-dev-utilities"
+version="2025.3.1-15"
+file="pool/main/intel-oneapi-dev-utilities-2025.3-2025.3.1-15_amd64.deb"
+sha256="61ab278788edbc2ad047e8f6f63f1f73f5508b4c96cc2b05e449289061a76c7d"
+
+[[hpckit-2025]]
+name="intel-oneapi-dnnl"
+version="2025.3.0-409"
+file="pool/main/intel-oneapi-dnnl-2025.3-2025.3.0-409_amd64.deb"
+sha256="4468042a137707721be596861b4058dee5190cf3d7b3aa2c12d643228ac6360c"
+
+[[hpckit-2025]]
+name="intel-oneapi-dnnl-devel"
+version="2025.3.0-409"
+file="pool/main/intel-oneapi-dnnl-devel-2025.3-2025.3.0-409_amd64.deb"
+sha256="256cc1f2347c882a0535be552e2048f11544e1c4fa8c024ae2dcd54f2ce81e87"
+
+[[hpckit-2025]]
+name="intel-oneapi-dpcpp-cpp"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-dpcpp-cpp-2025.3-2025.3.2-832_amd64.deb"
+sha256="b36e18609d627a10fa4ca3b20e3bb34270a149175872936e6f7499bd8b873d13"
+
+[[hpckit-2025]]
+name="intel-oneapi-dpcpp-ct"
+version="2025.3.1-18"
+file="pool/main/intel-oneapi-dpcpp-ct-2025.3-2025.3.1-18_amd64.deb"
+sha256="4ee8595d886639d2baef071b7d39817b1bf94db65ced729869823331ccef3e51"
+
+[[hpckit-2025]]
+name="intel-oneapi-dpcpp-debugger"
+version="2025.3.1-7"
+file="pool/main/intel-oneapi-dpcpp-debugger-2025.3-2025.3.1-7_amd64.deb"
+sha256="e18bef111d389603228b399e280f898a72be514d4cb4ca5c9e30492640fb2db2"
+
+[[hpckit-2025]]
+name="intel-oneapi-hpc-toolkit-env"
+version="2025.3.1-52"
+file="pool/main/intel-oneapi-hpc-toolkit-env-2025.3-2025.3.1-52_all.deb"
+sha256="3ec40bd7a9e49b5abfb0fcdd94a6015baa71b8335c9a9c9b4e2ec2a35aac5e60"
+
+[[hpckit-2025]]
+name="intel-oneapi-ipp"
+version="2022.3.1-7"
+file="pool/main/intel-oneapi-ipp-2022.3-2022.3.1-7_amd64.deb"
+sha256="89c0d1ce9aac145a6e949678c17296c57ee233ff10f4443019c32fe5db5b7569"
+
+[[hpckit-2025]]
+name="intel-oneapi-ipp-devel"
+version="2022.3.1-7"
+file="pool/main/intel-oneapi-ipp-devel-2022.3-2022.3.1-7_amd64.deb"
+sha256="ebdf865d359c030ce177fbbd916e6813ed7024bce37f680c33eff64c29d90708"
+
+[[hpckit-2025]]
+name="intel-oneapi-ippcp"
+version="2025.3.0-274"
+file="pool/main/intel-oneapi-ippcp-2025.3-2025.3.0-274_amd64.deb"
+sha256="de95e2a06164443725bb0b23d6489c1b5bb65fdc34619d7eff1d01241d098c4c"
+
+[[hpckit-2025]]
+name="intel-oneapi-ippcp-devel"
+version="2025.3.0-274"
+file="pool/main/intel-oneapi-ippcp-devel-2025.3-2025.3.0-274_amd64.deb"
+sha256="1b56080646f3e508550f4cef6f7dc05f90be96c0bc3c08485176d9619aa635b7"
+
+[[hpckit-2025]]
+name="intel-oneapi-ishmem"
+version="1.5.0-222"
+file="pool/main/intel-oneapi-ishmem-1.5-1.5.0-222_amd64.deb"
+sha256="c8b97c0c7e6c8aacd532ed68fd273b7cecfa869c469a82ba1f2518619a6f4bda"
+
+[[hpckit-2025]]
+name="intel-oneapi-ishmem-devel"
+version="1.5.0-222"
+file="pool/main/intel-oneapi-ishmem-devel-1.5-1.5.0-222_amd64.deb"
+sha256="7d21e663136bd2608757c4c2607a2f9589369047e89d58e6fd03801b7931ecbf"
+
+[[hpckit-2025]]
+name="intel-oneapi-libdpstd-devel"
+version="2022.10.0-275"
+file="pool/main/intel-oneapi-libdpstd-devel-2022.10-2022.10.0-275_amd64.deb"
+sha256="b7172453b5f31fabc864d5b8793979ffd3c472b6af1dd01a434dc9ffb241474d"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-classic-include"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-classic-include-2025.3-2025.3.1-8_amd64.deb"
+sha256="4ba39c1de76e318723c35c3043f2ad6279eb13a8658955eb4c36c595cf672f9c"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-cluster"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-cluster-2025.3-2025.3.1-8_amd64.deb"
+sha256="2149ca2adb7cef318ff50ea1fd6135cf873c2c4a1f3c0e396051645d992c0e7d"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-cluster-devel"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-cluster-devel-2025.3-2025.3.1-8_amd64.deb"
+sha256="3eb204990eb328b218bbd0a178dc40e4ac3f3a4fd7578caaf00caf7f0d732e70"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-core"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-core-2025.3-2025.3.1-8_amd64.deb"
+sha256="1648440662a5146d2064456c6e7ba23b00dbe63cb4a26e3563eb43b4912ace2f"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-core-devel"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-core-devel-2025.3-2025.3.1-8_amd64.deb"
+sha256="d2efe5d549803e80c3a9b3e5e092860f0acdd2f37da0e1c12de17d2e730035e6"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-2025.3-2025.3.1-8_amd64.deb"
+sha256="d3db31980517d70ba5febee14e089ac75844a9420ffde2baa43dc6f3e7269df8"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-blas"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-blas-2025.3-2025.3.1-8_amd64.deb"
+sha256="deb413a909822c14a6ee8eb270d5edb3351dc1c2656175ef40a7f99e025e6aab"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-data-fitting"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-data-fitting-2025.3-2025.3.1-8_amd64.deb"
+sha256="ca9b47611b8e7b8503b087ca7de4ff6417325c10685d6d0254df1eb3a668aca8"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-devel"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-devel-2025.3-2025.3.1-8_amd64.deb"
+sha256="73c70ab19f76d2c4cb64686800b2682d01a79f3a686454ff6d0b5198ce5f4e0d"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-dft"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-dft-2025.3-2025.3.1-8_amd64.deb"
+sha256="e825872685f8b93130e32ca1b72d31cad808042f97f956b5e8e86065f94d29e8"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-include"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-include-2025.3-2025.3.1-8_amd64.deb"
+sha256="5fa96fb892c4b818fb176e556f3a93f99235affe0b47b7766717b9d6dcbd44ae"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-lapack"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-lapack-2025.3-2025.3.1-8_amd64.deb"
+sha256="5296ef4a969688e3af40ebd851162523e3b5d4f63fea1d2f48a8dfd6a675a0a5"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-rng"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-rng-2025.3-2025.3.1-8_amd64.deb"
+sha256="8559a0e7cdcd77f8f4e97c490b0d5e055605b21815e93d88383c53772f60c507"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-sparse"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-sparse-2025.3-2025.3.1-8_amd64.deb"
+sha256="1261ee1b3ce52dfcc642ba541953af144308b2242e57ab7a32550da51882afaf"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-stats"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-stats-2025.3-2025.3.1-8_amd64.deb"
+sha256="426fd7795f4ef278930e2ea8a0021b4ff3460ab1c826206e01a17458cca9a9ba"
+
+[[hpckit-2025]]
+name="intel-oneapi-mkl-sycl-vm"
+version="2025.3.1-8"
+file="pool/main/intel-oneapi-mkl-sycl-vm-2025.3-2025.3.1-8_amd64.deb"
+sha256="47f9a6fa7fcc9bcc98de93cfea2c92cfda45f9e86ddd8129176f527e53a7f7e9"
+
+[[hpckit-2025]]
+name="intel-oneapi-mpi"
+version="2021.17.2-91"
+file="pool/main/intel-oneapi-mpi-2021.17-2021.17.2-91_amd64.deb"
+sha256="c6a0b33e6f60471a7461ba3246e7c90ebe06d550664a0af2134bd07ffd8f6c8d"
+
+[[hpckit-2025]]
+name="intel-oneapi-mpi-devel"
+version="2021.17.2-91"
+file="pool/main/intel-oneapi-mpi-devel-2021.17-2021.17.2-91_amd64.deb"
+sha256="519088a22fad2795fc56b216298ba4b467996107f9d359b0f56f1372b02508c0"
+
+[[hpckit-2025]]
+name="intel-oneapi-openmp"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-openmp-2025.3-2025.3.2-832_amd64.deb"
+sha256="c2dd60eb82b8b63a1ae44e98bd983b1ba1c15e1c87cdf37901723120d6164a3f"
+
+[[hpckit-2025]]
+name="intel-oneapi-openmp-common"
+version="2025.3.2-832"
+file="pool/main/intel-oneapi-openmp-common-2025.3-2025.3.2-832_all.deb"
+sha256="10af13bb74bbe14ed986d15114fc00352c95c09f32da77c58f50302ef3d0215a"
+
+[[hpckit-2025]]
+name="intel-oneapi-tbb"
+version="2022.3.1-400"
+file="pool/main/intel-oneapi-tbb-2022.3-2022.3.1-400_amd64.deb"
+sha256="01ad7551130d6f30d34ed19084650ffc778d755ef4ede682345bf907bd510641"
+
+[[hpckit-2025]]
+name="intel-oneapi-tbb-devel"
+version="2022.3.1-400"
+file="pool/main/intel-oneapi-tbb-devel-2022.3-2022.3.1-400_amd64.deb"
+sha256="eb085a1930230c9eda5e6ed32ebc167e9cad7c053f9cd5623201df08a5362947"
+
+[[hpckit-2025]]
+name="intel-oneapi-tcm"
+version="1.4.1-445"
+file="pool/main/intel-oneapi-tcm-1.4-1.4.1-445_amd64.deb"
+sha256="8e2fd21ec71f9c9d41df2a23d23ea8aad7d2928ae0f66ed3de4b54dbd7b5ce78"
+
+[[hpckit-2025]]
+name="intel-oneapi-tlt"
+version="2025.3.0-157"
+file="pool/main/intel-oneapi-tlt-2025.3-2025.3.0-157_amd64.deb"
+sha256="32fdc685d8dd8c54a646491dae19262e30533ba80c994cc33579e83259f7384a"
+
+[[hpckit-2025]]
+name="intel-oneapi-umf"
+version="1.0.3-17"
+file="pool/main/intel-oneapi-umf-1.0-1.0.3-17_amd64.deb"
+sha256="0b93cf3f42df26c31713a94172b16903fabb75b03494da47b2b99d2f37ad2298"
+

pkgs/intel-oneapi/deb/patch_intel.nix

@@ -0,0 +1,167 @@
+{
+  stdenv,
+  stdenvNoCC,
+  lib,
+  symlinkJoin,
+  autoPatchelfHook,
+  wrapIntel,
+  overrideCC,
+  hwloc,
+  libelf,
+  libffi_3_3,
+  libpsm2,
+  libuuid,
+  libxml2,
+  numactl,
+  ocl-icd,
+  openssl,
+  python3,
+  rdma-core,
+  ucx,
+  zlib,
+  writeTextFile,
+}:
+
+lib.makeOverridable (
+  {
+    unpatched,
+    components ? { },
+    extraPackages ? components.extraPackages or [ ],
+  }:
+
+  let
+    inherit (builtins)
+      attrValues
+      filter
+      mapAttrs
+      removeAttrs
+      ;
+
+    inherit (components) llvmMajorVersion;
+
+    __components = removeAttrs components [
+      "extraPackages"
+      "llvmMajorVersion"
+    ];
+    _components = __components;
+    # _components = lib.traceSeqN 2 {
+    #   inherit unpatched __components;
+    #   deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
+    # } __components;
+
+    meta = {
+      homepage = "https://www.intel.com/content/www/us/en/developer/tools/oneapi/hpc-toolkit.html";
+      description = "Intel® oneAPI HPC Toolkit";
+      maintainers = with lib.maintainers.bsc; [ abonerib ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.unfree;
+    };
+
+  in
+  stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = lib.removeSuffix "-extracted" unpatched.pname;
+    inherit (unpatched) version;
+    src = unpatched;
+
+    phases = [
+      "installPhase"
+      "fixupPhase"
+    ];
+    buildInputs = [
+      libffi_3_3
+      libelf
+      libxml2
+      hwloc
+      numactl
+      libuuid
+      libpsm2
+      zlib
+      ocl-icd
+      rdma-core
+      ucx
+      openssl
+      python3
+      stdenv.cc.cc.lib
+    ]
+    ++ extraPackages;
+
+    autoPatchelfIgnoreMissingDeps = [
+      "libhwloc.so.5"
+      "libcuda.so.1"
+      "libze_loader.so.1"
+    ];
+
+    # There are broken symlinks that go outside packages, ignore them
+    dontCheckForBrokenSymlinks = true;
+
+    nativeBuildInputs = [ autoPatchelfHook ];
+    installPhase = ''
+      cp -r $src/opt/intel/oneapi/ $out
+    '';
+
+    inherit meta;
+
+    passthru =
+      let
+        pkgs = mapAttrs (
+          folder: version:
+          let
+            original = "${finalAttrs.finalPackage}/${folder}/${version}";
+
+            etc-vendors = writeTextFile {
+              name = "intel-ocl-icd";
+              text = "${original}/lib/libintelocl.so";
+              destination = "/etc/OpenCL/vendors/intel.icd";
+            };
+          in
+          symlinkJoin {
+            pname = "intel-${folder}";
+            inherit version;
+            paths = [ original ] ++ lib.optionals (folder == "compiler") [ etc-vendors ];
+            passthru = { inherit original llvmMajorVersion; };
+            inherit meta;
+          }
+        ) _components;
+      in
+      pkgs
+      // {
+        inherit unpatched;
+        pkgs = lib.recurseIntoAttrs pkgs;
+        components = _components;
+
+        # This contains all packages properly symlinked into toplevel directories
+        # in $out.
+        #
+        # NOTE: there are clashes with packages that have symlinks outside their
+        # scope (libtcm and env/vars.sh)
+        all = symlinkJoin {
+          pname = finalAttrs.finalPackage.pname + "-symlinked";
+          inherit (finalAttrs.finalPackage) version;
+          paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
+        };
+
+        stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
+
+        cc = wrapIntel {
+          cc = finalAttrs.finalPackage.pkgs.compiler;
+          extraBuildCommands = ''
+            wrap icx  $wrapper $ccPath/icx
+            wrap icpx $wrapper $ccPath/icpx
+            wrap ifx  $wrapper $ccPath/ifx
+
+            ln -s $out/bin/icpx $out/bin/c++
+            ln -s $out/bin/icx  $out/bin/cc
+
+            sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
+          '';
+
+          extraInstallCommands = ''
+            export named_cc="icx"
+            export named_cxx="icpx"
+            export named_fc="ifx"
+          '';
+        };
+      };
+
+  })
+)

pkgs/intel-oneapi/deb/update.hs

@@ -0,0 +1,282 @@
+-- Copyright (c) 2026 Barcelona Supercomputing Center (BSC)
+-- SPDX-License-Identifier: MIT
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a copy
+-- of this software and associated documentation files (the "Software"), to deal
+-- in the Software without restriction, including without limitation the rights
+-- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+-- copies of the Software, and to permit persons to whom the Software is
+-- furnished to do so, subject to the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included in
+-- all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+-- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-- SOFTWARE.
+
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module Main (main) where
+
+import Control.Arrow (first, second, (&&&))
+import Control.Monad.Writer
+
+import qualified Data.Map.Lazy as M
+import qualified Data.Map.Strict as MS
+import qualified Data.Text as T
+import qualified Data.Text.IO as TIO
+
+import Data.Char (isAlpha)
+import Data.Functor (($>))
+import Data.List (find, nub, sortOn)
+import Data.Map.Lazy (Map)
+import Data.Maybe (catMaybes, maybeToList)
+import Data.Ord (Down (Down))
+import Data.Text.Read (decimal)
+
+import System.Environment (getArgs)
+import System.Exit (exitFailure)
+import System.IO (stderr)
+import Text.Printf (hPrintf, printf)
+
+type Str = T.Text
+type Data = Map Str [Package]
+type Version = [Int]
+type Err a = Either Str a
+
+data Package = Package
+    { name :: Str
+    , version :: Version
+    , filename, sha256 :: Str
+    , size :: Int
+    , depends :: [Dependency]
+    }
+    deriving (Show, Eq)
+
+data Dependency = Dependency
+    { pkgName :: Str
+    , pkgVersion :: Maybe (Ordering', Version)
+    }
+    deriving (Show, Eq)
+
+data Kit = Kit
+    { kitMajorVersion, kitFullVersion :: Version
+    , kitPackages :: [Package]
+    }
+    deriving (Show, Eq)
+
+-- Standard Ordering cannot represent GE or LE, we have to cook our own
+data Ordering' = GT' | LT' | EQ' | GE' | LE' deriving (Show, Eq)
+
+-- PARSING
+
+parse :: Str -> Err Data
+parse =
+    fmap (M.map (sortOn (Down . version)) . M.fromListWith (++) . fmap (second pure))
+        . mapM parsePackage
+        . ( init
+                . fmap
+                    ( M.fromList
+                        . ( fmap (second (T.strip . T.drop 1) . T.breakOn ":")
+                                . T.lines
+                                . T.strip
+                          )
+                    )
+                . T.splitOn "\n\n"
+          )
+
+parseDependency :: Str -> Err Dependency
+parseDependency t = case (T.breakOn "(" t) of
+    (a, "") -> Right $ Dependency (T.strip a) Nothing
+    (a, b) -> do
+        let (o, v) = T.span (`elem` ("<=>" :: String)) $ T.tail b
+        o' <- toOrd' o
+        v' <- parseVersion . T.strip $ T.dropEnd 1 v
+        return . Dependency (T.strip a) $ Just (o', v')
+  where
+    toOrd' :: Str -> Err Ordering'
+    toOrd' ">>" = Right GT'
+    toOrd' "<<" = Right LT'
+    toOrd' "=" = Right EQ'
+    toOrd' ">=" = Right GE'
+    toOrd' "<=" = Right LE'
+    toOrd' r = Left $ T.unwords ["could not parse dependency", quote t, "(unknown constraint type", quote r <> ")"]
+
+dropEmpty :: [Str] -> [Str]
+dropEmpty = filter (not . T.null)
+
+tshow :: (Show a) => a -> Str
+tshow = T.pack . show
+
+quote :: Str -> Str
+quote = ("\"" <>) . (<> "\"")
+
+parseVersion :: Str -> Err Version
+parseVersion = (>>= validateVersion) . mapM (unwrapDecimal . decimal) . dropEmpty . T.split (`elem` ("-._~" :: String))
+  where
+    unwrapDecimal (Left err) = Left . T.pack $ "version parsing failed with error: " <> err
+    unwrapDecimal (Right (a, "")) = Right a
+    unwrapDecimal (Right (a, b)) =
+        Left $ T.unwords ["version parsing failed, parsed", quote $ tshow a, "(leftover:", quote b <> ")"]
+
+    validateVersion [] = Left "version is empty"
+    validateVersion v = Right v
+
+parsePackage :: Map Str Str -> Err (Str, Package)
+parsePackage d =
+    (,)
+        <$> package
+        <*> ( Package
+                <$> package
+                <*> (d !? "Version" >>= parseVersion)
+                <*> (d !? "Filename")
+                <*> (d !? "SHA256")
+                <*> (read . T.unpack <$> (d !? "Installed-Size"))
+                <*> (mapM parseDependency . dropEmpty . (>>= T.splitOn ",") . maybeToList $ d M.!? "Depends")
+            )
+  where
+    package = d !? "Package"
+
+(!?) :: (Show a) => Map Str a -> Str -> Err a
+m !? k = maybeToEither ("missing key " <> quote k <> " in:\n" <> tshow m) $ m M.!? k
+
+maybeToEither :: a -> Maybe b -> Either a b
+maybeToEither _ (Just b) = Right b
+maybeToEither a Nothing = Left a
+
+-- DEPENDENCY SOLVER
+
+-- Compare versions in debian control file syntax
+-- See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
+--
+-- NOTE: this is not a proper version comparison
+--
+-- A proper version solver, should aggregate dependencies with the same name
+-- and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
+--
+-- But in the intel repo, there are no such "duplicated" dependencies to specify
+-- upper limits, which leads to issues when intel-hpckit-2021 depends on things
+-- like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
+-- basekit instead of the one from 2021.1
+--
+-- To mitigate this, >= is set to take the latest version with matching major
+-- and minor (only revision and patch are allowed to change)
+
+compareVersions :: Maybe (Ordering', Version) -> Version -> Bool
+compareVersions Nothing _ = True
+compareVersions (Just (kind, want)) got
+    | null want = True
+    | kind == GE' = and (take 2 $ zipWith (==) got want) && result
+    | kind == EQ' = and $ zipWith (==) want got -- Only compare up to the smallest list
+    | otherwise = result
+  where
+    result = matches (compare got want) kind
+
+    matches :: Ordering -> Ordering' -> Bool
+    matches EQ b = b `elem` [EQ', GE', LE']
+    matches LT b = b `elem` [LT', LE']
+    matches GT b = b `elem` [GT', GE']
+
+findMatching :: Data -> Dependency -> Maybe Package
+findMatching pkgList (Dependency n v) = pkgList M.!? n >>= find (compareVersions v . version)
+
+findMatchingTraced :: Data -> Dependency -> Writer [Dependency] (Maybe Package)
+findMatchingTraced l d = case findMatching l d of
+    Nothing -> tell [d] $> Nothing
+    Just a -> pure $ Just a
+
+solveDeps :: Data -> Package -> ([Package], [Dependency])
+solveDeps d p = first removeDupes $ runWriter $ go [] [p]
+  where
+    go :: [Package] -> [Package] -> Writer [Dependency] [Package]
+    go done [] = pure done
+    go done todo = do
+        let done' = filter (not . isBlacklisted) . nub $ done ++ (filter (not . isMetaPackage) todo)
+        todo' <- catMaybes <$> mapM (findMatchingTraced d) (todo >>= depends)
+        go done' todo'
+
+    isMetaPackage = ((== 0) . size) -- Meta Packages are only used to pull dependencies
+    removeDupes :: [Package] -> [Package]
+    removeDupes = fmap snd . MS.toList . MS.fromListWith getLatest . fmap (cleanName . name &&& id)
+
+    getLatest a b
+        | version a > version b = a
+        | otherwise = b
+
+-- Remove trailing version information from package name
+cleanName :: Str -> Str
+cleanName = T.dropWhileEnd (not . isAlpha)
+
+isBlacklisted :: Package -> Bool
+isBlacklisted = (`elem` blacklist) . cleanName . name
+  where
+    blacklist =
+        [ "intel-basekit-env"
+        , "intel-basekit-getting-started"
+        , "intel-hpckit-env"
+        , "intel-hpckit-getting-started"
+        , "intel-oneapi-advisor"
+        , "intel-oneapi-common-licensing"
+        , "intel-oneapi-common-oneapi-vars"
+        , "intel-oneapi-common-vars"
+        , "intel-oneapi-compiler-cpp-eclipse-cfg"
+        , "intel-oneapi-compiler-dpcpp-eclipse-cfg"
+        , "intel-oneapi-condaindex"
+        , "intel-oneapi-dev-utilities-eclipse-cfg"
+        , "intel-oneapi-dpcpp-ct-eclipse-cfg"
+        , "intel-oneapi-eclipse-ide"
+        , "intel-oneapi-hpc-toolkit-getting-started"
+        , "intel-oneapi-icc-eclipse-plugin-cpp"
+        , "intel-oneapi-inspector"
+        , "intel-oneapi-vtune"
+        , "intel-oneapi-vtune-eclipse-plugin-vtune"
+        ]
+
+application :: [String] -> Str -> Err ([Dependency], [Kit])
+application args contents = do
+    v <- mapM (parseVersion . T.pack) $ case args of
+        [] -> ["2025"]
+        _ -> args
+
+    d <- parse contents
+    first concat . unzip <$> mapM (processKit d) v
+
+processKit :: Data -> Version -> Err ([Dependency], Kit)
+processKit d v = do
+    kit <- findHpckit "intel-hpckit"
+    let (deps, missing) = solveDeps d kit
+    return $ (missing, Kit v (version kit) deps)
+  where
+    findHpckit pName =
+        maybeToEither (T.unwords ["package not found:", pName, "=", showVer v]) $
+            findMatching d (Dependency pName (Just (EQ', v)))
+
+-- OUTPUT
+
+showVer, showVerDash :: [Int] -> Str
+showVer = T.dropEnd 1 . T.concat . zipWith (flip (<>)) ([".", ".", "-"] ++ repeat ".") . fmap tshow
+showVerDash = T.intercalate "-" . fmap tshow
+
+-- Reads Debian Package List from apt repo from stdin and outputs TOML with
+-- hpckit versions passed as arguments
+main :: IO ()
+main =
+    application <$> getArgs <*> TIO.getContents >>= \case
+        Left err -> hPrintf stderr "[ERROR]: %s\n" err *> exitFailure
+        Right (missing, kits) -> do
+            mapM_ (hPrintf stderr "[WARN] missing dependency: %s\n" . show) $ nub missing
+            mapM_ (TIO.putStrLn) $ kits >>= formatKit
+  where
+    formatKit (Kit majorVer fullVer pkgs) =
+        T.pack
+            <$> (printf "[meta.hpckit-%s]\nversion=%s\n" (showVerDash majorVer) (quote $ showVer fullVer))
+                : ((formatPackage) <$> pkgs)
+      where
+        formatPackage (Package n v f h _ _) =
+            printf "[[hpckit-%s]]\nname=%s\nversion=%s\nfile=%s\nsha256=%s\n" (showVerDash majorVer) (quote $ cleanName n) (quote $ showVer v) (quote f) (quote h)

pkgs/intel-oneapi/deb/update.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+out_64=$(mktemp intel-api.64.XXXXXX)
+out_all=$(mktemp intel-api.all.XXXXXX)
+trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
+
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
+
+cat "$out_64" "$out_all" | runghc ./update.hs 2023.1.0 2024 2025 >packages.toml

pkgs/intel-oneapi/open/default.nix

@@ -0,0 +1,246 @@
+{
+  stdenv,
+  lib,
+  ninja,
+  autoAddDriverRunpath,
+  wrapCC,
+  cmake,
+  emhash,
+  fetchFromGitHub,
+  khronos-ocl-icd-loader,
+  libbacktrace,
+  opencl-headers,
+  parallel-hashmap,
+  perl,
+  pkg-config,
+  python3,
+  spirv-headers,
+  spirv-tools,
+  symlinkJoin,
+  zlib,
+
+  config,
+
+  cudaPackages ? null,
+  enableCuda ? config.cudaSupport,
+}:
+
+let
+
+  llvmMajorVersion = "21";
+  version = "6.2.1";
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "llvm";
+    tag = "v${version}";
+    sha256 = "sha256-j8+DmGKO0qDF5JjH+DlkLKs1kBz6dS7ukwySd/Crqv0=";
+  };
+
+  pinned = {
+    inherit parallel-hashmap;
+
+    vc-intrinsics.src = fetchFromGitHub {
+      owner = "intel";
+      repo = "vc-intrinsics";
+      rev = "4e51b2467104a257c22788e343dafbdde72e28bb";
+      sha256 = "sha256-AHXeKbih4bzmcuu+tx2TeS7Ixmk54uS1vKFVxI6ZP8g=";
+    };
+
+    unified-memory-framework.src = fetchFromGitHub {
+      owner = "oneapi-src";
+      repo = "unified-memory-framework";
+      tag = "v0.11.0";
+      sha256 = "sha256-k8QdP2u1QOoeCZ6ps4sM8+1iZq/H3q0lqCfVk8mz9KI=";
+    };
+
+    ocl-headers = opencl-headers.overrideAttrs {
+      version = "2024.10.24";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "OpenCL-Headers";
+        tag = "v2024.10.24";
+        sha256 = "sha256-KDlruE0IG8d+lAChxYyc6dg5XOvqCMrMyO69sdAzejA=";
+      };
+    };
+
+    ocl-icd = khronos-ocl-icd-loader;
+
+    spirv-headers = spirv-headers.overrideAttrs {
+      version = "1.4.309.0";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "SPIRV-Headers";
+        tag = "vulkan-sdk-1.4.309.0";
+        sha256 = "sha256-Q1i6i5XimULuGufP6mimwDW674anAETUiIEvDQwvg5Y=";
+      };
+    };
+  };
+
+  fetchcontent_cmakeFlags = lib.mapAttrsToList (
+    name: value: (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_${lib.toUpper name}" (toString value.src))
+  ) pinned;
+
+  # Hack to fix #include <emhash/...>
+  emhash' = symlinkJoin {
+    name = "emhash";
+    paths = [ emhash ];
+    postBuild = ''
+      pushd $out/include
+      ln -s . emhash
+      popd
+    '';
+  };
+
+in
+stdenv.mkDerivation {
+  pname = "intel-llvm";
+  inherit src version;
+
+  enableParallelBuilding = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    perl
+    cmake
+    ninja
+    pkg-config
+    python3
+    spirv-tools
+  ]
+  ++ lib.optionals enableCuda [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = [
+    emhash'
+    libbacktrace
+    zlib
+
+    pinned.ocl-icd
+    pinned.ocl-headers
+    pinned.spirv-headers
+  ]
+  ++ lib.optionals enableCuda [
+    cudaPackages.cudatoolkit
+  ];
+
+  patches = [ ./fix-ur.patch ]; # Has been fixed in next release
+
+  preBuild = ''
+    chmod -R u+w /build/source
+  '';
+
+  cmakeDir = "../llvm";
+
+  cmakeFlags =
+    let
+      cmakeList = name: l: lib.cmakeOptionType "list" name (builtins.concatStringsSep ";" l);
+
+      LLVM_EXTERNAL_PROJECTS = [
+        "sycl"
+        "llvm-spirv"
+        "opencl"
+        "xpti"
+        "xptifw"
+        "compiler-rt"
+        "sycl-jit"
+        "libdevice"
+      ]
+      ++ lib.optionals enableCuda [
+        "libclc"
+      ];
+    in
+    [
+      (lib.cmakeBool "LLVM_ENABLE_ASSERTIONS" true)
+
+      (cmakeList "LLVM_TARGETS_TO_BUILD" (
+        [
+          "host"
+          "SPIRV"
+        ]
+        ++ lib.optionals enableCuda [ "NVPTX" ]
+      ))
+      (cmakeList "LLVM_EXTERNAL_PROJECTS" LLVM_EXTERNAL_PROJECTS)
+      (cmakeList "LLVM_ENABLE_PROJECTS" ([ "clang" ] ++ LLVM_EXTERNAL_PROJECTS))
+
+      (lib.cmakeBool "UR_USE_EXTERNAL_UMF" false)
+      (lib.cmakeOptionType "path" "UR_OPENCL_INCLUDE_DIR" (toString pinned.ocl-headers))
+      (lib.cmakeOptionType "path" "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
+      (lib.cmakeFeature "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
+
+      (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+      (lib.cmakeBool "LLVM_BUILD_TOOLS" true)
+      (lib.cmakeBool "LLVM_ENABLE_ZSTD" true)
+      (lib.cmakeBool "LLVM_USE_STATIC_ZSTD" true)
+      (lib.cmakeBool "LLVM_ENABLE_DOXYGEN" false)
+      (lib.cmakeBool "LLVM_ENABLE_LLD" false)
+      (lib.cmakeBool "LLVM_ENABLE_SPHINX" false)
+      (lib.cmakeBool "LLVM_SPIRV_ENABLE_LIBSPIRV_DIS" false)
+      (lib.cmakeBool "SYCL_ENABLE_WERROR" false)
+      (lib.cmakeBool "SYCL_INCLUDE_TESTS" false)
+      (lib.cmakeBool "SYCL_ENABLE_EXTENSION_JIT" true)
+      (lib.cmakeBool "SYCL_ENABLE_MAJOR_RELEASE_PREVIEW_LIB" false)
+      (lib.cmakeBool "SYCL_ENABLE_XPTI_TRACING" true)
+      (lib.cmakeBool "XPTI_ENABLE_WERROR" false)
+
+      (cmakeList "SYCL_ENABLE_BACKENDS" ([ "opencl" ] ++ lib.optionals enableCuda [ "cuda" ]))
+    ]
+    ++ fetchcontent_cmakeFlags
+    ++ lib.optionals enableCuda [
+      (lib.cmakeOptionType "list" "LIBCLC_TARGETS_TO_BUILD" "nvptx64--nvidiacl")
+      (lib.cmakeBool "LIBCLC_GENERATE_REMANGLED_VARIANTS" true)
+      (lib.cmakeBool "LIBCLC_NATIVECPU_HOST_TARGET" false)
+    ];
+
+  hardeningDisable = [ "zerocallusedregs" ];
+
+  postPatch =
+
+    let
+      # See the postPatch phase for details on why this is used
+      ccWrapperStub = wrapCC (
+        stdenv.mkDerivation {
+          name = "ccWrapperStub";
+          dontUnpack = true;
+          installPhase = ''
+            mkdir -p $out/bin
+            cat > $out/bin/clang-${llvmMajorVersion} <<'EOF'
+            #!/bin/sh
+            exec "$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}" "$@"
+            EOF
+            chmod +x $out/bin/clang-${llvmMajorVersion}
+            cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang
+            cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang++
+          '';
+          passthru.isClang = true;
+        }
+      );
+    in
+    ''
+      # Parts of libdevice are built using the freshly-built compiler.
+      # As it tries to link to system libraries, we need to wrap it with the
+      # usual nix cc-wrapper.
+      # Since the compiler to be wrapped is not available at this point,
+      # we use a stub that points to where it will be later on
+      # in `$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}`
+      substituteInPlace libdevice/cmake/modules/SYCLLibdevice.cmake \
+        --replace-fail "\''${clang_exe}" "${ccWrapperStub}/bin/clang++"
+    '';
+
+  passthru = {
+    inherit llvmMajorVersion;
+    inherit enableCuda cudaPackages;
+  };
+
+  meta = {
+    homepage = "https://github.com/intel/llvm";
+    description = "Intel staging area for llvm.org contribution";
+    maintainers = with lib.maintainers.bsc; [ abonerib ];
+    platforms = lib.platforms.linux;
+    license = [
+      lib.licenses.asl20
+      lib.licenses.llvm-exception
+    ];
+  };
+}

pkgs/intel-oneapi/open/fix-ur.patch

@@ -0,0 +1,23 @@
+diff --git a/unified-runtime/source/adapters/cuda/CMakeLists.txt b/unified-runtime/source/adapters/cuda/CMakeLists.txt
+index a8401c71a..2ab363926 100644
+--- a/unified-runtime/source/adapters/cuda/CMakeLists.txt
++++ b/unified-runtime/source/adapters/cuda/CMakeLists.txt
+@@ -62,14 +62,14 @@ add_library(cudadrv SHARED IMPORTED GLOBAL)
+ if (WIN32)
+   set_target_properties(
+     cudadrv PROPERTIES 
+-      IMPORTED_IMPLIB               ${CUDA_cuda_driver_LIBRARY}
+-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
++      IMPORTED_IMPLIB               "${CUDA_cuda_driver_LIBRARY}"
++      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
+   )
+ else()
+   set_target_properties(
+     cudadrv PROPERTIES 
+-      IMPORTED_LOCATION             ${CUDA_cuda_driver_LIBRARY}
+-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
++      IMPORTED_LOCATION             "${CUDA_cuda_driver_LIBRARY}"
++      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
+   )
+ endif()
+ 

pkgs/intel-oneapi/update.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o amd64-packages
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o all-packages

pkgs/libpsm2/default.nix

@@ -0,0 +1,44 @@
+{ stdenv, lib, fetchFromGitHub, numactl, pkg-config }:
+
+let
+  version = "11.2.185";
+in
+stdenv.mkDerivation {
+  pname = "libpsm2";
+  inherit version;
+
+  preConfigure= ''
+    export UDEVDIR=$out/etc/udev
+    substituteInPlace ./Makefile --replace "udevrulesdir}" "prefix}/etc/udev";
+  '';
+
+  enableParallelBuilding = true;
+
+  buildInputs = [ numactl pkg-config ];
+
+  installFlags = [ 
+    "DESTDIR=$(out)"
+    "UDEVDIR=/etc/udev"
+    "LIBPSM2_COMPAT_CONF_DIR=/etc"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "opa-psm2";
+    rev = "PSM2_${version}";
+    sha256 = "062hg4r6gz7pla9df70nqs5i2a3mp1wszmp4l0g771fykhhrxsjg";
+  };
+
+  postInstall = ''
+    mv $out/usr/* $out
+    rmdir $out/usr
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/intel/opa-psm2";
+    description = "The PSM2 library supports a number of fabric media and stacks";
+    license = with licenses; [ gpl2 bsd3 ];
+   platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.bzizou ];
+  };
+}

pkgs/llvm-ompss2/clang.nix

@@ -3,6 +3,7 @@
 , lib
 , fetchFromGitHub
 , cmake
+, ninja
 , bash
 , python3
 , perl
@@ -16,19 +17,19 @@
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/llvm-ompss/llvm-mono.git"
 , gitBranch ? "master"
-, gitCommit ? "880e2341c56bad1dc14e8c369fb3356bec19018e"
+, gitCommit ? "872ba63f86edaefc9787984ef3fae9f2f94e0124" # github-release-2025.11
 }:
 
 let
   stdenv = llvmPackages_latest.stdenv;
 
   release = rec {
-    version = "2025.06";
+    version = "2025.11";
     src = fetchFromGitHub {
       owner = "bsc-pm";
       repo = "llvm";
       rev = "refs/tags/github-release-${version}";
-      hash = "sha256-ww9PpRmtz/M9IyLiZ8rAehx2UW4VpQt+svf4XfKBzKo=";
+      hash = "sha256-UgwMTUkM9Z87dDH205swZFBeFhrcbLAxginViG40pBM=";
     };
   };
 
@@ -48,6 +49,7 @@ in stdenv.mkDerivation {
   inherit (source) src version;
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   passthru = {
     CC = "clang";
@@ -62,6 +64,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [
     bash
     cmake
+    ninja
     elfutils
     llvmPackages_latest.lld
     pkg-config

pkgs/llvm-ompss2/default.nix

@@ -3,6 +3,7 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
+, writeShellScript
 , openmp ? null
 , wrapCCWith
 , llvmPackages_latest
@@ -27,20 +28,17 @@ let
   # We need to replace the lld linker from bintools with our linker just built,
   # otherwise we run into incompatibility issues when mixing compiler and linker
   # versions.
-  bintools-unwrapped = llvmPackages_latest.tools.bintools-unwrapped.override {
+  bintools-unwrapped = llvmPackages_latest.bintools-unwrapped.override {
     lld = clangOmpss2Unwrapped;
   };
-  bintools = llvmPackages_latest.tools.bintools.override {
+  bintools = llvmPackages_latest.bintools.override {
     bintools = bintools-unwrapped;
   };
   targetConfig = stdenv.targetPlatform.config;
   inherit gcc;
   cc = clangOmpss2Unwrapped;
   gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-in wrapCCWith {
-  inherit cc bintools;
-  # extraPackages adds packages to depsTargetTargetPropagated
-  extraPackages = optional (openmp != null) openmp;
+
   extraBuildCommands = ''
     echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
     echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -57,14 +55,50 @@ in wrapCCWith {
     echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags
 
     wrap clang++  $wrapper $ccPath/clang++
-
-  '' + optionalString (openmp != null) ''
-    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
-  '' + optionalString (ompss2rt != null) ''
-    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
-    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
-  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-    echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
   '';
-}
 
+  envExports = lib.optionalString (openmp != null) ''
+      echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
+    '' + optionalString (ompss2rt != null) ''
+      echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
+      echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
+    '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
+      echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
+    '';
+
+  extraPackages = optional (openmp != null) openmp;
+
+  wrappedCC = wrapCCWith {
+    # extraPackages adds packages to depsTargetTargetPropagated
+    inherit cc bintools extraPackages;
+    extraBuildCommands = extraBuildCommands + envExports;
+  };
+
+  resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
+  in writeShellScript "remove-intel.sh" ''
+    if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
+      unset NIX_CFLAGS_COMPILE_${tconf}
+      unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
+
+      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+        echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
+      fi
+    fi
+  '';
+
+  intelExtraBuildCommands = ''
+    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
+    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
+  '';
+
+  wrappedCCIntel = wrapCCWith {
+    inherit cc bintools extraPackages;
+    # extraPackages adds packages to depsTargetTargetPropagated
+    extraBuildCommands = intelExtraBuildCommands + envExports;
+  };
+
+in wrappedCC.overrideAttrs (oldAttrs: {
+    passthru = oldAttrs.passthru // {
+      forIcpx = wrappedCCIntel;
+    };
+  })

pkgs/llvm-ompss2/openmp.nix

@@ -39,7 +39,9 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
-  ] ++ lib.optionals enableNosv [
+  ];
+
+  buildInputs = lib.optionals enableNosv [
     nosv
   ] ++ lib.optionals enableOvni [
     ovni
@@ -54,6 +56,7 @@ stdenv.mkDerivation rec {
   dontStrip = enableDebug;
 
   separateDebugInfo = true;
+  strictDeps = true;
 
   cmakeFlags = [
     "-DLIBOMP_OMPD_SUPPORT=OFF"
@@ -71,6 +74,28 @@ stdenv.mkDerivation rec {
     rm -f $out/libllvmrt/libomp.*
   '';
 
+  doInstallCheck = true;
+  # There are not cmake flags to force nOS-V, it enables it when found through
+  # pkg-config. If enableNosv is set, but we fail to find it at build time,
+  # the build will succeed but won't use nOS-V (libompv won't be created).
+  # This is a sanity check to ensure that after install we have the proper
+  # files.
+  installCheckPhase =
+    if enableNosv then
+      ''
+        test -f $out/lib/libompv.so
+        test -f $out/libllvmrt/libompv.so
+        test ! -f $out/lib/libomp.so
+        test ! -f $out/libllvmrt/libomp.so
+      ''
+    else
+      ''
+        test -f $out/lib/libomp.so
+        test -f $out/libllvmrt/libomp.so
+        test ! -f $out/lib/libompv.so
+        test ! -f $out/libllvmrt/libompv.so
+      '';
+
   passthru = {
     inherit nosv;
   };

pkgs/lmbench/default.nix

@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   enableParallelBuilding = false;
+  strictDeps = true;
 
   preBuild = ''
     makeFlagsArray+=(

pkgs/mcxx/default.nix

@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
+    broken = true;
     homepage = "https://github.com/bsc-pm/mcxx";
     description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
     maintainers = with lib.maintainers.bsc; [ rpenacob ];

pkgs/meteocat-exporter/default.nix

@@ -1,12 +1,15 @@
 { python3Packages, lib }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "meteocat-exporter";
   version = "1.0";
 
+  pyproject = true;
+
   src = ./.;
 
   doCheck = false;
+  strictDeps = true;
 
   build-system = with python3Packages; [
     setuptools

pkgs/mpich/default.nix

@@ -6,6 +6,13 @@
 , pmix
 , gfortran
 , symlinkJoin
+# Disabled when cross-compiling
+# To fix cross compilation, we should fill the values in:
+# https://github.com/pmodels/mpich/blob/main/maint/fcrosscompile/cross_values.txt.in
+# For each arch
+, enableFortran ? stdenv.hostPlatform == stdenv.buildPlatform
+, perl
+, targetPackages
 }:
 
 let
@@ -15,10 +22,13 @@ let
     paths = [ pmix.dev pmix.out ];
   };
 in mpich.overrideAttrs (old: {
-  buildInput = old.buildInputs ++ [
+  buildInputs = old.buildInputs ++ [
     libfabric
     pmixAll
   ];
+  nativeBuildInputs = old.nativeBuildInputs ++ [
+    perl
+  ];
   configureFlags = [
     "--enable-shared"
     "--enable-sharedlib"
@@ -31,10 +41,22 @@ in mpich.overrideAttrs (old: {
   ] ++ lib.optionals (lib.versionAtLeast gfortran.version "10") [
     "FFLAGS=-fallow-argument-mismatch" # https://github.com/pmodels/mpich/issues/4300
     "FCFLAGS=-fallow-argument-mismatch"
+  ] ++ lib.optionals (!enableFortran) [
+    "--disable-fortran"
   ];
+
+  preFixup = ''
+    sed -i 's:^CC=.*:CC=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' $out/bin/mpicc
+    sed -i 's:^CXX=.*:CXX=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++:' $out/bin/mpicxx
+  '' + lib.optionalString enableFortran ''
+    sed -i 's:^FC=.*:FC=${targetPackages.gfortran or gfortran}/bin/${targetPackages.gfortran.targetPrefix or gfortran.targetPrefix}gfortran:' $out/bin/mpifort
+  '';
+
   hardeningDisable = [ "all" ];
+  strictDeps = true;
 
   meta = old.meta // {
     maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
+    cross = true;
   };
 })