Do not force derviation inputs, use booleans instead

Add ompss2rt to wrapper passthru
Use explicit splicing in clang wrapper
2026-01-21 15:16:06 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:23 +01:00
98 changed files with 43317 additions and 3323 deletions
--- a/keys.nix
+++ b/keys.nix
@@ -22,9 +22,8 @@ rec {
    storage    = [ bay lake2 ];
    monitor    = [ hut ];
    login      = [ apex ];
-    services   = [ tent ];

-    system     = storage ++ monitor ++ login ++ services;
+    system     = storage ++ monitor ++ login;
    safe       = system ++ compute;
    all        = safe ++ playground;
  };
--- a/m/apex/nfs.nix
+++ b/m/apex/nfs.nix
@@ -7,7 +7,7 @@
    mountdPort = 4002;
    statdPort = 4000;
    exports = ''
-      /home 10.0.40.0/21(rw,async,no_subtree_check,no_root_squash)
+      /home 10.0.40.0/24(rw,async,no_subtree_check,no_root_squash)
      /home 10.106.0.0/24(rw,async,no_subtree_check,no_root_squash)
    '';
  };
@@ -15,19 +15,19 @@
    # Check with `rpcinfo -p`
    extraCommands = ''
      # Accept NFS traffic from compute nodes but not from the outside
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
      # Same but UDP
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept

      # Accept NFS traffic from wg0
      iptables -A nixos-fw -p tcp -i wg0 -s 10.106.0.0/24 --dport 111   -j nixos-fw-accept
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -35,7 +35,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/common/base/env.nix
+++ b/m/common/base/env.nix
@@ -2,36 +2,11 @@

 {
  environment.systemPackages = with pkgs; [
-    cmake
-    ethtool
-    file
-    freeipmi
-    git
-    gnumake
-    home-manager
-    htop
-    ipmitool
-    ldns
-    lm_sensors
-    ncdu
-    nix-diff
-    nix-index
-    nix-output-monitor
-    nixfmt-tree
-    nixos-option
-    pciutils
-    perf
-    pv
-    ripgrep
-    tcpdump
-    tmux
-    tree
-    vim
-    wget
-
+    vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
+    nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
+    ncdu perf ldns pv
    # From jungle overlay
-    nixgen
-    osumb
+    osumb nixgen
  ];

  programs.direnv.enable = true;
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -134,7 +134,7 @@
        home = "/home/Computational/varcila";
        description = "Vincent Arcila";
        group = "Computational";
-        hosts = [ "apex" "hut" "tent" "fox" "owl1" "owl2" ];
+        hosts = [ "apex" "hut" "tent" "fox" ];
        hashedPassword = "$6$oB0Tcn99DcM4Ch$Vn1A0ulLTn/8B2oFPi9wWl/NOsJzaFAWjqekwcuC9sMC7cgxEVb.Nk5XSzQ2xzYcNe5MLtmzkVYnRS1CqP39Y0";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
@@ -194,32 +194,6 @@
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
        ];
      };
-
-      emonteir = {
-        uid = 9656;
-        isNormalUser = true;
-        home = "/home/Computational/emonteir";
-        description = "Erwin Royson Monteiro";
-        group = "Computational";
-        hosts = [ "apex" "fox" ];
-        hashedPassword = "$6$0mU88zd3ZuK5NiJQ$DFWL5RMLH6esQM5UyhBCiiNryw4lDDmvJp7Usz3tmevnsiSJr6u0RsUKAnR/K8GRBFrV1.GocrgNjKjik5GY//";
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKZKot/Y3F5Wq9pQIXlCbyvQuVVeWMCsAC96Nd+LTcG erwin@Oreo"
-        ];
-      };
-
-      ssanzmar = {
-        uid = 9657;
-        isNormalUser = true;
-        home = "/home/Computational/ssanzmar";
-        description = "Sergio Sanz Martínez";
-        group = "Computational";
-        hosts = [ "apex" "fox" ];
-        hashedPassword = "$6$HUjNDJeJMmNQ6M64$laXSOZcXg6o4v2r8Jm8Xj9kmqw7veCY32po3TVDPRR4WlyxvOeqwoKr4NjlUlPPpKN55Oot3ZYHi.9iNXsH5E1";
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIELrsRRHXryrdA2ZBx5XmdGxL4DC5bmJydhBeTWQ0SQ sergio.sanz.martinez@estudiantat.upc.edu"
-        ];
-      };
    };

    groups = {
--- a/m/hut/gitlab-runner.nix
+++ b/m/hut/gitlab-runner.nix
@@ -51,7 +51,6 @@
          "/nix/store:/nix/store:ro"
          "/nix/var/nix/db:/nix/var/nix/db:ro"
          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          "/var/run/postgresql/:/var/run/postgresql/"
        ];
        dockerExtraHosts = [
          # Required to pass the proxy via hut
--- a/m/hut/ssh-robot-probes.nix
+++ b/m/hut/ssh-robot-probes.nix
@@ -6,12 +6,6 @@ let
      chmod +x $out
    ''
  ;
-  sblame-probe-script = pkgs.runCommand "sblame-probe.sh" { }
-    ''
-      cp ${./sblame-probe.sh} $out;
-      chmod +x $out
-    ''
-  ;
 in
 {
  # Use a new user to handle the SSH keys
@@ -34,17 +28,4 @@ in
      Group = "ssh-robot";
    };
  };
-
-  systemd.services.sblame-probe = {
-    description = "Daemon to report SLURM statistics via SSH";
-    path = [ pkgs.openssh pkgs.netcat ];
-    after = [ "network.target" ];
-    wantedBy = [ "default.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9967,fork EXEC:${sblame-probe-script}";
-      User = "ssh-robot";
-      Group = "ssh-robot";
-    };
-  };
 }
--- a/m/hut/monitoring.nix
+++ b/m/hut/monitoring.nix
@@ -5,7 +5,7 @@
    ../module/slurm-exporter.nix
    ../module/meteocat-exporter.nix
    ../module/upc-qaire-exporter.nix
-    ./ssh-robot-probes.nix
+    ./gpfs-probe.nix
    ../module/nix-daemon-exporter.nix
  ];

@@ -111,7 +111,6 @@
            "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
            "127.0.0.1:9341" # Slurm exporter
            "127.0.0.1:9966" # GPFS custom exporter
-            "127.0.0.1:9967" # SLURM custom exporter
            "127.0.0.1:9999" # Nix-daemon custom exporter
            "127.0.0.1:9929" # Meteocat custom exporter
            "127.0.0.1:9928" # UPC Qaire custom exporter
--- a/m/hut/nginx.nix
+++ b/m/hut/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
-      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/m/hut/postgresql.nix
+++ b/m/hut/postgresql.nix
@@ -8,14 +8,12 @@
      { name = "anavarro"; ensureClauses.superuser = true; }
      { name = "rarias";   ensureClauses.superuser = true; }
      { name = "grafana"; }
-      { name = "gitlab-runner"; }
    ];
    authentication = ''
-      #type  database     DBuser         auth-method
-      local  perftestsdb  rarias         trust
-      local  perftestsdb  anavarro       trust
-      local  perftestsdb  grafana        trust
-      local  perftestsdb  gitlab-runner  trust
+      #type  database     DBuser    auth-method
+      local  perftestsdb  rarias    trust
+      local  perftestsdb  anavarro  trust
+      local  perftestsdb  grafana   trust
    '';
  };
 }
--- a/m/hut/sblame-probe.sh
+++ b/m/hut/sblame-probe.sh
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-cat <<EOF
-HTTP/1.1 200 OK
-Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
-
-EOF
-ssh bsc015557@glogin2.bsc.es "timeout 3 command sblame -E"
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -57,7 +57,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/module/tc1-board.nix
+++ b/m/module/tc1-board.nix
@@ -1,27 +0,0 @@
-{ lib, pkgs, ... }:
-
-{
-  # Allow user access to FTDI USB device
-  services.udev.packages = lib.singleton (pkgs.writeTextFile {
-    # Needs to be < 73
-    name = "60-ftdi-tc1.rules";
-    text = ''
-      # Bus 003 Device 003: ID 0403:6011 Future Technology Devices International, Ltd FT4232H Quad HS USB-UART/FIFO IC
-      # Use := to make sure it doesn't get changed later
-      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6011", MODE:="0666"
-    '';
-    destination = "/etc/udev/rules.d/60-ftdi-tc1.rules";
-  });
-
-  # Allow access to USB for docker in GitLab runner
-  services.gitlab-runner = {
-    services.gitlab-bsc-docker = {
-      registrationFlags = [
-        # We need raw access to the USB port to reboot the board
-        "--docker-devices /dev/bus/usb/003/003"
-        # And TTY access for the serial port
-        "--docker-devices /dev/ttyUSB2"
-      ];
-    };
-  };
-}
--- a/m/tent/configuration.nix
+++ b/m/tent/configuration.nix
@@ -16,8 +16,6 @@
    ../module/p.nix
    ../module/vpn-dac.nix
    ../module/hut-substituter.nix
-    ../module/tc1-board.nix
-    ../module/ceph.nix
  ];

  # Select the this using the ID to avoid mismatches
@@ -65,13 +63,6 @@
    fsType = "ext4";
  };

-  # Mount the NFS home
-  fileSystems."/nfs/home" = {
-    device = "10.106.0.30:/home";
-    fsType = "nfs";
-    options = [ "nfsvers=3" "rsize=1024" "wsize=1024" "cto" "nofail" ];
-  };
-
  # Make a /vault/$USER directory for each user.
  systemd.services.create-vault-dirs = let
    # Take only normal users in tent
--- a/m/tent/gitea.nix
+++ b/m/tent/gitea.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-let
-  cfg = config.services.gitea;
-in
 {
  services.gitea = {
    enable = true;
@@ -29,52 +26,6 @@ in
        SENDMAIL_ARGS = "--";
      };
    };
-
-    dump = {
-      enable = false; # Do not enable NixOS module, use our custom systemd script below
-      backupDir = "/vault/backup/gitea";
-    };
-  };
-
-  systemd.services.gitea-backup = let
-    exe = lib.getExe cfg.package;
-  in {
-    description = "Gitea daily backup";
-    after = [ "gitea.service" ];
-    path = [ cfg.package ];
-
-    environment = {
-      USER = cfg.user;
-      HOME = cfg.stateDir;
-      GITEA_WORK_DIR = cfg.stateDir;
-      GITEA_CUSTOM = cfg.customDir;
-    };
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = cfg.user;
-      WorkingDirectory = cfg.dump.backupDir;
-    };
-
-    script = ''
-      name="gitea-dump-$(date +%a).${cfg.dump.type}"
-      ${exe} dump --type ${cfg.dump.type} --file - >"$name.tmp"
-      mv "$name.tmp" "$name"
-      cp "$name" "/ceph/backup/gitea/$name"
-    '';
-  };
-
-  # Create also the /ceph directories if needed
-  systemd.tmpfiles.rules = [
-    "d /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-    "z /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-  ];
-
-  systemd.timers.gitea-backup = {
-    description = "Update timer for gitea-backup";
-    partOf = [ "gitea-backup.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig.OnCalendar = cfg.dump.interval;
  };

  # Allow gitea user to send mail
--- a/m/tent/gitlab-runner.nix
+++ b/m/tent/gitlab-runner.nix
@@ -43,7 +43,6 @@
        registrationFlags = [
          # Increase build log length to 64 MiB
          "--output-limit 65536"
-          "--docker-network-mode host"
        ];
        preBuildScript = pkgs.writeScript "setup-container" ''
          mkdir -p -m 0755 /nix/var/log/nix/drvs
--- a/m/tent/nginx.nix
+++ b/m/tent/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
-      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/m/weasel/configuration.nix
+++ b/m/weasel/configuration.nix
@@ -25,7 +25,7 @@
      address = "10.0.40.6";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.6";
      prefixLength = 24;
    } ];
--- a/overlay.nix
+++ b/overlay.nix
@@ -12,19 +12,14 @@ let
    bench6 = callPackage ./pkgs/bench6/default.nix { };
    bigotes = callPackage ./pkgs/bigotes/default.nix { };
    clangOmpss2 = callPackage ./pkgs/llvm-ompss2/default.nix { };
-    clangOmpss2Nanos6 = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nanos6; };
-    clangOmpss2Nodes = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmp; };
-    clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmpv; };
+    clangOmpss2Nanos6 = callPackage ./pkgs/llvm-ompss2/default.nix { useNanos6 = true; };
+    clangOmpss2Nodes = callPackage ./pkgs/llvm-ompss2/default.nix { useNodes = true; useOpenmp = true; };
+    clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { useNodes = true; useOpenmpV = true; };
    clangOmpss2Unwrapped = callPackage ./pkgs/llvm-ompss2/clang.nix { };
    cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
    #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
    gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
-    gromacs = callPackage ./pkgs/gromacs/default.nix { enableSYCL = true; };
-    intel-apt = callPackage ./pkgs/intel-oneapi/packages.nix { };
    intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
-    intelPackages_2024 = final.intel-apt.hpckit_2024;
-    intelPackages_2025 = final.intel-apt.hpckit_2025;
-    intelPackages = final.intelPackages_2025;
    jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
    # FIXME: Extend this to all linuxPackages variants. Open problem, see:
    # https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
@@ -34,8 +29,6 @@ let
    linuxPackages_latest = prev.linuxPackages_latest.extend(_final: _prev: {
      amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
    });
-    llvm-intel-unwrapped = callPackage ./pkgs/llvm-intel/default.nix { };
-    llvm-intel = callPackage ./pkgs/llvm-intel/wrapped.nix { };
    lmbench = callPackage ./pkgs/lmbench/default.nix { };
    # Broken and unmantained
    # mcxx = callPackage ./pkgs/mcxx/default.nix { };
@@ -46,33 +39,29 @@ let
    nanos6Debug = final.nanos6.override { enableDebug = true; };
    nixtools = callPackage ./pkgs/nixtools/default.nix { };
    nixgen = callPackage ./pkgs/nixgen/default.nix { };
-    nix-portable = callPackage ./pkgs/nix-portable/default.nix { };
-    nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
+    # Broken because of pkgsStatic.libcap
+    # See: https://github.com/NixOS/nixpkgs/pull/268791
+    #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
    nodes = callPackage ./pkgs/nodes/default.nix { };
    nosv = callPackage ./pkgs/nosv/default.nix { };
-    oneMath = callPackage ./pkgs/onemath/default.nix { };
    openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
    openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
    osumb = callPackage ./pkgs/osu/default.nix { };
    ovni = callPackage ./pkgs/ovni/default.nix { };
    ovniGit = final.ovni.override { useGit = true; };
+    papi = callPackage ./pkgs/papi/default.nix { papi = prev.papi; };
    paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
-    pocl = callPackage ./pkgs/pocl/default.nix { };
-    pocl-noicd = callPackage ./pkgs/pocl/default.nix { enableICD = false; };
    prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
    #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
    #psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
    slurm = import ./pkgs/slurm/default.nix { slurm = prev.slurm; };
    sonar = callPackage ./pkgs/sonar/default.nix { };
-    stdenvClangOmpss2 = final.stdenv.override { cc = final.clangOmpss2; allowedRequisites = null; };
-    stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.clangOmpss2Nanos6; allowedRequisites = null; };
-    stdenvClangOmpss2Nodes = final.stdenv.override { cc = final.clangOmpss2Nodes; allowedRequisites = null; };
-    stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
+    stdenvClangOmpss2 = final.stdenv.override { cc = final.buildPackages.clangOmpss2; allowedRequisites = null; };
+    stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.buildPackages.clangOmpss2Nanos6; allowedRequisites = null; };
+    stdenvClangOmpss2Nodes = final.stdenv.override { cc = final.buildPackages.clangOmpss2Nodes; allowedRequisites = null; };
+    stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.buildPackages.clangOmpss2NodesOmpv; allowedRequisites = null; };
    tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
    tampi = callPackage ./pkgs/tampi/default.nix { };
-    tasycl = callPackage ./pkgs/tasycl/default.nix { };
-    tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
-    unified-runtime = callPackage ./pkgs/unified-runtime/default.nix { };
    upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
    wxparaver = callPackage ./pkgs/paraver/default.nix { };
  };
@@ -82,13 +71,6 @@ let
    #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
    hello-c = callPackage ./test/compilers/hello-c.nix { };
    hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
-    hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
-    hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
-    hello-sycl-pocl = (callPackage ./test/compilers/hello-sycl.nix { }).withPocl;
-    hello-sycl-intel = (callPackage ./test/compilers/hello-sycl.nix { }).withIntel;
-    hello-syclompss-pocl = (callPackage ./test/compilers/icpx-ompss2.nix { }).withPocl;
-    hello-syclompss-intel = (callPackage ./test/compilers/icpx-ompss2.nix { }).withIntel;
-
    lto = callPackage ./test/compilers/lto.nix { };
    asan = callPackage ./test/compilers/asan.nix { };
    intel2023-icx-c   = hello-c.override   { stdenv = final.intelPackages_2023.stdenv; };
@@ -98,13 +80,6 @@ let
    intel2023-ifort   = callPackage ./test/compilers/hello-f.nix {
      stdenv = final.intelPackages_2023.stdenv-ifort;
    };
-    intel2024-icx-c   = hello-c.override   { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-c   = hello-c.override   { stdenv = final.intelPackages_2025.stdenv; };
-    intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
-    # intel2023-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
-    intel2024-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2024; };
-    intel2025-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2025; };
    clangOmpss2-lto   = lto.override       { stdenv = final.stdenvClangOmpss2Nanos6; };
    clangOmpss2-asan  = asan.override      { stdenv = final.stdenvClangOmpss2Nanos6; };
    clangOmpss2-task  = callPackage ./test/compilers/ompss2.nix {
@@ -122,15 +97,6 @@ let
    clangNosvOmpv-ld = callPackage ./test/compilers/clang-openmp-ld.nix {
      stdenv = final.stdenvClangOmpss2NodesOmpv;
    };
-
-    ocl-build = callPackage ./test/compilers/opencl.nix { };
-    ocl-build-noicd = callPackage ./test/compilers/opencl.nix { ocl-icd = final.pocl-noicd; };
-
-    pocl = callPackage ./test/compilers/pocl.nix { };
-    ocl-run-pocl = ocl-build.test-icd;
-    ocl-run-pocl-noicd = ocl-build-noicd.test-noicd;
-
-    sycl-ls = callPackage ./test/compilers/sycl-ls.nix { };
  };

  # For now, only build toplevel packages in CI/Hydra
--- a/pkgs/amd-uprof/default.nix
+++ b/pkgs/amd-uprof/default.nix
@@ -1,6 +1,8 @@
 { stdenv
 , lib
-, fetchurl
+, curl
+, cacert
+, runCommandLocal
 , autoPatchelfHook
 , elfutils
 , glib
@@ -24,23 +26,28 @@ let
  tarball = "AMDuProf_Linux_x64_${version}.tar.bz2";

  # NOTE: Remember to update the radare2 patch below if AMDuProfPcm changes.
-  src = fetchurl {
-    url = "https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}";
-    sha256 = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
-    curlOptsList = [
-      "-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
-      "-H" "'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'"
-      "-H" "Accept-Language: en-US,en;q=0.5"
-      "-H" "Accept-Encoding: gzip, deflate, br, zstd"
-      "-H" "Referer: https://www.amd.com/"
-    ];
-  };
+  uprofSrc = runCommandLocal tarball {
+    nativeBuildInputs = [ curl ];
+    outputHash = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
+    SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt";
+  } ''
+    curl \
+    -o $out \
+    'https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}' \
+    -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0' \
+    -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
+    -H 'Accept-Language: en-US,en;q=0.5' \
+    -H 'Accept-Encoding: gzip, deflate, br, zstd' \
+    -H 'Referer: https://www.amd.com/' 2>&1 | tr '\r' '\n'
+  '';

 in
  stdenv.mkDerivation {
    pname = "AMD-uProf";
-    inherit src version;
+    inherit version;
+    src = uprofSrc;
    dontStrip = true;
+    strictDeps = true;
    phases = [ "installPhase" "fixupPhase" ];
    nativeBuildInputs = [ autoPatchelfHook radare2 ];
    buildInputs = [
--- a/pkgs/amd-uprof/driver.nix
+++ b/pkgs/amd-uprof/driver.nix
@@ -18,6 +18,7 @@ in stdenv.mkDerivation {
    set +x
  '';
  hardeningDisable = [ "pic" "format" ];
+  strictDeps = true;
  nativeBuildInputs = kernel.moduleBuildDependencies;
  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
  makeFlags = [
--- a/pkgs/bench6/default.nix
+++ b/pkgs/bench6/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
  ];
  hardeningDisable = [ "all" ];
  dontStrip = true;
+  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/bench6";
--- a/pkgs/bigotes/default.nix
+++ b/pkgs/bigotes/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation {
  };
  nativeBuildInputs = [ cmake ];

+  strictDeps = true;
+
  meta = {
    homepage = "https://github.com/rodarima/bigotes";
    description = "Versatile benchmark tool";
--- a/pkgs/cudainfo/default.nix
+++ b/pkgs/cudainfo/default.nix
@@ -10,11 +10,14 @@
 stdenv.mkDerivation (finalAttrs: {
  name = "cudainfo";
  src = ./.;
-  buildInputs = [
+  strictDeps = true;
+  nativeBuildInputs = [
    cudatoolkit # Required for nvcc
-    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
    autoAddDriverRunpath
  ];
+  buildInputs = [
+    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+  ];
  installPhase = ''
    mkdir -p $out/bin
    cp -a cudainfo $out/bin
@@ -23,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
    name = "cudainfo-test";
    requiredSystemFeatures = [ "cuda" ];
    dontBuild = true;
+    strictDeps = true;
    nativeCheckInputs = [
      finalAttrs.finalPackage # The cudainfo package from above
      strace # When it fails, it will show the trace
--- a/pkgs/extrae/default.nix
+++ b/pkgs/extrae/default.nix
@@ -20,7 +20,7 @@
 #, python3Packages
 , installShellFiles
 , symlinkJoin
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 }:

 let
--- a/pkgs/gpi-2/default.nix
+++ b/pkgs/gpi-2/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
  };

  enableParallelBuilding = true;
+  strictDeps = true;

  patches = [ ./rdma-core.patch ./max-mem.patch ];

--- a/pkgs/gromacs/default.nix
+++ b/pkgs/gromacs/default.nix
@@ -1,190 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  hwloc,
-  fftw,
-  perl,
-  blas,
-  lapack,
-  llvmPackages,
-  intelPackages ? null,
-  mpi,
-  cudaPackages,
-  plumed,
-  singlePrec ? true,
-  config,
-  enableSYCL ? false,
-  enableCuda ? config.cudaSupport,
-  enableMpi ? false,
-  enablePlumed ? false,
-  cpuAcceleration ? null,
-}:
-
-# CUDA is only implemented for single precission
-assert enableCuda -> singlePrec;
-
-assert !(enableSYCL && enableCuda);
-
-assert enableSYCL -> intelPackages != null;
-
-let
-  inherit (cudaPackages.flags) cmakeCudaArchitecturesString;
-
-  # Select reasonable defaults for all major platforms
-  # The possible values are defined in CMakeLists.txt:
-  # AUTO None SSE2 SSE4.1 AVX_128_FMA AVX_256 AVX2_256
-  # AVX2_128 AVX_512 AVX_512_KNL MIC ARM_NEON ARM_NEON_ASIMD
-  SIMD =
-    x:
-    if (cpuAcceleration != null) then
-      x
-    else if stdenv.hostPlatform.system == "i686-linux" then
-      "SSE2"
-    else if stdenv.hostPlatform.system == "x86_64-linux" then
-      "SSE4.1"
-    else if stdenv.hostPlatform.system == "x86_64-darwin" then
-      "SSE4.1"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then
-      "ARM_NEON_ASIMD"
-    else
-      "None";
-
-  source =
-    if enablePlumed then
-      {
-        version = "2024.2";
-        hash = "sha256-gCp+M18uiVdw9XsVnk7DaOuw/yzm2sz3BsboAlw2hSs=";
-      }
-    else
-      {
-        version = "2025.3";
-        hash = "sha256-i9/KAmjz8Qp8o8BuWbYvc+oCQgxnIRwP85EvMteDPGU=";
-      };
-
-  stdenv' = if enableSYCL then intelPackages.stdenv else stdenv;
-
-in
-stdenv'.mkDerivation rec {
-  pname = "gromacs";
-  version = source.version;
-
-  src = fetchurl {
-    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    inherit (source) hash;
-  };
-
-  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
-
-  postPatch = lib.optionalString enablePlumed ''
-    plumed patch -p -e gromacs-${source.version}
-  '';
-
-  outputs = [
-    "out"
-    "dev"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    cmake
-  ]
-  ++ lib.optional enablePlumed plumed
-  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
-
-  env.MKLROOT = intelPackages.mkl;
-
-  buildInputs = [
-    fftw
-    perl
-    hwloc
-    blas
-    lapack
-  ]
-  ++ lib.optional enableMpi mpi
-  ++ lib.optionals enableCuda [
-    cudaPackages.cuda_cccl
-    cudaPackages.cuda_cudart
-    cudaPackages.libcufft
-    cudaPackages.cuda_profiler_api
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
-
-  propagatedBuildInputs = lib.optional enableMpi mpi;
-  propagatedUserEnvPkgs = lib.optional enableMpi mpi;
-
-  cmakeFlags = [
-    (lib.cmakeBool "GMX_HWLOC" true)
-    "-DGMX_SIMD:STRING=${SIMD cpuAcceleration}"
-    "-DGMX_OPENMP:BOOL=TRUE"
-    "-DBUILD_SHARED_LIBS=ON"
-  ]
-  ++ (
-    if singlePrec then
-      [
-        "-DGMX_DOUBLE=OFF"
-      ]
-    else
-      [
-        "-DGMX_DOUBLE=ON"
-        "-DGMX_DEFAULT_SUFFIX=OFF"
-      ]
-  )
-  ++ (
-    if enableMpi then
-      [
-        "-DGMX_MPI:BOOL=TRUE"
-        "-DGMX_THREAD_MPI:BOOL=FALSE"
-      ]
-    else
-      [
-        "-DGMX_MPI:BOOL=FALSE"
-      ]
-  )
-  ++ (lib.optionals enableSYCL [
-    "-DGMX_GPU=SYCL"
-    "-DGMX_OPENMP=OFF" # TODO: enable OpenMP with SYCL?
-  ])
-  ++ lib.optionals enableCuda [
-    "-DGMX_GPU=CUDA"
-    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cmakeCudaArchitecturesString)
-
-    # Gromacs seems to ignore and override the normal variables, so we add this ad hoc:
-    (lib.cmakeFeature "GMX_CUDA_TARGET_COMPUTE" cmakeCudaArchitecturesString)
-  ];
-
-  postInstall = ''
-    moveToOutput share/cmake $dev
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.gromacs.org";
-    license = licenses.lgpl21Plus;
-    description = "Molecular dynamics software package";
-    longDescription = ''
-      GROMACS is a versatile package to perform molecular dynamics,
-      i.e. simulate the Newtonian equations of motion for systems
-      with hundreds to millions of particles.
-
-      It is primarily designed for biochemical molecules like
-      proteins, lipids and nucleic acids that have a lot of
-      complicated bonded interactions, but since GROMACS is
-      extremely fast at calculating the nonbonded interactions (that
-      usually dominate simulations) many groups are also using it
-      for research on non-biological systems, e.g. polymers.
-
-      GROMACS supports all the usual algorithms you expect from a
-      modern molecular dynamics implementation, (check the online
-      reference or manual for details), but there are also quite a
-      few features that make it stand out from the competition.
-
-      See: https://www.gromacs.org/about.html for details.
-    '';
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      sheepforce
-      markuskowa
-    ];
-  };
-}
--- a/pkgs/gromacs/pkgconfig-2024.patch
+++ b/pkgs/gromacs/pkgconfig-2024.patch
@@ -1,24 +0,0 @@
-diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
-index 646787cb53..9b97ad57f7 100644
--- a/src/external/muparser/muparser.pc.in
-+++ b/src/external/muparser/muparser.pc.in
-@@ -1,7 +1,5 @@
-prefix=@CMAKE_INSTALL_PREFIX@
-exec_prefix=${prefix}
-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PACKAGE_NAME@
- Description: Mathematical expressions parser library
-diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
-index ec1ed6684e..ca1105474a 100644
--- a/src/gromacs/libgromacs.pc.cmakein
-+++ b/src/gromacs/libgromacs.pc.cmakein
-@@ -1,4 +1,4 @@
-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
- 
- Name: libgromacs@GMX_LIBS_SUFFIX@
- Description: Gromacs library
--- a/pkgs/gromacs/pkgconfig-2025.patch
+++ b/pkgs/gromacs/pkgconfig-2025.patch
@@ -1,36 +0,0 @@
-diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
-index 646787cb53..d26e84de8f 100644
--- a/src/external/muparser/muparser.pc.in
-+++ b/src/external/muparser/muparser.pc.in
-@@ -1,11 +1,9 @@
-prefix=@CMAKE_INSTALL_PREFIX@
-exec_prefix=${prefix}
-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-
-Name: @PACKAGE_NAME@
-Description: Mathematical expressions parser library
-Version: @MUPARSER_VERSION@
-Requires:
-Libs: -L${libdir} -lmuparser
-Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
-+
-+Name: @PACKAGE_NAME@
-+Description: Mathematical expressions parser library
-+Version: @MUPARSER_VERSION@
-+Requires:
-+Libs: -L${libdir} -lmuparser
-+Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
-diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
-index af9b5a6dc0..5f58d549bf 100644
--- a/src/gromacs/libgromacs.pc.cmakein
-+++ b/src/gromacs/libgromacs.pc.cmakein
-@@ -1,5 +1,4 @@
-prefix=@CMAKE_INSTALL_PREFIX@
-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-
- Name: libgromacs@GMX_LIBS_SUFFIX@
- Description: Gromacs library
--- a/pkgs/intel-oneapi/2023.nix
+++ b/pkgs/intel-oneapi/2023.nix
@@ -40,19 +40,45 @@ let
    mpi      = "2021.9.0";
  };

-  findMatch = name:
-  let
-    aptPackages = builtins.fromJSON (builtins.readFile ./packages.json);
-    matches = lib.filter (x: name == x.pname) aptPackages;
-    n = lib.length matches;
-    match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
+  aptPackageIndex = stdenv.mkDerivation {
+    name = "intel-oneapi-packages";
+    srcs = [
+      # Run update.sh to update the package lists
+      ./amd64-packages ./all-packages
+    ];
+    phases = [ "installPhase" ];
+    installPhase = ''
+      awk -F': ' '\
+        BEGIN   { print "[ {" } \
+        NR>1 && /^Package: / { print "} {"; } \
+        /: /    { printf "%s = \"%s\";\n", $1, $2 } \
+        END     { print "} ]" }' $srcs > $out
+    '';
+  };

-    apthost = "https://apt.repos.intel.com/oneapi/";
+  aptPackages = import aptPackageIndex;
+
+  apthost = "https://apt.repos.intel.com/oneapi/";
+
+  getSum = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #n = lib.length matches;
+    #match = builtins.trace (name + " -- ${builtins.toString n}") (lib.elemAt matches 0);
+    match = lib.elemAt matches 0;
  in
-    {
-      url = apthost + match.filename;
-      sha256 = match.sha256;
-    };
+    match.SHA256;
+
+  getUrl = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #match = assert lib.length matches == 1; lib.elemAt matches 0;
+    n = lib.length matches;
+    match =
+      #builtins.trace (name + " -- n=${builtins.toString n}")
+      (lib.elemAt matches 0);
+  in
+    apthost + match.Filename;

  uncompressDebs = debs: name: stdenv.mkDerivation {
    name = name;
@@ -72,7 +98,10 @@ let

  joinDebs = name: names:
  let
-    debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
+    urls = builtins.map (x: getUrl aptPackages x) names;
+    sums = builtins.map (x: getSum aptPackages x) names;
+    getsrc = url: sha256: builtins.fetchurl { inherit url sha256; };
+    debs = lib.zipListsWith getsrc urls sums;
  in
    uncompressDebs debs "${name}-source";

@@ -99,6 +128,7 @@ let

    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;
    installPhase = ''
      mkdir -p $out/{bin,etc,lib,include}
      mkdir -p $out/share/man
@@ -150,6 +180,7 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];

@@ -193,6 +224,7 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];

@@ -260,6 +292,7 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
+    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib,include}
@@ -348,6 +381,7 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
+    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib}
@@ -441,7 +475,7 @@ let
    '';
  };

-  ifort-wrapper = wrapIntel {
+  ifort-wrapper = wrapIntel rec {
    cc = intel-compiler-fortran;
    mygcc = gcc;
    extraBuild = ''
--- a/pkgs/intel-oneapi/all-packages
+++ b/pkgs/intel-oneapi/all-packages
--- a/pkgs/intel-oneapi/amd64-packages
+++ b/pkgs/intel-oneapi/amd64-packages
--- a/pkgs/intel-oneapi/packages.json
+++ b/pkgs/intel-oneapi/packages.json
--- a/pkgs/intel-oneapi/packages.nix
+++ b/pkgs/intel-oneapi/packages.nix
@@ -1,297 +0,0 @@
-{
-  lib,
-  stdenv,
-  callPackage,
-  dpkg,
-  fetchurl,
-
-  sqlite,
-  elfutils,
-}:
-
-let
-  inherit (builtins)
-    attrNames
-    attrValues
-    concatMap
-    elem
-    filter
-    fromJSON
-    getAttr
-    groupBy
-    head
-    isNull
-    listToAttrs
-    map
-    mapAttrs
-    readFile
-    replaceStrings
-    splitVersion
-    ;
-  inherit (lib)
-    converge
-    findFirst
-    groupBy'
-    hasPrefix
-    optional
-    pipe
-    take
-    toInt
-    toList
-    versionAtLeast
-    versionOlder
-    ;
-
-  aptData = fromJSON (readFile ./packages.json);
-
-  # Compare versions in debian control file syntax
-  # See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
-  #
-  # NOTE: this is not a proper version comparison
-  #
-  # A proper version solver, should aggregate dependencies with the same name
-  # and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
-  #
-  # But in the intel repo, there are no such "duplicated" dependencies to specify
-  # upper limits, which leads to issues when intel-hpckit-2021 depends on things
-  # like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
-  # basekit instead of the one from 2021.
-  #
-  # To mitigate this, >= is set to take the latest version with matching major
-  # and minor (only revision and patch are allowed to change)
-  compareVersions =
-    got: kind: want:
-    let
-      g0 = take 2 (splitVersion got);
-      w0 = take 2 (splitVersion want);
-    in
-    if isNull want then
-      true
-    else if kind == "=" then
-      got == want
-    else if kind == "<<" then
-      versionOlder got want
-    else if kind == "<=" then
-      versionAtLeast want got
-    else if kind == ">>" then
-      versionOlder want got
-    else if kind == ">=" then
-      (g0 == w0) && versionAtLeast got want # always match major version
-    else
-      throw "unknown operation: ${kind}";
-
-  findMatching =
-    {
-      pname,
-      kind,
-      version,
-    }:
-    findFirst (x: pname == x.pname && compareVersions x.version kind version) null aptData;
-
-  isIntel = pkg: (hasPrefix "intel-" pkg.pname);
-
-  expandDeps =
-    pkg: (map findMatching (filter isIntel pkg.dependencies)) ++ (optional (pkg.size != 0) pkg);
-
-  # get the oldest by major version. If they have the same major version, take
-  # the newest. This prevents most issues with resolutions
-  # versionOlder b a -> true if b is older than a (b `older` a)
-  getNewerInMajor =
-    a: b:
-    let
-      va = a.version;
-      vb = b.version;
-      va0 = head (splitVersion va);
-      vb0 = head (splitVersion vb);
-    in
-    if isNull a then
-      b
-    else if va0 != vb0 then
-      if va0 > vb0 then b else a
-    else if versionOlder vb va then
-      a
-    else
-      b;
-  removeDups = l: attrValues (groupBy' getNewerInMajor null (getAttr "provides") l);
-
-  _resolveDeps = converge (l: removeDups (concatMap expandDeps l));
-  resolveDeps =
-    pkg:
-    let
-      deps = _resolveDeps (toList pkg);
-      namedDeps = (map (x: "${x.pname}-${x.version}") deps);
-    in
-    builtins.traceVerbose (builtins.deepSeq namedDeps namedDeps) deps;
-
-  blacklist = [
-    "intel-basekit-env"
-    "intel-basekit-getting-started"
-    "intel-hpckit-env"
-    "intel-hpckit-getting-started"
-    "intel-oneapi-advisor"
-    "intel-oneapi-common-licensing"
-    "intel-oneapi-common-oneapi-vars"
-    "intel-oneapi-common-vars"
-    "intel-oneapi-compiler-cpp-eclipse-cfg"
-    "intel-oneapi-compiler-dpcpp-eclipse-cfg"
-    "intel-oneapi-condaindex"
-    "intel-oneapi-dev-utilities-eclipse-cfg"
-    "intel-oneapi-dpcpp-ct-eclipse-cfg"
-    "intel-oneapi-eclipse-ide"
-    "intel-oneapi-hpc-toolkit-getting-started"
-    "intel-oneapi-icc-eclipse-plugin-cpp"
-    "intel-oneapi-vtune"
-    "intel-oneapi-vtune-eclipse-plugin-vtune"
-  ];
-
-  isInBlacklist = pkg: elem pkg.provides blacklist;
-  removeBlacklist = filter (e: !(isInBlacklist e));
-
-  dpkgExtractAll =
-    pname: version:
-    { srcs, deps }:
-    stdenv.mkDerivation {
-      inherit pname version srcs;
-
-      nativeBuildInputs = [ dpkg ];
-      phases = [ "installPhase" ];
-
-      passthru = { inherit deps; };
-
-      installPhase = ''
-        mkdir -p $out
-        for src in $srcs; do
-          echo "Unpacking $src"
-          dpkg -x $src $out
-        done
-      '';
-    };
-
-  apthost = "https://apt.repos.intel.com/oneapi/";
-  fetchDeb =
-    p:
-    fetchurl {
-      url = apthost + p.filename;
-      inherit (p) sha256;
-    };
-
-  buildIntel =
-    pkg:
-    pipe pkg [
-      resolveDeps
-      removeBlacklist
-      (l: {
-        srcs = map fetchDeb l;
-        deps = l;
-      })
-      (dpkgExtractAll "${pkg.provides}-extracted" pkg.version)
-    ];
-
-  findHpcKit =
-    year:
-    findMatching {
-      pname = "intel-hpckit";
-      kind = "<<";
-      version = toString (year + 1);
-    };
-  years = map toInt (attrNames components);
-
-  patchIntel = callPackage ./patch_intel.nix { };
-
-  # Version information for each hpckit. This is used to normalize the paths
-  # so that files are in $out/{bin,lib,include...} instead of all over the place
-  # in $out/opt/intel/oneapi/*/*/{...}.
-  #
-  # The most important is the compiler component, which is used to build the
-  # stdenv for the hpckit.
-  #
-  # NOTE: this have to be manually specified, so we can avoid IFD. To add a
-  # new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
-  # build hpckit_2026.unpatched and use the values from
-  # result/opt/intel/oneapi/* to populate the attrset.
-  #
-  # WARN: if there are more than one version in the folders of the unpatched
-  # components, our dependency resolution hacks have probably failed and the
-  # package set may be broken.
-  components = {
-    "2025" = {
-      ishmem = "1.4";
-      pti = "0.13";
-      tcm = "1.4";
-      umf = "0.11";
-
-      ccl = "2021.16";
-      compiler = "2025.2";
-      dal = "2025.8";
-      debugger = "2025.2";
-      dev-utilities = "2025.2";
-      dnnl = "2025.2";
-      dpcpp-ct = "2025.2";
-      dpl = "2022.9";
-      ipp = "2022.2";
-      ippcp = "2025.2";
-      mkl = "2025.2";
-      mpi = "2021.16";
-      tbb = "2022.2";
-    };
-    "2024" = {
-      tcm = "1.1";
-
-      ccl = "2021.13";
-      compiler = "2024.2";
-      dal = "2024.6";
-      debugger = "2024.2";
-      dev-utilities = "2024.2";
-      diagnostics = "2024.2";
-      dnnl = "2024.2";
-      dpcpp-ct = "2024.2";
-      dpl = "2022.6";
-      ipp = "2021.12";
-      ippcp = "2021.12";
-      mkl = "2024.2";
-      mpi = "2021.13";
-      tbb = "2021.13";
-
-      extraPackages = [
-        sqlite
-        elfutils
-      ];
-    };
-  };
-
-  replaceDots = replaceStrings [ "." ] [ "_" ];
-
-in
-lib.recurseIntoAttrs (
-  listToAttrs (
-    map (
-      year:
-      let
-        year_str = toString year;
-      in
-      {
-        name = "hpckit_${year_str}";
-        value = patchIntel {
-          unpatched = buildIntel (findHpcKit year);
-          components = components.${year_str};
-        };
-      }
-    ) years
-  )
-)
-// {
-  apt = pipe aptData [
-    (groupBy (p: replaceDots p.provides))
-    (mapAttrs (
-      _: l:
-      listToAttrs (
-        map (pkg: {
-          name = replaceDots ("v" + pkg.version);
-          value = pkg;
-        }) l
-      )
-    ))
-  ];
-
-  inherit resolveDeps patchIntel buildIntel;
-}
--- a/pkgs/intel-oneapi/patch_intel.nix
+++ b/pkgs/intel-oneapi/patch_intel.nix
@@ -1,201 +0,0 @@
-{
-  stdenv,
-  stdenvNoCC,
-  lib,
-  symlinkJoin,
-  autoPatchelfHook,
-  wrapCCWith,
-  overrideCC,
-  gcc,
-  hwloc,
-  libelf,
-  libgcc,
-  libffi_3_3,
-  libpsm2,
-  libuuid,
-  libxml2,
-  numactl,
-  ocl-icd,
-  openssl,
-  python3,
-  rdma-core,
-  ucx,
-  zlib,
-  writeTextFile,
-}:
-
-lib.makeOverridable (
-  {
-    unpatched,
-    components ? { },
-    extraPackages ? components.extraPackages or [ ],
-  }:
-
-  let
-    inherit (builtins)
-      attrValues
-      filter
-      mapAttrs
-      removeAttrs
-      ;
-
-    __components = removeAttrs components [ "extraPackages" ];
-    _components = __components;
-    # _components = lib.traceSeqN 2 {
-    #   inherit unpatched __components;
-    #   deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
-    # } __components;
-
-    wrapIntel =
-      cc:
-      let
-        targetConfig = stdenv.targetPlatform.config;
-      in
-      (wrapCCWith {
-        inherit cc;
-
-        nixSupport = {
-          cc-ldflags = [
-            "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
-            "-L${gcc.cc.lib}/lib"
-            "-L${libgcc.out}/lib"
-            "-L${cc}/lib"
-          ];
-          cc-cflags = [
-            "--gcc-toolchain=${gcc.cc}"
-            "-isystem \"${cc.original}/lib/clang/*/include\""
-            "-isystem ${cc}/include"
-            "-isystem ${cc}/include/intel64"
-            "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
-          ];
-          libcxx-cxxflags = [
-            # "--gcc-toolchain=${gcc.cc}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
-          ];
-        };
-
-        extraBuildCommands = ''
-          # FIXME: We should find a better way to modify the PATH instead of using
-          # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
-          echo 'path_backup="${gcc.cc}/bin:$path_backup"' >>$out/nix-support/cc-wrapper-hook
-
-          # Disable hardening by default
-          echo "" > $out/nix-support/add-hardening.sh
-
-          wrap icx  $wrapper $ccPath/icx
-          wrap icpx $wrapper $ccPath/icpx
-          wrap ifx  $wrapper $ccPath/ifx
-
-          ln -s $out/bin/icpx $out/bin/c++
-          ln -s $out/bin/icx  $out/bin/cc
-
-          ln -s $ccPath/sycl-ls $out/bin/sycl-ls
-          ln -s $ccPath/sycl-trace $out/bin/sycl-trace
-
-          sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
-
-          # Use this to detect when a compiler subprocess is called
-          # from icpx (--fsycl-host-compiler)
-          echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
-
-          # oneMath looks for sycl libraries in bin/../lib
-          ln -s ${cc}/lib $out/lib
-          ln -s ${cc}/include $out/include
-        '';
-      }).overrideAttrs
-        (old: {
-          installPhase = old.installPhase + ''
-            export named_cc="icx"
-            export named_cxx="icpx"
-            export named_fc="ifx"
-          '';
-        });
-
-  in
-  stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = lib.removeSuffix "-extracted" unpatched.pname;
-    inherit (unpatched) version;
-    src = unpatched;
-
-    phases = [
-      "installPhase"
-      "fixupPhase"
-    ];
-    buildInputs = [
-      libffi_3_3
-      libelf
-      libxml2
-      hwloc
-      numactl
-      libuuid
-      libpsm2
-      zlib
-      ocl-icd
-      rdma-core
-      ucx
-      openssl
-      python3
-      stdenv.cc.cc.lib
-    ]
-    ++ extraPackages;
-
-    autoPatchelfIgnoreMissingDeps = [
-      "libhwloc.so.5"
-      "libcuda.so.1"
-      "libze_loader.so.1"
-    ];
-
-    # There are broken symlinks that go outside packages, ignore them
-    dontCheckForBrokenSymlinks = true;
-
-    nativeBuildInputs = [ autoPatchelfHook ];
-    installPhase = ''
-      cp -r $src/opt/intel/oneapi/ $out
-    '';
-
-    passthru =
-      let
-        pkgs = mapAttrs (
-          folder: version:
-          let
-            original = "${finalAttrs.finalPackage}/${folder}/${version}";
-
-            etc-vendors = writeTextFile {
-              name = "intel-ocl-icd";
-              text = "${original}/lib/libintelocl.so";
-              destination = "/etc/OpenCL/vendors/intel.icd";
-            };
-          in
-          symlinkJoin {
-            pname = "intel-${folder}";
-            inherit version;
-            paths = [ original ] ++ lib.optionals (folder == "compiler") [ etc-vendors ];
-            passthru = { inherit original; };
-          }
-        ) _components;
-      in
-      pkgs
-      // {
-        inherit unpatched;
-        pkgs = lib.recurseIntoAttrs pkgs;
-        components = _components;
-
-        # This contains all packages properly symlinked into toplevel directories
-        # in $out.
-        #
-        # NOTE: there are clashes with packages that have symlinks outside their
-        # scope (libtcm and env/vars.sh)
-        all = symlinkJoin {
-          pname = finalAttrs.finalPackage.pname + "-symlinked";
-          inherit (finalAttrs.finalPackage) version;
-          paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
-        };
-
-        stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
-
-        cc = wrapIntel finalAttrs.finalPackage.pkgs.compiler;
-      };
-
-  })
-)
--- a/pkgs/intel-oneapi/process.jq
+++ b/pkgs/intel-oneapi/process.jq
@@ -1,29 +0,0 @@
-#!/usr/bin/env -S jq -f
-
-def extract_fields: {
-        pname : .Package,
-        version : .Version,
-        provides : .Package | sub("[0-9.-]*$"; ""),
-        filename : .Filename,
-        size : ."Installed-Size" | tonumber,
-        sha256 : .SHA256,
-        dependencies : .Depends,
-    } ;
-
-# parses dependencies into a list of [{.pname, .kind, .version}]
-# some dependencies do not have a version specified, in which case, kind = version = null
-#
-# example dependencies:
-# intel-oneapi-common-vars (>= 2023.0.0-25325), intel-oneapi-common-licensing-2023.0.0
-
-def split_dependencies : map(try(.dependencies |= split(",\\s?"; "")) // .dependencies |= []) ;
-
-def match_version : capture("(?<pname>[a-zA-Z0-9_\\-.]*) *(\\((?<kind>[<>=]*) *(?<version>.*)\\))?"; "") ;
-
-def parse_dependencies : map_values(.dependencies.[] |= match_version) ;
-
-def sort_version_decreasing : sort_by(.version | split("[-.]"; "") | map(tonumber)) | reverse ;
-
-map(extract_fields) | split_dependencies | parse_dependencies | sort_version_decreasing
-
-# [.[] | select(.pname == "intel-hpckit") | .version]
--- a/pkgs/intel-oneapi/toJson.awk
+++ b/pkgs/intel-oneapi/toJson.awk
@@ -1,29 +0,0 @@
-#!/usr/bin/env -S awk -f
-
-BEGIN   {
-    FS=": "
-
-    prev_empty=1
-    t="  "
-
-    print "[ {"
-}
-
-!NF { # empty line, update separator so next non empty line closes the dict
-    prev_empty=1
-    t="},\n{ "
-    next # skip line (we won't match anything else)
-}
-
-{
-    printf t "\"%s\" : \"%s\"\n", $1, $2
-
-    if (prev_empty) {
-        # we were the first after a group of empty lines, following ones have to
-        # have a comma
-        prev_empty=0
-        t=", "
-    }
-}
-
-END     { print "} ]" }
--- a/pkgs/intel-oneapi/update.sh
+++ b/pkgs/intel-oneapi/update.sh
@@ -1,11 +1,4 @@
 #!/bin/sh

-out_64=$(mktemp intel-api.64.XXXXXX)
-out_all=$(mktemp intel-api.all.XXXXXX)
-trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
-
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
-
-# NOTE: we use `jq -r tostring` to minify the json (3.2Mb -> 2.3Mb)
-cat "$out_64" "$out_all" | ./toJson.awk | ./process.jq | jq -r tostring >packages.json
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o amd64-packages
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o all-packages
--- a/pkgs/llvm-intel/default.nix
+++ b/pkgs/llvm-intel/default.nix
@@ -1,244 +0,0 @@
-{
-  stdenv,
-  lib,
-  ninja,
-  autoAddDriverRunpath,
-  wrapCC,
-  cmake,
-  emhash,
-  fetchFromGitHub,
-  khronos-ocl-icd-loader,
-  libbacktrace,
-  opencl-headers,
-  parallel-hashmap,
-  perl,
-  pkg-config,
-  python3,
-  spirv-headers,
-  spirv-tools,
-  symlinkJoin,
-  zlib,
-
-  cudaPackages ? null,
-  enableCuda ? true,
-}:
-
-let
-
-  llvmMajorVersion = "21";
-  version = "6.2.1";
-  src = fetchFromGitHub {
-    owner = "intel";
-    repo = "llvm";
-    tag = "v${version}";
-    sha256 = "sha256-j8+DmGKO0qDF5JjH+DlkLKs1kBz6dS7ukwySd/Crqv0=";
-  };
-
-  pinned = {
-    inherit parallel-hashmap;
-
-    vc-intrinsics.src = fetchFromGitHub {
-      owner = "intel";
-      repo = "vc-intrinsics";
-      rev = "4e51b2467104a257c22788e343dafbdde72e28bb";
-      sha256 = "sha256-AHXeKbih4bzmcuu+tx2TeS7Ixmk54uS1vKFVxI6ZP8g=";
-    };
-
-    unified-memory-framework.src = fetchFromGitHub {
-      owner = "oneapi-src";
-      repo = "unified-memory-framework";
-      tag = "v0.11.0";
-      sha256 = "sha256-k8QdP2u1QOoeCZ6ps4sM8+1iZq/H3q0lqCfVk8mz9KI=";
-    };
-
-    ocl-headers = opencl-headers.overrideAttrs {
-      version = "2024.10.24";
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "OpenCL-Headers";
-        tag = "v2024.10.24";
-        sha256 = "sha256-KDlruE0IG8d+lAChxYyc6dg5XOvqCMrMyO69sdAzejA=";
-      };
-    };
-
-    ocl-icd = khronos-ocl-icd-loader;
-
-    spirv-headers = spirv-headers.overrideAttrs {
-      version = "1.4.309.0";
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "SPIRV-Headers";
-        tag = "vulkan-sdk-1.4.309.0";
-        sha256 = "sha256-Q1i6i5XimULuGufP6mimwDW674anAETUiIEvDQwvg5Y=";
-      };
-    };
-  };
-
-  fetchcontent_cmakeFlags = lib.mapAttrsToList (
-    name: value: (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_${lib.toUpper name}" (toString value.src))
-  ) pinned;
-
-  # Hack to fix #include <emhash/...>
-  emhash' = symlinkJoin {
-    name = "emhash";
-    paths = [ emhash ];
-    postBuild = ''
-      pushd $out/include
-      ln -s . emhash
-      popd
-    '';
-  };
-
-in
-stdenv.mkDerivation {
-  pname = "intel-llvm";
-  inherit src version;
-
-  enableParallelBuilding = true;
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    perl
-    cmake
-    ninja
-    pkg-config
-    python3
-    spirv-tools
-    autoAddDriverRunpath
-  ]
-  ++ lib.optionals enableCuda [
-    cudaPackages.cuda_nvcc
-  ];
-
-  buildInputs = [
-    emhash'
-    libbacktrace
-    zlib
-
-    pinned.ocl-icd
-    pinned.ocl-headers
-    pinned.spirv-headers
-  ]
-  ++ lib.optionals enableCuda [
-    cudaPackages.cudatoolkit
-  ];
-
-  patches = [ ./fix-ur.patch ]; # Has been fixed in next release
-
-  preBuild = ''
-    chmod -R u+w /build/source
-  '';
-
-  cmakeDir = "../llvm";
-
-  cmakeFlags =
-    let
-      cmakeList = name: l: lib.cmakeOptionType "list" name (builtins.concatStringsSep ";" l);
-
-      LLVM_EXTERNAL_PROJECTS = [
-        "sycl"
-        "llvm-spirv"
-        "opencl"
-        "xpti"
-        "xptifw"
-        "compiler-rt"
-        "sycl-jit"
-        "libdevice"
-      ]
-      ++ lib.optionals enableCuda [
-        "libclc"
-      ];
-    in
-    [
-      (lib.cmakeBool "LLVM_ENABLE_ASSERTIONS" true)
-
-      (cmakeList "LLVM_TARGETS_TO_BUILD" (
-        [
-          "host"
-          "SPIRV"
-        ]
-        ++ lib.optionals enableCuda [ "NVPTX" ]
-      ))
-      (cmakeList "LLVM_EXTERNAL_PROJECTS" LLVM_EXTERNAL_PROJECTS)
-      (cmakeList "LLVM_ENABLE_PROJECTS" ([ "clang" ] ++ LLVM_EXTERNAL_PROJECTS))
-
-      (lib.cmakeBool "UR_USE_EXTERNAL_UMF" false)
-      (lib.cmakeOptionType "path" "UR_OPENCL_INCLUDE_DIR" (toString pinned.ocl-headers))
-      (lib.cmakeOptionType "path" "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
-      (lib.cmakeFeature "UR_OPENCL_ICD_LOADER_LIBRARY" (toString pinned.ocl-icd))
-
-      (lib.cmakeBool "BUILD_SHARED_LIBS" false)
-      (lib.cmakeBool "LLVM_BUILD_TOOLS" true)
-      (lib.cmakeBool "LLVM_ENABLE_ZSTD" true)
-      (lib.cmakeBool "LLVM_USE_STATIC_ZSTD" true)
-      (lib.cmakeBool "LLVM_ENABLE_DOXYGEN" false)
-      (lib.cmakeBool "LLVM_ENABLE_LLD" false)
-      (lib.cmakeBool "LLVM_ENABLE_SPHINX" false)
-      (lib.cmakeBool "LLVM_SPIRV_ENABLE_LIBSPIRV_DIS" false)
-      (lib.cmakeBool "SYCL_ENABLE_WERROR" false)
-      (lib.cmakeBool "SYCL_INCLUDE_TESTS" false)
-      (lib.cmakeBool "SYCL_ENABLE_EXTENSION_JIT" true)
-      (lib.cmakeBool "SYCL_ENABLE_MAJOR_RELEASE_PREVIEW_LIB" false)
-      (lib.cmakeBool "SYCL_ENABLE_XPTI_TRACING" true)
-      (lib.cmakeBool "XPTI_ENABLE_WERROR" false)
-
-      (cmakeList "SYCL_ENABLE_BACKENDS" ([ "opencl" ] ++ lib.optionals enableCuda [ "cuda" ]))
-    ]
-    ++ fetchcontent_cmakeFlags
-    ++ lib.optionals enableCuda [
-      (lib.cmakeOptionType "list" "LIBCLC_TARGETS_TO_BUILD" "nvptx64--nvidiacl")
-      (lib.cmakeBool "LIBCLC_GENERATE_REMANGLED_VARIANTS" true)
-      (lib.cmakeBool "LIBCLC_NATIVECPU_HOST_TARGET" false)
-    ];
-
-  hardeningDisable = lib.optionals enableCuda [ "zerocallusedregs" ]; # not supported for nvidia
-
-  postPatch =
-
-    let
-      # See the postPatch phase for details on why this is used
-      ccWrapperStub = wrapCC (
-        stdenv.mkDerivation {
-          name = "ccWrapperStub";
-          dontUnpack = true;
-          installPhase = ''
-            mkdir -p $out/bin
-            cat > $out/bin/clang-${llvmMajorVersion} <<'EOF'
-            #!/bin/sh
-            exec "$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}" "$@"
-            EOF
-            chmod +x $out/bin/clang-${llvmMajorVersion}
-            cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang
-            cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang++
-          '';
-          passthru.isClang = true;
-        }
-      );
-    in
-    ''
-      # Parts of libdevice are built using the freshly-built compiler.
-      # As it tries to link to system libraries, we need to wrap it with the
-      # usual nix cc-wrapper.
-      # Since the compiler to be wrapped is not available at this point,
-      # we use a stub that points to where it will be later on
-      # in `$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}`
-      substituteInPlace libdevice/cmake/modules/SYCLLibdevice.cmake \
-        --replace-fail "\''${clang_exe}" "${ccWrapperStub}/bin/clang++"
-    '';
-
-  passthru = {
-    inherit llvmMajorVersion;
-    inherit enableCuda cudaPackages;
-  };
-
-  meta = {
-    homepage = "https://github.com/intel/llvm";
-    description = "Intel staging area for llvm.org contribution";
-    maintainers = with lib.maintainers.bsc; [ abonerib ];
-    platforms = lib.platforms.linux;
-    license = [
-      lib.licenses.asl20
-      lib.licenses.llvm-exception
-    ];
-  };
-}
--- a/pkgs/llvm-intel/fix-ur.patch
+++ b/pkgs/llvm-intel/fix-ur.patch
@@ -1,23 +0,0 @@
-diff --git a/unified-runtime/source/adapters/cuda/CMakeLists.txt b/unified-runtime/source/adapters/cuda/CMakeLists.txt
-index a8401c71a..2ab363926 100644
--- a/unified-runtime/source/adapters/cuda/CMakeLists.txt
-+++ b/unified-runtime/source/adapters/cuda/CMakeLists.txt
-@@ -62,14 +62,14 @@ add_library(cudadrv SHARED IMPORTED GLOBAL)
- if (WIN32)
-   set_target_properties(
-     cudadrv PROPERTIES 
-      IMPORTED_IMPLIB               ${CUDA_cuda_driver_LIBRARY}
-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
-+      IMPORTED_IMPLIB               "${CUDA_cuda_driver_LIBRARY}"
-+      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
-   )
- else()
-   set_target_properties(
-     cudadrv PROPERTIES 
-      IMPORTED_LOCATION             ${CUDA_cuda_driver_LIBRARY}
-      INTERFACE_INCLUDE_DIRECTORIES ${CUDAToolkit_INCLUDE_DIRS}
-+      IMPORTED_LOCATION             "${CUDA_cuda_driver_LIBRARY}"
-+      INTERFACE_INCLUDE_DIRECTORIES "${CUDAToolkit_INCLUDE_DIRS}"
-   )
- endif()
- 
--- a/pkgs/llvm-intel/wrapped.nix
+++ b/pkgs/llvm-intel/wrapped.nix
@@ -1,69 +0,0 @@
-{
-  stdenv,
-  lib,
-  wrapCCWith,
-  llvm-intel-unwrapped,
-  gcc,
-  libgcc,
-}:
-
-let
-  wrapIntel =
-    cc:
-    let
-      targetConfig = stdenv.targetPlatform.config;
-
-      extraPath = builtins.concatStringsSep ":" (
-        [ "${gcc.cc}/bin" ] ++ lib.optionals cc.enableCuda [ "${cc.cudaPackages.cudatoolkit}/bin" ]
-      );
-    in
-    wrapCCWith {
-      inherit cc;
-
-      nixSupport = {
-        cc-ldflags = [
-          "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
-          "-L${gcc.cc.lib}/lib"
-          "-L${libgcc.out}/lib"
-          "-L${gcc.libc}/lib"
-          "-L${cc}/lib"
-        ];
-        cc-cflags = [
-          "--gcc-toolchain=${gcc.cc}"
-          "-isystem ${cc}/lib/clang/${cc.llvmMajorVersion}/include"
-          "-isystem ${cc}/include"
-          "-isystem ${cc}/include/intel64"
-          "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
-        ];
-        libcxx-cxxflags = [
-          # "--gcc-toolchain=${gcc.cc}"
-          "-isystem ${gcc.cc}/include/c++/${gcc.version}"
-          "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
-        ];
-      };
-
-      extraBuildCommands = ''
-        # FIXME: We should find a better way to modify the PATH instead of using
-        # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
-        echo 'path_backup="${extraPath}:$path_backup"' >>$out/nix-support/cc-wrapper-hook
-
-        # Disable hardening by default
-        echo "" > $out/nix-support/add-hardening.sh
-
-        pushd $ccPath
-        for i in $ {llvm,sycl}-* ; do
-          ln -s $ccPath/$i $out/bin/$i
-        done
-        popd
-
-        # Use this to detect when a compiler subprocess is called
-        # from icpx (--fsycl-host-compiler)
-        echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
-
-        # oneMath looks for sycl libraries in bin/../lib
-        ln -s ${cc}/lib $out/lib
-        ln -s ${cc}/include $out/include
-      '';
-    };
-in
-wrapIntel llvm-intel-unwrapped
--- a/pkgs/llvm-ompss2/clang.nix
+++ b/pkgs/llvm-ompss2/clang.nix
@@ -1,9 +1,9 @@
 {
-  llvmPackages_latest
+  stdenv
+, llvmPackages_latest
 , lib
 , fetchFromGitHub
 , cmake
-, bash
 , python3
 , perl
 , which
@@ -11,7 +11,6 @@
 , libffi
 , zlib
 , pkg-config
-, gcc # needed to set the rpath of libstdc++ for clang-tblgen
 , enableDebug ? false
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/llvm-ompss/llvm-mono.git"
@@ -20,7 +19,10 @@
 }:

 let
-  stdenv = llvmPackages_latest.stdenv;
+  llvmPackages = llvmPackages_latest;
+  llvmStdenv = llvmPackages.stdenv;
+  # needed to set the rpath of libstdc++ for clang-tblgen
+  gcc = stdenv.cc;

  release = rec {
    version = "2025.11";
@@ -43,11 +45,12 @@ let

  source = if (useGit) then git else release;

-in stdenv.mkDerivation {
+in llvmStdenv.mkDerivation {
  pname = "clang-ompss2";
  inherit (source) src version;

  enableParallelBuilding = true;
+  strictDeps = true;

  passthru = {
    CC = "clang";
@@ -60,13 +63,12 @@ in stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    bash
    cmake
    elfutils
-    llvmPackages_latest.lld
+    llvmPackages.lld
+    perl
    pkg-config
    python3
-    perl
    which
    zlib
  ];
@@ -97,8 +99,13 @@ in stdenv.mkDerivation {
    cd build
    cmakeDir="../llvm"
    cmakeFlagsArray=(
-      "-DLLVM_HOST_TRIPLE=${stdenv.targetPlatform.config}"
+      "-DLLVM_HOST_TRIPLE=${llvmStdenv.targetPlatform.config}"
+    '' + (if "${llvmStdenv.targetPlatform.config}" == "riscv64-unknown-linux-gnu" then ''
+      "-DLLVM_DEFAULT_TARGET_TRIPLE=riscv64-unknown-linux-gnu"
+      "-DLLVM_TARGETS_TO_BUILD=RISCV"
+    '' else ''
      "-DLLVM_TARGETS_TO_BUILD=host"
+    '') + ''
      "-DLLVM_BUILD_LLVM_DYLIB=ON"
      "-DLLVM_LINK_LLVM_DYLIB=ON"
      # Required to run clang-ast-dump and clang-tblgen during build
@@ -107,7 +114,8 @@ in stdenv.mkDerivation {
      "-DCMAKE_CXX_FLAGS_DEBUG=-g -ggnu-pubnames"
      "-DCMAKE_EXE_LINKER_FLAGS_DEBUG=-Wl,--gdb-index"
      "-DLLVM_LIT_ARGS=-sv --xunit-xml-output=xunit.xml"
-      "-DLLVM_ENABLE_PROJECTS=clang;compiler-rt;lld"
+      "-DLLVM_ENABLE_PROJECTS=clang;lld"
+      "-DLLVM_ENABLE_RUNTIMES=compiler-rt"
      "-DLLVM_ENABLE_ASSERTIONS=ON"
      "-DLLVM_INSTALL_TOOLCHAIN_ONLY=ON"
      "-DCMAKE_INSTALL_BINDIR=bin"
--- a/pkgs/llvm-ompss2/default.nix
+++ b/pkgs/llvm-ompss2/default.nix
@@ -3,26 +3,42 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
-, writeShellScript
-, openmp ? null
+
+, openmp
+, useOpenmp  ? false
+, openmpv
+, useOpenmpV ? false
+, nanos6
+, useNanos6 ? false
+, nodes
+, useNodes ? false
+
 , wrapCCWith
 , llvmPackages_latest
-, ompss2rt ? null
 }:

 with lib;

 let
-  usingNodesAndOmpv = (openmp.pname == "openmp-v" && ompss2rt.pname == "nodes");
-  sameNosv = openmp.nosv == ompss2rt.nosv;
+  getSplice = target: pkg: if pkg ? "__spliced" && pkg.__spliced ? target then pkg.__spliced."${target}" else pkg;
+  getSpliceTargetTarget = getSplice "targetTarget";
+  omp = if useOpenmp then openmp else if useOpenmpV then openmpv else null;
+  ompss2rtUnspliced = if useNanos6 then nanos6 else if useNodes then nodes else null;
+  ompss2rt = getSpliceTargetTarget ompss2rtUnspliced;
+  usingNodesAndOmpv = omp != null && ompss2rt != null && (omp.pname == "openmp-v" && ompss2rt.pname == "nodes");
+  sameNosvUnspliced = omp != null && ompss2rtUnspliced != null && omp.nosv == ompss2rtUnspliced.nosv;
+  sameNosvSpliced = (getSpliceTargetTarget omp.nosv) == ompss2rt.nosv;
 in

-assert assertMsg (usingNodesAndOmpv -> sameNosv) "OpenMP-V and NODES must share the same nOS-V";
+assert assertMsg (usingNodesAndOmpv -> sameNosvUnspliced) "OpenMP-V and NODES must share the same nOS-V before splice";
+assert assertMsg (usingNodesAndOmpv -> sameNosvSpliced) "OpenMP-V and NODES must share the same nOS-V after splice";
+assert assertMsg (useOpenmp -> !useOpenmpV) "Either OpenMP or OpenMP-V may be enabled, but not both";
+assert assertMsg (useNanos6 -> !useNodes) "Either Nanos6 or NODES may be enabled, but not both";

 let
  homevar = if ompss2rt.pname == "nanos6" then "NANOS6_HOME" else "NODES_HOME";
  rtname  = if ompss2rt.pname == "nanos6" then "libnanos6" else "libnodes";
-  ompname = if openmp.pname == "openmp-v" then  "libompv" else "libomp";
+  ompname = if omp.pname == "openmp-v" then  "libompv" else "libomp";


  # We need to replace the lld linker from bintools with our linker just built,
@@ -38,7 +54,10 @@ let
  inherit gcc;
  cc = clangOmpss2Unwrapped;
  gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-
+in (wrapCCWith {
+  inherit cc bintools;
+  # extraPackages adds packages to depsTargetTargetPropagated
+  extraPackages = optional (omp != null) omp;
  extraBuildCommands = ''
    echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
    echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -54,51 +73,15 @@ let

    echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags

-    wrap clang++  $wrapper $ccPath/clang++
+    wrap ${targetConfig}clang++  $wrapper $ccPath/clang++
+    wrap ${targetConfig}clang    $wrapper $ccPath/clang
+
+  '' + optionalString (omp != null) ''
+    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null) ''
+    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
+    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
+    echo "export NOSV_HOME=${ompss2rt}" >> $out/nix-support/cc-wrapper-hook
  '';
-
-  envExports = lib.optionalString (openmp != null) ''
-      echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null) ''
-      echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
-      echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-      echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
-    '';
-
-  extraPackages = optional (openmp != null) openmp;
-
-  wrappedCC = wrapCCWith {
-    # extraPackages adds packages to depsTargetTargetPropagated
-    inherit cc bintools extraPackages;
-    extraBuildCommands = extraBuildCommands + envExports;
-  };
-
-  resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
-  in writeShellScript "remove-intel.sh" ''
-    if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
-      unset NIX_CFLAGS_COMPILE_${tconf}
-      unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
-
-      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
-        echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
-      fi
-    fi
-  '';
-
-  intelExtraBuildCommands = ''
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
-  '';
-
-  wrappedCCIntel = wrapCCWith {
-    inherit cc bintools extraPackages;
-    # extraPackages adds packages to depsTargetTargetPropagated
-    extraBuildCommands = intelExtraBuildCommands + envExports;
-  };
-
-in wrappedCC.overrideAttrs (oldAttrs: {
-    passthru = oldAttrs.passthru // {
-      forIcpx = wrappedCCIntel;
-    };
-  })
+}).overrideAttrs (prev: { passthru = (prev.passthru or {}) // { inherit ompss2rt; }; })
--- a/pkgs/llvm-ompss2/openmp.nix
+++ b/pkgs/llvm-ompss2/openmp.nix
@@ -39,7 +39,9 @@ stdenv.mkDerivation rec {
    perl
    pkg-config
    python3
-  ] ++ lib.optionals enableNosv [
+  ];
+
+  buildInputs = lib.optionals enableNosv [
    nosv
  ] ++ lib.optionals enableOvni [
    ovni
@@ -54,6 +56,7 @@ stdenv.mkDerivation rec {
  dontStrip = enableDebug;

  separateDebugInfo = true;
+  strictDeps = true;

  cmakeFlags = [
    "-DLIBOMP_OMPD_SUPPORT=OFF"
@@ -71,6 +74,28 @@ stdenv.mkDerivation rec {
    rm -f $out/libllvmrt/libomp.*
  '';

+  doInstallCheck = true;
+  # There are not cmake flags to force nOS-V, it enables it when found through
+  # pkg-config. If enableNosv is set, but we fail to find it at build time,
+  # the build will succeed but won't use nOS-V (libompv won't be created).
+  # This is a sanity check to ensure that after install we have the proper
+  # files.
+  installCheckPhase =
+    if enableNosv then
+      ''
+        test -f $out/lib/libompv.so
+        test -f $out/libllvmrt/libompv.so
+        test ! -f $out/lib/libomp.so
+        test ! -f $out/libllvmrt/libomp.so
+      ''
+    else
+      ''
+        test -f $out/lib/libomp.so
+        test -f $out/libllvmrt/libomp.so
+        test ! -f $out/lib/libompv.so
+        test ! -f $out/libllvmrt/libompv.so
+      '';
+
  passthru = {
    inherit nosv;
  };
--- a/pkgs/lmbench/default.nix
+++ b/pkgs/lmbench/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
  hardeningDisable = [ "all" ];

  enableParallelBuilding = false;
+  strictDeps = true;

  preBuild = ''
    makeFlagsArray+=(
--- a/pkgs/meteocat-exporter/default.nix
+++ b/pkgs/meteocat-exporter/default.nix
@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication {
  src = ./.;

  doCheck = false;
+  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/pkgs/mpich/default.nix
+++ b/pkgs/mpich/default.nix
@@ -53,6 +53,7 @@ in mpich.overrideAttrs (old: {
  '';

  hardeningDisable = [ "all" ];
+  strictDeps = true;

  meta = old.meta // {
    maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
--- a/pkgs/nanos6/default.nix
+++ b/pkgs/nanos6/default.nix
@@ -16,7 +16,7 @@
 , jemallocNanos6 ? null
 , cachelineBytes ? 64
 , enableGlibcxxDebug ? false
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/nanos6/nanos6"
 , gitBranch ? "master"
@@ -80,7 +80,8 @@ in
      (optional enableGlibcxxDebug "CXXFLAGS=-D_GLIBCXX_DEBUG") ++
      # Most nanos6 api symbols are resolved at runtime, so prefer
      # ifunc by default
-      (optional isCross "--with-symbol-resolution=ifunc");
+      (optional isCross "--with-symbol-resolution=ifunc") ++
+      (optional enablePapi "--with-papi=${papi}");

    postConfigure = lib.optionalString (!enableDebug) ''
      # Disable debug
@@ -95,16 +96,14 @@ in
    dontStrip = enableDebug;
    separateDebugInfo = true;

+    strictDeps = true;
+
    nativeBuildInputs = [
      autoconf
      automake
      libtool
      pkg-config
-
-      # TODO: papi_version is needed for configure:
-      # ./configure: line 27378: papi_version: command not found
-      # This probably breaks cross-compilation
-    ] ++ lib.optionals enablePapi [ papi ];
+    ];

    buildInputs = [
      boost
--- a/pkgs/nanos6/jemalloc.nix
+++ b/pkgs/nanos6/jemalloc.nix
@@ -5,7 +5,6 @@ jemalloc.overrideAttrs (old: {
    "--with-jemalloc-prefix=nanos6_je_"
    "--enable-stats"
  ];
-  enableParallelBuilding = true;
  hardeningDisable = [ "all" ];
  meta = old.meta // {
    description = old.meta.description + " (for Nanos6)";
--- a/pkgs/nix-portable/default.nix
+++ b/pkgs/nix-portable/default.nix
@@ -1,650 +0,0 @@
-with builtins;
-{
-  nix,
-  unzip,
-  zip,
-  unixtools,
-  stdenv,
-  buildPackages,
-  upx,
-
-  bootstrapPrograms ? [
-    "gitMinimal"
-    "netcat-openbsd"
-    "openssh"
-    "bashInteractive"
-  ],
-
-  cacert ? pkgs.cacert,
-  compression ? "zstd -19 -T0",
-  lib ? pkgs.lib,
-  pkgs ? import <nixpkgs> {},
-  # hardcode executable to run. Useful when creating a bundle.
-  bundledPackage ? null,
-
-  nixStatic,
-  busyboxStatic ? pkgs.pkgsStatic.busybox,
-  bwrapStatic ? pkgs.pkgsStatic.bubblewrap,
-  zstdStatic ? pkgs.pkgsStatic.zstd,
-
-  perlBuildBuild ? pkgs.pkgsBuildBuild.perl,
-}@inp:
-with lib;
-let
-
-  perl = perlBuildBuild;
-
-  pname =
-    if bundledPackage == null
-    then "nix-portable"
-    else lib.getName bundledPackage;
-
-  bundledExe = lib.getExe bundledPackage;
-
-  nixpkgsSrc = pkgs.path;
-
-  maketar = targets:
-    let
-      closureInfo = buildPackages.closureInfo { rootPaths = targets; };
-    in
-    stdenv.mkDerivation {
-      name = "nix-portable-store-tarball";
-      nativeBuildInputs = [ perl zstd ];
-      exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
-      buildCommand = ''
-        storePaths=$(cat ${closureInfo}/store-paths)
-        mkdir $out
-        echo $storePaths > $out/index
-        cp -r ${closureInfo} $out/closureInfo
-
-        tar -cf - \
-          --owner=0 --group=0 --mode=u+rw,uga+r \
-          --hard-dereference \
-          $storePaths | ${compression} > $out/tar
-      '';
-    };
-
-  packStaticBin = binPath: let
-      binName = (last (splitString "/" binPath)); in
-    pkgs.runCommand
-    binName
-    { nativeBuildInputs = [ upx ]; }
-    ''
-      mkdir -p $out/bin
-      theBinPath=${binPath}
-
-      if [[ -L "$theBinPath" ]]; then
-        theBinPath=$(readlink -f "$theBinPath")
-      fi
-
-      upx -9 -o $out/bin/${binName} $theBinPath
-    '';
-
-  installBin = pkg: bin: ''
-    unzip -qqoj "\$self" ${ lib.removePrefix "/" "${pkg}/bin/${bin}"} -d \$dir/bin
-    chmod +wx \$dir/bin/${bin};
-  '';
-
-  installDynamic = pkgname: let
-    out = pkgs.${pkgname}.out;
-  in ''
-    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
-      debug "Installing ${pkgname}"
-      \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
-        (import ${nixpkgsSrc} {}).${pkgname}.out
-      "
-    else
-      debug "${pkgname} already installed"
-    fi
-
-    export PATH="${out}/bin:\$PATH"
-  '';
-
-  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
-
-  bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
-  nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
-  zstd = packStaticBin "${zstdStatic}/bin/zstd";
-
-  # the default nix store contents to extract when first used
-  storeTar = maketar ([ cacert nix nixpkgsSrc ] ++ lib.optional (bundledPackage != null) bundledPackage);
-
-
-  # The runtime script which unpacks the necessary files to $HOME/.nix-portable
-  # and then executes nix via bwrap
-  # Some shell expressions will be evaluated at build time and some at run time.
-  # Variables/expressions escaped via `\$` will be evaluated at run time
-  runtimeScript = ''
-    #!/usr/bin/env bash
-
-    set -eo pipefail
-
-    start=\$(date +%s%N)  # start time in nanoseconds
-
-    # dump environment on exit if debug is enabled
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
-      trap "declare -p > \''${TMPDIR:-/tmp}/np_env" EXIT
-    fi
-
-    set -e
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 2 ]; then
-      set -x
-    fi
-
-    # &3 is our error out which we either forward to &2 or to /dev/null
-    # depending on the setting
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
-      debug(){
-        echo \$@ || true
-      }
-      exec 3>&2
-    else
-      debug(){
-        true
-      }
-      exec 3>/dev/null
-    fi
-
-    # to reference this script's file
-    self="\$(realpath \''${BASH_SOURCE[0]})"
-
-    # fingerprint will be inserted by builder
-    fingerprint="_FINGERPRINT_PLACEHOLDER_"
-
-    # user specified location for program files and nix store
-    [ -z "\$NP_LOCATION" ] && NP_LOCATION="\$HOME"
-    NP_LOCATION="\$(readlink -f "\$NP_LOCATION")"
-    dir="\$NP_LOCATION/.nix-portable"
-
-    # Create NP_LOCATION and remove sgid bit
-    mkdir -p \$dir
-    if [ ! -z "\$BSC_MACHINE" ]; then
-      # Attempt to avoid issues with sgid folders
-      chmod g-s \$dir
-      chgrp bsc \$dir
-    fi
-
-    store="\$dir/nix/store"
-    # create /nix/var/nix to prevent nix from falling back to chroot store.
-    mkdir -p \$dir/{bin,nix/var/nix,nix/store}
-
-    # create minimal drv file for nix to spawn a nix shell
-    echo 'builtins.derivation {name="foo"; builder="/bin/sh"; args = ["-c" "echo hello \> \\\$out"]; system=builtins.currentSystem;}' > "\$dir/mini-drv.nix"
-
-    # the fingerprint being present inside a file indicates that
-    # this version of nix-portable has already been initialized
-    if test -e \$dir/conf/fingerprint && [ "\$(cat \$dir/conf/fingerprint)" == "\$fingerprint" ]; then
-      newNPVersion=false
-    else
-      newNPVersion=true
-    fi
-
-    # Nix portable ships its own nix.conf
-    export NIX_CONF_DIR=\$dir/conf/
-
-    NP_CONF_SANDBOX=\''${NP_CONF_SANDBOX:-false}
-    NP_CONF_STORE=\''${NP_CONF_STORE:-auto}
-
-
-    recreate_nix_conf(){
-      mkdir -p "\$NIX_CONF_DIR"
-      rm -f "\$NIX_CONF_DIR/nix.conf"
-
-      # static config
-      echo "build-users-group = " >> \$dir/conf/nix.conf
-      echo "experimental-features = nix-command flakes" >> \$dir/conf/nix.conf
-      echo "ignored-acls = security.selinux system.nfs4_acl" >> \$dir/conf/nix.conf
-      echo "sandbox-paths = /bin/sh=\$dir/busybox/bin/busybox" >> \$dir/conf/nix.conf
-      echo "extra-substituters = https://jungle.bsc.es/cache">> \$dir/conf/nix.conf
-      echo "extra-trusted-public-keys = jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" >> \$dir/conf/nix.conf
-
-      echo "extra-system-features = sys-devices" >> \$dir/conf/nix.conf
-      echo "extra-sandbox-paths = /sys/devices/system/cpu=/sys/devices/system/cpu /sys/devices/system/node=/sys/devices/system/node" >> \$dir/conf/nix.conf
-      echo "extra-trusted-users = @bsc" >> \$dir/conf/nix.conf
-
-
-      # configurable config
-      echo "sandbox = \$NP_CONF_SANDBOX" >> \$dir/conf/nix.conf
-      echo "store = \$NP_CONF_STORE" >> \$dir/conf/nix.conf
-    }
-
-
-    ### install files
-
-    PATH_OLD="\$PATH"
-
-    # as soon as busybox is unpacked, restrict PATH to busybox to ensure reproducibility of this script
-    # only unpack binaries if necessary
-    if [ "\$newNPVersion" == "false" ]; then
-
-      debug "binaries already installed"
-      # our busybox does not run on termux, therefore we suffix the PATH only on termux
-      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
-
-    else
-
-      debug "installing files"
-
-      mkdir -p \$dir/emptyroot
-
-      # install busybox
-      mkdir -p \$dir/busybox/bin
-      (base64 -d> "\$dir/busybox/bin/busybox" && chmod +x "\$dir/busybox/bin/busybox") << END
-    $(cat ${busyboxStatic}/bin/busybox | base64)
-    END
-      busyBins="${toString (attrNames (filterAttrs (d: type: type == "symlink") (readDir "${busyboxStatic}/bin")))}"
-      for bin in \$busyBins; do
-        [ ! -e "\$dir/busybox/bin/\$bin" ] && ln -s busybox "\$dir/busybox/bin/\$bin"
-      done
-
-      # our busybox does not run on termux, therefore we suffix the PATH only on termux
-      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
-
-      # install other binaries
-      ${installBin zstd "zstd"}
-      ${installBin bwrap "bwrap"}
-      ${installBin nixStatic "nix"}
-
-      # install ssl cert bundle
-      unzip -poj "\$self" ${ lib.removePrefix "/" "${caBundleZstd}"} | \$dir/bin/zstd -d > \$dir/ca-bundle.crt
-
-      recreate_nix_conf
-    fi
-
-    # Override $SHELL with nix bashInteractive
-    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
-    export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
-
-    # unset bash function aliases
-    unset -f which ml module
-
-    ### setup SSL
-    # find ssl certs or use from nixpkgs
-    debug "figuring out ssl certs"
-    if [ -z "\$SSL_CERT_FILE" ]; then
-      debug "SSL_CERT_FILE not defined. trying to find certs automatically"
-      if [ -e /etc/ssl/certs/ca-bundle.crt ]; then
-        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-bundle.crt)
-        debug "found /etc/ssl/certs/ca-bundle.crt with real path \$SSL_CERT_FILE"
-      elif [ -e /etc/ssl/certs/ca-certificates.crt ]; then
-        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-certificates.crt)
-        debug "found /etc/ssl/certs/ca-certificates.crt with real path \$SSL_CERT_FILE"
-      elif [ ! -e /etc/ssl/certs ]; then
-        debug "/etc/ssl/certs does not exist. Will use certs from nixpkgs."
-        export SSL_CERT_FILE=\$dir/ca-bundle.crt
-      else
-        debug "certs seem to reside in /etc/ssl/certs. No need to set up anything"
-      fi
-    fi
-    if [ -n "\$SSL_CERT_FILE" ]; then
-      sslBind="\$(realpath \$SSL_CERT_FILE) \$dir/ca-bundle.crt"
-      export SSL_CERT_FILE="\$dir/ca-bundle.crt"
-    else
-      sslBind="/etc/ssl /etc/ssl"
-    fi
-
-    if [ -n "\$NP_GIT" ]; then
-      echo "WARN: NP_GIT is not supported, using nix version instead"
-    fi
-
-
-
-    storePathOfFile(){
-      file=\$(realpath \$1)
-      sPath="\$(echo \$file | awk -F "/" 'BEGIN{OFS="/";}{print \$2,\$3,\$4}')"
-      echo "/\$sPath"
-    }
-
-
-    collectBinds(){
-      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
-
-      toBind=""
-      for p in \$pathsTopLevel; do
-        if [ -e "\$p" ]; then
-          real=\$(realpath \$p)
-          if [ -e "\$real" ]; then
-            if [[ "\$real" == /nix/store/* ]]; then
-              storePath=\$(storePathOfFile \$real)
-              toBind="\$toBind \$storePath \$storePath"
-            else
-              toBind="\$toBind \$real \$p"
-            fi
-          fi
-        fi
-      done
-
-
-      # TODO: add /var/run/dbus/system_bus_socket
-      paths="/etc/host.conf /etc/hosts /etc/hosts.equiv /etc/mtab /etc/netgroup /etc/networks /etc/passwd /etc/group /etc/nsswitch.conf /etc/resolv.conf /etc/localtime \$HOME"
-
-      for p in \$paths; do
-        if [ -e "\$p" ]; then
-          real=\$(realpath \$p)
-          if [ -e "\$real" ]; then
-            if [[ "\$real" == /nix/store/* ]]; then
-              storePath=\$(storePathOfFile \$real)
-              toBind="\$toBind \$storePath \$storePath"
-            else
-              toBind="\$toBind \$real \$real"
-            fi
-          fi
-        fi
-      done
-
-      # provide /bin/sh via the shipped busybox
-      toBind="\$toBind \$dir/busybox/bin/busybox /bin/sh"
-      toBind="\$toBind \$dir/busybox/bin/busybox /usr/bin/env"
-
-      # on termux, make sure termux packages still work inside the nix-portable environment
-      if [ -n "\$TERMUX_VERSION" ]; then
-        # binds required so termux native packages still run inside the nix-portable sandbox
-        # TODO: this doesn't quite work yet. debug and fix
-        toBind="\$toBind /system/lib64/libc.so /system/lib64/libc.so"
-        toBind="\$toBind /system/lib64/ld-android.so /system/lib64/ld-android.so"
-        toBind="\$toBind /system/lib64/libdl.so /system/lib64/libdl.so"
-        toBind="\$toBind /system/bin /system/bin"
-        toBind="\$toBind /system/lib64 /system/lib64"
-        toBind="\$toBind /apex/com.android.runtime/bin /apex/com.android.runtime/bin"
-        toBind="\$toBind /linkerconfig/ld.config.txt /linkerconfig/ld.config.txt"
-        toBind="\$toBind \$dir/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt"
-        toBind="\$toBind \$(realpath \$HOME/../usr/etc/resolv.conf) /etc/resolv.conf"
-      fi
-
-    }
-
-
-    makeBindArgs(){
-      arg=\$1; shift
-      sep=\$1; shift
-      binds=""
-      while :; do
-        if [ -n "\$1" ]; then
-          from="\$1"; shift
-          to="\$1"; shift || { echo "no bind destination provided for \$from!"; exit 3; }
-          binds="\$binds \$arg \$from\$sep\$to";
-        else
-          break
-        fi
-      done
-    }
-
-
-
-    ### select container runtime
-    debug "figuring out which runtime to use"
-    [ -z "\$NP_BWRAP" ] && NP_BWRAP=\$dir/bin/bwrap
-    debug "bwrap executable: \$NP_BWRAP"
-    [ -z "\$NP_NIX" ] && NP_NIX=\$dir/bin/nix
-    debug "nix executable: \$NP_NIX"
-    debug "testing all available runtimes..."
-    if [ -z "\$NP_RUNTIME" ]; then
-      # read last automatic selected runtime from disk
-      if [ "\$newNPVersion" == "true" ]; then
-        debug "removing cached auto selected runtime"
-        rm -f "\$dir/conf/last_auto_runtime"
-      fi
-      if [ -f "\$dir/conf/last_auto_runtime" ]; then
-        last_auto_runtime="\$(cat "\$dir/conf/last_auto_runtime")"
-      else
-        last_auto_runtime=
-      fi
-      debug "last auto selected runtime: \$last_auto_runtime"
-      if [ "\$last_auto_runtime" != "" ]; then
-        NP_RUNTIME="\$last_auto_runtime"
-      # check if nix --store works
-      elif \\
-          debug "testing nix --store" \\
-          && mkdir -p \$dir/tmp/ \\
-          && touch \$dir/tmp/testfile \\
-          && "\$NP_NIX" --store "\$dir/tmp/__store" shell -f "\$dir/mini-drv.nix" -c "\$dir/bin/nix" store add-file --store "\$dir/tmp/__store" "\$dir/tmp/testfile" >/dev/null 2>&3; then
-        chmod -R +w \$dir/tmp/__store
-        rm -r \$dir/tmp/__store
-        debug "nix --store works on this system -> will use nix as runtime"
-        NP_RUNTIME=nix
-      # check if bwrap works properly
-      elif \\
-          debug "nix --store failed -> testing bwrap" \\
-          && \$NP_BWRAP --bind \$dir/emptyroot / --bind \$dir/ /nix --bind \$dir/busybox/bin/busybox "\$dir/true" "\$dir/true" 2>&3 ; then
-        debug "bwrap seems to work on this system -> will use bwrap"
-        NP_RUNTIME=bwrap
-      else
-        debug "bwrap doesn't work on this system -> will use proot"
-        NP_RUNTIME=proot
-      fi
-      echo -n "\$NP_RUNTIME" > "\$dir/conf/last_auto_runtime"
-    else
-      debug "runtime selected via NP_RUNTIME: \$NP_RUNTIME"
-    fi
-    debug "NP_RUNTIME: \$NP_RUNTIME"
-    if [ "\$NP_RUNTIME" == "nix" ]; then
-      run="\$NP_NIX shell -f \$dir/mini-drv.nix -c"
-      export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
-      NP_CONF_STORE="\$dir"
-      recreate_nix_conf
-    elif [ "\$NP_RUNTIME" == "bwrap" ]; then
-      collectBinds
-      makeBindArgs --bind " " \$toBind \$sslBind
-      run="\$NP_BWRAP \$BWRAP_ARGS \\
-        --bind \$dir/emptyroot /\\
-        --dev-bind /dev /dev\\
-        --proc /proc\\
-        --bind \$dir/nix /nix\\
-        \$binds"
-        # --bind \$dir/busybox/bin/busybox /bin/sh\\
-    else
-      # proot
-      echo Unsupported runtime: $NP_RUNTIME
-      exit 1
-    fi
-    debug "base command will be: \$run"
-
-
-
-    ### setup environment
-    export NIX_PATH="\$dir/channels:nixpkgs=\$dir/channels/nixpkgs"
-    mkdir -p \$dir/channels
-    [ -h \$dir/channels/nixpkgs ] || ln -s ${nixpkgsSrc} \$dir/channels/nixpkgs
-
-
-    ### install nix store
-    # Install all the nix store paths necessary for the current nix-portable version
-    # We only unpack missing store paths from the tar archive.
-    index="$(cat ${storeTar}/index)"
-
-    export missing=\$(
-      for path in \$index; do
-        basepath=\$(basename \$path)
-        if [ ! -e \$store/\$basepath ]; then
-          echo "nix/store/\$basepath"
-        fi
-      done
-    )
-
-    if [ -n "\$missing" ]; then
-      debug "extracting missing store paths"
-      (
-        mkdir -p \$dir/tmp \$store/
-        rm -rf \$dir/tmp/*
-        cd \$dir/tmp
-        unzip -qqp "\$self" ${ lib.removePrefix "/" "${storeTar}/tar"} \
-          | \$dir/bin/zstd -d \
-          | tar -x \$missing --strip-components 2
-        mv \$dir/tmp/* \$store/
-      )
-      rm -rf \$dir/tmp
-    fi
-
-    if [ -n "\$missing" ]; then
-      debug "registering new store paths to DB"
-      reg="$(cat ${storeTar}/closureInfo/registration)"
-      cmd="\$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix-store --load-db"
-      debug "running command: \$cmd"
-      echo "\$reg" | \$cmd
-    fi
-
-
-    ### select executable
-    # the executable can either be selected by
-    # - executing './nix-portable BIN_NAME',
-    # - symlinking to nix-portable, in which case the name of the symlink selects the nix executable
-    # Alternatively the executable can be hardcoded by specifying the argument 'executable' of nix-portable's default.nix file.
-    executable="${if bundledPackage == null then "" else bundledExe}"
-    if [ "\$executable" != "" ]; then
-      bin="\$executable"
-      debug "executable is hardcoded to: \$bin"
-
-    elif [[ "\$(basename \$0)" == nix-portable* ]]; then\
-      if [ -z "\$1" ]; then
-        echo "Error: please specify the nix binary to execute"
-        echo "Alternatively symlink against \$0"
-        exit 1
-      elif [ "\$1" == "debug" ]; then
-        bin="\$(which \$2)"
-        shift; shift
-      else
-        bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$1"
-        shift
-      fi
-    # for binary selection via symlink
-    else
-      bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$(basename \$0)"
-    fi
-
-
-
-    ### check which runtime has been used previously
-    if [ -f "\$dir/conf/last_runtime" ]; then
-      lastRuntime=\$(cat "\$dir/conf/last_runtime")
-    else
-      lastRuntime=
-    fi
-
-
-
-    ### check if nix is functional with or without sandbox
-    # sandbox-fallback is not reliable: https://github.com/NixOS/nix/issues/4719
-    if [ "\$newNPVersion" == "true" ] || [ "\$lastRuntime" != "\$NP_RUNTIME" ]; then
-      nixBin="\$(dirname \$bin)/nix"
-      debug "Testing if nix can build stuff without sandbox"
-      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox false >&3 2>&3; then
-        echo "Fatal error: nix is unable to build packages"
-        exit 1
-      fi
-
-      debug "Testing if nix sandbox is functional"
-      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox true >&3 2>&3; then
-        debug "Sandbox doesn't work -> disabling sandbox"
-        NP_CONF_SANDBOX=false
-        recreate_nix_conf
-      else
-        debug "Sandboxed builds work -> enabling sandbox"
-        NP_CONF_SANDBOX=true
-        recreate_nix_conf
-      fi
-
-    fi
-
-
-    ### save fingerprint and lastRuntime
-    if [ "\$newNPVersion" == "true" ]; then
-      echo -n "\$fingerprint" > "\$dir/conf/fingerprint"
-    fi
-    if [ "\$lastRuntime" != \$NP_RUNTIME ]; then
-      echo -n \$NP_RUNTIME > "\$dir/conf/last_runtime"
-    fi
-
-
-
-    ### set PATH
-    export PATH="\$dir/busybox/bin"
-    export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
-
-    ### install programs via nix
-    ${concatMapStringsSep "\n" installDynamic bootstrapPrograms}
-
-    ### print elapsed time
-    end=\$(date +%s%N)  # end time in nanoseconds
-    # time elapsed in millis with two decimal places
-
-    # print stats about initialization time of nix-portable
-    # skipt for termux, as it doesn't have bc installed
-    if [ -z "\$TERMUX_VERSION" ]; then
-      elapsed=\$(echo "scale=2; (\$end - \$start)/1000000" | bc)
-      debug "Time to initialize nix-portable: \$elapsed millis"
-    fi
-
-
-    ### run commands
-    [ -z "\$NP_RUN" ] && NP_RUN="\$run"
-    if [ "\$NP_RUNTIME" == "proot" ]; then
-      debug "running command: \$NP_RUN \$bin \$@"
-      exec \$NP_RUN \$bin "\$@"
-    else
-      cmd="\$NP_RUN \$bin \$@"
-      debug "running command: \$cmd"
-      exec \$NP_RUN \$bin "\$@"
-    fi
-    exit
-  '';
-
-  runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
-
-  nixPortable = pkgs.runCommand pname {
-    nativeBuildInputs = [unixtools.xxd unzip];
-
-    meta = {
-      homepage = "https://github.com/DavHau/nix-portable";
-      description = "Nix - Static, Permissionless, Installation-free, Pre-configured for mn5";
-      maintainers = with lib.maintainers.bsc; [ abonerib ];
-      platforms = lib.platforms.linux;
-      license = lib.licenses.mit;
-    };
-  } ''
-    mkdir -p $out/bin
-    echo "${runtimeScriptEscaped}" > $out/bin/nix-portable.zip
-    xxd $out/bin/nix-portable.zip | tail
-
-    sizeA=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
-    echo 504b 0304 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 0200 0000 4242 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    sizeB=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
-    echo 504b 0102 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 0000 0200 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 $sizeA 4242 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    echo 504b 0506 0000 0000 0000 0100 3000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo $sizeB 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    unzip -vl $out/bin/nix-portable.zip
-
-    zip="${zip}/bin/zip -0"
-    $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
-    $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
-    $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
-    $zip $out/bin/nix-portable.zip ${storeTar}/tar
-    $zip $out/bin/nix-portable.zip ${caBundleZstd}
-
-    # create fingerprint
-    fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
-    sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
-    # fix broken zip header due to manual modification
-    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
-
-    rm $out/bin/nix-portable.zip
-    executable=${if bundledPackage == null then "" else bundledExe}
-    if [ "$executable" == "" ]; then
-      target="$out/bin/nix-portable"
-    else
-      target="$out/bin/$(basename "$executable")"
-    fi
-    mv $out/bin/nix-portable-fixed.zip "$target"
-    chmod +x "$target"
-  '';
-in
-nixPortable.overrideAttrs (prev: {
-  passthru = (prev.passthru or {}) // {
-    inherit bwrap;
-  };
-})
--- a/pkgs/nix-wrap/default.nix
+++ b/pkgs/nix-wrap/default.nix
@@ -14,7 +14,7 @@ let
  nixConfDir = "share";
  nix_wrap_sh = writeText "nix-wrap.sh" ''
    #!/usr/bin/env bash
-
+    #
    busybox_bin="${nixPrefix}${busybox}/bin"
    bubblewrap_bin="${nixPrefix}/${bubblewrap}/bin"

@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
  name = "nix-wrap";
  buildInputs = [
    bashInteractive
+    busybox
    nix
  ];
  src = null;
@@ -91,6 +92,7 @@ stdenv.mkDerivation rec {
    homepage = null;
    description = "nix bubblewrap wrapper";
    maintainers = [ ];
+    broken = true;
    platforms = lib.platforms.linux;
    license = lib.licenses.mit;
  };
--- a/pkgs/nixgen/default.nix
+++ b/pkgs/nixgen/default.nix
@@ -8,6 +8,7 @@ stdenv.mkDerivation {
  version = "0.0.1";
  src = ./nixgen;
  dontUnpack = true;
+  strictDeps = true;
  phases = [ "installPhase" ];
  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/nixtools/default.nix
+++ b/pkgs/nixtools/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
  makeFlags = [ "DESTDIR=$(out)" ];
  preBuild = "env";
  dontPatchShebangs = true;
+  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/nixtools";
--- a/pkgs/nodes/default.nix
+++ b/pkgs/nodes/default.nix
@@ -48,6 +48,7 @@ in
    enableParallelBuilding = true;
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;

    configureFlags = [
      "--with-nosv=${nosv}"
--- a/pkgs/nosv/default.nix
+++ b/pkgs/nosv/default.nix
@@ -7,7 +7,7 @@
 , numactl
 , hwloc
 , papi
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , cacheline ? 64 # bits
 , ovni ? null
 , useGit ? false
@@ -40,16 +40,17 @@ let

  source = if (useGit) then git else release;
 in
-  stdenv.mkDerivation rec {
+  stdenv.mkDerivation {
    pname = "nosv";
    inherit (source) src version;
    hardeningDisable = [ "all" ];
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;
    configureFlags = [
      "--with-ovni=${ovni}"
      "CACHELINE_WIDTH=${toString cacheline}"
-    ];
+    ] ++ lib.optionals enablePapi [ "--with-papi=${papi}" ];
    nativeBuildInputs = [
      autoreconfHook
      pkg-config
@@ -59,6 +60,7 @@ in
      hwloc
      ovni
    ] ++ lib.optionals enablePapi [ papi ];
+    patches = [ ./fix-papi.patch ];

    meta = {
      homepage = "https://gitlab.bsc.es/nos-v/nos-v";
--- a/pkgs/nosv/fix-papi.patch
+++ b/pkgs/nosv/fix-papi.patch
@@ -0,0 +1,136 @@
+Commit ID: c09633f172ce4075e0a05a33f6dcbe8e03e1202a
+Change ID: onmwypnnrysktutwsvotqovzponvwrxs
+Bookmarks: fix/papi fix/papi@git fix/papi@origin
+Author   : Aleix Boné <aleix.boneribo@bsc.es> (2025-12-10 11:14:14)
+Committer: Aleix Boné <aleix.boneribo@bsc.es> (2025-12-12 12:56:48)
+
+    Improve PAPI m4 module for cross compilation
+
+diff --git a/m4/papi.m4 b/m4/papi.m4
+index de90584870..8398f856f5 100644
+--- a/m4/papi.m4
+++ b/m4/papi.m4
+@@ -1,6 +1,6 @@
+ #	This file is part of Nanos6 and is licensed under the terms contained in the COPYING file.
+ #
+-#	Copyright (C) 2021-2022 Barcelona Supercomputing Center (BSC)
+#	Copyright (C) 2021-2025 Barcelona Supercomputing Center (BSC)
+ 
+ AC_DEFUN([AC_CHECK_PAPI],
+ 	[
+@@ -8,34 +8,38 @@
+ 			[papi],
+ 			[AS_HELP_STRING([--with-papi=prefix], [specify the installation prefix of PAPI])],
+ 			[ ac_cv_use_papi_prefix=$withval ],
+-			[ ac_cv_use_papi_prefix="" ]
+			[ ac_cv_use_papi_prefix="check" ]
+ 		)
+ 
+ 		if test x"${ac_cv_use_papi_prefix}" = x"no"; then
+ 			AC_MSG_CHECKING([the PAPI installation prefix])
+ 			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+ 			ac_use_papi=no
+-		elif test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-			AC_MSG_CHECKING([the PAPI installation prefix])
+-			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+-			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
+-			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
+-			ac_use_papi=yes
+-		else
+		elif test x"${ac_cv_use_papi_prefix}" = x""; then
+			AC_MSG_RESULT([invalid prefix])
+			AC_MSG_ERROR([papi prefix specified but empty])
+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" -o x"${ac_cv_use_papi_prefix}" = x"check"; then
+ 			PKG_CHECK_MODULES(
+ 				[papi],
+-				[papi],
+				[papi >= 5.6.0],
+ 				[
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([retrieved from pkg-config])
+ 					papi_CFLAGS="${papi_CFLAGS}"
+ 					ac_use_papi=yes
+					ac_papi_version_correct=yes
+ 				], [
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([not available])
+ 					ac_use_papi=no
+ 				]
+ 			)
+		else
+			AC_MSG_CHECKING([the PAPI installation prefix])
+			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
+			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
+			ac_use_papi=yes
+ 		fi
+ 
+ 		if test x"${ac_use_papi}" = x"yes" ; then
+@@ -53,10 +57,10 @@
+ 					ac_use_papi=yes
+ 				],
+ 				[
+-					if test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-						AC_MSG_ERROR([PAPI cannot be found.])
+					if test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
+						AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 					else
+-						AC_MSG_WARN([PAPI cannot be found.])
+						AC_MSG_WARN([PAPI >= 5.6.0 not available.])
+ 					fi
+ 					ac_use_papi=no
+ 				]
+@@ -64,30 +68,38 @@
+ 
+ 			CFLAGS="${ac_save_CFLAGS}"
+ 			LIBS="${ac_save_LIBS}"
+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
+			AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 		fi
+ 
+-		if test x"${ac_use_papi}" = x"yes" ; then
+-			if test x"${ac_cv_use_papi_prefix}" != x"" ; then
+		if test x"${ac_use_papi}" = x"yes" -a x"${ac_papi_version_correct}" != x"yes" ; then
+			if test x"${ac_cv_use_papi_prefix}" != x"yes" -a x"${ac_cv_use_papi_prefix}" != x"check" ; then
+ 				papiBinary=${ac_cv_use_papi_prefix}/bin/papi_version
+ 			else
+ 				papiBinary=papi_version
+ 			fi
+-			papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
+ 
+-			AX_COMPARE_VERSION(
+-				[[${papiVersion}]],
+-				[[ge]],
+-				[[5.6.0]],
+-				[[ac_papi_version_correct=yes]],
+-				[[ac_papi_version_correct=no]]
+-			)
+ 
+-			if test x"${ac_papi_version_correct}" != x"yes" ; then
+-				AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
+-				ac_use_papi=no
+			if test x"$cross_compiling" = x"yes" ; then
+				AC_MSG_WARN([Cross-compiling detected, skipping PAPI version check])
+ 			else
+-				AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
+-				AC_MSG_RESULT([${ac_papi_version_correct}])
+				papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
+
+				AX_COMPARE_VERSION(
+					[[${papiVersion}]],
+					[[ge]],
+					[[5.6.0]],
+					[[ac_papi_version_correct=yes]],
+					[[ac_papi_version_correct=no]]
+				)
+
+				if test x"${ac_papi_version_correct}" != x"yes" ; then
+					AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
+					ac_use_papi=no
+				else
+					AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
+					AC_MSG_RESULT([${ac_papi_version_correct}])
+				fi
+ 			fi
+ 		fi
+ 
--- a/pkgs/onemath/default.nix
+++ b/pkgs/onemath/default.nix
@@ -1,91 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  cmake,
-  withCFlags,
-  intelPackages,
-
-  mklSupport ? true,
-
-  config,
-
-  cudaSupport ? config.cudaSupport,
-  cudaPackages ? { },
-
-  rocmSupport ? config.rocmSupport,
-  hipTargets ? null, # only one target at a time supported
-  rocmPackages ? { },
-}:
-
-let
-  # rocmSupport is not enough, we need a specific target
-  enableHip = rocmSupport && hipTargets != null;
-
-  stdenv = withCFlags (lib.optionals cudaSupport [
-    "--cuda-path=${cudaPackages.cudatoolkit}"
-  ]) intelPackages.stdenv;
-in
-
-# at least one backend has to be enabled
-assert mklSupport || cudaSupport || enableHip;
-
-stdenv.mkDerivation rec {
-  pname = "oneMath";
-  version = "0.8";
-
-  src = fetchFromGitHub {
-    owner = "uxlfoundation";
-    repo = "oneMath";
-    rev = "v${version}";
-    sha256 = "sha256-xK8lKI3oqKlx3xtvdScpMq+HXAuoYCP0BZdkEqnJP5o=";
-  };
-
-  cmakeFlags = [
-    (lib.cmakeBool "ENABLE_MKLCPU_BACKEND" mklSupport)
-    (lib.cmakeBool "ENABLE_MKLGPU_BACKEND" mklSupport)
-
-    (lib.cmakeBool "ENABLE_CUBLAS_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUFFT_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CURAND_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSOLVER_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSPARSE_BACKEND" cudaSupport)
-
-    (lib.cmakeBool "ENABLE_ROCBLAS_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCFFT_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSOLVER_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCRAND_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSPARSE_BACKEND" enableHip)
-
-    (lib.cmakeBool "BUILD_FUNCTIONAL_TESTS" false)
-    (lib.cmakeBool "BUILD_EXAMPLES" false)
-  ]
-  ++ lib.optionals enableHip [
-    (lib.cmakeFeature "HIP_TARGETS" hipTargets)
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs =
-    lib.optionals (mklSupport) [
-      intelPackages.mkl
-      intelPackages.tbb
-    ]
-    ++ lib.optionals (enableHip) [
-      rocmPackages.rocmPath
-      rocmPackages.rocblas
-      rocmPackages.rocfft
-      rocmPackages.rocsolver
-      rocmPackages.rocrand
-      rocmPackages.rocsparse
-    ]
-    ++ lib.optionals (cudaSupport) [
-      (lib.getDev cudaPackages.cuda_cudart)
-      cudaPackages.cudatoolkit
-
-      cudaPackages.libcublas
-      cudaPackages.libcurand
-      cudaPackages.libcufft
-      cudaPackages.libcusparse
-      cudaPackages.libcusolver
-    ];
-
-}
--- a/pkgs/osu/default.nix
+++ b/pkgs/osu/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {

  doCheck = true;
  enableParallelBuilding = true;
+  strictDeps = true;
  nativeBuildInputs = [ mpiAll ];
  buildInputs = [ mpiAll ];
  hardeningDisable = [ "all" ];
--- a/pkgs/ovni/default.nix
+++ b/pkgs/ovni/default.nix
@@ -40,6 +40,7 @@ in
    inherit (source) src version;
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;
    postPatch = ''
      patchShebangs --build test/
    '';
--- a/pkgs/papi/default.nix
+++ b/pkgs/papi/default.nix
@@ -0,0 +1,22 @@
+{
+  stdenv,
+  papi,
+}:
+
+if stdenv.hostPlatform == stdenv.buildPlatform then
+  papi
+else
+  papi.overrideAttrs (old: {
+    configureFlags = (old.configureFlags or [ ]) ++ [
+      "--enable-perf_event_uncore=no"
+      "--with-sysdetect=no"
+      "--with-ffsll"
+      "--with-tls=__thread"
+      "--with-virtualtimer=clock_thread_cputime_id"
+      "--with-walltimer=clock_realtime"
+      "--with-perf-events"
+      "--with-CPU=${stdenv.hostPlatform.uname.processor}"
+      "--with-arch=${stdenv.hostPlatform.uname.processor}"
+    ];
+    patches = (old.patches or [ ]) ++ [ ./fix-ar-cross.patch ];
+  })
--- a/pkgs/papi/fix-ar-cross.patch
+++ b/pkgs/papi/fix-ar-cross.patch
@@ -0,0 +1,19 @@
+diff --git a/sde_lib/Makefile b/sde_lib/Makefile
+index 8518f92..90a9953 100644
+--- a/sde_lib/Makefile
+++ b/sde_lib/Makefile
+@@ -1,4 +1,5 @@
+ CC ?= gcc
+AR ?= ar
+ SDE_INC = -I. -I..
+ SDE_LD = -ldl -pthread
+ CFLAGS += -Wextra -Wall -O2
+@@ -18,7 +19,7 @@ dynamic: $(DOBJS)
+ 	rm -f *_d.o
+ 
+ static: $(SOBJS)
+-	ar rs libsde.a $(SOBJS)
+	$(AR) rs libsde.a $(SOBJS)
+ 	rm -f *_s.o
+ 
+ clean:
--- a/pkgs/paraver/default.nix
+++ b/pkgs/paraver/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {

  dontStrip = true;
  enableParallelBuilding = true;
+  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3"
--- a/pkgs/paraver/kernel.nix
+++ b/pkgs/paraver/kernel.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  dontStrip = true;
+  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3 -DPARALLEL_ENABLED"
--- a/pkgs/pocl/0001-cmake-do-not-use-suffix.patch
+++ b/pkgs/pocl/0001-cmake-do-not-use-suffix.patch
@@ -1,26 +0,0 @@
-From ccf301659caac9b5e973ba1f2d32352acf617a98 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
-Date: Tue, 2 Jul 2024 16:45:05 +0200
-Subject: [PATCH] cmake: do not use suffix
-
---
- cmake/LLVM.cmake                              |  3 ++
- 1 files changed, 3 insertions(+)
-
-diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
-index f4dbda065..e29144dce 100644
--- a/cmake/LLVM.cmake
-+++ b/cmake/LLVM.cmake
-@@ -65,6 +65,9 @@ else()
-     message(WARNING "Cannot determine llvm binary suffix from ${LLVM_CONFIG}")
-   endif()
-   message(STATUS "LLVM binaries suffix : ${LLVM_BINARY_SUFFIX}")
-+
-+  # We don't want suffixes in nix
-+  set(LLVM_BINARY_SUFFIX "")
- endif()
- 
- get_filename_component(LLVM_CONFIG_LOCATION "${LLVM_CONFIG}" DIRECTORY)
-- 
-2.45.1
-
--- a/pkgs/pocl/0001-cmake-native-build-tools.patch
+++ b/pkgs/pocl/0001-cmake-native-build-tools.patch
@@ -1,33 +0,0 @@
-From f24b456c50f587b05cc8f2699c94d8cdefc5b13e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
-Date: Tue, 2 Jul 2024 17:11:11 +0200
-Subject: [PATCH] cmake: native build tools
-
---
- cmake/LLVM.cmake                    |   7 +-
- 1 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
-index e29144dce..b9f14ce6a 100644
--- a/cmake/LLVM.cmake
-+++ b/cmake/LLVM.cmake
-@@ -269,10 +269,15 @@ endforeach()
- 
- ####################################################################
- 
-+if(DEFINED LLVM_NATIVE_TOOL_DIR)
-+  set(TOOL_DIR "${LLVM_NATIVE_TOOL_DIR}")
-+  message(STATUS "TOOL_DIR=${TOOL_DIR}")
-+endif()
-+
- macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
-   find_program(${OUTPUT_VAR}
-     NAMES "${PROG_NAME}${LLVM_BINARY_SUFFIX}${CMAKE_EXECUTABLE_SUFFIX}"
-    HINTS "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
-+    HINTS "${TOOL_DIR}" "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
-     DOC "${DOCSTRING}"
-     NO_CMAKE_PATH
-     NO_CMAKE_ENVIRONMENT_PATH
-- 
-2.45.1
-
--- a/pkgs/pocl/0001-cmake-use-clang-from-cmake-variable.patch
+++ b/pkgs/pocl/0001-cmake-use-clang-from-cmake-variable.patch
@@ -1,48 +0,0 @@
-From 4688b5ce895761c884ae15fc0234ed8d623b988b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
-Date: Tue, 2 Jul 2024 15:41:47 +0200
-Subject: [PATCH] cmake: use clang from cmake variable
-
---
- cmake/LLVM.cmake | 22 ++++++++++++++++++++--
- 1 file changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
-index 71b786dc7..f4dbda065 100644
--- a/cmake/LLVM.cmake
-+++ b/cmake/LLVM.cmake
-@@ -281,11 +281,29 @@ macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
-   endif()
- endmacro()
- 
-find_program_or_die( CLANG "clang" "clang binary")
-+# -DCMAKE_C_COMPILER=riscv64-unknown-linux-gnu-clang -DCMAKE_CXX_COMPILER=riscv64-unknown-linux-gnu-clang++
-+
-+# if(DEFINED CLANG_EXECUTABLE)
-+if(DEFINED CMAKE_C_COMPILER)
-+  # set(CLANG "${CLANG_EXECUTABLE}")
-+  set(CLANG "${CMAKE_C_COMPILER}")
-+  message(STATUS "Using CLANG_EXECUTABLE: ${CLANG}")
-+else()
-+  find_program_or_die( CLANG "clang" "clang binary")
-+endif()
- execute_process(COMMAND "${CLANG}" "--version" OUTPUT_VARIABLE LLVM_CLANG_VERSION RESULT_VARIABLE CLANG_RES)
-+
- # TODO this should be optional
-find_program_or_die( CLANGXX "clang++" "clang++ binary")
-+# if(DEFINED CLANGXX_EXECUTABLE)
-+if(DEFINED CMAKE_CXX_COMPILER)
-+  # set(CLANGXX "${CLANGXX_EXECUTABLE}")
-+  set(CLANGXX "${CMAKE_CXX_COMPILER}")
-+  message(STATUS "Using CLANGXX_EXECUTABLE: ${CLANGXX}")
-+else()
-+  find_program_or_die( CLANGXX "clang++" "clang++ binary")
-+endif()
- execute_process(COMMAND "${CLANGXX}" "--version" OUTPUT_VARIABLE LLVM_CLANGXX_VERSION RESULT_VARIABLE CLANGXX_RES)
-+
- if(CLANGXX_RES OR CLANG_RES)
-   message(FATAL_ERROR "Failed running clang/clang++ --version")
- endif()
-- 
-2.45.1
-
--- a/pkgs/pocl/default.nix
+++ b/pkgs/pocl/default.nix
@@ -1,255 +0,0 @@
-{
-  lib,
-  llvmPackages,
-  ninja,
-  cmake,
-  hwloc,
-  ocl-icd,
-  opencl-headers,
-  getconf,
-  pkg-config,
-  spirv-llvm-translator,
-  spirv-tools,
-  libxml2, # required for statically linked llvm
-  python3,
-  writableTmpDirAsHomeHook,
-  writeText,
-  runCommand,
-  opencl-cts,
-
-  fetchFromGitHub,
-
-  useGit ? false,
-  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/pocl/pocl.git",
-  gitBranch ? "feat/nosv",
-  gitCommit ? "556542309fc3c5900cf05dae5b41d200cd3de6a0",
-
-  staticLLVM ? true,
-  enableICD ? true,
-  enableSPIRV ? true,
-  enableHWLOC ? true,
-  enableRemoteServer ? false,
-  enableRemoteClient ? false,
-  enableDistroVariants ? false,
-
-  lttng-ust,
-  enableLTTNG ? false,
-
-  onetbb,
-  enableTBB ? false,
-
-  nosv ? null,
-  ovni ? null,
-  enableNOSV ? useGit,
-  enableOVNI ? useGit,
-
-  buildPackages,
-  targetPackages,
-  nix-update-script,
-}:
-
-assert (enableNOSV || enableOVNI) -> useGit;
-
-let
-
-  release = rec {
-    version = "7.1";
-    src = fetchFromGitHub {
-      owner = "pocl";
-      repo = "pocl";
-      tag = "v${version}";
-      hash = "sha256-bS6vTIjLO7YLs7qYLKW0cYYbEJ/hRS/+IjjAKbkj8ac=";
-    };
-  };
-
-  git = rec {
-    version = src.shortRev;
-    src = builtins.fetchGit {
-      url = gitUrl;
-      ref = gitBranch;
-      rev = gitCommit;
-    };
-  };
-
-  source = if (useGit) then git else release;
-
-  stdenv = llvmPackages.stdenv;
-
-  buildLlvmPackages = buildPackages.llvmPackages;
-
-  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  featureList = lib.concatStringsSep "+" (
-    (lib.optionals enableICD [ "icd" ])
-    ++ (lib.optionals enableNOSV [ "nosv" ])
-    ++ (lib.optionals enableOVNI [ "ovni" ])
-    ++ (lib.optionals enableSPIRV [ "spirv" ])
-    ++ (lib.optionals enableTBB [ "tbb" ])
-    ++ (lib.optionals enableRemoteClient [ "server" ])
-    ++ (lib.optionals enableRemoteServer [ "client" ])
-  );
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "pocl";
-  version = featureList + "-" + source.version;
-  inherit (source) src;
-
-  patches = lib.optionals useGit [
-    ./0001-cmake-use-clang-from-cmake-variable.patch
-    ./0001-cmake-do-not-use-suffix.patch
-    ./0001-cmake-native-build-tools.patch
-  ];
-
-  cmakeFlags = [
-    # TODO: all these are broken when cross compiling. Upstream has refactored
-    # all the cmake infra for cross compilation, but it's not in a release yet
-    (lib.cmakeOptionType "filepath" "WITH_LLVM_CONFIG" (
-      lib.getExe' buildLlvmPackages.llvm.dev "llvm-config"
-    ))
-    (lib.cmakeOptionType "filepath" "CLANG" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang"))
-    (lib.cmakeOptionType "filepath" "CLANGXX" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang++"))
-    (lib.cmakeOptionType "path" "CLANG_RESOURCE_DIR" "${llvmPackages.stdenv.cc}/resource-root")
-
-    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
-
-    (lib.cmakeBool "ENABLE_RELOCATION" true)
-    (lib.cmakeBool "ENABLE_POCL_BUILDING" true)
-    (lib.cmakeBool "POCL_ICD_ABSOLUTE_PATH" true)
-
-    (lib.cmakeBool "ENABLE_TBB_DEVICE" enableTBB)
-    (lib.cmakeBool "ENABLE_ICD" enableICD)
-    (lib.cmakeBool "ENABLE_HWLOC" enableHWLOC)
-    (lib.cmakeBool "ENABLE_LTTNG" enableLTTNG)
-
-    (lib.cmakeBool "ENABLE_REMOTE_CLIENT" enableRemoteClient)
-    (lib.cmakeBool "ENABLE_REMOTE_SERVER" enableRemoteServer)
-
-    # avoid the runtime linker pulling in a different llvm e.g. from graphics drivers
-    (lib.cmakeBool "STATIC_LLVM" staticLLVM)
-  ]
-  ++ lib.optionals (enableNOSV || enableOVNI) [
-    (lib.cmakeBool "ENABLE_NOSV" enableNOSV)
-    (lib.cmakeBool "ENABLE_OVNI" enableOVNI)
-  ]
-  ++ lib.optionals (!isCross && enableDistroVariants) [
-    (lib.cmakeFeature "KERNELLIB_HOST_CPU_VARIANTS" "distro") # TODO: check if we can do it when cross compiling
-  ]
-  ++ lib.optionals isCross [
-    (lib.cmakeFeature "CMAKE_SYSTEM_NAME" "Linux")
-    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PROGRAM" "NEVER")
-    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_LIBRARY" "ONLY")
-    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_INCLUDE" "ONLY")
-    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PACKAGE" "ONLY")
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isRiscV [
-    (lib.cmakeFeature "LLC_TRIPLE" "riscv64-unknown-linux-gnu")
-    (lib.cmakeFeature "LLC_HOST_CPU" "rv64g")
-    (lib.cmakeFeature "CLANG_MARCH_FLAG" "-march=")
-  ];
-
-  # Fixes error: ld: cannot find -lgcc / -lgcc_s when linking from libpocl on
-  # host
-  preConfigure = ''
-    cmakeFlagsArray+=(
-      -DEXTRA_HOST_LD_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
-      -DEXTRA_KERNEL_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
-    )
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    getconf
-    ninja
-    pkg-config
-    python3
-  ];
-
-  buildInputs = [
-    opencl-headers
-    llvmPackages.libclang
-    llvmPackages.llvm
-  ]
-  ++ lib.optionals staticLLVM [ libxml2 ]
-  ++ lib.optionals enableNOSV [ nosv ]
-  ++ lib.optionals enableOVNI [ ovni ]
-  ++ lib.optionals enableHWLOC [ hwloc ]
-  ++ lib.optionals enableTBB [ onetbb ]
-  ++ lib.optionals enableICD [ ocl-icd ]
-  ++ lib.optionals enableLTTNG [ lttng-ust ]
-  ++ lib.optionals enableSPIRV [
-    (spirv-llvm-translator.override { inherit (llvmPackages) llvm; })
-    spirv-tools
-  ];
-
-  nativeInstallCheckInputs = [
-    writableTmpDirAsHomeHook # needed for POCL_CACHE_DIR
-  ];
-
-  doInstallCheck = true;
-
-  installCheckPhase = lib.optionalString enableICD ''
-    runHook preInstallCheck
-
-    export OCL_ICD_VENDORS=$out/etc/OpenCL/vendors
-    $out/bin/poclcc -o poclcc.cl.pocl $src/examples/poclcc/poclcc.cl
-
-    runHook postInstallCheck
-  '';
-
-  setupHook = lib.optionalDrvAttr enableICD (
-    writeText "setup-hook" ''
-      addToSearchPath OCL_ICD_VENDORS @out@/etc/OpenCL/vendors
-    ''
-  );
-
-  passthru =
-    let
-      self = finalAttrs.finalPackage;
-    in
-    {
-      updateScript = nix-update-script { };
-      git = self.override { useGit = true; };
-
-      withICD = enableICD;
-
-      test = {
-        # Run builtin tests (causes a rebuild)
-        self = self.overrideAttrs { doCheck = true; };
-
-        # Run basic test from Khronos OpenCL Conformance Test Suite
-        # WARN: despite its name, test_basic is very exhaustive, and can take more
-        # than 1 hour in a marenostrum5 node.
-        cts =
-          assert enableICD;
-          lib.genAttrs [ "api" "basic" "c11_atomics" "printf" "svm" ] (
-            name:
-            runCommand "pocl-cts-test_${name}" {
-              nativeBuildInputs = [ self ];
-              requiredSystemFeatures = [ "sys-devices" ];
-              env = {
-                POCL_DEBUG = "error,warn";
-                POCL_CACHE_DIR = "/build/pocl_cache";
-              };
-            } "${opencl-cts}/bin/Release/test_${name} | tee $out"
-          );
-      };
-    };
-
-  env.HWLOC_SYNTHETIC = lib.optionalDrvAttr enableHWLOC "node:1 core:1 pu:1";
-
-  propagatedBuildInputs = [ stdenv.cc.cc ];
-
-  meta = with lib; {
-    description = "A portable open source (MIT-licensed) implementation of the OpenCL standard";
-    homepage = "http://portablecl.org";
-    license = licenses.mit;
-    maintainers = with maintainers; [
-      leixb
-      jansol
-      xddxdd
-      bsc.maintainers.abonerib
-    ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-})
--- a/pkgs/slurm-exporter/default.nix
+++ b/pkgs/slurm-exporter/default.nix
@@ -13,6 +13,7 @@ buildGoModule rec {

  vendorHash = "sha256-A1dd9T9SIEHDCiVT2UwV6T02BSLh9ej6LC/2l54hgwI=";
  doCheck = false;
+  strictDeps = true;

  meta = with lib; {
    description = "Prometheus SLURM Exporter";
--- a/pkgs/sonar/default.nix
+++ b/pkgs/sonar/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
  };
  hardeningDisable = [ "all" ];
  dontStrip = true;
+  strictDeps = true;
  configureFlags = [ "--with-ovni=${ovni}" ];

  nativeBuildInputs = [
--- a/pkgs/tagaspi/default.nix
+++ b/pkgs/tagaspi/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
  pname = "tagaspi";
  enableParallelBuilding = true;
  separateDebugInfo = true;
+  strictDeps = true;

  version = "2.0";
  src = fetchFromGitHub {
--- a/pkgs/tampi/default.nix
+++ b/pkgs/tampi/default.nix
@@ -45,6 +45,7 @@ in stdenv.mkDerivation {
  inherit (source) src version;
  enableParallelBuilding = true;
  separateDebugInfo = true;
+  strictDeps = true;

  nativeBuildInputs = [
    autoconf
--- a/pkgs/tasycl/default.nix
+++ b/pkgs/tasycl/default.nix
@@ -1,87 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoconf,
-  automake,
-  autoreconfHook,
-  boost,
-  fetchFromGitHub,
-  gnumake,
-  libtool,
-  withCFlags,
-
-  useIntel ? true,
-  adaptivecpp ? null,
-  intelPackages ? null,
-
-  useGit ? false,
-  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/tasycl/tasycl.git",
-  gitBranch ? "main",
-  gitCommit ? "78f98dcf60a66e0eaa3b4ebcf55be076bec64825",
-}:
-
-assert !useIntel -> adaptivecpp != null;
-assert useIntel -> intelPackages != null;
-
-let
-  variant = if useIntel then "intel" else "acpp";
-
-  syclStdenv = withCFlags [ "-O3" ] (if useIntel then intelPackages.stdenv else stdenv);
-
-  release = rec {
-    version = "2.1.0";
-    src = fetchFromGitHub {
-      owner = "bsc-pm";
-      repo = "tasycl";
-      rev = version;
-      hash = "sha256-0kXnb0lHeQNHR27GTLbJ8xbiICLU8k2+FqEnnFSrzzo=";
-    };
-  };
-
-  git = rec {
-    version = src.shortRev;
-    src = builtins.fetchGit {
-      url = gitUrl;
-      ref = gitBranch;
-      rev = gitCommit;
-    };
-  };
-
-  source = if (useGit) then git else release;
-
-in
-
-syclStdenv.mkDerivation {
-  pname = "tasycl-${variant}";
-  inherit (source) src version;
-
-  enableParallelBuilding = true;
-  separateDebugInfo = true;
-
-  nativeBuildInputs = [
-    autoreconfHook
-    automake
-    autoconf
-    libtool
-    gnumake
-  ];
-
-  buildInputs = [
-    boost
-  ];
-
-  configureFlags = lib.optionals (!useIntel) [
-    "CXX=${lib.getExe adaptivecpp}"
-  ];
-
-  # add symlinks so we can explicitly link with tasycl-intel / tasycl-acpp
-  postInstall = ''
-    pushd $out/lib
-    for i in libtasycl* ; do
-      ln -s "$i" "''\${i/tasycl/tasycl-${variant}}"
-    done
-    popd
-  '';
-
-  hardeningDisable = [ "all" ];
-}
--- a/pkgs/unified-runtime/default.nix
+++ b/pkgs/unified-runtime/default.nix
@@ -1,63 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  python3,
-  cudatoolkit,
-  libbacktrace,
-  intel-compute-runtime,
-  level-zero,
-  unified-memory-framework,
-  autoAddDriverRunpath,
-
-  enableL0 ? false,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "unified-runtime";
-  version = "2025-WW45";
-
-  src = fetchFromGitHub {
-    owner = "intel";
-    repo = "llvm";
-    tag = version;
-    sha256 = "sha256-yf8pFEeNEWf9LpEhAy4vMdFDlA08x5XaCegnq+5aXRw=";
-  };
-
-  sourceRoot = "${src.name}/unified-runtime";
-
-  nativeBuildInputs = [
-    cmake
-    python3
-    libbacktrace
-    (python3.withPackages (
-      python-pkgs: with python-pkgs; [
-        lit
-        filecheck
-      ]
-    ))
-    autoAddDriverRunpath
-  ];
-
-  buildInputs = [
-    unified-memory-framework
-    cudatoolkit
-  ]
-  ++ lib.optionals enableL0 [
-    intel-compute-runtime
-    level-zero
-  ];
-
-  cmakeFlags = [
-    (lib.cmakeBool "UR_USE_EXTERNAL_UMF" true)
-    (lib.cmakeBool "UR_BUILD_TESTS" false)
-
-    (lib.cmakeBool "UR_BUILD_ADAPTER_CUDA" true)
-    (lib.cmakeBool "UR_BUILD_ADAPTER_L0" enableL0)
-
-    (lib.cmakeBool "UR_BUILD_ADAPTER_OPENCL" false)
-    (lib.cmakeBool "UR_BUILD_ADAPTER_HIP" false)
-    (lib.cmakeBool "UR_BUILD_ADAPTER_NATIVE_CPU" false)
-  ];
-}
--- a/pkgs/upc-qaire-exporter/default.nix
+++ b/pkgs/upc-qaire-exporter/default.nix
@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication {
  src = ./.;

  doCheck = false;
+  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/secrets/ceph-user.age
+++ b/secrets/ceph-user.age
@@ -1,29 +1,25 @@
 age-encryption.org/v1
-> ssh-ed25519 AY8zKw Crgof1PMHzv3jBw8VeJAst6FKSoyqPFdANFpf79CAgo
-7fagE5BmlWdTsdY/i3RbExu1KBcjW1LQXbYwu6chxlk
-> ssh-ed25519 sgAamA tGRCaK8mjvz65YziXjRcjMOHIRoyGNJFzBEEbivXPDo
-YLzE5a3J81r+gzkfZIeh9gS+mXzMooC82tBbZ+C3C8o
-> ssh-ed25519 HY2yRg +vhO1/vdGPM1JnZRsvVnViFWaFWUZ7MIqvWdePivkxA
-2K+JdN82DTeGh9QwZBTaghg8C5BCLoEsOgTCM64PU28
-> ssh-ed25519 fw2Xhg NHDn0dq32I/AVdUZlpzBX6retlEYEUipde7A9R90qW4
-SJO78ooqEwfHlBRW+YCzgSQJb1JHNo8jz37t3qvLClE
-> ssh-ed25519 G5LX5w d4HfLzI2623artkR2FIfRJgr5yb2BKZJUWqPnwOWDCk
-Kh50QESJZSjaJPyp3xroHGn0fD5pPNEYgKkDdqxGpjs
-> ssh-ed25519 tcumPQ wQyOKtT15Qezs3cyv5/xxIPVD7Jyk6N6ZLkfxxBHLTo
-rKlRBjJdfDVT6U8211+ssFF8yY9yRs1u3GhCSvsw2oE
-> ssh-ed25519 JJ1LWg 98tF1MdA244xNny4w3RnMFuubf4WcuQaZf2bN2Uq8Qc
-MA1Xh1H9vHisVYdqkxNeBkngtn8cYuT2eSimvooIXYo
-> ssh-ed25519 cDBabA imJ0rXLQETELP7yo3sArhqA9nJwY+S6gkC7tA7CJsQA
-pKMHW/KDAoEj5ZD64VKekg6et9hlS2PKSgDw3eB3eu8
-> ssh-ed25519 WY7yGw +2g5021/02HvLxLqq42ynr6qKgOKJ3J5GgB1a1bmFXg
-fYvj52R6bM6ngPOZ2lwVezTJnx+8LJBbdnaapKKbyd0
-> ssh-ed25519 cK5kHw fLZ6yF3NggJ724rjYqhs5ZZh1xUExuK+ITAyqONluzk
-NS9OMX70XEHrbPQnmC4KB/eoiHChIb8DwDLYJiwOLUU
-> ssh-ed25519 CAWG4Q tVduE/wMzdfS+DjNbU3Q4blNhL/A63IehNSZGJkJjD0
-jEBB5zG+gLA/88YF+KqWQsNH7lfCsWNvAkrgfbescFs
-> ssh-ed25519 xA739A ZhFvev77I+YOl1YSHKn2ZcEvGoLjWOILufjd4q/k8HM
-YXEtHHtjPQlgZW60zHgHm7CLI6vYiRo+AM8QERL9tCg
-> ssh-ed25519 MSF3dg 9DvLNheBU1vlfW2zNNxBrGnJ6k4P5ox7s+OGKlgRdyQ
-wseHfLGHz0huNi5sZsNOfeNkm6Kjjx0SZ8lK4/oXtUQ
--- bnJE+14onuSla0XmckD4z/wChWGZh6exbkcbyhcmNYU
-<EFBFBD><EFBFBD>t<>N猈<><10>U<EFBFBD>w▮i2<69><32>-<2D>iV'(<1E>IF<49><46>	S<><53>xs/s<><73>	<09><>NDm<44>Q<EFBFBD><51><EFBFBD>o<EFBFBD><6F><EFBFBD><EFBFBD>wZv<7F><76>.\
+-> ssh-ed25519 AY8zKw /gmhFOFqOs8IobAImvQVKeM5Y6k0FpuR61/Cu5drVVI
+g9FXJg2oIoien0zJ70FWHwSTM8SBwbpS188S3Swj7EM
+-> ssh-ed25519 sgAamA opPjlWPhSiI0Rd5l7kd204S5FXFLcQcQftyKb7MDmnU
+3XrRDVnglCP+vBwvfd1rP5gHttsGDHyXwbf10a8/kKY
+-> ssh-ed25519 HY2yRg QKZbubM76C3tobPoyCFDRclA9Pzb2fC7s4WOoIgdORc
+K5kckU0KhQFTE6SikJXFJgM41Tco5+VqOsaG0qLrY1Q
+-> ssh-ed25519 fw2Xhg +ohqts8dLFjvdHxrGHcOGxU0dm+V3N//giljHkobpDM
+jR/UzGrfS9lrJ/VeolKLxfzeJAf2fIB2pdIn/6ukqNk
+-> ssh-ed25519 tcumPQ 3DPkDPIQQSVtXSLzIRETsIyXQ0k1o18Evn6vf+l/6R8
+bLXF62OmJjnOT1vvgq3+AcOKKSG5NonrK5EqCVc0Mwo
+-> ssh-ed25519 JJ1LWg 2Wefc7eLolMU5InEmCNTq21Mf71mI0a2N1HgDrlHvy4
+qXFW9CQBnrzubZ0mzS0Io2WGRrwGBkmeYndBTcZn/fM
+-> ssh-ed25519 cDBabA oiH36AoIt/fFFYgnoxtH7OoetP+2/wjtn8qo3RJDSHc
+qKmkxy1aZGP4ZwC0iH7n7hiJ0+rFQYvjQb5O1a1Z0r4
+-> ssh-ed25519 cK5kHw bX3RtO5StMejUYWAaA37fjHA5nO7Xs1vWDQk3yOjs2o
+Egxmcf8FKAd+E5hMLmhV1yQsCo5rJyUazf1szOvpTAM
+-> ssh-ed25519 CAWG4Q oKqqRDJH0w8lsoQBQk0w8PO+z5gFNmSaGBUSumvDp1I
+m1zWp9MfViAmtpbJhqOHraIokDaPKb0DvvO4vAGCTWI
+-> ssh-ed25519 xA739A G26kPOz6sbFATs+KAr7gbDvji13eA1smFusQAOJXMwA
+Sppvz7A103kZoNxoGsd6eXeCvVh7mBE2MRwLFj9O1dY
+-> ssh-ed25519 MSF3dg 55ekNcp+inbUd+GQ/VZ7BoBASaJ8YDqF74CVXy1PUxQ
+aTHLLAbzQPWWld/OT3BKebc6FcmsqMTaWCPBGm1UHic
+--- mVkAMnI9XQhS3fMiFuuXP/yLR9wEG9+Rr8pA4Uc0avY
+<04>DU <20><>s<EFBFBD><73><EFBFBD><EFBFBD>j<EFBFBD><6A>M<EFBFBD><4D>$<24>[<5B>M<EFBFBD><4D><EFBFBD><03>[_<>K7s<37>ju<>v<EFBFBD>D<EFBFBD>4<EFBFBD>g<EFBFBD><67>܄3<>Gn<47><6E><EFBFBD> ɽ<>P<EFBFBD>7~rZs<><73>
--- a/secrets/gitea-runner-token.age
+++ b/secrets/gitea-runner-token.age
--- a/secrets/gitlab-bsc-docker-token.age
+++ b/secrets/gitlab-bsc-docker-token.age
--- a/secrets/gitlab-runner-docker-token.age
+++ b/secrets/gitlab-runner-docker-token.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 HY2yRg eHM55QsHK1ca9b5nP3EoVUZYu0w2d4B5tkilNK0j/lw
-6Na6lkMe0fOd7+vNP1fLIaVEQDUw5m65Wh8jUH1I6C0
-> ssh-ed25519 cK5kHw 0ekhoBYwF7OSWwn4P5f/J4gXb9UHJAWGKV0yI7HCzzE
-2Q+Tt5jXAB9ip9jf1z+jeM4FSiqd1w5DNtbqtacuOcM
-> ssh-ed25519 CAWG4Q Jmw4v9efOFXHjjNky96q/d6vGBP5dNM4wK9zoGrwOh8
-u5I17wcIq8/2ARWckDXsYckhfX0jWE4AEm5mip/KHws
-> ssh-ed25519 xA739A 10pPeC2YG9DJzaQlt7p+fGo27VDiL2dN6JmvY2npcUw
-4aRV8DekYeL9HagGWgOSjlYnPKmYdKZH8Aw4lRdm+r8
-> ssh-ed25519 MSF3dg hDwIE3Su6cN3sq2E5v/oy6vTNfxTT1ZPts85//gIhwY
-aoiaGjQYJB1ededhIuVBCKDRLIOVThWz1pSTvg65J3Y
--- OYPAGb5U/nwLOIV5VchSvxhChjNnwzbEgU9glSkWCl4
-<EFBFBD>=<EFBFBD><EFBFBD><EFBFBD>c<EFBFBD>WȟJSaІ&<26><1F>ቧ)E<><0B> C<><43>J~u<>c<63><7F>2<EFBFBD><32>v<EFBFBD><76><EFBFBD><03><>s<EFBFBD><73><EFBFBD>vf<76><10><>X7(<28>~<7E><1A>=XCi;<3B>״<EFBFBD>\ߢ<><DFA2><EFBFBD>ܣ<EFBFBD><10><><07>ɳCe<43>D;;X*<2A>3<EFBFBD>i<EFBFBD><69>r<EFBFBD>Em<45><6D><
+-> ssh-ed25519 HY2yRg U2KQWviZIVNemm9e8h7H+eOzoYNxXgLLS3hsZLMAuGk
+6n5dH1McNzk3rscP4v2pqZYDWtUFMd15rZsEd/mqIFM
+-> ssh-ed25519 cK5kHw Ebrj/cpz1cFWAYAV9OxgyyH85OEMUnfUIV66p7jaoFY
+6J7hWqODtS/fIF4BpxhxbrxZq5vbolvbLqRKqazT02M
+-> ssh-ed25519 CAWG4Q mXqoQH9ycHF7u0y8mazCgynHxNLxTnrmQHke+2a5QCc
+mq6PdSF+KOqthuXwzTCsOQsi5KG0z1wHUck+bSTyOBY
+-> ssh-ed25519 xA739A TADeswueqDEroZWLjMw3RDNwVQ2xRD+JUMVZENovn0M
+KFlnSjVFbjc+ZsbY8Ed7edC5B01TJGzd/dSryiLArPc
+-> ssh-ed25519 MSF3dg Pq+ZD8AqJGDHDbd4PO1ngNFST8+6C2ghZkO/knKzzEc
+wyiL/u38hdQMokmfTsBrY7CtYwc+31FG4EDaqVEn31U
+--- 1z4cOipayh0zYkvasEVEvGreajegE/dqBV7b6E7aFh0
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<EFBFBD>@<40>/i<>I'<27><><EFBFBD>Nx<4E>r"<1D>`<1E>O<EFBFBD><4F><EFBFBD>y<><79>8<EFBFBD><38> \/<2F><>I<19><17>D<EFBFBD>`<60>ߓ<EFBFBD><DF93><EFBFBD><1E><04>uy<75><79><EFBFBD>:9Lt<4C><1D><><EFBFBD>؋<EFBFBD><D88B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AU<41><55><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60>;<3B>q8<71>GLU#<23>i<EFBFBD>y<EFBFBD><79>i<03>ڜ
--- a/secrets/gitlab-runner-shell-token.age
+++ b/secrets/gitlab-runner-shell-token.age
--- a/secrets/ipmi.yml.age
+++ b/secrets/ipmi.yml.age
--- a/secrets/jungle-robot-password.age
+++ b/secrets/jungle-robot-password.age
--- a/secrets/munge-key.age
+++ b/secrets/munge-key.age
--- a/secrets/nix-serve.age
+++ b/secrets/nix-serve.age
--- a/secrets/tent-gitlab-runner-bsc-docker-token.age
+++ b/secrets/tent-gitlab-runner-bsc-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-docker-token.age
+++ b/secrets/tent-gitlab-runner-pm-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-shell-token.age
+++ b/secrets/tent-gitlab-runner-pm-shell-token.age
--- a/secrets/vpn-dac-client-key.age
+++ b/secrets/vpn-dac-client-key.age
--- a/secrets/vpn-dac-login.age
+++ b/secrets/vpn-dac-login.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 G5LX5w /9lcJOXC9CN02+XLswUaJ0H7jU6Xhjd8Xg4+KY0l1Vc
-fCLzsLc9zrocM8SHOKyZwt6eUEr8r1WLug9RLi63KU0
-> ssh-ed25519 cK5kHw 1qza6h2NRSs4g8LYdFU7E+Dn1CgdtCU7DPdYInP1GwM
-/6uk7pTFkNTRTI7nA+x4y4CyOBVQVXX2lnpOg3ktPe4
-> ssh-ed25519 CAWG4Q o+vyzcejSaNVYPSGzzOdzaqPByZ6zA1uaJf4KOg+wQA
-wfZmWrDSfRV8C+Hu+SeZDcomf/qigBqxuQK77SfnuEo
-> ssh-ed25519 xA739A +rBsOC+IBE3lmc/pfrziftLIqMSyaGMsggRjC5Pqwl0
-xa7ulLz2+YC3g2hu7e9XhRYDIUb2sriaaigJRYF2oB8
-> ssh-ed25519 MSF3dg TK6PmKjjQt8ni0mJLCt7P41lUsgimlj3o5Q6n3N+DE4
-ne+s3ctcg8cBjY06LY2lrW7wcxomvKHxu6MlirEA8Kg
--- eorg2ckkUZ1Ogi4iTTg2MoiVBwl1F0RCmH2D8N1d1So
-<EFBFBD><EFBFBD><EFBFBD>8<1C><><EFBFBD><EFBFBD><EFBFBD><12>i<17>$]K<>J=2Z<1D><>ӼF<D3BC>][<14><><EFBFBD>8<EFBFBD><38>ޤ<12>	<09>=<3D><>LD/<2F>gz
+-> ssh-ed25519 G5LX5w SRJhNenoQXbT1FgX3TMPnVH5P6oe2eHot+M1YsEjsEk
+hfTSLgKi98Eh7JK5o7x2POpTEtQlQCpEa3keUFYCuME
+-> ssh-ed25519 cK5kHw z5TwWJTkvx7HztjXHJW/aCOtOfPrQaLP0gyIT7rXcyU
+b4NCpHfasgvkLLr+6LcWUl60p59aSNnfp3bl2OFYXo0
+-> ssh-ed25519 CAWG4Q 4VpS1/OnFe8nxcQbRTKNhjsh/ZQ5cbhSMXwK/jjQ+3o
+WF9wvOkqVml4UcEzyzeumKuUwCwwr2zvKLMg+PCB8nk
+-> ssh-ed25519 xA739A 67FhuJ070jBVMt/xbKHWhfri6iIm0FyaFvzQabsvFBM
+1G5/913dDv/r/6p1x/c5YiUnZzrX/LvIj33KW+PN0KU
+-> ssh-ed25519 MSF3dg Bj/yB4N2wkyHCHC22tcjjJAA4ebSamN0Z4UVX3ZnryI
+6D/ZgTs+j+MGDAbPU5zyK0i9zN6tQy68IcOnQZ27mYg
+--- 169erk3ICSYLs4FPEuXCn7QlekWhsmSn0Lr+/R14I5Q
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>ҽ3<D2BD>s<EFBFBD>
+w<EFBFBD><EFBFBD>4D<EFBFBD><EFBFBD>b.<2E><><EFBFBD>"|<7C><><EFBFBD>)"<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>.<2E>ɫ7)<29>LeC<05>=S؟
--- a/secrets/wg-apex.age
+++ b/secrets/wg-apex.age
--- a/secrets/wg-fox.age
+++ b/secrets/wg-fox.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 cDBabA So/Tqwdwd7G0PbE4RwH2qDrNcdqTkhFjF4IJrLKKpkM
-MEA5dzlUeFXm3pa+ndxrcE0ZWdO00Xf98+Q8U9LZ+cQ
-> ssh-ed25519 cK5kHw sCHD/hHBOfMBUQXkLG3MBPNC4ebLOXW37OlF/C8FEjU
-4TFbKoy23Ic2vteXZ02fMrFxyb4NxyWaSo5I8dn48mI
-> ssh-ed25519 CAWG4Q KYGPAXTx8H5cBC3YIBxi5B7OeF15C9rEIPFCcG0vEDw
-9LC2Zvp1Oiau1/hfPf+nJknl6BUSr+lzTn6TozZNxJg
-> ssh-ed25519 xA739A hpvNBHPgYRtUx0HyUAdCW8s7QTmGyPXwzRHb8qYoeG0
-QkUZINY7Fr7HpyY6lbIMcP+hGO3oCmLL6N+yDN4weyk
-> ssh-ed25519 MSF3dg P9TmEfXS+hyxsbVKja58UWAFpad0ZS3LhwrMkLnSNAY
-hiHuh7HhoYwHi2KFbCczXJoF3On9eqjD1Wsp9Q1NW/w
--- SN3peoDvjXuD/Q4DdebQFam1CE22NyGZlMmnKyCTuX8
-s<0F><><14><>&׳֦<D7B3><D6A6><EFBFBD><EFBFBD>}<7D>#In0&<26><1F>{<7B>1<EFBFBD><31>.
+-> ssh-ed25519 cDBabA heyW9/cxgwFX9IexQIXjAQDWGQPNcMXcArQp2Rxsqx4
+o9MQ7EH8PDDjsJdpH9F3Xq2zUoaDAJQlfFmYucSFs6Y
+-> ssh-ed25519 cK5kHw Sza4pos7K3qW3omEeyidI/jszJNf9smemSZnUJfCIww
+D6vazXki7hIYraIuSiGPS+FPbkFUwHhHWDf52OhEIMg
+-> ssh-ed25519 CAWG4Q YexIHueOIMmIN8JIDyNUOKBkyz/k18HqV3hTXh48KlM
+xh8UJzzWT6ByN+Dpn4JrMNsjGC/uc/v6LynwjBDz9NQ
+-> ssh-ed25519 xA739A KySG3TXdqfCMUkVEDGa74B0op745s3XGYxFLyAXSQAc
+5EI/yb5ctW9Qu18bHm3/sK97kwGcKzzmWvPSCWm89XA
+-> ssh-ed25519 MSF3dg MNxnNj0fHmri8ophexXPNjRUBUWrzcuk5S1mucxUMTE
+GVFWXtISEU8ZmlwL4nh4weAgfGrt2GHX0DTzbpS6zg8
+--- UdrqkYG2ZApAuwdZeNhC50NP2rkD/Ol6y8nJa4RHx7Y
+<EFBFBD>ܻ<EFBFBD>m(<28><><EFBFBD>><3E>H<48>Y87<><37>G<0F>+*<12><><EFBFBD><EFBFBD>9V<>.<2E><><EFBFBD><EFBFBD><03><><EFBFBD>p<EFBFBD>Oo<4F>=+哇<>P0<50><30>{<7B>)<29><17><><EFBFBD><EFBFBD>><3E>z3P^
+u
--- a/secrets/wg-raccoon.age
+++ b/secrets/wg-raccoon.age
--- a/test/compilers/clang-openmp-ld.nix
+++ b/test/compilers/clang-openmp-ld.nix
@@ -23,9 +23,6 @@ in stdenv.mkDerivation {
  dontUnpack = true;
  dontConfigure = true;

-  # nOS-V requires access to /sys/devices to request NUMA information
-  requiredSystemFeatures = [ "sys-devices" ];
-
  buildInputs = [ openmp ];

  buildPhase = ''
--- a/test/compilers/hello-sycl.nix
+++ b/test/compilers/hello-sycl.nix
@@ -1,91 +0,0 @@
-{
-  intelPackages,
-  writeText,
-  strace,
-  pocl,
-}:
-
-let
-  stdenv = intelPackages.stdenv;
-  hello_sycl = writeText "hello.cpp" ''
-    #include <sycl/sycl.hpp>
-
-    class hello_world;
-
-    int main(int argc, char** argv) try {
-        auto device_selector = sycl::default_selector_v;
-
-        sycl::queue queue(device_selector);
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        });
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-  '';
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  version = "0.0.1";
-  name = "hello-sycl";
-  nativeBuildInputs = [
-    stdenv
-    strace
-  ];
-  src = hello_sycl;
-  dontUnpack = true;
-  dontConfigure = true;
-  NIX_DEBUG = 0;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    command -v $CXX
-    $CXX -fsycl hello.cpp -o hello
-    ./hello | tee test-output
-    set +x
-  '';
-
-  installPhase = ''
-    cp test-output $out
-  '';
-
-  passthru = {
-    withPocl = finalAttrs.finalPackage.overrideAttrs (old: {
-      nativeBuildInputs = old.nativeBuildInputs ++ [ pocl ];
-      env = (old.env or { }) // {
-        POCL_DEBUG = "error,warn";
-        POCL_CACHE_DIR = "/build/pocl_cache";
-
-        # Make PoCL report Intel vendor id so oneapi SYCL works
-        POCL_DRIVER_VERSION_OVERRIDE = "2024.18.6.0.02_160000";
-        POCL_CPU_VENDOR_ID_OVERRIDE = 32902;
-      };
-      doInstallCheck = true;
-      installCheckPhase = ''
-        grep "Hello World! (on device)" $out
-      '';
-    });
-    withIntel = finalAttrs.finalPackage.overrideAttrs (old: {
-      env = (old.env or { }) // {
-        OCL_ICD_VENDORS = intelPackages.compiler + "/etc/OpenCL/vendors";
-      };
-      doInstallCheck = true;
-      installCheckPhase = ''
-        grep "Hello World! (on device)" $out
-      '';
-
-    });
-  };
-})
--- a/test/compilers/icpx-ompss2.nix
+++ b/test/compilers/icpx-ompss2.nix
@@ -1,110 +0,0 @@
-{
-  writeText,
-  intelPackages,
-  nodes,
-  nosv,
-  clangOmpss2Nodes,
-  strace,
-  pocl,
-}:
-
-let
-  hello_cpp = writeText "hello.cpp" ''
-    #include <cstdio>
-    #include <sycl/sycl.hpp>
-
-    int main(int argc, char** argv) try {
-        sycl::queue queue;
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        #pragma oss task
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<class hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        }).wait();
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-
-  '';
-in
-
-intelPackages.stdenv.mkDerivation (finalAttrs: {
-  version = "0.0.1";
-  name = "hello-syclompss";
-
-  src = hello_cpp;
-
-  nativeBuildInputs = [
-    strace
-    nodes
-    nosv
-  ];
-
-  passthru = {
-    withPocl = finalAttrs.finalPackage.overrideAttrs (old: {
-      nativeBuildInputs = old.nativeBuildInputs ++ [ pocl ];
-      env = (old.env or { }) // {
-        POCL_DEBUG = "error,warn";
-        POCL_CACHE_DIR = "/build/pocl_cache";
-
-        # Make PoCL report Intel vendor id so oneapi SYCL works
-        POCL_DRIVER_VERSION_OVERRIDE = "2024.18.6.0.02_160000";
-        POCL_CPU_VENDOR_ID_OVERRIDE = 32902;
-      };
-      doInstallCheck = true;
-      installCheckPhase = ''
-        grep "Hello World! (on device)" $out
-      '';
-    });
-
-    withIntel = finalAttrs.finalPackage.overrideAttrs (old: {
-      env = (old.env or { }) // {
-        OCL_ICD_VENDORS = intelPackages.compiler + "/etc/OpenCL/vendors";
-      };
-      doInstallCheck = true;
-      installCheckPhase = ''
-        grep "Hello World! (on device)" $out
-      '';
-    });
-  };
-
-  dontUnpack = true;
-  dontConfigure = true;
-
-  # NODES requires access to /sys/devices to request NUMA information
-  requiredSystemFeatures = [ "sys-devices" ];
-
-  env.NODES_HOME = nodes;
-
-  NIX_DEBUG = 1;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    echo NODES_HOME=$NODES_HOME
-    command -v $CXX
-
-    icpx -Wno-deprecated-declarations -fsycl \
-        -fsycl-host-compiler=${clangOmpss2Nodes.forIcpx}/bin/clang++ \
-        -fsycl-host-compiler-options='-Wno-deprecated-declarations -fompss-2=libnodes' \
-        -lnodes -lnosv \
-        $NODES_HOME/lib/nodes-main-wrapper.o \
-        hello.cpp -o hello
-
-    ./hello | tee test-output
-    set +x
-  '';
-
-  installPhase = ''
-    cp test-output $out
-  '';
-})
--- a/test/compilers/opencl.c
+++ b/test/compilers/opencl.c
@@ -1,127 +0,0 @@
-#include <CL/cl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define BUF_LEN 128
-
-cl_int exit_err = CL_SUCCESS;
-
-#define CHECK(cmd)                                                             \
-  do {                                                                         \
-    cl_int err = cmd;                                                          \
-    if (err != CL_SUCCESS) {                                                   \
-      printf("[ERROR] " #cmd " (Error code: %d)\n"                             \
-             "@ "__FILE__                                                      \
-             ":%d",                                                            \
-             err, __LINE__);                                                   \
-      exit_err = err;                                                          \
-      goto cleanup;                                                            \
-    }                                                                          \
-  } while (0)
-
-const char *kernel_source = "__kernel void vector_add(__global const float *a, "
-                            "__global const float *b, __global float *c) {\n"
-                            "    int gid = get_global_id(0);\n"
-                            "    c[gid] = a[gid] + b[gid];\n"
-                            "}\n";
-
-cl_int test_kernel_compilation(cl_platform_id platform) {
-  cl_device_id device = NULL;
-  cl_context context = NULL;
-  cl_program program = NULL;
-  cl_int err = CL_SUCCESS;
-  char device_name[BUF_LEN];
-
-  // Get first device for this platform
-  CHECK(clGetDeviceIDs(platform, CL_DEVICE_TYPE_ALL, 1, &device, NULL));
-
-  // Get device name
-  CHECK(clGetDeviceInfo(device, CL_DEVICE_NAME, sizeof(device_name),
-                        device_name, NULL));
-  printf("    Device: %s\n", device_name);
-
-  context = clCreateContext(NULL, 1, &device, NULL, NULL, &err);
-  CHECK(err);
-
-  program = clCreateProgramWithSource(context, 1, &kernel_source, NULL, &err);
-  CHECK(err);
-
-  err = clBuildProgram(program, 1, &device, NULL, NULL, NULL);
-  if (err != CL_SUCCESS) {
-    printf("      [ERROR] Kernel compilation failed (Error code: %d)\n", err);
-
-    // Build log
-    size_t log_size;
-    CHECK(clGetProgramBuildInfo(program, device, CL_PROGRAM_BUILD_LOG, 0, NULL,
-                                &log_size));
-    char *log = (char *)malloc(log_size);
-    CHECK(clGetProgramBuildInfo(program, device, CL_PROGRAM_BUILD_LOG, log_size,
-                                log, NULL));
-    printf("      Build log:\n%s\n", log);
-    free(log);
-    goto cleanup;
-  }
-
-  printf("      [OK] Kernel compiled successfully!\n");
-
-cleanup:
-  if (program)
-    clReleaseProgram(program);
-  if (context)
-    clReleaseContext(context);
-  printf("\n");
-
-  return exit_err;
-}
-
-int main() {
-  cl_uint num_platforms;
-  cl_platform_id *platforms = NULL;
-
-  // Get number of platforms
-  CHECK(clGetPlatformIDs(0, NULL, &num_platforms));
-
-  printf("Found %d OpenCL platform(s)\n\n", num_platforms);
-
-  if (num_platforms == 0) {
-    printf("No OpenCL platforms found!\n");
-    return EXIT_FAILURE;
-  }
-
-  // Allocate memory for platforms
-  platforms = (cl_platform_id *)malloc(sizeof(cl_platform_id) * num_platforms);
-
-  // Get platform IDs
-  CHECK(clGetPlatformIDs(num_platforms, platforms, NULL));
-
-  // Query each platform and test kernel compilation
-  for (cl_uint i = 0; i < num_platforms; i++) {
-    char platform_name[BUF_LEN];
-    char platform_vendor[BUF_LEN];
-    char platform_version[BUF_LEN];
-
-    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_NAME,
-                            sizeof(platform_name), platform_name, NULL));
-    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_VENDOR,
-                            sizeof(platform_vendor), platform_vendor, NULL));
-    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_VERSION,
-                            sizeof(platform_version), platform_version, NULL));
-
-    printf("Platform %d: %s\n", i, platform_name);
-    printf("  Vendor: %s\n", platform_vendor);
-    printf("  Version: %s\n", platform_version);
-
-    // Test kernel compilation
-    CHECK(test_kernel_compilation(platforms[i]));
-  }
-
-cleanup:
-  if (platforms)
-    free(platforms);
-
-  if (exit_err == CL_SUCCESS)
-    return EXIT_SUCCESS;
-
-  return EXIT_FAILURE;
-}
--- a/test/compilers/opencl.nix
+++ b/test/compilers/opencl.nix
@@ -1,104 +0,0 @@
-{
-  stdenv,
-  ocl-icd,
-  opencl-headers,
-  pocl,
-  clinfo,
-  runCommand,
-  lib,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "opencl-pocl-test";
-  version = "1.0.0";
-
-  src = ./opencl.c;
-
-  dontUnpack = true;
-  dontConfigure = true;
-
-  buildInputs = [
-    ocl-icd
-    opencl-headers
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    $CC -Wall -Wextra -D CL_TARGET_OPENCL_VERSION=100 $src -o ocl-hello -lOpenCL
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    cp ocl-hello $out/bin
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    test-icd =
-      runCommand "custom-clinfo"
-        {
-          nativeBuildInputs =
-            assert !(lib.hasPrefix "pocl" ocl-icd.pname);
-            [
-              clinfo
-              finalAttrs.finalPackage
-              pocl
-            ];
-
-          env = {
-            POCL_DEBUG = "error,warn";
-            POCL_CACHE_DIR = "/build/pocl_cache";
-          };
-
-          requiredSystemFeatures = [ "sys-devices" ];
-        }
-
-        ''
-          set -x
-
-          mkdir $out
-
-          clinfo -l >$out/clinfo
-          clinfo >$out/clinfo-full
-
-          ocl-hello >$out/hello
-
-          for i in $out/*; do
-            grep "Portable Computing Language" $i
-          done
-
-          echo $OCL_ICD_VENDORS >$out/env
-
-          grep "pocl.*/etc/OpenCL/vendors" $out/env
-
-          set +x
-        '';
-    # this needs: ocl-icd = pocl-noicd
-    test-noicd =
-      runCommand "custom-clinfo"
-        {
-          nativeBuildInputs = [
-            finalAttrs.finalPackage
-          ];
-
-          env = {
-            POCL_DEBUG = "error,warn";
-            POCL_CACHE_DIR = "/build/pocl_cache";
-          };
-
-          requiredSystemFeatures = [ "sys-devices" ];
-        }
-
-        ''
-          ocl-hello >$out
-
-          grep "Portable Computing Language" $out
-        '';
-  };
-})
--- a/test/compilers/pocl.nix
+++ b/test/compilers/pocl.nix
@@ -1,27 +0,0 @@
-{
-  runCommand,
-  pocl,
-  clinfo,
-}:
-
-runCommand "clinfo-pocl"
-  {
-    nativeBuildInputs = [
-      clinfo
-      pocl
-    ];
-
-    requiredSystemFeatures = [ "sys-devices" ];
-
-    env = {
-      POCL_DEBUG = "error,warn";
-      POCL_CACHE_DIR = "/build/pocl_cache";
-    };
-  }
-  ''
-    echo $OCL_ICD_VENDORS
-    clinfo >$out
-
-    # check that we have PoCL:
-    grep "Portable Computing Language" $out
-  ''
--- a/test/compilers/sycl-ls.nix
+++ b/test/compilers/sycl-ls.nix
@@ -1,40 +0,0 @@
-{
-  intelPackages,
-  pocl,
-  runCommandWith,
-  symlinkJoin,
-  clinfo,
-}:
-
-runCommandWith
-  {
-    name = "sycl-ls";
-    inherit (intelPackages) stdenv;
-    runLocal = true;
-    derivationArgs = {
-      nativeBuildInputs = [ clinfo ];
-      env = {
-        OCL_ICD_VENDORS = symlinkJoin {
-          name = "vendors";
-          paths = builtins.map (p: p + "/etc/OpenCL/vendors") [
-            intelPackages.compiler
-            pocl
-          ];
-        };
-
-        POCL_DRIVER_VERSION_OVERRIDE = "2025.20.6.0.04_224945";
-        POCL_CPU_VENDOR_ID_OVERRIDE = 32902;
-        POCL_DEBUG = "error,warn";
-        POCL_CACHE_DIR = "/build/pocl_cache";
-
-        HWLOC_SYNTHETIC = "node:1 core:1 pu:1";
-      };
-    };
-  }
-  # bash
-  ''
-    clinfo -l | tee -a $out
-    sycl-ls | tee -a $out
-
-    test x6 = x"$(cat $out | wc -l)" # 2 lines per clinfo entry and 1 per sycl-ls
-  ''
Author	SHA1	Message	Date
Aleix Roca Nonell	9c6f2e0097	Do not force derviation inputs, use booleans instead Some checks failed CI / build:cross (pull_request) Successful in 8s Details CI / build:all (pull_request) Failing after 35m38s Details	2026-01-21 15:16:06 +01:00
Aleix Roca Nonell	61ed93c951	Add ompss2rt to wrapper passthru Some checks failed CI / build:cross (pull_request) Successful in 8s Details CI / build:all (pull_request) Failing after 44m56s Details	2026-01-21 12:46:24 +01:00
Aleix Roca Nonell	7d02658e44	Use explicit splicing in clang wrapper	2026-01-21 12:46:24 +01:00
Aleix Roca Nonell	06aa1fc5d4	Fix clang cross-build	2026-01-21 12:46:24 +01:00
Aleix Boné	1178574891	Add install check for OpenMP{,-V}	2026-01-21 12:46:24 +01:00
Aleix Boné	5a4e9ae48a	Fix openmp buildInputs	2026-01-21 12:46:23 +01:00
Aleix Boné	15ebb94645	Remove unused sys-devices requirement in ld test	2026-01-21 12:46:23 +01:00
Aleix Boné	ada96f349c	Enable papi when cross-compiling	2026-01-21 12:46:23 +01:00
Aleix Boné	1427e357f5	Fix papi cross compilation	2026-01-21 12:46:23 +01:00
Aleix Boné	435699357d	Use pkg-config instead of papi_version_check	2026-01-21 12:46:23 +01:00
Aleix Boné	a238824ff1	Fix cudainfo buildInputs	2026-01-21 12:46:23 +01:00
Aleix Boné	de6124f8ca	Set strictDeps to true on all our packages	2026-01-21 12:46:22 +01:00