rosenthal: hugo: Update to 0.147.3.

* modules/rosenthal/packages/web.scm (hugo): Update to 0.147.3.
[arguments]<#:go>: Use go-1.24.

README.org

@@ -24,18 +24,8 @@ Channel definition:
 
 For configuration, see [[https://guix.gnu.org/manual/devel/en/html_node/Specifying-Additional-Channels.html][Specifying Additional Channels]], [[https://guix.gnu.org/manual/devel/en/html_node/Customizing-the-System_002dWide-Guix.html][Customizing the System-Wide Guix]] and [[https://guix.gnu.org/manual/devel/en/html_node/Guix-Home-Services.html#index-home_002dchannels_002dservice_002dtype][~home-channels-service-type~]] in /GNU Guix Reference Manual/.
 
-Substitutes (see [[https://guix.gnu.org/manual/devel/en/html_node/Substitutes.html][Substitutes]] in /GNU Guix Reference Manual/) are available on [[https://substitute.boiledscript.com/][~https://substitute.boiledscript.com~]], with the following signing key:
-#+begin_src scheme
-  (public-key
-   (ecc
-    (curve Ed25519)
-    (q #374EC58F5F2EC0412431723AF2D527AD626B049D657B5633AAAEBC694F3E33F9#)))
-#+end_src
-
 Wiki: https://codeberg.org/hako/Rosenthal/wiki
 
-Build status: https://ci.boiledscript.com/jobset/rosenthal
-
 Git repositories:
 - Codeberg: https://codeberg.org/hako/Rosenthal
 - (backup) URSpace VCS: https://git.boiledscript.com/hako/Rosenthal

etc/committer.scm

@@ -0,0 +1,477 @@
+#!/usr/bin/env -S guix repl
+!#
+
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020, 2021, 2022, 2023 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2021 Sarah Morgensen <iskarian@mgsn.dev>
+;;; Copyright © 2021 Xinglu Chen <public@yoctocell.xyz>
+;;; Copyright © 2022 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; This script stages and commits changes to package definitions.
+
+;;; Code:
+
+(use-modules ((sxml xpath) #:prefix xpath:)
+             (srfi srfi-1)
+             (srfi srfi-2)
+             (srfi srfi-9)
+             (srfi srfi-11)
+             (srfi srfi-26)
+             (ice-9 format)
+             (ice-9 popen)
+             (ice-9 match)
+             (ice-9 rdelim)
+             (ice-9 regex)
+             (ice-9 textual-ports)
+             (guix gexp))
+
+(define* (break-string str #:optional (max-line-length 70))
+  "Break the string STR into lines that are no longer than MAX-LINE-LENGTH.
+Return a single string."
+  (define (restore-line words)
+    (string-join (reverse words) " "))
+  (if (<= (string-length str) max-line-length)
+      str
+      (let ((words+lengths (map (lambda (word)
+                                  (cons word (string-length word)))
+                                (string-tokenize str))))
+        (match (fold (match-lambda*
+                       (((word . length)
+                         (count current lines))
+                        (let ((new-count (+ count length 1)))
+                          (if (< new-count max-line-length)
+                              (list new-count
+                                    (cons word current)
+                                    lines)
+                              (list length
+                                    (list word)
+                                    (cons (restore-line current) lines))))))
+                     '(0 () ())
+                     words+lengths)
+          ((_ last-words lines)
+           (string-join (reverse (cons (restore-line last-words) lines))
+                        "\n"))))))
+
+(define* (break-string-with-newlines str #:optional (max-line-length 70))
+  "Break the lines of string STR into lines that are no longer than
+MAX-LINE-LENGTH. Return a single string."
+  (string-join (map (cut break-string <> max-line-length)
+                    (string-split str #\newline))
+               "\n"))
+
+(define (read-excursion port)
+  "Read an expression from PORT and reset the port position before returning
+the expression."
+  (let ((start (ftell port))
+        (result (read port)))
+    (seek port start SEEK_SET)
+    result))
+
+(define (lines+offsets-with-opening-parens port)
+  "Record all line numbers (and their offsets) where an opening parenthesis is
+found in column 0.  The resulting list is in reverse order."
+  (let loop ((acc '())
+             (number 0))
+    (let ((line (read-line port)))
+      (cond
+       ((eof-object? line) acc)
+       ((string-prefix? "(" line)
+        (loop (cons (cons number                      ;line number
+                          (- (ftell port)
+                             (string-length line) 1)) ;offset
+                    acc)
+              (1+ number)))
+       (else (loop acc (1+ number)))))))
+
+(define (surrounding-sexp port target-line-no)
+  "Return the top-level S-expression surrounding the change at line number
+TARGET-LINE-NO in PORT."
+  (let* ((line-numbers+offsets
+          (lines+offsets-with-opening-parens port))
+         (closest-offset
+          (or (and=> (list-index (match-lambda
+                                   ((line-number . offset)
+                                    (< line-number target-line-no)))
+                                 line-numbers+offsets)
+                     (lambda (index)
+                       (match (list-ref line-numbers+offsets index)
+                         ((line-number . offset) offset))))
+              (error "Could not find surrounding S-expression for line"
+                     target-line-no))))
+    (seek port closest-offset SEEK_SET)
+    (read port)))
+
+;;; Whether the hunk contains a newly added package (definition), a removed
+;;; package (removal) or something else (#false).
+(define hunk-types '(addition removal #false))
+
+(define-record-type <hunk>
+  (make-hunk file-name
+             old-line-number
+             new-line-number
+             diff-lines
+             type)
+  hunk?
+  (file-name       hunk-file-name)
+  ;; Line number before the change
+  (old-line-number hunk-old-line-number)
+  ;; Line number after the change
+  (new-line-number hunk-new-line-number)
+  ;; The full diff to be used with "git apply --cached"
+  (diff-lines hunk-diff-lines)
+  ;; Does this hunk add or remove a package?
+  (type hunk-type))                     ;one of 'hunk-types'
+
+(define* (hunk->patch hunk #:optional (port (current-output-port)))
+  (let ((file-name (hunk-file-name hunk)))
+    (format port
+            "diff --git a/~a b/~a~%--- a/~a~%+++ b/~a~%~a"
+            file-name file-name file-name file-name
+            (string-join (hunk-diff-lines hunk) ""))))
+
+(define (diff-info)
+  "Read the diff and return a list of <hunk> values."
+  (let ((port (open-pipe* OPEN_READ
+                          "git" "diff-files"
+                          "--no-prefix"
+                          ;; Only include one context line to avoid lumping in
+                          ;; new definitions with changes to existing
+                          ;; definitions.
+                          "--unified=1"
+                          "--" "modules/rosenthal")))
+    (define (extract-line-number line-tag)
+      (abs (string->number
+            (car (string-split line-tag #\,)))))
+    (define (read-hunk)
+      (let loop ((lines '())
+                 (type #false))
+        (let ((line (read-line port 'concat)))
+          (cond
+           ((eof-object? line)
+            (values (reverse lines) type))
+           ((or (string-prefix? "@@ " line)
+                (string-prefix? "diff --git" line))
+            (unget-string port line)
+            (values (reverse lines) type))
+           (else
+            (loop (cons line lines)
+                  (or type
+                      (cond
+                       ((string-prefix? "+(define" line)
+                        'addition)
+                       ((string-prefix? "-(define" line)
+                        'removal)
+                       (else #false)))))))))
+    (define info
+      (let loop ((acc '())
+                 (file-name #f))
+        (let ((line (read-line port)))
+          (cond
+           ((eof-object? line) acc)
+           ((string-prefix? "--- " line)
+            (match (string-split line #\space)
+              ((_ file-name)
+               (loop acc file-name))))
+           ((string-prefix? "@@ " line)
+            (match (string-split line #\space)
+              ((_ old-start new-start . _)
+               (let-values
+                   (((diff-lines type) (read-hunk)))
+                 (loop (cons (make-hunk file-name
+                                        (extract-line-number old-start)
+                                        (extract-line-number new-start)
+                                        (cons (string-append line "\n")
+                                              diff-lines)
+                                        type) acc)
+                       file-name)))))
+           (else (loop acc file-name))))))
+    (close-pipe port)
+    info))
+
+(define (lines-to-first-change hunk)
+  "Return the number of diff lines until the first change."
+  (1- (count (lambda (line)
+               ((negate char-set-contains?)
+                (char-set #\+ #\-)
+                (string-ref line 0)))
+             (hunk-diff-lines hunk))))
+
+(define %original-file-cache
+  (make-hash-table))
+
+(define (read-original-file file-name)
+  "Return the contents of FILE-NAME prior to any changes."
+  (let* ((port (open-pipe* OPEN_READ
+                           "git" "cat-file" "-p" (string-append
+                                                  "HEAD:" file-name)))
+         (contents (get-string-all port)))
+    (close-pipe port)
+    contents))
+
+(define (read-original-file* file-name)
+  "Caching variant of READ-ORIGINAL-FILE."
+  (or (hashv-ref %original-file-cache file-name)
+      (let ((value (read-original-file file-name)))
+        (hashv-set! %original-file-cache file-name value)
+        value)))
+
+(define (old-sexp hunk)
+  "Using the diff information in HUNK return the unmodified S-expression
+corresponding to the top-level definition containing the staged changes."
+  ;; TODO: We can't seek with a pipe port...
+  (call-with-input-string (read-original-file* (hunk-file-name hunk))
+    (lambda (port)
+      (surrounding-sexp port
+                        (+ (lines-to-first-change hunk)
+                           (hunk-old-line-number hunk))))))
+
+(define (new-sexp hunk)
+  "Using the diff information in HUNK return the modified S-expression
+corresponding to the top-level definition containing the staged changes."
+  (call-with-input-file (hunk-file-name hunk)
+    (lambda (port)
+      (surrounding-sexp port
+                        (+ (lines-to-first-change hunk)
+                           (hunk-new-line-number hunk))))))
+
+(define* (change-commit-message file-name old new #:optional (port (current-output-port)))
+  "Print ChangeLog commit message for changes between OLD and NEW."
+  (define (get-values expr field)
+    (match ((xpath:node-or
+             (xpath:sxpath `(*any* *any* package ,field quasiquote *))
+             ;; For let binding
+             (xpath:sxpath `(*any* *any* (*any*) package ,field quasiquote *)))
+            (cons '*TOP* expr))
+      (()
+       ;; New-style plain lists
+       (match ((xpath:node-or
+                (xpath:sxpath `(*any* *any* package ,field list *))
+                ;; For let binding
+                (xpath:sxpath `(*any* *any* (*any*) package ,field list *)))
+               (cons '*TOP* expr))
+         ((inner) inner)
+         (_ '())))
+      ;; Old-style labelled inputs
+      ((first . rest)
+       (map cadadr first))))
+  (define (listify items)
+    (match items
+      ((one) one)
+      ((one two)
+       (string-append one " and " two))
+      ((one two . more)
+       (string-append (string-join (drop-right items 1) ", ")
+                      ", and " (first (take-right items 1))))))
+  (define variable-name
+    (second old))
+  (define version
+    (and=> ((xpath:node-or
+             (xpath:sxpath '(*any* *any* package version *any*))
+             ;; For let binding
+             (xpath:sxpath '(*any* *any* (*any*) package version *any*)))
+            (cons '*TOP* new))
+           first))
+  (format port
+          "rosenthal: ~a: Update to ~a.~%~%* ~a (~a): Update to ~a.~%"
+          variable-name version file-name variable-name version)
+  (for-each (lambda (field)
+              (let ((old-values (get-values old field))
+                    (new-values (get-values new field)))
+                (or (equal? old-values new-values)
+                    (let ((removed (lset-difference equal? old-values new-values))
+                          (added (lset-difference equal? new-values old-values)))
+                      (format port
+                              "[~a]: ~a~%" field
+                              (break-string
+                               ;; A dependency can be a list of (pkg output).
+                               (match (list (map object->string removed)
+                                            (map object->string added))
+                                 ((() added)
+                                  (format #f "Add ~a."
+                                          (listify added)))
+                                 ((removed ())
+                                  (format #f "Remove ~a."
+                                          (listify removed)))
+                                 ((removed added)
+                                  (format #f "Remove ~a; add ~a."
+                                          (listify removed)
+                                          (listify added))))))))))
+            '(inputs propagated-inputs native-inputs)))
+
+(define* (add-commit-message file-name variable-name
+                             #:optional (port (current-output-port)))
+  "Print ChangeLog commit message for a change to FILE-NAME adding a
+definition."
+  (format port "rosenthal: Add ~a.~%~%* ~a (~a): New variable.~%"
+          variable-name file-name variable-name))
+
+(define* (remove-commit-message file-name variable-name
+                                #:optional (port (current-output-port)))
+  "Print ChangeLog commit message for a change to FILE-NAME removing a
+definition."
+  (format port "rosenthal: Remove ~a.~%~%* ~a (~a): Delete variable.~%"
+          variable-name file-name variable-name))
+
+(define* (custom-commit-message file-name variable-name message changelog
+                                #:optional (port (current-output-port)))
+  "Print custom commit message for a change to VARIABLE-NAME in FILE-NAME, using
+MESSAGE as the commit message and CHANGELOG as the body of the ChangeLog
+entry. If CHANGELOG is #f, the commit message is reused. If CHANGELOG already
+contains ': ', no colon is inserted between the location and body of the
+ChangeLog entry."
+  (define (trim msg)
+    (string-trim-right (string-trim-both msg) (char-set #\.)))
+
+  (define (changelog-has-location? changelog)
+    (->bool (string-match "^[[:graph:]]+:[[:blank:]]" changelog)))
+
+  (let* ((message (trim message))
+         (changelog (if changelog (trim changelog) message))
+         (message/f (format #f "rosenthal: ~a: ~a." variable-name message))
+         (changelog/f (if (changelog-has-location? changelog)
+                          (format #f "* ~a (~a)~a."
+                                  file-name variable-name changelog)
+                          (format #f "* ~a (~a): ~a."
+                                  file-name variable-name changelog))))
+    (format port
+            "~a~%~%~a~%"
+            (break-string-with-newlines message/f 72)
+            (break-string-with-newlines changelog/f 72))))
+
+(define (add-copyright-line line)
+  "Add the copyright line on LINE to the previous commit."
+  (let ((author (match:substring
+                 (string-match "^\\+;;; Copyright ©[^[:alpha:]]+(.*)$" line)
+                 1)))
+    (format
+     (current-output-port) "Amend and add copyright line for ~a~%" author)
+    (system* "git" "commit" "--amend" "--no-edit")))
+
+(define (group-hunks-by-sexp hunks)
+  "Return a list of pairs associating all hunks with the S-expression they are
+modifying."
+  (fold (lambda (sexp hunk acc)
+          (match acc
+            (((previous-sexp . hunks) . rest)
+             (if (equal? sexp previous-sexp)
+                 (cons (cons previous-sexp
+                             (cons hunk hunks))
+                       rest)
+                 (cons (cons sexp (list hunk))
+                       acc)))
+            (_
+             (cons (cons sexp (list hunk))
+                   acc))))
+        '()
+        (map new-sexp hunks)
+        hunks))
+
+(define (new+old+hunks hunks)
+  (map (match-lambda
+         ((new . hunks)
+          (cons* new (old-sexp (first hunks)) hunks)))
+       (group-hunks-by-sexp hunks)))
+
+(define %delay 1000)
+
+(define (main . args)
+  (define* (change-commit-message* file-name old new #:rest rest)
+    (let ((changelog #f))
+      (match args
+        ((or (message changelog) (message))
+         (apply custom-commit-message
+                file-name (second old) message changelog rest))
+        (_
+         (apply change-commit-message file-name old new rest)))))
+
+  (read-disable 'positions)
+  (match (diff-info)
+    (()
+     (display "Nothing to be done.\n" (current-error-port)))
+    (hunks
+     (let-values (((definitions changes) (partition hunk-type hunks)))
+       ;; Additions/removals.
+       (for-each
+        (lambda (hunk)
+          (and-let* ((define-line (find (cut string-match "(\\+|-)\\(define" <>)
+                                        (hunk-diff-lines hunk)))
+                     (variable-name (and=> (string-tokenize define-line)
+                                           second))
+                     (commit-message-proc (match (hunk-type hunk)
+                                            ('addition add-commit-message)
+                                            ('removal remove-commit-message))))
+            (commit-message-proc (hunk-file-name hunk) variable-name)
+            (let ((port (open-pipe* OPEN_WRITE
+                                    "git" "apply"
+                                    "--cached"
+                                    "--unidiff-zero")))
+              (hunk->patch hunk port)
+              (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                (error "Cannot apply")))
+
+            (let ((port (open-pipe* OPEN_WRITE "git" "commit" "-F" "-")))
+              (commit-message-proc (hunk-file-name hunk) variable-name port)
+              (usleep %delay)
+              (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                (error "Cannot commit"))))
+          (usleep %delay))
+        definitions)
+
+       ;; Changes.
+       (for-each
+        (match-lambda
+          ((new old . hunks)
+           (for-each (lambda (hunk)
+                       (let ((port (open-pipe* OPEN_WRITE
+                                               "git" "apply"
+                                               "--cached"
+                                               "--unidiff-zero")))
+                         (hunk->patch hunk port)
+                         (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                           (error "Cannot apply")))
+                       (usleep %delay))
+                     hunks)
+           (define copyright-line
+             (any (lambda (line) (and=> (string-prefix? "+;;; Copyright ©" line)
+                                   (const line)))
+                  (hunk-diff-lines (first hunks))))
+           (cond
+            (copyright-line
+             (add-copyright-line copyright-line))
+            (else
+             (let ((port (open-pipe* OPEN_WRITE "git" "commit" "-F" "-")))
+               (change-commit-message* (hunk-file-name (first hunks))
+                                       old new)
+               (change-commit-message* (hunk-file-name (first hunks))
+                                       old new
+                                       port)
+               (usleep %delay)
+               (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                 (error "Cannot commit")))))))
+        (new+old+hunks (match definitions
+                         ('() changes) ;reuse
+                         (_
+                          ;; XXX: we recompute the hunks here because previous
+                          ;; insertions lead to offsets.
+                          (let-values (((definitions changes)
+                                        (partition hunk-type (diff-info))))
+                            changes)))))))))
+
+(apply main (cdr (command-line)))

etc/manifest.scm

@@ -1,35 +0,0 @@
-;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
-;;
-;; SPDX-License-Identifier: CC0-1.0
-
-(specifications->manifest
- '(
-   "atuin"
-   "cloudflare-warp-bin"
-   "cloudflared"
-   "dinit"
-   "komga-bin"
-   "mihomo-bin"
-   "navidrome-bin"
-   "niri"
-   "shadow-tls-bin"
-   "sing-box-bin"
-   "tree-sitter-yaml"
-   "wakapi-bin"
-   "wakatime-cli-bin"
-   "xwayland-satellite"
-
-   ;; TODO: Updater unavailable.
-   ;; "bitwarden-icecat"
-   ;; "miniflux-injector-icecat"
-   ;; "sidebery-icecat"
-   ;; "clash-bin"
-   ;; "dnsmasq-china-list"
-   ;; "emacs-pcmpl-tailscale"
-   ;; "emacs-wakatime-mode"
-   ;; "forgejo"
-   ;; "grub-efi-luks2"
-   ;; "hugo"
-   ;; "socks2http"
-   ;; "tailscale"
-   ))

etc/manifests/all-packages.scm

@@ -0,0 +1,8 @@
+;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;
+;; SPDX-License-Identifier: CC0-1.0
+
+(use-modules (guix profiles)
+             (rosenthal packages))
+
+(manifest (map package->manifest-entry (all-rosenthal-packages)))

etc/manifests/auto-update.scm

@@ -0,0 +1,16 @@
+;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;
+;; SPDX-License-Identifier: CC0-1.0
+
+(use-modules (guix packages)
+             (guix profiles)
+             (rosenthal packages))
+
+(define (disable-updater? p)
+  (let ((properties (package-properties p)))
+    (and (assq 'rosenthal-update? properties)
+         (not (assq-ref properties 'rosenthal-update?)))))
+
+(manifest (map package->manifest-entry
+               (filter (negate disable-updater?)
+                       (all-rosenthal-packages))))

etc/manifests/manual-update.scm

@@ -0,0 +1,16 @@
+;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;
+;; SPDX-License-Identifier: CC0-1.0
+
+(use-modules (guix packages)
+             (guix profiles)
+             (rosenthal packages))
+
+(define (disable-updater? p)
+  (let ((properties (package-properties p)))
+    (and (assq 'rosenthal-update? properties)
+         (not (assq-ref properties 'rosenthal-update?)))))
+
+(manifest (map package->manifest-entry
+               (filter disable-updater?
+                       (all-rosenthal-packages))))

modules/rosenthal/packages.scm

@@ -5,12 +5,18 @@
 (define-module (rosenthal packages)
   #:use-module (gnu packages)
   #:use-module (guix diagnostics)
+  #:use-module (guix discovery)
   #:use-module (guix i18n)
+  #:use-module (guix memoization)
+  #:use-module (guix packages)
+  #:use-module (guix ui)
   #:use-module (ice-9 match)
   #:use-module (srfi srfi-34)
   #:replace (%patch-path
              search-patch)
-  #:export (rosenthal-patches))
+  #:export (rosenthal-patches
+            %rosenthal-package-module-path
+            all-rosenthal-packages))
 
 ;;; Commentary:
 ;;;
@@ -40,6 +46,9 @@
     (try ("rosenthal/packages/binaries.scm" rosenthal/ packages/)
          ("rosenthal/packages.scm" rosenthal/))))
 
+(define %rosenthal-package-module-path
+  `((,%rosenthal-root-directory . "rosenthal/packages")))
+
 (define %patch-path
   ;; Define it after '%package-module-path' so that '%load-path' contains user
   ;; directories, allowing patches in $GUIX_PACKAGE_PATH to be found.
@@ -64,3 +73,29 @@
   "Return the list of absolute file names corresponding to each
 FILE-NAME found in %PATCH-PATH."
   (list (search-patch file-name) ...))
+
+;; Adapted from (@ (gnu packages) all-packages).
+(define all-rosenthal-packages
+  (mlambda ()
+    "Return the list of all public packages, including replacements and hidden
+packages, excluding superseded packages."
+    ;; Note: 'fold-packages' never traverses the same package twice but
+    ;; replacements break that (they may or may not be visible to
+    ;; 'fold-packages'), hence this hash table to track visited packages.
+    (define visited (make-hash-table))
+
+    (fold-packages (lambda (package result)
+                     (if (hashq-ref visited package)
+                         result
+                         (begin
+                           (hashq-set! visited package #t)
+                           (match (package-replacement package)
+                             ((? package? replacement)
+                              (hashq-set! visited replacement #t)
+                              (cons* replacement package result))
+                             (#f
+                              (cons package result))))))
+                   '()
+                   (all-modules %rosenthal-package-module-path #:warn warn-about-load-error)
+                   ;; Dismiss deprecated packages but keep hidden packages.
+                   #:select? (negate package-superseded))))

modules/rosenthal/packages/admin.scm

@@ -19,7 +19,7 @@
 (define-public dinit
   (package
     (name "dinit")
-    (version "0.19.3")
+    (version "0.19.4")
     (source
      (origin
        (method git-fetch)
@@ -28,7 +28,7 @@
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0gw5jvh9bxnnwdv7ajscs03d6x2hcs9i3hxkqfjs19d4wr5rghyq"))))
+        (base32 "09k7airphnpg6hmif91d9nfi5fhz40qh52sp8vnrshfy7mhkq571"))))
     (build-system meson-build-system)
     (arguments
      (list #:configure-flags

modules/rosenthal/packages/binaries.scm

@@ -3,6 +3,7 @@
 ;; SPDX-License-Identifier: GPL-3.0-or-later
 
 (define-module (rosenthal packages binaries)
+  #:use-module (srfi srfi-1)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix gexp)
   #:use-module (guix deprecation)
@@ -29,7 +30,7 @@
 (define-public atuin-bin
   (deprecated-package "atuin-bin" atuin))
 
-(define bitwarden
+(define-public bitwarden
   (package
     (name "bitwarden")
     (version "2025.3.1")
@@ -50,74 +51,24 @@
     (description
      "This package provides browser extension for Bitwarden client.")
     (license license:gpl3)
-    (properties '((addon-id . "{446900e4-71c2-419f-a6a7-df9c091e268b}")))))
+    (properties
+     '((addon-id . "{446900e4-71c2-419f-a6a7-df9c091e268b}")
+       (hidden? . #t)
+       (rosenthal-update? . #f)))))
 
 (define-public bitwarden/icecat
-  (make-icecat-extension bitwarden))
-
-(define-public clash-bin
-  (package
-    (name "clash-bin")
-    (version "1.18.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/Dreamacro/clash/releases/download/v"
-                    version "/clash-linux-amd64-v3-v" version ".gz"))
-              (sha256
-               (base32
-                "0gchpc4pvy24dvhb5nk08g97rswjqr1ic6i405f1ba5snfv8i5z8"))))
-    (build-system copy-build-system)
-    (arguments
-     (list #:install-plan
-           #~'((#$(format #f "clash-linux-amd64-v3-v~a" version) "bin/clash"))
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-after 'install 'fix-permission
-                 (lambda _
-                   (chmod (string-append #$output "/bin/clash") #o555))))))
-    (supported-systems '("x86_64-linux"))
-    (home-page "https://github.com/Dreamacro/clash")
-    (synopsis "Rule-based tunnel in Go")
-    (description
-     "Clash is a cross-platform rule-based proxy utility that runs on the
-network and application layer, supporting various proxy and anti-censorship
-protocols out-of-the-box.")
-    (license license:gpl3)))
+  (let ((base (make-icecat-extension bitwarden)))
+    (package
+      (inherit base)
+      (properties
+       `(,@(alist-delete 'hidden? (package-properties base))
+         (rosenthal-update? . #f))))))
 
 (define-public hugo-bin
   (deprecated-package "hugo-bin" hugo))
 
 (define-public mihomo-bin
-  (package
-    (name "mihomo-bin")
-    (version "1.19.5")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/MetaCubeX/mihomo/releases/download/v"
-                    version "/mihomo-linux-amd64-v" version ".gz"))
-              (sha256
-               (base32
-                "1x7i7v1gkfgc19fmsn9annv8nvwfl6w5pqr1m3982plzabnlr1ni"))))
-    (build-system copy-build-system)
-    (arguments
-     (list #:install-plan
-           #~'((#$(string-append
-                   "mihomo-linux-amd64-v" (package-version this-package))
-                "bin/mihomo"))
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-after 'install 'fix-permission
-                 (lambda _
-                   (chmod (string-append #$output "/bin/mihomo") #o555))))))
-    (supported-systems '("x86_64-linux"))
-    (home-page "https://wiki.metacubex.one/")
-    (synopsis "Rule-based tunnel in Go")
-    (description
-     "This package provides @command{mihomo}, another @code{clash} kernel.")
-    (license license:gpl3)
-    (properties '((upstream-name . "mihomo")))))
+  (deprecated-package "mihomo-bin" mihomo))
 
 (define-public clash-meta-bin
   (deprecated-package "clash-meta-bin" mihomo-bin))
@@ -125,7 +76,7 @@ protocols out-of-the-box.")
 (define-public cloudflare-warp-bin
   (package
     (name "cloudflare-warp-bin")
-    (version "2025.2.600.0")
+    (version "2025.4.929.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://pkg.cloudflareclient.com"
@@ -133,7 +84,7 @@ protocols out-of-the-box.")
                                   "cloudflare-warp_" version "_amd64.deb"))
               (sha256
                (base32
-                "0rabxl6vfj3pljn77w96kb2k9w99hh5pvis1grr4im6lf5m86xsj"))))
+                "1ygqr6l7lsbkq1f8qwgypv2flyjd430sjkrwsw8rhd2lgnvwisff"))))
     (build-system copy-build-system)
     (arguments
      (list #:install-plan
@@ -238,11 +189,14 @@ eBooks.")
    (license license:expat)
    (properties '((upstream-name . "komga")))))
 
-(define miniflux-injector
+(define-public miniflux-injector
   (package
     (name "miniflux-injector")
     (version "2.3.3")
-    (properties '((addon-id . "{528ec801-2e29-4cb9-ae71-5a90503138d1}")))
+    (properties
+     '((addon-id . "{528ec801-2e29-4cb9-ae71-5a90503138d1}")
+       (hidden? . #t)
+       (rosenthal-update? . #f)))
     (source
      (origin
        (method url-fetch/zipbomb)
@@ -277,7 +231,38 @@ results are added in a sidebar next to search engine results.")
     (license license:expat)))
 
 (define-public miniflux-injector/icecat
-  (make-icecat-extension miniflux-injector))
+  (let ((base (make-icecat-extension miniflux-injector)))
+    (package
+      (inherit base)
+      (properties
+       `(,@(alist-delete 'hidden? (package-properties base))
+         (rosenthal-update? . #f))))))
+
+(define-public navidrome-bin
+  (package
+    (name "navidrome-bin")
+    (version "0.55.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/navidrome/navidrome/releases/download/v"
+                    version "/navidrome_" version "_linux_amd64.tar.gz"))
+              (sha256
+               (base32
+                "0h3984p10am39y619ibrvk1g96ra52kig929n792399q2jw1lrlp"))))
+    (build-system copy-build-system)
+    (arguments
+     (list #:install-plan
+           #~'(("navidrome" "bin/"))))
+    (supported-systems '("x86_64-linux"))
+    (home-page "https://www.navidrome.org/")
+    (synopsis "Web-based music collection server and streamer")
+    (description
+     "Navidrome is a self-hosted music server that allows users to stream and
+manage their music collections.  It provides a web interface and is compatible
+with the Subsonic API.")
+    (license license:expat)
+    (properties '((upstream-name . "navidrome")))))
 
 (define-public shadow-tls-bin
   (package
@@ -309,56 +294,8 @@ monster-in-the-middle}.")
     (license license:expat)
     (properties '((upstream-name . "shadow-tls")))))
 
-(define sidebery
-  (package
-    (name "sidebery")
-    (version "5.3.3.7")
-    (source
-     (origin
-       (method url-fetch/zipbomb)
-       (uri (string-append
-             "https://github.com/mbnuqw/sidebery/releases/download/v"
-             (string-drop-right version 2) "/sidebery-" version ".xpi"))
-       (sha256
-        (base32
-         "0srply73aa3i353w8d6zlqn55wqb2ndmcmzzr4n3dsxr5hynpypx"))))
-    (build-system copy-build-system)
-    (arguments
-     (list
-      #:install-plan
-      #~'(("." #$(assq-ref (package-properties this-package) 'addon-id)))))
-    (home-page "https://github.com/mbnuqw/sidebery")
-    (synopsis "Manage tabs and bookmarks in sidebar")
-    (description
-     "This package provides a browser extension for managing tabs and bookmarks
-in sidebar.")
-    (license license:expat)
-    (properties '((addon-id . "{3c078156-979c-498b-8990-85f7987dd929}")))))
-
-(define-public sidebery/icecat
-  (make-icecat-extension sidebery))
-
 (define-public sing-box-bin
-  (package
-    (name "sing-box-bin")
-    (version "1.11.8")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/SagerNet/sing-box/releases/download/v"
-                    version "/sing-box-" version "-linux-amd64.tar.gz"))
-              (sha256
-               (base32
-                "0fdv8wvkydm20fgpy30hm3b6v3vz09pim178faximpyv4846m46z"))))
-    (build-system copy-build-system)
-    (arguments (list #:install-plan #~'(("sing-box" "bin/"))))
-    (supported-systems '("x86_64-linux"))
-    (home-page "https://sing-box.sagernet.org/")
-    (synopsis "Universal proxy platform")
-    (description
-     "This package provides @command{sing-box}, a universal proxy platform.")
-    (license license:gpl3+)
-    (properties '((upstream-name . "sing-box")))))
+  (deprecated-package "sing-box-bin" sing-box))
 
 (define-public tailscale-bin
   (deprecated-package "tailscale-bin" tailscale))
@@ -366,7 +303,7 @@ in sidebar.")
 (define-public wakapi-bin
   (package
     (name "wakapi-bin")
-    (version "2.13.3")
+    (version "2.13.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -374,7 +311,7 @@ in sidebar.")
                     version "/wakapi_linux_amd64.zip"))
               (sha256
                (base32
-                "1znlp9h1rvisas6qf5r76yg0mbiiqxwgrqcc10gvcjsjrib844av"))))
+                "07wylvgi8yqcmywpvgbsqyhza86nmg8dfx1apmaynlw80y0nzial"))))
     (build-system copy-build-system)
     (arguments (list #:install-plan #~'(("wakapi" "bin/wakapi"))))
     (supported-systems '("x86_64-linux"))
@@ -390,7 +327,7 @@ coding statistics.")
 (define-public wakatime-cli-bin
   (package
     (name "wakatime-cli-bin")
-    (version "1.115.1")
+    (version "1.115.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/wakatime/wakatime-cli"
@@ -398,7 +335,7 @@ coding statistics.")
                                   "/wakatime-cli-linux-amd64.zip"))
               (sha256
                (base32
-                "1dd4r963kfka0iq6471sid4zrqkjbdm4lw8fyhx24rk0085lhcap"))))
+                "012s2r55iwd8kglh26sbscaps0iccdhk0ccaqf55kcfsbi35qc91"))))
     (build-system copy-build-system)
     (arguments
      (list #:install-plan

modules/rosenthal/packages/bootloaders.scm

@@ -47,4 +47,7 @@
                   (delete-file "configure")))))))
       (native-inputs
        (modify-inputs (package-native-inputs base)
-         (append autoconf automake python-minimal-wrapper))))))
+         (append autoconf automake python-minimal-wrapper)))
+      (properties
+       `(,@(package-properties base)
+         (rosenthal-update? . #f))))))

modules/rosenthal/packages/busybox.scm

@@ -25,4 +25,7 @@
               ;; FIXME: All mdev tests fail when building staticly.
               (add-before 'check 'disable-failing-tests
                 (lambda _
-                  (delete-file "testsuite/mdev.tests"))))))))))
+                  (delete-file "testsuite/mdev.tests")))))))
+      (properties
+       `(,@(package-properties base)
+         (rosenthal-update? . #f))))))

modules/rosenthal/packages/dns.scm

@@ -58,4 +58,6 @@ foreign CDN results so you also get best CDN node for your VPN at the same
 time.
 @item Block ISP ads on NXDOMAIN result (like 114so).
 @end itemize")
-      (license license:wtfpl2))))
+      (license license:wtfpl2)
+      (properties
+       '((rosenthal-update? . #f))))))

modules/rosenthal/packages/emacs-xyz.scm

@@ -6,9 +6,29 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix build-system emacs)
   #:use-module (guix gexp)
+  #:use-module (guix download)
   #:use-module (guix git-download)
   #:use-module (guix packages))
 
+(define-public emacs-nftables-mode
+  (package
+    (name "emacs-nftables-mode")
+    (version "1.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://elpa.gnu.org/packages/nftables-mode-"
+                           version ".tar"))
+       (sha256
+        (base32 "1wjw6n60kj84j8gj62mr6s97xd0aqvr4v7npyxwmhckw9z13xcqv"))))
+    (build-system emacs-build-system)
+    (home-page "https://elpa.gnu.org/packages/nftables-mode.html")
+    (synopsis "Major mode for editing nftables scripts")
+    (description
+     "@code{nftables-mode} is an Emacs major mode for editing nftables scripts.
+It currently only offers basic highlighting and primitive indentation.")
+    (license license:gpl3+)))
+
 (define-public emacs-pcmpl-tailscale
   (let ((commit "acd6bce54af506b0450cf6aa1068f63d4e25c8ce")
         (revision "0"))
@@ -30,7 +50,34 @@
       (description
        "This package provides enhanced completions for the tailscale command
 and it's subcommands.")
-      (license license:gpl3+))))
+      (license license:gpl3+)
+      (properties
+       '((rosenthal-update? . #f))))))
+
+(define-public emacs-treesit-auto
+  (package
+    (name "emacs-treesit-auto")
+    ;; NOTE: Not tagged, also change commit when updating.
+    (version "1.0.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/renzmann/treesit-auto")
+             (commit "016bd286a1ba4628f833a626f8b9d497882ecdf3")))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "03bvam7cpxqp4idhd235n76qdqhsbgw7m2lphy8qqwslbmcq23m4"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/renzmann/treesit-auto")
+    (synopsis "Automatically use tree-sitter major modes")
+    (description
+     "@code{treesit-auto} is an Emacs package for automatically using tree-sitter
+major modes and falling back to the original major mode when its tree-sitter
+counterpart is unavailable.")
+    (license license:gpl3+)
+    (properties
+     '((rosenthal-update? . #f)))))
 
 ;; https://issues.guix.gnu.org/59552
 (define-public emacs-wakatime-mode
@@ -61,4 +108,6 @@ and it's subcommands.")
       (description
        "WakaTime mode is an Emacs minor mode for automatic time tracking and
 metrics generated from your programming activity.")
-      (license license:gpl3+))))
+      (license license:gpl3+)
+      (properties
+       '((rosenthal-update? . #f))))))

modules/rosenthal/packages/golang.scm

@@ -0,0 +1,52 @@
+;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;
+;; SPDX-License-Identifier: GPL-3.0-or-later
+
+(define-module (rosenthal packages golang)
+  #:use-module (guix packages)
+  #:use-module ((guix build utils) #:select (alist-replace))
+  #:use-module (guix git-download)
+  #:use-module (gnu packages golang))
+
+(define-public go-1.24
+  (package
+    (inherit go-1.23)
+    (name "go")
+    (version "1.24.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/golang/go")
+             (commit (string-append "go" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "199yajw3amvspl9k2a75v4jblwr965laqngxbnsi5l3ragp5c1ck"))))
+    (native-inputs
+     ;; Go 1.24 and later requires Go 1.22+ as the bootstrap toolchain.
+     (alist-replace "go" (list go-1.22) (package-native-inputs go-1.23)))
+    (properties
+     `(,@(package-properties go-1.23)
+       (rosenthal-update? . #f)))))
+
+(define-public go-cloudflare
+  (let ((commit "37bc41c6ff79507200a315b72834fce6ca427a7e")
+        (revision "0"))
+    (package
+      (inherit go-1.22)
+      (name "go-cloudflare")
+      (version (git-version "1.22.12" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/cloudflare/go")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1zg6jqwhj42gaapk1fzqc4i7a6shdbfbpqgqhjyry55r4i0nqvxy"))))
+      (home-page "https://github.com/cloudflare/go")
+      (synopsis "Go with Cloudflare experimental patches")
+      (properties
+       `(,@(package-properties go-1.22)
+         (rosenthal-update? . #f))))))

modules/rosenthal/packages/networking.scm

@@ -9,8 +9,12 @@
   #:use-module (guix git-download)
   #:use-module (guix packages)
   #:use-module (rosenthal utils download)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages dns)
   #:use-module (gnu packages golang)
-  #:use-module (gnu packages golang-build))
+  #:use-module (gnu packages golang-build)
+  #:use-module (gnu packages linux)
+  #:use-module (rosenthal packages golang))
 
 (define-public cloudflared
   (package
@@ -30,7 +34,7 @@
                 "0mblq1zvl7722k3515yc99ym18li39anlcmj8s10m7kkp9yfc596"))))
     (build-system go-build-system)
     (arguments
-     (list #:go go-1.23
+     (list #:go go-cloudflare
            #:install-source? #f
            #:import-path "github.com/cloudflare/cloudflared/cmd/cloudflared"
            #:unpack-path "github.com/cloudflare/cloudflared"
@@ -63,6 +67,162 @@ this daemon, without requiring you to poke holes on your firewall --- your
 origin can remain as closed as possible.")
     (license license:asl2.0)))
 
+(define-public mihomo
+  (package
+    (name "mihomo")
+    (version "1.19.8")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/MetaCubeX/mihomo")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0wnzaji5yzj8hvjifgnmhg371mm94bc89bb2m1dmsqsp30m3dj0b"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
+      #:go go-1.23
+      #:install-source? #f
+      #:import-path "."
+      #:build-flags
+      #~(list "-tags" "with_gvisor"
+              (string-append
+               "-ldflags="
+               " -X github.com/metacubex/mihomo/constant.Version="
+               #$(package-version this-package)))
+      #:modules
+      '((ice-9 match)
+        ((guix build gnu-build-system) #:prefix gnu:)
+        (guix build go-build-system)
+        (guix build utils))
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'unpack
+            (lambda args
+              (unsetenv "GO111MODULE")
+              (apply (assoc-ref gnu:%standard-phases 'unpack) args)
+              (copy-recursively
+               #+(this-package-native-input "vendored-go-dependencies")
+               "vendor")))
+          (replace 'install-license-files
+            (assoc-ref gnu:%standard-phases 'install-license-files))
+          (delete 'check)
+          (add-after 'install 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (let ((mihomo (in-vicinity #$output "bin/mihomo")))
+                  (invoke mihomo "--help")
+                  (invoke mihomo "-v"))))))))
+    (native-inputs
+     (append
+      (list (origin
+              (method (go-mod-vendor #:go go-1.23))
+              (uri (package-source this-package))
+              (file-name "vendored-go-dependencies")
+              (sha256
+               (base32
+                "1275yq3n7dg7hbw7vj5i1dqi83qgin77iavqxbc2gw8dawbd9plg"))))
+      (if (%current-target-system)
+          (list this-package)
+          '())))
+    (home-page "https://wiki.metacubex.one/")
+    (synopsis "Rule-based proxy")
+    (description
+     "Mihomo is an anti-censorship proxy application, originally known as
+\"Clash Meta\", designed to facilitate secure and flexible internet access.
+It supports various protocols, making it a versatile tool for users seeking to
+bypass network restrictions." )
+    (license license:gpl3+)))
+
+(define-public sing-box
+  (package
+    (name "sing-box")
+    (version "1.11.10")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/SagerNet/sing-box")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "07vsg2zch1z6wk5k0zqj81n95l3crgzkgvafxkyy7za7y72h1jhr"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
+      #:go go-1.23
+      #:install-source? #f
+      #:import-path "./cmd/sing-box"
+      #:build-flags
+      #~(list "-tags" (string-join
+                       '("with_quic"
+                         "with_dhcp"
+                         "with_wireguard"
+                         "with_ech"
+                         "with_utls"
+                         "with_reality_server"
+                         "with_acme"
+                         "with_clash_api"
+                         "with_gvisor"))
+              (string-append
+               "-ldflags="
+               " -X github.com/sagernet/sing-box/constant.Version="
+               #$(package-version this-package)))
+      #:modules
+      '((ice-9 match)
+        ((guix build gnu-build-system) #:prefix gnu:)
+        (guix build go-build-system)
+        (guix build utils))
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'unpack
+            (lambda args
+              (unsetenv "GO111MODULE")
+              (apply (assoc-ref gnu:%standard-phases 'unpack) args)
+              (copy-recursively
+               #+(this-package-native-input "vendored-go-dependencies")
+               "vendor")))
+          (replace 'install-license-files
+            (assoc-ref gnu:%standard-phases 'install-license-files))
+          (add-after 'install 'install-extras
+            (lambda _
+              (let ((sing-box
+                     (or (which "sing-box")
+                         (in-vicinity #$output "bin/sing-box"))))
+                (map
+                 (match-lambda
+                   ((shell . path)
+                    (let ((file (in-vicinity #$output path)))
+                      (mkdir-p (dirname file))
+                      (with-output-to-file file
+                        (lambda ()
+                          (invoke sing-box "completion" shell))))))
+                 '(("bash" . "etc/bash_completion.d/sing-box")
+                   ("fish" . "share/fish/vendor_completions.d/sing-box.fish")
+                   ("zsh"  . "share/zsh/site-functions/_sing-box")))))))))
+    (native-inputs
+     (append
+      (list (origin
+              (method (go-mod-vendor #:go go-1.23))
+              (uri (package-source this-package))
+              (file-name "vendored-go-dependencies")
+              (sha256
+               (base32
+                "11607z2j6q6y20z7lkvhcd8z498mry6291lx69j73qa88wbc0mzd"))))
+      (if (%current-target-system)
+          (list this-package)
+          '())))
+    (home-page "https://sing-box.sagernet.org/")
+    (synopsis "Universal proxy platform")
+    (description
+     "@command{sing-box} is a customizable and univsersal proxy platform that
+can be used to create network proxy servers, clients and transparent proxies.")
+    (license license:gpl3+)))
+
 (define-public socks2http
   (package
     (name "socks2http")
@@ -86,16 +246,15 @@ origin can remain as closed as possible.")
     (description
      "This package provides a simple tool to plumb HTTP proxy requests through
 a SOCKS5 proxy.")
-    (license license:expat)))
+    (license license:expat)
+    (properties
+     '((rosenthal-update? . #f)))))
 
 (define-public tailscale
   (package
     (name "tailscale")
-    (version "1.80.3")
-    (source
-     (origin
-       (method go-vendored-fetch)
-       (uri (origin
+    (version "1.82.5")
+    (source (origin
               (method git-fetch)
               (uri (git-reference
                     (url "https://github.com/tailscale/tailscale")
@@ -103,42 +262,44 @@ a SOCKS5 proxy.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "07s8kwksvd0f9r65zkrhp3sn4jrv0c8g5w0wbiv9qq950l8gdv2h"))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "0g2pzazrfl41s1gra2g3ni34ddgw32mb2rjlv8x17g3yc7axdbqa"))
-       (modules '((guix build utils)))
-       (snippet '(delete-file-recursively "tool"))))
+                "05g3bwmdmhdq45v04znly8v3jjxh45b0gh959x5g6k9yq27ssn04"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  (delete-file-recursively "tool")
+                  (substitute* "net/tstun/tun_linux.go"
+                    (("/sbin/(modprobe)" _ cmd) cmd))))))
     (build-system go-build-system)
     (arguments
      (list
-      #:go go-1.23
+      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
+      #:go go-1.24
       #:install-source? #f
       #:import-path "."
       #:build-flags
       #~(list "-tags" "ts_include_cli"
               (string-append
                "-ldflags="
-               " -X tailscale.com/version.longStamp=v"
+               " -X tailscale.com/version.longStamp="
                #$(package-version this-package)
-               " -X tailscale.com/version.shortStamp=v"
+               " -X tailscale.com/version.shortStamp="
                #$(package-version this-package)))
-      #:test-flags ''("-skip=^TestPackageDocs$")
-      #:test-subdirs ''(".")
       #:modules
-      '(((guix build gnu-build-system) #:prefix gnu:)
+      '((ice-9 match)
+        ((guix build gnu-build-system) #:prefix gnu:)
         (guix build go-build-system)
         (guix build utils))
       #:phases
       #~(modify-phases %standard-phases
           (replace 'unpack
             (lambda args
+              (unsetenv "GO111MODULE")
               (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-              (unsetenv "GO111MODULE")))
+              (copy-recursively
+               #+(this-package-native-input "vendored-go-dependencies")
+               "vendor")))
           (replace 'install-license-files
             (assoc-ref gnu:%standard-phases 'install-license-files))
-          ;; TODO: Fix command references.
           (replace 'build
             (lambda* (#:key build-flags parallel-build? #:allow-other-keys)
               (let* ((njobs (if parallel-build? (parallel-job-count) 1)))
@@ -151,12 +312,69 @@ a SOCKS5 proxy.")
                             ,(string-append "tailscale.com/cmd/" pkg))))
                  '("derper"
                    "derpprobe"
-                   "tailscale"
+                   "tailscaled"
+                   "tsidp")))))
+          (add-after 'install 'install-extras
+            (lambda _
+              (symlink (in-vicinity #$output "bin/tailscaled")
+                       (in-vicinity #$output "bin/tailscale"))
+              (let ((tailscale
+                     (or (which "tailscale")
+                         (in-vicinity #$output "bin/tailscale"))))
+                (map
+                 (match-lambda
+                   ((shell . path)
+                    (let ((file (in-vicinity #$output path)))
+                      (mkdir-p (dirname file))
+                      (with-output-to-file file
+                        (lambda ()
+                          (invoke tailscale "completion" shell))))))
+                 '(("bash" . "etc/bash_completion.d/tailscale")
+                   ("fish" . "share/fish/vendor_completions.d/tailscale.fish")
+                   ("zsh"  . "share/zsh/site-functions/_tailscale"))))))
+          (add-after 'install 'wrap-binaries
+            (lambda* (#:key inputs #:allow-other-keys)
+              (wrap-program (in-vicinity #$output "bin/tailscaled")
+                `("PATH" ":" prefix
+                  ,(map (lambda (cmd)
+                          (dirname (search-input-file inputs cmd)))
+                        '("bin/find"
+                          "bin/getent"
+                          "bin/modprobe"
+                          "sbin/ip"
+                          "sbin/iptables"
+                          "sbin/resolvconf"
+                          "sbin/sysctl"))))))
+          (delete 'check)
+          (add-after 'install 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (for-each
+                 (lambda (cmd)
+                   (invoke (string-append #$output "/bin/" cmd) "--help"))
+                 '("derper"
+                   "derpprobe"
                    "tailscaled"
                    "tsidp"))))))))
+    (native-inputs
+     (append
+      (list (origin
+              (method (go-mod-vendor #:go go-1.24))
+              (uri (package-source this-package))
+              (file-name "vendored-go-dependencies")
+              (sha256
+               (base32
+                "15hpl0binvfwxazawd24xx32mxnfmpvprr5pk0854ashl0vj89aa"))))
+      (if (%current-target-system)
+          (list this-package)
+          '())))
+    (inputs
+     (list findutils glibc iproute iptables-nft kmod openresolv procps))
     (home-page "https://tailscale.com/")
-    (synopsis "Private WireGuard® networks made easy")
+    (synopsis "Mesh VPN service utilizing the WireGuard protocol and 2FA")
     (description
-     "This package provides @command{tailscale}, which brings an easy and secure
-way to use WireGuard and 2FA.")
+     "Tailscale is a mesh VPN service that simplifies the process of securely
+connecting devices and services across various networks.  It allows you to
+create a private network with minimal configuration and aims to remove the
+complexity of building a trusted and secure network.")
     (license license:bsd-3)))

modules/rosenthal/packages/ssh.scm

@@ -23,4 +23,7 @@
        (modify-inputs (package-inputs base)
          (append `(,zlib "static"))
          (replace "libtomcrypt" `(,libtomcrypt "static"))
-         (replace "libtommath" `(,libtommath "static")))))))
+         (replace "libtommath" `(,libtommath "static"))))
+      (properties
+       `(,@(package-properties base)
+         (rosenthal-update? . #f))))))

modules/rosenthal/packages/tree-sitter.scm

@@ -35,4 +35,6 @@
       (inherit base)
       (arguments
        (append '(#:tests? #f)           ;FIXME
-               (package-arguments base))))))
+               (package-arguments base)))
+      (properties
+       '((rosenthal-update? . #f))))))

modules/rosenthal/packages/video.scm

@@ -20,4 +20,7 @@
          ((#:phases _) #~%standard-phases)))
       (inputs
        (modify-inputs (package-inputs base)
-         (delete "libx11" "libxext" "libxfixes"))))))
+         (delete "libx11" "libxext" "libxfixes")))
+      (properties
+       `(,@(package-properties base)
+         (rosenthal-update? . #f))))))

modules/rosenthal/packages/web.scm

@@ -12,33 +12,102 @@
   #:use-module (guix build-system go)
   #:use-module (gnu packages golang)
   #:use-module (gnu packages image)
-  #:use-module (gnu packages web))
+  #:use-module (gnu packages web)
+  #:use-module (gnu packages version-control)
+  #:use-module (rosenthal packages golang))
 
-(define-public buku-run-dev
-  (let ((revision "23")
-        (commit "54fcdd77fc1e8e657b785b7d4ca8dc915e5f336b"))
-    (package
-      (inherit buku-run)
-      (name "buku-run-dev")
-      (version (git-version "0.1.1" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/carnager/buku_run")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "079ygn39px71bypa54jn4z55iq24lxxcy7jv3ijy08iinqbfvldc")))))))
+(define-public caddy
+  (package
+    (name "caddy")
+    (version "2.10.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/caddyserver/caddy")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "00crxr956sp865pc3mg0zsacsy80s8v4jgqpmbq3hrsk2gcdsc47"))
+              (modules '((guix build utils)))
+              (snippet '(substitute* "go.mod"
+                          (("^toolchain.*") "")))))
+    (build-system go-build-system)
+    (arguments
+     (list #:go go-1.24
+           #:tests? (not (%current-target-system)) ;TODO: Run test suite.
+           #:install-source? #f
+           #:import-path "./cmd/caddy"
+           #:build-flags
+           #~(list "-tags" "nobadger nomysql nopgx"
+                   (string-append
+                    "-ldflags="
+                    " -X github.com/caddyserver/caddy/v2.CustomVersion="
+                    #$(package-version this-package)))
+           #:modules
+           '((ice-9 match)
+             ((guix build gnu-build-system) #:prefix gnu:)
+             (guix build go-build-system)
+             (guix build utils))
+           #:phases
+           #~(modify-phases %standard-phases
+               (replace 'unpack
+                 (lambda args
+                   (unsetenv "GO111MODULE")
+                   (apply (assoc-ref gnu:%standard-phases 'unpack) args)
+                   (copy-recursively
+                    #+(this-package-native-input "vendored-go-dependencies")
+                    "vendor")))
+               (replace 'install-license-files
+                 (assoc-ref gnu:%standard-phases 'install-license-files))
+               (add-after 'install 'install-extras
+                 (lambda _
+                   (let ((caddy
+                          (or (which "caddy")
+                              (in-vicinity #$output "bin/caddy"))))
+                     (invoke caddy "manpage" "--directory"
+                             (in-vicinity #$output "share/man/man8"))
+                     (map
+                      (match-lambda
+                        ((shell . path)
+                         (let ((file (in-vicinity #$output path)))
+                           (mkdir-p (dirname file))
+                           (with-output-to-file file
+                             (lambda ()
+                               (invoke caddy "completion" shell))))))
+                      '(("bash" . "etc/bash_completion.d/caddy")
+                        ("fish" . "share/fish/vendor_completions.d/caddy.fish")
+                        ("zsh"  . "share/zsh/site-functions/_caddy"))))))
+               (delete 'check)
+               (add-after 'install 'check
+                 (lambda* (#:key tests? #:allow-other-keys)
+                   (when tests?
+                     (let ((caddy (in-vicinity #$output "bin/caddy")))
+                       (invoke caddy "help")
+                       (invoke caddy "version"))))))))
+    (native-inputs
+     (list (origin
+             (method (go-mod-vendor #:go go-1.24))
+             (uri (package-source this-package))
+             (file-name "vendored-go-dependencies")
+             (sha256
+              (base32
+               "0iwxhc85xnhpqrahiaw1017vxg27hc5q22rc0f96g42mc2mbi2zl")))))
+    (home-page "https://caddyserver.com/")
+    (synopsis "Extensible HTTP web server with automatic HTTPS")
+    (description
+     "Caddy is a web server designed for simplicity and ease of use.  It is
+notable for its automatic HTTPS feature, which enables secure connections
+without requiring complex configuration.  Caddy is built with a focus on
+performance and flexibility, making it suitable for a variety of applications,
+from serving static websites to running dynamic web applications.")
+    (license license:asl2.0)))
 
 (define-public hugo
   (package
     (name "hugo")
-    (version "0.145.0")
-    (source
-     (origin
-       (method go-vendored-fetch)
-       (uri (origin
+    (version "0.147.3")
+    (source (origin
               (method git-fetch)
               (uri (git-reference
                     (url "https://github.com/gohugoio/hugo")
@@ -46,19 +115,18 @@
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "19kfij8c1ljfn8xr3mfm5c89fhp62bl0c7rx0i8726jn6dbpl9g5"))))
-       (sha256
-        (base32
-         "10fmva8p4hcbs2kyjggbanrmix1mf1fym549c5zdv80khpppzfnb"))))
+                "17r4lhxkrv4rd2g5ap7glxnhkvg611g0z143bfj0kx80ir7rbdq8"))))
     (build-system go-build-system)
     (arguments
      (list
-      #:go go-1.23
+      #:go go-1.24
       #:install-source? #f
       #:import-path "."
       #:build-flags
-      ''("-tags" "extended withdeploy"
-         "-ldflags=-X github.com/gohugoio/hugo/common/hugo.vendorInfo=Nonguix")
+      #~(list "-tags" "extended withdeploy"
+              (string-append
+               "-ldflags="
+               " -X github.com/gohugoio/hugo/common/hugo.vendorInfo=Nonguix"))
       #:test-flags ''("-skip=^TestCommands/mod|^TestCommands/server")
       #:test-subdirs ''(".")
       #:modules
@@ -69,42 +137,59 @@
       #~(modify-phases %standard-phases
           (replace 'unpack
             (lambda args
+              (unsetenv "GO111MODULE")
               (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-              (unsetenv "GO111MODULE")))
+              (copy-recursively
+               #+(this-package-native-input "vendored-go-dependencies")
+               "vendor")))
           (replace 'install-license-files
             (assoc-ref gnu:%standard-phases 'install-license-files))
           (add-after 'unpack 'fix-paths
-            (lambda* (#:key inputs #:allow-other-keys)
+            (lambda* (#:key native-inputs inputs #:allow-other-keys)
               (setenv "C_INCLUDE_PATH"
                       (string-append
                        (getenv "C_INCLUDE_PATH") ":"
                        (dirname
                         (dirname
                          (dirname
-                          (search-input-file inputs "src/dec/alphai_dec.h"))))))
+                          (search-input-file
+                           (or native-inputs inputs)
+                           "src/dec/alphai_dec.h"))))))
               (with-directory-excursion "vendor/github.com/bep/gowebp"
                 (substitute* (find-files "internal/libwebp")
                   (("../../libwebp_src/(.*)\"" _ file)
-                   (string-append (search-input-file inputs file) "\""))))
+                   (format #f "~a\""
+                           (search-input-file
+                            (or native-inputs inputs) file)))))
               (with-directory-excursion "vendor/github.com/bep/golibsass"
                 (substitute* (find-files "internal/libsass")
                   (("../../libsass_src/(.*)\"" _ file)
-                   (string-append (search-input-file inputs file) "\"")))))))))
-    (inputs
-     (list (package-source libsass)
+                   (format #f "~a\""
+                           (search-input-file
+                            (or native-inputs inputs) file))))))))))
+    (native-inputs
+     (list (origin
+             (method (go-mod-vendor #:go go-1.24))
+             (uri (package-source this-package))
+             (file-name "vendored-go-dependencies")
+             (sha256
+              (base32
+               "1pwq7i0y2gb4cw9nriy699wa6pqlhz42rjkzv39g355nyszwpyj8")))
+           (package-source libsass)
            (package-source libwebp)))
     (home-page "https://gohugo.io/")
-    (synopsis "Static site generator")
+    (synopsis "Static site generator written in Go")
     (description
      "Hugo is a static site generator written in Go, optimized for speed and
-designed for flexibility.")
+designed for flexibility.  With its advanced templating system and fast asset
+pipelines, Hugo renders a complete site in seconds, often less.")
     (license license:asl2.0)))
 
-;; TODO: Package Forgejo without vendored dependencies.
 (define-public forgejo
   (package
     (name "forgejo")
     (version "10.0.3")
+    ;; TODO: Address npm dependencies and fetch from git.
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -112,13 +197,17 @@ designed for flexibility.")
                     version "/forgejo-src-" version ".tar.gz"))
               (sha256
                (base32
-                "0cqp4x3xrvr7q1pkijqmf6jnx3wahi20xjfrv7ap81ykif83269x"))))
+                "0cqp4x3xrvr7q1pkijqmf6jnx3wahi20xjfrv7ap81ykif83269x"))
+              (modules '((guix build utils)))
+              ;; Avoid downloading toolchain.
+              (snippet '(substitute* "go.mod"
+                          (("^toolchain.*") "")))))
     (build-system go-build-system)
     (arguments
-     (list #:go go-1.23
+     (list #:tests? (not (%current-target-system)) ;TODO: Run test suite.
+           #:go go-1.23
            #:install-source? #f
-           #:tests? #f                  ;TODO
-           #:import-path "code.gitea.io/gitea"
+           #:import-path "."
            #:build-flags
            #~(list (string-append
                     "-ldflags="
@@ -136,40 +225,40 @@ designed for flexibility.")
            #:phases
            #~(modify-phases %standard-phases
                (replace 'unpack
-                 (assoc-ref gnu:%standard-phases 'unpack))
-               (add-after 'unpack 'support-module
-                 (lambda _
+                 (lambda args
                    (unsetenv "GO111MODULE")
-                   (substitute* "go.mod"
-                     (("^toolchain.*") ""))))
-               (replace 'build
-                 (lambda* (#:key build-flags (parallel-build? #t)
-                           #:allow-other-keys)
-                   (let* ((njobs (if parallel-build? (parallel-job-count) 1)))
-                     (setenv "GOMAXPROCS" (number->string njobs)))
-                   (apply invoke "go" "install"
-                          "-v" "-x"
-                          "-ldflags=-s -w"
-                          "-trimpath"
-                          build-flags)))
-               (replace 'install
+                   (apply (assoc-ref gnu:%standard-phases 'unpack) args)))
+               (replace 'install-license-files
+                 (assoc-ref gnu:%standard-phases 'install-license-files))
+               (add-after 'install 'rename-binary
+                 (lambda _
+                   (rename-file (in-vicinity #$output "bin/gitea")
+                                (in-vicinity #$output "bin/forgejo"))))
+               (add-after 'install 'install-extras
                  (lambda _
                    (mkdir-p (in-vicinity #$output "/etc/forgejo"))
-                   (copy-file
-                    "custom/conf/app.example.ini"
-                    (in-vicinity #$output "etc/forgejo/app.ini"))
+                   (copy-file "custom/conf/app.example.ini"
+                              (in-vicinity #$output "etc/forgejo/app.ini"))
                    (for-each
                     (lambda (dir)
                       (copy-recursively
                        dir (string-append #$output "/etc/forgejo/" dir)))
-                    '("options" "public" "templates"))
-                   (with-directory-excursion (in-vicinity #$output "bin")
-                     (rename-file "gitea" "forgejo"))))
-               (replace 'install-license-files
-                 (assoc-ref gnu:%standard-phases 'install-license-files)))))
+                    '("options" "public" "templates"))))
+               (delete 'check)
+               (add-after 'install 'check
+                 (lambda* (#:key tests? #:allow-other-keys)
+                   (when tests?
+                     (let ((gitea (in-vicinity #$output "bin/gitea")))
+                       (invoke gitea "--help")
+                       (invoke gitea "--version"))))))))
+    (native-inputs (list git-minimal))
+    (home-page "https://forgejo.org/")
     (synopsis "Lightweight software forge")
     (description
-     "Forgejo is a self-hosted lightweight software forge.  Easy to install and
-low maintenance, it just does the job.")
-    (home-page "https://forgejo.org/")
-    (license license:gpl3+)))
+     "Forgejo is a self-hosted, lightweight software forge designed to
+facilitate collaborative software development.  It is built to be easy to
+install and maintain, making it an ideal choice for teams and organizations
+looking for a reliable platform to manage their software projects.")
+    (license license:gpl3+)
+    (properties
+     '((rosenthal-update? . #f)))))

modules/rosenthal/packages/wm.scm

@@ -67,7 +67,9 @@
       (synopsis "Rust bindings for PipeWire")
       (description "This package provides Rust bindings for PipeWire.")
       (license license:expat)
-      (properties '((hidden? . #t))))))
+      (properties
+       '((hidden? . #t)
+         (rosenthal-update? . #f))))))
 
 (define-public rust-smithay
   (let ((commit "0cd3345c59f7cb139521f267956a1a4e33248393")
@@ -118,7 +120,9 @@ will need, in a generic fashion.
 It supports the @code{wayland}, @code{wayland-protocols}, and some external
 extensions, such as @code{wlr-protocols} and @code{plasma-wayland-protocols}.")
       (license license:expat)
-      (properties '((hidden? . #t))))))
+      (properties
+       '((hidden? . #t)
+         (rosenthal-update? . #f))))))
 
 (define-public niri
   (package

modules/rosenthal/services/bittorrent.scm

@@ -133,8 +133,7 @@ WebUI\\Password_PBKDF2=\"@ByteArray(ARQ77eY1NUZaQsuDHbIMCA==:0WMRkYTUWVT9wVvdDtH
                 #$(file-append qbittorrent "/bin/qbittorrent-nox")
                 #$(string-append "--webui-port=" (number->string webui-port))
                 #$@extra-options)))
-           (stop #~(make-kill-destructor #:grace-period 1800))
-           (auto-start? #f)))))
+           (stop #~(make-kill-destructor #:grace-period 1800))))))
 
 (define home-qbittorrent-service-type
   (service-type

modules/rosenthal/services/web.scm

@@ -7,6 +7,7 @@
   #:use-module (guix records)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages version-control)
+  #:use-module (gnu packages video)
   #:use-module (rosenthal packages binaries)
   #:use-module (rosenthal packages web)
   #:use-module (gnu services)
@@ -29,6 +30,9 @@
             misskey-configuration
             misskey-service-type
 
+            navidrome-configuration
+            navidrome-service-type
+
             vaultwarden-configuration
             vaultwarden-service-type))
 
@@ -349,6 +353,77 @@
    (default-value (misskey-configuration))
    (description "Run Misskey, an interplanetary microblogging platform.")))
 
+
+;;;
+;;; Navidrome
+;;;
+
+
+(define-configuration navidrome-configuration
+  (navidrome
+   (file-like navidrome-bin)
+   "")
+  (ffmpeg
+   (file-like ffmpeg)
+   "")
+  (auto-start?
+   (boolean #t)
+   "")
+  (extra-config
+   (string "")
+   "")
+  (no-serialization))
+
+(define %navidrome-accounts
+  (list (user-group (name "navidrome") (system? #t))
+        (user-account
+         (name "navidrome")
+         (group "navidrome")
+         (system? #t)
+         (comment "Navidrome user")
+         (home-directory "/var/lib/navidrome"))))
+
+(define navidrome-shepherd-service
+  (match-record-lambda <navidrome-configuration>
+      (navidrome ffmpeg auto-start? extra-config)
+    (let ((config-file
+           (mixed-text-file
+            "navidrome.toml"
+            "DataFolder = '/var/lib/navidrome'\n"
+            "CacheFolder = '/var/lib/navidrome/cache'\n"
+            "EnableInsightsCollector = false\n"
+            extra-config)))
+      (list (shepherd-service
+             (documentation "Run Navidrome.")
+             (provision '(navidrome))
+             (requirement '(loopback user-processes))
+             (start
+              #~(make-forkexec-constructor
+                 (list #$(file-append navidrome "/bin/navidrome")
+                       "--configfile" #$config-file)
+                 #:user "navidrome"
+                 #:group "navidrome"
+                 #:log-file "/var/log/navidrome.log"
+                 #:environment-variables
+                 (list "LC_ALL=C.UTF-8"
+                       (string-append "PATH=" #$ffmpeg "/bin"))))
+             (stop
+              #~(make-kill-destructor))
+             (auto-start? auto-start?)
+             (actions
+              (list (shepherd-configuration-action config-file))))))))
+
+(define navidrome-service-type
+  (service-type
+   (name 'navidrome)
+   (extensions
+    (list (service-extension account-service-type
+                             (const %navidrome-accounts))
+          (service-extension shepherd-root-service-type
+                             navidrome-shepherd-service)))
+   (default-value (navidrome-configuration))
+   (description "Run Navidrome.")))
+
 
 ;;
 ;; Vaultwarden

modules/rosenthal/utils/download.scm

@@ -6,45 +6,41 @@
   #:use-module (guix gexp)
   #:use-module (guix packages)
   #:use-module (guix build-system gnu)
-  #:use-module (guix build-system go)
-  #:export (go-vendored-fetch))
+  #:export (go-mod-vendor))
 
-;; NOTE: This approach shouldn't be upstreamed.
-(define* (go-vendored-fetch src hash-algo hash
-                            #:optional name
-                            #:key (system (%current-system))
-                            (go
-                             (module-ref
-                              (resolve-interface '(gnu packages golang))
-                              ;; Use latest Go in Guix.
-                              'go-1.23))
-                            (nss-certs
-                             (module-ref
-                              (resolve-interface '(gnu packages certs))
-                              'nss-certs)))
-  (gexp->derivation
-   (or name
-       (string-append (origin-file-name src) "-vendored"))
-   (with-imported-modules %default-gnu-imported-modules
-     #~(begin
-         (use-modules (guix build gnu-build-system)
-                      (guix build utils))
-         (setenv "GOCACHE" "/tmp/go")
-         (setenv "GOMODCACHE" "/tmp/gomod")
-         (setenv "SSL_CERT_DIR" #+(file-append nss-certs "/etc/ssl/certs"))
-         ;; Support Unicode in file name.
-         (setlocale LC_ALL "C.UTF-8")
+;;;
+;;; ‘go mod vendor’ based fetcher
+;;;
 
-         ((assoc-ref %standard-phases 'unpack) #:source #+src)
-         (invoke #+(file-append go "/bin/go") "mod" "vendor")
-         (copy-recursively "." #$output)))
-   #:system system
-   #:hash-algo hash-algo
-   #:hash hash
-   ;; Is a directory.
-   #:recursive? #t
-   ;; Honor the user's proxy and locale settings.
-   #:leaked-env-vars '("http_proxy" "https_proxy"
-                       "LC_ALL" "LC_MESSAGES" "LANG"
-                       "COLUMNS")
-   #:local-build? #t))
+(define* (go-mod-vendor #:key go)
+  (lambda* (src hash-algo hash #:optional name #:key (system (%current-system)))
+    (define nss-certs
+      (module-ref (resolve-interface '(gnu packages certs)) 'nss-certs))
+
+    (gexp->derivation
+     (or name "vendored-go-dependencies")
+     (with-imported-modules %default-gnu-imported-modules
+       #~(begin
+           (use-modules (guix build gnu-build-system)
+                        (guix build utils))
+           ;; Support Unicode in file name.
+           (setlocale LC_ALL "C.UTF-8")
+           ;; For HTTPS support.
+           (setenv "SSL_CERT_DIR" #+(file-append nss-certs "/etc/ssl/certs"))
+
+           ((assoc-ref %standard-phases 'unpack) #:source #+src)
+           (invoke #+(file-append go "/bin/go") "mod" "vendor")
+           (copy-recursively "vendor" #$output)))
+     #:system system
+     #:hash-algo hash-algo
+     #:hash hash
+     ;; Is a directory.
+     #:recursive? #t
+     #:env-vars '(("GOCACHE" . "/tmp/go-cache")
+                  ("GOPATH" . "/tmp/go"))
+     ;; Honor the user's proxy and locale settings.
+     #:leaked-env-vars '("GOPROXY"
+                         "http_proxy" "https_proxy"
+                         "LC_ALL" "LC_MESSAGES" "LANG"
+                         "COLUMNS")
+     #:local-build? #t)))