fix: nix & python packages upgrade, csd verify file

.envrc

@@ -1 +1,4 @@
-use nix
+if ! has nix_direnv_version || ! nix_direnv_version 3.0.5; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.5/direnvrc" "sha256-RuwIS+QKFj/T9M2TFXScjBsLR6V3A17YVoEW/Q6AZ1w="
+fi
+use flake

.gitignore

@@ -109,3 +109,9 @@ venv.bak/
 
 # pre-commit
 .pre-commit-cache
+
+# direnv
+/.direnv
+
+# Nix
+result

flake.nix

@@ -1,19 +1,60 @@
 {
   inputs = {
-    flake-utils.url = "github:numtide/flake-utils";
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+      inputs.systems.follows = "systems";
+    };
+
+    poetry2nix = {
+      url = "github:nix-community/poetry2nix";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nix-github-actions.follows = "nix-github-actions";
+      inputs.treefmt-nix.follows = "treefmt-nix";
+      inputs.systems.follows = "systems";
+    };
+
+
+    # Unused but allows downstream to override versions and avoids duplicates
+
+    nix-github-actions = {
+      url = "github:nix-community/nix-github-actions";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    systems.url = "github:nix-systems/default";
+
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, flake-utils, nixpkgs }: (flake-utils.lib.eachDefaultSystem (
+  outputs = { self, nixpkgs, ... }@inputs: (inputs.flake-utils.lib.eachDefaultSystem (
     system:
     let
       pkgs = nixpkgs.legacyPackages.${system};
-      openconnect-sso = (import ./nix { inherit pkgs; }).openconnect-sso;
+      poetry2nix = inputs.poetry2nix.lib.mkPoetry2Nix { inherit pkgs; };
+
+      openconnect-pkgs = import ./nix {
+        inherit pkgs poetry2nix;
+        sources = null;
+      };
     in
     {
-      packages = { inherit openconnect-sso; };
-      defaultPackage = openconnect-sso;
+      packages = rec {
+        inherit (openconnect-pkgs) openconnect-sso;
+
+        default = openconnect-sso;
+      };
+
+      devShells.default = openconnect-pkgs.shell;
     }
   ) // {
-      overlay = import ./overlay.nix;
+    overlays = rec {
+      default = openconnect-sso;
+
+      openconnect-sso = import ./overlay.nix;
+    };
   });
 }

nix/default.nix

@@ -1,22 +1,12 @@
 { sources ? import ./sources.nix
-, pkgs ? import <nixpkgs> {
-    overlays = [ (import "${sources.poetry2nix}/overlay.nix") ];
-  }
+, pkgs ? import <nixpkgs> { }
+, poetry2nix ? import sources.poetry2nix { inherit pkgs; }
 }:
 
 let
-  qtLibsFor = with pkgs.lib; dep:
-    let
-      qtbase = head (filter (d: getName d.name == "qtbase") dep.nativeBuildInputs);
-      version = splitVersion qtbase.version;
-      majorMinor = concatStrings (take 2 version);
-    in
-    pkgs."libsForQt${majorMinor}";
+  inherit (pkgs) python3Packages qt6Packages;
 
-  inherit (qtLibsFor pkgs.python3Packages.pyqt5) callPackage;
-  pythonPackages = pkgs.python3Packages;
-
-  openconnect-sso = callPackage ./openconnect-sso.nix { inherit (pkgs) python3Packages; };
+  openconnect-sso = qt6Packages.callPackage ./openconnect-sso.nix { inherit poetry2nix; };
 
   shell = pkgs.mkShell {
     buildInputs = with pkgs; [
@@ -25,11 +15,10 @@ let
       git
       gnumake
       which
-      niv # Dependency manager for Nix expressions
       nixpkgs-fmt # To format Nix source files
       poetry # Dependency manager for Python
     ] ++ (
-      with pythonPackages; [
+      with python3Packages; [
         pre-commit # To check coding style during commit
       ]
     ) ++ (
@@ -50,16 +39,17 @@ let
     '';
   };
 
-  niv = if pkgs ? niv then pkgs.nim else pkgs.haskellPackages.niv;
-
   qtwrapper = pkgs.stdenv.mkDerivation {
     name = "qtwrapper";
     dontWrapQtApps = true;
     makeWrapperArgs = [
       "\${qtWrapperArgs[@]}"
     ];
     unpackPhase = ":";
-    nativeBuildInputs = [ pkgs.qt5.wrapQtAppsHook ];
+    nativeBuildInputs = with qt6Packages; [
+      wrapQtAppsHook qtbase
+    ];
+
     installPhase = ''
       mkdir -p $out/bin
       cat > $out/bin/wrap-qt <<'EOF'

nix/openconnect-sso.nix

@@ -1,32 +1,66 @@
 { lib
+, stdenv
 , openconnect
 , python3
 , python3Packages
 , poetry2nix
-, substituteAll
+, qt6Packages
 , wrapQtAppsHook
 }:
 
+# Nixpkgs' qutebrowser derivation is a good reference to check if something breaks
+
 poetry2nix.mkPoetryApplication {
-  src = lib.cleanSource ../.;
-  pyproject = ../pyproject.toml;
-  poetrylock = ../poetry.lock;
+  projectDir = ../.;
   python = python3;
-  buildInputs = [ wrapQtAppsHook ];
-  propagatedBuildInputs = [ openconnect ];
 
-  dontWrapQtApps = true;
-  makeWrapperArgs = [
-    "\${qtWrapperArgs[@]}"
+  # Skip dev-dependencies (doesn't seem to work, but doesn't hurt)
+  groups = [ ];
+  checkGroups = [ ];
+
+  buildInputs = [
+    python3Packages.setuptools
+  ];
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
   ];
 
-  preferWheels = true;
+  propagatedBuildInputs = [
+    openconnect
+  ] ++ lib.optional (stdenv.isLinux) qt6Packages.qtwayland;
+
+  dontWrapQtApps = true;
+  preFixup = ''
+    makeWrapperArgs+=(
+      # Force the app to use QT_PLUGIN_PATH values from wrapper
+      --unset QT_PLUGIN_PATH
+      "''${qtWrapperArgs[@]}"
+      # avoid persistant warning on starup
+      --set QT_STYLE_OVERRIDE Fusion
+    )
+  '';
+
+  # preferWheels = true;
 
   overrides = [
     poetry2nix.defaultPoetryOverrides
     (
       self: super: {
-        inherit (python3Packages) cryptography pyqt6 pyqt6-sip pyqt6-webengine six more-itertools;
+        inherit (python3Packages)
+          cryptography
+          lxml
+          more-itertools
+          pyqt6
+          pyqt6-sip
+          pyqt6-webengine
+          pysocks
+          requests
+          six;
+
+        coverage-enable-subprocess = super.coverage-enable-subprocess.overridePythonAttrs (old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+        });
       }
     )
   ];