Merge pull request #133984 from ju1m/sourcehut

nixos/sourcehut: updates, fixes, hardening

18 files changed, 269 insertions, 68 deletions

diff --git a/pkgs/applications/version-management/sourcehut/builds.nix b/pkgs/applications/version-management/sourcehut/builds.nix
index c8163caf8eae..2e771de73a54 100644
--- a/pkgs/applications/version-management/sourcehut/builds.nix
+++ b/pkgs/applications/version-management/sourcehut/builds.nix
@@ -11,25 +11,30 @@
 , python
 }:
 let
-  version = "0.66.7";
+  version = "0.74.17";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "builds.sr.ht";
+    rev = version;
+    sha256 = "sha256-6Yc33lkhozpnx8e6yukUfo+/Qw5mwpJQQKuYbC7uqcU=";
+  };
 
   buildWorker = src: buildGoModule {
     inherit src version;
     pname = "builds-sr-ht-worker";
 
-    vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY=";
+    vendorSha256 = "sha256-Pf1M9a43eK4jr6QMi6kRHA8DodXQU0pqq9ua5VC3ER0=";
   };
 in
 buildPythonPackage rec {
-  inherit version;
+  inherit src version;
   pname = "buildsrht";
 
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "builds.sr.ht";
-    rev = version;
-    sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM=";
-  };
+  patches = [
+    # Revert change breaking Unix socket support for Redis
+    patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
+  ];
 
   nativeBuildInputs = srht.nativeBuildInputs;
 
@@ -56,10 +61,12 @@ buildPythonPackage rec {
     cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker
   '';
 
+  pythonImportsCheck = [ "buildsrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
     description = "Continuous integration service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/core.nix b/pkgs/applications/version-management/sourcehut/core.nix
index 7c3a516ed9dc..3242b85e3787 100644
--- a/pkgs/applications/version-management/sourcehut/core.nix
+++ b/pkgs/applications/version-management/sourcehut/core.nix
@@ -25,17 +25,16 @@
 , sassc
 , nodejs
 , redis
-, writeText
 }:
 
 buildPythonPackage rec {
   pname = "srht";
-  version = "0.67.4";
+  version = "0.68.13";
 
   src = fetchgit {
     url = "https://git.sr.ht/~sircmpwn/core.sr.ht";
     rev = version;
-    sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc=";
+    sha256 = "sha256-LPyEfpNlmod18Fj16xpihKOrsU/hQUfAeOmWMmUeVPQ=";
     fetchSubmodules = true;
   };
 
@@ -46,6 +45,7 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # Disable check for npm
     ./disable-npm-install.patch
   ];
 
@@ -87,6 +87,7 @@ buildPythonPackage rec {
   '';
 
   dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "srht" ];
 
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/srht";
diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 401a1437b7d9..00810f208cc5 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -22,6 +22,7 @@ let
       listssrht = self.callPackage ./lists.nix { };
       mansrht = self.callPackage ./man.nix { };
       metasrht = self.callPackage ./meta.nix { };
+      pagessrht = self.callPackage ./pages.nix { };
       pastesrht = self.callPackage ./paste.nix { };
       todosrht = self.callPackage ./todo.nix { };
 
@@ -40,6 +41,7 @@ with python.pkgs; recurseIntoAttrs {
   listssrht = toPythonApplication listssrht;
   mansrht = toPythonApplication mansrht;
   metasrht = toPythonApplication metasrht;
+  pagessrht = pagessrht;
   pastesrht = toPythonApplication pastesrht;
   todosrht = toPythonApplication todosrht;
 }
diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix
index 637c6f9c1df4..18e105aea4bf 100644
--- a/pkgs/applications/version-management/sourcehut/dispatch.nix
+++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "dispatchsrht";
-  version = "0.15.8";
+  version = "0.15.34";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "dispatch.sr.ht";
     rev = version;
-    sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss=";
+    sha256 = "sha256-bZ4ZKohMozZIyP0TUgxETOECib4XGUv29+Mg8ZsoMf8=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -31,10 +31,12 @@ buildPythonPackage rec {
     export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
+  pythonImportsCheck = [ "dispatchsrht" ];
+
   meta = with lib; {
     homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht";
     description = "Task dispatcher and service integration tool for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/git.nix b/pkgs/applications/version-management/sourcehut/git.nix
index e44fb9cd6c6c..e33bb6595012 100644
--- a/pkgs/applications/version-management/sourcehut/git.nix
+++ b/pkgs/applications/version-management/sourcehut/git.nix
@@ -8,13 +8,13 @@
 , scmsrht
 }:
 let
-  version = "0.72.8";
+  version = "0.76.4";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "git.sr.ht";
     rev = version;
-    sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc=";
+    sha256 = "sha256-diUkQpB/ivg8JTaoTcSyKr9Q9LZiMo6qVInBDPceklc=";
   };
 
   buildShell = src: buildGoModule {
@@ -32,13 +32,13 @@ let
   buildKeys = src: buildGoModule {
     inherit src version;
     pname = "gitsrht-keys";
-    vendorSha256 = "1d94cqy7x0q0agwg515xxsbl70b3qrzxbzsyjhn1pbyj532brn7f";
+    vendorSha256 = "sha256-9pojS69HCKVHUceyOpGtv9ewcxFD4WsOVsEzkmWJkF4=";
   };
 
   buildUpdateHook = src: buildGoModule {
     inherit src version;
     pname = "gitsrht-update-hook";
-    vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih";
+    vendorSha256 = "sha256-sBlG7EFqdDm7CkAHVX50Mf4N3sl1rPNmWExG/bfbfGA=";
   };
 
   updateHook = buildUpdateHook "${src}/gitsrht-update-hook";
@@ -72,10 +72,12 @@ buildPythonPackage rec {
     inherit updateHook;
   };
 
+  pythonImportsCheck = [ "gitsrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
     description = "Git repository hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/hg.nix b/pkgs/applications/version-management/sourcehut/hg.nix
index cddb76cabf25..6716f643a7e1 100644
--- a/pkgs/applications/version-management/sourcehut/hg.nix
+++ b/pkgs/applications/version-management/sourcehut/hg.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "hgsrht";
-  version = "0.27.4";
+  version = "0.29.3";
 
   src = fetchhg {
     url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht";
     rev = version;
-    sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr";
+    sha256 = "y8gKaamwD5lsYqO1SkxMcn3E2TWidHAo2slvEU+8ovg=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -32,10 +32,12 @@ buildPythonPackage rec {
     export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
+  pythonImportsCheck = [ "hgsrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht";
     description = "Mercurial repository hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/hub.nix b/pkgs/applications/version-management/sourcehut/hub.nix
index 17cb3fe4b614..511ec359fc4b 100644
--- a/pkgs/applications/version-management/sourcehut/hub.nix
+++ b/pkgs/applications/version-management/sourcehut/hub.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "hubsrht";
-  version = "0.13.1";
+  version = "0.14.4";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "hub.sr.ht";
     rev = version;
-    sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U=";
+    sha256 = "sha256-7HF+jykWGqzPWA0YtJZQZU7pnID1yexcqLkEf2HpnSs=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -26,11 +26,12 @@ buildPythonPackage rec {
   '';
 
   dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "hubsrht" ];
 
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/hub.sr.ht";
     description = "Project hub service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/lists.nix b/pkgs/applications/version-management/sourcehut/lists.nix
index b419b49f7b5d..3490796dda01 100644
--- a/pkgs/applications/version-management/sourcehut/lists.nix
+++ b/pkgs/applications/version-management/sourcehut/lists.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "listssrht";
-  version = "0.48.19";
+  version = "0.51.0";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "lists.sr.ht";
     rev = version;
-    sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8=";
+    sha256 = "sha256-iywZ6G5E4AJevg/Q1LoB7JMJxBcsAnbhiND++mFy/bw=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -37,10 +37,12 @@ buildPythonPackage rec {
     export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
+  pythonImportsCheck = [ "listssrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
     description = "Mailing list service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/man.nix b/pkgs/applications/version-management/sourcehut/man.nix
index bd331f000a72..2d4d152e3aae 100644
--- a/pkgs/applications/version-management/sourcehut/man.nix
+++ b/pkgs/applications/version-management/sourcehut/man.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "mansrht";
-  version = "0.15.12";
+  version = "0.15.22";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "man.sr.ht";
     rev = version;
-    sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio=";
+    sha256 = "sha256-curouf+eNCKprDI23blGs4AzJMry6zlCLDt/+0j5c8A=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -29,10 +29,12 @@ buildPythonPackage rec {
     export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
+  pythonImportsCheck = [ "mansrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht";
     description = "Wiki service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/meta.nix b/pkgs/applications/version-management/sourcehut/meta.nix
index 86d293973d7f..74a00692b6c7 100644
--- a/pkgs/applications/version-management/sourcehut/meta.nix
+++ b/pkgs/applications/version-management/sourcehut/meta.nix
@@ -18,19 +18,19 @@
 , python
 }:
 let
-  version = "0.53.14";
+  version = "0.57.2";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "meta.sr.ht";
     rev = version;
-    sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k=";
+    sha256 = "sha256-+ksfAOuch/fLkFLYU52Ug0Hf0EoERy+oCwa9g+GKuAA=";
   };
 
   buildApi = src: buildGoModule {
     inherit src version;
     pname = "metasrht-api";
-    vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4=";
+    vendorSha256 = "sha256-vo+YbMyo/Eal7hbFxP9hwIW2cePJcGFszoDRCCzFYdM=";
   };
 
 in
@@ -38,6 +38,11 @@ buildPythonPackage rec {
   pname = "metasrht";
   inherit version src;
 
+  patches = [
+    # Revert change breaking Unix socket support for Redis
+    patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
+  ];
+
   nativeBuildInputs = srht.nativeBuildInputs;
 
   propagatedBuildInputs = [
@@ -66,10 +71,12 @@ buildPythonPackage rec {
     cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api
   '';
 
+  pythonImportsCheck = [ "metasrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
     description = "Account management service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/pages.nix b/pkgs/applications/version-management/sourcehut/pages.nix
new file mode 100644
index 000000000000..9b6011d99900
--- /dev/null
+++ b/pkgs/applications/version-management/sourcehut/pages.nix
@@ -0,0 +1,30 @@
+{ lib
+, fetchFromSourcehut
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "pagessrht";
+  version = "0.5.2";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "pages.sr.ht";
+    rev = version;
+    sha256 = "sha256-yEM122uhF0MNkMlNXyvBSfkLogRQETeuBl2K66kivac=";
+  };
+
+  vendorSha256 = "sha256-udr+1y5ApQCSPhs3yQTTi9QfzRbz0A9COYuFMjQGa74=";
+
+  postInstall = ''
+    mkdir -p $out/share/sql/
+    cp -r -t $out/share/sql/ schema.sql migrations
+  '';
+
+  meta = with lib; {
+    homepage = "https://git.sr.ht/~sircmpwn/pages.sr.ht";
+    description = "Web hosting service for the sr.ht network";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ eadwu ];
+  };
+}
diff --git a/pkgs/applications/version-management/sourcehut/paste.nix b/pkgs/applications/version-management/sourcehut/paste.nix
index 0d8c91354937..c411f8e8c954 100644
--- a/pkgs/applications/version-management/sourcehut/paste.nix
+++ b/pkgs/applications/version-management/sourcehut/paste.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pastesrht";
-  version = "0.12.1";
+  version = "0.13.6";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "paste.sr.ht";
     rev = version;
-    sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc=";
+    sha256 = "sha256-Khcqk86iD9nxiKXN3+8mSLNoDau2qXNFOrLdkVu+rH8=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -29,10 +29,12 @@ buildPythonPackage rec {
     export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
+  pythonImportsCheck = [ "pastesrht" ];
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
     description = "Ad-hoc text file hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
new file mode 100644
index 000000000000..ae8e95ddc0c2
--- /dev/null
+++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
@@ -0,0 +1,69 @@
+From 069b03f85847ed4a9223183b62ee53f420838911 Mon Sep 17 00:00:00 2001
+From: Julien Moutinho <julm+srht@sourcephile.fr>
+Date: Thu, 16 Dec 2021 04:54:24 +0100
+Subject: [PATCH builds.sr.ht] Revert "Add build submission and queue
+ monitoring"
+
+This reverts commit 690f1aa16c77e418dc40109cd5e8fdf4a7ed947a.
+
+This has broken Unix socket support for Redis
+See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E
+---
+ buildsrht/app.py    | 3 ---
+ buildsrht/runner.py | 9 +--------
+ 2 files changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/buildsrht/app.py b/buildsrht/app.py
+index e5321a2..7c9977c 100644
+--- a/buildsrht/app.py
++++ b/buildsrht/app.py
+@@ -36,9 +36,6 @@ class BuildApp(SrhtFlask):
+         self.register_blueprint(secrets)
+         self.register_blueprint(gql_blueprint)
+ 
+-        from buildsrht.runner import builds_queue_metrics_collector
+-        self.metrics_registry.register(builds_queue_metrics_collector)
+-
+         @self.context_processor
+         def inject():
+             return {
+diff --git a/buildsrht/runner.py b/buildsrht/runner.py
+index 7773452..0389c8e 100644
+--- a/buildsrht/runner.py
++++ b/buildsrht/runner.py
+@@ -5,13 +5,10 @@ from srht.config import cfg
+ from srht.database import db
+ from srht.email import send_email
+ from srht.oauth import UserType
+-from srht.metrics import RedisQueueCollector
+-from prometheus_client import Counter
+ 
+ allow_free = cfg("builds.sr.ht", "allow-free", default="no") == "yes"
+ 
+-builds_broker = cfg("builds.sr.ht", "redis")
+-runner = Celery('builds', broker=builds_broker, config_source={
++runner = Celery('builds', broker=cfg("builds.sr.ht", "redis"), config_source={
+     "CELERY_TASK_SERIALIZER": "json",
+     "CELERY_ACCEPT_CONTENT": ["json"],
+     "CELERY_RESULT_SERIALIZER": "json",
+@@ -19,9 +16,6 @@ runner = Celery('builds', broker=builds_broker, config_source={
+     "CELERY_TASK_PROTOCOL": 1
+ })
+ 
+-builds_queue_metrics_collector = RedisQueueCollector(builds_broker, "buildsrht_builds", "Number of builds currently in queue")
+-builds_submitted = Counter("buildsrht_builds_submited", "Number of builds submitted")
+-
+ def queue_build(job, manifest):
+     from buildsrht.types import JobStatus
+     job.status = JobStatus.queued
+@@ -34,7 +28,6 @@ def queue_build(job, manifest):
+                 cfg("sr.ht", "owner-email"),
+                 "Cryptocurrency mining attempt on builds.sr.ht")
+     else:
+-        builds_submitted.inc()
+         run_build.delay(job.id, manifest.to_dict())
+ 
+ def requires_payment(user):
+-- 
+2.34.0
+
diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
new file mode 100644
index 000000000000..9ec37670b060
--- /dev/null
+++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
@@ -0,0 +1,48 @@
+From d88bee195797c6c294320617ff14798da94cd0f3 Mon Sep 17 00:00:00 2001
+From: Julien Moutinho <julm+srht@sourcephile.fr>
+Date: Thu, 16 Dec 2021 04:52:08 +0100
+Subject: [PATCH meta.sr.ht] Revert "Add webhook queue monitoring"
+
+This reverts commit 9931df3c23094af5179df9ef019ca732b8125dac.
+
+This has broken Unix socket support for Redis.
+See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E
+---
+ metasrht/app.py      | 3 ---
+ metasrht/webhooks.py | 5 +----
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/metasrht/app.py b/metasrht/app.py
+index b190875..89c59bc 100644
+--- a/metasrht/app.py
++++ b/metasrht/app.py
+@@ -49,9 +49,6 @@ class MetaApp(SrhtFlask):
+             from metasrht.blueprints.billing import billing
+             self.register_blueprint(billing)
+ 
+-        from metasrht.webhooks import webhook_metrics_collector
+-        self.metrics_registry.register(webhook_metrics_collector)
+-
+         @self.context_processor
+         def inject():
+             return {
+diff --git a/metasrht/webhooks.py b/metasrht/webhooks.py
+index 3e1149e..3f0ba01 100644
+--- a/metasrht/webhooks.py
++++ b/metasrht/webhooks.py
+@@ -7,11 +7,8 @@ if not hasattr(db, "session"):
+     db.init()
+ from srht.webhook import Event
+ from srht.webhook.celery import CeleryWebhook, make_worker
+-from srht.metrics import RedisQueueCollector
+ 
+-webhook_broker = cfg("meta.sr.ht", "webhooks", "redis://")
+-worker = make_worker(broker=webhook_broker)
+-webhook_metrics_collector = RedisQueueCollector(webhook_broker, "srht_webhooks", "Webhook queue length")
++worker = make_worker(broker=cfg("meta.sr.ht", "webhooks", "redis://"))
+ 
+ class UserWebhook(CeleryWebhook):
+     events = [
+-- 
+2.34.0
+
diff --git a/pkgs/applications/version-management/sourcehut/scm.nix b/pkgs/applications/version-management/sourcehut/scm.nix
index 1f3852653601..9fbaa8c92454 100644
--- a/pkgs/applications/version-management/sourcehut/scm.nix
+++ b/pkgs/applications/version-management/sourcehut/scm.nix
@@ -5,18 +5,17 @@
 , redis
 , pyyaml
 , buildsrht
-, writeText
 }:
 
 buildPythonPackage rec {
   pname = "scmsrht";
-  version = "0.22.9";
+  version = "0.22.16"; # Untagged version
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "scm.sr.ht";
     rev = version;
-    sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU=";
+    sha256 = "sha256-A4Q7wUc4ag7KRWOkdYXCsbzuFHyJJsM15OjrCoVt9UQ=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -33,11 +32,12 @@ buildPythonPackage rec {
   '';
 
   dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "scmsrht" ];
 
   meta = with lib; {
-    homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
+    homepage = "https://git.sr.ht/~sircmpwn/scm.sr.ht";
     description = "Shared support code for sr.ht source control services.";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/todo.nix b/pkgs/applications/version-management/sourcehut/todo.nix
index 85e1f5637b62..da31ba240730 100644
--- a/pkgs/applications/version-management/sourcehut/todo.nix
+++ b/pkgs/applications/version-management/sourcehut/todo.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "todosrht";
-  version = "0.64.14";
+  version = "0.66.1";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "todo.sr.ht";
     rev = version;
-    sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE=";
+    sha256 = "sha256-P0xaQpK7O9zipGSIa5jL1O0L/fKt51EMNGt7XndYQ+g=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -42,11 +42,12 @@ buildPythonPackage rec {
   ];
 
   dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "todosrht" ];
 
   meta = with lib; {
     homepage = "https://todo.sr.ht/~sircmpwn/todo.sr.ht";
     description = "Ticket tracking service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = with maintainers; [ eadwu ];
   };
 }
diff --git a/pkgs/applications/version-management/sourcehut/update.sh b/pkgs/applications/version-management/sourcehut/update.sh
index 156d4cc35e44..97509397aef5 100755
--- a/pkgs/applications/version-management/sourcehut/update.sh
+++ b/pkgs/applications/version-management/sourcehut/update.sh
@@ -1,8 +1,11 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p git mercurial common-updater-scripts
+set -eux -o pipefail
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
+cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
 root=../../../..
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
 
 default() {
   (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
@@ -13,42 +16,61 @@ version() {
 }
 
 src_url() {
-  (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.src.drvAttrs.url" | tr -d '"')
+  nix-instantiate --eval --strict --expr " with import $root {}; let src = sourcehut.python.pkgs.$1.drvAttrs.src; in src.url or src.meta.homepage" | tr -d '"'
 }
 
 get_latest_version() {
   src="$(src_url "$1")"
-  tmp=$(mktemp -d)
-
+  rm -rf "$tmp"
   if [ "$1" = "hgsrht" ]; then
-    hg clone "$src" "$tmp" &> /dev/null
+    hg clone "$src" "$tmp" >/dev/null
     printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')"
   else
-    git clone "$src" "$tmp"
-    printf "%s" "$(cd "$tmp" && git describe $(git rev-list --tags --max-count=1))"
+    git clone "$src" "$tmp" >/dev/null
+    printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")"
   fi
 }
 
 update_version() {
   default_nix="$(default "$1")"
-  version_old="$(version "$1")"
+  oldVersion="$(version "$1")"
   version="$(get_latest_version "$1")"
 
   (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
 
-  git add "$default_nix"
-  git commit -m "$1: $version_old -> $version"
-}
+  # Update vendorSha256 of Go modules
+  retry=true
+  while "$retry"; do
+    retry=false;
+    exec < <(exec nix -L build -f "$root" sourcehut.python.pkgs."$1" 2>&1)
+    while IFS=' :' read -r origin hash; do
+      case "$origin" in
+        (expected|specified) oldHash="$hash";;
+        (got) sed -i "s|$oldHash|$hash|" "$default_nix"; retry=true; break;;
+        (*) printf >&2 "%s\n" "$origin${hash:+:$hash}"
+      esac
+    done
+  done
 
-services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
-           "metasrht" "pastesrht" "todosrht" "scmsrht" )
+  if [ "$oldVersion" != "$version" ]; then
+    git add "$default_nix"
+    git commit -m "sourcehut.$1: $oldVersion -> $version"
+  fi
+}
 
-# Whether or not a specific service is requested
-if [ -n "$1" ]; then
-  version="$(get_latest_version "$1")"
-  (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
+if [ $# -gt 0 ]; then
+  services=("$@")
 else
-  for service in "${services[@]}"; do
-    update_version "$service"
-  done
+  # Beware that some packages must be updated before others,
+  # eg. buildsrht must be updated before gitsrht,
+  # otherwise this script would enter an infinite loop
+  # because the reported $oldHash to be changed
+  # may not actually be in $default_nix
+  # but in the file of one of its dependencies.
+  services=( "srht" "scmsrht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
+             "metasrht" "pagessrht" "pastesrht" "todosrht" )
 fi
+
+for service in "${services[@]}"; do
+  update_version "$service"
+done
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 3b645f9ce8b9..f00ca1984ec8 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -71,6 +71,7 @@ let
     inherit (go) GOOS GOARCH;
 
     patches = args.patches or [];
+    patchFlags = args.patchFlags or [];
     preBuild = args.preBuild or "";
     sourceRoot = args.sourceRoot or "";