12 files changed, 137 insertions, 64 deletions
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 2e9e20331bf6..9343e29d5963 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@v2.1.0
+        uses: korthout/backport-action@v2.1.1
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dadda215b0df..f204758e7be8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -465,7 +465,7 @@ Is the change [acceptable for releases][release-acceptable] and do you wish to h
 - No: Use the `master` branch, do not backport the pull request.
 - Yes: Can the change be implemented the same way on the `master` and release branches?
   For example, a packages major version might differ between the `master` and release branches, such that separate security patches are required.
-  - Yes: Use the `master` branch and [backport the pull request](#backporting-changes).
+  - Yes: Use the `master` branch and [backport the pull request](#how-to-backport-pull-requests).
   - No: Create separate pull requests to the `master` and `release-XX.YY` branches.
 
 Furthermore, if the change causes a [mass rebuild][mass-rebuild], use the appropriate staging branch instead:
diff --git a/nixos/README.md b/nixos/README.md
index b3cd9d234fa6..d0257e12d933 100644
--- a/nixos/README.md
+++ b/nixos/README.md
@@ -21,12 +21,14 @@ Reviewing process:
 - Ensure that the module maintainers are notified.
   - [CODEOWNERS](https://help.github.com/articles/about-codeowners/) will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
 - Ensure that the module tests, if any, are succeeding.
+  - You may invoke OfBorg with `@ofborg test <module>` to build `nixosTests.<module>`
 - Ensure that the introduced options are correct.
   - Type should be appropriate (string related types differs in their merging capabilities, `loaOf` and `string` types are deprecated).
   - Description, default and example should be provided.
 - Ensure that option changes are backward compatible.
-  - `mkRenamedOptionModuleWith` provides a way to make option changes backward compatible.
-- Ensure that removed options are declared with `mkRemovedOptionModule`
+  - `mkRenamedOptionModuleWith` provides a way to make renamed option backward compatible.
+  - Use `lib.versionAtLeast config.system.stateVersion "23.11"` on backward incompatible changes which may corrupt, change or update the state stored on existing setups.
+- Ensure that removed options are declared with `mkRemovedOptionModule`.
 - Ensure that changes that are not backward compatible are mentioned in release notes.
 - Ensure that documentations affected by the change is updated.
 
@@ -55,6 +57,7 @@ New modules submissions introduce a new module to NixOS.
 
 Reviewing process:
 
+- Ensure that all file paths [fit the guidelines](../CONTRIBUTING.md#file-naming-and-organisation).
 - Ensure that the module tests, if any, are succeeding.
 - Ensure that the introduced options are correct.
   - Type should be appropriate (string related types differs in their merging capabilities, `loaOf` and `string` types are deprecated).
@@ -76,9 +79,9 @@ Sample template for a new module review is provided below.
 - [ ] options have default
 - [ ] options have example
 - [ ] options have descriptions
-- [ ] No unneeded package is added to environment.systemPackages
-- [ ] meta.maintainers is set
-- [ ] module documentation is declared in meta.doc
+- [ ] No unneeded package is added to `environment.systemPackages`
+- [ ] `meta.maintainers` is set
+- [ ] module documentation is declared in `meta.doc`
 
 ##### Possible improvements
 
diff --git a/nixos/modules/programs/ausweisapp.nix b/nixos/modules/programs/ausweisapp.nix
index ef1f059568c6..91870df20246 100644
--- a/nixos/modules/programs/ausweisapp.nix
+++ b/nixos/modules/programs/ausweisapp.nix
@@ -7,11 +7,11 @@ let
 in
 {
   options.programs.ausweisapp = {
-    enable = mkEnableOption (lib.mdDoc "AusweisApp2");
+    enable = mkEnableOption (lib.mdDoc "AusweisApp");
 
     openFirewall = mkOption {
       description = lib.mdDoc ''
-        Whether to open the required firewall ports for the Smartphone as Card Reader (SaC) functionality of AusweisApp2.
+        Whether to open the required firewall ports for the Smartphone as Card Reader (SaC) functionality of AusweisApp.
       '';
       default = false;
       type = lib.types.bool;
@@ -19,7 +19,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [ AusweisApp2 ];
+    environment.systemPackages = with pkgs; [ ausweisapp ];
     networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 24727 ];
   };
 }
diff --git a/pkgs/README.md b/pkgs/README.md
index 642833d968f3..7f9b2fb22073 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -696,16 +696,16 @@ It can happen that non-trivial updates include patches or more complex changes.
 
 Reviewing process:
 
-- Ensure that the package versioning fits the guidelines.
-- Ensure that the commit text fits the guidelines.
+- Ensure that the package versioning [fits the guidelines](#versioning).
+- Ensure that the commit text [fits the guidelines](../CONTRIBUTING.md#commit-conventions).
 - Ensure that the package maintainers are notified.
   - [CODEOWNERS](https://help.github.com/articles/about-codeowners) will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
-- Ensure that the meta field information is correct.
+- Ensure that the meta field information [fits the guidelines](#meta-attributes) and is correct:
   - License can change with version updates, so it should be checked to match the upstream license.
   - If the package has no maintainer, a maintainer must be set. This can be the update submitter or a community member that accepts to take maintainership of the package.
 - Ensure that the code contains no typos.
-- Building the package locally.
-  - pull requests are often targeted to the master or staging branch, and building the pull request locally when it is submitted can trigger many source builds.
+- Build the package locally.
+  - Pull requests are often targeted to the master or staging branch, and building the pull request locally when it is submitted can trigger many source builds.
   - It is possible to rebase the changes on nixos-unstable or nixpkgs-unstable for easier review by running the following commands from a nixpkgs clone.
 
     ```ShellSession
@@ -722,7 +722,7 @@ Reviewing process:
     ```ShellSession
     $ nix-shell -p nixpkgs-review --run "nixpkgs-review pr PRNUMBER"
     ```
-- Running every binary.
+- Run every binary.
 
 Sample template for a package update review is provided below.
 
@@ -731,7 +731,7 @@ Sample template for a package update review is provided below.
 
 - [ ] package name fits guidelines
 - [ ] package version fits guidelines
-- [ ] package build on ARCHITECTURE
+- [ ] package builds on ARCHITECTURE
 - [ ] executables tested on ARCHITECTURE
 - [ ] all depending packages build
 - [ ] patches have a comment describing either the upstream URL or a reason why the patch wasn't upstreamed
@@ -748,18 +748,20 @@ New packages are a common type of pull requests. These pull requests consists in
 
 Review process:
 
-- Ensure that the package versioning fits the guidelines.
-- Ensure that the commit name fits the guidelines.
-- Ensure that the meta fields contain correct information.
+- Ensure that all file paths [fit the guidelines](../CONTRIBUTING.md#file-naming-and-organisation).
+- Ensure that the package name and version [fits the guidelines](#package-naming).
+- Ensure that the package versioning [fits the guidelines](#versioning).
+- Ensure that the commit text [fits the guidelines](../CONTRIBUTING.md#commit-conventions).
+- Ensure that the meta fields [fits the guidelines](#meta-attributes) and contain the correct information:
   - License must match the upstream license.
   - Platforms should be set (or the package will not get binary substitutes).
   - Maintainers must be set. This can be the package submitter or a community member that accepts taking up maintainership of the package.
 - Report detected typos.
 - Ensure the package source:
-  - Uses mirror URLs when available.
+  - Uses `mirror://` URLs when available.
   - Uses the most appropriate functions (e.g. packages from GitHub should use `fetchFromGitHub`).
-- Building the package locally.
-- Running every binary.
+- Build the package locally.
+- Run every binary.
 
 Sample template for a new package review is provided below.
 
@@ -769,7 +771,7 @@ Sample template for a new package review is provided below.
 - [ ] package path fits guidelines
 - [ ] package name fits guidelines
 - [ ] package version fits guidelines
-- [ ] package build on ARCHITECTURE
+- [ ] package builds on ARCHITECTURE
 - [ ] executables tested on ARCHITECTURE
 - [ ] `meta.description` is set and fits guidelines
 - [ ] `meta.license` fits upstream license
diff --git a/pkgs/applications/misc/ausweisapp/default.nix b/pkgs/applications/misc/ausweisapp/default.nix
new file mode 100644
index 000000000000..ab7089e5199f
--- /dev/null
+++ b/pkgs/applications/misc/ausweisapp/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  testers,
+  cmake,
+  pkg-config,
+  wrapQtAppsHook,
+  pcsclite,
+  qtscxml,
+  qtsvg,
+  qttools,
+  qtwayland,
+  qtwebsockets,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ausweisapp";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "Governikus";
+    repo = "AusweisApp2";
+    rev = finalAttrs.version;
+    hash = "sha256-RUjc4KqyKZXBW+CMaRhKsbwVzmWw6/QHNK+RpBd7Gxw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  # The build scripts copy the entire translations directory from Qt
+  # which ends up being read-only because it's in the store.
+  preBuild = ''
+    chmod +w resources/translations
+  '';
+
+  buildInputs = [
+    pcsclite
+    qtscxml
+    qtsvg
+    qttools
+    qtwayland
+    qtwebsockets
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "QT_QPA_PLATFORM=offscreen ${finalAttrs.meta.mainProgram} --version";
+  };
+
+  meta = {
+    description = "Official authentication app for German ID card and residence permit";
+    downloadPage = "https://github.com/Governikus/AusweisApp2/releases";
+    homepage = "https://www.ausweisapp.bund.de/open-source-software";
+    license = lib.licenses.eupl12;
+    mainProgram = "AusweisApp";
+    maintainers = with lib.maintainers; [b4dm4n];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/misc/ausweisapp2/default.nix b/pkgs/applications/misc/ausweisapp2/default.nix
deleted file mode 100644
index 6ef313fa6def..000000000000
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake, pkg-config, pcsclite, qtsvg, qttools, qtwebsockets
-, qtquickcontrols2, qtgraphicaleffects }:
-
-mkDerivation rec {
-  pname = "AusweisApp2";
-  version = "1.26.7";
-
-  src = fetchFromGitHub {
-    owner = "Governikus";
-    repo = "AusweisApp2";
-    rev = version;
-    hash = "sha256-i9hfmMp0pEqtIeKc1mcyINXetzD/33aM0utL8nomVcg=";
-  };
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  # The build scripts copy the entire translations directory from Qt
-  # which ends up being read-only because it's in the store.
-  preBuild = ''
-    chmod +w resources/translations
-  '';
-
-  buildInputs = [ qtsvg qttools qtwebsockets qtquickcontrols2 qtgraphicaleffects pcsclite ];
-
-  meta = with lib; {
-    description = "Authentication software for the German ID card";
-    downloadPage = "https://github.com/Governikus/AusweisApp2/releases";
-    homepage = "https://www.ausweisapp.bund.de/ausweisapp2/";
-    license = licenses.eupl12;
-    maintainers = with maintainers; [ b4dm4n ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index b570c5bb53f0..a18afedaecdc 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.37.0";
-    hash = "sha256-oPW2YHyYsbTvQ+8VQtaubBki7w2wd1tlgVmPL5v5E5s=";
+    version = "6.38.0";
+    hash = "sha256-y2mwO7Qc01vuIeJUcAxYDD97DXOwXCd8wNZmkG4maF0=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.38.0-beta.1";
-    hash = "sha256-DZXqq4AD1arP+o5xbuR8yD5By5VPBtClchScZb2Nb1U=";
+    version = "6.39.0-beta.2";
+    hash = "sha256-1+1wvkMtEovBBs2bS9zUV5kpSxkPy0EqBAU01el8uko=";
   };
 }
diff --git a/pkgs/by-name/bk/bk/package.nix b/pkgs/by-name/bk/bk/package.nix
new file mode 100644
index 000000000000..9741278bb180
--- /dev/null
+++ b/pkgs/by-name/bk/bk/package.nix
@@ -0,0 +1,38 @@
+{ fetchCrate
+, go-md2man
+, installShellFiles
+, lib
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bk";
+  version = "0.6.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-rSMvx/zUZqRRgj48TVVG7RwQT8e70m0kertRJysDY4Y=";
+  };
+
+  cargoHash = "sha256-pE5loMwNMdHL3GODiw3kVVHj374hf3+vIDEYTqvx5WI=";
+
+  nativeBuildInputs = [ go-md2man installShellFiles ];
+
+  postBuild = ''
+    sed -i '$ a # Source and further info' README.md
+    sed -i '$ a https://github.com/aeosynth/bk' README.md
+    go-md2man -in README.md -out bk.1
+  '';
+
+  postInstall = ''
+    installManPage bk.?
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/aeosynth/bk";
+    description = "A terminal epub reader written in rust";
+    license = licenses.mit;
+    maintainers = with maintainers; [ vuimuich ];
+    mainProgram = "bk";
+  };
+}
diff --git a/pkgs/development/python-modules/experiment-utilities/default.nix b/pkgs/development/python-modules/experiment-utilities/default.nix
index a5201ed5e009..a236a2405918 100644
--- a/pkgs/development/python-modules/experiment-utilities/default.nix
+++ b/pkgs/development/python-modules/experiment-utilities/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "experiment-utilities";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitLab {
     owner = "creinke";
     repo = "exputils";
     domain = "gitlab.inria.fr";
     rev = "refs/tags/version_${version}";
-    hash = "sha256-y+I/TpEC1alP3145ByM6H//lZl2FrpLT/70lzn04P6w=";
+    hash = "sha256-jo0CBSpUc/F1lJ2vagocngDM1Lopw5/AJnt1QwCunA8=";
   };
 
   # This dependency constraint (<=7.6.5) was due to a bug in qgrid that has been patched in its
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 23301bec0aa5..0c1acad2e8e9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -55,6 +55,7 @@ mapAliases ({
 
   ### A ###
 
+  AusweisApp2 = ausweisapp; # Added 2023-11-08
   a4term = a4; # Added 2023-10-06
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 939161ca0e54..4ec31298a6a7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30550,7 +30550,7 @@ with pkgs;
 
   autopanosiftc = callPackage ../applications/graphics/autopanosiftc { };
 
-  AusweisApp2 = libsForQt5.callPackage ../applications/misc/ausweisapp2 { };
+  ausweisapp = qt6Packages.callPackage ../applications/misc/ausweisapp { };
 
   avidemux = libsForQt5.callPackage ../applications/video/avidemux { };