NixOS · bendlas · Aug 23, 2025
diff --git a/lib/default.nix b/lib/default.nix
@@ -287,6 +287,7 @@ let
         init
         crossLists
         unique
+        uniqueStrings
         allUnique
         intersectLists
         subtractLists

diff --git a/lib/lists.nix b/lib/lists.nix
@@ -11,7 +11,7 @@ let
     warn
     pipe
     ;
-  inherit (lib.attrsets) mapAttrs;
+  inherit (lib.attrsets) mapAttrs attrNames;
   inherit (lib) max;
 in
 rec {
@@ -1839,6 +1839,10 @@ rec {
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
 
+    :::{.note}
+    If the list only contains strings and order is not important, the complexity can be reduced to O(n log n) by using [`lib.lists.uniqueStrings`](#function-library-lib.lists.uniqueStrings) instead.
+    :::
+
     # Inputs
 
     `list`
@@ -1864,6 +1868,43 @@ rec {
   */
   unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
+  /**
+    Removes duplicate strings from the `list`. O(n log n) complexity.
+
+    :::{.note}
+    Order is not preserved.
+
+    All elements of the list must be strings without context.
+
+    This function fails when the list contains a non-string element or a [string with context](https://nix.dev/manual/nix/latest/language/string-context.html).
+    In that case use [`lib.lists.unique`](#function-library-lib.lists.unique) instead.
+    :::
+
+    # Inputs
+
+    `list`
+
+    : List of strings
+
+    # Type
+
+    ```
+    uniqueStrings :: [ String ] -> [ String ]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.uniqueStrings` usage example
+
+    ```nix
+    uniqueStrings [ "foo" "bar" "foo" ]
+    => [ "bar" "foo" ] # order is not preserved
+    ```
+
+    :::
+  */
+  uniqueStrings = list: attrNames (groupBy id list);
+
   /**
     Check if list contains only unique elements. O(n^2) complexity.
 

diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
@@ -113,6 +113,7 @@ let
     toIntBase10
     toShellVars
     types
+    uniqueStrings
     updateManyAttrsByPath
     versions
     xor
@@ -1940,6 +1941,69 @@ runTests {
     expected = false;
   };
 
+  testUniqueStrings_empty = {
+    expr = uniqueStrings [ ];
+    expected = [ ];
+  };
+  testUniqueStrings_singles = {
+    expr = uniqueStrings [
+      "all"
+      "unique"
+      "already"
+    ];
+    expected = [
+      "all"
+      "already"
+      "unique"
+    ];
+  };
+  testUniqueStrings_allDuplicates = {
+    expr = uniqueStrings [
+      "dup"
+      "dup"
+      "dup"
+    ];
+    expected = [ "dup" ];
+  };
+  testUniqueStrings_some_duplicates = {
+    expr = uniqueStrings [
+      "foo"
+      "foo"
+      "bar"
+      "bar"
+      "baz"
+    ];
+    expected = [
+      "bar"
+      "baz"
+      "foo"
+    ];
+  };
+  testUniqueStrings_unicode = {
+    expr = uniqueStrings [
+      "café"
+      "@"
+      "#"
+      "@"
+      "#"
+      "$"
+      "😎"
+      "😎"
+      "🙃"
+      ""
+      ""
+    ];
+    expected = [
+      ""
+      "#"
+      "$"
+      "@"
+      "café"
+      "😎"
+      "🙃"
+    ];
+  };
+
   # ATTRSETS
 
   testConcatMapAttrs = {

diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   util-linux,
@@ -21,20 +22,30 @@
   python3,
   withGui,
   withWallet ? true,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
+  builderKeys ? [
+    "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
+    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
+    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
+  ],
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
   version = "28.1.knots20250305";
 
   src = fetchurl {
-    url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz";
+    url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
+    # hash retrieved from signed SHA256SUMS
     hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    gnupg
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -58,11 +69,58 @@ stdenv.mkDerivation rec {
     qttools
   ];
 
+  preUnpack =
+    let
+      majorVersion = lib.versions.major finalAttrs.version;
+
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoinknots";
+        repo = "guix.sigs";
+        rev = "b998306d462f39b6077518521700d7156fec76b8";
+        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]
@@ -90,12 +148,12 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Derivative of Bitcoin Core with a collection of improvements";
     homepage = "https://bitcoinknots.org/";
-    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
+    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md";
     maintainers = with lib.maintainers; [
       prusnak
       mmahut
     ];
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   installShellFiles,
@@ -23,6 +24,16 @@
   withGui,
   withWallet ? true,
   enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
+  builderKeys ? [
+    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
+    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
+    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
+    "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
+    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
+  ],
 }:
 
 let
@@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     installShellFiles
+    gnupg
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
@@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
+  preUnpack =
+    let
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoin-core";
+        repo = "guix.sigs";
+        rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
+        sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   postInstall = ''
     cd ..
     installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash

diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
@@ -28,13 +28,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.11.90";
+  # nixpkgs-update: no auto update
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "mapeditor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gGsozdFEE5c315DF+EsIY9wGv50wwrOBycejTkVwEHA=";
+    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,18 +12,18 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-08-06";
+  version = "0.0.27-unstable-2025-08-14";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "2fc63d4128d2dc2fef0913c7480b4586959ebe4e";
-    hash = "sha256-hHa300Ldszsnp6AuYVJwOFc5FfuRTd3phyM6/qBUIQo=";
+    rev = "be0937a459624ce1170f158f9d8660d0ade47eb4";
+    hash = "sha256-1NzzyWW2Tp91wa+Ujv2cDTv/Cb/HgA6LiDuwxVWdJwU=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-8mBpzndz34RrmhJYezd4hLrJyhVL4S4IHK3plaue1k8=";
+    cargoHash = "sha256-pTWCT2s820mjnfTscFnoSKC37RE7DAPKxP71QuM+JXQ=";
 
     nativeBuildInputs = [
       pkg-config