Merge remote-tracking branch 'upstream/master'

nix/set-git-rev.nix

@@ -1,11 +1,19 @@
 { pkgs }:
 drv:
-pkgs.buildPackages.runCommand drv.name
+with pkgs;
+buildPackages.runCommand drv.name
 {
   inherit (drv) exeName exePath meta passthru;
-} ''
+  # this is to ensure we are re-signing macOS binaries that might have been
+  # mutilated by set-git-rev (e.g. patching in the git revision.)
+  nativeBuildInputs = lib.optionals hostPlatform.isDarwin [ darwin.signingUtils ];
+} (''
   mkdir -p $out
   cp --no-preserve=timestamps --recursive ${drv}/* $out/
   chmod -R +w $out/bin
-  ${pkgs.pkgsBuildBuild.haskellBuildUtils}/bin/set-git-rev "${pkgs.gitrev}" $out/bin/*
-''
+  ${pkgsBuildBuild.haskellBuildUtils}/bin/set-git-rev "${gitrev}" $out/bin/*
+'' + lib.optionalString hostPlatform.isDarwin ''
+  for exe in $out/bin/*; do
+    signIfRequired "$exe"
+  done
+'')

scripts/generate-release-changelog-links.hs

@@ -1,4 +1,4 @@
-#!/usr/bin/env cabal
+#!/usr/bin/env -S cabal run --verbose=1 --index-state=2023-10-04T00:00:00Z
 {- cabal:
   build-depends:
     base,
@@ -9,7 +9,8 @@
     containers,
     foldl,
     github ^>= 0.28,
-    optparse-applicative,
+    optparse-applicative ^>= 0.18,
+    ansi-wl-pprint >= 1,
     pandoc ^>= 3.1,
     prettyprinter,
     req,