Merge master into staging-next

nixos/modules/services/backup/syncoid.nix

@@ -5,14 +5,15 @@ with lib;
 let
   cfg = config.services.syncoid;
 
-  # Extract pool names of local datasets (ones that don't contain "@") that
+  # Extract the pool name of a local dataset (any dataset not containing "@")
-  # have the specified type (either "source" or "target")
+  localPoolName = d: optionals (d != null) (
-  getPools = type: unique (map (d: head (builtins.match "([^/]+).*" d)) (
+    let m = builtins.match "([^/@]+)[^@]*" d; in
-    # Filter local datasets
+    optionals (m != null) m);
-    filter (d: !hasInfix "@" d)
+
-    # Get datasets of the specified type
+  # Escape as required by: https://www.freedesktop.org/software/systemd/man/systemd.unit.html
-    (catAttrs type (attrValues cfg.commands))
+  escapeUnitName = name:
-  ));
+    lib.concatMapStrings (s: if lib.isList s then "-" else s)
+    (builtins.split "[^a-zA-Z0-9_.\\-]+" name);
 in {
 
     # Interface
@@ -77,6 +78,14 @@ in {
         '';
       };
 
+      service = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Systemd configuration common to all syncoid services.
+        '';
+      };
+
       commands = mkOption {
         type = types.attrsOf (types.submodule ({ name, ... }: {
           options = {
@@ -99,13 +108,7 @@ in {
               '';
             };
 
-            recursive = mkOption {
+            recursive = mkEnableOption ''the transfer of child datasets'';
-              type = types.bool;
-              default = false;
-              description = ''
-                Whether to also transfer child datasets.
-              '';
-            };
 
             sshKey = mkOption {
               type = types.nullOr types.path;
@@ -145,6 +148,14 @@ in {
               '';
             };
 
+            service = mkOption {
+              type = types.attrs;
+              default = {};
+              description = ''
+                Systemd configuration specific to this syncoid service.
+              '';
+            };
+
             extraArgs = mkOption {
               type = types.listOf types.str;
               default = [];
@@ -170,11 +181,15 @@ in {
     # Implementation
 
     config = mkIf cfg.enable {
-      users =  {
+      users = {
         users = mkIf (cfg.user == "syncoid") {
           syncoid = {
             group = cfg.group;
             isSystemUser = true;
+            # For syncoid to be able to create /var/lib/syncoid/.ssh/
+            # and to use custom ssh_config or known_hosts.
+            home = "/var/lib/syncoid";
+            createHome = false;
           };
         };
         groups = mkIf (cfg.group == "syncoid") {
@@ -182,35 +197,99 @@ in {
         };
       };
 
-      systemd.services.syncoid = {
+      systemd.services = mapAttrs' (name: c:
-        description = "Syncoid ZFS synchronization service";
+        nameValuePair "syncoid-${escapeUnitName name}" (mkMerge [
-        script = concatMapStringsSep "\n" (c: lib.escapeShellArgs
+          { description = "Syncoid ZFS synchronization from ${c.source} to ${c.target}";
-          ([ "${pkgs.sanoid}/bin/syncoid" ]
+            after = [ "zfs.target" ];
-            ++ (optionals c.useCommonArgs cfg.commonArgs)
+            startAt = cfg.interval;
-            ++ (optional c.recursive "-r")
+            # syncoid may need zpool to get feature@extensible_dataset
-            ++ (optionals (c.sshKey != null) [ "--sshkey" c.sshKey ])
+            path = [ "/run/booted-system/sw/bin/" ];
-            ++ c.extraArgs
+            serviceConfig = {
-            ++ [ "--sendoptions" c.sendOptions
+              ExecStartPre =
-                 "--recvoptions" c.recvOptions
+                map (pool: lib.escapeShellArgs [
-                 "--no-privilege-elevation"
+                  "+/run/booted-system/sw/bin/zfs" "allow"
-                 c.source c.target
+                  cfg.user "bookmark,hold,send,snapshot,destroy" pool
-               ])) (attrValues cfg.commands);
+                  # Permissions snapshot and destroy are in case --no-sync-snap is not used
-        after = [ "zfs.target" ];
+                ]) (localPoolName c.source) ++
-        serviceConfig = {
+                map (pool: lib.escapeShellArgs [
-          ExecStartPre = let
+                  "+/run/booted-system/sw/bin/zfs" "allow"
-            allowCmd = permissions: pool: lib.escapeShellArgs [
+                  cfg.user "create,mount,receive,rollback" pool
-              "+/run/booted-system/sw/bin/zfs" "allow"
+                ]) (localPoolName c.target);
-              cfg.user (concatStringsSep "," permissions) pool
+              ExecStart = lib.escapeShellArgs ([ "${pkgs.sanoid}/bin/syncoid" ]
-            ];
+                ++ optionals c.useCommonArgs cfg.commonArgs
-          in
+                ++ optional c.recursive "-r"
-            (map (allowCmd [ "hold" "send" "snapshot" "destroy" ]) (getPools "source")) ++
+                ++ optionals (c.sshKey != null) [ "--sshkey" c.sshKey ]
-            (map (allowCmd [ "create" "mount" "receive" "rollback" ]) (getPools "target"));
+                ++ c.extraArgs
-          User = cfg.user;
+                ++ [ "--sendoptions" c.sendOptions
-          Group = cfg.group;
+                     "--recvoptions" c.recvOptions
-        };
+                     "--no-privilege-elevation"
-        startAt = cfg.interval;
+                     c.source c.target
-      };
+                   ]);
+              User = cfg.user;
+              Group = cfg.group;
+              StateDirectory = [ "syncoid" ];
+              StateDirectoryMode = "700";
+              # Prevent SSH control sockets of different syncoid services from interfering
+              PrivateTmp = true;
+              # Permissive access to /proc because syncoid
+              # calls ps(1) to detect ongoing `zfs receive`.
+              ProcSubset = "all";
+              ProtectProc = "default";
+
+              # The following options are only for optimizing:
+              # systemd-analyze security | grep syncoid-'*'
+              AmbientCapabilities = "";
+              CapabilityBoundingSet = "";
+              DeviceAllow = ["/dev/zfs"];
+              LockPersonality = true;
+              MemoryDenyWriteExecute = true;
+              NoNewPrivileges = true;
+              PrivateDevices = true;
+              PrivateMounts = true;
+              PrivateNetwork = mkDefault false;
+              PrivateUsers = true;
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHome = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectSystem = "strict";
+              RemoveIPC = true;
+              RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+              RestrictNamespaces = true;
+              RestrictRealtime = true;
+              RestrictSUIDSGID = true;
+              RootDirectory = "/run/syncoid/${escapeUnitName name}";
+              RootDirectoryStartOnly = true;
+              BindPaths = [ "/dev/zfs" ];
+              BindReadOnlyPaths = [ builtins.storeDir "/etc" "/run" "/bin/sh" ];
+              # Avoid useless mounting of RootDirectory= in the own RootDirectory= of ExecStart='s mount namespace.
+              InaccessiblePaths = ["-+/run/syncoid/${escapeUnitName name}"];
+              MountAPIVFS = true;
+              # Create RootDirectory= in the host's mount namespace.
+              RuntimeDirectory = [ "syncoid/${escapeUnitName name}" ];
+              RuntimeDirectoryMode = "700";
+              SystemCallFilter = [
+                "@system-service"
+                # Groups in @system-service which do not contain a syscall listed by:
+                # perf stat -x, 2>perf.log -e 'syscalls:sys_enter_*' syncoid …
+                # awk >perf.syscalls -F "," '$1 > 0 {sub("syscalls:sys_enter_","",$3); print $3}' perf.log
+                # systemd-analyze syscall-filter | grep -v -e '#' | sed -e ':loop; /^[^ ]/N; s/\n //; t loop' | grep $(printf ' -e \\<%s\\>' $(cat perf.syscalls)) | cut -f 1 -d ' '
+                "~@aio" "~@chown" "~@keyring" "~@memlock" "~@privileged"
+                "~@resources" "~@setuid" "~@sync" "~@timer"
+              ];
+              SystemCallArchitectures = "native";
+              # This is for BindPaths= and BindReadOnlyPaths=
+              # to allow traversal of directories they create in RootDirectory=.
+              UMask = "0066";
+            };
+          }
+          cfg.service
+          c.service
+        ])) cfg.commands;
     };
 
-    meta.maintainers = with maintainers; [ lopsided98 ];
+    meta.maintainers = with maintainers; [ julm lopsided98 ];
   }

nixos/tests/sanoid.nix

@@ -44,7 +44,7 @@ in {
           # Sync snapshot taken by sanoid
           "pool/sanoid" = {
             target = "root@target:pool/sanoid";
-            extraArgs = [ "--no-sync-snap" ];
+            extraArgs = [ "--no-sync-snap" "--create-bookmark" ];
           };
           # Take snapshot and sync
           "pool/syncoid".target = "root@target:pool/syncoid";
@@ -92,8 +92,9 @@ in {
     # Sync snapshots
     target.wait_for_open_port(22)
     source.succeed("touch /mnt/pool/syncoid/test.txt")
-    source.systemctl("start --wait syncoid.service")
+    source.systemctl("start --wait syncoid-pool-sanoid.service")
     target.succeed("cat /mnt/pool/sanoid/test.txt")
+    source.systemctl("start --wait syncoid-pool-syncoid.service")
     target.succeed("cat /mnt/pool/syncoid/test.txt")
   '';
 })

pkgs/applications/editors/aseprite/skia.nix

@@ -16,7 +16,8 @@ let
   });
 in
 stdenv.mkDerivation {
-  name = "skia-aseprite-m71";
+  pname = "skia";
+  version = "aseprite-m71";
 
   src = fetchFromGitHub {
     owner = "aseprite";
@@ -73,4 +74,12 @@ stdenv.mkDerivation {
       third_party/externals/angle2/include \
       third_party/skcms/**/*.h
   '';
+
+  meta = with lib; {
+    description = "Skia is a complete 2D graphic library for drawing Text, Geometries, and Images";
+    homepage = "https://skia.org/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.all;
+  };
 }

pkgs/applications/graphics/hydrus/default.nix

@@ -1,53 +1,56 @@
 { lib
 , fetchFromGitHub
-, xz
 , wrapQtAppsHook
 , miniupnpc_2
+, ffmpeg
 , enableSwftools ? false
 , swftools
-, pythonPackages
+, python3Packages
 }:
 
-pythonPackages.buildPythonPackage rec {
+python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "441";
+  version = "447";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "13h4qcz0iqba4mwyvgmdqh99jy22x7kw20f3g43b5aq3qyk9ca2h";
+    sha256 = "0a9nrsbw3w1229bm90xayixvkpvr6g338w64x4v75sqxvpbx84lz";
   };
 
   nativeBuildInputs = [
     wrapQtAppsHook
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python3Packages; [
     beautifulsoup4
+    chardet
+    cloudscraper
     html5lib
     lxml
+    lz4
+    nose
     numpy
     opencv4
     pillow
     psutil
+    pylzma
     pyopenssl
+    pyside2
+    pysocks
+    pythonPackages.mpv
     pyyaml
+    qtpy
     requests
     send2trash
     service-identity
+    six
     twisted
-    lz4
-    xz
-    pysocks
-    matplotlib
-    qtpy
-    pyside2
-    mpv
   ];
 
-  checkInputs = with pythonPackages; [ nose httmock ];
+  checkInputs = with python3Packages; [ nose mock httmock ];
 
   # most tests are failing, presumably because we are not using test.py
   checkPhase = ''
@@ -77,37 +80,34 @@ pythonPackages.buildPythonPackage rec {
 
   outputs = [ "out" "doc" ];
 
-  postPatch = ''
-    sed 's;os\.path\.join(\sHC\.BIN_DIR,.*;"${miniupnpc_2}/bin/upnpc";' \
-      -i ./hydrus/core/networking/HydrusNATPunch.py
-  '' + lib.optionalString enableSwftools ''
-    sed 's;os\.path\.join(\sHC\.BIN_DIR,.*;"${swftools}/bin/swfrender";' \
-      -i ./hydrus/core/HydrusFlashHandling.py
-  '';
-
-  #doCheck = true;
-
   installPhase = ''
     # Move the hydrus module and related directories
-    mkdir -p $out/${pythonPackages.python.sitePackages}
+    mkdir -p $out/${python3Packages.python.sitePackages}
-    mv {hydrus,static} $out/${pythonPackages.python.sitePackages}
+    mv {hydrus,static} $out/${python3Packages.python.sitePackages}
     mv help $out/doc/
 
     # install the hydrus binaries
     mkdir -p $out/bin
     install -m0755 server.py $out/bin/hydrus-server
     install -m0755 client.py $out/bin/hydrus-client
+  '' + lib.optionalString enableSwftools ''
+    mkdir -p $out/${python3Packages.python.sitePackages}/bin
+    # swfrender seems to have to be called sfwrender_linux
+    # not sure if it can be loaded through PATH, but this is simpler
+    # $out/python3Packages.python.sitePackages/bin is correct NOT .../hydrus/bin
+    ln -s ${swftools}/bin/swfrender $out/${python3Packages.python.sitePackages}/bin/swfrender_linux
   '';
 
   dontWrapQtApps = true;
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg miniupnpc_2 ]})
   '';
 
   meta = with lib; {
     description = "Danbooru-like image tagging and searching system for the desktop";
     license = licenses.wtfpl;
     homepage = "https://hydrusnetwork.github.io/hydrus/";
-    maintainers = [ maintainers.evanjs ];
+    maintainers = with maintainers; [ dandellion evanjs ];
   };
 }

pkgs/applications/graphics/xournalpp/default.nix

@@ -9,6 +9,7 @@
 , glib
 , gsettings-desktop-schemas
 , gtk3
+, librsvg
 , libsndfile
 , libxml2
 , libzip
@@ -22,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xournalpp";
-  version = "1.0.20";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "xournalpp";
     repo = pname;
     rev = version;
-    sha256 = "1c7n03xm3m4lwcwxgplkn25i8c6s3i7rijbkcx86br1j4jadcs3k";
+    sha256 = "sha256-FIIpWgWvq1uo/lIQXpOkUTZ6YJPtOtxKF8VjXSgqrlE=";
   };
 
   nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
@@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
     [ glib
       gsettings-desktop-schemas
       gtk3
+      librsvg
       libsndfile
       libxml2
       libzip

pkgs/applications/misc/josm/default.nix

@@ -3,20 +3,20 @@
 }:
 let
   pname = "josm";
-  version = "17919";
+  version = "18004";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "sha256-Bj1s3vFSHPiZNTjp7hQhu1X2v8nlynC37Cm6sMNOi3g=";
+      sha256 = "sha256-Cd+/sE6A0MddHeAxy3gx7ev+9UR3ZNcR0tCTmdX2FtY=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java16.zip";
-      sha256 = "sha256-W+s6ARA5lyRwTuRD89wm4HChb2Up5AXQwh5uk0U7pQk=";
+      sha256 = "sha256-QSVh8043K/f7gPEjosGo/DNj1d75LUFwf6EMeHk68fM=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
       rev = version;
-      sha256 = "sha256-IjCFngixh2+7SifrV3Ohi1BjIOP+QSWg/QjeqbbP7aw=";
+      sha256 = "sha256-Ic6RtQPqpQIci1IbKgTcFmLfMdPxSVybrEAk+ttM0j8=";
     };
   };
 in

pkgs/applications/misc/snixembed/default.nix

@@ -0,0 +1,28 @@
+{ fetchFromSourcehut, gtk3, lib, libdbusmenu-gtk3, pkg-config, stdenv, vala }:
+
+stdenv.mkDerivation rec {
+  pname = "snixembed";
+  version = "0.3.1";
+
+  src = fetchFromSourcehut {
+    owner = "~steef";
+    repo = pname;
+    rev = version;
+    sha256 = "0yy1i4463q43aq98qk4nvvzpw4i6bid2bywwgf6iq545pr3glfj5";
+  };
+
+  nativeBuildInputs = [ pkg-config vala ];
+
+  buildInputs = [ gtk3 libdbusmenu-gtk3 ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "Proxy StatusNotifierItems as XEmbedded systemtray-spec icons";
+    homepage = "https://git.sr.ht/~steef/snixembed";
+    changelog = "https://git.sr.ht/~steef/snixembed/refs/${version}";
+    license = licenses.isc;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/applications/networking/cluster/linkerd/default.nix

@@ -64,8 +64,8 @@ in
     };
     edge = generic {
       channel = "edge";
-      version = "21.7.3";
+      version = "21.7.4";
-      sha256 = "sha256-fEkqZ/4BQVnmOKUrrLmi6DKlMVNeqvW95bxbZX0o7iI=";
+      sha256 = "sha256-yorxP4SQVV6MWlx8+8l0f7qOaF7aJ1XiPfnMqKC8m/o=";
-      vendorSha256 = "sha256-NqOmmeEGWvy/LYfSpIdnJZX4lGweCgiL008ed05XIFs=";
+      vendorSha256 = "sha256-2ZDsBiIV9ng8P0cDURbqDqMTxFKUFcBxHsPGWp5WjPo=";
     };
   }

pkgs/applications/networking/cluster/temporal/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "temporal";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     rev = "v${version}";
-    sha256 = "sha256-upoWftm82QBdax0lbeu+Nmwscsj/fsOzGUPI+fzcKUM=";
+    sha256 = "sha256-DskJtZGp8zmSWC5GJijNbhwKQF0Y0FXXh7wCzlbAgy8=";
   };
 
-  vendorSha256 = "sha256-eO/23MQpdXQNPCIzMC9nxvrgUFuEPABJ7vkBZKv+XZI";
+  vendorSha256 = "sha256-eO/23MQpdXQNPCIzMC9nxvrgUFuEPABJ7vkBZKv+XZI=";
 
   # Errors:
   #  > === RUN   TestNamespaceHandlerGlobalNamespaceDisabledSuite

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -375,19 +375,19 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "repo": "terraform-provider-google",
-    "rev": "v3.62.0",
+    "rev": "v3.76.0",
-    "sha256": "0x0qp8nk88667hvlpgxrdjsgirw8iwv85gn3k9xb37a3lw7xs4qz",
+    "sha256": "1j3q07v4r0a3mlkmpqw8nav5z09fwyms9xmlyk6k6xkkzr520xcp",
-    "vendorSha256": "0w6aavj1c4blpvsy00vz4dcj8rnxx6a586b16lqp6s1flqmlqrbi",
+    "vendorSha256": "1ffxfracj4545fzh6p6b0wal0j07807qc2q83qzchbalqvi7yhky",
-    "version": "3.62.0"
+    "version": "3.76.0"
   },
   "google-beta": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "repo": "terraform-provider-google-beta",
-    "rev": "v3.47.0",
+    "rev": "v3.76.0",
-    "sha256": "1nk0bg2q7dg65rn3j5pkdjv07x0gs7bkv1bpfvlhi9p4fzx9g4by",
+    "sha256": "1bdhk4vfn8pn7ql5q8m4r8js8d73zyp3dbhrmh4p07g7i5z57pjq",
-    "vendorSha256": "0c2q4d2khsi3v9b659q1kmncnlshv4px6ch99jpcymwqg3xrxda2",
+    "vendorSha256": "0cwvkzw45b057gwbj24z9gyldjpyfgv3fyr5x160spj0ksfn0ki0",
-    "version": "3.47.0"
+    "version": "3.76.0"
   },
   "grafana": {
     "owner": "grafana",

pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix

@@ -0,0 +1,33 @@
+{ autoreconfHook
+, fetchFromGitHub
+, glib
+, intltool
+, lib
+, libappindicator-gtk2
+, libtool
+, pidgin
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pidgin-indicator";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "philipl";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-CdA/aUu+CmCRbVBKpJGydicqFQa/rEsLWS3MBKlH2/M=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ glib intltool libappindicator-gtk2 libtool pidgin ];
+
+  meta = with lib; {
+    description = "An AppIndicator and KStatusNotifierItem Plugin for Pidgin";
+    homepage = "https://github.com/philipl/pidgin-indicator";
+    maintainers = with maintainers; [ imalison ];
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+  };
+}

pkgs/applications/science/biology/bedops/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bedops";
-  version = "2.4.39";
+  version = "2.4.40";
 
   src = fetchFromGitHub {
     owner = "bedops";
     repo = "bedops";
     rev = "v${version}";
-    sha256 = "sha256-vPrut3uhZK1Eg9vPcyxVNWW4zKeypdsb28oM1xbbpJo=";
+    sha256 = "sha256-rJVl3KbzGblyQZ7FtJXeEv/wjQJmzYGNjzhvkoMoBWY=";
   };
 
   buildInputs = [ zlib bzip2 jansson ];

pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "118w0fyy6pck8hyj925ym6ak0xxqhkaq2vharnpl9b97nab4mqg8";
+    sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
   propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];

pkgs/applications/window-managers/hikari/default.nix

@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchzip, fetchpatch,
+{ lib, stdenv, fetchzip
-  pkg-config, bmake,
+, pkg-config, bmake
-  cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman,
+, cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman
-  libucl, wayland, wayland-protocols, wlroots, mesa,
+, libucl, wayland, wayland-protocols, wlroots, mesa
-  features ? {
+, features ? {
     gammacontrol = true;
     layershell   = true;
     screencopy   = true;
@@ -10,17 +10,13 @@
   }
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "hikari";
-  version = "2.3.1";
+  version = "2.3.2";
-in
-
-stdenv.mkDerivation {
-  inherit pname version;
 
   src = fetchzip {
     url = "https://hikari.acmelabs.space/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-o6YsUATcWHSuAEfU7WnwxKNxRNuBt069qCv0FKDWStg=";
+    sha256 = "sha256-At4b6mkArKe6knNWouLdZ9v8XhfHaUW+aB+CHyEBg8o=";
   };
 
   nativeBuildInputs = [ pkg-config bmake ];

pkgs/data/fonts/noto-fonts/default.nix

@@ -110,7 +110,7 @@ in
   };
 
   noto-fonts-emoji = let
-    version = "2020-09-16-unicode13_1";
+    version = "2.028";
     emojiPythonEnv =
       python3.withPackages (p: with p; [ fonttools nototools ]);
   in stdenv.mkDerivation {
@@ -121,7 +121,7 @@ in
       owner = "googlefonts";
       repo = "noto-emoji";
       rev = "v${version}";
-      sha256 = "0659336dp0l2nkac153jpcb9yvp0p3dx1crcyxjd14i8cqkfi2hh";
+      sha256 = "0dy7px7wfl6bqkfzz82jm4gvbjp338ddsx0mwfl6m7z48l7ng4v6";
     };
 
     nativeBuildInputs = [

pkgs/development/libraries/drogon/default.nix

@@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, openssl, lib
+{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, lib
-# miscellaneous
+# optional but of negligible size
-, brotli, c-ares
+, openssl, brotli, c-ares
-# databases
+# optional databases
 , sqliteSupport ? true, sqlite
 , postgresSupport ? false, postgresql
 , redisSupport ? false, hiredis
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   version = "1.7.1";
 
   src = fetchFromGitHub {
-    owner = "an-tao";
+    owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
     sha256 = "0rhwbz3m5x3vy5zllfs8r347wqprg29pff5q7i53f25bh8y0n49i";
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional sqliteSupport sqlite
     ++ lib.optional postgresSupport postgresql
     ++ lib.optional redisSupport hiredis
-    # drogon uses mariadb for mysql (see https://github.com/an-tao/drogon/wiki/ENG-02-Installation#Library-Dependencies)
+    # drogon uses mariadb for mysql (see https://github.com/drogonframework/drogon/wiki/ENG-02-Installation#Library-Dependencies)
     ++ lib.optional mysqlSupport [ libmysqlclient mariadb ];
 
   patches = [
@@ -48,17 +48,16 @@ stdenv.mkDerivation rec {
   # modifying PATH here makes drogon_ctl visible to the test
   installCheckPhase = ''
     cd ..
-    patchShebangs test.sh
+    PATH=$PATH:$out/bin bash test.sh
-    PATH=$PATH:$out/bin ./test.sh
   '';
 
   doInstallCheck = true;
 
   meta = with lib; {
-    homepage = "https://github.com/an-tao/drogon";
+    homepage = "https://github.com/drogonframework/drogon";
     description = "C++14/17 based HTTP web application framework";
     license = licenses.mit;
-    maintainers = [ maintainers.urlordjames ];
+    maintainers = with maintainers; [ urlordjames ];
     platforms = platforms.all;
   };
 }

pkgs/development/libraries/ffmpeg-full/default.nix

@@ -74,6 +74,7 @@
 , libcaca ? null # Textual display (ASCII art)
 #, libcdio-paranoia ? null # Audio CD grabbing
 , libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
+, libdrm ? null # libdrm support
 , libiconv ? null
 #, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
 , libmfx ? null # Hardware acceleration vis libmfx
@@ -348,6 +349,7 @@ stdenv.mkDerivation rec {
     #(enableFeature (libcaca != null) "libcaca")
     #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
     (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
+    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
     (enableFeature (libiconv != null) "iconv")
     (enableFeature (libjack2 != null) "libjack")
     #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
@@ -432,6 +434,7 @@ stdenv.mkDerivation rec {
   ] ++ optionals openglExtlib [ libGL libGLU ]
     ++ optionals nonfreeLicensing [ fdk_aac openssl ]
     ++ optional ((isLinux || isFreeBSD) && libva != null) libva
+    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
     ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
     ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
     ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx

pkgs/development/libraries/gstreamer/default.nix

@@ -1,29 +1,27 @@
 { callPackage, AudioToolbox, AVFoundation, Cocoa, CoreFoundation, CoreMedia, CoreServices, CoreVideo, DiskArbitration, Foundation, IOKit, MediaToolbox, OpenGL, VideoToolbox }:
 
-rec {
+{
   gstreamer = callPackage ./core { inherit CoreServices; };
 
   gstreamermm = callPackage ./gstreamermm { };
 
-  gst-plugins-base = callPackage ./base { inherit gstreamer Cocoa OpenGL; };
+  gst-plugins-base = callPackage ./base { inherit Cocoa OpenGL; };
 
-  gst-plugins-good = callPackage ./good { inherit gst-plugins-base Cocoa; };
+  gst-plugins-good = callPackage ./good { inherit Cocoa; };
 
-  gst-plugins-bad = callPackage ./bad { inherit gst-plugins-base AudioToolbox AVFoundation CoreMedia CoreVideo Foundation MediaToolbox VideoToolbox; };
+  gst-plugins-bad = callPackage ./bad { inherit AudioToolbox AVFoundation CoreMedia CoreVideo Foundation MediaToolbox VideoToolbox; };
 
-  gst-plugins-ugly = callPackage ./ugly { inherit gst-plugins-base CoreFoundation DiskArbitration IOKit; };
+  gst-plugins-ugly = callPackage ./ugly { inherit CoreFoundation DiskArbitration IOKit; };
 
-  gst-rtsp-server = callPackage ./rtsp-server { inherit gst-plugins-base gst-plugins-bad; };
+  gst-rtsp-server = callPackage ./rtsp-server { };
 
-  gst-libav = callPackage ./libav { inherit gst-plugins-base; };
+  gst-libav = callPackage ./libav { };
 
-  gst-devtools = callPackage ./devtools { inherit gstreamer gst-plugins-base; };
+  gst-devtools = callPackage ./devtools { };
 
-  gst-editing-services = callPackage ./ges { inherit gst-plugins-base gst-plugins-bad gst-devtools; };
+  gst-editing-services = callPackage ./ges { };
 
-  gst-vaapi = callPackage ./vaapi {
+  gst-vaapi = callPackage ./vaapi { };
-    inherit gst-plugins-base gstreamer gst-plugins-bad;
-  };
 
   # note: gst-python is in ./python/default.nix - called under pythonPackages
 }

pkgs/development/libraries/hamlib/4.nix

@@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, fetchurl
+, perl
+, swig
+, gd
+, ncurses
+, python3
+, libxml2
+, tcl
+, libusb-compat-0_1
+, pkg-config
+, boost
+, libtool
+, perlPackages
+, pythonBindings ? true
+, tclBindings ? true
+, perlBindings ? true
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hamlib";
+  version = "4.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "1m8gb20i8ga6ndnnw187ry1h4z8wx27v1hl7c610r6ky60pv4072";
+  };
+
+  nativeBuildInputs = [
+    swig
+    pkg-config
+    libtool
+  ];
+
+  buildInputs = [
+    gd
+    libxml2
+    libusb-compat-0_1
+    boost
+  ] ++ lib.optionals pythonBindings [ python3 ncurses ]
+    ++ lib.optionals tclBindings [ tcl ]
+    ++ lib.optionals perlBindings [ perl perlPackages.ExtUtilsMakeMaker ];
+
+  configureFlags = lib.optionals perlBindings [ "--with-perl-binding" ]
+    ++ lib.optionals tclBindings [ "--with-tcl-binding" "--with-tcl=${tcl}/lib/" ]
+    ++ lib.optionals pythonBindings [ "--with-python-binding" ];
+
+  meta = with lib; {
+    description = "Runtime library to control radio transceivers and receivers";
+    longDescription = ''
+    Hamlib provides a standardized programming interface that applications
+    can use to send the appropriate commands to a radio.
+
+    Also included in the package is a simple radio control program 'rigctl',
+    which lets one control a radio transceiver or receiver, either from
+    command line interface or in a text-oriented interactive interface.
+    '';
+    license = with licenses; [ gpl2Plus lgpl2Plus ];
+    homepage = "http://hamlib.sourceforge.net";
+    maintainers = with maintainers; [ relrod ];
+    platforms = with platforms; unix;
+  };
+}

pkgs/development/libraries/hamlib/default.nix

@@ -1,5 +1,22 @@
-{lib, stdenv, fetchurl, perl, python2, swig, gd, libxml2, tcl, libusb-compat-0_1, pkg-config,
+{ lib
- boost, libtool, perlPackages }:
+, stdenv
+, fetchurl
+, perl
+, swig
+, gd
+, ncurses
+, python3
+, libxml2
+, tcl
+, libusb-compat-0_1
+, pkg-config
+, boost
+, libtool
+, perlPackages
+, pythonBindings ? true
+, tclBindings ? true
+, perlBindings ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "hamlib";
@@ -10,13 +27,26 @@ stdenv.mkDerivation rec {
     sha256 = "10788mgrhbc57zpzakcxv5aqnr2819pcshml6fbh8zvnkja562y9";
   };
 
-  buildInputs = [ perl perlPackages.ExtUtilsMakeMaker python2 swig gd libxml2
+  nativeBuildInputs = [
-                  tcl libusb-compat-0_1 pkg-config boost libtool ];
+    swig
+    pkg-config
+    libtool
+  ];
 
-  configureFlags = [ "--with-perl-binding" "--with-python-binding"
+  buildInputs = [
-                     "--with-tcl-binding" "--with-rigmatrix" ];
+    gd
+    libxml2
+    libusb-compat-0_1
+    boost
+  ] ++ lib.optionals pythonBindings [ python3 ncurses ]
+    ++ lib.optionals tclBindings [ tcl ]
+    ++ lib.optionals perlBindings [ perl perlPackages.ExtUtilsMakeMaker ];
 
-  meta = {
+  configureFlags = lib.optionals perlBindings [ "--with-perl-binding" ]
+    ++ lib.optionals tclBindings [ "--with-tcl-binding" "--with-tcl=${tcl}/lib/" ]
+    ++ lib.optionals pythonBindings [ "--with-python-binding" ];
+
+  meta = with lib; {
     description = "Runtime library to control radio transceivers and receivers";
     longDescription = ''
     Hamlib provides a standardized programming interface that applications
@@ -26,9 +56,9 @@ stdenv.mkDerivation rec {
     which lets one control a radio transceiver or receiver, either from
     command line interface or in a text-oriented interactive interface.
     '';
-    license = with lib.licenses; [ gpl2Plus lgpl2Plus ];
+    license = with licenses; [ gpl2Plus lgpl2Plus ];
     homepage = "http://hamlib.sourceforge.net";
-    maintainers = with lib.maintainers; [ relrod ];
+    maintainers = with maintainers; [ relrod ];
-    platforms = with lib.platforms; unix;
+    platforms = with platforms; unix;
   };
 }

pkgs/development/libraries/librsync/0.9.nix

@@ -1,26 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "librsync-0.9.7";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/librsync/librsync-0.9.7.tar.gz";
-    sha256 = "1mj1pj99mgf1a59q9f2mxjli2fzxpnf55233pc1klxk2arhf8cv6";
-  };
-
-  hardeningDisable = [ "format" ];
-
-  configureFlags = [
-    (lib.enableFeature stdenv.isCygwin    "static")
-    (lib.enableFeature (!stdenv.isCygwin) "shared")
-  ];
-
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  meta = {
-    homepage = "http://librsync.sourceforge.net/";
-    license = lib.licenses.lgpl2Plus;
-    description = "Implementation of the rsync remote-delta algorithm";
-    platforms = lib.platforms.unix;
-  };
-}

pkgs/development/libraries/libxlsxwriter/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.0.9";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "sha256-6MMQr0ynMmfZj+RFoKtLB/f1nTBfn9tcYpzyUwnfB3M=";
+    sha256 = "1bi8a1pj18836yfqsnmfp45nqhq2d9r2r7gzi2v1y0qyk9jh6xln";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/GitPython/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "GitPython";
-  version = "3.1.18";
+  version = "3.1.19";
-  disabled = isPy27; # no longer supported
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b838a895977b45ab6f0cc926a9045c8d1c44e2b653c1fcc39fe91f42c6e8f05b";
+    sha256 = "0lqf5plm02aw9zl73kffk7aa4mp4girm3f2yfk27nmmmjsdh7x0q";
   };
 
   patches = [
@@ -30,12 +30,13 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     gitdb
     ddt
-  ] ++ lib.optionals (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
   ];
 
   # Tests require a git repo
   doCheck = false;
+
   pythonImportsCheck = [ "git" ];
 
   meta = with lib; {

pkgs/development/python-modules/apache-airflow/default.nix

@@ -3,7 +3,6 @@
 , python
 , buildPythonPackage
 , fetchFromGitHub
-, writeText
 , alembic
 , argcomplete
 , attrs

pkgs/development/python-modules/boost-histogram/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "boost-histogram";
-  version = "1.0.2";
+  version = "1.1.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     pname = "boost_histogram";
     inherit version;
-    sha256 = "b79cb9a00c5b8e44ff24ffcbec0ce5d3048dd1570c8592066344b6d2f2369fa2";
+    sha256 = "370e8e44a0bac4ebbedb7e62570be3a75a7a3807a297d6e82a94301b4681fc22";
   };
 
   buildInputs = [ boost ];

pkgs/development/python-modules/channels/default.nix

@@ -1,23 +1,43 @@
-{ lib, buildPythonPackage, fetchPypi,
+{ lib
-  asgiref, django, daphne
+, buildPythonPackage
+, fetchFromGitHub
+, asgiref
+, django
+, daphne
+, pytest-asyncio
+, pytest-django
+, pytestCheckHook
 }:
+
 buildPythonPackage rec {
   pname = "channels";
-  version = "3.0.3";
+  version = "3.0.4";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "django";
-    sha256 = "056b72e51080a517a0f33a0a30003e03833b551d75394d6636c885d4edb8188f";
+    repo = pname;
+    rev = version;
+    sha256 = "0jdylcb77n04rqyzg9v6qfzaxp1dnvdvnxddwh3x1qazw3csi5y2";
   };
 
-  # Files are missing in the distribution
+  propagatedBuildInputs = [
-  doCheck = false;
+    asgiref
+    django
+    daphne
+  ];
 
-  propagatedBuildInputs = [ asgiref django daphne ];
+  checkInputs = [
+    pytest-asyncio
+    pytest-django
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "channels" ];
 
   meta = with lib; {
     description = "Brings event-driven capabilities to Django with a channel system";
     license = licenses.bsd3;
     homepage = "https://github.com/django/channels";
+    maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/debugpy/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , substituteAll
 , gdb
 , flask
@@ -18,13 +17,13 @@
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YGzc9mMIzPTmUgIXuZROLdYKjUm69x9SR+JtYRVpn24=";
+    hash = "sha256-W51Y9tZB1Uyp175+hWCpXChwL+MBpDWjudF87F1MRso=";
   };
 
   patches = [
@@ -49,12 +48,6 @@ buildPythonPackage rec {
     # To avoid this issue, debugpy should be installed using python.withPackages:
     # python.withPackages (ps: with ps; [ debugpy ])
     ./fix-test-pythonpath.patch
-
-    # Fix tests with flask>=2.0
-    (fetchpatch {
-      url = "https://github.com/microsoft/debugpy/commit/0a7f2cd67dda27ea4d38389b49a4e2a1899b834e.patch";
-      sha256 = "1g070fn07n7jj01jaf5s570zn70akf6klkamigs3ix11gh736rpn";
-    })
   ];
 
   # Remove pre-compiled "attach" libraries and recompile for host platform

pkgs/development/python-modules/debugpy/hardcode-gdb.patch

@@ -1,8 +1,8 @@
 diff --git a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
-index 6d031b4..ecf21f2 100644
+index 51017f2..46654ab 100644
 --- a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
 +++ b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
-@@ -293,7 +293,7 @@ def run_python_code_linux(pid, python_code, connect_debugger_tracing=False, show
+@@ -398,7 +398,7 @@ def run_python_code_linux(pid, python_code, connect_debugger_tracing=False, show
      is_debug = 0
      # Note that the space in the beginning of each line in the multi-line is important!
      cmd = [

pkgs/development/python-modules/flower/default.nix

@@ -7,22 +7,22 @@
 , pytz
 , tornado
 , prometheus_client
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "flower";
-  version = "0.9.7";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf27a254268bb06fd4972408d0518237fcd847f7da4b4cd8055e228150ace8f3";
+    sha256 = "1gcczr04g7wx99h7pxxx1p9n50sbyi0zxrzy7f7m0sf5apxw85rf";
   };
 
   postPatch = ''
     # rely on using example programs (flowers/examples/tasks.py) which
     # are not part of the distribution
     rm tests/load.py
-    substituteInPlace  requirements/default.txt --replace "prometheus_client==0.8.0" "prometheus_client>=0.8.0"
   '';
 
   propagatedBuildInputs = [
@@ -33,7 +33,10 @@ buildPythonPackage rec {
     prometheus_client
   ];
 
-  checkInputs = [ mock ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "flower" ];
 
@@ -41,7 +44,6 @@ buildPythonPackage rec {
     description = "Celery Flower";
     homepage = "https://github.com/mher/flower";
     license = licenses.bsdOriginal;
-    maintainers = [ maintainers.arnoldfarkas ];
+    maintainers = with maintainers; [ arnoldfarkas ];
-    broken = (celery.version >= "5.0.2"); # currently broken with celery>=5.0 by https://github.com/mher/flower/pull/1021
   };
 }

pkgs/development/python-modules/frilouz/default.nix

@@ -0,0 +1,38 @@
+{ lib
+, astunparse
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "frilouz";
+  version = "0.0.2";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "QuantStack";
+    repo = "frilouz";
+    rev = version;
+    sha256 = "0w2qzi4zb10r9iw64151ay01vf0yzyhh0bsjkx1apxp8fs15cdiw";
+  };
+
+  checkInputs = [ astunparse ];
+
+  preCheck = "cd test";
+
+  checkPhase = ''
+    runHook preCheck
+    python -m unittest
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "frilouz" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/QuantStack/frilouz";
+    description = "Python AST parser adapter with partial error recovery";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}

pkgs/development/python-modules/hap-python/default.nix

@@ -4,7 +4,6 @@
 , cryptography
 , curve25519-donna
 , ecdsa
-, ed25519
 , fetchFromGitHub
 , h11
 , pyqrcode
@@ -17,15 +16,14 @@
 
 buildPythonPackage rec {
   pname = "hap-python";
-  version = "3.5.1";
+  version = "3.5.2";
   disabled = pythonOlder "3.6";
 
-  # pypi package does not include tests
   src = fetchFromGitHub {
     owner = "ikalchev";
     repo = "HAP-python";
     rev = "v${version}";
-    sha256 = "sha256-ZHTqlb7LIDp8MFNW8MFg6jX7QwaxT40cLi3H13ONLCI=";
+    sha256 = "1irf4dcq9fcqvvjbijkymm63n2s7a19igs1zsbv7y8fa5a2yprhd";
   };
 
   propagatedBuildInputs = [
@@ -33,7 +31,6 @@ buildPythonPackage rec {
     cryptography
     curve25519-donna
     ecdsa
-    ed25519
     h11
     pyqrcode
     zeroconf

pkgs/development/python-modules/influxdb-client/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "influxdb-client";
-  version = "1.18.0";
+  version = "1.19.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "influxdb-client-python";
     rev = "v${version}";
-    sha256 = "0xgp1wxdfa4y316dfkpmj38chlh68mndr8kqphckpnw16qxsl3d9";
+    sha256 = "0k1qcwd2qdw8mcr8ywy3wi1x9j6i57axgcps5kmkbx773s8qf155";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/jeepney/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "jeepney";
-  version = "0.6.0";
+  version = "0.7.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d59b6622675ca9e993a6bd38de845051d315f8b0c72cca3aef733a20b648657";
+    sha256 = "1237cd64c8f7ac3aa4b3f332c4d0fb4a8216f39eaa662ec904302d4d77de5a54";
   };
 
   checkInputs = [

pkgs/development/python-modules/meshio/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "meshio";
-  version = "4.3.10";
+  version = "4.4.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1i34bk8bbc0dnizrlgj0yxnbzyvndkmnl6ryymxgcl9rv1abkfki";
+    sha256 = "0kv832s2vyff30zz8yqypw5jifwdanvh5x56d2bzkvy94h4jlddy";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pylzma/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "pylzma";
+  version = "0.5.0";
+
+  # This vendors an old LZMA SDK
+  # After some discussion, it seemed most reasonable to keep it that way
+  # xz, and uefi-firmware-parser also does this
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "074anvhyjgsv2iby2ql1ixfvjgmhnvcwjbdz8gk70xzkzcm1fx5q";
+  };
+
+  pythonImportsCheck = [ "pylzma" ];
+
+  meta = with lib; {
+    homepage = "https://www.joachim-bauch.de/projects/pylzma/";
+    description = "Platform independent python bindings for the LZMA compression library";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}

pkgs/development/python-modules/pysyncthru/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysyncthru";
-  version = "0.7.3";
+  version = "0.7.5";
 
   disabled = isPy27;
 

pkgs/development/python-modules/requests-unixsocket/default.nix

@@ -1,6 +1,11 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
-, pbr, requests
+, buildPythonPackage
-, pytest, waitress }:
+, fetchPypi
+, pbr
+, requests
+, pytestCheckHook
+, waitress
+}:
 
 buildPythonPackage rec {
   pname = "requests-unixsocket";
@@ -14,10 +19,10 @@ buildPythonPackage rec {
   nativeBuildInputs = [ pbr ];
   propagatedBuildInputs = [ requests ];
 
-  checkInputs = [ pytest waitress ];
+  checkInputs = [ pytestCheckHook waitress ];
-  checkPhase = ''
+
+  preCheck = ''
     rm pytest.ini
-    py.test
   '';
 
   meta = with lib; {

pkgs/development/python-modules/synergy/default.nix

@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, numpy
+, scipy
+, matplotlib
+, plotly
+, pandas
+}:
+
+buildPythonPackage rec {
+  pname = "synergy";
+  version = "0.5.1";
+  disabled = pythonOlder "3.5";
+
+  # Pypi does not contain unit tests
+  src = fetchFromGitHub {
+    owner = "djwooten";
+    repo = "synergy";
+    rev = "v${version}";
+    sha256 = "1c60dpvr72g4wjqg6bc601kssl5z55v9bg09xbyh9ahch58bi212";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    matplotlib
+    plotly
+    pandas
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "synergy" ];
+
+  meta = with lib; {
+    description = "A Python library for calculating, analyzing, and visualizing drug combination synergy";
+    homepage = "https://github.com/djwooten/synergy";
+    maintainers = [ maintainers.ivar ];
+    license = licenses.gpl3Plus;
+  };
+}

pkgs/development/tools/analysis/frama-c/default.nix

@@ -31,12 +31,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "frama-c";
-  version = "23.0";
+  version = "23.1";
   slang   = "Vanadium";
 
   src = fetchurl {
     url    = "https://frama-c.com/download/frama-c-${version}-${slang}.tar.gz";
-    sha256 = "0pdm3y2nfyjhpnicv1pg9j48llq86dmb591d2imnafp4xfqani0s";
+    sha256 = "1rgkq9sg436smw005ag0j6y3xryhjn18a07m5wjfrfp0s1438nnj";
   };
 
   preConfigure = lib.optionalString stdenv.cc.isClang "configureFlagsArray=(\"--with-cpp=clang -E -C\")";

pkgs/development/tools/apksigcopier/default.nix

@@ -4,10 +4,9 @@
 , installShellFiles
 , bash
 , pandoc
+, apksigner
 }:
 
-# FIXME: how to "recommend" apksigner like the Debian package?
-
 python3.pkgs.buildPythonApplication rec {
   pname = "apksigcopier";
   version = "1.0.1";
@@ -22,6 +21,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [ installShellFiles pandoc ];
   propagatedBuildInputs = with python3.pkgs; [ click ];
   checkInputs = with python3.pkgs; [ flake8 mypy pylint ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ apksigner ]}" ];
 
   postPatch = ''
     substituteInPlace Makefile \

pkgs/development/tools/apksigner/default.nix

@@ -0,0 +1,15 @@
+{ runCommand
+, makeWrapper
+, jre
+, build-tools
+}:
+let
+  tools = builtins.head build-tools;
+in
+runCommand "apksigner" {
+  nativeBuildInputs = [ makeWrapper ];
+} ''
+  mkdir -p $out/bin
+  makeWrapper "${jre}/bin/java" "$out/bin/apksigner" \
+    --add-flags "-jar ${tools}/libexec/android-sdk/build-tools/${tools.version}/lib/apksigner.jar"
+''

pkgs/development/tools/fdroidserver/default.nix

@@ -1,7 +1,8 @@
-{ docker
+{ fetchFromGitLab
-, fetchFromGitLab
 , python
-, lib }:
+, lib
+, apksigner
+}:
 
 python.pkgs.buildPythonApplication rec {
   version = "2.0.3";
@@ -47,6 +48,8 @@ python.pkgs.buildPythonApplication rec {
     yamllint
   ];
 
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ apksigner ]}" ];
+
   # no tests
   doCheck = false;
 

pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix

@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, libarchive, python, file, which }:
+{ lib, stdenv, fetchurl, libarchive, python3, file, which }:
 
 stdenv.mkDerivation rec {
   pname = "remarkable-toolchain";
-  version = "1.8-23.9.2019";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://remarkable.engineering/oecore-x86_64-cortexa9hf-neon-toolchain-zero-gravitas-${version}.sh";
+    url = "https://storage.googleapis.com/remarkable-codex-toolchain/codex-x86_64-cortexa9hf-neon-rm10x-toolchain-${version}.sh";
-    sha256 = "1rk1r80m5d18sw6hrybj6f78s8pna0wrsa40ax6j8jzfwahgzmfb";
+    sha256 = "sha256-ocODUUx2pgmqxMk8J+D+OvqlSHBSay6YzcqnxC9n59w=";
     executable = true;
   };
 
   nativeBuildInputs = [
     libarchive
-    python
+    python3
     file
     which
   ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A toolchain for cross-compiling to reMarkable tablets";
     homepage = "https://remarkable.engineering/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ nickhu siraben ];
     platforms = [ "x86_64-linux" ];
   };

pkgs/development/tools/misc/remarkable/remarkable2-toolchain/default.nix

@@ -1,32 +1,28 @@
-{ lib, stdenv, fetchurl, libarchive, python3, file }:
+{ lib, stdenv, fetchurl, libarchive, python3, file, which }:
 
 stdenv.mkDerivation rec {
   pname = "remarkable2-toolchain";
-  version = "2.5.2";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://storage.googleapis.com/codex-public-bucket/codex-x86_64-cortexa7hf-neon-rm11x-toolchain-${version}.sh";
+    url = "https://storage.googleapis.com/remarkable-codex-toolchain/codex-x86_64-cortexa7hf-neon-rm11x-toolchain-${version}.sh";
-    sha256 = "1v410q1jn8flisdpkrymxd4pa1ylawd0rh3rljjpkqw1bp8a5vw1";
+    sha256 = "sha256-JKMDRbkvoxwHiTm/o4JdLn3Mm2Ld1LyxTnCCwvnxk4c=";
+    executable = true;
   };
 
   nativeBuildInputs = [
     libarchive
     python3
     file
+    which
   ];
 
-  unpackCmd = ''
+  dontUnpack = true;
-    mkdir src
-    install $curSrc src/install-toolchain.sh
-  '';
-
   dontBuild = true;
 
   installPhase = ''
-    patchShebangs install-toolchain.sh
+    mkdir -p $out
-    sed -i -e '3,9d' install-toolchain.sh # breaks PATH
+    ENVCLEANED=1 $src -y -d $out
-    sed -i 's|PYTHON=.*$|PYTHON=${python3}/bin/python|' install-toolchain.sh
-    ./install-toolchain.sh -D -y -d $out
   '';
 
   meta = with lib; {
@@ -34,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://remarkable.engineering/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ tadfisher ];
-    platforms = platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/development/tools/scalafix/default.nix

@@ -17,21 +17,20 @@ let
   };
 in
 stdenv.mkDerivation {
-  name = "${baseName}-${version}";
+  pname = baseName;
+  inherit version;
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jdk deps ];
 
-  doCheck = true;
+  dontUnpack = true;
-
-  phases = [ "installPhase" "checkPhase" ];
 
   installPhase = ''
     makeWrapper ${jre}/bin/java $out/bin/${baseName} \
       --add-flags "-cp $CLASSPATH scalafix.cli.Cli"
   '';
 
-  checkPhase = ''
+  installCheckPhase = ''
     $out/bin/${baseName} --version | grep -q "${version}"
   '';
 

pkgs/games/minecraft-server/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     chmod +x $out/bin/minecraft-server
   '';
 
-  phases = "installPhase";
+  dontUnpack = true;
 
   passthru = {
     tests = { inherit (nixosTests) minecraft-server; };

pkgs/games/tcl2048/default.nix

@@ -10,7 +10,7 @@ tcl.mkTclDerivation rec {
   };
 
   buildInputs = [ tcllib ];
-  phases = "installPhase fixupPhase";
+  dontUnpack = true;
 
   installPhase = ''
     mkdir -pv $out/bin

pkgs/misc/vscode-extensions/default.nix

@@ -1,4 +1,6 @@
-{ config, lib, buildEnv, callPackage, vscode-utils, asciidoctor, nodePackages, jdk, llvmPackages_8, nixpkgs-fmt, jq, shellcheck, moreutils, racket-minimal }:
+{ config, lib, buildEnv, callPackage, vscode-utils, asciidoctor, nodePackages, jdk, llvmPackages_8, nixpkgs-fmt, jq
+, shellcheck, moreutils, racket-minimal, clojure-lsp
+}:
 
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
@@ -206,6 +208,23 @@ let
         };
       };
 
+      betterthantomorrow.calva = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "calva";
+          publisher = "betterthantomorrow";
+          version = "2.0.205";
+          sha256 = "sha256-umnG1uLB42fUNKjANaKcABjVmqbdOQakd/6TPsEpF9c";
+        };
+        nativeBuildInputs = [ jq moreutils ];
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
+        '';
+        meta = with lib; {
+          license = licenses.mit;
+        };
+      };
+
       bodil.file-browser = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "file-browser";

pkgs/servers/atlassian/crowd.nix

@@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
     sha256 = "1gg4jcwvk4za6j4260dx1vz2dprrnqv8paqf6z86s7ka3y1nx1aj";
   };
 
-  phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
-
   buildPhase = ''
     mv apache-tomcat/conf/server.xml apache-tomcat/conf/server.xml.dist
     ln -s /run/atlassian-crowd/server.xml apache-tomcat/conf/server.xml

pkgs/servers/http/jboss/default.nix

@@ -8,8 +8,6 @@ stdenv.mkDerivation rec {
     sha256 = "1bdjw0ib9qr498vpfbg8klqw6rl11vbz7vwn6gp1r5gpqkd3zzc8";
   };
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
   installPhase = ''
     mv $PWD $out
     find $out/bin -name \*.sh -print0 | xargs -0 sed -i -e '/#!\/bin\/sh/aJAVA_HOME=${jdk}'

pkgs/servers/mastodon/update.nix

@@ -8,7 +8,6 @@ stdenv.mkDerivation rec {
     patchShebangs $out/bin/update.sh
     wrapProgram $out/bin/update.sh --prefix PATH : ${lib.makeBinPath buildInputs}
   '';
-  phases = [ "installPhase" ];
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ yarn2nix bundix coreutils diffutils nix-prefetch-github gnused jq ];

pkgs/servers/misc/subsonic/default.nix

@@ -33,6 +33,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ telotortium ];
     platforms = platforms.unix;
   };
-
-  phases = ["unpackPhase" "installPhase"];
 }

pkgs/servers/monitoring/prometheus/jmx-httpserver.nix

@@ -17,7 +17,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
 
-  phases = "installPhase";
+  dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/libexec

pkgs/servers/monitoring/riemann/default.nix

@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     substituteInPlace bin/riemann --replace '$top/lib/riemann.jar' "$out/share/java/riemann.jar"
 

pkgs/servers/tautulli/default.nix

@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.7.3";
+  version = "2.7.5";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ig2vq19sb6n2x2w2zbf54izynaqay9l8xq1zds116v0z729wlkh";
+    sha256 = "h4IRPUaqgb/AgqKJJEsHBydJOH2i//fpWzMFa0VM2ns=";
   };
 
   installPhase = ''

pkgs/tools/backup/btar/default.nix

@@ -1,21 +1,30 @@
-{ lib, stdenv, fetchurl, librsync }:
+{ lib, stdenv, fetchurl, fetchpatch, librsync }:
 
 stdenv.mkDerivation rec {
-  name = "btar-1.1.1";
+  pname = "btar";
+  version = "1.1.1";
+
   src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/btar/${name}.tar.gz";
+    url = "https://vicerveza.homeunix.net/~viric/soft/btar/btar-${version}.tar.gz";
     sha256 = "0miklk4bqblpyzh1bni4x6lqn88fa8fjn15x1k1n8bxkx60nlymd";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://build.opensuse.org/public/source/openSUSE:Factory/btar/btar-librsync.patch?rev=2";
+      sha256 = "1awqny9489vsfffav19s73xxg26m7zrhvsgf1wxb8c2izazwr785";
+    })
+  ];
+
   buildInputs = [ librsync ];
 
-  installPhase = "make install PREFIX=$out";
+  makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "Tar-compatible block-based archiver";
     license = lib.licenses.gpl3Plus;
-    homepage = "http://viric.name/cgi-bin/btar";
+    homepage = "https://viric.name/cgi-bin/btar";
-    platforms = with lib.platforms; all;
+    platforms = platforms.all;
-    maintainers = with lib.maintainers; [viric];
+    maintainers = with maintainers; [ viric ];
   };
 }

pkgs/tools/graphics/astc-encoder/default.nix

@@ -31,13 +31,13 @@ with rec {
 
 gccStdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-+vYEO2zS144ZuVN8b4/EpvTcakC9U0uc/eV4pB7lHiY=";
+    sha256 = "sha256-WWxk8F1MtFv1tWbSs45fmu4k9VCAAOjJP8zBz80zLTo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/tools/graphics/goverlay/default.nix

@@ -34,13 +34,13 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "goverlay";
-  version = "0.5.1";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = pname;
     rev = version;
-    hash = "sha256-Zl1pq2MeGJsPdNlwUEpov5MHlsr9pSMkWHVprt8ImKs=";
+    hash = "sha256-E4SMUL9rpDSSdprX4fPyGCHCowdQavjhGIhV3r4jeiw=";
   };
 
   outputs = [ "out" "man" ];

pkgs/tools/graphics/goverlay/find-xdg-data-files.patch

@@ -1,8 +1,8 @@
 diff --git a/overlayunit.pas b/overlayunit.pas
-index 59f6a81..a096543 100644
+index de8725f..005f171 100644
 --- a/overlayunit.pas
 +++ b/overlayunit.pas
-@@ -4871,7 +4871,7 @@ begin
+@@ -5377,7 +5377,7 @@ begin
     //Determine Mangohud dependency status
  
            //locate MangoHud and store result in tmp folder
@@ -11,7 +11,7 @@ index 59f6a81..a096543 100644
  
            // Assign Text file dependency_mangohud to variable mangohudVAR
            AssignFile(mangohudVAR, '/tmp/goverlay/dependency_mangohud');
-@@ -4880,7 +4880,7 @@ begin
+@@ -5386,7 +5386,7 @@ begin
            CloseFile(mangohudVAR);
  
            // Read String and store value on mangohuddependencyVALUE based on result
@@ -20,7 +20,7 @@ index 59f6a81..a096543 100644
            mangohuddependencyVALUE := 1
            else
            mangohuddependencyVALUE := 0;
-@@ -4889,7 +4889,7 @@ begin
+@@ -5395,7 +5395,7 @@ begin
     //Determine vkBasalt dependency staus
  
             //locate vkBasalt and store result in tmp folder
@@ -29,7 +29,7 @@ index 59f6a81..a096543 100644
  
             // Assign Text file dependency_mangohud to variable mangohudVAR
             AssignFile(vkbasaltVAR, '/tmp/goverlay/dependency_vkbasalt');
-@@ -4898,7 +4898,7 @@ begin
+@@ -5404,7 +5404,7 @@ begin
             CloseFile(vkbasaltVAR);
  
             // Read String and store value on vkbasaltdependencyVALUE based on result

pkgs/tools/misc/diffoscope/default.nix

@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, runCommand, makeWrapper, python3Packages, docutils, help2man, installShellFiles
+{ lib, stdenv, fetchurl, python3Packages, docutils, help2man, installShellFiles
-, abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
+, abootimg, acl, apksigner, apktool, binutils-unwrapped, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
 , e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
 , radare2, sng, sqlite, squashfsTools, tcpdump, odt2txt, unzip, wabt, xxd, xz, zip, zstd
@@ -7,13 +7,6 @@
 }:
 
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
-let
-  apksigner = runCommand "apksigner" { nativeBuildInputs = [ makeWrapper ]; } ''
-    mkdir -p $out/bin
-    makeWrapper "${jdk}/bin/java" "$out/bin/apksigner" \
-      --add-flags "-jar ${builtins.head build-tools}/libexec/android-sdk/build-tools/28.0.3/lib/apksigner.jar"
-  '';
-in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
   version = "178";

pkgs/tools/security/fail2ban/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, python3 }:
 
-let version = "0.11.1"; in
+let version = "0.11.2"; in
 
 python3.pkgs.buildPythonApplication {
   pname = "fail2ban";
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication {
     owner  = "fail2ban";
     repo   = "fail2ban";
     rev    = version;
-    sha256 = "0kqvkxpb72y3kgmxf6g36w67499c6gcd2a9yyblagwx12y05f1sh";
+    sha256 = "q4U9iWCa1zg8sA+6pPNejt6v/41WGIKN5wITJCrCqQE=";
   };
 
   pythonPath = with python3.pkgs;

pkgs/tools/security/minio-certgen/default.nix

@@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "minio-certgen";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "minio";
+    repo = "certgen";
+    rev = "v${version}";
+    sha256 = "sha256-HtzcoEUMt3LpQNyT0wGcmc4Q70QqHx7QpjrDh4YSO/Q=";
+  };
+
+  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+
+  meta = with lib; {
+    description = "A simple Minio tool to generate self-signed certificates, and provides SAN certificates with DNS and IP entries";
+    downloadPage = "https://github.com/minio/certgen";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ superherointj ];
+  };
+}

pkgs/tools/typesetting/pdfchain/default.nix

@@ -0,0 +1,56 @@
+{ lib, stdenv, fetchurl, fetchpatch
+, autoconf, gtkmm3, glib, pdftk, pkg-config, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pdfchain";
+  version = "0.4.4.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-Hu4Pk9voyc75+f5OwKEOCkXKjN5nzWzv+izmyEN1Lz0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config wrapGAppsHook autoconf
+  ];
+
+  buildInputs = [
+    gtkmm3 pdftk glib
+  ];
+
+  patches = let
+    fetchDebianPatch = {name, sha256}: fetchpatch {
+      url = "https://salsa.debian.org/debian/pdfchain/raw/2d29107756a3194fb522bdea8e9b9e393b15a8f3/debian/patches/${name}";
+      inherit name sha256;
+    };
+  in
+  [
+    (fetchDebianPatch {
+      name = "fix_crash_on_startup";
+      sha256 = "sha256-1UyMHHGrmUIFhY53ILdMMsyocSIbcV6CKQ7sLVNhNQw=";
+    })
+    (fetchDebianPatch {
+      name = "fix_desktop_file";
+      sha256 = "sha256-L6lhUs7GqVN1XOQO6bbz6BT29n4upsJtlHCAIGzk1Bw=";
+    })
+    (fetchDebianPatch {
+      name = "fix_spelling";
+      sha256 = "sha256-sOUUslPfcOo2K3zuaLcux+CNdgfWM0phsfe6g4GUFes=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/constant.h \
+        --replace '"pdftk"' '"${pdftk}/bin/pdftk"' \
+        --replace "/usr/share" "$out/share"
+  '';
+
+  meta = with lib; {
+    description = "A graphical user interface for the PDF Toolkit (PDFtk)";
+    homepage = "https://pdfchain.sourceforge.io";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ hqurve ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/video/swftools/default.nix

@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = [ maintainers.koral ];
     platforms = lib.platforms.unix;
-    broken = true;
     knownVulnerabilities = [
       "CVE-2017-10976"
       "CVE-2017-11096"

pkgs/top-level/aliases.nix

@@ -424,6 +424,7 @@ mapAliases ({
   libqrencode = qrencode;  # added 2019-01-01
   librdf = lrdf; # added 2020-03-22
   librecad2 = librecad;  # backwards compatibility alias, added 2015-10
+  librsync_0_9 = throw "librsync_0_9 has been removed"; # added 2021-07-24
   libseat = seatd; # added 2021-06-24
   libsysfs = sysfsutils; # added 2018-04-25
   libtidy = html-tidy;  # added 2014-12-21

pkgs/top-level/all-packages.nix

@@ -1105,6 +1105,10 @@ in
 
   apksigcopier = callPackage ../development/tools/apksigcopier { };
 
+  apksigner = callPackage ../development/tools/apksigner {
+    inherit (androidenv.androidPkgs_9_0) build-tools;
+  };
+
   apktool = callPackage ../development/tools/apktool {
     inherit (androidenv.androidPkgs_9_0) build-tools;
   };
@@ -3543,9 +3547,7 @@ in
 
   bsdiff = callPackage ../tools/compression/bsdiff { };
 
-  btar = callPackage ../tools/backup/btar {
+  btar = callPackage ../tools/backup/btar { };
-    librsync = librsync_0_9;
-  };
 
   bud = callPackage ../tools/networking/bud { };
 
@@ -4202,7 +4204,6 @@ in
   diff-so-fancy = callPackage ../applications/version-management/git-and-tools/diff-so-fancy { };
 
   diffoscopeMinimal = callPackage ../tools/misc/diffoscope {
-    inherit (androidenv.androidPkgs_9_0) build-tools;
     jdk = jdk8;
   };
 
@@ -5509,7 +5510,9 @@ in
 
   gpp = callPackage ../development/tools/gpp { };
 
-  gpredict = callPackage ../applications/science/astronomy/gpredict { };
+  gpredict = callPackage ../applications/science/astronomy/gpredict {
+    hamlib = hamlib_4;
+  };
 
   gptfdisk = callPackage ../tools/system/gptfdisk { };
 
@@ -7075,6 +7078,8 @@ in
 
   minio-client = callPackage ../tools/networking/minio-client { };
 
+  minio-certgen = callPackage ../tools/security/minio-certgen { };
+
   minissdpd = callPackage ../tools/networking/minissdpd { };
 
   inherit (callPackage ../tools/networking/miniupnpc
@@ -15537,7 +15542,7 @@ in
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope { libav = pkgs.ffmpeg; };
+    callPackage = newScope (gst_all_1 // { libav = pkgs.ffmpeg; });
     inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Cocoa CoreFoundation CoreMedia CoreServices CoreVideo DiskArbitration Foundation IOKit MediaToolbox OpenGL VideoToolbox;
   });
 
@@ -15760,7 +15765,9 @@ in
 
   gwenhywfar = callPackage ../development/libraries/aqbanking/gwenhywfar.nix { };
 
-  hamlib = callPackage ../development/libraries/hamlib { };
+  hamlib = hamlib_3;
+  hamlib_3 = callPackage ../development/libraries/hamlib { };
+  hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };
 
   heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
@@ -17043,8 +17050,6 @@ in
 
   librsync = callPackage ../development/libraries/librsync { };
 
-  librsync_0_9 = callPackage ../development/libraries/librsync/0.9.nix { };
-
   librttopo = callPackage ../development/libraries/librttopo { };
 
   libs3 = callPackage ../development/libraries/libs3 { };
@@ -23517,7 +23522,9 @@ in
     python3Packages = python37Packages;
   };
 
-  cqrlog = callPackage ../applications/radio/cqrlog { };
+  cqrlog = callPackage ../applications/radio/cqrlog {
+    hamlib = hamlib_4;
+  };
 
   crun = callPackage ../applications/virtualization/crun {};
 
@@ -23596,7 +23603,9 @@ in
     inherit (pkgs.gnome2) libart_lgpl libgnomeui;
   };
 
-  direwolf = callPackage ../applications/radio/direwolf { };
+  direwolf = callPackage ../applications/radio/direwolf {
+    hamlib = hamlib_4;
+  };
 
   dirt = callPackage ../applications/audio/dirt {};
 
@@ -23928,7 +23937,9 @@ in
 
   flexget = callPackage ../applications/networking/flexget { };
 
-  fldigi = callPackage ../applications/radio/fldigi { };
+  fldigi = callPackage ../applications/radio/fldigi {
+    hamlib = hamlib_4;
+  };
 
   flink = callPackage ../applications/networking/cluster/flink { };
 
@@ -26374,6 +26385,8 @@ in
     inherit (gnome2) libgnomecanvas;
   };
 
+  pdfchain = callPackage ../tools/typesetting/pdfchain { };
+
   pdfcpu = callPackage ../applications/graphics/pdfcpu { };
   pdftk = callPackage ../tools/typesetting/pdftk {
     jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
@@ -26435,6 +26448,8 @@ in
     plugins = [];
   };
 
+  pidgin-indicator = callPackage ../applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator { };
+
   pidgin-latex = callPackage ../applications/networking/instant-messengers/pidgin-plugins/pidgin-latex {
     texLive = texlive.combined.scheme-basic;
   };
@@ -26962,6 +26977,8 @@ in
 
   sniproxy = callPackage ../applications/networking/sniproxy { };
 
+  snixembed = callPackage ../applications/misc/snixembed { };
+
   sooperlooper = callPackage ../applications/audio/sooperlooper { };
 
   sops = callPackage ../tools/security/sops { };

pkgs/top-level/python-packages.nix

@@ -2734,6 +2734,8 @@ in {
 
   freezegun = callPackage ../development/python-modules/freezegun { };
 
+  frilouz = callPackage ../development/python-modules/frilouz { };
+
   fritzconnection = callPackage ../development/python-modules/fritzconnection { };
 
   fritzprofiles = callPackage ../development/python-modules/fritzprofiles { };
@@ -6215,6 +6217,8 @@ in {
 
   pylxd = callPackage ../development/python-modules/pylxd { };
 
+  pylzma = callPackage ../development/python-modules/pylzma { };
+
   pymacaroons = callPackage ../development/python-modules/pymacaroons { };
 
   pymaging = callPackage ../development/python-modules/pymaging { };
@@ -8458,6 +8462,8 @@ in {
 
   syncer = callPackage ../development/python-modules/syncer { };
 
+  synergy = callPackage ../development/python-modules/synergy { };
+
   synologydsm-api = callPackage ../development/python-modules/synologydsm-api { };
 
   systembridge = callPackage ../development/python-modules/systembridge { };