Merge branch 'master' into staging-next-2022-04-23

.github/workflows/update-terraform-providers.yml

@@ -25,7 +25,7 @@ jobs:
           git commit -m "${{ steps.setup.outputs.title }}" providers.json
           popd
       - name: create PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

lib/modules.nix

@@ -160,7 +160,10 @@ rec {
             type = types.lazyAttrsOf types.raw;
             # Only render documentation once at the root of the option tree,
             # not for all individual submodules.
-            internal = prefix != [];
+            # Allow merging option decls to make this internal regardless.
+            ${if prefix == []
+              then null  # unset => visible
+              else "internal"} = true;
             # TODO: Change the type of this option to a submodule with a
             # freeformType, so that individual arguments can be documented
             # separately

maintainers/maintainer-list.nix

@@ -525,6 +525,12 @@
     githubId = 38869148;
     name = "Alex Eyre";
   };
+  algram = {
+    email = "aliasgram@gmail.com";
+    github = "Algram";
+    githubId = 5053729;
+    name = "Alias Gram";
+  };
   alibabzo = {
     email = "alistair.bill@gmail.com";
     github = "alibabzo";
@@ -2061,6 +2067,12 @@
     githubId = 8228888;
     name = "Charlie Hanley";
   };
+  charlesbaynham = {
+    email = "charlesbaynham@gmail.com";
+    github = "charlesbaynham";
+    githubId = 4397637;
+    name = "Charles Baynham";
+  };
   CharlesHD = {
     email = "charleshdespointes@gmail.com";
     github = "CharlesHD";
@@ -4093,11 +4105,18 @@
     matrix = "@felschr:matrix.org";
     github = "felschr";
     githubId = 3314323;
-    name = "Felix Tenley";
+    name = "Felix Schröter";
-    keys = [{
+    keys = [
-      longkeyid = "ed25519/0x910ACB9F6BD26F58";
+      {
-      fingerprint = "6AB3 7A28 5420 9A41 82D9  0068 910A CB9F 6BD2 6F58";
+        # historical
-    }];
+        longkeyid = "ed25519/0x910ACB9F6BD26F58";
+        fingerprint = "6AB3 7A28 5420 9A41 82D9  0068 910A CB9F 6BD2 6F58";
+      }
+      {
+        longkeyid = "ed25519/0x671E39E6744C807D";
+        fingerprint = "7E08 6842 0934 AA1D 6821  1F2A 671E 39E6 744C 807D";
+      }
+    ];
   };
   ffinkdevs = {
     email = "fink@h0st.space";
@@ -12018,6 +12037,12 @@
     githubId = 1694705;
     name = "Sam Stites";
   };
+  strager = {
+    email = "strager.nds@gmail.com";
+    github = "strager";
+    githubId = 48666;
+    name = "Matthew \"strager\" Glazar";
+  };
   stumoss = {
     email = "samoss@gmail.com";
     github = "stumoss";
@@ -12762,6 +12787,13 @@
     githubId = 90456;
     name = "Rebecca (Bex) Kelly";
   };
+  tpw_rules = {
+    name = "Thomas Watson";
+    email = "twatson52@icloud.com";
+    matrix = "@tpw_rules:matrix.org";
+    github = "tpwrules";
+    githubId = 208010;
+  };
   travisbhartwell = {
     email = "nafai@travishartwell.net";
     github = "travisbhartwell";

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -1292,7 +1292,7 @@ Existing 3rd party modules that provided similar functionality, like <literal>pu
           <literal>systemd-shutdown</literal> is now properly linked on
           shutdown to unmount all filesystems and device mapper devices
           cleanly. This can be disabled using
-          <literal>boot.systemd.shutdown.enable</literal>.
+          <literal>systemd.shutdownRamfs.enable</literal>.
         </para>
       </listitem>
       <listitem>

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -513,7 +513,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`
 
-- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `boot.systemd.shutdown.enable`.
+- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`.
 
 - The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
 

nixos/lib/systemd-types.nix

@@ -1,4 +1,4 @@
-{ lib, systemdUtils }:
+{ lib, systemdUtils, pkgs }:
 
 with systemdUtils.lib;
 with systemdUtils.unitOptions;
@@ -34,4 +34,36 @@ rec {
 
   automounts = with types; listOf (submodule [ stage2AutomountOptions unitConfig automountConfig ]);
   initrdAutomounts = with types; attrsOf (submodule [ stage1AutomountOptions unitConfig automountConfig ]);
+
+  initrdContents = types.attrsOf (types.submodule ({ config, options, name, ... }: {
+    options = {
+      enable = mkEnableOption "copying of this file and symlinking it" // { default = true; };
+
+      target = mkOption {
+        type = types.path;
+        description = ''
+          Path of the symlink.
+        '';
+        default = name;
+      };
+
+      text = mkOption {
+        default = null;
+        type = types.nullOr types.lines;
+        description = "Text of the file.";
+      };
+
+      source = mkOption {
+        type = types.path;
+        description = "Path of the source file.";
+      };
+    };
+
+    config = {
+      source = mkIf (config.text != null) (
+        let name' = "initrd-" + baseNameOf name;
+        in mkDerivedConfig options.text (pkgs.writeText name')
+      );
+    };
+  }));
 }

nixos/lib/utils.nix

@@ -213,6 +213,6 @@ rec {
   systemdUtils = {
     lib = import ./systemd-lib.nix { inherit lib config pkgs; };
     unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
-    types = import ./systemd-types.nix { inherit lib systemdUtils; };
+    types = import ./systemd-types.nix { inherit lib systemdUtils pkgs; };
   };
 }

nixos/modules/config/console.nix

@@ -149,8 +149,11 @@ in
         '');
 
         boot.initrd.systemd.contents = {
-          "/etc/kbd".source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share";
           "/etc/vconsole.conf".source = vconsoleConf;
+          # Add everything if we want full console setup...
+          "/etc/kbd" = lib.mkIf cfg.earlySetup { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share"; };
+          # ...but only the keymaps if we don't
+          "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps"; };
         };
         boot.initrd.systemd.storePaths = [
           "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
@@ -180,7 +183,7 @@ in
         ];
       })
 
-      (mkIf cfg.earlySetup {
+      (mkIf (cfg.earlySetup && !config.boot.inird.systemd.enable) {
         boot.initrd.extraUtilsCommands = ''
           mkdir -p $out/share/consolefonts
           ${if substring 0 1 cfg.font == "/" then ''
@@ -194,10 +197,6 @@ in
             cp -L $font $out/share/consolefonts/font.psf
           fi
         '';
-        assertions = [{
-          assertion = !config.boot.initrd.systemd.enable;
-          message = "console.earlySetup is implied by systemd stage 1";
-        }];
       })
     ]))
   ];

nixos/modules/hardware/all-firmware.nix

@@ -85,7 +85,10 @@ in {
         b43Firmware_6_30_163_46
         b43FirmwareCutter
         xow_dongle-firmware
-      ] ++ optional pkgs.stdenv.hostPlatform.isx86 facetimehd-firmware;
+      ] ++ optionals pkgs.stdenv.hostPlatform.isx86 [
+        facetimehd-calibration
+        facetimehd-firmware
+      ];
     })
     (mkIf cfg.wirelessRegulatoryDatabase {
       hardware.firmware = [ pkgs.wireless-regdb ];

nixos/modules/hardware/video/nvidia.nix

@@ -361,11 +361,12 @@ in
     services.udev.extraRules =
       ''
         # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
-        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
-        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%n c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", PROGRAM="${pkgs.gnugrep}/bin/grep 'Device Minor:' /proc/driver/nvidia/gpus/%b/information", \
+          RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%c{3} c 195 %c{3}"
         KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
-        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
+        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
       '' + optionalString cfg.powerManagement.finegrained ''
         # Remove NVIDIA USB xHCI Host Controller devices, if present
         ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"

nixos/modules/hardware/video/webcam/facetimehd.nix

@@ -14,6 +14,18 @@ in
 
   options.hardware.facetimehd.enable = mkEnableOption "facetimehd kernel module";
 
+  options.hardware.facetimehd.withCalibration = mkOption {
+    default = false;
+    example = true;
+    type = types.bool;
+    description = ''
+      Whether to include sensor calibration files for facetimehd.
+      This makes colors look much better but is experimental, see
+      <link xlink:href="https://github.com/patjak/facetimehd/wiki/Extracting-the-sensor-calibration-files"/>
+      for details.
+    '';
+  };
+
   config = mkIf cfg.enable {
 
     boot.kernelModules = [ "facetimehd" ];
@@ -22,7 +34,8 @@ in
 
     boot.extraModulePackages = [ kernelPackages.facetimehd ];
 
-    hardware.firmware = [ pkgs.facetimehd-firmware ];
+    hardware.firmware = [ pkgs.facetimehd-firmware ]
+      ++ optional cfg.withCalibration pkgs.facetimehd-calibration;
 
     # unload module during suspend/hibernate as it crashes the whole system
     powerManagement.powerDownCommands = ''

nixos/modules/installer/cd-dvd/channel.nix

@@ -39,7 +39,8 @@ in
         echo "unpacking the NixOS/Nixpkgs sources..."
         mkdir -p /nix/var/nix/profiles/per-user/root
         ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/per-user/root/channels \
-          -i ${channelSources} --quiet --option build-use-substitutes false
+          -i ${channelSources} --quiet --option build-use-substitutes false \
+          ${optionalString config.boot.initrd.systemd.enable "--option sandbox false"} # There's an issue with pivot_root
         mkdir -m 0700 -p /root/.nix-defexpr
         ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
         mkdir -m 0755 -p /var/lib/nixos

nixos/modules/module-list.nix

@@ -172,6 +172,7 @@
   ./programs/java.nix
   ./programs/k40-whisperer.nix
   ./programs/kclock.nix
+  ./programs/k3b.nix
   ./programs/kdeconnect.nix
   ./programs/kbdlight.nix
   ./programs/less.nix
@@ -662,6 +663,7 @@
   ./services/monitoring/longview.nix
   ./services/monitoring/mackerel-agent.nix
   ./services/monitoring/metricbeat.nix
+  ./services/monitoring/mimir.nix
   ./services/monitoring/monit.nix
   ./services/monitoring/munin.nix
   ./services/monitoring/nagios.nix
@@ -1182,13 +1184,14 @@
   ./system/boot/stage-2.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/initrd-secrets.nix
+  ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
   ./system/boot/systemd/shutdown.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
-  ./system/boot/systemd/initrd.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
   ./system/etc/etc-activation.nix

nixos/modules/profiles/installation-device.nix

@@ -99,6 +99,10 @@ with lib;
         stdenvNoCC # for runCommand
         busybox
         jq # for closureInfo
+        # For boot.initrd.systemd
+        makeInitrdNGTool
+        systemdStage1
+        systemdStage1Network
       ];
 
     # Show all debug messages from the kernel but don't log refused packets

nixos/modules/profiles/qemu-guest.nix

@@ -1,13 +1,13 @@
 # Common configuration for virtual machines running under QEMU (using
 # virtio).
 
-{ ... }:
+{ config, lib, ... }:
 
 {
   boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
   boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];
 
-  boot.initrd.postDeviceCommands =
+  boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
     ''
       # Set the system time from the hardware clock to work around a
       # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised

nixos/modules/programs/k3b.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  # interface
+  options.programs.k3b = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable k3b, the KDE disk burning application.
+
+        Additionally to installing <package>k3b</package> enabling this will
+        add <literal>setuid</literal> wrappers in <literal>/run/wrappers/bin</literal>
+        for both <package>cdrdao</package> and <package>cdrecord</package>. On first
+        run you must manually configure the path of <package>cdrdae</package> and
+        <package>cdrecord</package> to correspond to the appropriate paths under
+        <literal>/run/wrappers/bin</literal> in the "Setup External Programs" menu.
+      '';
+    };
+  };
+
+  # implementation
+  config = mkIf config.programs.k3b.enable {
+
+    environment.systemPackages = with pkgs; [
+      k3b
+      dvdplusrwtools
+      cdrdao
+      cdrkit
+    ];
+
+    security.wrappers = {
+      cdrdao = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrdao}/bin/cdrdao";
+      };
+      cdrecord = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrkit}/bin/cdrecord";
+      };
+    };
+
+  };
+}

nixos/modules/services/databases/couchdb.nix

@@ -193,6 +193,11 @@ in {
 
       preStart = ''
         touch ${cfg.configFile}
+        if ! test -e ${cfg.databaseDir}/.erlang.cookie; then
+          touch ${cfg.databaseDir}/.erlang.cookie
+          chmod 600 ${cfg.databaseDir}/.erlang.cookie
+          dd if=/dev/random bs=16 count=1 | base64 > ${cfg.databaseDir}/.erlang.cookie
+        fi
       '';
 
       environment = {
@@ -204,6 +209,7 @@ in {
         ERL_FLAGS= ''-couch_ini ${cfg.package}/etc/default.ini ${configFile} ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} ${cfg.configFile}'';
         # 5. the vm.args file
         COUCHDB_ARGS_FILE=''${cfg.argsFile}'';
+        HOME =''${cfg.databaseDir}'';
       };
 
       serviceConfig = {

nixos/modules/services/monitoring/mimir.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) escapeShellArgs mkEnableOption mkIf mkOption types;
+
+  cfg = config.services.mimir;
+
+  settingsFormat = pkgs.formats.yaml {};
+in {
+  options.services.mimir = {
+    enable = mkEnableOption "mimir";
+
+    configuration = mkOption {
+      type = (pkgs.formats.json {}).type;
+      default = {};
+      description = ''
+        Specify the configuration for Mimir in Nix.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Specify a configuration file that Mimir should use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = (
+        (cfg.configuration == {} -> cfg.configFile != null) &&
+        (cfg.configFile != null -> cfg.configuration == {})
+      );
+      message  = ''
+        Please specify either
+        'services.mimir.configuration' or
+        'services.mimir.configFile'.
+      '';
+    }];
+
+    systemd.services.mimir = {
+      description = "mimir Service Daemon";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = let
+        conf = if cfg.configFile == null
+               then settingsFormat.generate "config.yaml" cfg.configuration
+               else cfg.configFile;
+      in
+      {
+        ExecStart = "${pkgs.grafana-mimir}/bin/mimir --config.file=${conf}";
+        DynamicUser = true;
+        Restart = "always";
+        ProtectSystem = "full";
+        DevicePolicy = "closed";
+        NoNewPrivileges = true;
+        StateDirectory = "mimir";
+      };
+    };
+  };
+}

nixos/modules/system/boot/luksroot.nix

@@ -992,6 +992,7 @@ in
       ];
       storePaths = [
         "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup"
+        "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-cryptsetup-generator"
       ];
 
     };

nixos/modules/system/boot/systemd/initrd-secrets.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  config = lib.mkIf (config.boot.initrd.enable && config.boot.initrd.systemd.enable) {
+    # Copy secrets into the initrd if they cannot be appended
+    boot.initrd.systemd.contents = lib.mkIf (!config.boot.loader.supportsInitrdSecrets)
+      (lib.mapAttrs' (dest: source: lib.nameValuePair "/.initrd-secrets/${dest}" { source = if source == null then dest else source; }) config.boot.initrd.secrets);
+
+    # Copy secrets to their respective locations
+    boot.initrd.systemd.services.initrd-nixos-copy-secrets = lib.mkIf (config.boot.initrd.secrets != {}) {
+      description = "Copy secrets into place";
+      # Run as early as possible
+      wantedBy = [ "sysinit.target" ];
+      before = [ "cryptsetup-pre.target" ];
+      unitConfig.DefaultDependencies = false;
+
+      # We write the secrets to /.initrd-secrets and move them because this allows
+      # secrets to be written to /run. If we put the secret directly to /run and
+      # drop this service, we'd mount the /run tmpfs over the secret, making it
+      # invisible in stage 2.
+      script = ''
+        for secret in $(cd /.initrd-secrets; find . -type f); do
+          mkdir -p "$(dirname "/$secret")"
+          cp "/.initrd-secrets/$secret" "/$secret"
+        done
+      '';
+
+      unitConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+    # The script needs this
+    boot.initrd.systemd.extraBin.find = "${pkgs.findutils}/bin/find";
+  };
+}

nixos/modules/system/boot/systemd/initrd.nix

@@ -105,6 +105,9 @@ let
         opts = options ++ optional autoFormat "x-systemd.makefs" ++ optional autoResize "x-systemd.growfs";
       in "${device} /sysroot${mountPoint} ${fsType} ${lib.concatStringsSep "," opts}") fileSystems);
 
+  needMakefs = lib.any (fs: fs.autoFormat) fileSystems;
+  needGrowfs = lib.any (fs: fs.autoResize) fileSystems;
+
   kernel-name = config.boot.kernelPackages.kernel.name or "kernel";
   modulesTree = config.system.modulesTree.override { name = kernel-name + "-modules"; };
   firmware = config.hardware.firmware;
@@ -155,37 +158,7 @@ in {
       '';
       visible = false;
       default = {};
-      type = types.attrsOf (types.submodule ({ config, options, name, ... }: {
+      type = utils.systemdUtils.types.initrdContents;
-        options = {
-          enable = mkEnableOption "copying of this file to initrd and symlinking it" // { default = true; };
-
-          target = mkOption {
-            type = types.path;
-            description = ''
-              Path of the symlink.
-            '';
-            default = name;
-          };
-
-          text = mkOption {
-            default = null;
-            type = types.nullOr types.lines;
-            description = "Text of the file.";
-          };
-
-          source = mkOption {
-            type = types.path;
-            description = "Path of the source file.";
-          };
-        };
-
-        config = {
-          source = mkIf (config.text != null) (
-            let name' = "initrd-" + baseNameOf name;
-            in mkDerivedConfig options.text (pkgs.writeText name')
-          );
-        };
-      }));
     };
 
     storePaths = mkOption {
@@ -390,18 +363,22 @@ in {
       storePaths = [
         # systemd tooling
         "${cfg.package}/lib/systemd/systemd-fsck"
-        "${cfg.package}/lib/systemd/systemd-growfs"
+        (lib.mkIf needGrowfs "${cfg.package}/lib/systemd/systemd-growfs")
         "${cfg.package}/lib/systemd/systemd-hibernate-resume"
         "${cfg.package}/lib/systemd/systemd-journald"
-        "${cfg.package}/lib/systemd/systemd-makefs"
+        (lib.mkIf needMakefs "${cfg.package}/lib/systemd/systemd-makefs")
         "${cfg.package}/lib/systemd/systemd-modules-load"
         "${cfg.package}/lib/systemd/systemd-remount-fs"
         "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
 
-        # additional systemd directories
+        # generators
-        "${cfg.package}/lib/systemd/system-generators"
+        "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-fstab-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-gpt-auto-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-hibernate-resume-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-run-generator"
 
         # utilities needed by systemd
         "${cfg.package.util-linux}/bin/mount"
@@ -439,8 +416,8 @@ in {
         mkdir -p $out/etc/systemd/system
         touch $out/etc/systemd/system/systemd-{makefs,growfs}@.service
       '')];
-      services."systemd-makefs@".unitConfig.IgnoreOnIsolate = true;
+      services."systemd-makefs@" = lib.mkIf needMakefs { unitConfig.IgnoreOnIsolate = true; };
-      services."systemd-growfs@".unitConfig.IgnoreOnIsolate = true;
+      services."systemd-growfs@" = lib.mkIf needGrowfs { unitConfig.IgnoreOnIsolate = true; };
 
       services.initrd-nixos-activation = {
         after = [ "initrd-fs.target" ];
@@ -502,6 +479,21 @@ in {
           ''systemctl --no-block switch-root /sysroot "''${NEW_INIT}"''
         ];
       };
+
+      services.panic-on-fail = {
+        wantedBy = ["emergency.target"];
+        unitConfig = {
+          DefaultDependencies = false;
+          ConditionKernelCommandLine = [
+            "|boot.panic_on_fail"
+            "|stage1panic"
+          ];
+        };
+        script = ''
+          echo c > /proc/sysrq-trigger
+        '';
+        serviceConfig.Type = "oneshot";
+      };
     };
 
     boot.kernelParams = lib.mkIf (config.boot.resumeDevice != "") [ "resume=${config.boot.resumeDevice}" ];

nixos/modules/system/boot/systemd/shutdown.nix

@@ -1,31 +1,57 @@
-{ config, lib, ... }: let
+{ config, lib, utils, pkgs, ... }: let
 
-  cfg = config.boot.systemd.shutdown;
+  cfg = config.systemd.shutdownRamfs;
+
+  ramfsContents = let
+    storePaths = map (p: "${p}\n") cfg.storePaths;
+    contents = lib.mapAttrsToList (_: v: "${v.source}\n${v.target}") (lib.filterAttrs (_: v: v.enable) cfg.contents);
+  in pkgs.writeText "shutdown-ramfs-contents" (lib.concatStringsSep "\n" (storePaths ++ contents));
 
 in {
-  options.boot.systemd.shutdown = {
+  options.systemd.shutdownRamfs = {
     enable = lib.mkEnableOption "pivoting back to an initramfs for shutdown" // { default = true; };
+    contents = lib.mkOption {
+      description = "Set of files that have to be linked into the shutdown ramfs";
+      example = lib.literalExpression ''
+        {
+          "/lib/systemd/system-shutdown/zpool-sync-shutdown".source = writeShellScript "zpool" "exec ''${zfs}/bin/zpool sync"
+        }
+      '';
+      type = utils.systemdUtils.types.initrdContents;
+    };
+
+    storePaths = lib.mkOption {
+      description = ''
+        Store paths to copy into the shutdown ramfs as well.
+      '';
+      type = lib.types.listOf lib.types.singleLineStr;
+      default = [];
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown";
+    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
+
     systemd.services.generate-shutdown-ramfs = {
       description = "Generate shutdown ramfs";
+      wantedBy = [ "shutdown.target" ];
       before = [ "shutdown.target" ];
       unitConfig = {
         DefaultDependencies = false;
         ConditionFileIsExecutable = [
           "!/run/initramfs/shutdown"
-          "/run/current-system/systemd/lib/systemd/systemd-shutdown"
         ];
       };
 
+      path = [pkgs.util-linux pkgs.makeInitrdNGTool pkgs.glibc pkgs.patchelf];
       serviceConfig.Type = "oneshot";
       script = ''
         mkdir -p /run/initramfs
         if ! mountpoint -q /run/initramfs; then
           mount -t tmpfs tmpfs /run/initramfs
         fi
-        cp /run/current-system/systemd/lib/systemd/systemd-shutdown /run/initramfs/shutdown
+        make-initrd-ng ${ramfsContents} /run/initramfs
       '';
     };
   };

nixos/modules/tasks/filesystems/zfs.nix

@@ -466,6 +466,11 @@ in
         '') rootPools));
       };
 
+      systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/zpool".source = pkgs.writeShellScript "zpool-sync-shutdown" ''
+        exec ${cfgZfs.package}/bin/zpool sync
+      '';
+      systemd.shutdownRamfs.storePaths = ["${cfgZfs.package}/bin/zpool"];
+
       # TODO FIXME See https://github.com/NixOS/nixpkgs/pull/99386#issuecomment-798813567. To not break people's bootloader and as probably not everybody would read release notes that thoroughly add inSystem.
       boot.loader.grub = mkIf (inInitrd || inSystem) {
         zfsSupport = true;

nixos/modules/testing/test-instrumentation.nix

@@ -65,33 +65,26 @@ in
       };
     };
 
-    boot.initrd.preDeviceCommands =
+    boot.kernel.sysctl = {
-      ''
+      "kernel.hung_task_timeout_secs" = 600;
-        echo 600 > /proc/sys/kernel/hung_task_timeout_secs
+      # Panic on out-of-memory conditions rather than letting the
-      '';
+      # OOM killer randomly get rid of processes, since this leads
+      # to failures that are hard to diagnose.
+      "vm.panic_on_oom" = lib.mkDefault 2;
+    };
 
-    boot.initrd.postDeviceCommands =
+    boot.kernelParams = [
-      ''
+      "console=${qemu-common.qemuSerialDevice}"
-        # Using acpi_pm as a clock source causes the guest clock to
+      # Panic if an error occurs in stage 1 (rather than waiting for
-        # slow down under high host load.  This is usually a bad
+      # user intervention).
-        # thing, but for VM tests it should provide a bit more
+      "panic=1" "boot.panic_on_fail"
-        # determinism (e.g. if the VM runs at lower speed, then
+      # Using acpi_pm as a clock source causes the guest clock to
-        # timeouts in the VM should also be delayed).
+      # slow down under high host load.  This is usually a bad
-        echo acpi_pm > /sys/devices/system/clocksource/clocksource0/current_clocksource
+      # thing, but for VM tests it should provide a bit more
-      '';
+      # determinism (e.g. if the VM runs at lower speed, then
-
+      # timeouts in the VM should also be delayed).
-    boot.postBootCommands =
+      "clock=acpi_pm"
-      ''
+    ];
-        # Panic on out-of-memory conditions rather than letting the
-        # OOM killer randomly get rid of processes, since this leads
-        # to failures that are hard to diagnose.
-        echo 2 > /proc/sys/vm/panic_on_oom
-      '';
-
-    # Panic if an error occurs in stage 1 (rather than waiting for
-    # user intervention).
-    boot.kernelParams =
-      [ "console=${qemu-common.qemuSerialDevice}" "panic=1" "boot.panic_on_fail" ];
 
     # `xwininfo' is used by the test driver to query open windows.
     environment.systemPackages = [ pkgs.xorg.xwininfo ];

nixos/modules/virtualisation/qemu-vm.nix

@@ -754,13 +754,13 @@ in
     );
     boot.loader.grub.gfxmodeBios = with cfg.resolution; "${toString x}x${toString y}";
 
-    boot.initrd.extraUtilsCommands =
+    boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
       ''
         # We need mke2fs in the initrd.
         copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
       '';
 
-    boot.initrd.postDeviceCommands =
+    boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
       ''
         # If the disk image appears to be empty, run mke2fs to
         # initialise.
@@ -770,7 +770,7 @@ in
         fi
       '';
 
-    boot.initrd.postMountCommands =
+    boot.initrd.postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
       ''
         # Mark this as a NixOS machine.
         mkdir -p $targetRoot/etc
@@ -789,6 +789,11 @@ in
         ''}
       '';
 
+    systemd.tmpfiles.rules = lib.mkIf config.boot.initrd.systemd.enable [
+      "f /etc/NIXOS 0644 root root -"
+      "d /boot 0644 root root -"
+    ];
+
     # After booting, register the closure of the paths in
     # `virtualisation.additionalPaths' in the Nix database in the VM.  This
     # allows Nix operations to work in the VM.  The path to the

nixos/tests/all-tests.nix

@@ -235,6 +235,7 @@ in
   input-remapper = handleTest ./input-remapper.nix {};
   inspircd = handleTest ./inspircd.nix {};
   installer = handleTest ./installer.nix {};
+  installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix {};
   invoiceplane = handleTest ./invoiceplane.nix {};
   iodine = handleTest ./iodine.nix {};
   ipfs = handleTest ./ipfs.nix {};

nixos/tests/custom-ca.nix

@@ -1,9 +1,14 @@
 # Checks that `security.pki` options are working in curl and the main browser
-# engines: Gecko (via Firefox), Chromium, QtWebEngine (Falkon) and WebKitGTK
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (via qutebrowser) and
-# (via Midori). The test checks that certificates issued by a custom trusted
+# WebKitGTK (via Midori). The test checks that certificates issued by a custom
-# CA are accepted but those from an unknown CA are rejected.
+# trusted CA are accepted but those from an unknown CA are rejected.
 
-import ./make-test-python.nix ({ pkgs, lib, ... }:
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   makeCert = { caName, domain }: pkgs.runCommand "example-cert"
@@ -68,24 +73,8 @@ let
       domain = "bad.example.com";
     };
 
-in
+  webserverConfig =
-
+    { networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
-{
-  name = "custom-ca";
-  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-
-  enableOCR = true;
-
-  nodes.machine = { pkgs, ... }:
-    { imports = [ ./common/user-account.nix ./common/x11.nix ];
-
-      # chromium-based browsers refuse to run as root
-      test-support.displayManager.auto.user = "alice";
-
-      # browsers may hang with the default memory
-      virtualisation.memorySize = 600;
-
-      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
 
       services.nginx.enable = true;
@@ -107,73 +96,98 @@ in
             return 200 'It does not work!';
           '';
         };
-
-      environment.systemPackages = with pkgs; [
-        xdotool
-        firefox
-        chromium
-        qutebrowser
-        midori
-      ];
     };
 
-  testScript = ''
+  curlTest = makeTest {
-    from typing import Tuple
+    name = "custom-ca-curl";
-    def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-        """
+    nodes.machine = { ... }: webserverConfig;
-        Run a shell command as a specific user.
+    testScript = ''
-        """
+        with subtest("Good certificate is trusted in curl"):
-        return machine.execute(f"sudo -u {user} {cmd}")
+            machine.wait_for_unit("nginx")
+            machine.wait_for_open_port(443)
+            machine.succeed("curl -fv https://good.example.com")
+
+        with subtest("Unknown CA is untrusted in curl"):
+            machine.fail("curl -fv https://bad.example.com")
+    '';
+  };
+
+  mkBrowserTest = browser: testParams: makeTest {
+    name = "custom-ca-${browser}";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+    enableOCR = true;
+
+    nodes.machine = { pkgs, ... }:
+      { imports =
+          [ ./common/user-account.nix
+            ./common/x11.nix
+            webserverConfig
+          ];
+
+        # chromium-based browsers refuse to run as root
+        test-support.displayManager.auto.user = "alice";
+
+        # browsers may hang with the default memory
+        virtualisation.memorySize = 600;
+
+        environment.systemPackages = [ pkgs.xdotool pkgs.${browser} ];
+      };
+
+    testScript = ''
+      from typing import Tuple
+      def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+          """
+          Run a shell command as a specific user.
+          """
+          return machine.execute(f"sudo -u {user} {cmd}")
 
 
-    def wait_for_window_as(user: str, cls: str) -> None:
+      def wait_for_window_as(user: str, cls: str) -> None:
-        """
+          """
-        Wait until a X11 window of a given user appears.
+          Wait until a X11 window of a given user appears.
-        """
+          """
 
-        def window_is_visible(last_try: bool) -> bool:
+          def window_is_visible(last_try: bool) -> bool:
-            ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
+              ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
-            if last_try:
+              if last_try:
-                machine.log(f"Last chance to match {cls} on the window list")
+                  machine.log(f"Last chance to match {cls} on the window list")
-            return ret == 0
+              return ret == 0
 
-        with machine.nested("Waiting for a window to appear"):
+          with machine.nested("Waiting for a window to appear"):
-            retry(window_is_visible)
+              retry(window_is_visible)
 
 
-    machine.start()
+      machine.start()
+      machine.wait_for_x()
 
-    with subtest("Good certificate is trusted in curl"):
+      command = "${browser} ${testParams.args or ""}"
-        machine.wait_for_unit("nginx")
+      with subtest("Good certificate is trusted in ${browser}"):
-        machine.wait_for_open_port(443)
+          execute_as(
-        machine.succeed("curl -fv https://good.example.com")
+              "alice", f"{command} https://good.example.com >&2 &"
+          )
+          wait_for_window_as("alice", "${browser}")
+          machine.sleep(4)
+          execute_as("alice", "xdotool key ctrl+r")  # reload to be safe
+          machine.wait_for_text("It works!")
+          machine.screenshot("good${browser}")
+          execute_as("alice", "xdotool key ctrl+w")  # close tab
 
-    with subtest("Unknown CA is untrusted in curl"):
+      with subtest("Unknown CA is untrusted in ${browser}"):
-        machine.fail("curl -fv https://bad.example.com")
+          execute_as("alice", f"{command} https://bad.example.com >&2 &")
+          machine.wait_for_text("${testParams.error}")
+          machine.screenshot("bad${browser}")
+    '';
+  };
 
-    browsers = {
+in
-      "firefox": "Security Risk",
-      "chromium": "not private",
-      "qutebrowser -T": "Certificate error",
-      "midori": "Security"
-    }
 
-    machine.wait_for_x()
+{
-    for command, error in browsers.items():
+  curl = curlTest;
-        browser = command.split()[0]
+} // pkgs.lib.mapAttrs mkBrowserTest {
-        with subtest("Good certificate is trusted in " + browser):
+  firefox = { error = "Security Risk"; };
-            execute_as(
+  chromium = { error = "not private"; };
-                "alice", f"{command} https://good.example.com >&2 &"
+  qutebrowser = { args = "-T"; error = "Certificate error"; };
-            )
+  midori = { error = "Security"; };
-            wait_for_window_as("alice", browser)
+}
-            machine.wait_for_text("It works!")
-            machine.screenshot("good" + browser)
-            execute_as("alice", "xdotool key ctrl+w")  # close tab
-
-        with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com >&2 &")
-            machine.wait_for_text(error)
-            machine.screenshot("bad" + browser)
-            machine.succeed("pkill -f " + browser)
-  '';
-})

nixos/tests/installer-systemd-stage-1.nix

@@ -0,0 +1,33 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+{
+  # Some of these tests don't work with systemd stage 1 yet. Uncomment
+  # them when fixed.
+  inherit (import ./installer.nix { inherit system config pkgs; systemdStage1 = true; })
+    # bcache
+    # btrfsSimple
+    # btrfsSubvolDefault
+    # btrfsSubvols
+    # encryptedFSWithKeyfile
+    # grub1
+    # luksroot
+    # luksroot-format1
+    # luksroot-format2
+    # lvm
+    separateBoot
+    separateBootFat
+    simple
+    simpleLabels
+    simpleProvided
+    simpleSpecialised
+    simpleUefiGrub
+    simpleUefiGrubSpecialisation
+    simpleUefiSystemdBoot
+    # swraid
+    # zfsroot
+    ;
+
+}

nixos/tests/installer.nix

@@ -1,6 +1,7 @@
 { system ? builtins.currentSystem,
   config ? {},
-  pkgs ? import ../.. { inherit system config; }
+  pkgs ? import ../.. { inherit system config; },
+  systemdStage1 ? false
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
@@ -23,6 +24,8 @@ let
         # To ensure that we can rebuild the grub configuration on the nixos-rebuild
         system.extraDependencies = with pkgs; [ stdenvNoCC ];
 
+        ${optionalString systemdStage1 "boot.initrd.systemd.enable = true;"}
+
         ${optionalString (bootLoader == "grub") ''
           boot.loader.grub.version = ${toString grubVersion};
           ${optionalString (grubVersion == 1) ''
@@ -290,6 +293,8 @@ let
           virtualisation.cores = 8;
           virtualisation.memorySize = 1536;
 
+          boot.initrd.systemd.enable = systemdStage1;
+
           # Use a small /dev/vdb as the root disk for the
           # installer. This ensures the target disk (/dev/vda) is
           # the same during and after installation.

nixos/tests/systemd-initrd-luks-keyfile.nix

@@ -32,7 +32,7 @@ in {
         };
       };
       virtualisation.bootDevice = "/dev/mapper/cryptroot";
-      boot.initrd.systemd.contents."/etc/cryptroot.key".source = keyfile;
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
     };
   };
 

nixos/tests/systemd-shutdown.nix

@@ -1,4 +1,6 @@
-import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
+import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : let
+  msg = "Shutting down NixOS";
+in {
   name = "systemd-shutdown";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ das_j ];
@@ -6,7 +8,9 @@ import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
 
   nodes.machine = {
     imports = [ ../modules/profiles/minimal.nix ];
-    boot.initrd.systemd.enable = systemdStage1;
+    systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/shutdown-message".source = pkgs.writeShellScript "shutdown-message" ''
+      echo "${msg}"
+    '';
   };
 
   testScript = ''
@@ -14,7 +18,8 @@ import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
     # .shutdown() would wait for the machine to power off
     machine.succeed("systemctl poweroff")
     # Message printed by systemd-shutdown
-    machine.wait_for_console_text("All filesystems, swaps, loop devices, MD devices and DM devices detached.")
+    machine.wait_for_console_text("Unmounting '/oldroot'")
+    machine.wait_for_console_text("${msg}")
     # Don't try to sync filesystems
     machine.booted = False
   '';

pkgs/applications/audio/LibreArp/default.nix

@@ -0,0 +1,53 @@
+{ stdenv, lib, fetchFromGitLab, cmake, pkg-config, cairo, libxkbcommon
+, xcbutilcursor, xcbutilkeysyms, xcbutil, libXrandr, libXinerama, libXcursor
+, alsa-lib, libjack2, lv2, gcc-unwrapped, curl}:
+
+stdenv.mkDerivation rec {
+  pname = "LibreArp";
+  version = "2.2";
+
+  src = fetchFromGitLab {
+    owner = "LibreArp";
+    repo = "LibreArp";
+    rev = version;
+    hash = "sha256-jCUT/sflO9L57xRTqNR90RbwJ0uZ+xJVXnB3n+FhWBo=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    cairo
+    libxkbcommon
+    xcbutilcursor
+    xcbutilkeysyms
+    xcbutil
+    libXrandr
+    libXinerama
+    libXcursor
+    alsa-lib
+    libjack2
+    lv2
+    curl
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${gcc-unwrapped}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
+    "-DCMAKE_NM=${gcc-unwrapped}/bin/gcc-nm"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/vst3
+    cd LibreArp_artefacts/Release
+    cp -r VST3/LibreArp.vst3 $out/lib/vst3
+  '';
+
+  meta = with lib; {
+    description =
+      "A pattern-based arpeggio generator plugin.";
+    homepage = "https://librearp.gitlab.io/";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ magnetophon ];
+  };
+}

pkgs/applications/audio/LibreArp/lv2.nix

@@ -0,0 +1,53 @@
+{ stdenv, lib, fetchFromGitLab, cmake, pkg-config, cairo, libxkbcommon
+, xcbutilcursor, xcbutilkeysyms, xcbutil, libXrandr, libXinerama, libXcursor
+, alsa-lib, libjack2, lv2, gcc-unwrapped, curl}:
+
+stdenv.mkDerivation rec {
+  pname = "LibreArp-lv2";
+  version = "2.2";
+
+  src = fetchFromGitLab {
+    owner = "LibreArp";
+    repo = "LibreArp";
+    rev = "${version}-lv2";
+    hash = "sha256-j5SksuhC4ZXXILfOpwXNqIu5fO07a/6tiZ5qUo+p0Ug=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    cairo
+    libxkbcommon
+    xcbutilcursor
+    xcbutilkeysyms
+    xcbutil
+    libXrandr
+    libXinerama
+    libXcursor
+    alsa-lib
+    libjack2
+    lv2
+    curl
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${gcc-unwrapped}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
+    "-DCMAKE_NM=${gcc-unwrapped}/bin/gcc-nm"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/lv2
+    cd LibreArp_artefacts/Release
+    cp -r LV2/LibreArp.lv2 $out/lib/lv2
+  '';
+
+  meta = with lib; {
+    description =
+      "A pattern-based arpeggio generator plugin.";
+    homepage = "https://librearp.gitlab.io/";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ magnetophon ];
+  };
+}

pkgs/applications/audio/carla/default.nix

@@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;
 
 stdenv.mkDerivation rec {
   pname = "carla";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "falkTX";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-A0QmyphjsNU06kh2f9rXrR+GkDEI5HqXRA9J82E6qJU=";
+    sha256 = "sha256-FAQTIM5NpcOhLNMf62qiKaxg6QtK5uIJF/XT6KJVnUc=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/cider/default.nix

@@ -2,11 +2,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "cider";
-  version = "1.3.1308";
+  version = "1.4.1.1680";
 
   src = fetchurl {
-    url = "https://1308-429851205-gh.circle-artifacts.com/0/%7E/Cider/dist/artifacts/Cider-${version}.AppImage";
+    url = "https://github.com/ciderapp/cider-releases/releases/download/v${version}/Cider-${builtins.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}-alpha.${builtins.elemAt (lib.splitVersion version) 3}.AppImage";
-    sha256 = "1lbyvn1c8155p039qfzx7jwad7km073phkmrzjm0w3ahdpwz3wgi";
+    sha256 = "sha256-hEv+vfMMH+Trwa1UF5R8EtyYeyiRVLP0BrXOK2+1q8M=";
   };
 
   extraInstallCommands =

pkgs/applications/audio/denemo/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "denemo";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "sha256-B6GbBL/o/z0emT+Iw6XvWmAsJCmIwSGCyV1DkhDyfBY=";
+    sha256 = "sha256-S+WXDGmEf5fx+HYnXJdE5QNOfJg7EqEEX7IMI2SUtV0=";
   };
 
   buildInputs = [

pkgs/applications/audio/musikcube/default.nix

@@ -6,6 +6,7 @@
 , fetchFromGitHub
 , fetchpatch
 , ffmpeg
+, gnutls
 , lame
 , libev
 , libmicrohttpd
@@ -20,17 +21,17 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.96.10";
+  version = "0.97.0";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Aa52pRGq99Pt++aEVZdmVNhhQuBajgfZp39L1AfKvho=";
+    sha256 = "sha256-W9Ng1kqai5qhaDs5KWg/1sOTIAalBXLng1MG8sl/ZOg=";
   };
 
   patches = [
-    # Fix pending upstream inclusion for ncuurses-6.3 support:
+    # Fix pending upstream inclusion for ncurses-6.3 support:
     #  https://github.com/clangen/musikcube/pull/474
     (fetchpatch {
       name = "ncurses-6.3.patch";
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
     boost
     curl
     ffmpeg
+    gnutls
     lame
     libev
     libmicrohttpd

pkgs/applications/audio/pyradio/default.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.8.9.16";
+  version = "0.8.9.17";
 
   propagatedBuildInputs = with python3Packages; [
     requests
@@ -13,8 +13,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "sha256-uerQfyGHWhLbO6UkLSMA1tdfW/8fDQkcm6hYIdwwC7I=";
+    sha256 = "sha256-lfDSD1+xbA6tAKeHKciq/n6YHWS4JTOvjIqOn+FQ2yA=";
   };
 
   checkPhase = ''

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -3,13 +3,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.4.7";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Qz4BNrhK+NPnKBgjXGYl4P2R878LCuMGZxLECawA12E=";
+    sha256 = "sha256-DcxRrVUen+JxMpiLDPfknpwCe962ifaekBeBnxJ0y88=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -31,18 +31,18 @@
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.All";
-    version = "1.3.2";
+    version = "1.3.6";
-    sha256 = "0xcfba8n9zf5m1nb48ilggp03kpki4nv4kx7k7a5w1gxgm6k6j9z";
+    sha256 = "0jdpqy6kxg0lyh4n88wsvrcqc0kk7s7zn5lw7ivwys716m69qrdl";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Charge";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "1xakwnb839dl0qnhqprsnfq8png31iyb0fsngljis5jc8yvb4353";
+    sha256 = "0v5rss6dg7297kq1frhn2pj9gd0rd8g1p5d316x5wkd4w7pmrm2w";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.CLightning";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "0a79p6i3xiq6svv08c4hhihkvqa2ac7fphi3g9i0cwh47ak0k5h2";
+    sha256 = "0qs5p6pm54il23j8yysw0pzvrki37y6z8cd2gdknpz2f3wg7slm9";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Common";
@@ -51,23 +51,23 @@
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Common";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "165p1246fn628hlwdrx7sanlxa6qqpn480rq1asn5r1602w21844";
+    sha256 = "119zplkc7iy9wc95iz1qnyi42fr99ar4hp8a11p708a22w941yi0";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Eclair";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "1vlwm5mw8wffp00xhkx19yavk59b5x540sg81vis3q7hjvvgca5c";
+    sha256 = "08gw1gqng1khxzvvhlwsg6lw1w56ylilg738wi6cbcwy7vl7f6bb";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.LNBank";
-    version = "1.3.1";
+    version = "1.3.4";
-    sha256 = "0qga34vi4fzfr0g4qk0ad8xkqdig2ishmdj9i32s5yrrjrkx7c8d";
+    sha256 = "1vyz63pi5j31y8pz0b4hp9c4j249rszzfcymk3z3b2clwq32s4i4";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.LND";
-    version = "1.3.1";
+    version = "1.3.3";
-    sha256 = "1b70jlyzy9xjvfywzi6i3l3sd4mkknxpni9akdi0phsfqysmy0wl";
+    sha256 = "137azpxxmp2q69bp07ky1jsgnfy9lf0dg5ba8l654flvvrgxaq6y";
   })
   (fetchNuGet {
     pname = "BuildBundlerMinifier";
@@ -89,6 +89,11 @@
     version = "15.0.5";
     sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma";
   })
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
   (fetchNuGet {
     pname = "DigitalRuby.ExchangeSharp";
     version = "0.6.3";
@@ -374,11 +379,6 @@
     version = "3.1.6";
     sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5";
   })
-  (fetchNuGet {
-    pname = "Microsoft.EntityFrameworkCore.Abstractions";
-    version = "6.0.0";
-    sha256 = "1aw13qjkpglc1mm3cv7s73s8fschy8lzdnigsp346b7mycpg7v92";
-  })
   (fetchNuGet {
     pname = "Microsoft.EntityFrameworkCore.Abstractions";
     version = "6.0.1";
@@ -831,8 +831,8 @@
   })
   (fetchNuGet {
     pname = "NBitcoin";
-    version = "6.0.15";
+    version = "6.0.18";
-    sha256 = "038dcl2k88w4cijws3pdnjflgy4lmqx70z0l7yqz355kmxjz8ain";
+    sha256 = "1dr669h68cx6yfzr3n97yzzwbgnsv5g2008diyxngdjm55nh3q9s";
   })
   (fetchNuGet {
     pname = "NBitcoin";
@@ -856,8 +856,8 @@
   })
   (fetchNuGet {
     pname = "NBXplorer.Client";
-    version = "4.1.3";
+    version = "4.2.0";
-    sha256 = "1nh4jj7yg81825hr7cc99qlnfmdm6jibap81qqi8a968b61z4251";
+    sha256 = "1adbn5cbr42cjfvijaf1lffhcrcn0ws1arfi7mrg3kjshbzfgims";
   })
   (fetchNuGet {
     pname = "NETStandard.Library";
@@ -931,13 +931,13 @@
   })
   (fetchNuGet {
     pname = "Npgsql.EntityFrameworkCore.PostgreSQL";
-    version = "6.0.1";
+    version = "6.0.3";
-    sha256 = "108sc62dqdb6ym2ck651kamcv6qf93cmaqzygfblmiglwzi6frnx";
+    sha256 = "0mgwm9psxvrq6vs2cy7m72wnknydgrs71hir2jqal5wbdh8g01np";
   })
   (fetchNuGet {
     pname = "Npgsql";
-    version = "6.0.1";
+    version = "6.0.3";
-    sha256 = "150paiwqxp6zsy5v7vl2a9h3ikzfv3pd04whxifmamq0h1ghw0ld";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
   })
   (fetchNuGet {
     pname = "NSec.Cryptography";
@@ -1086,8 +1086,8 @@
   })
   (fetchNuGet {
     pname = "Selenium.WebDriver.ChromeDriver";
-    version = "98.0.4758.10200";
+    version = "100.0.4896.6000";
-    sha256 = "10mc50gm78zbxrwvxlygzmj2a29liiacv8haax0534c26vj9dwkl";
+    sha256 = "1pfdvxjy4xiw1j7787lf07w9nr0dmj589vf6p4aqmk2cfz8j35c6";
   })
   (fetchNuGet {
     pname = "Selenium.WebDriver";

pkgs/applications/blockchains/lnd/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.14.2-beta";
+  version = "0.14.3-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "sha256-JOKitxxWcTlGlxYR1XpySZlI2fT9jgBrOxNUwT/sqdQ=";
+    sha256 = "sha256-ZTvGFmjhQBIWqMGatMAlX59uVyl1oUKo7L5jiz571Gc";
   };
 
   vendorSha256 = "sha256-shDmJcEyobY7Ih1MHMEY2GQnzAffsH/y4J1bme/bT7I=";

pkgs/applications/blockchains/nbxplorer/default.nix

@@ -2,13 +2,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.2.20";
+  version = "2.3.20";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-C3REnfecNwf3dtk6aLYAEsedHRlIrQZAokXtf6KI8U0=";
+    sha256 = "sha256-cAko5s1bFSI7HOcXg/tZtdMMe0S9zkRBeZ6bispxgwc=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";

pkgs/applications/blockchains/nbxplorer/deps.nix

@@ -1,4 +1,9 @@
 { fetchNuGet }: [
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
   (fetchNuGet {
     pname = "DBTrie";
     version = "1.0.39";
@@ -249,6 +254,11 @@
     version = "1.0.0.18";
     sha256 = "0lgssxafv6cqlw21fb79fm0fcln0clgsk6zadcwrnjv9vampfw7b";
   })
+  (fetchNuGet {
+    pname = "Npgsql";
+    version = "6.0.3";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
+  })
   (fetchNuGet {
     pname = "NuGet.Frameworks";
     version = "5.0.0";
@@ -754,6 +764,11 @@
     version = "4.5.0";
     sha256 = "17labczwqk3jng3kkky73m0jhi8wc21vbl7cz5c0hj2p1dswin43";
   })
+  (fetchNuGet {
+    pname = "System.Runtime.CompilerServices.Unsafe";
+    version = "6.0.0";
+    sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc";
+  })
   (fetchNuGet {
     pname = "System.Runtime.Extensions";
     version = "4.1.0";

pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.162.5";
+  version = "1.163.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "sha256-CQ0TPZH9A37WK+gm7jgCxL5eF+1SxHlsJTTzMVRkHIs=";
+    sha256 = "sha256-4jGLyAE202GAjaypubKGW1edyKqOti/yTwstC/R94iE=";
   };
 
   postPatch = ''

pkgs/applications/editors/cudatext/deps.json

@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2022.04.21",
+    "rev": "2022.04.26",
-    "sha256": "sha256-rPbQ3LNBXNHi9dgQKSaaCsuAY/VIzgq9tqlRXRl2IqU="
+    "sha256": "sha256-aItWkjnFqxeyEywELEBkuvMH1zfI4jJFL10CexSktxU="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",

pkgs/applications/editors/helix/default.nix

@@ -17,6 +17,9 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
+    # not needed at runtime
+    rm -r runtime/grammars/sources
+
     mkdir -p $out/lib
     cp -r runtime $out/lib
   '';

pkgs/applications/editors/texmaker/default.nix

@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "texmaker";
-  version = "5.1.2";
+  version = "5.1.3";
 
   src = fetchurl {
     url = "http://www.xm1math.net/texmaker/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-UmiW8sGuVhEw7seq6BW53Nqejut3K2VB0NyUzpGnEEQ=";
+    sha256 = "0qczc2r01vhap11xmqizwbq21ggn4yjrxim8iqjxaq9w1rg2x9dz";
   };
 
   buildInputs = [ qtbase qtscript poppler zlib qtwebengine ];

pkgs/applications/editors/texstudio/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "texstudio";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "${pname}-org";
     repo = pname;
     rev = version;
-    sha256 = "sha256-MZz8DQT1f6RU+euEED1bbg2MsaqC6+W3RoMk2qfIjr4=";
+    sha256 = "19z9dx8258qbjyzgskkg0xdn88mvx191y1sz4nk15yxsdyf2z3p8";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];

pkgs/applications/emulators/mame/default.nix

@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.242";
+  version = "0.243";
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
-    sha256 = "sha256-06iKM9cpjXuNvChQTPjhb9oQptC4KTZEoxzZk8+x3/k=";
+    sha256 = "sha256-dUgYLNvgvolz9M0ySkGJIZjVMBQwejkxsZ6npg8rIqk=";
   };
 
   hardeningDisable = [ "fortify" ];

pkgs/applications/emulators/ripes/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, pkg-config
+, qtbase
+, qtsvg
+, qtcharts
+, wrapQtAppsHook
+, cmake
+, python3
+}:
+
+mkDerivation rec {
+  pname = "ripes";
+  version = "2.2.4";
+
+  src = fetchFromGitHub {
+    owner = "mortbopet";
+    repo = "Ripes";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-Aal2A4xypzaY7Oa+boIrXk7ITNKnh5OZIP7DkJjcGu4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtsvg
+    qtcharts
+  ];
+
+  installPhase = ''
+    install -D Ripes $out/bin/Ripes
+    cp -r ${src}/appdir/usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "A graphical processor simulator and assembly editor for the RISC-V ISA";
+    homepage = "https://github.com/mortbopet/Ripes";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rewine ];
+  };
+}

pkgs/applications/finance/irpf/default.nix

@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "irpf";
-  version = "2022-1.3";
+  version = "2022-1.4";
 
   src = let
     year = lib.head (lib.splitVersion version);
   in fetchzip {
     url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${version}.zip";
-    sha256 = "sha256-nAmcVPSnMIWuq2zj1xq/657RmzaSmdtxlI9cp9v5P0A=";
+    sha256 = "sha256-AKBcBkoPDBknUOyndf9hNigzDHjjgi2v0n1Rs+//j/8=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper copyDesktopItems ];

pkgs/applications/gis/grass/default.nix

@@ -1,25 +1,25 @@
 { lib, stdenv, fetchFromGitHub, flex, bison, pkg-config, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg, makeWrapper, wxGTK30, wxmac, netcdf, blas
+, cairo, readline, ffmpeg, makeWrapper, wxGTK31, wxmac, netcdf, blas
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python3Packages, libLAS, proj-datumgrid
 , zstd, pdal, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "grass";
-  version = "7.8.6";
+  version = "8.0.1";
 
   src = with lib; fetchFromGitHub {
     owner = "OSGeo";
     repo = "grass";
     rev = version;
-    sha256 = "sha256-zvZqFWuxNyA+hu+NMiRbQVdzzrQPsZrdGdfVB17+SbM=";
+    sha256 = "sha256-rcOT21HRJDR+DEYsZn6BjOOhy28DWapz9PN7cRAdWGc=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite
   readline ffmpeg makeWrapper netcdf geos postgresql libmysqlclient blas
   libLAS proj-datumgrid zstd wrapGAppsHook ]
-    ++ lib.optionals stdenv.isLinux [ cairo pdal wxGTK30 ]
+    ++ lib.optionals stdenv.isLinux [ cairo pdal wxGTK31 ]
     ++ lib.optional stdenv.isDarwin wxmac
     ++ (with python3Packages; [ python python-dateutil numpy ]
       ++ lib.optional stdenv.isDarwin wxPython_4_0
@@ -68,41 +68,15 @@ stdenv.mkDerivation rec {
   /* Ensures that the python script run at build time are actually executable;
    * otherwise, patchShebangs ignores them.  */
   postConfigure = ''
-    chmod +x scripts/d.out.file/d.out.file.py \
+    for f in $(find . -name '*.py'); do
-      scripts/d.to.rast/d.to.rast.py \
+      chmod +x $f
-      scripts/d.what.rast/d.what.rast.py \
-      scripts/d.what.vect/d.what.vect.py \
-      scripts/g.extension/g.extension.py \
-      scripts/g.extension.all/g.extension.all.py \
-      scripts/r.drain/r.drain.py \
-      scripts/r.pack/r.pack.py \
-      scripts/r.import/r.import.py \
-      scripts/r.tileset/r.tileset.py \
-      scripts/r.unpack/r.unpack.py \
-      scripts/v.clip/v.clip.py \
-      scripts/v.rast.stats/v.rast.stats.py \
-      scripts/v.to.lines/v.to.lines.py \
-      scripts/v.what.strds/v.what.strds.py \
-      scripts/v.unpack/v.unpack.py \
-      scripts/wxpyimgview/*.py \
-      gui/wxpython/animation/g.gui.animation.py \
-      gui/wxpython/datacatalog/g.gui.datacatalog.py \
-      gui/wxpython/rlisetup/g.gui.rlisetup.py \
-      gui/wxpython/vdigit/g.gui.vdigit.py \
-      temporal/t.rast.accumulate/t.rast.accumulate.py \
-      temporal/t.rast.accdetect/t.rast.accdetect.py \
-      temporal/t.rast.algebra/t.rast.algebra.py \
-      temporal/t.rast3d.algebra/t.rast3d.algebra.py \
-      temporal/t.vect.algebra/t.vect.algebra.py \
-      temporal/t.downgrade/t.downgrade.py \
-      temporal/t.select/t.select.py
-    for d in gui lib scripts temporal tools; do
-      patchShebangs $d
     done
+
+    patchShebangs */
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/grass78 \
+    wrapProgram $out/bin/grass \
     --set PYTHONPATH $PYTHONPATH \
     --set GRASS_PYTHON ${python3Packages.python.interpreter} \
     --suffix LD_LIBRARY_PATH ':' '${gdal}/lib'
@@ -117,6 +91,6 @@ stdenv.mkDerivation rec {
     description = "GIS software suite used for geospatial data management and analysis, image processing, graphics and maps production, spatial modeling, and visualization";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [mpickering];
+    maintainers = with lib.maintainers; [ mpickering willcohen ];
   };
 }

pkgs/applications/graphics/cloudcompare/default.nix

@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , mkDerivation
 , fetchFromGitHub
 , fetchpatch
@@ -114,5 +115,6 @@ mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ nh2 ];
     platforms = with platforms; linux; # only tested here; might work on others
+    broken = stdenv.isLinux; # plugins/core/IO/qPDALIO/CMakeFiles/QPDAL_IO_PLUGIN.dir/src/LASFilter.cpp.o] Error 1
   };
 }

pkgs/applications/graphics/ovito/default.nix

@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "ovito";
-  version = "3.6.0";
+  version = "3.7.1";
 
   src = fetchFromGitLab {
     owner = "stuko";
     repo = "ovito";
     rev = "v${version}";
-    sha256 = "sha256-yQ8gSe/QM1RRNxk4bDJ+K5QX0eYjZ+iG3QOHj01tJhY=";
+    sha256 = "sha256-6b/yqfrpeZ6i6DoPe3lcftvuzwvK7rfZhgyHc9GtyBs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/fspy/default.nix

@@ -2,7 +2,6 @@
 let
   pname = "fspy";
   version = "1.0.3";
-  name = "${pname}-v${version}";
 
   src = fetchurl {
     url = "https://github.com/stuffmatic/fSpy/releases/download/v${version}/${pname}-${version}-x86_64.AppImage";
@@ -10,10 +9,10 @@ let
   };
 
 in appimageTools.wrapType2 {
-  inherit name src;
+  inherit pname version src;
 
   extraInstallCommands = ''
-    mv $out/bin/${name} $out/bin/${pname}
+    mv $out/bin/${pname}-v${version} $out/bin/${pname}
   '';
 
   meta = with lib; {

pkgs/applications/misc/gallery-dl/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.21.1";
+  version = "1.21.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-oLVrYM7F9JFDYgQL/XgJS9LeUexqcSlvmkwyAk1bpoY=";
+    sha256 = "sha256-xn+Y8WOIH6zkExO3ZNya3ZBwh90oSjSk00xfO0c23To=";
   };
 
   propagatedBuildInputs = [ requests yt-dlp ];

pkgs/applications/misc/gnome-secrets/default.nix

@@ -5,7 +5,6 @@
 , gettext
 , fetchFromGitLab
 , python3Packages
-, libpwquality
 , wrapGAppsHook4
 , gtk4
 , glib
@@ -17,7 +16,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gnome-secrets";
-  version = "6.1";
+  version = "6.4";
   format = "other";
   strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943
 
@@ -26,7 +25,7 @@ python3Packages.buildPythonApplication rec {
     owner = "World";
     repo = "secrets";
     rev = version;
-    sha256 = "sha256-TBGNiiR0GW8s/Efi4/Qqvwd87Ir0gCLGPfBmmqqSwQ8=";
+    sha256 = "sha256-qO2DJ/Eb9+G1R3un2+n9Tf6oxpGrEuH3SBrajQ9tCPU=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +44,7 @@ python3Packages.buildPythonApplication rec {
     glib
     gdk-pixbuf
     libadwaita
+    python3Packages.libpwquality.dev # Use python-enabled libpwquality
   ];
 
   propagatedBuildInputs = with python3Packages; [
@@ -52,14 +52,9 @@ python3Packages.buildPythonApplication rec {
     construct
     pykeepass
     pyotp
-  ] ++ [
+    libpwquality
-    libpwquality # using the python bindings
   ];
 
-  postPatch = ''
-    substituteInPlace meson_post_install.py --replace "gtk-update-icon-cache" "gtk4-update-icon-cache";
-  '';
-
   # Prevent double wrapping, let the Python wrapper use the args in preFixup.
   dontWrapGApps = true;
 
@@ -76,4 +71,3 @@ python3Packages.buildPythonApplication rec {
     maintainers = with maintainers; [ mvnetbiz ];
   };
 }
-

pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.96.0";
+  version = "0.98.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3O+ZdOloh5gILPQssztt7s/MwRgDOnpJItwLn7FXnPU=";
+    sha256 = "sha256-oZzjnuu6C522qBs/A83jKIZ3dUrJRmKJ/C8NRX31yvw=";
   };
 
-  vendorSha256 = "sha256-TgE/ToHBg2QBgtk0gPZTV/icIbQN14RpVAbL/8b+W0U=";
+  vendorSha256 = "sha256-HM5IE/rVNWyTfjUtVOlw+69+YoWYlLtU2FOXeH2BAi8=";
 
   doCheck = false;
 

pkgs/applications/misc/lighthouse/default.nix

@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
-, libX11, libxcb, cairo, gtk2, pango, python27, python3
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lighthouse";
-  version = "unstable-2016-07-20";
-
-  src = fetchFromGitHub {
-    owner = "emgram769";
-    repo = "lighthouse";
-    rev = "d1813ef8e2aca9f6b3609b1e0c6d1d5ee683281a";
-    sha256 = "0v6ylm49f1b44zwq1y1gqxp2csyqblplr24ajllc2q3r0sc9m1ys";
-   };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    libX11 libxcb cairo gtk2 pango python27 python3
-  ];
-
-  makeFlags = [ "PREFIX=\${out}" ];
-
-  preFixup = "chmod +x $out/share/lighthouse/.config/lighthouse/google.py";
-
-  postFixup = "chmod -x $out/share/lighthouse/.config/lighthouse/google.py";
-
-  meta = with lib; {
-    description = "A simple flexible popup dialog to run on X";
-    homepage = "https://github.com/emgram769/lighthouse";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ramkromberg ];
-    platforms = platforms.linux;
-  };
-
-}

pkgs/applications/misc/octoprint/default.nix

@@ -9,251 +9,11 @@
 , packageOverrides ? self: super: { }
 }:
 let
-  mkOverride = attrname: version: sha256:
-    self: super: {
-      ${attrname} = super.${attrname}.overridePythonAttrs (
-        oldAttrs: {
-          inherit version;
-          src = oldAttrs.src.override {
-            inherit version sha256;
-          };
-        }
-      );
-    };
 
   py = python3.override {
     self = py;
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) (
       [
-        # the following dependencies are non trivial to update since later versions introduce backwards incompatible
-        # changes that might affect plugins, or due to other observed problems
-        (mkOverride "click" "7.1.2" "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a")
-        (mkOverride "flask-babel" "1.0.0" "0gmb165vkwv5v7dxsxa2i3zhafns0fh938m2zdcrv4d8z5l099yn")
-        (mkOverride "itsdangerous" "1.1.0" "321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19")
-        (mkOverride "jinja2" "2.11.3" "a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6")
-        (mkOverride "markdown" "3.1.1" "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a")
-        (mkOverride "markupsafe" "1.1.1" "29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b")
-
-        # black uses hash, not sha256 identifier. Newer black version requires newer click version
-        (
-          self: super: {
-            black = super.black.overridePythonAttrs (oldAttrs: rec {
-              version = "21.12b0";
-              src = oldAttrs.src.override {
-                inherit version;
-                hash = "sha256-d7gPaTpWni5SeVhFljTxjfmwuiYluk4MLV2lvkLm8rM=";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # tests need network
-        (
-          self: super: {
-            curio = super.curio.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_timeout"
-                "test_ssl_outgoing"
-              ];
-            });
-          }
-        )
-
-        # tests need network
-        (
-          self: super: {
-            trio = super.trio.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_local_address_real"
-              ];
-              disabledTestPaths = [
-                "trio/tests/test_exports.py"
-                "trio/tests/test_socket.py"
-              ];
-            });
-          }
-        )
-
-        # Requires flask<2, cannot mkOverride because tests need to be disabled
-        (
-          self: super: {
-            flask = super.flask.overridePythonAttrs (oldAttrs: rec {
-              version = "1.1.4";
-              src = oldAttrs.src.override {
-                inherit version;
-                sha256 = "15ni4xlm57a15f5hipp8w0c9zba20179bvfns2392fiq1lcbdghg";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # Requires werkezug<2, cannot mkOverride because tests need to be disabled
-        (
-          self: super: {
-            werkzeug = super.werkzeug.overridePythonAttrs (oldAttrs: rec {
-              version = "1.0.1";
-              src = oldAttrs.src.override {
-                inherit version;
-                sha256 = "6c80b1e5ad3665290ea39320b91e1be1e0d5f60652b964a3070216de83d2e47c";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # Requires unidecode>=0.04.14,<0.05. Upstream changed the source naming between releases
-        (
-          self: super: {
-            unidecode = super.unidecode.overridePythonAttrs (oldAttrs: rec {
-              version = "0.04.21";
-              src = fetchFromGitHub {
-                owner = "avian2";
-                repo = "unidecode";
-                rev = "release-${version}";
-                sha256 = "0p5bkibv0xm1265dlfrz3zq3k9bbx07gl8zyq8mvvb8hi7p5lifg";
-              };
-            });
-          }
-        )
-
-        # Requires websocket-client <1.0, >=0.57. Cannot do mkOverride b/c differing underscore/hyphen in pypi source name
-        (
-          self: super: {
-            websocket-client = super.websocket-client.overridePythonAttrs (
-              oldAttrs: rec {
-                version = "0.59.0";
-                src = oldAttrs.src.override {
-                  inherit version;
-                  sha256 = "0p0cz2mdissq7iw1n7jrmsfir0jfmgs1dvnpnrx477ffx9hbsxnk";
-                };
-                propagatedBuildInputs = with self; [
-                  six
-                  pysocks
-                ];
-                disabledTests = [
-                  "testConnect" # requires network access
-                ];
-              }
-            );
-          }
-        )
-
-        # Octoprint needs zeroconf >=0.24 <0.25. This can't be done via mkOverride, because in zeroconf 0.32
-        # the super package was migrated to fetchFromGitHub.
-        (
-          self: super: {
-            zeroconf = super.zeroconf.overrideAttrs (oldAttrs: rec {
-              version = "0.24.5";
-              src = super.fetchPypi {
-                inherit (oldAttrs) pname;
-                inherit version;
-                sha256 = "0jpgd0rk91si93857mjrizan5gc42kj1q4fi4160qgk68la88fl9";
-              };
-              pythonImportsCheck = [
-                "zeroconf"
-              ];
-              buildInputs = with self; [
-                pytestCheckHook
-                nose
-              ];
-              pytestFlagsArray = [ "zeroconf/test.py" ];
-            });
-          }
-        )
-
-        # Octoprint pulls in celery indirectly but has no support for the up-to-date releases
-        (
-          self: super: {
-            celery = super.celery.overrideAttrs (oldAttrs: rec {
-              version = "5.0.0";
-              src = oldAttrs.src.override {
-                inherit version;
-                hash = "sha256-MTkw/d3nA9jjcCmjBL+RQpzRGu72PFfebayp2Vjh8lU=";
-              };
-              disabledTestPaths = [
-                "t/unit/backends/test_mongodb.py"
-              ];
-            });
-          }
-        )
-
-        # Octoprint would allow later sentry-sdk releases but not later click releases
-        (
-          self: super: {
-            sentry-sdk = super.sentry-sdk.overrideAttrs (oldAttrs: rec {
-              pname = "sentry-sdk";
-              version = "1.4.3";
-
-              src = fetchFromGitHub {
-                owner = "getsentry";
-                repo = "sentry-python";
-                rev = version;
-                sha256 = "sha256-vdE6eqELMM69CWHaNYhF0HMCTV3tQsJlMHAA96oCy8c=";
-              };
-              disabledTests = [
-                "test_apply_simulates_delivery_info"
-                "test_auto_enabling_integrations_catches_import_error"
-                "test_leaks"
-              ];
-              disabledTestPaths = [
-                # Don't test integrations
-                "tests/integrations"
-                # test crashes on aarch64
-                "tests/test_transport.py"
-              ];
-            });
-          }
-        )
-
-        # Octoprint fails due to a newly added test in pytest-httpbin
-        # see https://github.com/NixOS/nixpkgs/issues/159864
-        (
-          self: super: {
-            pytest-httpbin = super.pytest-httpbin.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_redirect_location_is_https_for_secure_server"
-              ];
-            });
-          }
-        )
-
-        # All test fail on aarch64
-        (
-          self: super: {
-            azure-core = super.azure-core.overridePythonAttrs (oldAttrs: rec {
-              doCheck = stdenv.buildPlatform == "x86_64-linux";
-            });
-          }
-        )
-
-        # needs network
-        (
-          self: super: {
-            falcon = super.falcon.overridePythonAttrs (oldAttrs: rec {
-              #pytestFlagsArray = [ "-W ignore::DeprecationWarning" ];
-              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
-                "tests/asgi/test_asgi_servers.py"
-              ];
-            });
-          }
-        )
-
-        # update broke some tests
-        (
-          self: super: {
-            sanic = super.sanic.overridePythonAttrs (oldAttrs: rec {
-              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
-                "test_cli.py"
-                "test_cookies.py"
-                # requires network
-                "test_worker.py"
-              ];
-            });
-          }
-        )
-
         # Built-in dependency
         (
           self: super: {
@@ -294,14 +54,14 @@ let
           self: super: {
             octoprint-pisupport = self.buildPythonPackage rec {
               pname = "OctoPrint-PiSupport";
-              version = "2021.10.28";
+              version = "2022.3.28";
               format = "setuptools";
 
               src = fetchFromGitHub {
                 owner = "OctoPrint";
                 repo = "OctoPrint-PiSupport";
                 rev = version;
-                sha256 = "01bpvv1sn3113fdpw6b90c2rj8lqay118x609yy64z9ccm93khl9";
+                sha256 = "yzE/jz604nX/CHcW3aa7goH1ey8qZ7rLw31SMfNKJZM=";
               };
 
               # requires octoprint itself during tests
@@ -314,13 +74,13 @@ let
           self: super: {
             octoprint = self.buildPythonPackage rec {
               pname = "OctoPrint";
-              version = "1.7.3";
+              version = "1.8.0rc5";
 
               src = fetchFromGitHub {
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                sha256 = "sha256-U6g7WysHHOlZ4p5BM4tw3GGAxQmxv6ltYgAp1rO/eCg=";
+                sha256 = "sha256-FeT45w6VXaFV4BsuOMk58nxxiu9jhCNnA2F7Uh/3sB0=";
               };
 
               propagatedBuildInputs = with super; [
@@ -368,7 +128,7 @@ let
                 werkzeug
                 wrapt
                 zeroconf
-                zipstream-new
+                zipstream-ng
               ] ++ lib.optionals stdenv.isDarwin [
                 py.pkgs.appdirs
               ];
@@ -406,6 +166,8 @@ let
                     "watchdog"
                     "wrapt"
                     "zeroconf"
+                    "Flask-Login"
+                    "werkzeug"
                   ];
                 in
                 ''

pkgs/applications/misc/osmscout-server/default.nix

@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromGitHub, fetchpatch, pkg-config
+{ lib, mkDerivation, fetchFromGitHub, pkg-config
 , qmake, qttools, kirigami2, qtquickcontrols2, qtlocation
 , libosmscout, valhalla, libpostal, osrm-backend, protobuf
 , libmicrohttpd_0_9_70, sqlite, marisa, kyotocabinet, boost
@@ -14,30 +14,16 @@ let
 in
 mkDerivation rec {
   pname = "osmscout-server";
-  version = "1.17.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "rinigus";
     repo = "osmscout-server";
     rev = version;
-    sha256 = "0rpsi6nyhcz6bv0jab4vixkxhjmn84xi0q2xz15a097hn46cklx9";
+    sha256 = "sha256-I14nQL0H2rMga+RDdAjykqmf7QIZveA6oGWu5PfZ89s=";
     fetchSubmodules = true;
   };
 
-  # Two patches required to work with valhalla 3.1
-  patches = [
-    # require C++14 to match latest Valhalla
-    (fetchpatch {
-      url = "https://github.com/rinigus/osmscout-server/commit/78b41b9b4c607fe9bfd6fbd61ae31cb7c8a725cd.patch";
-      sha256 = "0gk9mdwa75awl0bj30gm8waj454d8k2yixxwh05m0p550cbv3lg0";
-    })
-    # add Valhalla 3.1 config
-    (fetchpatch {
-      url = "https://github.com/rinigus/osmscout-server/commit/584de8bd47700053960fa139a2d7f8d3d184c876.patch";
-      sha256 = "0liz72n83q93bzzyyiqjkxa6hp9zjx7v9rgsmpwf88gc4caqm2dz";
-    })
-  ];
-
   nativeBuildInputs = [ qmake pkg-config qttools ];
   buildInputs = [
     kirigami2 qtquickcontrols2 qtlocation
@@ -45,13 +31,6 @@ mkDerivation rec {
     libpostal sqlite marisa kyotocabinet boost protobuf date
   ];
 
-  # OSMScout server currently defaults to an earlier version of valhalla,
-  # but valhalla 3.1 support has been added. (See patches above)
-  # Replace the default valhalla.json with the valhalla 3.1 version
-  postPatch = ''
-    mv data/valhalla.json-3.1 data/valhalla.json
-  '';
-
   qmakeFlags = [
     "SCOUT_FLAVOR=kirigami" # Choose to build the kirigami UI variant
     "CONFIG+=disable_mapnik" # Disable the optional mapnik backend

pkgs/applications/misc/vit/default.nix

@@ -8,18 +8,16 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "vit";
-  version = "2.1.0";
+  version = "2.2.0";
-  disabled = lib.versionOlder python.version "3.6";
+  disabled = lib.versionOlder python.version "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fd34f0b827953dfdecdc39f8416d41c50c24576c33a512a047a71c1263eb3e0f";
+    sha256 = "sha256-6GbIc5giuecxUqswyaAJw675R1M8BvelyyRNFcTqKW8=";
   };
 
   propagatedBuildInputs = [
-    pytz
     tasklib
-    tzlocal
     urwid
   ];
 

pkgs/applications/networking/browsers/chromium/common.nix

@@ -61,13 +61,6 @@ let
     url = "https://chromium.googlesource.com/chromium/tools/build/+/e77882e0dde52c2ccf33c5570929b75b4a2a2522/recipes/recipe_modules/chromium/resources/clang-format?format=TEXT";
     sha256 = "0ic3hn65dimgfhakli1cyf9j3cxcqsf1qib706ihfhmlzxf7256l";
   };
-  # https://webrtc-review.googlesource.com/c/src/+/255601
-  webrtcWaylandScreenshareCoredumpFix = fetchurl {
-    # PipeWire capturer: check existence of cursor metadata
-    name = "webrtc-wayland-screenshare-coredump-fix.patch";
-    url = "https://webrtc-review.googlesource.com/changes/src~255601/revisions/2/patch?download";
-    hash = "sha256-PHGwEoYhMa+ZL2ner10FwdGUWUxsVr+HWuZOAEugYDY=";
-  };
 
   # The additional attributes for creating derivations based on the chromium
   # source tree.
@@ -169,8 +162,14 @@ let
       ./patches/widevine-79.patch
     ];
 
-    postPatch = optionalString (versionRange "100" "101") ''
+    postPatch = optionalString (chromiumVersionAtLeast "102") ''
-      base64 --decode ${webrtcWaylandScreenshareCoredumpFix} | patch -p1 -d third_party/webrtc
+      # Workaround/fix for https://bugs.chromium.org/p/chromium/issues/detail?id=1313361:
+      substituteInPlace BUILD.gn \
+        --replace '"//infra/orchestrator:orchestrator_all",' ""
+      # Disable build flags that require LLVM 15:
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace '"-Xclang",' "" \
+        --replace '"-no-opaque-pointers",' ""
     '' + ''
       # remove unused third-party
       for lib in ${toString gnSystemLibraries}; do
@@ -289,7 +288,6 @@ let
       enable_widevine = true;
       # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture:
       rtc_use_pipewire = true;
-    } // optionalAttrs (chromiumVersionAtLeast "101") {
       # Disable PGO because the profile data requires a newer compiler version (LLVM 14 isn't sufficient):
       chrome_pgo_phase = 0;
     } // optionalAttrs proprietaryCodecs {

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -19,22 +19,9 @@
     }
   },
   "beta": {
-    "version": "101.0.4951.41",
+    "version": "102.0.5005.27",
-    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
+    "sha256": "0fznry72w50dpijg55yxkaz1hv1zkvvxini3yxadwpfa5y0mpn3m",
-    "sha256bin64": "1jbj5cykxamf32c1s4gsid1wxcsdf4hng2d19q9h7b2ashkvvrbi",
+    "sha256bin64": "0k543zz3njsn5kh1wf90hqywll9s6g4xrnh2zqph066l91gj17rx",
-    "deps": {
-      "gn": {
-        "version": "2022-03-14",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
-        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
-      }
-    }
-  },
-  "dev": {
-    "version": "102.0.5005.22",
-    "sha256": "12s4w8qs71a7r13mm28w6kld2q21srwalsy2yfcys4kjmfp4gqfa",
-    "sha256bin64": "07jj7nvgalzvxacx6srccc82ggckzj4x10w1k2zskcyxpblnd7fc",
     "deps": {
       "gn": {
         "version": "2022-04-14",
@@ -44,20 +31,33 @@
       }
     }
   },
-  "ungoogled-chromium": {
+  "dev": {
-    "version": "100.0.4896.127",
+    "version": "103.0.5028.0",
-    "sha256": "0kgq38dy9mjyc44556i9gxhlsgd7dfvv1xi1ibk92b4p7i2y6427",
+    "sha256": "06i6kgsdril5gfbjl1sh0z5hqvq64bchhb2z8w0h8cw9977bvqk6",
-    "sha256bin64": "0mm6lix14bf4ca440dyccnq54z0qvn5c886ghfyzy2q0bqzbq4nh",
+    "sha256bin64": "09hxvcv5n1kd4qnwh6pxzmrlnc8xijm7rwb1c8c57v0jjb32x9ry",
     "deps": {
       "gn": {
-        "version": "2022-01-21",
+        "version": "2022-04-26",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
+        "rev": "ced9fbfe6943854e65ada4ac1849d1fa4cb19348",
-        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+        "sha256": "14fgjsfqihmma1cr8n30n37vxkf20paa6swq2yxn1agjvfr9cdvl"
+      }
+    }
+  },
+  "ungoogled-chromium": {
+    "version": "101.0.4951.41",
+    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
+    "sha256bin64": "12nzzsp4040mwc7jah5w0p58ckv8s16wv6ylf6vlmfby06a4xlkq",
+    "deps": {
+      "gn": {
+        "version": "2022-03-14",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
+        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
       },
       "ungoogled-patches": {
-        "rev": "100.0.4896.127-1",
+        "rev": "101.0.4951.41-1",
-        "sha256": "192kyhr0fa97csciv5kp496y9zwcsknwlrmdr4jic3rvv8ig1q9y"
+        "sha256": "19m31bd04yvba3w5iymkxfjnmilas3cfp383m9fl6pd4wwhy9md0"
       }
     }
   }

pkgs/applications/networking/browsers/firefox/librewolf/src.json

@@ -1,8 +1,8 @@
 {
-  "packageVersion": "99.0.1-3",
+  "packageVersion": "99.0.1-4",
   "source": {
-    "rev": "99.0.1-3",
+    "rev": "99.0.1-4",
-    "sha256": "0ag4n86hvyp6kx3hp60yn7q45rgjbx7054frj6226ni2ribjx4ln"
+    "sha256": "0s0r9smyfr8yhbgp67569ki3lkc2dyv1dw9735njja2gy0nahgni"
   },
   "firefox": {
     "version": "99.0.1",

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -366,6 +366,11 @@ stdenv.mkDerivation rec {
       PULSE_SERVER="\''${PULSE_SERVER:-}" \
       PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
       \
+      MOZ_ENABLE_WAYLAND=\$MOZ_ENABLE_WAYLAND \
+      WAYLAND_DISPLAY="\$WAYLAND_DISPLAY" \
+      XDG_RUNTIME_DIR="\$XDG_RUNTIME_DIR" \
+      XCURSOR_PATH="\$XCURSOR_PATH" \
+      \
       APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \
       \
       TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \
@@ -404,7 +409,9 @@ stdenv.mkDerivation rec {
     LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null
 
     echo "Checking tor-browser wrapper ..."
-    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
+    DISPLAY="" MOZ_ENABLE_WAYLAND="" WAYLAND_DISPLAY="" XAUTHORITY="" \
+      XCURSOR_PATH="" XDG_RUNTIME_DIR="" XDG_SESSION_TYPE="" \
+      DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
       $out/bin/tor-browser --version >/dev/null
   '';
 

pkgs/applications/networking/cluster/flink/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "flink";
-  version = "1.14.3";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.11.tgz";
-    sha256 = "sha256-dst0Q1AlDdggtOwYROoV6QcBLRNfmGTo7DL2BV/5PB4=";
+    sha256 = "sha256-qvWUh+EQT/MljN5LCX2JLMEapIEGAbAljrCMTYsFqtw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.29.4";
+  version = "0.29.5";
-  sha256 = "110wbz5dyzrzndr937in663cs9hwfs3glgm63f0md9gjj67mz0kk";
+  sha256 = "1nqi7yk5d66fcjf6kyjivm3cbaqkj36ajgfvjm995q7cla2xyawm";
-  manifestsSha256 = "14vrkadv2gsz360s0naqr002sw8n5kvgskc13yx936mcz2vs465y";
+  manifestsSha256 = "09rq7wiv3ixdp0p8isfp26vikyx523arzdyizi6yb90q6dl6hgc0";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-/8gRyaXTCWe+F4X3z5iT8QhE3LdiNEYKHjtoYKJB/HU=";
+  vendorSha256 = "sha256-dQV/8NF+sMiEoFr2wtR/oGqqn72JwH/JGbMREHIr/Tw=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests

pkgs/applications/networking/cluster/fluxcd/update.sh

@@ -3,36 +3,43 @@
 
 set -x -eu -o pipefail
 
-cd $(dirname "${BASH_SOURCE[0]}")
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+FLUXCD_PATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
-TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; fluxcd.version or (builtins.parseDrvName fluxcd.name).version" | tr -d '"')"
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
 
-VERSION=$(echo ${TAG} | sed 's/^v//')
+if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
+    SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz)
+    SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz)
 
-SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${TAG}.tar.gz)
+    setKV () {
+        sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/default.nix"
+    }
 
-SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${TAG}/manifests.tar.gz)
+    setKV version ${LATEST_VERSION}
+    setKV sha256 ${SHA256}
+    setKV manifestsSha256 ${SPEC_SHA256}
+    setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
 
-setKV () {
+    set +e
-    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
+    VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-}
+    set -e
 
-setKV version ${VERSION}
+    if [ -n "${VENDOR_SHA256:-}" ]; then
-setKV sha256 ${SHA256}
+        setKV vendorSha256 ${VENDOR_SHA256}
-setKV manifestsSha256 ${SPEC_SHA256}
+    else
-setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
+        echo "Update failed. VENDOR_SHA256 is empty."
+        exit 1
+    fi
 
-cd ../../../../../
+    # `git` flag here is to be used by local maintainers to speed up the bump process
-set +e
+    if [ "$1" = "git" ]; then
-VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+        git switch -c "package-fluxcd-${LATEST_VERSION}"
-set -e
+        git add "$FLUXCD_PATH"/default.nix
-
+        git commit -m "fluxcd: ${OLD_VERSION} -> ${LATEST_VERSION}"
-cd - > /dev/null
+    fi
-
-if [ -n "${VENDOR_SHA256:-}" ]; then
-    setKV vendorSha256 ${VENDOR_SHA256}
 else
-    echo "Update failed. VENDOR_SHA256 is empty."
+    echo "fluxcd is already up-to-date at $OLD_VERSION"
-    exit 1
 fi
-

pkgs/applications/networking/cluster/talosctl/default.nix

@@ -1,10 +1,10 @@
 { lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 let
   # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.3";
+  version = "1.0.4";
-  sha256 = "sha256-unGr+T2uYg7/4pAXf8vp9Hpi6IrCsLCqGbyBC7QXGX8=";
+  sha256 = "sha256-kO48MRQDQGDUvFfsxAt+CAHn2EGU44NMpSKDWnNwAdk=";
-  vendorSha256 = "sha256-9NYr5Ok9oQ1ajYFiTeU9ztmX/55UROBjNawLGjm4HYU=";
+  vendorSha256 = "sha256-QcD5MKQO51ZZ/NvVIiAmDsN6wLI2N8YkhA387KB77W8=";
-  pkgsVersion = "v1.0.0-8-g76f8c5b";
+  pkgsVersion = "v1.0.0-10-gbf81bd2";
   extrasVersion = "v1.0.0-2-gc5d3ab0";
 in
 buildGoModule rec {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -17,6 +17,15 @@
     "vendorSha256": "1gpbc72q7mjyjxk75dyfi3j2fk6glgz0a15m2pq7clyc35kapnkc",
     "version": "2.8.0"
   },
+  "age": {
+    "owner": "clementblaise",
+    "provider-source-address": "registry.terraform.io/clementblaise/age",
+    "repo": "terraform-provider-age",
+    "rev": "v0.1.1",
+    "sha256": "sha256-bJrzjvkrCX93bNqCA+FdRibHnAw6cb61StqtwUY5ok4=",
+    "vendorSha256": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk=",
+    "version": "0.1.1"
+  },
   "aiven": {
     "owner": "aiven",
     "provider-source-address": "registry.terraform.io/aiven/aiven",

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "lib/electron-main.js",
-  "version": "1.10.10",
+  "version": "1.10.11",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {
@@ -89,6 +89,7 @@
   },
   "build": {
     "appId": "im.riot.app",
+    "asarUnpack": "**/*.node",
     "files": [
       "package.json",
       {

pkgs/applications/networking/instant-messengers/element/pin.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.10.10",
+  "version": "1.10.11",
-  "desktopSrcHash": "Atgcu+K28pScYokS/lTu+/mMeEC+1yTcn3Akq+KZJNY=",
+  "desktopSrcHash": "n74KFmHI6ZQWBEJCR55VZHS//myh2RePcJRVOmZ6XHo=",
   "desktopYarnHash": "0jm0i1yyfkg1ll11pb3qif1vdxx6rp0yl9kd8jg9nhsg2jzw66pr",
-  "webHash": "1xp0rhw3k2znwvqqikhd771l2n6xyx8npcz87m9d4cisl82lpnr0"
+  "webHash": "02m64bhg1ls4a5igmizkkxnqfmbfhs0xy24ycr75vxmn0zmwa3yd"
 }

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -110,8 +110,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     ${rec {
       aarch64-darwin = ''
-        mkdir -p $out/Applications/zoom.us.app
+        mkdir -p $out/Applications
-        cp -R . $out/Applications/zoom.us.app
+        cp -R zoom.us.app $out/Applications/
       '';
       # darwin steps same on both architectures
       x86_64-darwin = aarch64-darwin;

pkgs/applications/networking/ipfs-cluster/default.nix

@@ -2,26 +2,17 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "0.14.5";
+  version = "1.0.0";
 
-  vendorSha256 = "sha256-ykUjq7Svp3+kUNnFkwsBlC+C4nws6Yvu3bk2Wb4c8vY=";
+  vendorSha256 = "sha256-b0k1V1+JikGemSQjyiKcH7cgyDEt0Nn5aVUf6nnE+/0=";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-Xb7QbBmCJKgokxvdbtWxtnNIS/iUsYFLlRzgfoABAq8=";
+    sha256 = "sha256-vwu+Fj7PegbK9pmnsNuEl/AQz2gejRiFAAAov5+VNMQ=";
   };
 
-  # Remove patch when updating to >0.14.5
-  patches = [
-    (fetchpatch {
-      name = "remove-distribution-test.patch";
-      url = "https://github.com/ipfs/ipfs-cluster/pull/1589/commits/49825d1df76f848806f1d76abce5e279221cc8c5.patch";
-      sha256 = "sha256-mM2rc4ai/qhbvxnoRw5jO7BTRlD2/Tp037EuqqS49DE=";
-    })
-  ];
-
   meta = with lib; {
     description = "Allocate, replicate, and track Pins across a cluster of IPFS daemons";
     homepage = "https://cluster.ipfs.io/";

pkgs/applications/networking/nextcloud-client/default.nix

@@ -50,15 +50,18 @@ mkDerivation rec {
     done
   '';
 
+  # required to not include inkscape in the wrapper
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     cmake
-    extra-cmake-modules
     inkscape
     sphinx
   ];
 
   buildInputs = [
+    extra-cmake-modules
     inotify-tools
     libcloudproviders
     libsecret
@@ -95,7 +98,7 @@ mkDerivation rec {
     description = "Nextcloud themed desktop client";
     homepage = "https://nextcloud.com";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [ kranzes SuperSandro2000 ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/p2p/qbittorrent/default.nix

@@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
   pname = "qbittorrent";
-  version = "4.4.1";
+  version = "4.4.2";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qBittorrent";
     rev = "release-${version}";
-    sha256 = "sha256-HNgegPL7M0zwkn7+lcNcsgWgrCbY9/d0nuIlIC5hkAM=";
+    sha256 = "sha256-xBNN9YYKMDcoL1wvERjlAjV8vb2GVgwwlHtb5y0+f+8=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/sync/rclone/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.58.0";
+  version = "1.58.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zCKXi3qeiq2AGT7UioVfCbB4bc5F2tXJ507zPa+O0pc=";
+    sha256 = "sha256-Hh0IVNaLAUOmdYJ6cbYFyDCLwL+0HyZdRzKnXAT0CB8=";
   };
 
-  vendorSha256 = "sha256-mgupx5SNQ3wUkQCeTVnw3wwdSCrTcwLYxcX6tlqXTyQ=";
+  vendorSha256 = "sha256-MPo1t1gzlrzAzbTOv/dSs2BH8NwlXmf6vo1DOFP2TrM=";
 
   subPackages = [ "." ];
 

pkgs/applications/office/beamerpresenter/default.nix

@@ -1,46 +1,69 @@
-{ lib, stdenv, fetchFromGitHub, installShellFiles,
+{ lib,
-  qmake, qtbase, qtmultimedia, wrapQtAppsHook,
+  stdenv,
-  poppler, mupdf, freetype, jbig2dec, openjpeg, gumbo,
+  fetchFromGitHub,
-  renderer ? "mupdf" }:
+  installShellFiles,
+  pkg-config,
+  cmake,
+  qtbase,
+  qtmultimedia,
+  qttools,
+  wrapQtAppsHook,
+  bash,
+  zlib,
+  gcc,
+  gnumake,
+  coreutils,
+  # only required when using poppler
+  poppler,
+  # only required when using mupdf
+  mupdf,
+  freetype,
+  jbig2dec,
+  openjpeg,
+  gumbo,
+  # choose renderer: mupdf or poppler or both (not recommended)
+  renderer ? "mupdf",
+  # choose major Qt version: "5" or "6" (only 5 is tested)
+  qt_version ? "5"}:
 
 let
   renderers = {
     mupdf.buildInputs = [ mupdf freetype jbig2dec openjpeg gumbo ];
     poppler.buildInputs = [ poppler ];
   };
-
+  use_poppler = if "${renderer}" == "poppler" || "${renderer}" == "both" then "ON" else "OFF";
+  use_mupdf = if "${renderer}" == "mupdf" || "${renderer}" == "both" then "ON" else "OFF";
 in
 
 stdenv.mkDerivation rec {
   pname = "beamerpresenter";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "stiglers-eponym";
     repo = "BeamerPresenter";
     rev = "v${version}";
-    sha256 = "sha256-+ZxllYL2wco4bG2pqInIbL9qfOoqoUJJUReqDyEBRcI=";
+    sha256 = "16v263nnnipih3lxg95rmwz0ihnvpl4n1wlj9r6zavnspzlp9dvb";
   };
 
-  nativeBuildInputs = [ qmake installShellFiles wrapQtAppsHook ];
+  nativeBuildInputs = [ pkg-config installShellFiles wrapQtAppsHook ];
-  buildInputs = [ qtbase qtmultimedia ] ++ renderers.${renderer}.buildInputs;
+  buildInputs = [ gcc cmake coreutils gnumake bash zlib qtbase qtmultimedia qttools ] ++ renderers.${renderer}.buildInputs;
 
-  qmakeFlags = [ "RENDERER=${renderer}" ];
+  cmakeFlags = [
-
+    "-DCMAKE_BUILD_TYPE='Release'"
-  postPatch = ''
+    "-DGIT_VERSION=OFF"
-    shopt -s globstar
+    "-DUSE_POPPLER=${use_poppler}"
-    for f in **/*.{pro,conf,h,cpp}; do
+    "-DUSE_MUPDF=${use_mupdf}"
-      substituteInPlace "$f" \
+    "-DUSE_MUJS=OFF"
-        --replace "/usr/" "$out/" \
+    "-DUSE_GUMBO=ON"
-        --replace "/etc/" "$out/etc/" \
+    "-DUSE_TRANSLATIONS=ON"
-        --replace '$${GUI_CONFIG_PATH}' "$out/etc/xdg/beamerpresenter/gui.json"
+    "-DQT_VERSION_MAJOR=${qt_version}"
-    done
+  ];
-  '';
 
   meta = with lib; {
-    description = "Modular multi screen pdf presentation software respecting your window manager";
+    description = "Modular multi screen pdf presentation viewer";
     homepage = "https://github.com/stiglers-eponym/BeamerPresenter";
-    license = licenses.agpl3Plus;
+    license = with licenses; [ agpl3 gpl3Plus ];
     platforms = platforms.all;
     maintainers = with maintainers; [ pacien ];
   };

pkgs/applications/office/zotero/default.nix

@@ -41,12 +41,12 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "6.0";
+  version = "6.0.4";
 
   src = fetchurl {
     url =
       "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0zkgmmflcj6vbyv8rs51jf3vx1zq8pl7b5d5asgayhrdlwi0qgff";
+    sha256 = "sha256-KPvsyN3qpnG8/qRwTlWe2mZWnI9OfxlHu6OUubItJZc=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];

pkgs/applications/radio/rtl-sdr/default.nix

@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromGitHub
 , cmake
 , pkg-config
 , libusb1
@@ -8,12 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl-sdr";
-  version = "0.6.0";
+  version = "0.8.0";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = "git://git.osmocom.org/rtl-sdr.git";
+    owner = "librtlsdr";
-    rev = "refs/tags/${version}";
+    repo = "librtlsdr";
-    sha256 = "0lmvsnb4xw4hmz6zs0z5ilsah5hjz29g1s0050n59fllskqr3b8k";
+    rev = "v${version}";
+    sha256 = "1fgxlkgmdchbrf0nn98ivjr6css5hak3608nr4xrf2qzf7xy2kdk";
   };
 
   postPatch = ''
@@ -28,7 +29,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libusb1 ];
 
-  cmakeFlags = lib.optional stdenv.isLinux "-DINSTALL_UDEV_RULES=ON";
+  cmakeFlags = lib.optional stdenv.isLinux [
+    "-DINSTALL_UDEV_RULES=ON"
+    "-DWITH_RPC=ON"
+  ];
 
   meta = with lib; {
     description = "Turns your Realtek RTL2832 based DVB dongle into a SDR receiver";

pkgs/applications/radio/uhd/default.nix

@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
   # and xxx.yyy.zzz. Hrmpf... style keeps changing
   version = "4.1.0.5";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "EttusResearch";
     repo = "uhd";

pkgs/applications/science/biology/blast/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "blast";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchurl {
     url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-src.tar.gz";
-    sha256 = "122bf45cyj3s3zv2lw1y1rhz7g22v0va560ai30xdjl8sk4wk8zx";
+    sha256 = "sha256-iVU3FNEz2vKMR3+D0zN5Szxi5BSECMByobRiDl7E/rI=";
   };
 
   sourceRoot = "ncbi-blast-${version}+-src/c++";

pkgs/applications/science/computer-architecture/qtrvsim/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "QtRVSim";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "cvut";
     repo = "qtrvsim";
     rev = "refs/tags/v${version}";
-    sha256 = "B1l+ysrodeDbxYfdLLMF8yk4/uPXTcDrTaMtYm89HuU=";
+    sha256 = "BV/nHRvimPaBtY1nfK1PZ2yJ9xWZpNlwiTRfI/9KQec=";
   };
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];

pkgs/applications/science/math/adolc/default.nix

@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "adolc";
+  version = "2.7.2";
+
+  src = fetchFromGitHub {
+    owner = "coin-or";
+    repo = "ADOL-C";
+    sha256 = "1w0x0p32r1amfmh2lyx33j4cb5bpkwjr5z0ll43zi5wf5gsvckd1";
+    rev = "releases/${version}";
+  };
+
+  configureFlags = [ "--with-openmp-flag=-fopenmp" ];
+
+  meta = with lib; {
+    description = "Automatic Differentiation of C/C++";
+    homepage = "https://github.com/coin-or/ADOL-C";
+    maintainers = [ maintainers.bzizou ];
+    license = licenses.gpl2Plus;
+  };
+}
+

pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix

@@ -1,25 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, libiconv, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-interactive-rebase-tool";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "MitMaro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-DYl/GUbeNtKmXoR3gq8mK8EfsZNVNlrdngAwfzG+epw=";
+    sha256 = "sha256-++KTMzTt84dowoZP+Bc9E/jUS21YN5ybKrlpQUKCir0=";
   };
 
-  cargoPatches = [
+  cargoSha256 = "sha256-OUaP/nDs589FYaGYcleRMTQNu3/q/2wBjHSv2q8OyjA=";
-    # update git2 crate to fix a compile error
-    (fetchpatch {
-      url = "https://github.com/MitMaro/git-interactive-rebase-tool/commit/f4d3026f23118d29a263bbca6c83f963e76c34c4.patch";
-      sha256 = "sha256-6ErPRcPbPRXbEslNiNInbbUhbOWb9ZRll7ZDRgTpWS4=";
-    })
-  ];
-
-  cargoSha256 = "sha256-2aHW9JIiqkO0X0B0D44tSZ8QkmKH/QZoYvKNEQWldo4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 

pkgs/applications/version-management/redmine/Gemfile

@@ -3,7 +3,7 @@ source 'https://rubygems.org'
 ruby '>= 2.4.0', '< 2.8.0'
 gem 'bundler', '>= 1.12.0'
 
-gem 'rails', '5.2.6.2'
+gem 'rails', '5.2.6.3'
 gem 'sprockets', '~> 3.7.2' if RUBY_VERSION < '2.5'
 gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')
 gem 'rouge', '~> 3.26.0'
@@ -24,7 +24,7 @@ gem 'rubyzip', '~> 2.3.0'
 gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
 
 # TOTP-based 2-factor authentication
-gem 'rotp'
+gem 'rotp', '>= 5.0.0'
 gem 'rqrcode'
 
 # Optional gem for LDAP authentication

pkgs/applications/version-management/redmine/Gemfile.lock

@@ -1,19 +1,19 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (5.2.6.2)
+    actioncable (5.2.6.3)
-      actionpack (= 5.2.6.2)
+      actionpack (= 5.2.6.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.6.2)
+    actionmailer (5.2.6.3)
-      actionpack (= 5.2.6.2)
+      actionpack (= 5.2.6.3)
-      actionview (= 5.2.6.2)
+      actionview (= 5.2.6.3)
-      activejob (= 5.2.6.2)
+      activejob (= 5.2.6.3)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.6.2)
+    actionpack (5.2.6.3)
-      actionview (= 5.2.6.2)
+      actionview (= 5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
@@ -21,26 +21,26 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actionview (5.2.6.2)
+    actionview (5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.6.2)
+    activejob (5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       globalid (>= 0.3.6)
-    activemodel (5.2.6.2)
+    activemodel (5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
-    activerecord (5.2.6.2)
+    activerecord (5.2.6.3)
-      activemodel (= 5.2.6.2)
+      activemodel (= 5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       arel (>= 9.0)
-    activestorage (5.2.6.2)
+    activestorage (5.2.6.3)
-      actionpack (= 5.2.6.2)
+      actionpack (= 5.2.6.3)
-      activerecord (= 5.2.6.2)
+      activerecord (= 5.2.6.3)
       marcel (~> 1.0.0)
-    activesupport (5.2.6.2)
+    activesupport (5.2.6.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -60,7 +60,7 @@ GEM
       xpath (~> 3.2)
     childprocess (4.1.0)
     chunky_png (1.4.0)
-    concurrent-ruby (1.1.9)
+    concurrent-ruby (1.1.10)
     crass (1.0.6)
     css_parser (1.11.0)
       addressable
@@ -72,7 +72,7 @@ GEM
     htmlentities (4.3.4)
     i18n (1.8.11)
       concurrent-ruby (~> 1.0)
-    loofah (2.14.0)
+    loofah (2.16.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
@@ -81,21 +81,19 @@ GEM
     method_source (1.0.0)
     mini_magick (4.11.0)
     mini_mime (1.0.3)
-    mini_portile2 (2.5.3)
     minitest (5.15.0)
     mocha (1.13.0)
     mysql2 (0.5.3)
     net-ldap (0.17.0)
     nio4r (2.5.8)
     nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
-    parallel (1.21.0)
+    parallel (1.22.1)
-    parser (3.1.1.0)
+    parser (3.1.2.0)
       ast (~> 2.4.1)
     pg (1.2.3)
-    public_suffix (4.0.6)
+    public_suffix (4.0.7)
-    puma (5.6.2)
+    puma (5.6.4)
       nio4r (~> 2.0)
     racc (1.6.0)
     rack (2.2.3)
@@ -104,27 +102,27 @@ GEM
       ruby-openid (>= 2.1.8)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.2.6.2)
+    rails (5.2.6.3)
-      actioncable (= 5.2.6.2)
+      actioncable (= 5.2.6.3)
-      actionmailer (= 5.2.6.2)
+      actionmailer (= 5.2.6.3)
-      actionpack (= 5.2.6.2)
+      actionpack (= 5.2.6.3)
-      actionview (= 5.2.6.2)
+      actionview (= 5.2.6.3)
-      activejob (= 5.2.6.2)
+      activejob (= 5.2.6.3)
-      activemodel (= 5.2.6.2)
+      activemodel (= 5.2.6.3)
-      activerecord (= 5.2.6.2)
+      activerecord (= 5.2.6.3)
-      activestorage (= 5.2.6.2)
+      activestorage (= 5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       bundler (>= 1.3.0)
-      railties (= 5.2.6.2)
+      railties (= 5.2.6.3)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.4.2)
       loofah (~> 2.3)
-    railties (5.2.6.2)
+    railties (5.2.6.3)
-      actionpack (= 5.2.6.2)
+      actionpack (= 5.2.6.3)
-      activesupport (= 5.2.6.2)
+      activesupport (= 5.2.6.3)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
@@ -160,7 +158,7 @@ GEM
       rubocop-ast (>= 1.2.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.16.0)
+    rubocop-ast (1.17.0)
       parser (>= 3.1.1.0)
     rubocop-performance (1.10.2)
       rubocop (>= 0.90.0, < 2.0)
@@ -180,7 +178,7 @@ GEM
       docile (~> 1.1)
       simplecov-html (~> 0.11)
     simplecov-html (0.12.3)
-    sprockets (4.0.2)
+    sprockets (4.0.3)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
     sprockets-rails (3.4.2)
@@ -227,13 +225,13 @@ DEPENDENCIES
   pg (~> 1.2.2)
   puma
   rack-openid
-  rails (= 5.2.6.2)
+  rails (= 5.2.6.3)
   rails-dom-testing
   rbpdf (~> 1.20.0)
   redcarpet (~> 3.5.1)
   request_store (~> 1.5.0)
   roadie-rails (~> 2.2.0)
-  rotp
+  rotp (>= 5.0.0)
   rouge (~> 3.26.0)
   rqrcode
   rubocop (~> 1.12.0)
@@ -248,7 +246,7 @@ DEPENDENCIES
   yard
 
 RUBY VERSION
-   ruby 2.7.4p191
+   ruby 2.7.6p219
 
 BUNDLED WITH
-   2.1.4
+   2.2.33

pkgs/applications/version-management/redmine/default.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper }:
 
 let
-  version = "4.2.4";
+  version = "4.2.5";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -15,10 +15,8 @@ in
     inherit version;
 
     src = fetchurl {
-      # https://www.redmine.org/news/134
+      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      # > "These releases are not available yet on the releases page from a technical reason, we are sorry for this and we expected to have them uploaded next week. I'll post here an update after we have them uploaded."
+      sha256 = "112rc2sjx6x7046fjz7np0ilszvkqapc180ld02ncwmdxaq88w6r";
-      url = "https://www.redmine.org/attachments/download/28862/${pname}-${version}.tar.gz";
-      sha256 = "7f50fd4a6cf1c1e48091a87696b813ba264e11f04dec67fb006858a1b49a5c7d";
     };
 
     nativeBuildInputs = [ makeWrapper ];

pkgs/applications/version-management/redmine/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0il9l30jz1gfjccrahfk2gl57b31dqgjlzjc8cfifm76ggywmz67";
+      sha256 = "1gmwailk92znzrdpi4116ih6bq609a38rpnszzh5piq7b507ikpn";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cci24da56d467ldq40n3l176h9qdw691w1b703c251izh6c4n5d";
+      sha256 = "103a1nixkazzdk21bg42vs722m6gm0vf17ag2fdad5dycwk3ycpp";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xis55xvs4hja6fnmj4785rzafk553k5f0xb7jprqf38c6dzmiak";
+      sha256 = "15fz3rjk85svpx9lsqfdwlvyd972zf0g5jasnsllcbf6d300gdj6";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   actionpack-xml_parser = {
     dependencies = ["actionpack" "railties"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00a9g63xwfimnzsrcrnr4vmdwhg7jaic49jas70r695nznwkxr9x";
+      sha256 = "00cfpmbk8gw9c589xnqazsbd860p2368gyh8nyzixcsa6k28wfwv";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fm5qxrv8pxhl7m88p17xxpizddasm9kknaldkax8im3b9vrgnr9";
+      sha256 = "1gczbnk7qy4rjhv0q82nd70xawc9lb1vinvwr4ngpim5rqwzm6d6";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k0xizwbcadmslc8rkg2vnsbrsqivm6yj2yjrzb6rhqwphcr9zjf";
+      sha256 = "0ib8qlbwr9hp5284c6bmx08lrfy45zzd4inzmawz08alkgdcrzca";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "arel"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m00zh62rfn2h15vfn89jg39wxmghc88v2vjb5r4m0c7g24vrb14";
+      sha256 = "0ky3zc8i5rjg2dpdb95icsgb443siim9sv71xwcmryjxp5rhkqyx";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   activestorage = {
     dependencies = ["actionpack" "activerecord" "marcel"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h3z331xli0j5didh0g9cv4zrlx32b5csp1566fpy0fr2kgqmpi9";
+      sha256 = "1risg5jklxrm7j5i4rzaqpb94822ivbjaasblppwmx5f33vhfpca";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "164lmi9w96wdwd00dnly8f9dcak3blv49ymyqz30q2fdjn45c775";
+      sha256 = "09vif5aajkvrsdcl51kvk8crz8hl38awprh7d5wj93nscpxmqgns";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -186,10 +186,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
+      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
       type = "gem";
     };
-    version = "1.1.9";
+    version = "1.1.10";
   };
   crass = {
     groups = ["default"];
@@ -280,10 +280,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z8bdcmw66j3dy6ivcc02yq32lx3n9bavx497llln8qy014xjm4w";
+      sha256 = "15s6z5bvhdhnqv4wg8zcz3mhbc7i4dbqskv5jvhprz33ak7682km";
       type = "gem";
     };
-    version = "2.14.0";
+    version = "2.16.0";
   };
   mail = {
     dependencies = ["mini_mime"];
@@ -336,16 +336,6 @@
     };
     version = "1.0.3";
   };
-  mini_portile2 = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
-      type = "gem";
-    };
-    version = "2.5.3";
-  };
   minitest = {
     groups = ["default" "test"];
     platforms = [];
@@ -405,7 +395,7 @@
     version = "2.5.8";
   };
   nokogiri = {
-    dependencies = ["mini_portile2" "racc"];
+    dependencies = ["racc"];
     groups = ["default" "test"];
     platforms = [];
     source = {
@@ -420,10 +410,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hkfpm78c2vs1qblnva3k1grijvxh87iixcnyd83s3lxrxsjvag4";
+      sha256 = "07vnk6bb54k4yc06xnwck7php50l09vvlw1ga8wdz0pia461zpzb";
       type = "gem";
     };
-    version = "1.21.0";
+    version = "1.22.1";
   };
   parser = {
     dependencies = ["ast"];
@@ -431,10 +421,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zaghgvva2q4jqbachg8jvpwgbg3w1jqr0d00m8rqciqznjgsw3c";
+      sha256 = "0xhfghgidj8cbdnqp01f7kvnrv1f60izpkd9dhxsvpdzkfsdg97d";
       type = "gem";
     };
-    version = "3.1.1.0";
+    version = "3.1.2.0";
   };
   pg = {
     groups = ["default"];
@@ -459,10 +449,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
       type = "gem";
     };
-    version = "4.0.6";
+    version = "4.0.7";
   };
   puma = {
     dependencies = ["nio4r"];
@@ -470,10 +460,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1np2myaxlk5iab1zarwgmp7zsjvm5j8ssg35ijv8b6dpvc3cjd56";
+      sha256 = "0dgr2rybayih2naz3658mbzqwfrg9fxl80zsvhscf6b972kp3jdw";
       type = "gem";
     };
-    version = "5.6.2";
+    version = "5.6.4";
   };
   racc = {
     groups = ["default" "test"];
@@ -523,10 +513,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fgbld733j2j85pf8kpv1mvp8rmlkqs7ccv77q2mwfm7ri4yisy0";
+      sha256 = "19962nkjssr77753a8893yz17kmvb63h9rl3ajq6r8rx9xifq8fn";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "nokogiri"];
@@ -556,10 +546,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fgyw80j2mss3hdhzxa1b12c7j17az55znq0d16md69if8dwfmic";
+      sha256 = "0waa50li6vvckz9mznyz4jhks46ba09fmbdadrrj35mzwahyb6fy";
       type = "gem";
     };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
   };
   rainbow = {
     groups = ["default" "test"];
@@ -723,10 +713,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bd2z82ly7fix8415gvfiwzb6bjialz5rs3sr72kv1lk68rd23wv";
+      sha256 = "1k9izkr5rhw3zc309yjp17z7496l74j4li3zrcgpgqfnqwz695qx";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.17.0";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -818,10 +808,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ikgwbl6jv3frfiy3xhg5yxw9d0064rgzghar1rg391xmrc4gm38";
+      sha256 = "19k5cwg8gyb6lkmz4kab7c5nlplpgj64jy7vw8p5l2i2ysq5hym0";
       type = "gem";
     };
-    version = "4.0.2";
+    version = "4.0.3";
   };
   sprockets-rails = {
     dependencies = ["actionpack" "activesupport" "sprockets"];

pkgs/applications/version-management/redmine/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p cacert bundix
+
+# Do these steps before running this script:
+#   1. Copy Gemfile from new Redmine version to this folder
+#   2. Manually modify the database lines in Gemfile (diff the two files, it's obvious)
+
+pkg_dir="$(dirname "$0")"
+cd ${pkg_dir}
+
+for file in "gemset.nix" "Gemfile.lock"; do
+  if [ -f ${file} ]; then
+    rm ${file}
+  fi
+done
+
+bundix -l

pkgs/applications/version-management/subversion/default.nix

@@ -119,11 +119,6 @@ let
   });
 
 in {
-  subversion_1_10 = common {
-    version = "1.10.8";
-    sha256 = "sha256-CnO6MSe1ov/7j+4rcCmE8qgI3nEKjbKLfdQBDYvlDlo=";
-  };
-
   subversion = common {
     version = "1.14.2";
     sha256 = "sha256-yRMOjQt1copm8OcDj8dwUuZxgw14W1YWqtU7SBDTzCg=";

pkgs/applications/video/hyperion-ng/default.nix

@@ -0,0 +1,50 @@
+{ avahi-compat, cmake, fetchFromGitHub, flatbuffers, hidapi, lib, libcec
+, libusb1, libX11, libxcb, libXrandr, mbedtls, mkDerivation, protobuf, python3
+, qtbase, qtserialport, qtsvg, qtx11extras, wrapQtAppsHook }:
+
+mkDerivation rec {
+  pname = "hyperion.ng";
+  version = "2.0.12";
+
+  src = fetchFromGitHub {
+    owner = "hyperion-project";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-J31QaWwGNhIpnZmWN9lZEI6fC0VheY5X8fGchQqtAlQ=";
+  };
+
+  buildInputs = [
+    avahi-compat
+    flatbuffers
+    hidapi
+    libcec
+    libusb1
+    libX11
+    libxcb
+    libXrandr
+    mbedtls
+    protobuf
+    python3
+    qtbase
+    qtserialport
+    qtsvg
+    qtx11extras
+  ];
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_SYSTEM_MBEDTLS_LIBS=ON"
+    "-DUSE_SYSTEM_FLATBUFFERS_LIBS=ON"
+    "-DUSE_SYSTEM_PROTO_LIBS=ON"
+  ];
+
+  meta = with lib; {
+    description = "Open Source Ambilight solution";
+    homepage = "https://github.com/hyperion-project/hyperion.ng";
+    license = licenses.mit;
+    maintainers = with maintainers; [ algram ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/video/lightworks/default.nix

@@ -23,15 +23,15 @@ let
   ];
 
   lightworks = stdenv.mkDerivation rec {
-    version = "2021.2.1";
+    version = "2022.1.1";
-    rev = "128456";
+    rev = "132926";
     pname = "lightworks";
 
     src =
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
-          url = "https://cdn.lwks.com/releases/${version}/lightworks_${lib.versions.majorMinor version}_r${rev}.deb";
+          url = "https://cdn.lwks.com/releases/${version}/lightworks_${version}_r${rev}.deb";
-          sha256 = "sha256-GkTg43IUF1NgEm/wT9CZw68Dw/R2BYBU/F4bsCxQowQ=";
+          sha256 = "sha256-f2lxfv0sFESpDnINDKlfVcR0pySAueMeOMbkgBWzz7Q=";
         }
       else throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
 

pkgs/applications/virtualization/distrobox/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "distrobox";
-  version = "1.2.14";
+  version = "1.2.15";
 
   src = fetchFromGitHub {
     owner = "89luca89";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gHKyuIL4K/SLBJw8xNuPdNifDcHI91AFTiHaiv38gus=";
+    sha256 = "sha256-9rivXnHyEE1MoGY+CwUeDStLGPVq+4FvwPjV7Nblk60=";
   };
 
   dontConfigure = true;

pkgs/applications/virtualization/podman-tui/default.nix

@@ -11,13 +11,13 @@
 }:
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    sha256 = "sha256-1WbDmnKyFosp4Kz9QINr3lOR/wD0UW2QZf7nAAaoClM=";
+    sha256 = "sha256-Xc6F87evQiv4jRbxxRBzJBeI8653HvlQL+UwcVWY0wk=";
   };
 
   vendorSha256 = null;

pkgs/build-support/rust/default-crate-overrides.nix

@@ -170,7 +170,7 @@ in
   };
 
   security-framework-sys = attr: {
-    propagatedBuildInputs = [ Security ];
+    propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
   };
 
   sequoia-openpgp = attrs: {

pkgs/data/fonts/amiri/default.nix

@@ -1,14 +1,14 @@
 { lib, fetchzip }:
 
 let
-  version = "0.113";
+  version = "0.114";
 
 in fetchzip rec {
   name = "Amiri-${version}";
 
   url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
 
-  sha256 = "0v5xm4spyww8wy6j9kpb01ixrakw7wp6jng4xnh220iy6yqcxm7v";
+  sha256 = "sha256-6FA46j1shP0R8iEi/Xop2kXS0OKW1jaGUEOthT3Z5b4=";
 
   postFetch = ''
     unzip $downloadedFile

pkgs/data/fonts/annapurna-sil/default.nix

@@ -0,0 +1,29 @@
+{ lib, fetchzip }:
+
+let
+  version = "1.204";
+in
+  fetchzip rec {
+    name = "annapurna-sil-${version}";
+
+    url = "https://software.sil.org/downloads/r/annapurna/AnnapurnaSIL-${version}.zip";
+
+    postFetch = ''
+      mkdir -p $out/share/{doc,fonts}
+      unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+      unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
+    '';
+
+    sha256 = "sha256-kVeP9ZX8H+Wn6jzmH1UQvUKY6vJjadMTdEusS7LodFM=";
+
+    meta = with lib; {
+      homepage = "https://software.sil.org/annapurna";
+      description = "Unicode-based font family with broad support for writing systems that use the Devanagari script";
+      longDescription = ''
+        Annapurna SIL is a Unicode-based font family with broad support for writing systems that use the Devanagari script. Inspired by traditional calligraphic forms, the design is intended to be highly readable, reasonably compact, and visually attractive.
+      '';
+      license = licenses.ofl;
+      platforms = platforms.all;
+      maintainers = [ maintainers.kmein ];
+    };
+  }

pkgs/data/fonts/ezra-sil/default.nix

@@ -0,0 +1,26 @@
+{ lib, fetchzip }:
+
+let
+  version = "2.51";
+in
+  fetchzip rec {
+    name = "ezra-sil-${version}";
+
+    url = "https://software.sil.org/downloads/r/ezra/EzraSIL-${version}.zip";
+
+    postFetch = ''
+      mkdir -p $out/share/{doc,fonts}
+      unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+      unzip -j $downloadedFile \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
+    '';
+
+    sha256 = "sha256-1LGw/RPFeNtEvcBWFWZf8+dABvWye2RfZ/jt8rwQewM=";
+
+    meta = with lib; {
+      homepage = "https://software.sil.org/ezra";
+      description = "Typeface fashioned after the square letter forms of the typography of the Biblia Hebraica Stuttgartensia (BHS)";
+      license = licenses.ofl;
+      platforms = platforms.all;
+      maintainers = [ maintainers.kmein ];
+    };
+  }