Merge branch 'master' into staging-next

doc/languages-frameworks/agda.section.md

@@ -158,7 +158,23 @@ This can be overridden.
 
 By default, Agda sources are files ending on `.agda`, or literate Agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised Agda source extensions can be extended by setting the `extraExtensions` config variable.
 
-## Adding Agda packages to Nixpkgs {#adding-agda-packages-to-nixpkgs}
+## Maintaining the Agda package set on Nixpkgs {#maintaining-the-agda-package-set-on-nixpkgs}
+
+We are aiming at providing all common Agda libraries as packages on `nixpkgs`,
+and keeping them up to date.
+Contributions and maintenance help is always appreciated,
+but the maintenance effort is typically low since the Agda ecosystem is quite small.
+
+The `nixpkgs` Agda package set tries to take up a role similar to that of [Stackage](https://www.stackage.org/) in the Haskell world.
+It is a curated set of libraries that:
+
+1. Always work together.
+2. Are as up-to-date as possible.
+
+While the Haskell ecosystem is huge, and Stackage is highly automatised,
+the Agda package set is small and can (still) be maintained by hand.
+
+### Adding Agda packages to Nixpkgs {#adding-agda-packages-to-nixpkgs}
 
 To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the top line of the `default.nix` can look like:
 
@@ -192,3 +208,49 @@ mkDerivation {
 This library has a file called `.agda-lib`, and so we give an empty string to `libraryFile` as nothing precedes `.agda-lib` in the filename. This file contains `name: IAL-1.3`, and so we let `libraryName =  "IAL-1.3"`. This library does not use an `Everything.agda` file and instead has a Makefile, so there is no need to set `everythingFile` and we set a custom `buildPhase`.
 
 When writing an Agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes Agda to think that the nix store is a Agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
+
+In the pull request adding this library,
+you can test whether it builds correctly by writing in a comment:
+
+```
+@ofborg build agdaPackages.iowa-stdlib
+```
+
+### Maintaining Agda packages
+
+As mentioned before, the aim is to have a compatible, and up-to-date package set.
+These two conditions sometimes exclude each other:
+For example, if we update `agdaPackages.standard-library` because there was an upstream release,
+this will typically break many reverse dependencies,
+i.e. downstream Agda libraries that depend on the standard library.
+In `nixpkgs` we are typically among the first to notice this,
+since we have build tests in place to check this.
+
+In a pull request updating e.g. the standard library, you should write the following comment:
+
+```
+@ofborg build agdaPackages.standard-library.passthru.tests
+```
+
+This will build all reverse dependencies of the standard library,
+for example `agdaPackages.agda-categories`, or `agdaPackages.generic`.
+
+In some cases it is useful to build _all_ Agda packages.
+This can be done with the following Github comment:
+
+```
+@ofborg build agda.passthru.tests.allPackages
+```
+
+Sometimes, the builds of the reverse dependencies fail because they have not yet been updated and released.
+You should drop the maintainers a quick issue notifying them of the breakage,
+citing the build error (which you can get from the ofborg logs).
+If you are motivated, you might even send a pull request that fixes it.
+Usually, the maintainers will answer within a week or two with a new release.
+Bumping the version of that reverse dependency should be a further commit on your PR.
+
+In the rare case that a new release is not to be expected within an acceptable time,
+simply mark the broken package as broken by setting `meta.broken = true;`.
+This will exclude it from the build test.
+It can be added later when it is fixed,
+and does not hinder the advancement of the whole package set in the meantime.

doc/languages-frameworks/dotnet.section.md

@@ -28,8 +28,7 @@ mkShell {
   packages = [
     (with dotnetCorePackages; combinePackages [
       sdk_3_1
-      sdk_3_0
+      sdk_5_0
-      sdk_2_1
     ])
   ];
 }
@@ -64,9 +63,9 @@ $ dotnet --info
 
 The `dotnetCorePackages.sdk_X_Y` is preferred over the old dotnet-sdk as both major and minor version are very important for a dotnet environment. If a given minor version isn't present (or was changed), then this will likely break your ability to build a project.
 
-## dotnetCorePackages.sdk vs dotnetCorePackages.net vs dotnetCorePackages.netcore vs dotnetCorePackages.aspnetcore {#dotnetcorepackages.sdk-vs-dotnetcorepackages.net-vs-dotnetcorepackages.netcore-vs-dotnetcorepackages.aspnetcore}
+## dotnetCorePackages.sdk vs dotnetCorePackages.runtime vs dotnetCorePackages.aspnetcore {#dotnetcorepackages.sdk-vs-dotnetcorepackages.runtime-vs-dotnetcorepackages.aspnetcore}
 
-The `dotnetCorePackages.sdk` contains both a runtime and the full sdk of a given version. The `net`, `netcore` and `aspnetcore` packages are meant to serve as minimal runtimes to deploy alongside already built applications. For runtime versions >= .NET 5 `net` is used while `netcore` is used for older .NET Core runtime version.
+The `dotnetCorePackages.sdk` contains both a runtime and the full sdk of a given version. The `runtime` and `aspnetcore` packages are meant to serve as minimal runtimes to deploy alongside already built applications.
 
 ## Packaging a Dotnet Application {#packaging-a-dotnet-application}
 

doc/languages-frameworks/rust.section.md

@@ -237,22 +237,6 @@ where they are known to differ. But there are ways to customize the argument:
    --target /nix/store/asdfasdfsadf-thumb-crazy.json # contains {"foo":"","bar":""}
    ```
 
-Finally, as an ad-hoc escape hatch, a computed target (string or JSON file
-path) can be passed directly to `buildRustPackage`:
-
-```nix
-pkgs.rustPlatform.buildRustPackage {
-  /* ... */
-  target = "x86_64-fortanix-unknown-sgx";
-}
-```
-
-This is useful to avoid rebuilding Rust tools, since they are actually target
-agnostic and don't need to be rebuilt. But in the future, we should always
-build the Rust tools and standard library crates separately so there is no
-reason not to take the `stdenv.hostPlatform.rustc`-modifying approach, and the
-ad-hoc escape hatch to `buildRustPackage` can be removed.
-
 Note that currently custom targets aren't compiled with `std`, so `cargo test`
 will fail. This can be ignored by adding `doCheck = false;` to your derivation.
 

maintainers/maintainer-list.nix

@@ -4094,6 +4094,12 @@
     githubId = 16470252;
     name = "Gemini Lasswell";
   };
+  gbtb = {
+    email = "goodbetterthebeast3@gmail.com";
+    github = "gbtb";
+    githubId = 37017396;
+    name = "gbtb";
+  };
   gebner = {
     email = "gebner@gebner.org";
     github = "gebner";
@@ -4421,6 +4427,16 @@
     githubId = 54728477;
     name = "Happy River";
   };
+  hardselius = {
+    email = "martin@hardselius.dev";
+    github = "hardselius";
+    githubId = 1422583;
+    name = "Martin Hardselius";
+    keys = [{
+      longkeyid = "rsa4096/0x03A6E6F786936619";
+      fingerprint = "3F35 E4CA CBF4 2DE1 2E90  53E5 03A6 E6F7 8693 6619";
+    }];
+  };
   haslersn = {
     email = "haslersn@fius.informatik.uni-stuttgart.de";
     github = "haslersn";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -1577,6 +1577,38 @@ Superuser created successfully.
           when they are socket-activated.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>virtualisation.libvirtd</literal> module has been
+          refactored and updated with new options:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>virtualisation.libvirtd.qemu*</literal> options
+              (e.g.:
+              <literal>virtualisation.libvirtd.qemuRunAsRoot</literal>)
+              were moved to
+              <link xlink:href="options.html#opt-virtualisation.libvirtd.qemu"><literal>virtualisation.libvirtd.qemu</literal></link>
+              submodule,
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              software TPM1/TPM2 support (e.g.: Windows 11 guests)
+              (<link xlink:href="options.html#opt-virtualisation.libvirtd.qemu.swtpm"><literal>virtualisation.libvirtd.qemu.swtpm</literal></link>),
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              custom OVMF package (e.g.:
+              <literal>pkgs.OVMFFull</literal> with HTTP, CSM and Secure
+              Boot support)
+              (<link xlink:href="options.html#opt-virtualisation.libvirtd.qemu.ovmf.package"><literal>virtualisation.libvirtd.qemu.ovmf.package</literal></link>).
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -455,3 +455,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `networking.sits` now supports Foo-over-UDP encapsulation.
 
 - Changing systemd `.socket` units now restarts them and stops the service that is activated by them. Additionally, services with `stopOnChange = false` don't break anymore when they are socket-activated.
+
+-  The `virtualisation.libvirtd` module has been refactored and updated with new options:
+    - `virtualisation.libvirtd.qemu*` options (e.g.: `virtualisation.libvirtd.qemuRunAsRoot`) were moved to [`virtualisation.libvirtd.qemu`](options.html#opt-virtualisation.libvirtd.qemu) submodule,
+    - software TPM1/TPM2 support (e.g.: Windows 11 guests) ([`virtualisation.libvirtd.qemu.swtpm`](options.html#opt-virtualisation.libvirtd.qemu.swtpm)),
+    - custom OVMF package (e.g.: `pkgs.OVMFFull` with HTTP, CSM and Secure Boot support) ([`virtualisation.libvirtd.qemu.ovmf.package`](options.html#opt-virtualisation.libvirtd.qemu.ovmf.package)).

nixos/lib/build-vms.nix

@@ -68,9 +68,8 @@ rec {
                       prefixLength = 24;
                   } ];
                 });
-            in
+
-            { key = "ip-address";
+              networkConfig =
-              config =
                 { networking.hostName = mkDefault m.fst;
 
                   networking.interfaces = listToAttrs interfaces;
@@ -96,7 +95,15 @@ rec {
                     in flip concatMap interfacesNumbered
                       ({ fst, snd }: qemu-common.qemuNICFlags snd fst m.snd);
                 };
-            }
+
+              in
+                { key = "ip-address";
+                  config = networkConfig // {
+                    # Expose the networkConfig items for tests like nixops
+                    # that need to recreate the network config.
+                    system.build.networkConfig = networkConfig;
+                  };
+                }
           )
           (getAttr m.fst nodes)
         ] );

nixos/lib/make-options-doc/default.nix

@@ -83,10 +83,13 @@ let
   optionsListVisible = lib.filter (opt: opt.visible && !opt.internal) (lib.optionAttrSetToDocList options);
 
   # Customly sort option list for the man page.
+  # Always ensure that the sort order matches sortXML.py!
   optionsList = lib.sort optionLess optionsListDesc;
 
   # Convert the list of options into an XML file.
-  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList);
+  # This file is *not* sorted sorted to save on eval time, since the docbook XML
+  # and the manpage depend on it and thus we evaluate this on every system rebuild.
+  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsListDesc);
 
   optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
 
@@ -185,9 +188,10 @@ in {
       exit 1
     fi
 
+    ${pkgs.python3Minimal}/bin/python ${./sortXML.py} $optionsXML sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
       --stringparam revision '${revision}' \
-      -o intermediate.xml ${./options-to-docbook.xsl} $optionsXML
+      -o intermediate.xml ${./options-to-docbook.xsl} sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
       -o "$out" ${./postprocess-option-descriptions.xsl} intermediate.xml
   '';

nixos/lib/make-options-doc/sortXML.py

@@ -0,0 +1,28 @@
+import xml.etree.ElementTree as ET
+import sys
+
+tree = ET.parse(sys.argv[1])
+# the xml tree is of the form
+# <expr><list> {all options, each an attrs} </list></expr>
+options = list(tree.getroot().find('list'))
+
+def sortKey(opt):
+    def order(s):
+        if s.startswith("enable"):
+            return 0
+        if s.startswith("package"):
+            return 1
+        return 2
+
+    return [
+        (order(p.attrib['value']), p.attrib['value'])
+        for p in opt.findall('attr[@name="loc"]/list/string')
+    ]
+
+# always ensure that the sort order matches the order used in the nix expression!
+options.sort(key=sortKey)
+
+doc = ET.Element("expr")
+newOptions = ET.SubElement(doc, "list")
+newOptions.extend(options)
+ET.ElementTree(doc).write(sys.argv[2], encoding='utf-8')

nixos/maintainers/scripts/azure-new/examples/basic/image.nix

@@ -1,6 +1,6 @@
 let
   pkgs = (import ../../../../../../default.nix {});
-  machine = import "${pkgs.path}/nixos/lib/eval-config.nix" {
+  machine = import (pkgs.path + "/nixos/lib/eval-config.nix") {
     system = "x86_64-linux";
     modules = [
       ({config, ...}: { imports = [ ./system.nix ]; })

nixos/modules/services/misc/subsonic.nix

@@ -109,7 +109,7 @@ let cfg = config.services.subsonic; in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       script = ''
-        ${pkgs.jre}/bin/java -Xmx${toString cfg.maxMemory}m \
+        ${pkgs.jre8}/bin/java -Xmx${toString cfg.maxMemory}m \
           -Dsubsonic.home=${cfg.home} \
           -Dsubsonic.host=${cfg.listenAddress} \
           -Dsubsonic.port=${toString cfg.port} \

nixos/modules/services/network-filesystems/samba.nix

@@ -87,13 +87,20 @@ in
           <note>
             <para>If you use the firewall consider adding the following:</para>
           <programlisting>
-            networking.firewall.allowedTCPPorts = [ 139 445 ];
+            services.samba.openFirewall = true;
-            networking.firewall.allowedUDPPorts = [ 137 138 ];
           </programlisting>
           </note>
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to automatically open the necessary ports in the firewall.
+        '';
+      };
+
       enableNmbd = mkOption {
         type = types.bool;
         default = true;
@@ -235,7 +242,10 @@ in
         };
 
         security.pam.services.samba = {};
-        environment.systemPackages = [ config.services.samba.package ];
+        environment.systemPackages = [ cfg.package ];
+
+        networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 139 445 ];
+        networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ 137 138 ];
       })
     ];
 

nixos/modules/services/security/privacyidea.nix

@@ -272,7 +272,7 @@ in
     (mkIf cfg.ldap-proxy.enable {
 
       systemd.services.privacyidea-ldap-proxy = let
-        ldap-proxy-env = pkgs.python2.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
+        ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
       in {
         description = "privacyIDEA LDAP proxy";
         wantedBy = [ "multi-user.target" ];

nixos/modules/services/web-apps/hedgedoc.nix

@@ -539,6 +539,69 @@ in
                 Specify the OAuth token URL.
               '';
             };
+            baseURL = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the OAuth base URL.
+              '';
+            };
+            userProfileURL = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the OAuth userprofile URL.
+              '';
+            };
+            userProfileUsernameAttr = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the name of the attribute for the username from the claim.
+              '';
+            };
+            userProfileDisplayNameAttr = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the name of the attribute for the display name from the claim.
+              '';
+            };
+            userProfileEmailAttr = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the name of the attribute for the email from the claim.
+              '';
+            };
+            scope = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the OAuth scope.
+              '';
+            };
+            providerName = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the name to be displayed for this strategy.
+              '';
+            };
+            rolesClaim = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify the role claim name.
+              '';
+            };
+            accessRole = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Specify role which should be included in the ID token roles claim to grant access
+              '';
+            };
             clientID = mkOption {
               type = types.str;
               description = ''

nixos/modules/virtualisation/hyperv-guest.nix

@@ -34,7 +34,7 @@ in {
       initrd.availableKernelModules = [ "hyperv_keyboard" ];
 
       kernelParams = [
-        "video=hyperv_fb:${cfg.videoMode} elevator=noop"
+        "video=hyperv_fb:${cfg.videoMode}" "elevator=noop"
       ];
     };
 

nixos/modules/virtualisation/libvirtd.nix

@@ -13,23 +13,140 @@ let
   '';
   ovmfFilePrefix = if pkgs.stdenv.isAarch64 then "AAVMF" else "OVMF";
   qemuConfigFile = pkgs.writeText "qemu.conf" ''
-    ${optionalString cfg.qemuOvmf ''
+    ${optionalString cfg.qemu.ovmf.enable ''
       nvram = [ "/run/libvirt/nix-ovmf/${ovmfFilePrefix}_CODE.fd:/run/libvirt/nix-ovmf/${ovmfFilePrefix}_VARS.fd" ]
     ''}
-    ${optionalString (!cfg.qemuRunAsRoot) ''
+    ${optionalString (!cfg.qemu.runAsRoot) ''
       user = "qemu-libvirtd"
       group = "qemu-libvirtd"
     ''}
-    ${cfg.qemuVerbatimConfig}
+    ${cfg.qemu.verbatimConfig}
   '';
   dirName = "libvirt";
   subDirs = list: [ dirName ] ++ map (e: "${dirName}/${e}") list;
 
-in {
+  ovmfModule = types.submodule {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Allows libvirtd to take advantage of OVMF when creating new
+          QEMU VMs with UEFI boot.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.OVMF;
+        defaultText = literalExpression "pkgs.OVMF";
+        example = literalExpression "pkgs.OVMFFull";
+        description = ''
+          OVMF package to use.
+        '';
+      };
+    };
+  };
+
+  swtpmModule = types.submodule {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Allows libvirtd to use swtpm to create an emulated TPM.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.swtpm;
+        defaultText = literalExpression "pkgs.swtpm";
+        description = ''
+          swtpm package to use.
+        '';
+      };
+    };
+  };
+
+  qemuModule = types.submodule {
+    options = {
+      package = mkOption {
+        type = types.package;
+        default = pkgs.qemu;
+        defaultText = literalExpression "pkgs.qemu";
+        description = ''
+          Qemu package to use with libvirt.
+          `pkgs.qemu` can emulate alien architectures (e.g. aarch64 on x86)
+          `pkgs.qemu_kvm` saves disk space allowing to emulate only host architectures.
+        '';
+      };
+
+      runAsRoot = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          If true,  libvirtd runs qemu as root.
+          If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.
+          Changing this option to false may cause file permission issues
+          for existing guests. To fix these, manually change ownership
+          of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
+        '';
+      };
+
+      verbatimConfig = mkOption {
+        type = types.lines;
+        default = ''
+          namespaces = []
+        '';
+        description = ''
+          Contents written to the qemu configuration file, qemu.conf.
+          Make sure to include a proper namespace configuration when
+          supplying custom configuration.
+        '';
+      };
+
+      ovmf = mkOption {
+        type = ovmfModule;
+        default = { };
+        description = ''
+          QEMU's OVMF options.
+        '';
+      };
+
+      swtpm = mkOption {
+        type = swtpmModule;
+        default = { };
+        description = ''
+          QEMU's swtpm options.
+        '';
+      };
+    };
+  };
+in
+{
 
   imports = [
     (mkRemovedOptionModule [ "virtualisation" "libvirtd" "enableKVM" ]
-      "Set the option `virtualisation.libvirtd.qemuPackage' instead.")
+      "Set the option `virtualisation.libvirtd.qemu.package' instead.")
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuPackage" ]
+      [ "virtualisation" "libvirtd" "qemu" "package" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuRunAsRoot" ]
+      [ "virtualisation" "libvirtd" "qemu" "runAsRoot" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuVerbatimConfig" ]
+      [ "virtualisation" "libvirtd" "qemu" "verbatimConfig" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuOvmf" ]
+      [ "virtualisation" "libvirtd" "qemu" "ovmf" "enable" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuOvmfPackage" ]
+      [ "virtualisation" "libvirtd" "qemu" "ovmf" "package" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuSwtpm" ]
+      [ "virtualisation" "libvirtd" "qemu" "swtpm" "enable" ])
   ];
 
   ###### interface
@@ -56,17 +173,6 @@ in {
       '';
     };
 
-    qemuPackage = mkOption {
-      type = types.package;
-      default = pkgs.qemu;
-      defaultText = literalExpression "pkgs.qemu";
-      description = ''
-        Qemu package to use with libvirt.
-        `pkgs.qemu` can emulate alien architectures (e.g. aarch64 on x86)
-        `pkgs.qemu_kvm` saves disk space allowing to emulate only host architectures.
-      '';
-    };
-
     extraConfig = mkOption {
       type = types.lines;
       default = "";
@@ -76,56 +182,6 @@ in {
       '';
     };
 
-    qemuRunAsRoot = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        If true,  libvirtd runs qemu as root.
-        If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.
-        Changing this option to false may cause file permission issues
-        for existing guests. To fix these, manually change ownership
-        of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
-      '';
-    };
-
-    qemuVerbatimConfig = mkOption {
-      type = types.lines;
-      default = ''
-        namespaces = []
-      '';
-      description = ''
-        Contents written to the qemu configuration file, qemu.conf.
-        Make sure to include a proper namespace configuration when
-        supplying custom configuration.
-      '';
-    };
-
-    qemuOvmf = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Allows libvirtd to take advantage of OVMF when creating new
-        QEMU VMs with UEFI boot.
-      '';
-    };
-
-    qemuOvmfPackage = mkOption {
-      type = types.package;
-      default = pkgs.OVMF;
-      defaultText = literalExpression "pkgs.OVMF";
-      example = literalExpression "pkgs.OVMFFull";
-      description = ''
-        OVMF package to use.
-      '';
-    };
-    qemuSwtpm = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Allows libvirtd to use swtpm to create an emulated TPM.
-      '';
-    };
-
     extraOptions = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -136,7 +192,7 @@ in {
     };
 
     onBoot = mkOption {
-      type = types.enum ["start" "ignore" ];
+      type = types.enum [ "start" "ignore" ];
       default = "start";
       description = ''
         Specifies the action to be done to / on the guests when the host boots.
@@ -148,7 +204,7 @@ in {
     };
 
     onShutdown = mkOption {
-      type = types.enum ["shutdown" "suspend" ];
+      type = types.enum [ "shutdown" "suspend" ];
       default = "suspend";
       description = ''
         When shutting down / restarting the host what method should
@@ -166,6 +222,13 @@ in {
       '';
     };
 
+    qemu = mkOption {
+      type = qemuModule;
+      default = { };
+      description = ''
+        QEMU related options.
+      '';
+    };
   };
 
 
@@ -179,17 +242,19 @@ in {
         message = "The libvirtd module currently requires Polkit to be enabled ('security.polkit.enable = true').";
       }
       {
-        assertion = builtins.elem "fd" cfg.qemuOvmfPackage.outputs;
+        assertion = builtins.elem "fd" cfg.qemu.ovmf.package.outputs;
         message = "The option 'virtualisation.libvirtd.qemuOvmfPackage' needs a package that has an 'fd' output.";
       }
     ];
 
     environment = {
       # this file is expected in /etc/qemu and not sysconfdir (/var/lib)
-      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
+      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n"
-        "allow ${e}") cfg.allowedBridges;
+        (e:
-      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
+          "allow ${e}")
-      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
+        cfg.allowedBridges;
+      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemu.package ];
+      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];
@@ -230,17 +295,17 @@ in {
         cp -f ${qemuConfigFile} /var/lib/${dirName}/qemu.conf
 
         # stable (not GC'able as in /nix/store) paths for using in <emulator> section of xml configs
-        for emulator in ${cfg.package}/libexec/libvirt_lxc ${cfg.qemuPackage}/bin/qemu-kvm ${cfg.qemuPackage}/bin/qemu-system-*; do
+        for emulator in ${cfg.package}/libexec/libvirt_lxc ${cfg.qemu.package}/bin/qemu-kvm ${cfg.qemu.package}/bin/qemu-system-*; do
           ln -s --force "$emulator" /run/${dirName}/nix-emulators/
         done
 
         for helper in libexec/qemu-bridge-helper bin/qemu-pr-helper; do
-          ln -s --force ${cfg.qemuPackage}/$helper /run/${dirName}/nix-helpers/
+          ln -s --force ${cfg.qemu.package}/$helper /run/${dirName}/nix-helpers/
         done
 
-        ${optionalString cfg.qemuOvmf ''
+        ${optionalString cfg.qemu.ovmf.enable ''
-          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemu.ovmf.package.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
-          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemu.ovmf.package.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
         ''}
       '';
 
@@ -256,16 +321,20 @@ in {
     systemd.services.libvirtd = {
       requires = [ "libvirtd-config.service" ];
       after = [ "libvirtd-config.service" ]
-              ++ optional vswitch.enable "ovs-vswitchd.service";
+        ++ optional vswitch.enable "ovs-vswitchd.service";
 
       environment.LIBVIRTD_ARGS = escapeShellArgs (
-        [ "--config" configFile
+        [
-          "--timeout" "120"     # from ${libvirt}/var/lib/sysconfig/libvirtd
+          "--config"
-        ] ++ cfg.extraOptions);
+          configFile
+          "--timeout"
+          "120" # from ${libvirt}/var/lib/sysconfig/libvirtd
+        ] ++ cfg.extraOptions
+      );
 
-      path = [ cfg.qemuPackage ] # libvirtd requires qemu-img to manage disk images
+      path = [ cfg.qemu.package ] # libvirtd requires qemu-img to manage disk images
-             ++ optional vswitch.enable vswitch.package
+        ++ optional vswitch.enable vswitch.package
-             ++ optional cfg.qemuSwtpm pkgs.swtpm;
+        ++ optional cfg.qemu.swtpm.enable cfg.qemu.swtpm.package;
 
       serviceConfig = {
         Type = "notify";

nixos/tests/all-tests.nix

@@ -311,6 +311,7 @@ in
   nitter = handleTest ./nitter.nix {};
   nix-serve = handleTest ./nix-ssh-serve.nix {};
   nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
+  nixops = handleTest ./nixops/default.nix {};
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
   node-red = handleTest ./node-red.nix {};
   nomad = handleTest ./nomad.nix {};

nixos/tests/nixops/default.nix

@@ -0,0 +1,115 @@
+{ pkgs, ... }:
+let
+  inherit (pkgs) lib;
+
+  tests = {
+    # TODO: uncomment stable
+    #  - Blocked on https://github.com/NixOS/nixpkgs/issues/138584 which has a
+    #    PR in staging: https://github.com/NixOS/nixpkgs/pull/139986
+    #  - Alternatively, blocked on a NixOps 2 release
+    #    https://github.com/NixOS/nixops/issues/1242
+    # stable = testsLegacyNetwork { nixopsPkg = pkgs.nixops; };
+    unstable = testsForPackage { nixopsPkg = pkgs.nixopsUnstable; };
+
+    # inherit testsForPackage;
+  };
+
+  testsForPackage = lib.makeOverridable (args: lib.recurseIntoAttrs {
+    legacyNetwork = testLegacyNetwork args;
+  });
+
+  testLegacyNetwork = { nixopsPkg }: pkgs.nixosTest ({
+    nodes = {
+      deployer = { config, lib, nodes, pkgs, ... }: {
+        imports = [ ../../modules/installer/cd-dvd/channel.nix ];
+        environment.systemPackages = [ nixopsPkg ];
+        nix.binaryCaches = lib.mkForce [ ];
+        users.users.person.isNormalUser = true;
+        virtualisation.writableStore = true;
+        virtualisation.memorySize = 1024 /*MiB*/;
+        virtualisation.pathsInNixDB = [
+          pkgs.hello
+          pkgs.figlet
+
+          # This includes build dependencies all the way down. Not efficient,
+          # but we do need build deps to an *arbitrary* depth, which is hard to
+          # determine.
+          (allDrvOutputs nodes.server.config.system.build.toplevel)
+        ];
+      };
+      server = { lib, ... }: {
+        imports = [ ./legacy/base-configuration.nix ];
+      };
+    };
+
+    testScript = { nodes }:
+      let
+        deployerSetup = pkgs.writeScript "deployerSetup" ''
+          #!${pkgs.runtimeShell}
+          set -eux -o pipefail
+          cp --no-preserve=mode -r ${./legacy} unicorn
+          cp --no-preserve=mode ${../ssh-keys.nix} unicorn/ssh-keys.nix
+          mkdir -p ~/.ssh
+          cp ${snakeOilPrivateKey} ~/.ssh/id_ed25519
+          chmod 0400 ~/.ssh/id_ed25519
+        '';
+        serverNetworkJSON = pkgs.writeText "server-network.json"
+          (builtins.toJSON nodes.server.config.system.build.networkConfig);
+      in
+      ''
+        import shlex
+
+        def deployer_do(cmd):
+            cmd = shlex.quote(cmd)
+            return deployer.succeed(f"su person -l -c {cmd} &>/dev/console")
+
+        start_all()
+
+        deployer_do("cat /etc/hosts")
+
+        deployer_do("${deployerSetup}")
+        deployer_do("cp ${serverNetworkJSON} unicorn/server-network.json")
+
+        # Establish that ssh works, regardless of nixops
+        # Easy way to accept the server host key too.
+        server.wait_for_open_port(22)
+        deployer.wait_for_unit("network.target")
+
+        # Put newlines on console, to flush the console reader's line buffer
+        # in case nixops' last output did not end in a newline, as is the case
+        # with a status line (if implemented?)
+        deployer.succeed("while sleep 60s; do echo [60s passed] >/dev/console; done &")
+
+        deployer_do("cd ~/unicorn; ssh -oStrictHostKeyChecking=accept-new root@server echo hi")
+
+        # Create and deploy
+        deployer_do("cd ~/unicorn; nixops create")
+
+        deployer_do("cd ~/unicorn; nixops deploy --confirm")
+
+        deployer_do("cd ~/unicorn; nixops ssh server 'hello | figlet'")
+      '';
+  });
+
+  inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+
+  /*
+    Return a store path with a closure containing everything including
+    derivations and all build dependency outputs, all the way down.
+  */
+  allDrvOutputs = pkg:
+    let name = lib.strings.sanitizeDerivationName "allDrvOutputs-${pkg.pname or pkg.name or "unknown"}";
+    in
+    pkgs.runCommand name { refs = pkgs.writeReferencesToFile pkg.drvPath; } ''
+      touch $out
+      while read ref; do
+        case $ref in
+          *.drv)
+            cat $ref >>$out
+            ;;
+        esac
+      done <$refs
+    '';
+
+in
+tests

nixos/tests/nixops/legacy/base-configuration.nix

@@ -0,0 +1,31 @@
+{ lib, modulesPath, pkgs, ... }:
+let
+  ssh-keys =
+    if builtins.pathExists ../../ssh-keys.nix
+    then # Outside sandbox
+      ../../ssh-keys.nix
+    else # In sandbox
+      ./ssh-keys.nix;
+
+  inherit (import ssh-keys pkgs)
+    snakeOilPrivateKey snakeOilPublicKey;
+in
+{
+  imports = [
+    (modulesPath + "/virtualisation/qemu-vm.nix")
+    (modulesPath + "/testing/test-instrumentation.nix")
+  ];
+  virtualisation.writableStore = true;
+  nix.binaryCaches = lib.mkForce [ ];
+  virtualisation.graphics = false;
+  documentation.enable = false;
+  services.qemuGuest.enable = true;
+  boot.loader.grub.enable = false;
+
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys = [
+    snakeOilPublicKey
+  ];
+  security.pam.services.sshd.limits =
+    [{ domain = "*"; item = "memlock"; type = "-"; value = 1024; }];
+}

nixos/tests/nixops/legacy/nixops.nix

@@ -0,0 +1,15 @@
+{
+  network = {
+    description = "Legacy Network using <nixpkgs> and legacy state.";
+    # NB this is not really what makes it a legacy network; lack of flakes is.
+    storage.legacy = { };
+  };
+  server = { lib, pkgs, ... }: {
+    deployment.targetEnv = "none";
+    imports = [
+      ./base-configuration.nix
+      (lib.modules.importJSON ./server-network.json)
+    ];
+    environment.systemPackages = [ pkgs.hello pkgs.figlet ];
+  };
+}

nixos/tests/samba.nix

@@ -20,6 +20,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       server =
         { ... }:
         { services.samba.enable = true;
+          services.samba.openFirewall = true;
           services.samba.shares.public =
             { path = "/public";
               "read only" = true;
@@ -27,8 +28,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
               "guest ok" = "yes";
               comment = "Public samba share.";
             };
-          networking.firewall.allowedTCPPorts = [ 139 445 ];
-          networking.firewall.allowedUDPPorts = [ 137 138 ];
         };
     };
 

pkgs/applications/audio/pavucontrol/default.nix

@@ -1,26 +1,35 @@
-{ fetchurl, fetchpatch, lib, stdenv, pkg-config, intltool, libpulseaudio,
+{ fetchurl
-gtkmm3 , libcanberra-gtk3, gnome, wrapGAppsHook }:
+, fetchpatch
+, lib
+, stdenv
+, pkg-config
+, intltool
+, libpulseaudio
+, gtkmm3
+, libsigcxx
+, libcanberra-gtk3
+, json-glib
+, gnome
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "pavucontrol";
-  version = "4.0";
+  version = "5.0";
 
   src = fetchurl {
     url = "https://freedesktop.org/software/pulseaudio/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1qhlkl3g8d7h72xjskii3g1l7la2cavwp69909pzmbi2jyn5pi4g";
+    sha256 = "sha256-zityw7XxpwrQ3xndgXUPlFW9IIcNHTo20gU2ry6PTno=";
   };
 
-  patches = [
+  buildInputs = [
-    # Can be removed with the next version bump
+    libpulseaudio
-    # https://gitlab.freedesktop.org/pulseaudio/pavucontrol/-/merge_requests/20
+    gtkmm3
-    (fetchpatch {
+    libsigcxx
-      name = "streamwidget-fix-drop-down-wayland.patch";
+    libcanberra-gtk3
-      url = "https://gitlab.freedesktop.org/pulseaudio/pavucontrol/-/commit/ae278b8643cf1089f66df18713c8154208d9a505.patch";
+    json-glib
-      sha256 = "066vhxjz6gmi2sp2n4pa1cdsxjnq6yml5js094g5n7ld34p84dpj";
+    gnome.adwaita-icon-theme
-  })];
+  ];
-
-  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3
-                  gnome.adwaita-icon-theme ];
 
   nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
 

pkgs/applications/audio/reaper/default.nix

@@ -17,12 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "6.29";
+  version = "6.38";
 
   src = fetchurl {
-    url = "https://www.reaper.fm/files/${lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_${stdenv.targetPlatform.qemuArch}.tar.xz";
+    url = "https://www.reaper.fm/files/${lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_${stdenv.hostPlatform.qemuArch}.tar.xz";
-    hash = if stdenv.isx86_64 then "sha256-DOul6J2Y7szy4+Q4SeO0uG6PSuU+MELE7ky8W3mSpTQ="
+    hash = {
-                              else "sha256-67iTi6bFlbQtyCjnPIjK8K/3aV+zaCsWBRCWmgYonM4=";
+      x86_64-linux = "sha256-K5EnrmzP8pyW9dR1fbMzkPzpS6aHm8JF1+m3afnH4rU=";
+      aarch64-linux = "sha256-6wNWDXjQNyfU2l9Xi9JtmAuoKtHuIY5cvNMjYkwh2Sk=";
+    }.${stdenv.hostPlatform.system};
   };
 
   nativeBuildInputs = [
@@ -76,6 +78,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.reaper.fm/";
     license = licenses.unfree;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ jfrankenau ilian ];
+    maintainers = with maintainers; [ jfrankenau ilian orivej ];
   };
 }

pkgs/applications/blockchains/electrs/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "electrs";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "romanz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04dqbn2nfzllxfcn3v9vkfy2hn2syihijr575621r1pj65pcgf8y";
+    hash = "sha256-GDO8iGntQncvdJiDMBJk9GrGF9JToasbLRzju3S0TS0=";
   };
 
-  cargoSha256 = "0hl8q62lankrab8gq9vxmkn68drs0hw5pk0q6aiq8fxsb63dzsw0";
+  cargoHash = "sha256-Ms785+3Z4xEUW8FRRu1FIHk7HSWYLBThKlJDFjW6j0I=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ llvmPackages.clang ];

pkgs/applications/blockchains/electrs/update.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq git gnupg common-updater-scripts
+set -euo pipefail
+
+# Fetch latest release, GPG-verify the tag, update derivation
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../..)
+
+oldVersion=$(nix-instantiate --eval -E "(import \"$nixpkgs\" { config = {}; overlays = []; }).electrs.version" | tr -d '"')
+version=$(curl -s --show-error "https://api.github.com/repos/romanz/electrs/releases/latest" | jq -r '.tag_name' | tail -c +2)
+
+if [[ $version == $oldVersion ]]; then
+  echo "Already at latest version $version"
+  exit 0
+fi
+echo "New version: $version"
+
+tmpdir=$(mktemp -d /tmp/electrs-verify-gpg.XXX)
+repo=$tmpdir/repo
+trap "rm -rf $tmpdir" EXIT
+
+git clone --depth 1 --branch v${version} -c advice.detachedHead=false https://github.com/romanz/electrs $repo
+
+export GNUPGHOME=$tmpdir
+echo
+echo "Fetching romanz's key"
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 15c8c3574ae4f1e25f3f35c587cae5fa46917cbb 2> /dev/null
+echo
+echo "Verifying commit"
+git -C $repo verify-tag v${version}
+
+rm -rf $repo/.git
+hash=$(nix hash path $repo)
+
+(cd "$nixpkgs" && update-source-version electrs "$version" "$hash")
+sed -i 's|cargoHash = .*|cargoHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";|' "$scriptDir/default.nix"
+echo
+echo "electrs: $oldVersion -> $version"

pkgs/applications/blockchains/wasabiwallet/default.nix

@@ -2,7 +2,7 @@
 , fetchurl
 , makeDesktopItem
 , curl
-, dotnet-netcore
+, dotnetCorePackages
 , fontconfig
 , krb5
 , openssl
@@ -11,9 +11,10 @@
 }:
 
 let
+  dotnet-runtime = dotnetCorePackages.runtime_5_0;
   libPath = lib.makeLibraryPath [
     curl
-    dotnet-netcore
+    dotnet-runtime
     fontconfig.lib
     krb5
     openssl

pkgs/applications/graphics/epick/default.nix

@@ -0,0 +1,56 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, python3
+, libGL
+, libX11
+, libXcursor
+, libXi
+, libXrandr
+, libxcb
+, libxkbcommon
+, AppKit
+, IOKit
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "epick";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "vv9k";
+    repo = pname;
+    rev = version;
+    sha256 = "0l7m45bqx62nrwi0r4pdwxcq37s7h3nnawk9nq2zpvl9wcgnx3gc";
+  };
+
+  cargoSha256 = "sha256-LERV3+zwt5oVfyueGfxM7HsOha4cuWTkPyvPQwHSZqo=";
+
+  nativeBuildInputs = lib.optional stdenv.isLinux python3;
+
+  buildInputs = lib.optionals stdenv.isLinux [
+    libGL
+    libX11
+    libXcursor
+    libXi
+    libXrandr
+    libxcb
+    libxkbcommon
+  ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
+    IOKit
+  ];
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    patchelf --set-rpath ${lib.makeLibraryPath buildInputs} $out/bin/epick
+  '';
+
+  meta = with lib; {
+    description = "Simple color picker that lets the user create harmonic palettes with ease";
+    homepage = "https://github.com/vv9k/epick";
+    changelog = "https://github.com/vv9k/epick/blob/${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/applications/misc/calibre/default.nix

@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchurl
+, fetchpatch
 , poppler_utils
 , pkg-config
 , libpng
@@ -26,18 +27,21 @@
 
 mkDerivation rec {
   pname = "calibre";
-  version = "5.24.0";
+  version = "5.29.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256:18dr577nv7ijw3ar6mrk2xrc54mlrqkaj5jrc6s5sirl0710fdfg";
+    sha256 = "sha256-9ymHEpTHDUM3NAGoeSETzKRLKgJLRY4eEli6N5lbZug=";
   };
 
+  # https://sources.debian.org/patches/calibre/5.29.0+dfsg-1
   patches = [
-    # Plugin installation (very insecure) disabled (from Debian)
+    #  allow for plugin update check, but no calibre version check
-    ./disable_plugins.patch
+    (fetchpatch {
-    # Automatic version update disabled by default (from Debian)
+      name = "0001_only_plugin_update.patch";
-    ./no_updates_dialog.patch
+      url = "https://sources.debian.org/data/main/c/calibre/5.29.0%2Bdfsg-1/debian/patches/0001-only-plugin-update.patch";
+      sha256 = "sha256-aGT8rJ/eQKAkmyHBWdY0ouZuWvDwtLVJU5xY6d3hY3k=";
+    })
   ]
   ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
 

pkgs/applications/misc/calibre/disable_plugins.patch

@@ -1,17 +0,0 @@
-Description: Disable plugin dialog. It uses a totally non-authenticated and non-trusted way of installing arbitrary code.
-Author: Martin Pitt <mpitt@debian.org>
-Bug-Debian: http://bugs.debian.org/640026
-
-Index: calibre-0.8.29+dfsg/src/calibre/gui2/actions/preferences.py
-===================================================================
---- calibre-0.8.29+dfsg.orig/src/calibre/gui2/actions/preferences.py	2011-12-16 05:49:14.000000000 +0100
-+++ calibre-0.8.29+dfsg/src/calibre/gui2/actions/preferences.py	2011-12-20 19:29:04.798468930 +0100
-@@ -28,8 +28,6 @@
-             pm.addAction(QIcon(I('config.png')), _('Preferences'), self.do_config)
-         cm('welcome wizard', _('Run welcome wizard'),
-                 icon='wizard.png', triggered=self.gui.run_wizard)
--        cm('plugin updater', _('Get plugins to enhance calibre'),
--                icon='plugins/plugin_updater.png', triggered=self.get_plugins)
-         if not DEBUG:
-             pm.addSeparator()
-             cm('restart', _('Restart in debug mode'), icon='debug.png',

pkgs/applications/misc/calibre/no_updates_dialog.patch

@@ -1,15 +0,0 @@
-diff -burN calibre-2.9.0.orig/src/calibre/gui2/main.py calibre-2.9.0/src/calibre/gui2/main.py
---- calibre-2.9.0.orig/src/calibre/gui2/main.py	2014-11-09 20:09:54.081231882 +0800
-+++ calibre-2.9.0/src/calibre/gui2/main.py	2014-11-09 20:15:48.193033844 +0800
-@@ -37,8 +37,9 @@
-                       help=_('Start minimized to system tray.'))
-     parser.add_option('-v', '--verbose', default=0, action='count',
-                       help=_('Ignored, do not use. Present only for legacy reasons'))
--    parser.add_option('--no-update-check', default=False, action='store_true',
--            help=_('Do not check for updates'))
-+    parser.add_option('--update-check', dest='no_update_check', default=True,
-+            action='store_false',
-+            help=_('Check for updates'))
-     parser.add_option('--ignore-plugins', default=False, action='store_true',
-             help=_('Ignore custom plugins, useful if you installed a plugin'
-                 ' that is preventing calibre from starting'))

pkgs/applications/misc/lutris/default.nix

@@ -15,6 +15,11 @@
 , webkitgtk
 , wrapGAppsHook
 
+  # check inputs
+, xvfb-run
+, nose
+, flake8
+
   # python dependencies
 , dbus-python
 , distro
@@ -46,7 +51,7 @@
 
 let
   # See lutris/util/linux.py
-  binPath = lib.makeBinPath [
+  requiredTools = [
     xrandr
     pciutils
     psmisc
@@ -64,6 +69,8 @@ let
     xorg.xkbcomp
   ];
 
+  binPath = lib.makeBinPath requiredTools;
+
   gstDeps = with gst_all_1; [
     gst-libav
     gst-plugins-bad
@@ -76,13 +83,13 @@ let
 in
 buildPythonApplication rec {
   pname = "lutris-original";
-  version = "0.5.8.4";
+  version = "0.5.9.1";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    sha256 = "sha256-5ivXIgDyM9PRvuUhPFPgziXDvggcL+p65kI2yOaiS1M=";
+    sha256 = "sha256-ykPJneCKbFKv0x/EDo9PkRb1LkMeFeYzTDmvE3ShNe0=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
@@ -111,6 +118,20 @@ buildPythonApplication rec {
     python_magic
   ];
 
+  checkInputs = [ xvfb-run nose flake8 ] ++ requiredTools;
+  preCheck = "export HOME=$PWD";
+  checkPhase = ''
+    runHook preCheck
+    xvfb-run -s '-screen 0 800x600x24' make test
+    runHook postCheck
+  '';
+
+  # unhardcodes xrandr and fixes nosetests
+  # upstream in progress: https://github.com/lutris/lutris/pull/3754
+  patches = [
+    ./fixes.patch
+  ];
+
   # avoid double wrapping
   dontWrapGApps = true;
   makeWrapperArgs = [
@@ -121,8 +142,6 @@ buildPythonApplication rec {
   # see https://github.com/NixOS/nixpkgs/issues/56943
   strictDeps = false;
 
-  preCheck = "export HOME=$PWD";
-
   meta = with lib; {
     homepage = "https://lutris.net";
     description = "Open Source gaming platform for GNU/Linux";

pkgs/applications/misc/lutris/fixes.patch

@@ -0,0 +1,67 @@
+diff --git a/Makefile b/Makefile
+index 821a9500..75affa77 100644
+--- a/Makefile
++++ b/Makefile
+@@ -25,12 +25,12 @@ release: build-source upload upload-ppa
+ 
+ test:
+ 	rm tests/fixtures/pga.db -f
+-	nosetests3
++	nosetests
+ 
+ cover:
+ 	rm tests/fixtures/pga.db -f
+ 	rm tests/coverage/ -rf
+-	nosetests3 --with-coverage --cover-package=lutris --cover-html --cover-html-dir=tests/coverage
++	nosetests --with-coverage --cover-package=lutris --cover-html --cover-html-dir=tests/coverage
+ 
+ pgp-renew:
+ 	osc signkey --extend home:strycore
+diff --git a/lutris/util/graphics/xrandr.py b/lutris/util/graphics/xrandr.py
+index f788c94c..5544dbe9 100644
+--- a/lutris/util/graphics/xrandr.py
++++ b/lutris/util/graphics/xrandr.py
+@@ -5,6 +5,7 @@ from collections import namedtuple
+ 
+ from lutris.util.log import logger
+ from lutris.util.system import read_process_output
++from lutris.util.linux import LINUX_SYSTEM
+ 
+ Output = namedtuple("Output", ("name", "mode", "position", "rotation", "primary", "rate"))
+ 
+@@ -12,7 +13,7 @@ Output = namedtuple("Output", ("name", "mode", "position", "rotation", "primary"
+ def _get_vidmodes():
+     """Return video modes from XrandR"""
+     logger.debug("Retrieving video modes from XrandR")
+-    return read_process_output(["xrandr"]).split("\n")
++    return read_process_output([LINUX_SYSTEM.get("xrandr")]).split("\n")
+ 
+ 
+ def get_outputs():  # pylint: disable=too-many-locals
+@@ -76,7 +77,7 @@ def turn_off_except(display):
+     for output in get_outputs():
+         if output.name != display:
+             logger.info("Turning off %s", output[0])
+-            subprocess.Popen(["xrandr", "--output", output.name, "--off"])
++            subprocess.Popen([LINUX_SYSTEM.get("xrandr"), "--output", output.name, "--off"])
+ 
+ 
+ def get_resolutions():
+@@ -111,7 +112,7 @@ def change_resolution(resolution):
+             logger.warning("Resolution %s doesn't exist.", resolution)
+         else:
+             logger.info("Changing resolution to %s", resolution)
+-            subprocess.Popen(["xrandr", "-s", resolution])
++            subprocess.Popen([LINUX_SYSTEM.get("xrandr"), "-s", resolution])
+     else:
+         for display in resolution:
+             logger.debug("Switching to %s on %s", display.mode, display.name)
+@@ -128,7 +129,7 @@ def change_resolution(resolution):
+             logger.info("Switching resolution of %s to %s", display.name, display.mode)
+             subprocess.Popen(
+                 [
+-                    "xrandr",
++                    LINUX_SYSTEM.get("xrandr"),
+                     "--output",
+                     display.name,
+                     "--mode",

pkgs/applications/misc/upwork/default.nix

@@ -6,15 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.6.8.0";
+  version = "5.6.9.3";
 
   src = fetchurl {
-    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_8_0_836f43f6f6be4149/${pname}_${version}_amd64.deb";
+    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_9_3_10c2eb9781db4d7f/${pname}_${version}_amd64.deb";
-    sha256 = "b3a52f773d633837882dc107b206006325722ca5d5d5a1e8bdf5453f872e1b6f";
+    sha256 = "0b884aa6992d438cee09f58673780218a00a823e03c114b0c753947020c0a327";
   };
 
-  dontWrapGApps = true;
-
   nativeBuildInputs = [
     dpkg
     wrapGAppsHook
@@ -31,6 +29,10 @@ stdenv.mkDerivation rec {
 
   libPath = lib.makeLibraryPath buildInputs;
 
+  dontWrapGApps = true;
+  dontBuild = true;
+  dontConfigure = true;
+
   unpackPhase = ''
     dpkg-deb -x ${src} ./
   '';

pkgs/applications/networking/cluster/nixops/default.nix

@@ -1,4 +1,5 @@
-{ pkgs
+{ nixosTests
+, pkgs
 , poetry2nix
 , lib
 , overrides ? (self: super: {})
@@ -59,10 +60,17 @@ let
     }
   ).python;
 
-in interpreter.pkgs.nixops.withPlugins(ps: [
+  pkg = interpreter.pkgs.nixops.withPlugins(ps: [
-  ps.nixops-encrypted-links
+    ps.nixops-encrypted-links
-  ps.nixops-virtd
+    ps.nixops-virtd
-  ps.nixops-aws
+    ps.nixops-aws
-  ps.nixops-gcp
+    ps.nixops-gcp
-  ps.nixopsvbox
+    ps.nixopsvbox
-])
+  ]) // rec {
+    # Workaround for https://github.com/NixOS/nixpkgs/issues/119407
+    # TODO after #1199407: Use .overrideAttrs(pkg: old: { passthru.tests = .....; })
+    tests = nixosTests.nixops.unstable.override { nixopsPkg = pkg; };
+    # Not strictly necessary, but probably expected somewhere; part of the workaround:
+    passthru.tests = tests;
+  };
+in pkg

pkgs/applications/networking/flexget/default.nix

@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.1.139";
+  version = "3.1.140";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
     owner = "flexget";
     repo = "flexget";
     rev = "v${version}";
-    sha256 = "0gnj89q5mv5qiy6zsp85sswmwzm0y73nffjj3vrccx5lmxd955nv";
+    sha256 = "15ngmpqqx902l7gxg2lb6h8q8vmjk247jbqhc92l1apr1imjqcc5";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix

@@ -0,0 +1,92 @@
+{ lib, stdenv, pkgs, fetchurl }:
+let
+  libPathNative = { packages }: lib.makeLibraryPath packages;
+in
+stdenv.mkDerivation rec {
+  pname = "rocketchat-desktop";
+  version = "3.5.7";
+
+  src = fetchurl {
+    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
+    sha256 = "1ri8a60fsbqgq83f8wkyfnd59nqk4d0gpz1vanj54769zflpl71s";
+  };
+
+  buildInputs = with pkgs; [
+    gtk3
+    stdenv.cc.cc
+    zlib
+    glib
+    dbus
+    atk
+    pango
+    freetype
+    libgnome-keyring3
+    fontconfig
+    gdk-pixbuf
+    cairo
+    cups
+    expat
+    libgpg-error
+    alsa-lib
+    nspr
+    nss
+    xorg.libXrender
+    xorg.libX11
+    xorg.libXext
+    xorg.libXdamage
+    xorg.libXtst
+    xorg.libXcomposite
+    xorg.libXi
+    xorg.libXfixes
+    xorg.libXrandr
+    xorg.libXcursor
+    xorg.libxkbfile
+    xorg.libXScrnSaver
+    systemd
+    libnotify
+    xorg.libxcb
+    at-spi2-atk
+    at-spi2-core
+    libdbusmenu
+    libdrm
+    mesa
+    xorg.libxshmfence
+    libxkbcommon
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    ar p $src data.tar.xz | tar xJ ./opt/ ./usr/
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    mv opt $out
+    mv usr/share $out
+    ln -s $out/opt/Rocket.Chat/rocketchat-desktop $out/bin/rocketchat-desktop
+    runHook postInstall
+  '';
+
+  postFixup =
+    let
+      libpath = libPathNative { packages = buildInputs; };
+    in
+    ''
+      app=$out/opt/Rocket.Chat
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${libpath}:$app" \
+        $app/rocketchat-desktop
+      sed -i -e "s|Exec=.*$|Exec=$out/bin/rocketchat-desktop|" $out/share/applications/rocketchat-desktop.desktop
+    '';
+
+  meta = with lib; {
+    description = "Official Desktop client for Rocket.Chat";
+    homepage = "https://github.com/RocketChat/Rocket.Chat.Electron";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gbtb ];
+    platforms = platforms.x86_64;
+  };
+}

pkgs/applications/networking/msmtp/default.nix

@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "msmtp";
-  version = "1.8.16";
+  version = "1.8.17";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1n271yr83grpki9szdirnk6wb5rcc319f0gmfabyw3fzyf4msjy0";
+    sha256 = "sha256-D92+dMGp3PZGG0obDbPk00JmGEUAxAPX8QetQttOxNM=";
   };
 
   patches = [

pkgs/applications/science/biology/fastp/default.nix

@@ -1,20 +1,23 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , zlib
+, libdeflate
+, isa-l
 }:
 
 stdenv.mkDerivation rec {
   pname = "fastp";
-  version = "0.22.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "OpenGene";
     repo = "fastp";
     rev = "v${version}";
-    sha256 = "sha256-XR76hNz7iGXQYSBbBandHZ+oU3wyTf1AKlu9Xeq/GyE=";
+    sha256 = "sha256-vRJlNtg2JabBAUaX91Y04z8MdyxEnreBAlIHn7VB+u4=";
   };
 
-  buildInputs = [ zlib ];
+  buildInputs = [ zlib libdeflate isa-l ];
 
   installPhase = ''
     install -D fastp $out/bin/fastp

pkgs/applications/version-management/git-and-tools/git-branchless/default.nix

@@ -1,9 +1,11 @@
-{ lib, fetchFromGitHub
+{ lib
-
+, fetchFromGitHub
-, coreutils
+, fetchpatch
 , git
 , libiconv
 , ncurses
+, openssl
+, pkg-config
 , rustPlatform
 , sqlite
 , stdenv
@@ -13,45 +15,38 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-branchless";
-  version = "0.3.2";
+  version = "0.3.6-nixos.0";
 
   src = fetchFromGitHub {
     owner = "arxanas";
     repo = "git-branchless";
     rev = "v${version}";
-    sha256 = "0pfiyb23ah1h6risrhjr8ky7b1k1f3yfc3z70s92q3czdlrk6k07";
+    sha256 = "sha256-Sq+43w7xgrCe2w+9A/gfe/34+K2IgZVholtD+WF59Qo=";
   };
 
-  cargoSha256 = "0gplx80xhpz8kwry7l4nv4rlj9z02jg0sgb6zy1y3vd9s2j5wals";
+  cargoSha256 = "sha256-tCpvIqGMklOUJ/+d8poq4uz2EyZTkBmtlkA/BUIVPxs=";
 
-  # Remove path hardcodes patching if they get fixed upstream, see:
+  nativeBuildInputs = [ pkg-config ];
-  # https://github.com/arxanas/git-branchless/issues/26
-  postPatch = ''
-    # Inline test hardcodes `echo` location.
-    substituteInPlace ./src/commands/wrap.rs --replace '/bin/echo' '${coreutils}/bin/echo'
-
-    # Tests in general hardcode `git` location.
-    substituteInPlace ./src/testing.rs --replace '/usr/bin/git' '${git}/bin/git'
-  '';
 
   buildInputs = [
     ncurses
+    openssl
     sqlite
-  ] ++ lib.optionals (stdenv.isDarwin) [
+  ] ++ lib.optionals stdenv.isDarwin [
     Security
     SystemConfiguration
     libiconv
   ];
 
   preCheck = ''
-    # Tests require path to git.
     export PATH_TO_GIT=${git}/bin/git
+    export GIT_EXEC_PATH=$(${git}/bin/git --exec-path)
   '';
 
   meta = with lib; {
     description = "A suite of tools to help you visualize, navigate, manipulate, and repair your commit history";
     homepage = "https://github.com/arxanas/git-branchless";
-    license = licenses.asl20;
+    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ msfjarvis nh2 ];
+    maintainers = with maintainers; [ msfjarvis nh2 hmenke ];
   };
 }

pkgs/applications/version-management/git-and-tools/glitter/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "glitter";
-  version = "1.4.4";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "milo123459";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hj1md4h4m1g7cx41sjihlr8xq0zhkikci4cp2gbldqcq5x8iws4";
+    sha256 = "sha256-5yv0RZfGLS/cxOxettHQHSPldcq+xa+TNj6dDIAmzOM=";
   };
 
-  cargoSha256 = "sha256-2QgL8iH0FNlUR/863YML3PLad8lRkYjfSmbl49LTfWw=";
+  cargoSha256 = "sha256-xG7aic7NCcltz9YmQ4V40/h3OR8Vt5IgApp4yoDbPuc=";
 
   # tests require it to be in a git repository
   preCheck = ''

pkgs/applications/version-management/mercurial/4.9.nix

@@ -1,68 +0,0 @@
-{ lib, stdenv, fetchurl, python2Packages, makeWrapper
-, guiSupport ? false, tk ? null
-, ApplicationServices
-}:
-
-let
-  inherit (python2Packages) docutils hg-git dulwich python;
-
-in python2Packages.buildPythonApplication rec {
-  pname = "mercurial";
-  version = "4.9.1";
-
-  src = fetchurl {
-    url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "0iybbkd9add066729zg01kwz5hhc1s6lhp9rrnsmzq6ihyxj3p8v";
-  };
-
-  format = "other";
-
-  inherit python; # pass it so that the same version can be used in hg2git
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ docutils ]
-    ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];
-
-  propagatedBuildInputs = [ hg-git dulwich ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  postInstall = (lib.optionalString guiSupport
-    ''
-      mkdir -p $out/etc/mercurial
-      cp contrib/hgk $out/bin
-      cat >> $out/etc/mercurial/hgrc << EOF
-      [extensions]
-      hgk=$out/lib/${python.libPrefix}/site-packages/hgext/hgk.py
-      EOF
-      # setting HG so that hgk can be run itself as well (not only hg view)
-      WRAP_TK=" --set TK_LIBRARY ${tk}/lib/${tk.libPrefix}
-                --set HG $out/bin/hg
-                --prefix PATH : ${tk}/bin "
-    '') +
-    ''
-      for i in $(cd $out/bin && ls); do
-        wrapProgram $out/bin/$i \
-          $WRAP_TK
-      done
-
-      # copy hgweb.cgi to allow use in apache
-      mkdir -p $out/share/cgi-bin
-      cp -v hgweb.cgi contrib/hgweb.wsgi $out/share/cgi-bin
-      chmod u+x $out/share/cgi-bin/hgweb.cgi
-
-      # install bash/zsh completions
-      install -v -m644 -D contrib/bash_completion $out/share/bash-completion/completions/_hg
-      install -v -m644 -D contrib/zsh_completion $out/share/zsh/site-functions/_hg
-    '';
-
-  meta = {
-    description = "A fast, lightweight SCM system for very large distributed projects";
-    homepage = "https://www.mercurial-scm.org";
-    downloadPage = "https://www.mercurial-scm.org/release/";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.eraserhd ];
-    updateWalker = true;
-    platforms = lib.platforms.unix;
-  };
-}

pkgs/applications/video/freetube/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "freetube";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchurl {
     url = "https://github.com/FreeTubeApp/FreeTube/releases/download/v${version}-beta/freetube_${version}_amd64.AppImage";
-    sha256 = "sha256:0qaghj70ffc90wck1i4217ky5d6cryrmgna2ipsc4v8dcvbyc1lh";
+    sha256 = "sha256-52cVY3SBT048tErydk3l27yBvM/FMVpEMf5miAeInDM=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/video/mkvtoolnix/default.nix

@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "61.0.0";
+  version = "62.0.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "04f18jr0a5m1sah8163m28b82w1ikjzmahqy67pbbpzg0mc6rqr4";
+    sha256 = "0pjf1lkpjirqanazm7a28b8bsyin4i1kd1s4y169zsilzb28kpiz";
   };
 
   nativeBuildInputs = [

pkgs/build-support/agda/default.nix

@@ -79,7 +79,12 @@ let
           find -not \( -path ${everythingFile} -or -path ${lib.interfaceFile everythingFile} \) -and \( ${concatMapStringsSep " -or " (p: "-name '*.${p}'") (extensions ++ extraExtensions)} \) -exec cp -p --parents -t "$out" {} +
           runHook postInstall
         '';
+
         meta = if meta.broken or false then meta // { hydraPlatforms = lib.platforms.none; } else meta;
+
+        # Retrieve all packages from the finished package set that have the current package as a dependency and build them
+        passthru.tests = with builtins;
+          lib.filterAttrs (name: pkg: self.lib.isUnbrokenAgdaPackage pkg && elem pname (map (pkg: pkg.pname) pkg.buildInputs)) self;
       };
 in
 {

pkgs/build-support/agda/lib.nix

@@ -7,4 +7,9 @@
   * interfaceFile "src/Everything.lagda.tex" == "src/Everything.agdai"
   */
   interfaceFile = agdaFile: lib.head (builtins.match ''(.*\.)l?agda(\.(md|org|rst|tex))?'' agdaFile) + "agdai";
+
+  /* Takes an arbitrary derivation and says whether it is an agda library package
+  *  that is not marked as broken.
+  */
+  isUnbrokenAgdaPackage = pkg: pkg.isAgdaDerivation or false && !pkg.meta.broken;
 }

pkgs/build-support/build-dotnet-module/default.nix

@@ -32,7 +32,7 @@
 # The dotnet SDK to use.
 , dotnet-sdk ? dotnetCorePackages.sdk_5_0
 # The dotnet runtime to use.
-, dotnet-runtime ? dotnetCorePackages.net_5_0
+, dotnet-runtime ? dotnetCorePackages.runtime_5_0
 , ... } @ args:
 
 assert projectFile == null -> throw "Defining the `projectFile` attribute is required. This is usually an `.csproj`, or `.sln` file.";

pkgs/data/themes/arc/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "arc-theme";
-  version = "20210412";
+  version = "20211018";
 
   src = fetchFromGitHub {
     owner = "jnsh";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BNJirtBtdWsIzQfsJsZzg1zFbJEzZPq1j2qZ+1QjRH8=";
+    sha256 = "1rrxm5b7l8kq1h0lm08ck54xljzm8w573mxx904n3rhdg3ri9d63";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome/extensions/collisions.json

@@ -79,6 +79,10 @@
       "unredirect@vaina.lt",
       "unredirect@aunetx"
     ],
+    "floating-dock": [
+      "floatingDock@sun.wxg@gmail.com",
+      "floating-dock@nandoferreira_prof@hotmail.com"
+    ],
     "extension-list": [
       "extension-list@tu.berry",
       "screen-lock@garciabaameiro.com"

pkgs/desktops/gnome/extensions/dash-to-dock/default.nix

@@ -1,41 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, glib
-, gettext
-, sassc
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gnome-shell-extension-dash-to-dock";
-  version = "unstable-2021-10-03";
-
-  # temporarily switched to commit hash because GNOME 40 version is not released yet.
-  src = fetchFromGitHub {
-    owner = "micheleg";
-    repo = "dash-to-dock";
-    rev = "9605dd69fe86d4f92416299c3f62605e75827dd3";
-    sha256 = "0vrkiq5z2f11gqlfyis2rsnp6j25hwsp24s21vr55qkzkfszsigg";
-  };
-
-  nativeBuildInputs = [
-    glib
-    gettext
-    sassc
-  ];
-
-  makeFlags = [
-    "INSTALLBASE=${placeholder "out"}/share/gnome-shell/extensions"
-  ];
-
-  passthru = {
-    extensionUuid = "dash-to-dock@micxgx.gmail.com";
-    extensionPortalSlug = "dash-to-dock";
-  };
-
-  meta = with lib; {
-    description = "A dock for the Gnome Shell";
-    homepage = "https://micheleg.github.io/dash-to-dock/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ eperuffo jtojnar ];
-  };
-}

pkgs/desktops/gnome/extensions/extensionOverrides.nix

@@ -11,6 +11,10 @@
 # the upstream repository's sources.
 super: super // {
 
+  "dash-to-dock@micxgx.gmail.com" = super."dash-to-dock@micxgx.gmail.com".overrideAttrs (old: {
+    meta.maintainers = with lib.maintainers; [ eperuffo jtojnar rhoriguchi ];
+  });
+
   "display-brightness-ddcutil@themightydeity.github.com" = super."display-brightness-ddcutil@themightydeity.github.com".overrideAttrs (old: {
     # Has a hard-coded path to a run-time dependency
     # https://github.com/NixOS/nixpkgs/issues/136111

pkgs/desktops/gnome/extensions/extensionRenames.nix

@@ -38,6 +38,8 @@
   "extension-list@tu.berry" = "extension-list";
   "screen-lock@garciabaameiro.com" = "screen-lock"; # Don't know why they got 'extension-list' as slug
 
+  "floatingDock@sun.wxg@gmail.com" = "floating-dock-2";
+  "floating-dock@nandoferreira_prof@hotmail.com" = "floating-dock";
 
   # ############################################################################
   # These are conflicts for 3.38 extensions. They will very probably come back

pkgs/desktops/gnome/extensions/manuallyPackaged.nix

@@ -3,7 +3,6 @@
   "arcmenu@arcmenu.com" = callPackage ./arcmenu { };
   "caffeine@patapon.info" = callPackage ./caffeine { };
   "clock-override@gnomeshell.kryogenix.org" = callPackage ./clock-override { };
-  "dash-to-dock@micxgx.gmail.com" = callPackage ./dash-to-dock { };
   "dash-to-panel@jderose9.github.com" = callPackage ./dash-to-panel { };
   "drop-down-terminal@gs-extensions.zzrough.org" = callPackage ./drop-down-terminal { };
   "EasyScreenCast@iacopodeenosee.gmail.com" = callPackage ./EasyScreenCast { };

pkgs/development/compilers/dotnet/build-dotnet.nix

@@ -3,7 +3,7 @@
 , sha512
 }:
 
-assert builtins.elem type [ "aspnetcore" "netcore" "sdk"];
+assert builtins.elem type [ "aspnetcore" "runtime" "sdk"];
 { lib, stdenv
 , fetchurl
 , libunwind
@@ -17,7 +17,7 @@ assert builtins.elem type [ "aspnetcore" "netcore" "sdk"];
 let
   pname = if type == "aspnetcore" then
     "aspnetcore-runtime"
-  else if type == "netcore" then
+  else if type == "runtime" then
     "dotnet-runtime"
   else
     "dotnet-sdk";
@@ -30,12 +30,12 @@ let
     "Unsupported system: ${stdenv.hostPlatform.system}");
   urls = {
     aspnetcore = "https://dotnetcli.azureedge.net/dotnet/aspnetcore/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
-    netcore = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
+    runtime = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
     sdk = "https://dotnetcli.azureedge.net/dotnet/Sdk/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
   };
   descriptions = {
-    aspnetcore = "ASP .NET Core runtime ${version}";
+    aspnetcore = "ASP.NET Core Runtime ${version}";
-    netcore = ".NET Core runtime ${version}";
+    runtime = ".NET Runtime ${version}";
     sdk = ".NET SDK ${version}";
   };
 in stdenv.mkDerivation rec {

pkgs/development/compilers/dotnet/combine-packages.nix

@@ -5,7 +5,7 @@ in
 assert lib.assertMsg ((builtins.length packages) != 0)
     ''You must include at least one package, e.g
       `with dotnetCorePackages; combinePackages [
-          sdk_3_0 aspnetcore_2_1
+          sdk_3_1 aspnetcore_5_0
        ];`'' ;
   buildEnv {
     name = "dotnet-core-combined";

pkgs/development/compilers/dotnet/default.nix

@@ -1,6 +1,6 @@
 /*
 How to combine packages for use in development:
-dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_3_1 sdk_2_2 sdk_3_0 sdk aspnetcore_2_1 ];
+dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_3_1 sdk_5_0 aspnetcore_5_0 ];
 
 Hashes below are retrived from:
 https://dotnet.microsoft.com/download/dotnet
@@ -9,75 +9,19 @@ https://dotnet.microsoft.com/download/dotnet
 let
   buildDotnet = attrs: callPackage (import ./build-dotnet.nix attrs) {};
   buildAspNetCore = attrs: buildDotnet (attrs // { type = "aspnetcore"; });
-  buildNetCore = attrs: buildDotnet (attrs // { type = "netcore"; });
+  buildNetRuntime = attrs: buildDotnet (attrs // { type = "runtime"; });
-  buildNetCoreSdk = attrs: buildDotnet (attrs // { type = "sdk"; });
+  buildNetSdk = attrs: buildDotnet (attrs // { type = "sdk"; });
 in
 rec {
   combinePackages = attrs: callPackage (import ./combine-packages.nix attrs) {};
 
-  # v2.1.22 (LTS)
+  # EOL
 
-  aspnetcore_2_1 = buildAspNetCore {
+  sdk_2_1 = throw "Dotnet SDK 2.1 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
-    version = "2.1.22";
+  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
-    sha512 = {
+  sdk_3_0 = throw "Dotnet SDK 3.0 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
-      x86_64-linux = "27v3a69dgnnb4lz5p2dn2qwadb8vpnqwdy6mnnqfp1dl4kgg3izvriz2268if272sy6flcz5lckjlmn0i0i1jci5zypc7x9kykj991l";
-      aarch64-linux = null; # no aarch64 version of this package is available
-      x86_64-darwin = "0xh06jmzx2cfq51hv9l4h72hbfyh3r0wlla217821gi0hlw6xcc0gb3b4xmqcs240fllqnwrnrwz0axi3xi21wacgn3xbcmzpbi6jml";
-    };
-  };
 
-  netcore_2_1 = buildNetCore {
+  # v3.1 (LTS)
-    version = "2.1.22";
-    sha512 = {
-      x86_64-linux = "0c2b31l59izcxbhz5wzjpjkdl550s5p3aid4vyghq468vyf67pm0npjny50c172b63vw0ikfbps2b2hj16hpifp116gj4b5llmqjhyc";
-      aarch64-linux = "3llai3d2xpgbr7a4ndg9wqfpnb5zb8k07dicc57a6cmniiqyqigyxinhpx2k0l45mbnihjsr5k1rih3r6bwlj241v67iwd2i0dpqd8a";
-      x86_64-darwin = "106mx6a4rwcvq41v54c1yx89156s43n889im9g0q2pvm7054q8b6xm6qrnymzmj5i2i6awyk0z02j5pfiyh35sw9afxb3695ymsb3v8";
-    };
-  };
-
-  sdk_2_1 = buildNetCoreSdk {
-    version = "2.1.810";
-    sha512 = {
-      x86_64-linux = "388nrba5f7z9syq23xh3k45rzy3iys58s32ya7a0q9mwdf1y3haw7yvbq79cn08741hhqdi73mip8jf50f4s64mbr62ay1p76zsrkj5";
-      aarch64-linux = "2vs8bhk63cjrqkm5n164ahc6bdz58aq9vmhaiyy27krp7wlkz4gpiva9153h7mywhk709l1qc7cddj99qsh2ygv6axjfigbhgrzslqi";
-      x86_64-darwin = "3qxlgbd0np0w8wmp98mhp4cqgva4zglqf7k9kzqbwxfwr5s795kap7rs5w0cy7h0bsvj0ygx3d5nzyn9hp3fsswx4jl4mkvillnvjzy";
-    };
-  };
-
-  # v2.2
-
-  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 3.1";
-
-  # v3.0.2 (Maintenance)
-
-  aspnetcore_3_0 = buildAspNetCore {
-    version = "3.0.3";
-    sha512 = {
-      x86_64-linux = "342v6kxxbxky09d1c392vvr9rm30lf75wccka1bk2h4advlcga5nlgv93g7vrq48bsyxfi5gc36r3b0dlwl1g409g5mlk1042n6d0yq";
-      aarch64-linux = "2xkg4q88q5jw6jdz6cxj8vsjr475nd0fcvifkv1shdm2j9dsjy233hwpxbr140m5n5ggyh6z99238z9j4kp2az977y8y8irz8m8ppvf";
-      x86_64-darwin = "2p04j6p4j93pan71ih13hv57zxalcirh0n3vfjq0cfb80pbhf1f5cgxl24pw6kifh6hhh38rj62c4mr69lxzlqc8sfcfaws8dyz2avm";
-    };
-  };
-
-  netcore_3_0 = buildNetCore {
-    version = "3.0.3";
-    sha512 = {
-      x86_64-linux = "32ykpcw2xx708r2lxcwcbxnmy4sk159rlfjfvkw990qh7n79pm3lm2qwa3zhqcslznmpg18kwxz8qb5fgsa0h49g843xx4kyai0n7rx";
-      aarch64-linux = "1lp8din7d5jv5fkyq1a7m01i1xg9jwpiljvam1kcyzsnwzvi0cb4ji336cfx4lqrn95gvc75gkzi6q8b4fz0h21gvk6z6kmlcr63nyg";
-      x86_64-darwin = "0s20k7xawwd09xhy4xdcxp1rw6jd418ibrvhb509dnj480g48xryda2203g4mpswd24v2kx0n9qzxgbrbq9lvasfglkxi84bbqayp83";
-    };
-  };
-
-  sdk_3_0 = buildNetCoreSdk {
-    version = "3.0.103";
-    sha512 = {
-      x86_64-linux = "2diiplgxs92fkb6ym68b02d79z4qn63x5qlky5lvr757c1zkh0vfpk3khawdg94kdn4qkn6dmyqr0msxqgmiqyhp63cadzqq4vx7b12";
-      aarch64-linux = "32843q2lj7dgciq62g9v1q31vwfjyv5vaxrz712d942mcg5lyzjygwri106bv4naq3a22131ldzwnsifbdn2vq1iz60raqdb7ss9vnf";
-      x86_64-darwin = "3apswk2bhalgi0hm7h2j9p152jvp39h4xilxxzix5j1n36b442l1pwk7lj7019lxafjqkz5y850xkfcp14ks5wcvs33xs2c0aqwxvcn";
-    };
-  };
-
-  # v3.1.1 (LTS)
 
   aspnetcore_3_1 = buildAspNetCore {
     version = "3.1.19";
@@ -88,7 +32,7 @@ rec {
     };
   };
 
-  netcore_3_1 = buildNetCore {
+  runtime_3_1 = buildNetRuntime {
     version = "3.1.19";
     sha512 = {
       x86_64-linux = "2cf268cc13bb4739203a18a9160aac58f2088e8ec275b1f7ef2fe2b74bc16edfdfbeb886a74fc9421edbf2899fa9e3ee7ea2734a83b1800b4a9848fb7e10bbbe";
@@ -97,7 +41,7 @@ rec {
     };
   };
 
-  sdk_3_1 = buildNetCoreSdk {
+  sdk_3_1 = buildNetSdk {
     version = "3.1.413";
     sha512 = {
       x86_64-linux = "2a0824f11aba0b79d3f9a36af0395649bc9b4137e61b240a48dccb671df0a5b8c2086054f8e495430b7ed6c344bb3f27ac3dfda5967d863718a6dadeca951a83";
@@ -106,7 +50,7 @@ rec {
     };
   };
 
-  # v5.0.0
+  # v5.0 (Current)
 
   aspnetcore_5_0 = buildAspNetCore {
     version = "5.0.10";
@@ -117,7 +61,7 @@ rec {
     };
   };
 
-  net_5_0 = buildNetCore {
+  runtime_5_0 = buildNetRuntime {
     version = "5.0.10";
     sha512 = {
       x86_64-linux = "421b00d5751381e6bf829dcba8fa0d781f0efd065be492739d60a4bef2b7b362dbec77fa3289e2ee45cab40616f95318fc214699ffe2f33aa15e77c2d163841c";
@@ -126,7 +70,7 @@ rec {
     };
   };
 
-  sdk_5_0 = buildNetCoreSdk {
+  sdk_5_0 = buildNetSdk {
     version = "5.0.401";
     sha512 = {
       x86_64-linux = "a444d44007709ceb68d8f72dec0531e17f85f800efc0007ace4fa66ba27f095066930e6c6defcd2f85cdedea2fec25e163f5da461c1c2b8563e5cd7cb47091e0";

pkgs/development/compilers/graalvm/community-edition/default.nix

@@ -16,6 +16,6 @@ in {
   graalvm11-ce = mkGraal rec {
     version = "21.2.0";
     javaVersion = "11";
-    platforms = ["x86_64-linux" "x86_64-darwin"];
+    platforms = ["x86_64-linux" "aarch64-linux" "x86_64-darwin"];
   };
 }

pkgs/development/compilers/graalvm/community-edition/repository.nix

@@ -10,17 +10,26 @@
 , gtkSupport ? true, cairo, glib, gtk3 }:
 
 let
-  platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
+  platform = {
+    aarch64-linux = "linux-aarch64";
+    x86_64-linux = "linux-amd64";
+    x86_64-darwin = "darwin-amd64";
+  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+
   runtimeDependencies = [ cups ]
     ++ lib.optionals gtkSupport [ cairo glib gtk3 ];
+
   runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
+
   javaVersionPlatform = "${javaVersion}-${platform}";
+
   graalvmXXX-ce = stdenv.mkDerivation rec {
     name = "graalvm${javaVersion}-ce";
     srcs = [
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "01gyxjmfp7wpcyn7x8b184fn0lp3xryfw619bqch120pzvr6z88f";
+          "11-linux-aarch64" = "sha256-u9841eaHH347JHCrm5u3YGZ9RSTuKiDq368TY2otAYw=";
           "11-linux-amd64" = "0w7lhvxm4nggqdcl4xrhdd3y6dqw9jhyca9adjkp508n4lqf1lxv";
           "11-darwin-amd64" = "0dnahicdl0vhrbiml9z9nbb7k75hbsjj8rs246i1lwril12dqb7n";
         }.${javaVersionPlatform};
@@ -29,6 +38,7 @@ let
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "1jlvrxdlbsmlk3ia43h9m29kmmdn83h6zdlnf8qb7bm38c84nhsc";
+          "11-linux-aarch64" = "sha256-7W5gkhj2kON2ocrGpyH/OL/phOyHkjNDId2CtyUAEWY=";
           "11-linux-amd64" = "1ybd7a6ii6582skr0nkxx7bccsa7gkg0yriql2h1lcz0rfzcdi3g";
           "11-darwin-amd64" = "1jdy845vanmz05zx5b9227gb1msh9wdrz2kf3fx9z54ssd9qgdhm";
         }.${javaVersionPlatform};
@@ -37,11 +47,23 @@ let
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "18ip0ay06q1pryqs8ja988mvk9vw475c0nfjcznnsd1zp296p6jc";
+          "11-linux-aarch64" = "sha256-i9ysgqbI52PiXofZQ5AnPSzs2TeR8An5CIYzcwhx28o=";
           "11-linux-amd64" = "1jszz97mkqavxzyhx5jxhi43kqjxk9c36j5l5hy3kn8sdfmbplm4";
           "11-darwin-amd64" = "1767ryhv2cn5anlys63ysax1p8ag79bykac1xfrjfan8yv6d8ybl";
         }.${javaVersionPlatform};
         url = "https://github.com/oracle/truffleruby/releases/download/vm-${version}/ruby-installable-svm-java${javaVersionPlatform}-${version}.jar";
       })
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "08s36rjy5irg25b7lqx0m4v2wpywin3cqyhdrywhvq14f7zshsd5";
+          "11-linux-aarch64" = "sha256-Lkc/mq1w18+PQ5McvLGyQBSOz/TMSUgwioRZ0Dtyhm4=";
+          "11-linux-amd64" = "1ybjaknmbsdg8qzb986x39fq0h7fyiymdcigc7y86swk8dd916hv";
+          "11-darwin-amd64" = "02dwlb62kqr4rjjmvkhn2xk9l1p47ahg9xyyfkw7im1jwlqmqnzf";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
+    ] ++ lib.optionals (platform == "amd64") [
+      # graalpython is not available on aarch64 platforms yet
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "0il15438qnikqsxdsl7fcdg0c8zs3cbm4ry7pys7fxxr1ckd8szq";
@@ -50,14 +72,6 @@ let
         }.${javaVersionPlatform};
         url = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
       })
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "08s36rjy5irg25b7lqx0m4v2wpywin3cqyhdrywhvq14f7zshsd5";
-          "11-linux-amd64" = "1ybjaknmbsdg8qzb986x39fq0h7fyiymdcigc7y86swk8dd916hv";
-          "11-darwin-amd64" = "02dwlb62kqr4rjjmvkhn2xk9l1p47ahg9xyyfkw7im1jwlqmqnzf";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
     ];
 
     buildInputs = lib.optionals stdenv.isLinux [
@@ -124,10 +138,9 @@ let
          exit 1
       fi
 
-      unpack_jar ''${arr[1]}
+      for jar in "''${arr[@]:1}"; do
-      unpack_jar ''${arr[2]}
+        unpack_jar "$jar"
-      unpack_jar ''${arr[3]}
+      done
-      unpack_jar ''${arr[4]}
     '';
 
     outputs = [ "out" "lib" ];
@@ -145,7 +158,6 @@ let
           ln -s $f ${basepath}/${platform}/$(basename $f)
         done
       '';
-
       copyClibrariesToLib = ''
         # add those libraries to $lib output too, so we can use them with
         # `native-image -H:CLibraryPath=''${graalvm11-ce.lib}/lib ...` and reduce
@@ -173,6 +185,13 @@ let
 
         ${copyClibrariesToLib}
       '';
+      "11-linux-aarch64" = ''
+        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
+      '';
       "11-darwin-amd64" = ''
         # create empty $lib/lib to avoid breaking builds
         mkdir -p $lib/lib
@@ -219,53 +238,60 @@ let
 
     doInstallCheck = true;
     installCheckPhase = ''
-        echo ${
+      echo ${
-          lib.escapeShellArg ''
+        lib.escapeShellArg ''
-            public class HelloWorld {
+          public class HelloWorld {
-              public static void main(String[] args) {
+            public static void main(String[] args) {
-                System.out.println("Hello World");
+              System.out.println("Hello World");
-              }
             }
-          ''
+          }
-        } > HelloWorld.java
+        ''
-        $out/bin/javac HelloWorld.java
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
 
-        # run on JVM with Graal Compiler
+      # run on JVM with Graal Compiler
-        $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
 
-        # Ahead-Of-Time compilation
+      # Ahead-Of-Time compilation
-        $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
+      $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
-        ./helloworld | fgrep 'Hello World'
+      ./helloworld | fgrep 'Hello World'
 
-        ${
+      ${
-          lib.optionalString stdenv.isLinux ''
+        lib.optionalString stdenv.isLinux ''
-            # Ahead-Of-Time compilation with --static
+          # Ahead-Of-Time compilation with --static
-            # --static flag doesn't work for darwin
+          # --static flag doesn't work for darwin
-            $out/bin/native-image --no-server --static HelloWorld
+          $out/bin/native-image --no-server --static HelloWorld
-            ./helloworld | fgrep 'Hello World'
+          ./helloworld | fgrep 'Hello World'
-          ''
+        ''
-        }
+      }
 
-        echo "Testing interpreted languages"
+      ${
-        $out/bin/graalpython -c 'print(1 + 1)'
+        lib.optionalString (platform == "amd64") ''
-        $out/bin/ruby -e 'puts(1 + 1)'
+          echo "Testing interpreted languages"
+          $out/bin/graalpython -c 'print(1 + 1)'
+          $out/bin/ruby -e 'puts(1 + 1)'
 
-        echo '1 + 1' | $out/bin/graalpython
+          echo '1 + 1' | $out/bin/graalpython
+        ''
+      }
 
-        ${
+      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
-          lib.optionalString stdenv.isLinux ''
+        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
-            # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+        # though `openssl` is in `propagatedBuildInputs`. For more details see:
-            # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
+        # https://github.com/NixOS/nixpkgs/pull/105815
-            # though `openssl` is in `propagatedBuildInputs`. For more details see:
+        # TODO: "truffleruby: an internal exception escaped out of the interpreter"
-            # https://github.com/NixOS/nixpkgs/pull/105815
+        # error on linux-aarch64
-            echo '1 + 1' | $out/bin/irb
+        lib.optionalString (platform == "linux-amd64") ''
-          ''
+          echo '1 + 1' | $out/bin/irb
-        }
+        ''
+      }
 
-      ${lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
+      ${# TODO: Doesn't work on MacOS, we have this error:
-        # Doesn't work on MacOS, we have this error: "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
+        # "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
-        echo '1 + 1' | $out/bin/jshell
+        lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
-      ''}'';
+          echo '1 + 1' | $out/bin/jshell
+        ''
+      }'';
 
     passthru.home = graalvmXXX-ce;
 
@@ -280,6 +306,7 @@ let
         glittershark
         babariviere
         ericdallo
+        thiagokokada
       ];
       platforms = platforms;
     };

pkgs/development/compilers/nextpnr/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, boost, python3, eigen
+, boost, python3, eigen, python3Packages
 , icestorm, trellis
 , llvmPackages
 
@@ -39,17 +39,18 @@ stdenv.mkDerivation rec {
      = [ cmake ]
     ++ (lib.optional enableGui wrapQtAppsHook);
   buildInputs
-     = [ boostPython python3 eigen ]
+     = [ boostPython python3 eigen python3Packages.apycula ]
     ++ (lib.optional enableGui qtbase)
     ++ (lib.optional stdenv.cc.isClang llvmPackages.openmp);
 
   cmakeFlags =
     [ "-DCURRENT_GIT_VERSION=${lib.substring 0 7 (lib.elemAt srcs 0).rev}"
-      "-DARCH=generic;ice40;ecp5"
+      "-DARCH=generic;ice40;ecp5;gowin"
       "-DBUILD_TESTS=ON"
       "-DICESTORM_INSTALL_PREFIX=${icestorm}"
       "-DTRELLIS_INSTALL_PREFIX=${trellis}"
       "-DTRELLIS_LIBDIR=${trellis}/lib/trellis"
+      "-DGOWIN_BBA_EXECUTABLE=${python3Packages.apycula}/bin/gowin_bba"
       "-DUSE_OPENMP=ON"
       # warning: high RAM usage
       "-DSERIALIZE_CHIPDBS=OFF"
@@ -74,6 +75,7 @@ stdenv.mkDerivation rec {
     wrapQtApp $out/bin/nextpnr-generic
     wrapQtApp $out/bin/nextpnr-ice40
     wrapQtApp $out/bin/nextpnr-ecp5
+    wrapQtApp $out/bin/nextpnr-gowin
   '';
 
   meta = with lib; {

pkgs/development/compilers/nim/default.nix

@@ -98,12 +98,12 @@ in {
 
   nim-unwrapped = stdenv.mkDerivation rec {
     pname = "nim-unwrapped";
-    version = "1.4.8";
+    version = "1.6.0";
     strictDeps = true;
 
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${version}.tar.xz";
-      hash = "sha256-t5jFd0EdfZW4YxJh27Nnbp0a/Z42dA0ESWagVVtBRBo=";
+      hash = "sha256-UgZdSNcqcnAuwa/l96mDHhFnNTHiec3/nK7AGgfuxj0=";
     };
 
     buildInputs = [ boehmgc openssl pcre readline sqlite ];
@@ -114,7 +114,7 @@ in {
 
       ./nixbuild.patch
       # Load libraries at runtime by absolute path
-    ];
+    ] ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
 
     configurePhase = ''
       runHook preConfigure

pkgs/development/compilers/nim/nim.cfg.patch

@@ -1,5 +1,5 @@
 diff --git a/config/nim.cfg b/config/nim.cfg
-index a33a2f0a9..e069193ff 100644
+index 3b964d124..850ed0ed9 100644
 --- a/config/nim.cfg
 +++ b/config/nim.cfg
 @@ -8,26 +8,12 @@
@@ -29,42 +29,3 @@ index a33a2f0a9..e069193ff 100644
  path="$lib/deprecated/core"
  path="$lib/deprecated/pure"
  path="$lib/pure/collections"
-@@ -111,7 +97,7 @@ path="$lib/pure"
- @end
- 
- @if unix:
--  @if not bsd or haiku:
-+  @if not bsd or genode or haiku:
-     # -fopenmp
-     gcc.options.linker = "-ldl"
-     gcc.cpp.options.linker = "-ldl"
-@@ -295,29 +281,6 @@ vcc.cpp.options.size = "/O1"
- # Configuration for the Tiny C Compiler:
- tcc.options.always = "-w"
- 
--# Configuration for the Genode toolchain
--@if genode:
--  noCppExceptions # avoid std C++
--  tlsEmulation:on # no TLS segment register magic
--  @if i386 or amd64:
--    gcc.exe = "genode-x86-gcc"
--    gcc.cpp.exe = "genode-x86-g++"
--    gcc.cpp.linkerexe = "genode-x86-ld"
--  @elif arm:
--    gcc.exe = "genode-arm-gcc"
--    gcc.cpp.exe = "genode-arm-g++"
--    gcc.cpp.linkerexe = "genode-arm-ld"
--  @elif arm64:
--    gcc.exe = "genode-aarch64-gcc"
--    gcc.cpp.exe = "genode-aarch64-g++"
--    gcc.cpp.linkerexe = "genode-aarch64-ld"
--  @elif riscv64:
--    gcc.exe = "genode-riscv-gcc"
--    gcc.cpp.exe = "genode-riscv-g++"
--    gcc.cpp.linkerexe = "genode-riscv-ld"
--  @end
--@end
--
- @if arm or arm64:
-   --define:nimEmulateOverflowChecks
- @end

pkgs/development/compilers/nim/toLocation.patch

@@ -0,0 +1,16 @@
+diff --git a/lib/std/private/miscdollars.nim b/lib/std/private/miscdollars.nim
+index 840fedf54..6c3436308 100644
+--- a/lib/std/private/miscdollars.nim
++++ b/lib/std/private/miscdollars.nim
+@@ -6,9 +6,8 @@ template toLocation*(result: var string, file: string | cstring, line: int, col:
+   # it can be done in a single place.
+   result.add file
+   if line > 0:
+-    result.add "("
++    result.add ":"
+     addInt(result, line)
+     if col > 0:
+-      result.add ", "
++      result.add ":"
+       addInt(result, col)
+-    result.add ")"

pkgs/development/interpreters/bats/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bats";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchzip {
     url = "https://github.com/bats-core/bats-core/archive/v${version}.tar.gz";
-    hash = "sha256-+dboExOx2YELxV8Cwk9SVwk9G3p8EoP0LdaJ3o7GT6c=";
+    hash = "sha256-bGZXjq6zG9MJgDccpVYATsgYhhb1Zf7Deoa/DoSv8QE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/libraries/capnproto/default.nix

@@ -1,12 +1,15 @@
-{ lib, stdenv, fetchurl, capnproto, cmake }:
+{ lib, stdenv, fetchFromGitHub, capnproto, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "capnproto";
   version = "0.9.0";
 
-  src = fetchurl {
+  # release tarballs are missing some ekam rules
-    url = "https://capnproto.org/capnproto-c++-${version}.tar.gz";
+  src = fetchFromGitHub {
-    sha256 = "sha256-soBUp6K/6kK/w5LI0AljDZTXLozoaiOtbxi15yV0Bk8=";
+    owner = "capnproto";
+    repo = "capnproto";
+    rev = "v${version}";
+    sha256 = "038i40apywn8sg95kwld4mg9p9m08izcw5xj7mwkmshycmqw65na";
   };
 
   nativeBuildInputs = [ cmake ]

pkgs/development/libraries/isa-l/default.nix

@@ -0,0 +1,27 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, nasm }:
+
+stdenv.mkDerivation rec {
+  pname = "isa-l";
+  version = "2.30.0";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "isa-l";
+    rev = "v${version}";
+    sha256 = "sha256-AAuSdDQfDW4QFRu0jHwCZ+ZCSjoVqlQiSW1OOFye1Rs=";
+  };
+
+  nativeBuildInputs = [ nasm autoreconfHook ];
+
+  preConfigure = ''
+    export AS=nasm
+  '';
+
+  meta = with lib; {
+    description = "A collection of optimised low-level functions targeting storage applications";
+    license = licenses.bsd3;
+    homepage = "https://github.com/intel/isa-l";
+    maintainers = with maintainers; [ jbedo ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/node-packages/default.nix

@@ -91,6 +91,22 @@ let
       '';
     };
 
+    mdctl-cli = super."@medable/mdctl-cli".override {
+      nativeBuildInputs = with pkgs; with darwin.apple_sdk.frameworks; [
+        glib
+        libsecret
+        pkg-config
+      ] ++ lib.optionals stdenv.isDarwin [
+        AppKit
+        Security
+      ];
+      buildInputs = with pkgs; [
+        nodePackages.node-gyp-build
+        nodePackages.node-pre-gyp
+        nodejs
+      ];
+    };
+
     coc-imselect = super.coc-imselect.override {
       meta.broken = since "10";
     };
@@ -319,14 +335,6 @@ let
       '';
     };
 
-    netlify-cli =
-      super.netlify-cli.override {
-        preRebuild = ''
-          export ESBUILD_BINARY_PATH="${pkgs.esbuild_netlify}/bin/esbuild"
-        '';
-        meta.maintainers = with lib.maintainers; [ roberth ];
-      };
-
     ssb-server = super.ssb-server.override {
       buildInputs = [ pkgs.automake pkgs.autoconf self.node-gyp-build ];
       meta.broken = since "10";

pkgs/development/node-packages/node-packages.json

@@ -6,6 +6,7 @@
 , "@commitlint/cli"
 , "@commitlint/config-conventional"
 , "@hyperspace/cli"
+, "@medable/mdctl-cli"
 , "@nerdwallet/shepherd"
 , "@nestjs/cli"
 , "@squoosh/cli"
@@ -184,7 +185,6 @@
 , "multi-file-swagger"
 , "musescore-downloader"
 , "neovim"
-, "netlify-cli"
 , "nijs"
 , "node-gyp"
 , "node-gyp-build"

pkgs/development/ocaml-modules/bistro/default.nix

@@ -28,9 +28,15 @@ buildDunePackage rec {
   })
   ];
 
+  # Fix build with ppxlib 0.23
+  postPatch = ''
+    substituteInPlace ppx/ppx_bistro.ml \
+      --replace 'Parser.parse_expression' 'Ocaml_common.Parser.parse_expression'
+  '';
+
   propagatedBuildInputs = [ base64 bos core lwt_react ocamlgraph rresult tyxml ];
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.12";
 
   meta = {
     inherit (src.meta) homepage;

pkgs/development/ocaml-modules/janestreet/0.14.nix

@@ -41,7 +41,7 @@ with self;
     version = "0.14.1";
     hash = "1cdkv34m6czhacivpbb2sasj83fgcid6gnqk30ig9i84z8nh2gw2";
     meta.description = "Accessors for Core types, for use with the Accessor library";
-    meta.broken = lib.versionAtLeast ocaml.version "4.12";
+    meta.broken = true; # Not compatible with ppxlib ≥ 0.23
     propagatedBuildInputs = [ accessor_base core_kernel ];
   };
 
@@ -375,9 +375,9 @@ with self;
 
   ppx_accessor = janePackage {
     pname = "ppx_accessor";
-    version = "0.14.2";
+    version = "0.14.3";
     minimumOCamlVersion = "4.09";
-    hash = "01nifsh7gap28cpvff6i569lqr1gmyhrklkisgri538cp4pf1wq1";
+    hash = "sha256:1c8blzh2f34vbm1z3mnvh670c6vda70chw805n2hmkd9j46l0cll";
     meta.description = "[@@deriving] plugin to generate accessors for use with the Accessor libraries";
     propagatedBuildInputs = [ accessor ];
   };
@@ -633,9 +633,9 @@ with self;
 
   ppx_variants_conv = janePackage {
     pname = "ppx_variants_conv";
-    version = "0.14.1";
+    version = "0.14.2";
     minimumOCamlVersion = "4.04.2";
-    hash = "0q6a43zrwqzdz7aja0k44a2llyjjj5xzi2kigwhsnww3g0r5ig84";
+    hash = "1p11fiz4m160hs0xzg4g9rxchp053sz3s3d1lyciqixad1xi47a4";
     meta.description = "Generation of accessor and iteration functions for ocaml variant types";
     propagatedBuildInputs = [ variantslib ppxlib ];
   };

pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildDunePackage, fetchurl, ppxlib, alcotest
+, ppx_deriving, yaml
+}:
+
+buildDunePackage rec {
+  pname = "ppx_deriving_yaml";
+  version = "0.1.0";
+
+  useDune2 = true;
+
+  minimalOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/patricoferris/ppx_deriving_yaml/releases/download/v${version}/ppx_deriving_yaml-v${version}.tbz";
+    sha256 = "kdonUD4Y8QhVSAFAafIpXBFPkS4pSScYwJbaWMn/6pA=";
+  };
+
+  propagatedBuildInputs = [ ppxlib ppx_deriving yaml ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "A YAML codec generator for OCaml";
+    homepage = "https://github.com/patricoferris/ppx_deriving_yaml";
+    license = lib.licenses.isc;
+    maintainers = [ ];
+  };
+}

pkgs/development/ocaml-modules/ppxlib/default.nix

@@ -2,7 +2,7 @@
 , version ?
   if lib.versionAtLeast ocaml.version "4.07"
   then if lib.versionAtLeast ocaml.version "4.08"
-  then "0.22.2" else "0.15.0" else "0.13.0"
+  then "0.23.0" else "0.15.0" else "0.13.0"
 , ocaml-compiler-libs, ocaml-migrate-parsetree, ppx_derivers, stdio
 , stdlib-shims, ocaml-migrate-parsetree-2
 }:
@@ -38,6 +38,10 @@ let param = {
     sha256 = "0fysjqcpv281n52wl3h0dy2lzf9d61wdzk90ldv3p63a4i3mr1j2";
     min_version = "4.07";
   };
+  "0.23.0" = {
+    sha256 = "0jg5v4pssbl66hn5davpin1i57a0r3r54l96vpz5y99xk5w70xi1";
+    min_version = "4.07";
+  };
 }."${version}"; in
 
 if param ? max_version && lib.versionAtLeast ocaml.version param.max_version

pkgs/development/python-modules/aiomusiccast/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aiomusiccast";
-  version = "0.10.0";
+  version = "0.11.0";
 
   format = "pyproject";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "vigonotion";
     repo = "aiomusiccast";
     rev = version;
-    sha256 = "sha256-UdWZLthpCuKLjASVwi4GTkrHY+K9c1xrNYVLezC/NGM=";
+    sha256 = "sha256-58l9bmGmSRFHqiKwHtGcAu2H+JnKjsZZg+fxbLW5xBg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/auth0-python/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "3.18.0";
+  version = "3.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-jitJF+puXaLv3qyJOjLFetzxRpnlbi4BKS0TzDmCRe8=";
+    sha256 = "ed33557f252cf8b022b788ebd2b851c681979f200171498acde2b92d760db026";
   };
 
   propagatedBuildInputs = [
@@ -23,7 +23,6 @@ buildPythonPackage rec {
 
   checkInputs = [
     mock
-    pyjwt
     pytestCheckHook
   ];
 

pkgs/development/python-modules/authlib/default.nix

@@ -8,14 +8,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.15.4";
+  version = "0.15.5";
   pname = "authlib";
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "authlib";
     rev = "v${version}";
-    sha256 = "1jc7rssi1y6brkwjplj8qmi4q5w9h9wz03fbhg01c0y5bmy0g1nj";
+    sha256 = "1893mkzrlfxpxrgv10y134y8c3ni5hb0qvb0wsc76d2k4mci5j3n";
   };
 
   propagatedBuildInputs = [ cryptography requests ];

pkgs/development/python-modules/azure-mgmt-containerservice/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "16.2.0";
+  version = "16.3.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "ee40fa76d84b82e37e1d8a364649de25bb1e0c6c07f182f145a3ade44ec43711";
+    sha256 = "87f06525c6cc47de86d7886ed35f04140ddaf1b0c59482ba578fdb3f5d143b1c";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,8 @@ buildPythonPackage rec {
   # has no tests
   doCheck = false;
 
+  pythonImportsCheck = [ "azure.mgmt.containerservice" ];
+
   meta = with lib; {
     description = "This is the Microsoft Azure Container Service Management Client Library";
     homepage = "https://github.com/Azure/azure-sdk-for-python";

pkgs/development/python-modules/bracex/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bracex";
-  version = "2.1.1";
+  version = "2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-AfcVzQ7XpiLsizIyLnFYE/dXTeUx8Jtw9vOywQ9oJCU=";
+    sha256 = "8230f3a03f1f76c192a7844377124300fbaec83870a728b629dfabd9be9e83d0";
   };
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/python-modules/cbor2/default.nix

@@ -3,33 +3,43 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
-, pytest-cov
+, pythonOlder
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.4.1";
+  version = "5.4.2";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jga5wj3kalf6zj5gyrmy6kwmxxkld52mvcgxc5gb5dmdhpl7gx8";
+    sha256 = "sha256-4oPnC1WgSf82TMXmSP3lh+TZsOh+SyZkxp5jkTXms7g=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   checkInputs = [
-    pytest-cov
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov" ""
+  '';
+
   # https://github.com/agronholm/cbor2/issues/99
   disabledTests = lib.optionals stdenv.is32bit [
     "test_huge_truncated_bytes"
     "test_huge_truncated_string"
   ];
 
-  pythonImportsCheck = [ "cbor2" ];
+  pythonImportsCheck = [
+    "cbor2"
+  ];
 
   meta = with lib; {
     description = "Python CBOR (de)serializer with extensive tag support";

pkgs/development/python-modules/debian/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "python-debian";
-  version = "0.1.40";
+  version = "0.1.42";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "385dfb965eca75164d256486c7cf9bae772d24144249fd18b9d15d3cffb70eea";
+    sha256 = "a794f4c4ee2318ae7260c2e32dac252b833bdaf6686efc2a1afbc6ecf3f0931f";
   };
 
   propagatedBuildInputs = [ chardet six ];

pkgs/development/python-modules/debugpy/default.nix

@@ -4,26 +4,26 @@
 , fetchFromGitHub
 , substituteAll
 , gdb
+, django
 , flask
+, gevent
 , psutil
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
 , requests
-, isPy27
+, isPy3k
-, django
-, gevent
 }:
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ULxVoZuMNDL0Win/+55RnbkCPZ8OI8nhSKshvJOMFQ4=";
+    sha256 = "sha256-xgxKyqtSqKITwze7DKDdkxZlq1mWM+x4C/eJlUJmYuk=";
   };
 
   patches = [
@@ -65,30 +65,21 @@ buildPythonPackage rec {
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")}
   )'';
 
+  doCheck = isPy3k;
   checkInputs = [
+    django
     flask
+    gevent
     psutil
     pytest-timeout
     pytest-xdist
     pytestCheckHook
     requests
-  ] ++ lib.optionals (!isPy27) [
-    django
-    gevent
   ];
 
   # Override default arguments in pytest.ini
   pytestFlagsArray = [ "--timeout=0" "-n=$NIX_BUILD_CORES" ];
 
-  disabledTests = lib.optionals isPy27 [
-    # django 1.11 is the last version to support Python 2.7
-    # and is no longer built in nixpkgs
-    "django"
-
-    # gevent fails to import zope.interface with Python 2.7
-    "gevent"
-  ];
-
   pythonImportsCheck = [ "debugpy" ];
 
   meta = with lib; {

pkgs/development/python-modules/deezer-python/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "3.2.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NwG/VbTHoQl3c//vrrhKQ//gyVIGLY2148mgDToiKks=";
+    sha256 = "sha256-eza0bu4CcKvDMEq/8y6fW5qXtEFbeB5zk0w75+3Hx4Q=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ecoaliface/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "ecoaliface";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hzx0r3311f952jik3pgmrg74xp5m6w9c5v6snfrb8w2m19vs6qy";
+    sha256 = "f17b3452cfd31bb8c3509d59b846889c81db5fb85082c061c32703162cbe9083";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/flux-led/default.nix

@@ -1,23 +1,44 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
-, aiohttp, zigpy
+, buildPythonPackage
-, pytest, isPy27 }:
+, fetchFromGitHub
+, webcolors
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "flux_led";
-  version = "0.22";
+  version = "0.24.9";
-  disabled = isPy27;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "1zgajlkhclyrqhkmivna4ha2lyvfpk5929s042gy59p7mzpkvjx7";
+    sha256 = "sha256-U2Z7fsXO5Wb4WmcOOXm+6zmk+7pLcUxz/a5/QtWwC2Y=";
   };
 
+  propagatedBuildInputs = [
+    webcolors
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  pythonImportsCheck = [
+    "flux_led"
+  ];
+
   meta = with lib; {
-    description = "A Python library to communicate with the flux_led smart bulbs";
+    description = "Python library to communicate with the flux_led smart bulbs";
     homepage = "https://github.com/Danielhiversen/flux_led";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ colemickens ];
     platforms = platforms.linux;
   };

pkgs/development/python-modules/hatasmota/default.nix

@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "hatasmota";
-  version = "0.2.20";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "emontnemery";
     repo = pname;
     rev = version;
-    sha256 = "1qdvm1bnn7x2mf4fq997gvq6a5901ndhd2s75h92zsgmlcp7rc77";
+    sha256 = "sha256-mtn/r6pvHeGMLkvUP4w6CT+2+viLna4Vvn9RFMEmqts=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/mypy-boto3-s3/default.nix

@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.18.63";
+  version = "1.18.64";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf676b3d36677382429a3ed29e17edfdd342c1879db37868723b2a0761640d62";
+    sha256 = "c1640be24881b174b318888d6a0bfc7fc25d51ec9b263c60c6c5bac1e3295b70";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/nulltype/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "nulltype";
+  version = "2.3.1";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "0wpjbsmm0c9ifg9y6cnfz49qq9pa5f99nnqp6wdlv42ymfr3rak4";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "nulltype"
+  ];
+
+  meta = with lib; {
+    description = "Python library to handle Null values and sentinels like (but not) None, False and True";
+    homepage = "https://pypi.org/project/nulltype/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/open-garage/default.nix

@@ -8,14 +8,15 @@
 
 buildPythonPackage rec {
   pname = "open-garage";
-  version = "0.1.5";
+  version = "0.1.6";
+
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pyOpenGarage";
     rev = version;
-    sha256 = "1iqcqkbb1ik5lmsvwgy6i780x6y3wlm1gx257anxyvp1b21gm24p";
+    sha256 = "sha256-vm51Fjej0OQ7LftisS/tsnxZxa5c/j7eGIROMsEcXNE=";
   };
 
   propagatedBuildInputs = [
@@ -26,7 +27,9 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "opengarage" ];
+  pythonImportsCheck = [
+    "opengarage"
+  ];
 
   meta = with lib; {
     description = "Python module to communicate with opengarage.io";

pkgs/development/python-modules/plaid-python/default.nix

@@ -1,26 +1,38 @@
-{ lib, buildPythonPackage, fetchPypi, requests, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, nulltype
+, python-dateutil
+, urllib3
+}:
 
 buildPythonPackage rec {
-  version = "8.3.0";
   pname = "plaid-python";
+  version = "8.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b11779042bf6dcf1474a35a88bc52959ee41f1deeedcc6667b4d740a5627f28d";
+    sha256 = "13gj4xb0lx2dgdkcdp7fvvql3vjr572qpa1m993z3p7n5c27j5xi";
   };
 
-  checkInputs = [ pytest ];
+  propagatedBuildInputs = [
+    nulltype
+    python-dateutil
+    urllib3
+  ];
 
-  # Integration tests require API keys and internet access
+  # Tests require a Client IP
-  checkPhase = "py.test -rxs ./tests/unit";
+  doCheck = false;
 
-  propagatedBuildInputs = [ requests ];
+  pythonImportsCheck = [
+    "plaid"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Python client library for the Plaid API and Link";
     homepage = "https://github.com/plaid/plaid-python";
     changelog = "https://github.com/plaid/plaid-python/blob/master/CHANGELOG.md";
-    license = lib.licenses.mit;
+    license = licenses.mit;
-    maintainers = with lib.maintainers; [ bhipple ];
+    maintainers = with maintainers; [ bhipple ];
   };
 }

pkgs/development/python-modules/privacyidea-ldap-proxy/default.nix

@@ -1,30 +1,24 @@
-{ lib, buildPythonPackage, isPy3k, fetchFromGitHub, twisted, ldaptor, configobj }:
+{ lib, buildPythonPackage, fetchFromGitHub, twisted, ldaptor, configobj }:
 
 buildPythonPackage rec {
   pname = "privacyidea-ldap-proxy";
-  version = "0.6.1";
+  version = "0.6.2";
-
-  # https://github.com/privacyidea/privacyidea-ldap-proxy/issues/50
-  disabled = isPy3k;
 
   src = fetchFromGitHub {
     owner = "privacyidea";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1kc1n9wr1a66xd5zvl6dq78xnkqkn5574jpzashc99pvm62dr24j";
+    sha256 = "sha256-U2lg4zDQKn9FQ7O0zSLaijIkXKVjg8wi2ItueF4ACDU=";
   };
 
   propagatedBuildInputs = [ twisted ldaptor configobj ];
 
-  # python 2 zope.interface test import path issues
-  doCheck = false;
-
   pythonImportsCheck = [ "pi_ldapproxy" ];
 
   meta = with lib; {
     description = "LDAP Proxy to intercept LDAP binds and authenticate against privacyIDEA";
     homepage = "https://github.com/privacyidea/privacyidea-ldap-proxy";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = [ maintainers.globin ];
   };
 }

pkgs/development/python-modules/pychromecast/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "9.2.1";
+  version = "9.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iD1ug2/18QaKi9ADZKFbTJhUKTCGSV6f2crNm01UwL8=";
+    sha256 = "sha256-VN3TWbfk0Bm+LJ05/Cx1zRbiFYKafqca99GEobAxlhw=";
   };
 
   disabled = !isPy3k;

pkgs/development/python-modules/pycontrol4/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pycontrol4";
-  version = "0.3.0";
+  version = "0.3.1";
 
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "lawtancool";
     repo = "pyControl4";
     rev = "v${version}";
-    sha256 = "sha256-z7MDz9fGwZY4JcqabeYFGZ9nsRU2qa5LYnNQx/ae/4Y=";
+    sha256 = "068iiyi17ndv6cv124r5dzvififblbi2zw7jgnzb5xi0q093czkj";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pysma/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pysma";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ahSc45fIoYvFc0QOt8LV44J3mlJe8uTkwTLJ6cu8gKo=";
+    sha256 = "sha256-8HADY6+qwfzYyEVLQyMiXiUYinADSA1iKUay3YHhNXI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyspark/default.nix

@@ -1,28 +1,39 @@
-{ buildPythonPackage, fetchPypi, lib, py4j }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, py4j
+}:
 
 buildPythonPackage rec {
   pname = "pyspark";
-  version = "3.1.2";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5e25ebb18756e9715f4d26848cc7e558035025da74b4fc325a0ebc05ff538e65";
+    sha256 = "bfea06179edbfb4bc76a0f470bd3c38e12f00e1023e3ad0373558d07cff102ab";
   };
 
   # pypandoc is broken with pandoc2, so we just lose docs.
   postPatch = ''
     sed -i "s/'pypandoc'//" setup.py
 
-    substituteInPlace setup.py --replace py4j==0.10.9 'py4j>=0.10.9,<0.11'
+    substituteInPlace setup.py \
+      --replace py4j==0.10.9.2 'py4j>=0.10.9,<0.11'
   '';
 
-  propagatedBuildInputs = [ py4j ];
+  propagatedBuildInputs = [
+    py4j
+  ];
 
-  # Tests assume running spark...
+  # Tests assume running spark instance
   doCheck = false;
 
+  pythonImportsCheck = [
+    "pyspark"
+  ];
+
   meta = with lib; {
-    description = "Apache Spark";
+    description = "Python bindings for Apache Spark";
     homepage = "https://github.com/apache/spark/tree/master/python";
     license = licenses.asl20;
     maintainers = [ maintainers.shlevy ];

pkgs/development/python-modules/pytest-httpserver/default.nix

@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     pname = "pytest_httpserver";
     inherit version;
-    sha256 = "12b0028vp5rh9bg712klgjzm4vl4biyza1j6iyv3pgg25ircang3";
+    sha256 = "sha256-JwH9HZgU1YVR+dEETbM1xrqYcxaTZsWDSVI6WM907UA=";
   };
 
   propagatedBuildInputs = [ werkzeug ];

pkgs/development/python-modules/python-ironicclient/default.nix

@@ -20,11 +20,11 @@
 
 buildPythonApplication rec {
   pname = "python-ironicclient";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b55516a72b995f92fb434619cbc1e2effa604c7fcaa6ac4afb8f5af1ea8193a4";
+    sha256 = "99d45e914b2845731ac44fbfc63ae3e1bd52211396748797b588f2adc4b3f341";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pytile/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pytile";
-  version = "5.2.3";
+  version = "5.2.4";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "01gxq6dbqjmsqndjcbqv79wd2wgs7krm0rn47k883gh2xg9sn606";
+    sha256 = "sha256-9FbcGhRmXULJgfJOmy6mhiZwQUDNmvxZI/WxjJIbnc8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/qualysclient/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "qualysclient";
-  version = "0.0.4.8.1";
+  version = "0.0.4.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "woodtechie1428";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fdcmspjm1cy53x9gm7frfq175saskcwn565zqprgxzfcigip1n3";
+    sha256 = "0hrbp5ci1l06j709k5y3z3ad9dryvrkvmc2wyb4a01gw7qzry7ys";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sendgrid/default.nix

@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.8.2";
+  version = "6.8.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "sendgrid-python";
     rev = version;
-    sha256 = "sha256-TaewVBWQ6D5TH1TGXlXVBnW7K4HS/cFxJ6bcMv2DB+c=";
+    sha256 = "sha256-kJbpYLM+GpyAHEnO2mqULOYyxIpOrmGeSMd4wJccz/8=";
   };
 
   propagatedBuildInputs = [
@@ -45,5 +45,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/sendgrid/sendgrid-python";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    # No support for new starkbank-ecdsa releases
+    broken = true;
   };
 }

pkgs/development/python-modules/simple-rest-client/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "simple-rest-client";
-  version = "1.1.0";
+  version = "1.1.1";
 
   disabled = pythonOlder "3.8";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "allisson";
     repo = "python-simple-rest-client";
     rev = version;
-    sha256 = "sha256-i+wUc9qxyei+Jbch8vyIrm9ElClnOIKp+YK6jIDkbTA=";
+    sha256 = "sha256-oJXP2/lChlzzKyNiTgJMHkcNkFyy92kTPxgDkon54g8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/soco/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.24.0";
+  version = "0.24.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    sha256 = "sha256-3VL2JFlukfQdjTP65X40OOsuCUVsY9kuvRKUZ3qEd+s=";
+    sha256 = "sha256-78JYetA6msGiLMHNTdTN2b5lOiXaY+TQA9ID8qtPmM0=";
   };
 
   propagatedBuildInputs = [