From 920a3f5a9d0d603b2435bac2c58d76ab784fcddd Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Mon, 15 Mar 2021 01:33:45 +0000
Subject: [PATCH 01/20] nixos/acme: Fix webroot issues

With the UMask set to 0023, the
mkdir -p command which creates the webroot
could end up unreadable if the web server
changes, as surfaced by the test suite in #114751
On top of this, the following commands
to chown the webroot + subdirectories was
mostly unnecessary. I stripped it back to
only fix the deepest part of the directory,
resolving #115976, and reintroduced a
human readable error message.
---
 nixos/modules/security/acme.nix | 14 ++++++++----
 nixos/tests/acme.nix            | 39 ++++++++++++++++++++++++---------
 2 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index c33a92580d4c..5881e5f98d0a 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -24,7 +24,7 @@ let
       Type = "oneshot";
       User = "acme";
       Group = mkDefault "acme";
-      UMask = 0023;
+      UMask = 0022;
       StateDirectoryMode = 750;
       ProtectSystem = "full";
       PrivateTmp = true;
@@ -275,9 +275,15 @@ let
         set -euxo pipefail
 
         ${optionalString (data.webroot != null) ''
-          # Ensure the webroot exists
-          mkdir -p '${data.webroot}/.well-known/acme-challenge'
-          chown 'acme:${data.group}' ${data.webroot}/{.well-known,.well-known/acme-challenge}
+          # Ensure the webroot exists. Fixing group is required in case configuration was changed between runs.
+          # Lego will fail if the webroot does not exist at all.
+          (
+            mkdir -p '${data.webroot}/.well-known/acme-challenge' \
+            && chgrp '${data.group}' ${data.webroot}/.well-known/acme-challenge
+          ) || (
+            echo 'Please ensure ${data.webroot}/.well-known/acme-challenge exists and is writable by acme:${data.group}' \
+            && exit 1
+          )
         ''}
 
         echo '${domainHash}' > domainhash.txt
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index c6d393d91963..ef5021bf1a00 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -253,7 +253,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
 
       def check_connection(node, domain, retries=3):
-          assert retries >= 0
+          assert retries >= 0, f"Failed to connect to https://{domain}"
 
           result = node.succeed(
               "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"
@@ -262,12 +262,12 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
           for line in result.lower().split("\n"):
               if "verification" in line and "error" in line:
-                  time.sleep(1)
+                  time.sleep(3)
                   return check_connection(node, domain, retries - 1)
 
 
       def check_connection_key_bits(node, domain, bits, retries=3):
-          assert retries >= 0
+          assert retries >= 0, f"Did not find expected number of bits ({bits}) in key"
 
           result = node.succeed(
               "openssl s_client -CAfile /tmp/ca.crt"
@@ -277,12 +277,12 @@ in import ./make-test-python.nix ({ lib, ... }: {
           print("Key type:", result)
 
           if bits not in result:
-              time.sleep(1)
+              time.sleep(3)
               return check_connection_key_bits(node, domain, bits, retries - 1)
 
 
       def check_stapling(node, domain, retries=3):
-          assert retries >= 0
+          assert retries >= 0, "OCSP Stapling check failed"
 
           # Pebble doesn't provide a full OCSP responder, so just check the URL
           result = node.succeed(
@@ -293,10 +293,23 @@ in import ./make-test-python.nix ({ lib, ... }: {
           print("OCSP Responder URL:", result)
 
           if "${caDomain}:4002" not in result.lower():
-              time.sleep(1)
+              time.sleep(3)
               return check_stapling(node, domain, retries - 1)
 
 
+      def download_ca_certs(node, retries=5):
+          assert retries >= 0, "Failed to connect to pebble to download root CA certs"
+
+          exit_code, _ = node.execute("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
+          exit_code_2, _ = node.execute(
+              "curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt"
+          )
+
+          if exit_code + exit_code_2 > 0:
+              time.sleep(3)
+              return download_ca_certs(node, retries - 1)
+
+
       client.start()
       dnsserver.start()
 
@@ -313,8 +326,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
       acme.wait_for_unit("network-online.target")
       acme.wait_for_unit("pebble.service")
 
-      client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
-      client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")
+      download_ca_certs(client)
 
       with subtest("Can request certificate with HTTPS-01 challenge"):
           webserver.wait_for_unit("acme-finished-a.example.test.target")
@@ -375,8 +387,15 @@ in import ./make-test-python.nix ({ lib, ... }: {
           assert keyhash_old == keyhash_new
 
       with subtest("Can request certificates for vhost + aliases (apache-httpd)"):
-          switch_to(webserver, "httpd-aliases")
-          webserver.wait_for_unit("acme-finished-c.example.test.target")
+          try:
+              switch_to(webserver, "httpd-aliases")
+              webserver.wait_for_unit("acme-finished-c.example.test.target")
+          except Exception as err:
+              _, output = webserver.execute(
+                  "cat /var/log/httpd/*.log && ls -al /var/lib/acme/acme-challenge"
+              )
+              print(output)
+              raise err
           check_issuer(webserver, "c.example.test", "pebble")
           check_connection(client, "c.example.test")
           check_connection(client, "d.example.test")

From 2dd7973751e411e5dd6dc06e19b8c23e42ff2c3d Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Mon, 15 Mar 2021 19:25:49 +0000
Subject: [PATCH 02/20] nixos/acme: Add permissions tests

---
 nixos/tests/acme.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index ef5021bf1a00..99dd8ec6fd3c 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -334,6 +334,21 @@ in import ./make-test-python.nix ({ lib, ... }: {
           check_issuer(webserver, "a.example.test", "pebble")
           check_connection(client, "a.example.test")
 
+      with subtest("Certificates and accounts have safe + valid permissions"):
+          group = "${nodes.webserver.config.security.acme.certs."a.example.test".group}"
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
+          )
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/.lego/a.example.test/**/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
+          )
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test | tee /dev/stderr | grep '750 acme {group}' | wc -l) -eq 1"
+          )
+          webserver.succeed(
+              f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c \"%a %U %G\" {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"
+          )
+
       with subtest("Can generate valid selfsigned certs"):
           webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
           webserver.succeed("systemctl start acme-selfsigned-a.example.test.service")

From 6bfe98e543e32f90474093b3f79a784c35fc9f70 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 22 Mar 2021 00:32:43 +0000
Subject: [PATCH 03/20] catt: 0.12.0 -> 0.12.1

---
 pkgs/applications/video/catt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/catt/default.nix b/pkgs/applications/video/catt/default.nix
index e60acf87da6f..e4225963cb2b 100644
--- a/pkgs/applications/video/catt/default.nix
+++ b/pkgs/applications/video/catt/default.nix
@@ -4,11 +4,11 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "catt";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-6RUeinHhAvvSz38hHQP5/MXNiY00rCM8k2ONaFYbwPc=";
+    sha256 = "fef58bf7a8ebaba98399d1077cc4615f53d0196aab2a989df369a66f7111963b";
   };
 
   propagatedBuildInputs = [

From f8f11cba7784ec5b9201f609a5c550c7431f936c Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 22 Mar 2021 06:03:47 +0000
Subject: [PATCH 04/20] codeql: 2.4.5 -> 2.4.6

---
 pkgs/development/tools/analysis/codeql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 77992b9909ce..49b711c2c19b 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.4.5";
+  version = "2.4.6";
 
   dontConfigure = true;
   dontBuild = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-FM7fcjbZilp1spy0HxDhEAzs7Qe2r/HObKB80o4mSiw=";
+    sha256 = "sha256-lJ/N9oduWGZAc70wl7ATBd1mnaUkeTXAW/RfqbAthsI=";
   };
 
   nativeBuildInputs = [

From d4a4a8fbd837c8a2c9b9d4f958c9a9e5bc8c860e Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 22 Mar 2021 09:30:32 +0000
Subject: [PATCH 05/20] hugo: 0.81.0 -> 0.82.0

---
 pkgs/applications/misc/hugo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index a4c32b9b931c..8f3444d85d80 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.81.0";
+  version = "0.82.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9YroUxcLixu+MNL37JByCulCHv0WxWGwqBQ/+FGtZLw=";
+    sha256 = "sha256-D0bwy8LJihlfM+E3oys85yjadjZNfPv5xnq4ekaZPCU=";
   };
 
-  vendorSha256 = "sha256-5gQyoLirXajkzxKxzcuPnjECL2mJPiHS65lYkyIpKs8=";
+  vendorSha256 = "sha256-pJBm+yyy1DbH28oVBQA+PHSDtSg3RcgbRlurrwnnEls=";
 
   doCheck = false;
 

From d51760a0748a26ee40a77e277de5d71a54e3feb8 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 22 Mar 2021 10:38:44 +0000
Subject: [PATCH 06/20] kubie: 0.12.1 -> 0.13.4

---
 pkgs/development/tools/kubie/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index 7f8a193551fe..c00304c1ec52 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.12.1";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-y4/azFr2fngmUxQw3c2xAhAppYHeD6Bz7IvZ6GTdsEQ=";
+    sha256 = "sha256-ZD63Xtnw7qzTrzFxzzZ37N177/PnRaMEzBbhz7h/zCY=";
   };
 
-  cargoSha256 = "sha256-/Vg3qojBWN2tp8QaKmHrzy3cDWlkT6067Wprcjlu31U=";
+  cargoSha256 = "sha256-c6veaasuwRtaO8TwHS0tNxjbBfekQOa52I9INcE1Jn0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From f875d996fb2cd1dafe18290b65e04f0bd6032d1d Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Sun, 21 Mar 2021 22:11:09 -0400
Subject: [PATCH 07/20] kodi.packages.a4ksubtitles: init at 2.3.0

---
 .../kodi-packages/a4ksubtitles/default.nix    | 26 +++++++++++++++++++
 pkgs/top-level/kodi-packages.nix              |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/applications/video/kodi-packages/a4ksubtitles/default.nix

diff --git a/pkgs/applications/video/kodi-packages/a4ksubtitles/default.nix b/pkgs/applications/video/kodi-packages/a4ksubtitles/default.nix
new file mode 100644
index 000000000000..5d714cf17993
--- /dev/null
+++ b/pkgs/applications/video/kodi-packages/a4ksubtitles/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildKodiAddon, fetchFromGitHub, requests, vfs-libarchive  }:
+
+buildKodiAddon rec {
+  pname = "a4ksubtitles";
+  namespace = "service.subtitles.a4ksubtitles";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "a4k-openproject";
+    repo = "a4kSubtitles";
+    rev = "${namespace}/${namespace}-${version}";
+    sha256 = "0hxvxkbihfyvixmlxf5n4ccn70w0244hhw3hr44rqvx00a0bg1lh";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    vfs-libarchive
+  ];
+
+  meta = with lib; {
+    homepage = "https://a4k-openproject.github.io/a4kSubtitles/";
+    description = "Multi-Source Subtitles Addon";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index 03d70a32f6a2..38d1ed6b86ca 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -46,6 +46,8 @@ let self = rec {
 
   # addon packages
 
+  a4ksubtitles = callPackage ../applications/video/kodi-packages/a4ksubtitles { };
+
   controllers = {
     default = callPackage ../applications/video/kodi-packages/controllers { controller = "default"; };
 

From 971b497a470c1a1931c36fd6ac58c72a46bf85f0 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 22 Mar 2021 12:14:15 +0000
Subject: [PATCH 08/20] minizinc: 2.5.4 -> 2.5.5

---
 pkgs/development/tools/minizinc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/minizinc/default.nix b/pkgs/development/tools/minizinc/default.nix
index ad267e6bcdd8..c1e0a356df35 100644
--- a/pkgs/development/tools/minizinc/default.nix
+++ b/pkgs/development/tools/minizinc/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, flex, bison }:
 let
-  version = "2.5.4";
+  version = "2.5.5";
 in
 stdenv.mkDerivation {
   pname = "minizinc";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     owner = "MiniZinc";
     repo = "libminizinc";
     rev = version;
-    sha256 = "sha256-/vJyh2WdESimJTCASsg6xjVzG2EkL4V87B+xvIUBcMM=";
+    sha256 = "sha256-9z2E6KqOys9UUXlXWB4eDhg34kS3PhUB1Dd1F6iGYoE=";
   };
 
   meta = with lib; {

From aae8588182913549435332d0ac120e18d7afdab5 Mon Sep 17 00:00:00 2001
From: Louis Blin <45168934+lbpdt@users.noreply.github.com>
Date: Mon, 8 Mar 2021 20:36:13 +0000
Subject: [PATCH 09/20] dockerTools.buildLayeredImage: support fromImage

It is now possible to pass a `fromImage` to `buildLayeredImage` and
`streamLayeredImage`, similar to what `buildImage` currently supports.

This will prepend the layers of the given base image to the resulting
image, while ensuring that at most `maxLayers` are used. It will also
ensure that environment variables from the base image are propagated
to the final image.
---
 doc/builders/images/dockertools.section.md    |  6 ++
 nixos/tests/docker-tools.nix                  | 30 +++++-
 pkgs/build-support/docker/default.nix         | 29 +++++-
 pkgs/build-support/docker/examples.nix        | 85 ++++++++++++-----
 .../docker/stream_layered_image.py            | 94 +++++++++++++++++--
 5 files changed, 213 insertions(+), 31 deletions(-)

diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md
index 40d4dba1b85e..23662f9bbfe4 100644
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@@ -111,6 +111,12 @@ Create a Docker image with many of the store paths being on their own layer to i
 
     *Default:* the output path's hash
 
+`fromImage` _optional_
+
+: The repository tarball containing the base image. It must be a valid Docker image, such as one exported by `docker save`.
+
+    *Default:* `null`, which can be seen as equivalent to `FROM scratch` of a `Dockerfile`.
+
 `contents` _optional_
 
 : Top level paths in the container. Either a single derivation, or a list of derivations.
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index 1cc554d002b2..dd287883c982 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -161,12 +161,18 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker run --rm ${examples.layered-image.imageName} cat extraCommands",
         )
 
-    with subtest("Ensure building an image on top of a layered Docker images work"):
+    with subtest("Ensure images built on top of layered Docker images work"):
         docker.succeed(
             "docker load --input='${examples.layered-on-top}'",
             "docker run --rm ${examples.layered-on-top.imageName}",
         )
 
+    with subtest("Ensure layered images built on top of layered Docker images work"):
+        docker.succeed(
+            "docker load --input='${examples.layered-on-top-layered}'",
+            "docker run --rm ${examples.layered-on-top-layered.imageName}",
+        )
+
 
     def set_of_layers(image_name):
         return set(
@@ -205,6 +211,16 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         assert "FROM_CHILD=true" in env, "envvars from the child should be preserved"
         assert "LAST_LAYER=child" in env, "envvars from the child should take priority"
 
+    with subtest("Ensure environment variables of layered images are correctly inherited"):
+        docker.succeed(
+            "docker load --input='${examples.environmentVariablesLayered}'"
+        )
+        out = docker.succeed("docker run --rm ${examples.environmentVariablesLayered.imageName} env")
+        env = out.splitlines()
+        assert "FROM_PARENT=true" in env, "envvars from the parent should be preserved"
+        assert "FROM_CHILD=true" in env, "envvars from the child should be preserved"
+        assert "LAST_LAYER=child" in env, "envvars from the child should take priority"
+
     with subtest("Ensure image with only 2 layers can be loaded"):
         docker.succeed(
             "docker load --input='${examples.two-layered-image}'"
@@ -219,6 +235,18 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker run bulk-layer ls /bin/hello",
         )
 
+    with subtest(
+        "Ensure the bulk layer with a base image respects the number of maxLayers"
+    ):
+        docker.succeed(
+            "docker load --input='${pkgs.dockerTools.examples.layered-bulk-layer}'",
+            # Ensure the image runs correctly
+            "docker run layered-bulk-layer ls /bin/hello",
+        )
+
+        # Ensure the image has the correct number of layers
+        assert len(set_of_layers("layered-bulk-layer")) == 4
+
     with subtest("Ensure correct behavior when no store is needed"):
         # This check tests that buildLayeredImage can build images that don't need a store.
         docker.succeed(
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index fec289f0ff1e..a73737cb1231 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -729,6 +729,8 @@ rec {
     name,
     # Image tag, the Nix's output hash will be used if null
     tag ? null,
+    # Parent image, to append to.
+    fromImage ? null,
     # Files to put on the image (a nix store path or list of paths).
     contents ? [],
     # Docker config; e.g. what command to run on the container.
@@ -791,7 +793,7 @@ rec {
       unnecessaryDrvs = [ baseJson overallClosure ];
 
       conf = runCommand "${baseName}-conf.json" {
-        inherit maxLayers created;
+        inherit fromImage maxLayers created;
         imageName = lib.toLower name;
         passthru.imageTag =
           if tag != null
@@ -821,6 +823,27 @@ rec {
                          unnecessaryDrvs}
         }
 
+        # Compute the number of layers that are already used by a potential
+        # 'fromImage' as well as the customization layer. Ensure that there is
+        # still at least one layer available to store the image contents.
+        usedLayers=0
+
+        # subtract number of base image layers
+        if [[ -n "$fromImage" ]]; then
+          (( usedLayers += $(tar -xOf "$fromImage" manifest.json | jq '.[0].Layers | length') ))
+        fi
+
+        # one layer will be taken up by the customisation layer
+        (( usedLayers += 1 ))
+
+        if ! (( $usedLayers < $maxLayers )); then
+          echo >&2 "Error: usedLayers $usedLayers layers to store 'fromImage' and" \
+                    "'extraCommands', but only maxLayers=$maxLayers were" \
+                    "allowed. At least 1 layer is required to store contents."
+          exit 1
+        fi
+        availableLayers=$(( maxLayers - usedLayers ))
+
         # Create $maxLayers worth of Docker Layers, one layer per store path
         # unless there are more paths than $maxLayers. In that case, create
         # $maxLayers-1 for the most popular layers, and smush the remainaing
@@ -838,18 +861,20 @@ rec {
                 | (.[:$maxLayers-1] | map([.])) + [ .[$maxLayers-1:] ]
                 | map(select(length > 0))
             ' \
-              --argjson maxLayers "$(( maxLayers - 1 ))" # one layer will be taken up by the customisation layer
+              --argjson maxLayers "$availableLayers"
         )"
 
         cat ${baseJson} | jq '
           . + {
             "store_dir": $store_dir,
+            "from_image": $from_image,
             "store_layers": $store_layers,
             "customisation_layer", $customisation_layer,
             "repo_tag": $repo_tag,
             "created": $created
           }
           ' --arg store_dir "${storeDir}" \
+            --argjson from_image ${if fromImage == null then "null" else "'\"${fromImage}\"'"} \
             --argjson store_layers "$store_layers" \
             --arg customisation_layer ${customisationLayer} \
             --arg repo_tag "$imageName:$imageTag" \
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 9e33a42af23e..9c7d46812140 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -188,7 +188,25 @@ rec {
     };
   };
 
-  # 12. example of running something as root on top of a parent image
+  # 12 Create a layered image on top of a layered image
+  layered-on-top-layered = pkgs.dockerTools.buildLayeredImage {
+    name = "layered-on-top-layered";
+    tag = "latest";
+    fromImage = layered-image;
+    extraCommands = ''
+      mkdir ./example-output
+      chmod 777 ./example-output
+    '';
+    config = {
+      Env = [ "PATH=${pkgs.coreutils}/bin/" ];
+      WorkingDir = "/example-output";
+      Cmd = [
+        "${pkgs.bash}/bin/bash" "-c" "echo hello > foo; cat foo"
+      ];
+    };
+  };
+
+  # 13. example of running something as root on top of a parent image
   # Regression test related to PR #52109
   runAsRootParentImage = buildImage {
     name = "runAsRootParentImage";
@@ -197,7 +215,7 @@ rec {
     fromImage = bash;
   };
 
-  # 13. example of 3 layers images This image is used to verify the
+  # 14. example of 3 layers images This image is used to verify the
   # order of layers is correct.
   # It allows to validate
   # - the layer of parent are below
@@ -235,23 +253,23 @@ rec {
     '';
   };
 
-  # 14. Environment variable inheritance.
+  # 15. Environment variable inheritance.
   # Child image should inherit parents environment variables,
   # optionally overriding them.
-  environmentVariables = let
-    parent = pkgs.dockerTools.buildImage {
-      name = "parent";
-      tag = "latest";
-      config = {
-        Env = [
-          "FROM_PARENT=true"
-          "LAST_LAYER=parent"
-        ];
-      };
+  environmentVariablesParent = pkgs.dockerTools.buildImage {
+    name = "parent";
+    tag = "latest";
+    config = {
+      Env = [
+        "FROM_PARENT=true"
+        "LAST_LAYER=parent"
+      ];
     };
-  in pkgs.dockerTools.buildImage {
+  };
+
+  environmentVariables = pkgs.dockerTools.buildImage {
     name = "child";
-    fromImage = parent;
+    fromImage = environmentVariablesParent;
     tag = "latest";
     contents = [ pkgs.coreutils ];
     config = {
@@ -262,14 +280,27 @@ rec {
     };
   };
 
-  # 15. Create another layered image, for comparing layers with image 10.
+  environmentVariablesLayered = pkgs.dockerTools.buildLayeredImage {
+    name = "child";
+    fromImage = environmentVariablesParent;
+    tag = "latest";
+    contents = [ pkgs.coreutils ];
+    config = {
+      Env = [
+        "FROM_CHILD=true"
+        "LAST_LAYER=child"
+      ];
+    };
+  };
+
+  # 16. Create another layered image, for comparing layers with image 10.
   another-layered-image = pkgs.dockerTools.buildLayeredImage {
     name = "another-layered-image";
     tag = "latest";
     config.Cmd = [ "${pkgs.hello}/bin/hello" ];
   };
 
-  # 16. Create a layered image with only 2 layers
+  # 17. Create a layered image with only 2 layers
   two-layered-image = pkgs.dockerTools.buildLayeredImage {
     name = "two-layered-image";
     tag = "latest";
@@ -278,7 +309,7 @@ rec {
     maxLayers = 2;
   };
 
-  # 17. Create a layered image with more packages than max layers.
+  # 18. Create a layered image with more packages than max layers.
   # coreutils and hello are part of the same layer
   bulk-layer = pkgs.dockerTools.buildLayeredImage {
     name = "bulk-layer";
@@ -289,7 +320,19 @@ rec {
     maxLayers = 2;
   };
 
-  # 18. Create a "layered" image without nix store layers. This is not
+  # 19. Create a layered image with a base image and more packages than max
+  # layers. coreutils and hello are part of the same layer
+  layered-bulk-layer = pkgs.dockerTools.buildLayeredImage {
+    name = "layered-bulk-layer";
+    tag = "latest";
+    fromImage = two-layered-image;
+    contents = with pkgs; [
+      coreutils hello
+    ];
+    maxLayers = 4;
+  };
+
+  # 20. Create a "layered" image without nix store layers. This is not
   # recommended, but can be useful for base images in rare cases.
   no-store-paths = pkgs.dockerTools.buildLayeredImage {
     name = "no-store-paths";
@@ -321,7 +364,7 @@ rec {
     };
   };
 
-  # 19. Support files in the store on buildLayeredImage
+  # 21. Support files in the store on buildLayeredImage
   # See: https://github.com/NixOS/nixpkgs/pull/91084#issuecomment-653496223
   filesInStore = pkgs.dockerTools.buildLayeredImageWithNixDb {
     name = "file-in-store";
@@ -341,7 +384,7 @@ rec {
     };
   };
 
-  # 20. Ensure that setting created to now results in a date which
+  # 22. Ensure that setting created to now results in a date which
   # isn't the epoch + 1 for layered images.
   unstableDateLayered = pkgs.dockerTools.buildLayeredImage {
     name = "unstable-date-layered";
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
index 60d67442c169..3e5781ba1c80 100644
--- a/pkgs/build-support/docker/stream_layered_image.py
+++ b/pkgs/build-support/docker/stream_layered_image.py
@@ -33,6 +33,7 @@ function does all this.
 
 import io
 import os
+import re
 import sys
 import json
 import hashlib
@@ -126,10 +127,85 @@ class ExtractChecksum:
         return (self._digest.hexdigest(), self._size)
 
 
+FromImage = namedtuple("FromImage", ["tar", "manifest_json", "image_json"])
 # Some metadata for a layer
 LayerInfo = namedtuple("LayerInfo", ["size", "checksum", "path", "paths"])
 
 
+def load_from_image(from_image_str):
+    """
+    Loads the given base image, if any.
+
+    from_image_str: Path to the base image archive.
+
+    Returns: A 'FromImage' object with references to the loaded base image,
+             or 'None' if no base image was provided.
+    """
+    if from_image_str is None:
+        return None
+
+    base_tar = tarfile.open(from_image_str)
+
+    manifest_json_tarinfo = base_tar.getmember("manifest.json")
+    with base_tar.extractfile(manifest_json_tarinfo) as f:
+        manifest_json = json.load(f)
+
+    image_json_tarinfo = base_tar.getmember(manifest_json[0]["Config"])
+    with base_tar.extractfile(image_json_tarinfo) as f:
+        image_json = json.load(f)
+
+    return FromImage(base_tar, manifest_json, image_json)
+
+
+def add_base_layers(tar, from_image):
+    """
+    Adds the layers from the given base image to the final image.
+
+    tar: 'tarfile.TarFile' object for new layers to be added to.
+    from_image: 'FromImage' object with references to the loaded base image.
+    """
+    if from_image is None:
+        print("No 'fromImage' provided", file=sys.stderr)
+        return []
+
+    layers = from_image.manifest_json[0]["Layers"]
+    checksums = from_image.image_json["rootfs"]["diff_ids"]
+    layers_checksums = zip(layers, checksums)
+
+    for num, (layer, checksum) in enumerate(layers_checksums, start=1):
+        layer_tarinfo = from_image.tar.getmember(layer)
+        checksum = re.sub(r"^sha256:", "", checksum)
+
+        tar.addfile(layer_tarinfo, from_image.tar.extractfile(layer_tarinfo))
+        path = layer_tarinfo.path
+        size = layer_tarinfo.size
+
+        print("Adding base layer", num, "from", path, file=sys.stderr)
+        yield LayerInfo(size=size, checksum=checksum, path=path, paths=[path])
+
+    from_image.tar.close()
+
+
+def overlay_base_config(from_image, final_config):
+    """
+    Overlays the final image 'config' JSON on top of selected defaults from the
+    base image 'config' JSON.
+
+    from_image: 'FromImage' object with references to the loaded base image.
+    final_config: 'dict' object of the final image 'config' JSON.
+    """
+    if from_image is None:
+        return final_config
+
+    base_config = from_image.image_json["config"]
+
+    # Preserve environment from base image
+    final_env = base_config.get("Env", []) + final_config.get("Env", [])
+    if final_env:
+        final_config["Env"] = final_env
+    return final_config
+
+
 def add_layer_dir(tar, paths, store_dir, mtime):
     """
     Appends given store paths to a TarFile object as a new layer.
@@ -248,17 +324,21 @@ def main():
     mtime = int(created.timestamp())
     store_dir = conf["store_dir"]
 
+    from_image = load_from_image(conf["from_image"])
+
     with tarfile.open(mode="w|", fileobj=sys.stdout.buffer) as tar:
         layers = []
-        for num, store_layer in enumerate(conf["store_layers"]):
-            print(
-              "Creating layer", num,
-              "from paths:", store_layer,
-              file=sys.stderr)
+        layers.extend(add_base_layers(tar, from_image))
+
+        start = len(layers) + 1
+        for num, store_layer in enumerate(conf["store_layers"], start=start):
+            print("Creating layer", num, "from paths:", store_layer,
+                  file=sys.stderr)
             info = add_layer_dir(tar, store_layer, store_dir, mtime=mtime)
             layers.append(info)
 
-        print("Creating the customisation layer...", file=sys.stderr)
+        print("Creating layer", len(layers) + 1, "with customisation...",
+              file=sys.stderr)
         layers.append(
           add_customisation_layer(
             tar,
@@ -273,7 +353,7 @@ def main():
             "created": datetime.isoformat(created),
             "architecture": conf["architecture"],
             "os": "linux",
-            "config": conf["config"],
+            "config": overlay_base_config(from_image, conf["config"]),
             "rootfs": {
                 "diff_ids": [f"sha256:{layer.checksum}" for layer in layers],
                 "type": "layers",

From f7d1fb542fee29f90a85a2683da5835848de67d3 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Sat, 20 Mar 2021 15:16:25 -0300
Subject: [PATCH 10/20] mksh: fix license

According to official documentation (http://www.mirbsd.org/TaC-mksh.txt), mksh
licensing changes according to build-time configuration.
---
 pkgs/shells/mksh/default.nix | 34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/pkgs/shells/mksh/default.nix b/pkgs/shells/mksh/default.nix
index c10537959d75..360380e19b34 100644
--- a/pkgs/shells/mksh/default.nix
+++ b/pkgs/shells/mksh/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
 
 stdenv.mkDerivation rec {
   pname = "mksh";
@@ -6,20 +10,30 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     urls = [
-      "https://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R${version}.tgz"
-      "http://pub.allbsd.org/MirOS/dist/mir/mksh/mksh-R${version}.tgz"
+      "https://www.mirbsd.org/MirOS/dist/mir/mksh/${pname}-R${version}.tgz"
+      "http://pub.allbsd.org/MirOS/dist/mir/mksh/${pname}-R${version}.tgz"
     ];
-    sha256 = "01n5ggw33bw4jv4d3148wlw9n4aj7vdn3ffnc66c9w9pldjidbkp";
+    hash = "sha256-d64WZaM38cSMYda5Yds+UhGbOOWIhNHIloSvMfh7xQY=";
   };
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   dontConfigure = true;
 
-  buildPhase = "sh ./Build.sh -r";
+  buildPhase = ''
+    runHook preBuild
+    sh ./Build.sh -r
+    runHook postBuild
+  '';
 
   installPhase = ''
-    install -D -m 755 mksh $out/bin/mksh
-    install -D -m 644 mksh.1 $out/share/man/man1/mksh.1
-    install -D -m 644 dot.mkshrc $out/share/mksh/mkshrc
+    runHook preInstall
+    install -D mksh $out/bin/mksh
+    install -D dot.mkshrc $out/share/mksh/mkshrc
+    installManPage mksh.1
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -32,7 +46,7 @@ stdenv.mkDerivation rec {
       systems.
     '';
     homepage = "https://www.mirbsd.org/mksh.htm";
-    license = licenses.bsd3;
+    license = with licenses; [ miros isc unicode-dfs-2016 ];
     maintainers = with maintainers; [ AndersonTorres joachifm ];
     platforms = platforms.unix;
   };
@@ -41,3 +55,5 @@ stdenv.mkDerivation rec {
     shellPath = "/bin/mksh";
   };
 }
+# TODO [ AndersonTorres ]: lksh
+# TODO [ AndersonTorres ]: a more accurate licensing info

From 1176f7068f29509b7f6d095c822174790f7f6065 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 23 Mar 2021 18:30:59 +0000
Subject: [PATCH 11/20] python38Packages.bitarray: 1.7.1 -> 1.8.0

---
 pkgs/development/python-modules/bitarray/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bitarray/default.nix b/pkgs/development/python-modules/bitarray/default.nix
index b287e7be98e8..64bfdb89efb8 100644
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4de977d708b7024760266d827b8285e4405dce4293f25508c4556970139018a";
+    sha256 = "fe4444d92b17073bf1f9f24e3015a0e5bb70a645c47df93ef8a9ce8be33fcbad";
   };
 
   pythonImportsCheck = [ "bitarray" ];

From 2ce3eff490737e1fe24a30f26464875267140098 Mon Sep 17 00:00:00 2001
From: Flakebi <flakebi@t-online.de>
Date: Tue, 23 Mar 2021 19:38:14 +0100
Subject: [PATCH 12/20] salt: 3002.5 -> 3002.6

---
 pkgs/tools/admin/salt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 9a2d8e52fd96..7df6e94e46bd 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -7,11 +7,11 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3002.5";
+  version = "3002.6";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1bqranhanxcxjc1qcc6cm95f4xxag0ic9g61dq352hqh6m1l1ay8";
+    sha256 = "/8R4VpNj4dF7ajoMQh6q6cB5u+q8THcloiLQ+/kDoKU=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

From ad8aaa1eb1e32674386171bcd2e71c5edb5f0aa9 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Tue, 23 Mar 2021 16:24:49 -0300
Subject: [PATCH 13/20] zchunk: 1.1.8 -> 1.1.9

---
 pkgs/development/libraries/zchunk/default.nix | 38 +++++++++----------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/libraries/zchunk/default.nix b/pkgs/development/libraries/zchunk/default.nix
index a0d1378aa708..2037d815a81b 100644
--- a/pkgs/development/libraries/zchunk/default.nix
+++ b/pkgs/development/libraries/zchunk/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
-, pkg-config
+, argp-standalone
+, curl
 , meson
 , ninja
+, pkg-config
 , zstd
-, curl
-, argp-standalone
 }:
 
 stdenv.mkDerivation rec {
   pname = "zchunk";
-  version = "1.1.8";
+  version = "1.1.9";
 
   outputs = [ "out" "lib" "dev" ];
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     owner = "zchunk";
     repo = pname;
     rev = version;
-    sha256 = "0q1jafxh5nqgn2w5ciljkh8h46xma0qia8a5rj9m0pxixcacqj6q";
+    hash = "sha256-MqnHtqOjLl6R5GZ4f2UX1iLoO9FUT2IfZlSN58wW8JA=";
   };
 
   nativeBuildInputs = [
@@ -29,25 +29,23 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    zstd
     curl
+    zstd
   ] ++ lib.optional stdenv.isDarwin argp-standalone;
 
-  # Darwin needs a patch for argp-standalone usage and differing endian.h location on macOS
-  # https://github.com/zchunk/zchunk/pull/35
-  patches = [
-  (fetchpatch {
-    name = "darwin-support.patch";
-    url = "https://github.com/zchunk/zchunk/commit/f7db2ac0a95028a7f82ecb89862426bf53a69232.patch";
-    sha256 = "0cm84gyii4ly6nsmagk15g9kbfa13rw395nqk3fdcwm0dpixlkh4";
-  })
-];
-
   meta = with lib; {
-    description = "File format designed for highly efficient deltas while maintaining good compression";
     homepage = "https://github.com/zchunk/zchunk";
+    description = "File format designed for highly efficient deltas while maintaining good compression";
+    longDescription = ''
+      zchunk is a compressed file format that splits the file into independent
+      chunks. This allows you to only download changed chunks when downloading a
+      new version of the file, and also makes zchunk files efficient over rsync.
+
+      zchunk files are protected with strong checksums to verify that the file
+      you downloaded is, in fact, the file you wanted.
+    '';
     license = licenses.bsd2;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
   };
 }

From 2a212938fa0760868c371d871410efb65491582c Mon Sep 17 00:00:00 2001
From: "Robert T. McGibbon" <rmcgibbo@gmail.com>
Date: Tue, 23 Mar 2021 17:24:20 -0400
Subject: [PATCH 14/20] python3Packages.restview: 2.9.1 -> 2.9.2 (#117374)

---
 .../python-modules/restview/default.nix       | 22 +++++++------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/restview/default.nix b/pkgs/development/python-modules/restview/default.nix
index acce48c45d04..b2fc2d9beae7 100644
--- a/pkgs/development/python-modules/restview/default.nix
+++ b/pkgs/development/python-modules/restview/default.nix
@@ -7,38 +7,32 @@
 , packaging
 , pygments
 , mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "restview";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de87c84f19526bd4a76505f6d40b51b7bb03ca43b6067c93f82f1c7237ac9e84";
+    sha256 = "1p1jgdvc04ws8kga3r0vrq3m0b52qw3clwyydl96a13wb3mrf03r";
   };
 
-  propagatedBuildInputs = [ docutils readme_renderer packaging pygments ];
-  checkInputs = [ mock ];
-
   patches = [
-    # fix tests after readme_renderer update
-    # TODO remove on next update
     (fetchpatch {
-      url = "https://github.com/mgedmin/restview/commit/541743ded13ae55dea4c437046984a5f13d06e8b.patch";
-      sha256 = "031b1dlqx346bz7afpc011lslnq771lnxb6iy1l2285pph534bci";
+      url = "https://github.com/mgedmin/restview/commit/a1ded30a87c65f3ce59a18497a7fc5099317c2be.patch";
+      sha256 = "1ax7pih456a3nbj8qrrq7hqigbyag4ihzpn6bm0z4y74d0r3v8a5";
     })
   ];
 
-  postPatch = ''
-    # dict order breaking tests
-    sed -i 's@<a href="http://www.example.com" rel="nofollow">@...@' src/restview/tests.py
-  '';
+  propagatedBuildInputs = [ docutils readme_renderer packaging pygments ];
+  checkInputs = [ mock pytestCheckHook ];
 
   meta = {
     description = "ReStructuredText viewer";
     homepage = "https://mg.pov.lt/restview/";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ koral ];
   };
 }

From dfff61f8500bd74872ada89c5f8a674f13605508 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Tue, 23 Mar 2021 14:08:03 -0300
Subject: [PATCH 15/20] zziplib: 0.13.71 -> 0.13.72

---
 .../development/libraries/zziplib/default.nix | 74 ++++++++-----------
 1 file changed, 29 insertions(+), 45 deletions(-)

diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
index 8cfec83af542..051af0bd43f7 100644
--- a/pkgs/development/libraries/zziplib/default.nix
+++ b/pkgs/development/libraries/zziplib/default.nix
@@ -1,80 +1,64 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
 , perl
 , pkg-config
-, fetchFromGitHub
-, fetchpatch
-, zip
-, unzip
 , python3
 , xmlto
+, zip
 , zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.71";
+  version = "0.13.72";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
-    repo = "zziplib";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "P+7D57sc2oIABhk3k96aRILpGnsND5SLXHh2lqr9O4E=";
+    hash = "sha256-Ht3fBgdrTm4mCi5uhgQPNtpGzADoRVOpSuGPsIS6y0Q=";
   };
 
-  patches = [
-    # Install man pages
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/5583ccc7a247ee27556ede344e93d3ac1dc72e9b.patch";
-      sha256 = "wVExEZN8Ml1/3GicB0ZYsLVS3KJ8BSz8i4Gu46naz1Y=";
-      excludes = [ "GNUmakefile" ];
-    })
-
-    # Fix man page formatting
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/22ed64f13dc239f86664c60496261f544bce1088.patch";
-      sha256 = "ScFVWLc4LQPqkcHn9HK/VkLula4b5HzuYl0b5vi4Ikc=";
-    })
-  ];
-
   nativeBuildInputs = [
+    cmake
     perl
     pkg-config
-    zip
     python3
     xmlto
+    zip
   ];
-
   buildInputs = [
     zlib
   ];
 
-  checkInputs = [
-    unzip
+  # test/zziptests.py requires network access
+  # (https://github.com/gdraheim/zziplib/issues/24)
+  cmakeFlags = [
+    "-DZZIP_TESTCVE=OFF"
+    "-DBUILD_SHARED_LIBS=True"
+    "-DBUILD_STATIC_LIBS=False"
+    "-DBUILD_TESTS=OFF"
+    "-DMSVC_STATIC_RUNTIME=OFF"
+    "-DZZIPSDL=OFF"
+    "-DZZIPTEST=OFF"
+    "-DZZIPWRAP=OFF"
+    "-DBUILDTESTS=OFF"
   ];
 
-  # tests are broken (https://github.com/gdraheim/zziplib/issues/20),
-  # and test/zziptests.py requires network access
-  # (https://github.com/gdraheim/zziplib/issues/24)
-  doCheck = false;
-  checkTarget = "check";
-
   meta = with lib; {
+    homepage = "https://github.com/gdraheim/zziplib";
     description = "Library to extract data from files archived in a zip file";
-
     longDescription = ''
-      The zziplib library is intentionally lightweight, it offers the ability
-      to easily extract data from files archived in a single zip
-      file.  Applications can bundle files into a single zip archive and
-      access them.  The implementation is based only on the (free) subset of
-      compression with the zlib algorithm which is actually used by the
-      zip/unzip tools.
+      The zziplib library is intentionally lightweight, it offers the ability to
+      easily extract data from files archived in a single zip file.
+      Applications can bundle files into a single zip archive and access them.
+      The implementation is based only on the (free) subset of compression with
+      the zlib algorithm which is actually used by the zip/unzip tools.
     '';
-
     license = with licenses; [ lgpl2Plus mpl11 ];
-
-    homepage = "http://zziplib.sourceforge.net/";
-
-    maintainers = [ ];
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = python3.meta.platforms;
   };
 }

From 76552e95cc6679de7b690ef624135b71b3b326d7 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Tue, 23 Mar 2021 18:45:48 -0400
Subject: [PATCH 16/20] stdenv: Fix regression on ARM+static when enabling
 hardening (#115363)

4e9dc46dea0ef8cf15c567fa863796bb23099d0b re-enabled hardening for Musl,
which is good.

Though static builds for ARM fail in various ways

 - cross armv7l static does not build
 - cross aarch64 static produces segfaulting dynamically linked binaries
 - native aarch64 static also produces segfaulting dynamically linked binaries

It seems that for native x86_64-linux, static builds are fine though.

This works around the issue by removing PIE from the hardening flags,
keeping all other hardening flags. This is an improvement (I think) from
before 4e9dc46d.

Fixes #114953
---
 pkgs/stdenv/generic/make-derivation.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 19c3d8965a74..2b89b37f7864 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -106,7 +106,12 @@ in rec {
                                       ++ depsTargetTarget ++ depsTargetTargetPropagated) == 0;
       dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || (stdenv.noCC or false);
       supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
-      defaultHardeningFlags = if stdenv.hostPlatform.isMusl
+                              # Musl-based platforms will keep "pie", other platforms will not.
+      defaultHardeningFlags = if stdenv.hostPlatform.isMusl &&
+                                # Except when:
+                                #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
+                                #    - static armv7l, where compilation fails.
+                                !((stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32) && stdenv.hostPlatform.isStatic)
                               then supportedHardeningFlags
                               else lib.remove "pie" supportedHardeningFlags;
       enabledHardeningOptions =

From 0df63c954347ba5f85be869b5957587cccc2b4e7 Mon Sep 17 00:00:00 2001
From: "Robert T. McGibbon" <rmcgibbo@gmail.com>
Date: Tue, 23 Mar 2021 18:49:02 -0400
Subject: [PATCH 17/20] python3Packages.loguru: unbreak (#117381)

---
 .../python-modules/loguru/default.nix         | 27 +++++++++++++++----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/loguru/default.nix b/pkgs/development/python-modules/loguru/default.nix
index 458d2ca50329..8146f8b183e1 100644
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@@ -1,19 +1,36 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27, colorama, pytestCheckHook }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, isPy27
+, colorama
+, pytestCheckHook
+, pythonAtLeast
+}:
 
 buildPythonPackage rec {
   pname = "loguru";
   version = "0.5.3";
 
-  disabled = isPy27;
+  # python3.9 compatibility should be in the next release after 0.5.3
+  disabled = isPy27 || pythonAtLeast "3.9";
   src = fetchPypi {
     inherit pname version;
     sha256 = "b28e72ac7a98be3d28ad28570299a393dfcd32e5e3f6a353dec94675767b6319";
   };
 
+  patches = [
+    # Fixes tests with pytest>=6.2.2. Will be part of the next release after 0.5.3
+    (fetchpatch {
+      url = "https://github.com/Delgan/loguru/commit/31cf758ee9d22dbfa125f38153782fe20ac9dce5.patch";
+      sha256 = "1lzbs8akg1s7s6xjl3samf4c4bpssqvwg5fn3mwlm4ysr7jd5y67";
+    })
+  ];
+
   checkInputs = [ pytestCheckHook colorama ];
 
-  pytestFlagsArray = lib.optionals stdenv.isDarwin [ "--ignore=tests/test_multiprocessing.py" ];
-
+  disabledTestPaths = lib.optionals stdenv.isDarwin [ "tests/test_multiprocessing.py" ];
   disabledTests = [ "test_time_rotation_reopening" "test_file_buffering" ]
     ++ lib.optionals stdenv.isDarwin [ "test_rotation_and_retention" "test_rotation_and_retention_timed_file" "test_renaming" "test_await_complete_inheritance" ];
 
@@ -21,6 +38,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/Delgan/loguru";
     description = "Python logging made (stupidly) simple";
     license = licenses.mit;
-    maintainers = with maintainers; [ jakewaksbaum ];
+    maintainers = with maintainers; [ jakewaksbaum rmcgibbo ];
   };
 }

From c33a8a2c2d4078224ccd2d7dd239625a8fda8924 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Tue, 23 Mar 2021 18:49:23 -0400
Subject: [PATCH 18/20] vimPlugins: update

---
 pkgs/misc/vim-plugins/generated.nix | 208 ++++++++++++++--------------
 1 file changed, 104 insertions(+), 104 deletions(-)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 98fafe4bb7f9..1abf5bb4f1ab 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -65,12 +65,12 @@ let
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "f7852dbd0a063d6d82ee17a5057fea53cb79b21d";
-      sha256 = "16cslwkc8kcr2z0crchl9w5p5vsbzfwpfa103wysyvq9d0q309xk";
+      rev = "eb0ebe622102cc6da3d7e943a3b739db7b6ed216";
+      sha256 = "10dp9xq8k0svr7z117a3bha4rvlgsx1j8qqdfnza94rbh8zy096k";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -389,12 +389,12 @@ let
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-03-22";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "8f7238502c742fe098e0d681c3597452aa053b89";
-      sha256 = "1cppnzf1slzxf3kb24pg18r2izdpd6mylrhc49rla083mr7hqx15";
+      rev = "18e39f1550980bc21761018e191742e66d86854d";
+      sha256 = "12grx41z5qf7p4ls56ww8rai0nfcl01v8iy1vayx463lb7dsvlxm";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -545,12 +545,12 @@ let
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc-nvim";
-    version = "2021-03-22";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "3b3c5f88bcb25c3d68351f417fa5e8425a3a3142";
-      sha256 = "1fkgyb0a5wirndk99d9ajdvxaiipgnv3r0cmvzldvy6ps5ljxabm";
+      rev = "e916ef84b95897a713773642bc768a88e4b8e449";
+      sha256 = "0svmsacpa6wvkdcdb4jb7lc7zdc31r9mqdvznskhgwzmjlhnbq8d";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -942,12 +942,12 @@ let
 
   denite-nvim = buildVimPluginFrom2Nix {
     pname = "denite-nvim";
-    version = "2021-03-18";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "denite.nvim";
-      rev = "8c44de41ec46c44f84dd70907a5763112df2eacb";
-      sha256 = "1y235ap3hchkf3hc85frcjl5kwr56lz3vw12qzhhzhrl2k7k5ziw";
+      rev = "b0cc470c63b0ed3b6497f659588b004ed05872ee";
+      sha256 = "15ngimlnprp73fy3sa9vz39avq75mcqhr90ygj3drjj1d33vk3f3";
     };
     meta.homepage = "https://github.com/Shougo/denite.nvim/";
   };
@@ -1370,8 +1370,8 @@ let
     src = fetchFromGitHub {
       owner = "fenetikm";
       repo = "falcon";
-      rev = "2ba0036e19adbefaf0beffe545e349964a68cc0a";
-      sha256 = "0pg3i1dvbjv746szki36yszz6bd82pgzvfyr3ayxf7lih4pjbxmj";
+      rev = "f6be01e8642dc8ccc7ed1f37b23f4b0dfa2c6f8c";
+      sha256 = "1w4ld5dvy0jxgjvp6yf8qibc4x82hn490vfg0hpln67nr6mhq1iw";
     };
     meta.homepage = "https://github.com/fenetikm/falcon/";
   };
@@ -1643,12 +1643,12 @@ let
 
   gitsigns-nvim = buildVimPluginFrom2Nix {
     pname = "gitsigns-nvim";
-    version = "2021-03-17";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "18d0a4bab12193460e6443d02d22218b5ce05a35";
-      sha256 = "0qizdphmady0baz5wgi92vdy9wbz1npgahsx0kmpx8c4vfvcdv10";
+      rev = "6bc3dba1a73466282215491d9ede85261199b7f2";
+      sha256 = "0qfpadjv4qd92kgjvwga285404wzzy0q4vylbdfwngf9s29bpj40";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -1811,12 +1811,12 @@ let
 
   hop-nvim = buildVimPluginFrom2Nix {
     pname = "hop-nvim";
-    version = "2021-03-18";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "phaazon";
       repo = "hop.nvim";
-      rev = "8d1a199236590a6e6667a45e0084d26aaeb32fb6";
-      sha256 = "1skya8iqkf9bblpdf1vvkl73i9rqm0lqd40114a8ppk8vbqjp53x";
+      rev = "4c6d776005eed4ebc66bf3af8a336d004ae238a3";
+      sha256 = "17dcvi3jlwzm11lykjz3dh2ckbbmdp221y0d7wl0xq12s2g1v4pg";
     };
     meta.homepage = "https://github.com/phaazon/hop.nvim/";
   };
@@ -2340,12 +2340,12 @@ let
 
   lualine-nvim = buildVimPluginFrom2Nix {
     pname = "lualine-nvim";
-    version = "2021-03-19";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "hoob3rt";
       repo = "lualine.nvim";
-      rev = "f80d5adb415812484c1b86692846feb3a8ce7e46";
-      sha256 = "0gp0nw173ryn6mn9z98jvrk9y7fyhm08r90qc1zv7z85lngd9226";
+      rev = "7bf5076ece80cde0a48dac403799a89c8caefd1d";
+      sha256 = "0zc1s75dqxb1dxma59mlc88lf74i0mpbz15khcfv1pfp5cr3hhih";
     };
     meta.homepage = "https://github.com/hoob3rt/lualine.nvim/";
   };
@@ -2412,12 +2412,12 @@ let
 
   minimap-vim = buildVimPluginFrom2Nix {
     pname = "minimap-vim";
-    version = "2021-03-20";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "wfxr";
       repo = "minimap.vim";
-      rev = "adc19481ceececc53b4a6e3157bae7ebf7b9bb66";
-      sha256 = "14hjfnqh9wvbhgf55arjhwbcsm1d91x9mhglz2qdmln6nr66ayz4";
+      rev = "31e22971ba5f5f3e5955fa8e2247b6cd22c3f7b1";
+      sha256 = "19hg4nnwdr6mj9wyrcapg91vm2bzvcsfbvjkirdsxp2v3ca83w2i";
     };
     meta.homepage = "https://github.com/wfxr/minimap.vim/";
   };
@@ -2724,12 +2724,12 @@ let
 
   neogit = buildVimPluginFrom2Nix {
     pname = "neogit";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "TimUntersberger";
       repo = "neogit";
-      rev = "0b969a8f6a7d38aed32ca7bddfeb19f80a2b1a29";
-      sha256 = "1x9q4kl5595dq7ydpv21apbff5pr15diyww8cd600ibjwybmlm8v";
+      rev = "537cc6e1757c41bd75717ebd4421c27b7ebe9205";
+      sha256 = "0s0z2qmsnqj5mgsqb6x4cwh507sc3y4ahqvzc3bijd224xff97b1";
     };
     meta.homepage = "https://github.com/TimUntersberger/neogit/";
   };
@@ -3036,12 +3036,12 @@ let
 
   nvim-compe = buildVimPluginFrom2Nix {
     pname = "nvim-compe";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "nvim-compe";
-      rev = "08dbc5f47d2be27cbc92c9684ec876b1eb778a4f";
-      sha256 = "09fnzidcmknkrmls3wmjfa6drp5i8hmcbfs3hrvvp8jywgfyrpr3";
+      rev = "777b98390da6638583b0e7ba2316aa1257462cad";
+      sha256 = "1ggh7038kzc61ihjbf8zvq1vxgjg9hpwqvjj979mf3qzrznrd89i";
     };
     meta.homepage = "https://github.com/hrsh7th/nvim-compe/";
   };
@@ -3060,12 +3060,12 @@ let
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2021-03-15";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "492849bf57425d005c4a13ee2a5d6f3c8207cc02";
-      sha256 = "1jspnzkb9371jfkppj77f95zccbnyw6gn0i4jlqpbci2p0ppp0gz";
+      rev = "f5180887cbf0505f64e43516072e74b74652a5f9";
+      sha256 = "1cy36pxj6kfggjds8bb13ggj91c4vq3b37i78pjyh8jynyfd0va7";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -3132,12 +3132,12 @@ let
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2021-03-20";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "c4199f88d5f6bf269b91ae5d775a082aef05f9bd";
-      sha256 = "18cnhhybhzw20l6v4rxzk5a5jcgv8l7jhbmzl529rd9jdhxqikfa";
+      rev = "fede58fdb67c451697bd1028bf084d4f0fbfc38b";
+      sha256 = "052rvsl0prhvbic350x1q5ma5c8km8sf3y92gng4sc2wj37fs2k8";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
@@ -3156,12 +3156,12 @@ let
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2021-03-20";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "00e9a7450eac88121768df21fde7d21f43de7529";
-      sha256 = "0qqr6zz4a1i13hmj4hvcx08m5ipy28iz3hlaa239jf5yx9rw0y1h";
+      rev = "487ea4a2393fd6d3fc1bf5d198e4f4583c5082ac";
+      sha256 = "1dr0my4y7qvy7d7ypkz4d0d1p223092vsn5wfpj4qv84k84ilpp8";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -3204,12 +3204,12 @@ let
 
   nvim-scrollview = buildVimPluginFrom2Nix {
     pname = "nvim-scrollview";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "693b93d273c4c0c0670d364cab9f3ab880d2f306";
-      sha256 = "04dsjc6f8ag0vfr4sa6nmpfqimx48cvadwv7dd3m9g2mwivkfgyi";
+      rev = "902f24503ab7a754be2a1c483de1cd3428bd85ec";
+      sha256 = "0b31lpzdx1z88fm60p7d5gs442h4apm2n9h098n4j0ghcs5ppvnf";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
@@ -3228,24 +3228,24 @@ let
 
   nvim-tree-lua = buildVimPluginFrom2Nix {
     pname = "nvim-tree-lua";
-    version = "2021-03-16";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "kyazdani42";
       repo = "nvim-tree.lua";
-      rev = "f7ad4ce5f4c93c91aca00f0d9f10316c98471798";
-      sha256 = "0l7ixschycw3lvg488bxgbbzsba59k0zkm8yrjdh63dp2nk2p2kj";
+      rev = "e0b9882a8a8ecce8b58076091217d3643f215da3";
+      sha256 = "1i8mqa45gg0lagcd4q5qwp97zlynkdw42ajw0wh8r92i5bs9crd8";
     };
     meta.homepage = "https://github.com/kyazdani42/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2021-03-22";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "600509aad6c3e38c45a0f67802ede5d2204e0250";
-      sha256 = "0j92ayfrlapgh09mz9rxfjzxag2kjmljd2qkbv54jl5dzr6p0f3q";
+      rev = "09045354c0245ca866104c526bc57c2a06d7f381";
+      sha256 = "182jvkwixmv1i39npvxkj0nr19cazqkab1kbprx7282dad68x30b";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -3288,24 +3288,24 @@ let
 
   nvim-ts-rainbow = buildVimPluginFrom2Nix {
     pname = "nvim-ts-rainbow";
-    version = "2021-03-22";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "p00f";
       repo = "nvim-ts-rainbow";
-      rev = "4c9043e117bfa5ea8e4d5b04b60b2e29c0548e14";
-      sha256 = "1ada87qkka1bsjdy52xqcnj5rmd9fl8q2v0km1pml3lcjyi0zdf5";
+      rev = "f61093c56a53c6790b142f76bdfaa476f497b93f";
+      sha256 = "1wzg1y0gksprdxhww0vcswfa0imkkrnhczljhlb94lrrmknv3nxv";
     };
     meta.homepage = "https://github.com/p00f/nvim-ts-rainbow/";
   };
 
   nvim-web-devicons = buildVimPluginFrom2Nix {
     pname = "nvim-web-devicons";
-    version = "2021-03-10";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "kyazdani42";
       repo = "nvim-web-devicons";
-      rev = "1fb0962b8c4a217eec8166b03d683aa070115ed7";
-      sha256 = "1rqswcjqrg6ckp7vyzqlncfabkggnhjvp3b0sq7y2g333z925sjm";
+      rev = "6e32d113d848c76ddbcc824038244657f170a97a";
+      sha256 = "02m8bsq7172sm9vkq3shh87xv4c3jxkgvhwhd3vv0na86kl9sqd6";
     };
     meta.homepage = "https://github.com/kyazdani42/nvim-web-devicons/";
   };
@@ -3420,12 +3420,12 @@ let
 
   packer-nvim = buildVimPluginFrom2Nix {
     pname = "packer-nvim";
-    version = "2021-03-15";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "wbthomason";
       repo = "packer.nvim";
-      rev = "6d7be3232ed0dcbbd040bf92ba70b997fe4fd840";
-      sha256 = "0k1ydkplqpizyqn56bdwhpsdib384ikv2lqfmk8j11r7p6m0xvir";
+      rev = "77cd1d1e0cfcb582b210d75745594f4fb60d3418";
+      sha256 = "0yhdxh6768z4dalpmzhhypnjfx3mjx7d6r722lv9g15xg7i1lg3q";
     };
     meta.homepage = "https://github.com/wbthomason/packer.nvim/";
   };
@@ -3504,12 +3504,12 @@ let
 
   playground = buildVimPluginFrom2Nix {
     pname = "playground";
-    version = "2021-02-17";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "playground";
-      rev = "444eab728ecaf337629a45a733535e94a3efc04a";
-      sha256 = "0r10fmk90wdc9hj3kdfkb93vvw1kdxwkl20f9zs3rfs5vs7p9i97";
+      rev = "d96cef521d22afd1a409449a890f20f50b436ee1";
+      sha256 = "1j1iqzi9q8fnl02hvazl8szg84iz8dqy0n52ngh1lvl78s9qa393";
     };
     meta.homepage = "https://github.com/nvim-treesitter/playground/";
   };
@@ -3985,12 +3985,12 @@ let
 
   sonokai = buildVimPluginFrom2Nix {
     pname = "sonokai";
-    version = "2021-02-28";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "sonokai";
-      rev = "86298232f4f5ab418d5d9d18a336d7ab8b167b68";
-      sha256 = "060k664gm4857nfmxaj0v6sz50mb3y9v8489jnv1bhqplzqf8gmy";
+      rev = "78f1b14ad18b043eb888a173f4c431dbf79462d8";
+      sha256 = "0spnpzr874ad9jpawcgydfm242wq55ychcky14f1qa09svsrdiv0";
     };
     meta.homepage = "https://github.com/sainnhe/sonokai/";
   };
@@ -4238,12 +4238,12 @@ let
 
   tagbar = buildVimPluginFrom2Nix {
     pname = "tagbar";
-    version = "2021-02-18";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "tagbar";
-      rev = "51ff7a05404e2f5c83799dd6c38134ed4aaca85c";
-      sha256 = "0i7qzn3vlvjjd5qvf230r7aaqz84rn30zkn643fdvpni7pxfywdv";
+      rev = "f6012cb65da4bda46b0779a36840df36ad01483e";
+      sha256 = "08vb3ffm1f47q5gxyqmmfv75x12001qpkqml7v612wnnfpclcqf5";
     };
     meta.homepage = "https://github.com/preservim/tagbar/";
   };
@@ -5248,12 +5248,12 @@ let
 
   vim-commentary = buildVimPluginFrom2Nix {
     pname = "vim-commentary";
-    version = "2019-11-18";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-commentary";
-      rev = "f8238d70f873969fb41bf6a6b07ca63a4c0b82b1";
-      sha256 = "09d81q9na7pvvrmxxqy09ffdzsx5v5dikinb704c9wm4ys2bidr9";
+      rev = "349340debb34f6302931f0eb7139b2c11dfdf427";
+      sha256 = "01lpfcn2hmvxddcf97f4qx5vksxj1hwrxb0c8ri59z9lb9z2hgjd";
     };
     meta.homepage = "https://github.com/tpope/vim-commentary/";
   };
@@ -5764,12 +5764,12 @@ let
 
   vim-floaterm = buildVimPluginFrom2Nix {
     pname = "vim-floaterm";
-    version = "2021-03-17";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "2d9107b1e1ceb3d4f118647f2cd5f9165172ccf9";
-      sha256 = "1ja58d2x8a5af7vhvbjp8x7l4bzbvndr2nd97p115q89l2zy6ayp";
+      rev = "a1403fd295edeffdc2e387f9308dc4392f057e68";
+      sha256 = "1dc1169lwz1wjgqp27g8wa37yqsvc4fgmrcprc3ys4r3s9m6y5m6";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
   };
@@ -5824,12 +5824,12 @@ let
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "58d2b25836f420cf2fe20cc0b6f988165ae33782";
-      sha256 = "0550dq20axl1qj6rasws2hsar7x4kjx9fspqzmkisv4wzrxr1kp5";
+      rev = "857496c32f02ebe74e821bdd2240aafc1455f8ea";
+      sha256 = "11kyccfmcm7jpvaidd84wdn5vypg9lcdpkpmy2hy7k23gg7hzpza";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -5944,12 +5944,12 @@ let
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2021-03-21";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "a60ff48be1d57991866320886569d012cdfb9e6f";
-      sha256 = "1w3cbvdl08vf7d9w4d3vaw3l4ccvzvgfkamk7qxanmcg2vd0k1rg";
+      rev = "00c5f2dad170131c0c850dbf331d63ddf515116d";
+      sha256 = "07ckmqxl25hzv10iarj6xdhg65q8450zriqc9wd6c2hlldj45ys3";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -6594,12 +6594,12 @@ let
 
   vim-lsc = buildVimPluginFrom2Nix {
     pname = "vim-lsc";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "natebosch";
       repo = "vim-lsc";
-      rev = "d2b394c0033014288daac317c32918bed469ff66";
-      sha256 = "0a8hd20v5q3bjq5pcs8p708f5jmh1y87aqa0f7ip4snldnf6gq2d";
+      rev = "2f0cbbfb8ea8997b408e447a2bc9554a3de33617";
+      sha256 = "1y3r5a5mcjf8dp0pkmhgnbay10hh48w1b3wd795wwbm6nx4izjjq";
     };
     meta.homepage = "https://github.com/natebosch/vim-lsc/";
   };
@@ -6919,12 +6919,12 @@ let
 
   vim-obsession = buildVimPluginFrom2Nix {
     pname = "vim-obsession";
-    version = "2020-01-19";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-obsession";
-      rev = "96a3f837c112cb64e0a9857b69f6d6a71041155e";
-      sha256 = "11h7jyg7fhjmq3pmpc93nrsxm175ra14407rs3558h8p04snc159";
+      rev = "82c9ac5e130c92a46e043dd9cd9e5b48d15e286d";
+      sha256 = "0lfcba8sk25l5yp3agh6pwniddf8jx627ikpr8i2z9ary2fqsj98";
     };
     meta.homepage = "https://github.com/tpope/vim-obsession/";
   };
@@ -7723,12 +7723,12 @@ let
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2021-03-15";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "a8ac81b8922ac621e7043813d98e69ad0ac265a4";
-      sha256 = "0gl77mnajzvmnxwnbzb5fqzzljb59lbfv23gzbz1h493gfm0f04n";
+      rev = "164bc3aa42feaa3c1deec84f7a10840418aec300";
+      sha256 = "0snzmjl4qiw6598a3ajc7v6l4q35wxf8b9lklk47pmfmalvril6w";
     };
     meta.homepage = "https://github.com/honza/vim-snippets/";
   };
@@ -7807,12 +7807,12 @@ let
 
   vim-startuptime = buildVimPluginFrom2Nix {
     pname = "vim-startuptime";
-    version = "2021-02-23";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "vim-startuptime";
-      rev = "af70d17a863c9a33def9cafbb3911195a571c686";
-      sha256 = "078xq6bwkbwsjajyq3c9bn8b3r0da6j70vp1ba934a6jjdv6vrj4";
+      rev = "cee157ee4f73ddacfe1a70bb833b96f7a47a10c2";
+      sha256 = "1y049vbjhsg80am0hxyrcq0d0p7qfyvb1z38nc7yd7bcgwsqc5ac";
     };
     meta.homepage = "https://github.com/dstein64/vim-startuptime/";
   };
@@ -8528,12 +8528,12 @@ let
 
   vimspector = buildVimPluginFrom2Nix {
     pname = "vimspector";
-    version = "2021-03-20";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "puremourning";
       repo = "vimspector";
-      rev = "35e5b3d56e193ee6129eabedcd48fd17b8293b2d";
-      sha256 = "0njs7bn3hzr44sn04lg44baia5khpxra0l1llshx42bkdidcj1s1";
+      rev = "054ea35428e5e8d6abe12b6a535a3b0426d4874e";
+      sha256 = "0cx35hbyhrzmbfzsikbpa4jh0gr3sbdhk27v2nsbwj4i3rg9767p";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/puremourning/vimspector/";
@@ -8541,12 +8541,12 @@ let
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2021-03-21";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "4b9e69dc5e817c3436843ee0cb431e59fa5705b0";
-      sha256 = "1s2h2bgd751jf7vj9dr1756g7gxdx3b7pwx49686273ibv1spnwf";
+      rev = "3109f140196716b3b3a430f06df35723d85f991d";
+      sha256 = "1n44sg35xm1jc70wpjgc5xjf8h6hrpa2f9jwq6x3dcrppj781naq";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -8722,12 +8722,12 @@ let
 
   YouCompleteMe = buildVimPluginFrom2Nix {
     pname = "YouCompleteMe";
-    version = "2021-03-20";
+    version = "2021-03-22";
     src = fetchFromGitHub {
       owner = "ycm-core";
       repo = "YouCompleteMe";
-      rev = "3352684bfb6a08be8e864a46b0773e459d4d201f";
-      sha256 = "03mqrprmiain4n9aw5388msq4smczw1avcls71rj0c7igzpdc4vw";
+      rev = "ed423e8a1d2a5842a126d33b824ad3b65f85f3ba";
+      sha256 = "19c238sdc6i3ky374v52g13csnbmdcm9d97iji6fmklmzsyrq4cr";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/ycm-core/YouCompleteMe/";
@@ -8771,12 +8771,12 @@ let
 
   zephyr-nvim = buildVimPluginFrom2Nix {
     pname = "zephyr-nvim";
-    version = "2021-03-18";
+    version = "2021-03-23";
     src = fetchFromGitHub {
       owner = "glepnir";
       repo = "zephyr-nvim";
-      rev = "05315a214fc0b4681e596cbcb40045d54564ff8c";
-      sha256 = "0bapbwyvvbvqd8ggcyns2y5iya44jvb0jxq14xh5qfnxiycrwrgi";
+      rev = "79e273ed8ff386a81e6a88ae888ec6d878a9dcbc";
+      sha256 = "00x0b2lwrfkmny6rhwjrb1kyp2lai597f6f62whhwgw7iq9j5b5k";
     };
     meta.homepage = "https://github.com/glepnir/zephyr-nvim/";
   };

From 1e2bd7cd6f8b4add0c8f5f1f557ae377ce2cb6e0 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Tue, 23 Mar 2021 18:49:51 -0400
Subject: [PATCH 19/20] vimPlugins.nvim-bufferline-lua: init at 2021-03-22

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 1abf5bb4f1ab..98c9363bd6f8 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -3022,6 +3022,18 @@ let
     meta.homepage = "https://github.com/kevinhwang91/nvim-bqf/";
   };
 
+  nvim-bufferline-lua = buildVimPluginFrom2Nix {
+    pname = "nvim-bufferline-lua";
+    version = "2021-03-22";
+    src = fetchFromGitHub {
+      owner = "akinsho";
+      repo = "nvim-bufferline.lua";
+      rev = "437aa7cacc8eb6b7840e298f55666f4a6dea20e7";
+      sha256 = "15df8l8mx9cbm5mirn511d965nlxh5gj17d0b6rffxjlzc5ciai3";
+    };
+    meta.homepage = "https://github.com/akinsho/nvim-bufferline.lua/";
+  };
+
   nvim-cm-racer = buildVimPluginFrom2Nix {
     pname = "nvim-cm-racer";
     version = "2017-07-27";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index b72aeb0d10fd..d794f02fbe84 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -3,6 +3,7 @@ aca/completion-tabnine
 ackyshake/Spacegray.vim@main
 airblade/vim-gitgutter
 airblade/vim-rooter
+akinsho/nvim-bufferline.lua
 aklt/plantuml-syntax
 altercation/vim-colors-solarized
 alvan/vim-closetag

From cce199a3e09b75256eca999e0371c4e4811dab49 Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Tue, 23 Mar 2021 13:50:25 +0800
Subject: [PATCH 20/20] plasma-workspace: fix path to qdbus

---
 pkgs/desktops/plasma-5/plasma-workspace/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/plasma-5/plasma-workspace/default.nix b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
index 69d7d508d50c..b65bc7df8ed8 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@@ -53,9 +53,10 @@ mkDerivation {
     ./0002-absolute-wallpaper-install-dir.patch
   ];
 
+  # QT_INSTALL_BINS refers to qtbase, and qdbus is in qttools
   postPatch = ''
-    substituteInPlace wallpapers/image/wallpaper.knsrc.cmake \
-      --replace '@QtBinariesDir@/qdbus' ${getBin qttools}/bin/qdbus
+    substituteInPlace CMakeLists.txt \
+      --replace 'query_qmake(QtBinariesDir QT_INSTALL_BINS)' 'set(QtBinariesDir "${lib.getBin qttools}/bin")'
   '';
 
   NIX_CFLAGS_COMPILE = [