Merge staging-next into staging

lib/customisation.nix

@@ -217,4 +217,31 @@ rec {
         };
     in self;
 
+  /* Like the above, but aims to support cross compilation. It's still ugly, but
+     hopefully it helps a little bit. */
+  makeScopeWithSplicing = splicePackages: newScope: otherSplices: keep: f:
+    let
+      spliced = splicePackages {
+        pkgsBuildBuild = otherSplices.selfBuildBuild;
+        pkgsBuildHost = otherSplices.selfBuildHost;
+        pkgsBuildTarget = otherSplices.selfBuildTarget;
+        pkgsHostHost = otherSplices.selfHostHost;
+        pkgsHostTarget = self; # Not `otherSplices.selfHostTarget`;
+        pkgsTargetTarget = otherSplices.selfTargetTarget;
+      } // keep self;
+      self = f self // {
+        newScope = scope: newScope (spliced // scope);
+        callPackage = newScope spliced; # == self.newScope {};
+        # N.B. the other stages of the package set spliced in are *not*
+        # overridden.
+        overrideScope = g: makeScopeWithSplicing
+          splicePackages
+          newScope
+          otherSplices
+          keep
+          (lib.fixedPoints.extends g f);
+        packages = f;
+      };
+    in self;
+
 }

lib/default.nix

@@ -101,7 +101,7 @@ let
       noDepEntry fullDepEntry packEntry stringAfter;
     inherit (self.customisation) overrideDerivation makeOverridable
       callPackageWith callPackagesWith extendDerivation hydraJob
-      makeScope;
+      makeScope makeScopeWithSplicing;
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
       hiPrioSet;

maintainers/maintainer-list.nix

@@ -3193,12 +3193,6 @@
     githubId = 313929;
     name = "Gabriel Ebner";
   };
-  genesis = {
-    email = "ronan@aimao.org";
-    github = "bignaux";
-    githubId = 149484;
-    name = "Ronan Bignaux";
-  };
   georgewhewell = {
     email = "georgerw@gmail.com";
     github = "georgewhewell";
@@ -6159,10 +6153,10 @@
     githubId = 6455574;
     name = "Matt Votava";
   };
-  mwilsoninsight = {
+  maxwilson = {
-    email = "max.wilson@insight.com";
+    email = "nixpkgs@maxwilson.dev";
-    github = "mwilsoninsight";
+    github = "mwilsoncoding";
-    githubId = 47782621;
+    githubId = 43796009;
     name = "Max Wilson";
   };
   myrl = {

maintainers/team-list.nix

@@ -108,4 +108,12 @@ with lib.maintainers; {
     ];
     scope = "Maintain Podman and CRI-O related packages and modules.";
   };
+
+  sage = {
+    members = [
+      timokau
+      omasanori
+    ];
+    scope = "Maintain SageMath and the dependencies that are likely to break it.";
+  };
 }

nixos/doc/manual/release-notes/rl-2103.xml

@@ -172,6 +172,12 @@
       please note that your non-root pools will now be forcibly imported.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     <package>openafs</package> now points to <package>openafs_1_8</package>,
+     which is the new stable release.  OpenAFS 1.6 was removed.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/services/monitoring/telegraf.nix

@@ -21,7 +21,7 @@ in {
       };
 
       environmentFiles = mkOption {
-        type = types.nullOr (types.listOf types.path);
+        type = types.listOf types.path;
         default = [];
         example = "/run/keys/telegraf.env";
         description = ''
@@ -38,17 +38,13 @@ in {
         description = "Extra configuration options for telegraf";
         type = settingsFormat.type;
         example = {
-          outputs = {
+          outputs.influxdb = {
-            influxdb = {
+            urls = ["http://localhost:8086"];
-              urls = ["http://localhost:8086"];
+            database = "telegraf";
-              database = "telegraf";
-            };
           };
-          inputs = {
+          inputs.statsd = {
-            statsd = {
+            service_address = ":8125";
-              service_address = ":8125";
+            delete_timings = true;
-              delete_timings = true;
-            };
           };
         };
       };

nixos/modules/services/network-filesystems/openafs/server.nix

@@ -251,7 +251,6 @@ in {
         wantedBy = [ "multi-user.target" ];
         restartIfChanged = false;
         unitConfig.ConditionPathExists = [
-          "|/etc/openafs/server/rxkad.keytab"
           "|/etc/openafs/server/KeyFileExt"
         ];
         preStart = ''

nixos/modules/tasks/filesystems/nfs.nix

@@ -10,20 +10,9 @@ let
 
   rpcMountpoint = "${nfsStateDir}/rpc_pipefs";
 
-  idmapdConfFile = pkgs.writeText "idmapd.conf" ''
+  format = pkgs.formats.ini {};
-    [General]
-    Pipefs-Directory = ${rpcMountpoint}
-    ${optionalString (config.networking.domain != null)
-      "Domain = ${config.networking.domain}"}
-
-    [Mapping]
-    Nobody-User = nobody
-    Nobody-Group = nogroup
-
-    [Translation]
-    Method = nsswitch
-  '';
 
+  idmapdConfFile = format.generate "idmapd.conf" cfg.idmapd.settings;
   nfsConfFile = pkgs.writeText "nfs.conf" cfg.extraConfig;
   requestKeyConfFile = pkgs.writeText "request-key.conf" ''
     create id_resolver * * ${pkgs.nfs-utils}/bin/nfsidmap -t 600 %k %d
@@ -38,6 +27,25 @@ in
 
   options = {
     services.nfs = {
+      idmapd.settings = mkOption {
+        type = format.type;
+        default = {};
+        description = ''
+          libnfsidmap configuration. Refer to
+          <link xlink:href="https://linux.die.net/man/5/idmapd.conf"/>
+          for details.
+        '';
+        example = literalExample ''
+          {
+            Translation = {
+              GSS-Methods = "static,nsswitch";
+            };
+            Static = {
+              "root/hostname.domain.com@REALM.COM" = "root";
+            };
+          }
+        '';
+      };
       extraConfig = mkOption {
         type = types.lines;
         default = "";
@@ -54,6 +62,20 @@ in
 
     services.rpcbind.enable = true;
 
+    services.nfs.idmapd.settings = {
+      General = mkMerge [
+        { Pipefs-Directory = rpcMountpoint; }
+        (mkIf (config.networking.domain != null) { Domain = config.networking.domain; })
+      ];
+      Mapping = {
+        Nobody-User = "nobody";
+        Nobody-Group = "nogroup";
+      };
+      Translation = {
+        Method = "nsswitch";
+      };
+    };
+
     system.fsPackages = [ pkgs.nfs-utils ];
 
     boot.initrd.kernelModules = mkIf inInitrd [ "nfs" ];

nixos/tests/all-tests.nix

@@ -103,6 +103,7 @@ in
   etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
   etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
+  fcitx = handleTest ./fcitx {};
   ferm = handleTest ./ferm.nix {};
   firefox = handleTest ./firefox.nix {};
   firefox-esr = handleTest ./firefox.nix { esr = true; };

nixos/tests/fcitx/config

@@ -0,0 +1,12 @@
+[Hotkey]
+SwitchKey=Disabled
+IMSwitchHotkey=ALT_SHIFT
+TimeInterval=240
+
+[Program]
+DelayStart=5
+
+[Output]
+
+[Appearance]
+

nixos/tests/fcitx/default.nix

@@ -0,0 +1,142 @@
+import ../make-test-python.nix ( 
+  {
+    pkgs, ...
+  }: 
+    # copy_from_host works only for store paths
+    rec {
+        name = "fcitx";
+        machine = 
+        { 
+          pkgs, 
+          ... 
+        }: 
+          {
+            virtualisation.memorySize = 1024;
+
+            imports = [
+              ../common/user-account.nix
+            ];
+
+            environment.systemPackages = [
+              # To avoid clashing with xfce4-terminal
+              pkgs.alacritty 
+            ];
+
+
+            services.xserver = 
+            {
+              enable = true;
+
+              displayManager = {
+                lightdm.enable = true;
+                autoLogin = {
+                  enable = true;
+                  user = "alice";
+                };
+              };
+
+              desktopManager.xfce.enable = true;
+            };
+              
+            i18n = {
+              inputMethod = {
+                enabled = "fcitx";
+                fcitx.engines = [
+                  pkgs.fcitx-engines.m17n
+                  pkgs.fcitx-engines.table-extra
+                ];
+              };
+            };
+          }
+        ;
+
+        testScript = { nodes, ... }: 
+        let 
+            user = nodes.machine.config.users.users.alice;
+            userName      = user.name;
+            userHome      = user.home;
+            xauth         = "${userHome}/.Xauthority";
+            fcitx_confdir = "${userHome}/.config/fcitx";
+        in 
+        ''
+            # We need config files before login session
+            # So copy first thing
+
+            # Point and click would be expensive,
+            # So configure using files
+            machine.copy_from_host(
+                "${./profile}",
+                "${fcitx_confdir}/profile",
+            )
+            machine.copy_from_host(
+                "${./config}",
+                "${fcitx_confdir}/config",
+            )
+
+            start_all()
+
+            machine.wait_for_file("${xauth}")
+            machine.succeed("xauth merge ${xauth}")
+
+            machine.sleep(5)
+
+            machine.succeed("su - ${userName} -c 'alacritty&'")
+            machine.succeed("su - ${userName} -c 'fcitx&'")
+            machine.sleep(10)
+
+            ### Type on terminal
+            machine.send_chars("echo ")
+            machine.sleep(1)
+
+            ### Start fcitx Unicode input
+            machine.send_key("ctrl-alt-shift-u")
+            machine.sleep(5)
+            machine.sleep(1)
+            
+            ### Search for smiling face
+            machine.send_chars("smil")
+            machine.sleep(1)
+
+            ### Navigate to the second one
+            machine.send_key("tab")
+            machine.sleep(1)
+
+            ### Choose it
+            machine.send_key("\n")
+            machine.sleep(1)
+
+            ### Start fcitx language input
+            machine.send_key("ctrl-spc")
+            machine.sleep(1)
+
+            ### Default zhengma, enter 一下
+            machine.send_chars("a2")
+            machine.sleep(1)
+
+            ### Switch to Harvard Kyoto
+            machine.send_key("alt-shift")
+            machine.sleep(1)
+
+            ### Enter क
+            machine.send_chars("ka ")
+            machine.sleep(1)
+
+            machine.send_key("alt-shift")
+            machine.sleep(1)
+
+            ### Turn off Fcitx
+            machine.send_key("ctrl-spc")
+            machine.sleep(1)
+
+            ### Redirect typed characters to a file
+            machine.send_chars(" > fcitx_test.out\n")
+            machine.sleep(1)
+            machine.screenshot("terminal_chars")
+
+            ### Verify that file contents are as expected
+            file_content = machine.succeed("cat ${userHome}/fcitx_test.out")
+            assert file_content == "☺一下क\n"
+            ''
+    ;
+  }
+)

nixos/tests/fcitx/profile

@@ -0,0 +1,4 @@
+[Profile]
+IMName=zhengma-large
+EnabledIMList=fcitx-keyboard-us:True,zhengma-large:True,m17n_sa_harvard-kyoto:True
+PreeditStringInClientWindow=False

nixos/tests/telegraf.nix

@@ -6,9 +6,9 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
   machine = { ... }: {
     services.telegraf.enable = true;
-    services.telegraf.environmentFiles = [pkgs.writeText "secrets" ''
+    services.telegraf.environmentFiles = [(pkgs.writeText "secrets" ''
       SECRET=example
-    ''];
+    '')];
     services.telegraf.extraConfig = {
       agent.interval = "1s";
       agent.flush_interval = "1s";

pkgs/applications/audio/cadence/default.nix

@@ -94,7 +94,7 @@ mkDerivation rec {
     homepage = "https://github.com/falkTX/Cadence/";
     description = "Collection of tools useful for audio production";
     license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [ genesis worldofpeace ];
+    maintainers = with stdenv.lib.maintainers; [ worldofpeace ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.15.0";
+  version = "2.16.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "06sm4ah05j0f3bxb1sbdi8mazmxk166y2gaycll6p2xhd105ins3";
+    sha256 = "16z2cy41vxbrvjblj09in6669pks1p9y3rgx8b7afjwf102ba9yi";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/editors/bluefish/default.nix

@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "bluefish-2.2.11";
+  name = "bluefish-2.2.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/bluefish/${name}.tar.bz2";
-    sha256 = "1zy2ppdg3nq9iy3zgfhnw93bq5zbbhyampf7bk3grpfvq5zqfk25";
+    sha256 = "0slyjx4b4l612505q02crk00pjg9d5wi8gm5gxvcs0f6l9dr1y8d";
   };
 
   nativeBuildInputs = [ intltool pkgconfig wrapGAppsHook ];

pkgs/applications/editors/texmacs/default.nix

@@ -1,4 +1,4 @@
-{ lib, mkDerivation, callPackage, fetchurl, fetchpatch,
+{ lib, mkDerivation, callPackage, fetchFromGitHub,
   guile_1_8, qtbase, xmodmap, which, freetype,
   libjpeg,
   sqlite,
@@ -16,7 +16,7 @@
 
 let
   pname = "TeXmacs";
-  version = "1.99.14";
+  version = "1.99.15";
   common = callPackage ./common.nix {
     inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
   };
@@ -24,9 +24,11 @@ in
 mkDerivation {
   name = "${pname}-${version}";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
+    owner = "texmacs";
-    sha256 = "1zbl1ddhppgnn3j213jl1b9mn8zmwnknxiqswm25p4llj0mqcgna";
+    repo = "texmacs";
+    rev = "v${version}";
+    sha256 = "04585hdh98fvyhj4wsxf69xal2wvfa6lg76gad8pr6ww9abi5105";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/gthumb/default.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gthumb";
-  version = "3.10.0";
+  version = "3.10.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0j7cxp4hhkvkckyvll6pmqkv5rwrknlzq9j1my0grb01b8wzhw9y";
+    sha256 = "0gm7q6n9lnjsdqpx5b0cqjayhzwnplqb6p5pshzhbfp2zqd2g9ss";
   };
 
   nativeBuildInputs = [

pkgs/applications/kde/kmahjongg.nix

@@ -14,6 +14,6 @@ mkDerivation {
   buildInputs = [ kdeclarative libkmahjongg knewstuff libkdegames ];
   meta = {
     license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ genesis ];
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/applications/kde/ksudoku.nix

@@ -13,6 +13,6 @@ mkDerivation {
   buildInputs = [ libGLU kdeclarative libkdegames ];
   meta = {
     license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ genesis ];
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/applications/kde/libkmahjongg.nix

@@ -9,7 +9,7 @@ mkDerivation {
   name = "libkmahjongg";
   meta = {
     license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ genesis ];
+    maintainers = with lib.maintainers; [ ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ kcompletion kconfig kconfigwidgets kcoreaddons ki18n

pkgs/applications/misc/cointop/default.nix

@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "cointop";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "miguelmota";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1gkrwh5g69mywlllszy310xpahr8rz8nghjjpiamd85djf1iz43b";
+    sha256 = "051jxa07c58ym1w0mwckwxh60v28gqcpqw5nv8sm5wxil1crcayr";
   };
 
   goPackagePath = "github.com/miguelmota/cointop";

pkgs/applications/misc/dasel/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.5.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "14xh5fjh0ngf8rmhqgfxmz25yz7far3sf8yza9iprs7y7ad61qz9";
+    sha256 = "sha256-LGrFs9JNb0gjXg6IRkUfUOWS+sr1nukzOEWK4XUfkfw=";
   };
 
   vendorSha256 = "1552k85z4s6gv7sss7dccv3h8x22j2sr12icp6s7s0a3i4iwyksw";

pkgs/applications/misc/navit/default.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.navit-project.org";
     description = "Car navigation system with routing engine using OSM maps";
     license = licenses.gpl2;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/pueue/default.nix

@@ -2,27 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.7.1";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ksks8c35q9aq5vnjxh480vqjyaa8c1fz1fb465vngnlyw762b22";
+    sha256 = "0rqnbils0r98qglhm2jafw5d119fqdzszmk825yc0bma4icm7xzp";
   };
 
-  cargoSha256 = "0v1h4jhrzfb55zmpnbq18188rdvx7a7lvnjqh0w7cy90kvxssian";
+  cargoSha256 = "1f3g5i0yh82qll1hyihrvv08pbd4h9vzs6jy6bf94bzabyjsgnzv";
 
   nativeBuildInputs = [ installShellFiles ];
 
-  checkFlagsArray = [ "--skip=test_single_huge_payload" ];
+  checkFlags = [ "--skip=test_single_huge_payload" "--skip=test_create_unix_socket" ];
 
   postInstall = ''
-    # zsh completion generation fails. See: https://github.com/Nukesor/pueue/issues/57
+    for shell in bash fish zsh; do
-    for shell in bash fish; do
       $out/bin/pueue completions $shell .
-      installShellCompletion pueue.$shell
     done
+    installShellCompletion pueue.{bash,fish} _pueue
   '';
 
   meta = with lib; {

pkgs/applications/misc/xkbd/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/mahatma-kaganovich/xkbd";
     description = "onscreen soft keyboard for X11";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/browsers/firefox/common.nix

@@ -4,7 +4,7 @@
 
 { lib, stdenv, pkgconfig, pango, perl, python2, python3, zip
 , libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
-, freetype, fontconfig, file, nspr, nss, libnotify
+, freetype, fontconfig, file, nspr, nss, nss_3_53, libnotify
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
 , hunspell, libXdamage, libevent, libstartup_notification
 , libvpx_1_8
@@ -106,6 +106,8 @@ let
   # 78 ESR won't build with rustc 1.47
   inherit (if lib.versionAtLeast ffversion "82" then rustPackages else rustPackages_1_45)
     rustc cargo;
+
+  nss_pkg = if lib.versionOlder ffversion "83" then nss_3_53 else nss;
 in
 
 buildStdenv.mkDerivation ({
@@ -116,12 +118,37 @@ buildStdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
-  ] ++ lib.optional pipewireSupport
+  ] ++
+
+  # there are two flavors of pipewire support
+  # The patches for the ESR release and the patches for the current stable
+  # release.
+  # Until firefox upstream stabilizes pipewire support we will have to continue
+  # tracking multiple versions here.
+  lib.optional (pipewireSupport && lib.versionOlder ffversion "83")
     (fetchpatch {
       # https://src.fedoraproject.org/rpms/firefox/blob/master/f/firefox-pipewire-0-3.patch
       url = "https://src.fedoraproject.org/rpms/firefox/raw/e99b683a352cf5b2c9ff198756859bae408b5d9d/f/firefox-pipewire-0-3.patch";
       sha256 = "0qc62di5823r7ly2lxkclzj9rhg2z7ms81igz44nv0fzv3dszdab";
     })
+    ++
+    # This picks pipewire patches from fedora that are part of https://bugzilla.mozilla.org/show_bug.cgi?id=1672944
+    lib.optionals (pipewireSupport && lib.versionAtLeast ffversion "83") (let
+      fedora_revision = "d6756537dd8cf4d9816dc63ada66ea026e0fd128";
+      mkPWPatch = spec: fetchpatch {
+        inherit (spec) name sha256;
+        url = "https://src.fedoraproject.org/rpms/firefox/raw/${fedora_revision}/f/${spec.name}";
+      };
+    in map mkPWPatch [
+        { name = "pw1.patch"; sha256 = "1a7zvngn3k7dg886zmi38kmrsdzh2rrr46aw59bhr1gfmq8wlwn0"; }
+        { name = "pw2.patch"; sha256 = "17irg3yb2mchcy0z0nr4k65mwvkps467cvvczr10fnm06lhkhw1l"; }
+        { name = "pw3.patch"; sha256 = "12p6ql5ff2lfzlni6xkpz63h2xr6n2a9zf8hhjl99fj56rif6706"; }
+        { name = "pw4.patch"; sha256 = "0rvysc92rdm98s47w5lvbnrklrf7d299k3918qnldniyb4b9p4mg"; }
+        { name = "pw5.patch"; sha256 = "0kk2yxq4qkfwc4px6m08jrn18a7a7dhrngfiaw84r9ga6sgn0z00"; }
+        { name = "pw6.patch"; sha256 = "12lhx9wjpw0ahbfmw07wsx76bb223mr453q9cg8cq951vyskch3s"; }
+        { name = "pw7.patch"; sha256 = "0afw7cfd48vn62zb9y5kd2l26fg44s3aq1kyg3gm4q3rj34xidf6"; }
+    ])
+
   ++ patches;
 
 
@@ -144,7 +171,7 @@ buildStdenv.mkDerivation ({
     # yasm can potentially be removed in future versions
     # https://bugzilla.mozilla.org/show_bug.cgi?id=1501796
     # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
-    nspr nss
+    nspr nss_pkg
   ]
   ++ lib.optional  alsaSupport alsaLib
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
@@ -165,14 +192,14 @@ buildStdenv.mkDerivation ({
 
   NIX_CFLAGS_COMPILE = toString [
     "-I${glib.dev}/include/gio-unix-2.0"
-    "-I${nss.dev}/include/nss"
+    "-I${nss_pkg.dev}/include/nss"
   ];
 
   MACH_USE_SYSTEM_PYTHON = "1";
 
   postPatch = ''
     rm -rf obj-x86_64-pc-linux-gnu
-  '' + lib.optionalString pipewireSupport ''
+  '' + lib.optionalString (pipewireSupport && lib.versionOlder ffversion "83") ''
     # substitute the /usr/include/ lines for the libraries that pipewire provides.
     # The patch we pick from fedora only contains the generated moz.build files
     # which hardcode the dependency paths instead of running pkg_config.

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "82.0.3";
+    ffversion = "83.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0j5s5fkph9bm87lv53d4xvfj02qjfqzj5graxcc8air49iqswfmqjdzghna6bj9m8fbn6f5klgm6jbrmavdsycbps0y88x23b6kab5i";
+      sha512 = "3va5a9471677jfzkhqp8xkba45n0bcpphbabhqbcbnps6p85m3y98pl5jy9q7cpq3a6gxc4ax7bp90yz2nfvfq7i64iz397xpprri2a";
     };
 
     patches = [
@@ -35,10 +35,10 @@ rec {
 
   firefox-esr-78 = common rec {
     pname = "firefox-esr";
-    ffversion = "78.4.1esr";
+    ffversion = "78.5.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "3gfhipbihyznnh822lxams6rm0bcslh31b58lzibjx8a9dn99hy3p04h07slygcqazbz1rrs7b2b8q321fknp27aisk0sz8cynrcw18";
+      sha512 = "20h53cn7p4dds1yfm166iwbjdmw4fkv5pfk4z0pni6x8ddjvg19imzs6ggmpnfhaji8mnlknm7xp5j7x9vi24awvdxdds5n88rh25hd";
     };
 
     patches = [

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,9 +11,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.14.2";
+  version = "1.15.0";
 
-  vendorSha256 = "057mlmja3mygfdf0cp0bcm0chq7s30bjcs5hqacwl6c79ivrjf89";
+  vendorSha256 = "1xkk4f8qjqx5x878iniclni3jm2f7ka47va756vc3vk8p5s6vpdk";
 
   doCheck = false;
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "1fidvfm9x3rbqfjn9zm5kx9smk94dmjm4gb98rrdmgsld5fg99xj";
+    sha256 = "1n1jhsa0lrfpqvl7m5il37l3f22ffgg4zv8g42xq24cgna951a1z";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];

pkgs/applications/networking/cluster/terraform-providers/lxd/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terraform-provider-lxd";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "sl1pm4t";
     repo = "terraform-provider-lxd";
     rev = "v${version}";
-    sha256 = "1k54021178zybh9dqly2ly8ji9x5rka8dn9xd6rv7gkcl5w3y6fv";
+    sha256 = "00gj7zj45wm9sf7a7nybjijdrdr00g2yf8h41c6j679a6nfnx0fd";
   };
 
-  vendorSha256 = "1shdpl1zsbbpc3mfs0l65ykq2h15ggvqylaixcap4j4lfl7m9my0";
+  vendorSha256 = "0xq8zgx8h47pc88nkdvy5skpr8vk87b4212mm5msfxk8n7nl4fi2";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, terraform }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper }:
 
 buildGoModule rec {
   pname = "terragrunt";
@@ -19,11 +19,6 @@ buildGoModule rec {
 
   buildFlagsArray = [ "-ldflags=" "-X main.VERSION=v${version}" ];
 
-  postInstall = ''
-    wrapProgram $out/bin/terragrunt \
-      --set TERRAGRUNT_TFPATH ${lib.getBin terraform.full}/bin/terraform
-  '';
-
   meta = with lib; {
     description = "A thin wrapper for Terraform that supports locking for Terraform state and enforces best practices";
     homepage = "https://github.com/gruntwork-io/terragrunt/";

pkgs/applications/networking/gns3/server.nix

@@ -35,7 +35,9 @@ in python.pkgs.buildPythonPackage {
 
   postPatch = ''
     # yarl 1.4+ only requires Python 3.6+
-    sed -iE "s/yarl==1.3.0//" requirements.txt
+    substituteInPlace requirements.txt \
+      --replace "aiohttp==3.6.2" "aiohttp>=3.6.2" \
+      --replace "yarl==1.3.0" ""
   '';
 
   propagatedBuildInputs = with python.pkgs; [

pkgs/applications/networking/irc/convos/default.nix

@@ -6,13 +6,13 @@ with stdenv.lib;
 
 perlPackages.buildPerlPackage rec {
   pname = "convos";
-  version = "4.40";
+  version = "5.00";
 
   src = fetchFromGitHub {
     owner = "Nordaaker";
     repo = pname;
     rev = version;
-    sha256 = "0yyykr86d494xq1ga5ncr6jmdf0ny1r4gm0wzwn49bxn2x1l0xck";
+    sha256 = "0mdbh9q1vclwgnjwvb3z637s7v804h65zxazbhmd7qi3zislnhg1";
   };
 
   nativeBuildInputs = [ makeWrapper ]

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -32,7 +32,7 @@
 , nasm
 , nodejs
 , nspr
-, nss
+, nss_3_53
 , pango
 , perl
 , pkgconfig
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
     libvpx
     libwebp
     nspr
-    nss
+    nss_3_53
     pango
     perl
     sqlite
@@ -142,7 +142,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE =[
     "-I${glib.dev}/include/gio-unix-2.0"
-    "-I${nss.dev}/include/nss"
+    "-I${nss_3_53.dev}/include/nss"
   ];
 
   patches = [

pkgs/applications/networking/p2p/soulseekqt/default.nix

@@ -23,7 +23,7 @@ mkDerivation rec {
 
   dontBuild = true;
   dontConfigure = true;
-  
+
   nativeBuildInputs = [ imagemagick autoPatchelfHook desktop-file-utils ];
   buildInputs = [ qtmultimedia stdenv.cc.cc ];
 
@@ -53,7 +53,7 @@ mkDerivation rec {
     description = "Official Qt SoulSeek client";
     homepage = "https://www.slsknet.org";
     license = licenses.unfree;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/networking/ps2client/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   patchPhase = ''
    sed -i -e "s|-I/usr/include||g" -e "s|-I/usr/local/include||g" Makefile
   '';
-  
+
   installPhase = ''
     make PREFIX=$out install
   '';
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     description = "Desktop clients to interact with ps2link and ps2netfs";
     homepage = "https://github.com/ps2dev/ps2client";
     license = licenses.bsd3;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/office/jabref/default.nix

@@ -1,14 +1,17 @@
-{ stdenv, fetchurl, makeWrapper, makeDesktopItem, jdk, jre, wrapGAppsHook, gtk3, gsettings-desktop-schemas }:
+{ stdenv, fetchurl, makeWrapper, makeDesktopItem, wrapGAppsHook, gtk3, gsettings-desktop-schemas
+, zlib , libX11, libXext, libXi, libXrender, libXtst, libGL, alsaLib, libav, cairo, freetype, pango, gdk-pixbuf, glib }:
 
 stdenv.mkDerivation rec {
-  version = "3.8.1";
+  version = "5.1";
   pname = "jabref";
 
   src = fetchurl {
-    url = "https://github.com/JabRef/jabref/releases/download/v${version}/JabRef-${version}.jar";
+    url = "https://github.com/JabRef/jabref/releases/download/v${version}/JabRef-${version}-portable_linux.tar.gz";
-    sha256 = "11asfym74zdq46i217z5n6vc79gylcx8xn7nvwacfqmym0bz79cg";
+    sha256 = "04f612byrq3agzy26byg1sgrjyhcpa8xfj0ssh8dl8d8vnhx9742";
   };
 
+  preferLocalBuild = true;
+
   desktopItem = makeDesktopItem {
     comment =  meta.description;
     name = "jabref";
@@ -19,21 +22,44 @@ stdenv.mkDerivation rec {
     exec = "jabref";
   };
 
-  buildInputs = [ makeWrapper jdk wrapGAppsHook gtk3 gsettings-desktop-schemas ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  buildInputs = [ gsettings-desktop-schemas ] ++ systemLibs;
 
-  dontUnpack = true;
+  systemLibs = [ gtk3 zlib libX11 libXext libXi libXrender libXtst libGL alsaLib libav cairo freetype pango gdk-pixbuf glib ];
+  systemLibPaths = stdenv.lib.makeLibraryPath systemLibs;
 
   installPhase = ''
-    mkdir -p $out/bin $out/share/java $out/share/icons
+    mkdir -p $out/share/java $out/share/icons
+
+    cp -r lib $out/lib
+
+    for f in $out/lib/runtime/bin/j*; do
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${ stdenv.lib.makeLibraryPath [ zlib ]}:$out/lib/runtime/lib:$out/lib/runtime/lib/server" $f
+    done
+
+    for f in $out/lib/runtime/lib/*.so; do
+      patchelf \
+        --set-rpath "${systemLibPaths}:$out/lib/runtime/lib:$out/lib/runtime/lib/server" $f
+    done
+
+    # patching the libs in the JImage runtime image is quite impossible as there is no documented way
+    # of rebuilding the image after it has been extracted
+    # the image format itself is "intendedly not documented" - maybe one of the reasons the
+    # devolpers constantly broke "jimage recreate" and dropped it in OpenJDK 9 Build 116 Early Access
+    # so, for now just copy the image and provide our lib paths through the wrapper
+
+    makeWrapper $out/lib/runtime/bin/java $out/bin/jabref \
+      --add-flags '-Djava.library.path=${systemLibPaths}' --add-flags "-p $out/lib/app -m org.jabref/org.jabref.JabRefLauncher" \
+      --run 'export LD_LIBRARY_PATH=${systemLibPaths}:$LD_LIBRARY_PATH'
 
     cp -r ${desktopItem}/share/applications $out/share/
 
-    jar xf $src images/icons/JabRef-icon-mac.svg
+    # we still need to unpack the runtime image to get the icon
-    cp images/icons/JabRef-icon-mac.svg $out/share/icons/jabref.svg
+    mkdir unpacked
-
+    $out/lib/runtime/bin/jimage extract --dir=./unpacked lib/runtime/lib/modules
-    ln -s $src $out/share/java/jabref-${version}.jar
+    cp unpacked/org.jabref/icons/jabref.svg $out/share/icons/jabref.svg
-    makeWrapper ${jre}/bin/java $out/bin/jabref \
-      --add-flags "-jar $out/share/java/jabref-${version}.jar"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/radio/fldigi/default.nix

@@ -2,12 +2,12 @@
   libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.15";
+  version = "4.1.16";
   pname = "fldigi";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1fzbcv2dgg6byb2l8m2d6i69yn0a44pq52mpmms756jdf6z622i6";
+    sha256 = "1dfkvhs0ri5kbyskk730ik8ix5z138qys26b31p6kixd8jjkw3k4";
   };
 
   buildInputs = [ libXinerama gettext hamlib fltk14 libjpeg libpng portaudio

pkgs/applications/science/astronomy/astrolabe-generator/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.astrolabeproject.com";
     description = "A Java-based tool for generating EPS files for constructing astrolabes and related tools";
     license = licenses.gpl3;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.all;
   };
 }

pkgs/applications/science/chemistry/jmol/default.nix

@@ -48,6 +48,6 @@ stdenv.mkDerivation rec {
      homepage = "https://sourceforge.net/projects/jmol";
      license = licenses.lgpl2;
      platforms = platforms.all;
-     maintainers = with maintainers; [ timokau mounium ];
+     maintainers = with maintainers; [ mounium ] ++ teams.sage.members;
   };
 }

pkgs/applications/science/chemistry/marvin/default.nix

@@ -4,12 +4,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "20.19.0";
+  version = "20.20.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "0b9a0yl3mxfb2dfdkgs2wphhxsgwixqk6nl2hsn1ly3gz53cws1q";
+    sha256 = "1a8b0drb0c95c8arm3aa0z0sbdm9ilj4h1g90i0qyn4g2wk2xsal";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];

pkgs/applications/science/math/R/default.nix

@@ -113,6 +113,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     hydraPlatforms = platforms.linux;
 
-    maintainers = with maintainers; [ peti timokau ];
+    maintainers = with maintainers; [ peti ] ++ teams.sage.members;
   };
 }

pkgs/applications/science/math/lrcalc/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "Littlewood-Richardson calculator";
     homepage = "http://math.rutgers.edu/~asbuch/lrcalc/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/applications/science/math/nauty/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     inherit version;
     description = ''Programs for computing automorphism groups of graphs and digraphs'';
     license = licenses.asl20;
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
     # I'm not sure if the filename will remain the same for future changelog or
     # if it will track changes to minor releases. Lets see. Better than nothing

pkgs/applications/science/math/palp/default.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     # version was released that pointed to gplv2 however, so thats probably
     # the right license.
     license = licenses.gpl2;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/applications/science/math/pari/default.nix

@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     homepage = "http://pari.math.u-bordeaux.fr";
     downloadPage = "http://pari.math.u-bordeaux.fr/download.html";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ertes raskin AndersonTorres timokau ];
+    maintainers = with maintainers; [ ertes AndersonTorres ] ++ teams.sage.members;
     platforms = platforms.linux ++ platforms.darwin;
     updateWalker = true;
   };

pkgs/applications/science/math/pynac/default.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     '';
     homepage    = "http://pynac.org";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms   = platforms.unix;
   };
 }

pkgs/applications/science/math/sage/flask-oldsessions.nix

@@ -30,7 +30,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Provides a session class that works like the one in Flask before 0.10.";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     homepage = "https://github.com/mitsuhiko/flask-oldsessions";
   };
 }

pkgs/applications/science/math/sage/flask-openid.nix

@@ -22,7 +22,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Adds openid support to flask applications";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     homepage = "https://pythonhosted.org/Flask-OpenID/";
   };
 }

pkgs/applications/science/math/sage/pybrial.nix

@@ -20,6 +20,6 @@ buildPythonPackage rec {
     meta = with stdenv.lib; {
       description = "python implementation of BRiAl";
       license = licenses.gpl2;
-      maintainers = with maintainers; [ timokau ];
+      maintainers = teams.sage.members;
     };
 }

pkgs/applications/science/math/sage/python-openid.nix

@@ -34,7 +34,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "OpenID library for Python";
     license = licenses.asl20;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     homepage = "https://github.com/openid/python-openid/";
   };
 }

pkgs/applications/science/math/sage/sage.nix

@@ -63,6 +63,6 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Open Source Mathematics Software, free alternative to Magma, Maple, Mathematica, and Matlab";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/applications/science/math/sage/sagenb.nix

@@ -46,7 +46,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Sage Notebook";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 
   # let sagenb use mathjax

pkgs/applications/science/math/singular/default.nix

@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A CAS for polynomial computations";
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     # 32 bit x86 fails with some link error: `undefined reference to `__divmoddi4@GCC_7.0.0'`
     platforms = subtractLists platforms.i686 platforms.unix;
     license = licenses.gpl3; # Or GPLv2 at your option - but not GPLv4

pkgs/applications/science/math/symmetrica/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = ''A collection of routines for representation theory and combinatorics'';
     license = licenses.isc;
-    maintainers = with maintainers; [raskin timokau];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
     homepage = "https://gitlab.com/sagemath/symmetrica";
   };

pkgs/applications/terminal-emulators/mlterm/default.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mlterm";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/mlterm/01release/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "17h6j4nmbyvsx2shm8mqm7smzq9i7mbqxjw19c2m0rhf5yzqhr3k";
+    sha256 = "03fnynwv7d1aicwk2rp31sgncv5m65agvygqvsgn59v9di40gnnb";
   };
 
   nativeBuildInputs = [ pkgconfig autoconf wrapGAppsHook ];

pkgs/applications/version-management/gitkraken/default.nix

@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gitkraken";
-  version = "7.3.2";
+  version = "7.4.0";
 
   src = fetchzip {
     url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0bw75m87qbnnn1gjphik3xcjx2zwczsa37rpr16la1zjhqjl5m7j";
+    sha256 = "0ih0jxdm74vr4dgslhnl3llvi31zin0g2xjw6a4pdji2y2kajkzk";
   };
 
   dontBuild = true;

pkgs/data/documentation/man-pages/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-pages";
-  version = "5.08";
+  version = "5.09";
 
   src = fetchurl {
     url = "mirror://kernel/linux/docs/man-pages/${pname}-${version}.tar.xz";
-    sha256 = "1xzp3f6wvw3wplk1a1x09zfv0jp0pdc9wh95czndh3h8z0qwv9yf";
+    sha256 = "1whbxim4diyan97y9pz9k4ck16rmjalw5i1m0dg6ycv3pxv386nz";
   };
 
   makeFlags = [ "MANDIR=$(out)/share/man" ];

pkgs/data/misc/cacert/default.nix

@@ -13,12 +13,17 @@ let
     sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
   };
 
+  version = "3.57";
+  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 in
 
 stdenv.mkDerivation {
-  name = "nss-cacert-${nss.version}";
+  name = "nss-cacert-${version}";
 
-  src = nss.src;
+  src = fetchurl {
+    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
+    sha256 = "55a86c01be860381d64bb4e5b94eb198df9b0f098a8af0e58c014df398bdc382";
+  };
 
   outputs = [ "out" "unbundled" ];
 
@@ -60,6 +65,8 @@ stdenv.mkDerivation {
 
   setupHook = ./setup-hook.sh;
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     homepage = "https://curl.haxx.se/docs/caextract.html";
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";

pkgs/data/misc/cacert/update.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix common-updater-scripts jq
+
+# Build both the cacert package and an overriden version where we use the source attribute of NSS.
+# Cacert and NSS are both from the same upstream sources. They are decoupled as
+# the cacert output only cares about a few infrequently changing files in the
+# sources while the NSS source code changes frequently.
+#
+# By having cacert on a older source revision that produces the same
+# certificate output as a newer version we can avoid large amounts of
+# unnecessary rebuilds.
+#
+# As of this writing there are a few magnitudes more packages depending on
+# cacert than on nss.
+
+
+set -ex
+
+BASEDIR="$(dirname "$0")/../../../.."
+
+
+CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
+PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs (_: { inherit (nss) src version; })).out")
+
+# Check the hash of the etc subfolder
+# We can't check the entire output as that contains the nix-support folder
+# which contains the output path itself.
+CURRENT_HASH=$(nix-hash "$CURRENT_PATH/etc")
+PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
+
+if [[ "$CURRENT_HASH" !=  "$PATCHED_HASH" ]]; then
+    NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss.version" | jq -r .)
+    update-source-version cacert "$NSS_VERSION"
+fi

pkgs/data/misc/combinatorial_designs/default.nix

@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.publicDomain;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/conway_polynomials/default.nix

@@ -38,6 +38,6 @@ stdenv.mkDerivation rec {
     description = "Contains a small database of Conway polynomials";
     license = licenses.gpl2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/elliptic_curves/default.nix

@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/fedora-backgrounds/default.nix

@@ -0,0 +1,23 @@
+{ callPackage, lib, fetchurl }:
+
+let
+  fedoraBackground = callPackage ./generic.nix { };
+in {
+  f32 = fedoraBackground rec {
+    version = "32.2.2";
+    src = fetchurl {
+      url = "https://github.com/fedoradesign/backgrounds/releases/download/v${version}/f${lib.versions.major version}-backgrounds-${version}.tar.xz";
+      hash = "sha256-1F75aae7Jj7M2IPn/vWKcUF+O5mZ0Yey7hWuFj/4Fhg=";
+    };
+  };
+
+  f33 = fedoraBackground rec {
+    version = "33.0.7";
+    src = fetchurl {
+      url = "https://github.com/fedoradesign/backgrounds/releases/download/v${version}/f${lib.versions.major version}-backgrounds-${version}.tar.xz";
+      hash = "sha256-lAn5diEYebCo2ZJCOn9rD87rOasUU0qnSOr0EnZKW4o=";
+    };
+    # Fix broken symlinks in the Xfce background directory.
+    patches = [ ./f33-fix-xfce-path.patch ];
+  };
+}

pkgs/data/misc/fedora-backgrounds/f33-fix-xfce-path.patch

@@ -0,0 +1,15 @@
+diff --git a/default/Makefile b/default/Makefile
+index ec8095a..9391f8f 100644
+--- a/default/Makefile
++++ b/default/Makefile
+@@ -48,8 +48,8 @@ install:
+ 	
+ 	#~ XFCE background
+ 	$(MKDIR) $(XFCE_BG_DIR)
+-	$(LN_S) ../default/$(WP_NAME)-02-day.png \
++	$(LN_S) ../../backgrounds/$(WP_NAME)/default/$(WP_NAME)-02-day.png \
+ 			$(XFCE_BG_DIR)/$(WP_NAME).png
+ 	for tod in 01-dawn 03-dusk 04-night; do \
+-	   $(LN_S) ../default/$(WP_NAME)-$${tod}.png $(XFCE_BG_DIR)/$(WP_NAME)-$${tod}.png; \
++	   $(LN_S) ../../backgrounds/$(WP_NAME)/default/$(WP_NAME)-$${tod}.png $(XFCE_BG_DIR)/$(WP_NAME)-$${tod}.png; \
+ 	done;

pkgs/data/misc/fedora-backgrounds/generic.nix

@@ -0,0 +1,42 @@
+{ stdenv
+, coreutils
+}:
+
+{ version
+, src
+, patches ? [ ]
+}:
+
+stdenv.mkDerivation {
+  inherit patches src version;
+
+  pname = "fedora${stdenv.lib.versions.major version}-backgrounds";
+
+  dontBuild = true;
+
+  postPatch = ''
+    for f in default/Makefile extras/Makefile; do
+      substituteInPlace $f \
+        --replace "usr/share" "share" \
+        --replace "/usr/bin/" "" \
+        --replace "/bin/" ""
+    done
+
+    for f in $(find . -name '*.xml'); do
+      substituteInPlace $f \
+        --replace "/usr/share" "$out/share"
+    done;
+  '';
+
+  installFlags = [
+    "DESTDIR=$(out)"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/fedoradesign/backgrounds";
+    description = "A set of default and supplemental wallpapers for Fedora";
+    license = licenses.cc-by-sa-40;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ danieldk ];
+  };
+}

pkgs/data/misc/graphs/default.nix

@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     description = "A database of graphs";
     license = licenses.gpl2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/pari-galdata/default.nix

@@ -21,6 +21,6 @@ stdenv.mkDerivation {
     homepage = "http://pari.math.u-bordeaux.fr/";
     license = licenses.gpl2Plus;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/pari-seadata-small/default.nix

@@ -21,6 +21,6 @@ stdenv.mkDerivation {
     homepage = "http://pari.math.u-bordeaux.fr/";
     license = licenses.gpl2Plus;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/data/misc/polytopes_db/default.nix

@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     description = "Reflexive polytopes database";
     license = licenses.gpl2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
   };
 }

pkgs/desktops/gnome-3/misc/pomodoro/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-pomodoro";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "codito";
     repo = "gnome-pomodoro";
     rev = version;
-    sha256 = "0s9wzx7wbynpqgj7nlgs5wwx4w2akz7nli89sy7pxcn4xpnahqgn";
+    sha256 = "0990m8ydryd77kv25nfqli1n209i0h5dkjg9gkyww8bfrjhw47mc";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/julia/1.3.nix

@@ -72,13 +72,15 @@ stdenv.mkDerivation rec {
   makeFlags =
     let
       arch = head (splitString "-" stdenv.system);
-      march = { x86_64 = stdenv.hostPlatform.platform.gcc.arch or "x86-64"; i686 = "pentium4"; }.${arch}
+      march = {
+        x86_64 = stdenv.hostPlatform.platform.gcc.arch or "x86-64";
+        i686 = "pentium4";
+        aarch64 = "armv8-a";
+      }.${arch}
               or (throw "unsupported architecture: ${arch}");
       # Julia requires Pentium 4 (SSE2) or better
-      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; }.${arch}
+      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; aarch64 = "generic"; }.${arch}
                   or (throw "unsupported architecture: ${arch}");
-      # Julia applies a lot of patches to its dependencies, so for now do not use the system LLVM
-      # https://github.com/JuliaLang/julia/tree/master/deps/patches
     in [
       "ARCH=${arch}"
       "MARCH=${march}"
@@ -119,7 +121,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = !stdenv.isDarwin;
+  # Other versions of Julia pass the tests, but we are not sure why these fail.
+  doCheck = false;
   checkTarget = "testall";
   # Julia's tests require read/write access to $HOME
   preCheck = ''

pkgs/development/compilers/rasm/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     description = "Z80 assembler";
     # use -n option to display all licenses
     license = licenses.mit; # expat version
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/development/compilers/z88dk/default.nix

@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     homepage    = "https://www.z88dk.org";
     description = "z80 Development Kit";
     license     = licenses.clArtistic;
-    maintainers = [ maintainers.genesis ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/development/interpreters/clojure/default.nix

@@ -14,22 +14,28 @@ stdenv.mkDerivation rec {
     makeWrapper
   ];
 
+  # See https://github.com/clojure/brew-install/blob/1.10.1/src/main/resources/clojure/install/linux-install.sh
   installPhase =
     let
       binPath = stdenv.lib.makeBinPath [ rlwrap jdk ];
     in
     ''
-      mkdir -p $out/libexec
+      clojure_lib_dir=$out
-      cp clojure-tools-${version}.jar $out/libexec
+      bin_dir=$out/bin
-      cp example-deps.edn $out
-      cp deps.edn $out
-      cp exec.jar $out
 
+      echo "Installing libs into $clojure_lib_dir"
+      install -Dm644 deps.edn "$clojure_lib_dir/deps.edn"
+      install -Dm644 example-deps.edn "$clojure_lib_dir/example-deps.edn"
+      install -Dm644 exec.jar "$clojure_lib_dir/libexec/exec.jar"
+      install -Dm644 clojure-tools-${version}.jar "$clojure_lib_dir/libexec/clojure-tools-${version}.jar"
+
+      echo "Installing clojure and clj into $bin_dir"
       substituteInPlace clojure --replace PREFIX $out
+      install -Dm755 clojure "$bin_dir/clojure"
+      install -Dm755 clj "$bin_dir/clj"
 
-      install -Dt $out/bin clj clojure
+      wrapProgram $bin_dir/clojure --prefix PATH : $out/bin:${binPath}
-      wrapProgram $out/bin/clj --prefix PATH : $out/bin:${binPath}
+      wrapProgram $bin_dir/clj --prefix PATH : $out/bin:${binPath}
-      wrapProgram $out/bin/clojure --prefix PATH : $out/bin:${binPath}
 
       installManPage clj.1 clojure.1
     '';

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -19,6 +19,10 @@
 # For the Python package set
 , packageOverrides ? (self: super: {})
 , buildPackages
+, pkgsBuildBuild
+, pkgsBuildTarget
+, pkgsHostHost
+, pkgsTargetTarget
 , sourceVersion
 , sha256
 , passthruFun
@@ -35,7 +39,8 @@ with stdenv.lib;
 
 let
 
-  pythonForBuild = buildPackages.${"python${sourceVersion.major}${sourceVersion.minor}"};
+  pythonAttr = "python${sourceVersion.major}${sourceVersion.minor}";
+  pythonForBuild = buildPackages.${pythonAttr};
 
   passthru = passthruFun rec {
     inherit self sourceVersion packageOverrides;
@@ -45,6 +50,10 @@ let
     pythonVersion = with sourceVersion; "${major}.${minor}";
     sitePackages = "lib/${libPrefix}/site-packages";
     inherit hasDistutilsCxxPatch pythonForBuild;
+    pythonPackagesBuildBuild = pkgsBuildBuild.${pythonAttr};
+    pythonPackagesBuildTarget = pkgsBuildTarget.${pythonAttr};
+    pythonPackagesHostHost = pkgsHostHost.${pythonAttr};
+    pythonPackagesTargetTarget = pkgsTargetTarget.${pythonAttr} or {};
   } // {
     inherit ucsEncoding;
   };

pkgs/development/interpreters/python/cpython/default.nix

@@ -20,7 +20,11 @@
 # For the Python package set
 , packageOverrides ? (self: super: {})
 , buildPackages
-, pythonForBuild ? buildPackages.${"python${sourceVersion.major}${sourceVersion.minor}"}
+, pkgsBuildBuild
+, pkgsBuildTarget
+, pkgsHostHost
+, pkgsTargetTarget
+, pythonForBuild ? buildPackages.${pythonAttr}
 , sourceVersion
 , sha256
 , passthruFun
@@ -36,6 +40,7 @@
 # Not using optimizations on Darwin
 # configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.
 , enableOptimizations ? (!stdenv.isDarwin)
+, pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -54,6 +59,7 @@ with stdenv.lib;
 
 let
 
+
   passthru = passthruFun rec {
     inherit self sourceVersion packageOverrides;
     implementation = "cpython";
@@ -62,6 +68,10 @@ let
     pythonVersion = with sourceVersion; "${major}.${minor}";
     sitePackages = "lib/${libPrefix}/site-packages";
     inherit hasDistutilsCxxPatch pythonForBuild;
+    pythonPackagesBuildBuild = pkgsBuildBuild.${pythonAttr};
+    pythonPackagesBuildTarget = pkgsBuildTarget.${pythonAttr};
+    pythonPackagesHostHost = pkgsHostHost.${pythonAttr};
+    pythonPackagesTargetTarget = pkgsTargetTarget.${pythonAttr} or {};
   };
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";

pkgs/development/interpreters/python/default.nix

@@ -14,13 +14,70 @@ with pkgs;
     , packageOverrides
     , sitePackages
     , hasDistutilsCxxPatch
-    , pythonForBuild
+    , pythonPackagesBuildBuild
-    , self
+    , pythonForBuild # provides pythonPackagesBuildHost
+    , pythonPackagesBuildTarget
+    , pythonPackagesHostHost
+    , self # is pythonPackagesHostTarget
+    , pythonPackagesTargetTarget
     }: let
-      pythonPackages = callPackage ../../../top-level/python-packages.nix {
+      pythonPackages = callPackage
-        python = self;
+        ({ pkgs, stdenv, python, overrides }: let
-        overrides = packageOverrides;
+          pythonPackagesFun = import ../../../top-level/python-packages.nix {
-      };
+            inherit stdenv pkgs;
+            python = self;
+          };
+          otherSplices = {
+            selfBuildBuild = pythonPackagesBuildBuild;
+            selfBuildHost = pythonForBuild.pkgs;
+            selfBuildTarget = pythonPackagesBuildTarget;
+            selfHostHost = pythonPackagesHostHost;
+            selfTargetTarget = pythonPackagesTargetTarget;
+          };
+          keep = self: {
+            # TODO maybe only define these here so nothing is needed to be kept in sync.
+            inherit (self)
+              isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder
+              python bootstrapped-pip buildPythonPackage buildPythonApplication
+              fetchPypi
+              hasPythonModule requiredPythonModules makePythonPath disabledIf
+              toPythonModule toPythonApplication
+              buildSetupcfg
+
+              eggUnpackHook
+              eggBuildHook
+              eggInstallHook
+              flitBuildHook
+              pipBuildHook
+              pipInstallHook
+              pytestCheckHook
+              pythonCatchConflictsHook
+              pythonImportsCheckHook
+              pythonNamespacesHook
+              pythonRecompileBytecodeHook
+              pythonRemoveBinBytecodeHook
+              pythonRemoveTestsDirHook
+              setuptoolsBuildHook
+              setuptoolsCheckHook
+              venvShellHook
+              wheelUnpackHook
+
+              wrapPython
+
+              pythonPackages
+
+              recursivePthLoader
+            ;
+          };
+        in lib.makeScopeWithSplicing
+          pkgs.splicePackages
+          pkgs.newScope
+          otherSplices
+          keep
+          (lib.extends overrides pythonPackagesFun))
+        {
+          overrides = packageOverrides;
+        };
     in rec {
         isPy27 = pythonVersion == "2.7";
         isPy35 = pythonVersion == "3.5";
@@ -48,7 +105,6 @@ with pkgs;
           python = self;
         };
   };
-
 in {
 
   python27 = callPackage ./cpython/2.7 {

pkgs/development/interpreters/python/hooks/default.nix

@@ -1,7 +1,6 @@
 # Hooks for building Python packages.
 { python
 , lib
-, callPackage
 , makeSetupHook
 , disabledIf
 , isPy3k
@@ -9,6 +8,7 @@
 }:
 
 let
+  callPackage = python.pythonForBuild.pkgs.callPackage;
   pythonInterpreter = python.pythonForBuild.interpreter;
   pythonSitePackages = python.sitePackages;
   pythonCheckInterpreter = python.interpreter;

pkgs/development/interpreters/python/pypy/default.nix

@@ -22,9 +22,15 @@ let
     implementation = "pypy";
     libPrefix = "pypy${pythonVersion}";
     executable = "pypy${if isPy3k then "3" else ""}";
-    pythonForBuild = self; # No cross-compiling for now.
     sitePackages = "site-packages";
     hasDistutilsCxxPatch = false;
+
+    # No cross-compiling for now.
+    pythonForBuild = self;
+    pythonPackagesBuildBuild = {};
+    pythonPackagesBuildTarget = {};
+    pythonPackagesHostHost = {};
+    pythonPackagesTargetTarget = {};
   };
   pname = passthru.executable;
   version = with sourceVersion; "${major}.${minor}.${patch}";

pkgs/development/libraries/arb/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = ''A library for arbitrary-precision interval arithmetic'';
     homepage = "http://arblib.org/";
     license = stdenv.lib.licenses.lgpl21Plus;
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     platforms = stdenv.lib.platforms.unix;
   };
 }

pkgs/development/libraries/cddlib/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     inherit version;
     description = ''An implementation of the Double Description Method for generating all vertices of a convex polyhedron'';
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [raskin timokau];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
     homepage = "https://www.inf.ethz.ch/personal/fukudak/cdd_home/index.html";
   };

pkgs/development/libraries/eclib/default.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     description = ''Elliptic curve tools'';
     homepage = "https://github.com/JohnCremona/eclib";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.all;
   };
 }

pkgs/development/libraries/fflas-ffpack/default.nix

@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     inherit version;
     description = ''Finite Field Linear Algebra Subroutines'';
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
     homepage = "https://linbox-team.github.io/fflas-ffpack/";
   };

pkgs/development/libraries/fplll/default.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       "https://groups.google.com/forum/#!searchin/fplll-devel/FPLLL$20${version}"
     ];
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [raskin timokau];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/gf2x/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     description = ''Routines for fast arithmetic in GF(2)[x]'';
     homepage = "http://gf2x.gforge.inria.fr";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ raskin timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/glpk/default.nix

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "The GNU Linear Programming Kit";
 
     longDescription =
@@ -70,9 +70,9 @@ stdenv.mkDerivation rec {
       '';
 
     homepage = "https://www.gnu.org/software/glpk/";
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = licenses.gpl3Plus;
 
-    maintainers = with stdenv.lib.maintainers; [ bjg timokau ];
+    maintainers = with maintainers; [ bjg ] ++ teams.sage.members;
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.all;
   };
 }

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -161,7 +161,6 @@ in stdenv.mkDerivation rec {
     soundtouch
     srtp
     fluidsynth
-    libva
     libvdpau
     libwebp
     xvidcore
@@ -180,6 +179,7 @@ in stdenv.mkDerivation rec {
     faac
   ] ++ optionals stdenv.isLinux [
     bluez
+    libva # vaapi requires libva -> libdrm -> libpciaccess, which is Linux-only in nixpkgs
     wayland
     wayland-protocols
   ] ++ optionals (!stdenv.isDarwin) [
@@ -259,6 +259,9 @@ in stdenv.mkDerivation rec {
     "-Dwpe=disabled" # required `wpe-webkit` library not packaged in nixpkgs as of writing
     "-Dzxing=disabled" # required `zxing-cpp` library not packaged in nixpkgs as of writing
   ]
+  ++ optionals (!stdenv.isLinux) [
+    "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ]
   ++ optionals stdenv.isDarwin [
     "-Dbluez=disabled"
     "-Dchromaprint=disabled"
@@ -272,6 +275,7 @@ in stdenv.mkDerivation rec {
     "-Ddvb=disabled"
     "-Dfbdev=disabled"
     "-Duvch264=disabled" # requires gudev
+    "-Dv4l2codecs=disabled" # requires gudev
     "-Dladspa=disabled" # requires lrdf
     "-Dwebrtc=disabled" # requires libnice, which as of writing doesn't work on Darwin in nixpkgs
     "-Dwildmidi=disabled" # see dependencies above

pkgs/development/libraries/libavif/default.nix

@@ -11,21 +11,22 @@
 
 stdenv.mkDerivation rec {
   pname = "libavif";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "AOMediaCodec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0f0l8ywz2jhc9mkfrzdxdvr3q39a404yn9wcyvqshfbkbprsan4p";
+    sha256 = "1d6ql4vq338dvz61d5im06dh8m9rqfk37f9i356j3njpq604i1f6";
   };
 
   # reco: encode libaom slowest but best, decode dav1d fastest
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-    "-DAVIF_CODEC_AOM=ON"
+    "-DAVIF_CODEC_AOM=ON" # best encoder (slow but small)
-    "-DAVIF_CODEC_DAV1D=ON"
+    "-DAVIF_CODEC_DAV1D=ON" # best decoder (fast)
+    "-DAVIF_CODEC_AOM_DECODE=OFF"
     "-DAVIF_BUILD_APPS=ON"
   ];
 

pkgs/development/libraries/libgda/default.nix

@@ -9,11 +9,11 @@ assert postgresSupport -> postgresql != null;
 
 (if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
   pname = "libgda";
-  version = "5.2.9";
+  version = "5.2.10";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16vxv2qvysh22s8h9h6irx96sacagxkz0i4qgi1wc6ibly6fvjjr";
+    sha256 = "1j1l4dwjgw6w4d1v4bl5a4kwyj7bcih8mj700ywm7xakh1xxyv3g";
   };
   configureFlags = with stdenv.lib; [
     "--enable-gi-system-install=no"

pkgs/development/libraries/libgpiod/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgpiod";
-  version = "1.6";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
-    sha256 = "0xcwrg4p4w925lijmz4ci4500z83kj5gs1n501q4vhi54bdzn2k5";
+    sha256 = "0p3vjf4zj137miix1gbi8rv6g4wvi8kmyhwwxyirw00ankxbxp1n";
   };
 
   patches = [

pkgs/development/libraries/linbox/default.nix

@@ -70,12 +70,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     inherit version;
     description = "C++ library for exact, high-performance linear algebra";
-    license = stdenv.lib.licenses.lgpl21Plus;
+    license = licenses.lgpl21Plus;
-    maintainers = [stdenv.lib.maintainers.timokau];
+    maintainers = teams.sage.members;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
     homepage = "https://linalg.org/";
   };
 }

pkgs/development/libraries/nss/3.53.nix

@@ -0,0 +1,169 @@
+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja
+, # allow FIPS mode. Note that this makes the output non-reproducible.
+  # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
+  enableFIPS ? false
+}:
+
+let
+  nssPEM = fetchurl {
+    url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
+    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
+  };
+  version = "3.53.1";
+  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
+
+in stdenv.mkDerivation rec {
+  pname = "nss";
+  inherit version;
+
+  src = fetchurl {
+    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
+    sha256 = "05jk65x3zy6q8lx2djj8ik7kg741n88iy4n3bblw89cv0xkxxk1d";
+  };
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
+    ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ darwin.cctools fixDarwinDylibNames ];
+
+  buildInputs = [ zlib sqlite ];
+
+  propagatedBuildInputs = [ nspr ];
+
+  prePatch = ''
+    # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
+    xz -d < ${nssPEM} | sed \
+       -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
+       -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
+       -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
+       | patch -p1
+
+    patchShebangs nss
+
+    for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
+      substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
+    done
+
+    substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
+  '';
+
+  patches =
+    [
+      # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
+      ./85_security_load.patch
+      ./ckpem.patch
+      ./fix-cross-compilation.patch
+    ];
+
+  patchFlags = [ "-p0" ];
+
+  postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+     substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
+     substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
+   '';
+
+  outputs = [ "out" "dev" "tools" ];
+
+  preConfigure = "cd nss";
+
+  buildPhase = let
+    getArch = platform: if platform.isx86_64 then "x64"
+          else if platform.isx86_32 then "ia32"
+          else if platform.isAarch32 then "arm"
+          else if platform.isAarch64 then "arm64"
+          else if platform.isPower && platform.is64bit then (
+            if platform.isLittleEndian then "ppc64le" else "ppc64"
+          )
+          else platform.parsed.cpu.name;
+    # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
+    target = getArch stdenv.hostPlatform;
+    host = getArch stdenv.buildPlatform;
+  in ''
+    runHook preBuild
+
+    sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
+    ./build.sh -v --opt \
+      --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
+      --system-sqlite \
+      --enable-legacy-db \
+      --target ${target} \
+      -Dhost_arch=${host} \
+      -Duse_system_zlib=1 \
+      --enable-libpkix \
+      ${stdenv.lib.optionalString enableFIPS "--enable-fips"} \
+      ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
+      ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
+
+    runHook postBuild
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf $out/private
+    find $out -name "*.TOC" -delete
+    mv $out/public $out/include
+
+    ln -s lib $out/lib64
+
+    # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
+    # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
+    NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
+    NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
+    NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
+    PREFIX="$out"
+
+    mkdir -p $out/lib/pkgconfig
+    sed -e "s,%prefix%,$PREFIX," \
+        -e "s,%exec_prefix%,$PREFIX," \
+        -e "s,%libdir%,$PREFIX/lib64," \
+        -e "s,%includedir%,$dev/include/nss," \
+        -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
+        -e "s,%NSPR_VERSION%,4.16,g" \
+        pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
+    chmod 0644 $out/lib/pkgconfig/nss.pc
+
+    sed -e "s,@prefix@,$PREFIX," \
+        -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
+        -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
+        -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
+        pkg/pkg-config/nss-config.in > $out/bin/nss-config
+    chmod 0755 $out/bin/nss-config
+  '';
+
+  postFixup = let
+    isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+    nss = if isCross then buildPackages.nss.tools else "$out";
+  in
+  (stdenv.lib.optionalString enableFIPS (''
+    for libname in freebl3 nssdbm3 softokn3
+    do '' +
+    (if stdenv.isDarwin
+     then ''
+       libfile="$out/lib/lib$libname.dylib"
+       DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
+     '' else ''
+       libfile="$out/lib/lib$libname.so"
+       LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
+     '') + ''
+        ${nss}/bin/shlibsign -v -i "$libfile"
+    done
+  '')) +
+  ''
+    moveToOutput bin "$tools"
+    moveToOutput bin/nss-config "$dev"
+    moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
+    rm -f "$out"/lib/*.a
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://developer.mozilla.org/en-US/docs/NSS";
+    description = "A set of libraries for development of security-enabled client and server applications";
+    license = licenses.mpl20;
+    platforms = platforms.all;
+  };
+}

pkgs/development/libraries/nss/default.nix

@@ -9,7 +9,13 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.57";
+
+  # NOTE: Whenever you updated this version check if the `cacert` package also
+  #       needs an update. You can run the regular updater script for cacerts.
+  #       It will rebuild itself using the version of this package (NSS) and if
+  #       an update is required do the required changes to the expression.
+  #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
+  version = "3.59";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -18,7 +24,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "55a86c01be860381d64bb4e5b94eb198df9b0f098a8af0e58c014df398bdc382";
+    sha256 = "096fs3z21r171q24ca3rq53p1389xmvqz1f2rpm7nlm8r9s82ag6";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/development/libraries/ntl/default.nix

@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.shoup.net/ntl/";
     # also locally at "${src}/doc/tour-changes.html";
     changelog = "https://www.shoup.net/ntl/doc/tour-changes.html";
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     license = licenses.gpl2Plus;
     platforms = platforms.all;
   };

pkgs/development/libraries/osip/default.nix

@@ -1,9 +1,9 @@
 {stdenv, fetchurl}:
 stdenv.mkDerivation rec {
-  version = "5.1.2";
+  version = "5.2.0";
   src = fetchurl {
     url = "mirror://gnu/osip/libosip2-${version}.tar.gz";
-    sha256 = "148j1i0zkwf09qdpk3nc5sssj1dvppw7p0n9rgrg8k56447l1h1b";
+    sha256 = "0xdk3cszkzb8nb757gl47slrr13mf6xz43ab4k343fv8llp8pd2g";
   };
   pname = "libosip2";
 

pkgs/development/libraries/science/math/brial/default.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/BRiAl/BRiAl";
     description = "Legacy version of PolyBoRi maintained by sagemath developers";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/science/math/cliquer/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       easy to use.
     '';
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/science/math/flintqs/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/sagemath/FlintQS";
     description = "Highly optimized multi-polynomial quadratic sieve for integer factorization";
     license = with licenses; [ gpl2 ];
-    maintainers = with maintainers; [ timokau ];
+    maintainers = teams.sage.members;
     platforms = platforms.all;
   };
 }