Merge staging-next into staging

2022-04-05 12:10:46 +00:00 · 2022-04-05 12:10:46 +00:00 · 3063a8ea39
commit 3063a8ea39
parent ba0cd3c436 27a4e52731
59 changed files with 2358 additions and 2091 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -242,9 +242,8 @@

 # Docker tools
 /pkgs/build-support/docker                   @roberth
-/nixos/tests/docker-tools-overlay.nix        @roberth
-/nixos/tests/docker-tools.nix                @roberth
-/doc/builders/images/dockertools.xml         @roberth
+/nixos/tests/docker-tools*                   @roberth
+/doc/builders/images/dockertools.section.md  @roberth

 # Blockchains
 /pkgs/applications/blockchains  @mmahut @RaghavSood
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@ -8,6 +8,7 @@
 # $ nix run nixpkgs.python3Packages.flake8 -c flake8 --ignore E501,E265 update.py

 import argparse
+import csv
 import functools
 import http
 import json
@ -28,7 +29,7 @@ from pathlib import Path
 from typing import Dict, List, Optional, Tuple, Union, Any, Callable
 from urllib.parse import urljoin, urlparse
 from tempfile import NamedTemporaryFile
-from dataclasses import dataclass
+from dataclasses import dataclass, asdict

 import git

@ -85,21 +86,30 @@ def make_request(url: str, token=None) -> urllib.request.Request:
        headers["Authorization"] = f"token {token}"
    return urllib.request.Request(url, headers=headers)

+
+Redirects = Dict['Repo', 'Repo']
+
 class Repo:
    def __init__(
-        self, uri: str, branch: str, alias: Optional[str]
+        self, uri: str, branch: str
    ) -> None:
        self.uri = uri
        '''Url to the repo'''
-        self.branch = branch
-        self.alias = alias
-        self.redirect: Dict[str, str] = {}
+        self._branch = branch
+        # {old_uri: new_uri}
+        self.redirect: Redirects = {}
        self.token = "dummy_token"

    @property
    def name(self):
        return self.uri.split('/')[-1]

+    @property
+    def branch(self):
+        return self._branch or "HEAD"
+
+    def __str__(self) -> str:
+        return f"{self.uri}"
    def __repr__(self) -> str:
        return f"Repo({self.name}, {self.uri})"

@ -109,6 +119,7 @@ class Repo:

    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def latest_commit(self) -> Tuple[str, datetime]:
+        log.debug("Latest commit")
        loaded = self._prefetch(None)
        updated = datetime.strptime(loaded['date'], "%Y-%m-%dT%H:%M:%S%z")

@ -124,6 +135,7 @@ class Repo:
        return loaded

    def prefetch(self, ref: Optional[str]) -> str:
+        print("Prefetching")
        loaded = self._prefetch(ref)
        return loaded["sha256"]

@ -137,21 +149,22 @@ class Repo:

 class RepoGitHub(Repo):
    def __init__(
-        self, owner: str, repo: str, branch: str, alias: Optional[str]
+        self, owner: str, repo: str, branch: str
    ) -> None:
        self.owner = owner
        self.repo = repo
        self.token = None
        '''Url to the repo'''
-        super().__init__(self.url(""), branch, alias)
-        log.debug("Instantiating github repo %s/%s", self.owner, self.repo)
+        super().__init__(self.url(""), branch)
+        log.debug("Instantiating github repo owner=%s and repo=%s", self.owner, self.repo)

    @property
    def name(self):
        return self.repo

    def url(self, path: str) -> str:
-        return urljoin(f"https://github.com/{self.owner}/{self.name}/", path)
+        res = urljoin(f"https://github.com/{self.owner}/{self.repo}/", path)
+        return res

    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def has_submodules(self) -> bool:
@ -168,6 +181,7 @@ class RepoGitHub(Repo):
    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def latest_commit(self) -> Tuple[str, datetime]:
        commit_url = self.url(f"commits/{self.branch}.atom")
+        log.debug("Sending request to %s", commit_url)
        commit_req = make_request(commit_url, self.token)
        with urllib.request.urlopen(commit_req, timeout=10) as req:
            self._check_for_redirect(commit_url, req)
@ -191,12 +205,9 @@ class RepoGitHub(Repo):
            new_owner, new_name = (
                urllib.parse.urlsplit(response_url).path.strip("/").split("/")[:2]
            )
-            end_line = "\n" if self.alias is None else f" as {self.alias}\n"
-            plugin_line = "{owner}/{name}" + end_line

-            old_plugin = plugin_line.format(owner=self.owner, name=self.name)
-            new_plugin = plugin_line.format(owner=new_owner, name=new_name)
-            self.redirect[old_plugin] = new_plugin
+            new_repo = RepoGitHub(owner=new_owner, repo=new_name, branch=self.branch)
+            self.redirect[self] = new_repo


    def prefetch(self, commit: str) -> str:
@ -207,9 +218,9 @@ class RepoGitHub(Repo):
        return sha256

    def prefetch_github(self, ref: str) -> str:
-        data = subprocess.check_output(
-            ["nix-prefetch-url", "--unpack", self.url(f"archive/{ref}.tar.gz")]
-        )
+        cmd = ["nix-prefetch-url", "--unpack", self.url(f"archive/{ref}.tar.gz")]
+        log.debug("Running %s", cmd)
+        data = subprocess.check_output(cmd)
        return data.strip().decode("utf-8")

    def as_nix(self, plugin: "Plugin") -> str:
@ -239,21 +250,38 @@ class PluginDesc:
        else:
            return self.alias

+    def __lt__(self, other):
+        return self.repo.name < other.repo.name

+    @staticmethod
+    def load_from_csv(config: FetchConfig, row: Dict[str, str]) -> 'PluginDesc':
+        branch = row["branch"]
+        repo = make_repo(row['repo'], branch.strip())
+        repo.token = config.github_token
+        return PluginDesc(repo, branch.strip(), row["alias"])
+
+
+    @staticmethod
+    def load_from_string(config: FetchConfig, line: str) -> 'PluginDesc':
+        branch = "HEAD"
+        alias = None
+        uri = line
+        if " as " in uri:
+            uri, alias = uri.split(" as ")
+            alias = alias.strip()
+        if "@" in uri:
+            uri, branch = uri.split("@")
+        repo = make_repo(uri.strip(), branch.strip())
+        repo.token = config.github_token
+        return PluginDesc(repo, branch.strip(), alias)
+
+@dataclass
 class Plugin:
-    def __init__(
-        self,
-        name: str,
-        commit: str,
-        has_submodules: bool,
-        sha256: str,
-        date: Optional[datetime] = None,
-    ) -> None:
-        self.name = name
-        self.commit = commit
-        self.has_submodules = has_submodules
-        self.sha256 = sha256
-        self.date = date
+    name: str
+    commit: str
+    has_submodules: bool
+    sha256: str
+    date: Optional[datetime] = None

    @property
    def normalized_name(self) -> str:
@ -270,6 +298,17 @@ class Plugin:
        return copy


+def load_plugins_from_csv(config: FetchConfig, input_file: Path,) -> List[PluginDesc]:
+    log.debug("Load plugins from csv %s", input_file)
+    plugins = []
+    with open(input_file, newline='') as csvfile:
+        log.debug("Writing into %s", input_file)
+        reader = csv.DictReader(csvfile,)
+        for line in reader:
+            plugin = PluginDesc.load_from_csv(config, line)
+            plugins.append(plugin)
+
+    return plugins

 class Editor:
    """The configuration of the update script."""
@ -298,14 +337,8 @@ class Editor:
        return get_current_plugins(self)

    def load_plugin_spec(self, config: FetchConfig, plugin_file) -> List[PluginDesc]:
-        plugins = []
-        with open(plugin_file) as f:
-            for line in f:
-                if line.startswith("#"):
-                    continue
-                plugin = parse_plugin_line(config, line)
-                plugins.append(plugin)
-        return plugins
+        '''CSV spec'''
+        return load_plugins_from_csv(config, plugin_file)

    def generate_nix(self, plugins, outfile: str):
        '''Returns nothing for now, writes directly to outfile'''
@ -316,11 +349,11 @@ class Editor:
        _prefetch = functools.partial(prefetch, cache=cache)

        def update() -> dict:
-            plugin_names = self.load_plugin_spec(config, input_file)
+            plugins = self.load_plugin_spec(config, input_file)

            try:
                pool = Pool(processes=config.proc)
-                results = pool.map(_prefetch, plugin_names)
+                results = pool.map(_prefetch, plugins)
            finally:
                cache.store()

@ -423,6 +456,7 @@ def get_current_plugins(editor: Editor) -> List[Plugin]:
    data = json.loads(out)
    plugins = []
    for name, attr in data.items():
+        print("get_current_plugins: name %s" % name)
        p = Plugin(name, attr["rev"], attr["submodules"], attr["sha256"])
        plugins.append(p)
    return plugins
@ -431,7 +465,7 @@ def get_current_plugins(editor: Editor) -> List[Plugin]:
 def prefetch_plugin(
    p: PluginDesc,
    cache: "Optional[Cache]" = None,
-) -> Tuple[Plugin, Dict[str, str]]:
+) -> Tuple[Plugin, Redirects]:
    repo, branch, alias = p.repo, p.branch, p.alias
    name = alias or p.repo.name
    commit = None
@ -454,11 +488,6 @@ def prefetch_plugin(
    )


-def fetch_plugin_from_pluginline(config: FetchConfig, plugin_line: str) -> Plugin:
-    plugin, _ = prefetch_plugin(parse_plugin_line(config, plugin_line))
-    return plugin
-
-
 def print_download_error(plugin: str, ex: Exception):
    print(f"{plugin}: {ex}", file=sys.stderr)
    ex_traceback = ex.__traceback__
@ -468,14 +497,14 @@ def print_download_error(plugin: str, ex: Exception):
    ]
    print("\n".join(tb_lines))

-
 def check_results(
-    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Dict[str, str]]]
-) -> Tuple[List[Tuple[PluginDesc, Plugin]], Dict[str, str]]:
+    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Redirects]]
+) -> Tuple[List[Tuple[PluginDesc, Plugin]], Redirects]:
    ''' '''
    failures: List[Tuple[str, Exception]] = []
    plugins = []
-    redirects: Dict[str, str] = {}
+    # {old: new} plugindesc
+    redirects: Dict[Repo, Repo] = {}
    for (pdesc, result, redirect) in results:
        if isinstance(result, Exception):
            failures.append((pdesc.name, result))
@ -495,31 +524,17 @@ def check_results(

        sys.exit(1)

-def make_repo(uri, branch, alias) -> Repo:
+def make_repo(uri: str, branch) -> Repo:
    '''Instantiate a Repo with the correct specialization depending on server (gitub spec)'''
    # dumb check to see if it's of the form owner/repo (=> github) or https://...
-    res = uri.split('/')
-    if len(res) <= 2:
-        repo = RepoGitHub(res[0], res[1], branch, alias)
+    res = urlparse(uri)
+    if res.netloc in [ "github.com", ""]:
+        res = res.path.strip('/').split('/')
+        repo = RepoGitHub(res[0], res[1], branch)
    else:
-        repo = Repo(uri.strip(), branch, alias)
+        repo = Repo(uri.strip(), branch)
    return repo

-def parse_plugin_line(config: FetchConfig, line: str) -> PluginDesc:
-    branch = "HEAD"
-    alias = None
-    uri = line
-    if " as " in uri:
-        uri, alias = uri.split(" as ")
-        alias = alias.strip()
-    if "@" in uri:
-        uri, branch = uri.split("@")
-
-    repo = make_repo(uri.strip(), branch.strip(), alias)
-    repo.token = config.github_token
-
-    return PluginDesc(repo, branch.strip(), alias)
-

 def get_cache_path(cache_file_name: str) -> Optional[Path]:
    xdg_cache = os.environ.get("XDG_CACHE_HOME", None)
@ -585,27 +600,27 @@ def prefetch(
        return (pluginDesc, e, {})


+
 def rewrite_input(
    config: FetchConfig,
    input_file: Path,
    deprecated: Path,
-    redirects: Dict[str, str] = None,
-    append: Tuple = (),
+    # old pluginDesc and the new
+    redirects: Dict[PluginDesc, PluginDesc] = {},
+    append: List[PluginDesc] = [],
 ):
-    with open(input_file, "r") as f:
-        lines = f.readlines()
+    plugins = load_plugins_from_csv(config, input_file,)

-    lines.extend(append)
+    plugins.extend(append)

    if redirects:
-        lines = [redirects.get(line, line) for line in lines]

        cur_date_iso = datetime.now().strftime("%Y-%m-%d")
        with open(deprecated, "r") as f:
            deprecations = json.load(f)
        for old, new in redirects.items():
-            old_plugin = fetch_plugin_from_pluginline(config, old)
-            new_plugin = fetch_plugin_from_pluginline(config, new)
+            old_plugin, _ = prefetch_plugin(old)
+            new_plugin, _ = prefetch_plugin(new)
            if old_plugin.normalized_name != new_plugin.normalized_name:
                deprecations[old_plugin.normalized_name] = {
                    "new": new_plugin.normalized_name,
@ -615,10 +630,14 @@ def rewrite_input(
            json.dump(deprecations, f, indent=4, sort_keys=True)
            f.write("\n")

-    lines = sorted(lines, key=str.casefold)
-
    with open(input_file, "w") as f:
-        f.writelines(lines)
+        log.debug("Writing into %s", input_file)
+        # fields = dataclasses.fields(PluginDesc)
+        fieldnames = ['repo', 'branch', 'alias']
+        writer = csv.DictWriter(f, fieldnames, dialect='unix', quoting=csv.QUOTE_NONE)
+        writer.writeheader()
+        for plugin in sorted(plugins):
+            writer.writerow(asdict(plugin))


 def commit(repo: git.Repo, message: str, files: List[Path]) -> None:
@ -660,9 +679,11 @@ def update_plugins(editor: Editor, args):
            )

    for plugin_line in args.add_plugins:
-        editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, append=(plugin_line + "\n",))
+        pdesc = PluginDesc.load_from_string(fetch_config, plugin_line)
+        append = [ pdesc ]
+        editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, append=append)
        update()
-        plugin = fetch_plugin_from_pluginline(fetch_config, plugin_line)
+        plugin, _ = prefetch_plugin(pdesc, )
        if autocommit:
            commit(
                nixpkgs_repo,
--- a/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
@ -866,6 +866,14 @@
          package.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The vim/kakoune plugin updater now reads from a CSV file:
+          check
+          <literal>pkgs/applications/editors/vim/plugins/vim-plugin-names</literal>
+          out to see the new format
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-1803.section.md
+++ b/nixos/doc/manual/release-notes/rl-1803.section.md
@ -282,3 +282,5 @@ When upgrading from a previous release, please be aware of the following incompa
 - The NixOS test driver supports user services declared by `systemd.user.services`. The methods `waitForUnit`, `getUnitInfo`, `startJob` and `stopJob` provide an optional `$user` argument for that purpose.

 - Enabling bash completion on NixOS, `programs.bash.enableCompletion`, will now also enable completion for the Nix command line tools by installing the [nix-bash-completions](https://github.com/hedning/nix-bash-completions) package.
+
+- The vim/kakoune plugin updater now reads from a CSV file: check `pkgs/applications/editors/vim/plugins/vim-plugin-names` out to see the new format
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -170,6 +170,7 @@ let format' = format; in let
      config.system.build.nixos-install
      config.system.build.nixos-enter
      nix
+      systemdMinimal
    ] ++ stdenv.initialPath);

  # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -108,7 +108,7 @@ let

  fileSystems = filter utils.fsNeededForBoot config.system.build.fileSystems;

-  fstab = pkgs.writeText "fstab" (lib.concatMapStringsSep "\n"
+  fstab = pkgs.writeText "initrd-fstab" (lib.concatMapStringsSep "\n"
    ({ fsType, mountPoint, device, options, autoFormat, autoResize, ... }@fs: let
        opts = options ++ optional autoFormat "x-systemd.makefs" ++ optional autoResize "x-systemd.growfs";
      in "${device} /sysroot${mountPoint} ${fsType} ${lib.concatStringsSep "," opts}") fileSystems);
@ -128,11 +128,7 @@ let
    name = "initrd-emergency-env";
    paths = map getBin cfg.initrdBin;
    pathsToLink = ["/bin" "/sbin"];
-    # Make recovery easier
-    postBuild = ''
-      ln -s ${cfg.package.util-linux}/bin/mount $out/bin/
-      ln -s ${cfg.package.util-linux}/bin/umount $out/bin/
-    '';
+    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -s '${v}' $out/bin/'${n}'") cfg.extraBin);
  };

  initialRamdisk = pkgs.makeInitrdNG {
@ -205,6 +201,19 @@ in {
      default = [];
    };

+    extraBin = mkOption {
+      description = ''
+        Tools to add to /bin
+      '';
+      example = literalExpression ''
+        {
+          umount = ''${pkgs.util-linux}/bin/umount;
+        }
+      '';
+      type = types.attrsOf types.path;
+      default = {};
+    };
+
    suppressedStorePaths = mkOption {
      description = ''
        Store paths specified in the storePaths option that
@ -342,8 +351,15 @@ in {

  config = mkIf (config.boot.initrd.enable && cfg.enable) {
    system.build = { inherit initialRamdisk; };
+
+    boot.initrd.availableKernelModules = [ "autofs4" ]; # systemd needs this for some features
+
    boot.initrd.systemd = {
      initrdBin = [pkgs.bash pkgs.coreutils pkgs.kmod cfg.package] ++ config.system.fsPackages;
+      extraBin = {
+        mount = "${cfg.package.util-linux}/bin/mount";
+        umount = "${cfg.package.util-linux}/bin/umount";
+      };

      contents = {
        "/init".source = "${cfg.package}/lib/systemd/systemd";
--- a/nixos/tests/docker-tools-cross.nix
+++ b/nixos/tests/docker-tools-cross.nix
@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let

  remoteSystem =
-    if pkgs.system == "aarch64-linux"
+    if pkgs.stdenv.hostPlatform.system == "aarch64-linux"
    then "x86_64-linux"
    else "aarch64-linux";

@ -18,7 +18,7 @@ let

    # NOTE: Since this file can't control where the test will be _run_ we don't
    #       cross-compile _to_ a different system but _from_ a different system
-    crossSystem = pkgs.system;
+    crossSystem = pkgs.stdenv.hostPlatform.system;
  };

  hello1 = remoteCrossPkgs.dockerTools.buildImage {
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -315,7 +315,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
                "docker inspect ${pkgs.dockerTools.examples.cross.imageName} "
                + "| ${pkgs.jq}/bin/jq -r .[].Architecture"
            ).strip()
-            == "${if pkgs.system == "aarch64-linux" then "amd64" else "arm64"}"
+            == "${if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then "amd64" else "arm64"}"
        )

    with subtest("buildLayeredImage doesn't dereference /nix/store symlink layers"):
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@ -113,7 +113,6 @@ let
                  driver.find_element_by_css_selector('input#masterPasswordRetype').send_keys(
                    '${userPassword}'
                  )
-                  driver.find_element_by_css_selector('input#acceptPolicies').click()

                  driver.find_element_by_xpath("//button[contains(., 'Submit')]").click()

--- a/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
+++ b/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
@ -1,19 +1,20 @@
-alexherbo2/auto-pairs.kak
-alexherbo2/replace-mode.kak
-alexherbo2/sleuth.kak
-andreyorst/fzf.kak
-andreyorst/powerline.kak
-basbebe/pandoc.kak
-danr/kakoune-easymotion
-Delapouite/kakoune-buffers
-Delapouite/kakoune-registers
-enricozb/tabs.kak@main
-greenfork/active-window.kak
-kakoune-editor/kakoune-extra-filetypes
-kakounedotcom/connect.kak
-kakounedotcom/prelude.kak
-lePerdu/kakboard
-listentolist/kakoune-rainbow
-mayjs/openscad.kak
-occivink/kakoune-buffer-switcher
-occivink/kakoune-vertical-selection
+repo,branch,alias
+alexherbo2/auto-pairs.kak,,
+alexherbo2/replace-mode.kak,,
+alexherbo2/sleuth.kak,,
+andreyorst/fzf.kak,,
+andreyorst/powerline.kak,,
+basbebe/pandoc.kak,,
+danr/kakoune-easymotion,,
+Delapouite/kakoune-buffers,,
+Delapouite/kakoune-registers,,
+enricozb/tabs.kak@main,,
+greenfork/active-window.kak,,
+kakoune-editor/kakoune-extra-filetypes,,
+kakounedotcom/connect.kak,,
+kakounedotcom/prelude.kak,,
+lePerdu/kakboard,,
+listentolist/kakoune-rainbow,,
+mayjs/openscad.kak,,
+occivink/kakoune-buffer-switcher,,
+occivink/kakoune-vertical-selection,,
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
--- a/pkgs/applications/graphics/imgbrd-grabber/default.nix
+++ b/pkgs/applications/graphics/imgbrd-grabber/default.nix
@ -33,12 +33,12 @@ stdenv.mkDerivation rec {

  buildInputs = [
    openssl
-    makeWrapper
    libpulseaudio
    typescript
  ];

  nativeBuildInputs = [
+    makeWrapper
    qtmultimedia
    qtbase
    qtdeclarative
--- a/pkgs/applications/graphics/jpegrescan/default.nix
+++ b/pkgs/applications/graphics/jpegrescan/default.nix
@ -28,8 +28,12 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ perlPackages.FileSlurp ];

+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
  buildInputs = [
-    perl libjpeg_turbo makeWrapper
+    perl libjpeg_turbo
  ];

  meta = with lib; {
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@ -103,10 +103,10 @@ stdenv.mkDerivation {

  preConfigure = "./bootstrap.sh";

-  nativeBuildInputs = [ pkg-config autoreconfHook gettext ];
+  nativeBuildInputs = [ pkg-config autoreconfHook gettext makeWrapper ];
  buildInputs = [
    ETL boost cairo glibmm gtk3 gtkmm3 imagemagick intltool
-    libjack2 libsigcxx libxmlxx makeWrapper mlt-qt5
+    libjack2 libsigcxx libxmlxx mlt-qt5
    synfig which gnome.adwaita-icon-theme
  ];

--- a/pkgs/applications/misc/gnome-solanum/default.nix
+++ b/pkgs/applications/misc/gnome-solanum/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , rustPlatform
 , desktop-file-utils
 , meson
@ -27,6 +28,15 @@ stdenv.mkDerivation rec {
    sha256 = "0cga6cz6jfbipzp008rjznkz7844licdc34lk133fcyqil0cg0ap";
  };

+  patches = [
+    # Fix build with meson 0.61, can be removed on next update
+    # https://gitlab.gnome.org/World/Solanum/-/merge_requests/49
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/Solanum/-/commit/e5c5d88f95b0fe4145c9ed346b8ca98a613d7cfe.patch";
+      sha256 = "j84P9KzMr0o38u4OD4ZPst+yqw1LCRoa1awT3nelFDI=";
+    })
+  ];
+
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
 , gnutls, libgcrypt, libgpg-error, geoip, openssl, lua5, python3, libcap, glib
-, libssh, nghttp2, zlib, cmake, makeWrapper
+, libssh, nghttp2, zlib, cmake, makeWrapper, wrapGAppsHook
 , withQt ? true, qt5 ? null
 , ApplicationServices, SystemConfiguration, gmp
 , asciidoctor
@ -34,7 +34,8 @@ in stdenv.mkDerivation {
  # Avoid referencing -dev paths because of debug assertions.
  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];

-  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config ] ++ optional withQt qt5.wrapQtAppsHook;
+  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config ]
+    ++ optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];

  buildInputs = [
    gettext pcre perl libpcap lua5 libssh nghttp2 openssl libgcrypt
@ -85,6 +86,12 @@ in stdenv.mkDerivation {

  dontFixCmake = true;

+  # Prevent double-wrapping, inject wrapper args manually instead.
+  dontWrapGApps = true;
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
  shellHook = ''
    # to be able to run the resulting binary
    export WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.39";
+  version = "14.32.45";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-ekwipWWGsXYECJBOmw0+uIWHDpdF8T8jZUo6LeqD6Io=";
+    sha256 = "sha256-9bcOwORHLZfn95RFur4JdP3Djpq8K8utnWIsniqKAI4=";
  };

  patchPhase = ''
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -16,8 +16,8 @@
 , makeWrapper
 , moreutils
 , nix
+, nixosTests
 , pigz
-, pkgs
 , rsync
 , runCommand
 , runtimeShell
@ -26,6 +26,7 @@
 , storeDir ? builtins.storeDir
 , substituteAll
 , symlinkJoin
+, tarsum
 , util-linux
 , vmTools
 , writeReferencesToFile
@ -81,6 +82,15 @@ rec {
    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
  };

+  tests = {
+    inherit (nixosTests)
+      docker-tools
+      docker-tools-overlay
+      # requires remote builder
+      # docker-tools-cross
+      ;
+  };
+
  pullImage =
    let
      fixName = name: builtins.replaceStrings [ "/" ":" ] [ "-" "-" ] name;
@ -113,7 +123,7 @@ rec {
        outputHashAlgo = "sha256";
        outputHash = sha256;

-        nativeBuildInputs = lib.singleton skopeo;
+        nativeBuildInputs = [ skopeo ];
        SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";

        sourceURL = "docker://${imageName}@${imageDigest}";
@ -132,7 +142,7 @@ rec {

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
  # And we cannot untar it, because then we cannot preserve permissions etc.
-  tarsum = pkgs.tarsum;
+  inherit tarsum; # pkgs.dockerTools.tarsum

  # buildEnv creates symlinks to dirs, which is hard to edit inside the overlay VM
  mergeDrvs =
@ -754,7 +764,7 @@ rec {
  # "#!/usr/bin/env executable" shebang.
  usrBinEnv = runCommand "usr-bin-env" { } ''
    mkdir -p $out/usr/bin
-    ln -s ${pkgs.coreutils}/bin/env $out/usr/bin
+    ln -s ${coreutils}/bin/env $out/usr/bin
  '';

  # This provides /bin/sh, pointing to bashInteractive.
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@ -486,7 +486,7 @@ rec {
  cross = let
    # Cross compile for x86_64 if on aarch64
    crossPkgs =
-      if pkgs.system == "aarch64-linux" then pkgsCross.gnu64
+      if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then pkgsCross.gnu64
      else pkgsCross.aarch64-multiplatform;
  in crossPkgs.dockerTools.buildImage {
    name = "hello-cross";
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , appstream
 , desktop-file-utils
@ -28,24 +27,15 @@

 stdenv.mkDerivation rec {
  pname = "elementary-code";
-  version = "6.1.0";
+  version = "6.2.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "code";
    rev = version;
-    sha256 = "sha256-AXmMcPj2hf33G5v3TUg+eZwaKOdVlRvoVXglMJFHRjw=";
+    sha256 = "sha256-QhJNRhYgGbPMd7B1X3kG+pnC/lGUoF7gc7O1PdG49LI=";
  };

-  patches = [
-    # Fix build with meson 0.61
-    # https://github.com/elementary/code/pull/1165
-    (fetchpatch {
-      url = "https://github.com/elementary/code/commit/a2607cce3a6b1bb62d02456456d3cbc3c6530bb0.patch";
-      sha256 = "sha256-VKR83IOUYsQhBRlU9JUTlMJtXWv/AyG4wDsjMU2vmU8=";
-    })
-  ];
-
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/development/compilers/julia/1.6-bin.nix
+++ b/pkgs/development/compilers/julia/1.6-bin.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "julia-bin";
-  version = "1.6.5";
+  version = "1.6.6";

  src = {
    x86_64-linux = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/linux/x64/${lib.versions.majorMinor version}/julia-${version}-linux-x86_64.tar.gz";
-      sha256 = "0b4fmcfd5q5wzvasmsfqq838rivpxn274n5y2kza4m3jakp27zmq";
+      sha256 = "0ia9a4h7w0n5rg57fkl1kzcyj500ymfwq3qsd2r7l82288dgfpy2";
    };
  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

--- a/pkgs/development/libraries/hivex/default.nix
+++ b/pkgs/development/libraries/hivex/default.nix
@ -12,9 +12,9 @@ stdenv.mkDerivation rec {

  patches = [ ./hivex-syms.patch ];

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config ];
  buildInputs = [
-    autoreconfHook makeWrapper libxml2
+    libxml2
  ]
  ++ (with perlPackages; [ perl IOStringy ])
  ++ lib.optionals stdenv.isDarwin [ libiconv ];
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -16,17 +16,18 @@
 , js_of_ocaml-tyxml
 , lwt_ppx
 , ocamlnet
+, ocsipersist
 }:

 stdenv.mkDerivation rec {
  pname = "eliom";
-  version = "8.9.0";
+  version = "9.4.0";

  src = fetchFromGitHub {
    owner = "ocsigen";
    repo = "eliom";
    rev = version;
-    sha256 = "sha256-VNxzpVpXEGlixyjadbW0GjL83jcKV5TWd46UReNYO6w=";
+    sha256 = "sha256:1yn8mqxv9yz51x81j8wv1jn7l7crm8azp1m2g4zn5nz2s4nmfv6q";
  };

  nativeBuildInputs = [
@ -49,12 +50,17 @@ stdenv.mkDerivation rec {
    lwt_ppx
    lwt_react
    ocsigen_server
+    ocsipersist
    ppx_deriving
  ];

  strictDeps = true;

-  installPhase = "opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
+  installPhase = ''
+    runHook preInstall
+    opaline -prefix $out -libdir $OCAMLFIND_DESTDIR
+    runHook postInstall
+  '';

  setupHook = [ ./setup-hook.sh ];

--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@ -2,7 +2,7 @@
 , bigstringaf, lwt, cstruct, mirage-crypto, zarith, mirage-crypto-ec, ptime, mirage-crypto-rng, mtime, ca-certs
 , cohttp, cohttp-lwt-unix, hmap
 , lwt_log, ocaml_pcre, cryptokit, xml-light, ipaddr
-, pgocaml, camlzip, ocaml_sqlite3
+, camlzip
 , makeWrapper
 }:

@ -17,7 +17,7 @@ let caml_ld_library_path =
 ; in

 buildDunePackage rec {
-  version = "4.0.1";
+  version = "5.0.1";
  pname = "ocsigenserver";

  useDune2 = true;
@ -27,11 +27,11 @@ buildDunePackage rec {
    owner = "ocsigen";
    repo = "ocsigenserver";
    rev = version;
-    sha256 = "0pid4irkmdmx1d6n2rvcvx5mnljl3hazzdqc3bql72by35izfac6";
+    sha256 = "sha256:1vzza33hd41740dqrx4854rqpyd8wv7kwpsvvmlpck841i9lh8h5";
  };

  nativeBuildInputs = [ makeWrapper which ];
-  buildInputs = [ lwt_react pgocaml camlzip ocaml_sqlite3 ];
+  buildInputs = [ lwt_react camlzip ];

  propagatedBuildInputs = [ cohttp cohttp-lwt-unix cryptokit hmap ipaddr lwt_log lwt_ssl
    ocaml_pcre xml-light
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-ocsigen-start";
-  version = "4.3.0";
+  version = "4.5.0";

  nativeBuildInputs = [ ocaml findlib eliom ];
  propagatedBuildInputs = [ pgocaml_ppx safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix ocamlnet ];
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    owner = "ocsigen";
    repo = "ocsigen-start";
    rev = version;
-    sha256 = "0lkl59dwzyqq2lyr46fyjr27ms0fp9h59xfsn37faaavdd7v0h98";
+    sha256 = "sha256:1n94r8rbkzxbgcz5w135n6f2cwpc91bdvf7yslcdq4cn713rncmq";
  };

  preInstall = ''
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@ -5,7 +5,7 @@
 stdenv.mkDerivation rec {
 pname = "ocsigen-toolkit";
 name = "ocaml${ocaml.version}-${pname}-${version}";
- version = "3.0.1";
+ version = "3.1.1";

 propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
 nativeBuildInputs = [ ocaml findlib opaline eliom ];
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    owner = "ocsigen";
    repo = pname;
    rev = version;
-    sha256 = "1yx50ja2wcs5vfy4rk9szgwccpnihkjn14i4ywchx4yr4ppr00fm";
+    sha256 = "sha256:1fm0vvccmjib9yj5m2760vhzb4z3392swlprp51az53g3vk4q218";
  };

  meta = {
--- a/pkgs/development/ocaml-modules/ocsipersist/default.nix
+++ b/pkgs/development/ocaml-modules/ocsipersist/default.nix
@ -0,0 +1,20 @@
+{ buildDunePackage, ocsipersist-lib
+, ocsipersist-pgsql
+, ocsipersist-sqlite
+}:
+
+buildDunePackage {
+  pname = "ocsipersist";
+  inherit (ocsipersist-lib) src version useDune2;
+
+  buildInputs = [
+    ocsipersist-pgsql
+    ocsipersist-sqlite
+  ];
+
+  propagatedBuildInputs = [ ocsipersist-lib ];
+
+  meta = ocsipersist-lib.meta // {
+    description = "Persistent key/value storage (for Ocsigen) using multiple backends";
+  };
+}
--- a/pkgs/development/ocaml-modules/ocsipersist/lib.nix
+++ b/pkgs/development/ocaml-modules/ocsipersist/lib.nix
@ -0,0 +1,27 @@
+{ lib, buildDunePackage, fetchFromGitHub
+, lwt_ppx, lwt
+}:
+
+buildDunePackage rec {
+  pname = "ocsipersist-lib";
+  version = "1.1.0";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "ocsigen";
+    repo = "ocsipersist";
+    rev = version;
+    sha256 = "sha256:1d6kdcfjvrz0dl764mnyxc477aa57rvmzkg154qc915w2y1nbz9a";
+  };
+
+  buildInputs = [ lwt_ppx ];
+  propagatedBuildInputs = [ lwt ];
+
+  meta = {
+    description = "Persistent key/value storage (for Ocsigen) - support library";
+    license = lib.licenses.lgpl21Only;
+    maintainers = [ lib.maintainers.vbgl ];
+    inherit (src.meta) homepage;
+  };
+}
--- a/pkgs/development/ocaml-modules/ocsipersist/pgsql.nix
+++ b/pkgs/development/ocaml-modules/ocsipersist/pgsql.nix
@ -0,0 +1,24 @@
+{ buildDunePackage, ocsipersist-lib
+, lwt_log
+, ocsigen_server
+, pgocaml
+, xml-light
+}:
+
+buildDunePackage {
+  pname = "ocsipersist-pgsql";
+  inherit (ocsipersist-lib) version src useDune2;
+
+  propagatedBuildInputs = [
+    lwt_log
+    ocsigen_server
+    ocsipersist-lib
+    pgocaml
+    xml-light
+  ];
+
+  meta = ocsipersist-lib.meta // {
+    description = "Persistent key/value storage (for Ocsigen) using PostgreSQL";
+  };
+}
+
--- a/pkgs/development/ocaml-modules/ocsipersist/sqlite.nix
+++ b/pkgs/development/ocaml-modules/ocsipersist/sqlite.nix
@ -0,0 +1,23 @@
+{ buildDunePackage, ocsipersist-lib
+, lwt_log
+, ocaml_sqlite3
+, ocsigen_server
+, xml-light
+}:
+
+buildDunePackage {
+  pname = "ocsipersist-sqlite";
+  inherit (ocsipersist-lib) version src useDune2;
+
+  propagatedBuildInputs = [
+    lwt_log
+    ocaml_sqlite3
+    ocsigen_server
+    ocsipersist-lib
+    xml-light
+  ];
+
+  meta = ocsipersist-lib.meta // {
+    description = "Persistent key/value storage (for Ocsigen) using SQLite";
+  };
+}
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.6.1";
+  version = "1.6.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "v${version}";
-    sha256 = "sha256-NpPVA+fruI/xX0KMjRuRuMK8HYc/0ErbDhJOCNXKhyY=";
+    sha256 = "sha256-1YROdQvwfV5Wp7vsNYCy2X6yR6mplunchD0U4xGUNBc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hachoir/default.nix
+++ b/pkgs/development/python-modules/hachoir/default.nix
@ -3,17 +3,21 @@
 , fetchFromGitHub
 , pytestCheckHook
 , urwid
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "hachoir";
-  version = "3.1.2";
+  version = "3.1.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "vstinner";
    repo = pname;
    rev = version;
-    sha256 = "06544qmmimvaznwcjs8wwfih1frdd7anwcw5z07cf69l8p146p0y";
+    hash = "sha256-HlxDwkU0GccO+IUzbtVpLbsAo+Mcacm4/WrXWCsmpBg=";
  };

  propagatedBuildInputs = [
@ -24,7 +28,9 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "hachoir" ];
+  pythonImportsCheck = [
+    "hachoir"
+  ];

  meta = with lib; {
    description = "Python library to view and edit a binary stream";
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "1.0.4";
+  version = "1.0.5";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = version;
-    sha256 = "sha256-YpsZKhuK3IzUZFNmBToBOuUacaDgbMC/N7pZDjuSzbE=";
+    sha256 = "sha256-8iLQpNax0xgjf+vUo6OcXMF1aZuaRFZBos8EC1gJEPA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/md-toc/default.nix
+++ b/pkgs/development/python-modules/md-toc/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "md-toc";
-  version = "8.1.1";
+  version = "8.1.2";
  format = "setuptools";

  disabled = pythonOlder "3.5";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "frnmst";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Dlqia+B7WJZlFGlIhgUWdND1qhSS/FOPoFH+uim6i8I=";
+    sha256 = "sha256-EmhCZhxUCzBMqScPeawvcWmP9rrthow1vhTZachjCDI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pex";
-  version = "2.1.75";
+  version = "2.1.76";
  format = "flit";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-G5JE4/ZWZYo8Fpy3ZhIaWNzGfEkWb9qA9vL3UVTqf0Q=";
+    hash = "sha256-a/e0tz67QR7SSYQRt3tJqgCGJLn6oi0+3HMpg8NKRH8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyvesync/default.nix
+++ b/pkgs/development/python-modules/pyvesync/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pyvesync";
-  version = "2.0.0";
+  version = "2.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-+054tFirjMF3sGLRpTVCZ3V2KN627b57+fFl6GBMMcU=";
+    sha256 = "sha256-7eGsRy8S6IZQ+UVNN8SoS7tBIYLlujSFr2qFldaxtJE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "sqlmap";
-  version = "1.6.3";
+  version = "1.6.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-W/UdJPLcFOEHHz7VYeQ3CcXysNju5DuxqvYA+xMkb20=";
+    sha256 = "sha256-6RKJ5a8Yl+SnWgdfrTIwY0m1JyY6W9fhZk6pTZiBVx8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "typed-settings";
-  version = "1.0.0";
+  version = "1.0.1";
  format = "pyproject";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-c+iOb1F8+9IoRbwpMTdyDfOPW2ZEo4xDAlbzLAxgSfk=";
+    sha256 = "sha256-xrIJgQiAaSXcANMnyXMnqEkLNUP+VyxjRoi9DkX+SLA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@ -27,7 +27,7 @@

 buildPythonPackage rec {
  pname = "weasyprint";
-  version = "54.2";
+  version = "54.3";
  disabled = !isPy3k;

  format = "pyproject";
@ -35,7 +35,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "weasyprint";
-    sha256 = "sha256-1eiqguPiokd6RUPwZG2fsUCAybo0oIWXUesjdXzABGY=";
+    sha256 = "sha256-4E2gQGMFZsRMqiAgM/B/hYdl9TZwkEWoCXOfPQSOidY=";
  };

  patches = [
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,13 +32,13 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.988";
+  version = "2.0.1034";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-0/SL20N5d/oqWdyvVMZ+pzpPbehrYepaPi8P8SS8DSA=";
+    hash = "sha256-amSgg/6yYaLKzwkO7dq06zvh4744RyTVhd/tdurHKa4=";
  };

  nativeBuildInputs = with py.pkgs; [
@ -94,7 +94,8 @@ buildPythonApplication rec {
  postPatch = ''
    substituteInPlace setup.py \
      --replace "cyclonedx-python-lib>=0.11.0,<1.0.0" "cyclonedx-python-lib>=0.11.0" \
-      --replace "prettytable>=3.0.0" "prettytable"
+      --replace "prettytable>=3.0.0" "prettytable" \
+      --replace "pycep-parser==0.3.3" "pycep-parser"
  '';

  preCheck = ''
@ -114,6 +115,8 @@ buildPythonApplication rec {
    "test_skipped_check_exists"
    # AssertionError: 0 not greater than 0
    "test_skip_mapping_default"
+    # Test is failing
+    "test_SQLServerAuditingEnabled"
  ];

  disabledTestPaths = [
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@ -3,16 +3,16 @@
  nixosTests }:
 buildGoModule rec {
  pname = "buildkite-agent";
-  version = "3.34.1";
+  version = "3.35.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    rev = "v${version}";
-    sha256 = "sha256-OxZcMPJx83hBQOe4Pc8ERhO9QOc4euVVs+OMbPjA4U0=";
+    sha256 = "sha256-Ql6Oe58a5z4UhANDVRGwcmwVgrCfkRKyN5DVXPshf3w=";
  };

-  vendorSha256 = "sha256-n3XRxpEKjHf7L7fcGscWTVKBtot9waZbLoS9cG0kHfI=";
+  vendorSha256 = "sha256-YnOOJDzdirikFbS9451A/TWOSWv04QsqO68/cSXK82k=";

  postPatch = ''
    substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
@ -46,7 +46,7 @@ buildGoModule rec {
    '';
    homepage = "https://buildkite.com/docs/agent";
    license = licenses.mit;
-    maintainers = with maintainers; [ pawelpacana zimbatm rvl ];
+    maintainers = with maintainers; [ pawelpacana zimbatm rvl techknowlogick ];
    platforms = with platforms; unix ++ darwin;
  };
 }
--- a/pkgs/development/tools/misc/gef/default.nix
+++ b/pkgs/development/tools/misc/gef/default.nix
@ -4,6 +4,7 @@
 , makeWrapper
 , gdb
 , python3
+, bintools-unwrapped
 , file
 , ps
 , git
@ -39,7 +40,12 @@ in stdenv.mkDerivation rec {
    makeWrapper ${gdb}/bin/gdb $out/bin/gef \
      --add-flags "-q -x $out/share/gef/gef.py" \
      --set NIX_PYTHONPATH ${pythonPath} \
-      --prefix PATH : ${lib.makeBinPath [ python3 file ps ]}
+      --prefix PATH : ${lib.makeBinPath [
+        python3
+        bintools-unwrapped # for readelf
+        file
+        ps
+      ]}
  '';

  checkInputs = [
--- a/pkgs/development/tools/neil/default.nix
+++ b/pkgs/development/tools/neil/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "neil";
-  version = "0.0.13";
+  version = "0.0.23";

  src = fetchFromGitHub {
    owner = "babashka";
    repo = "neil";
    rev = "v${version}";
-    sha256 = "0jiyl0d39d8kk5bpangwxiy90vqipj4lgp8x84rh4z5m53knjpkd";
+    sha256 = "0fx34gkhkklzq3hzk1cj2l4rgqrq9vif5y8b0nx9gg4136yj85cg";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/phantomjs2/default.nix
+++ b/pkgs/development/tools/phantomjs2/default.nix
@ -25,11 +25,10 @@ in stdenv.mkDerivation rec {
    sha256 = "1zsbpk1sgh9a16f1a5nx3qvk77ibjn812wqkxqck8n6fia85m5iq";
  };

-  nativeBuildInputs = [ qmake ];
+  nativeBuildInputs = [ qmake makeWrapper ];
  buildInputs = [
    bison flex fontconfig freetype gperf icu openssl
    libjpeg libpng perl python2 ruby sqlite qtwebkit qtbase
-    makeWrapper
  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
    AGL ApplicationServices AppKit Cocoa OpenGL
    darwin.libobjc fakeClang cups
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "skaffold";
-  version = "1.37.0";
+  version = "1.37.1";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "skaffold";
    rev = "v${version}";
-    sha256 = "sha256-mS+q+WOdEMMHjoqoIlDOqkoaRRLlou7FbMjC436k96A=";
+    sha256 = "sha256-hcP0BGzPQoYGvK+5Ro9Ts5882JhQYRT63mdTJbXhnzg=";
  };

  vendorSha256 = "sha256-LiNnTAI7iJkWL657eBw5OsCdvgWE2ZFZ3e+8vJtMhoE=";
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@ -10,6 +10,7 @@
 , installShellFiles
 , makeWrapper
 , fuse-overlayfs
+, dockerTools
 }:

 buildGoModule rec {
@ -53,6 +54,10 @@ buildGoModule rec {
    runHook postInstall
  '';

+  passthru.tests = {
+    inherit (dockerTools.examples) testNixFromDockerHub;
+  };
+
  meta = with lib; {
    description = "A command line utility for various operations on container images and image repositories";
    homepage = "https://github.com/containers/skopeo";
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@ -41,8 +41,12 @@ stdenv.mkDerivation rec {
    sha256 = "1g1w0s9d8mfld8abrn405ll5grv3xgs0b0hsganrz6qafdq9j7q1";
  };

-  buildInputs = [
+  nativeBuildInputs = [
    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
    # pam_usb dependencies
    dbus libxml2 pam pmount pkg-config
    # pam_usb's tools dependencies
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@ -13,8 +13,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-p273O5JLFX1dA2caV3lVVL9YNTcGMSrC7DWieUfUmqI=";
  };

-  buildInputs = [
+  nativeBuildInputs = [
    makeWrapper
+  ];
+
+  buildInputs = [
    which
    coreutils
    rrdtool
--- a/pkgs/servers/owncast/default.nix
+++ b/pkgs/servers/owncast/default.nix
@ -15,7 +15,7 @@ buildGoModule rec {

  propagatedBuildInputs = [ ffmpeg ];

-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

  preInstall = ''
    mkdir -p $out
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@ -18,10 +18,10 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    autoreconfHook
+    makeWrapper
  ];

  buildInputs = [
-    makeWrapper
    perl
    (buildEnv {
      name = "rt-perl-deps";
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@ -13,6 +13,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    autoreconfHook
+    makeWrapper
    pkg-config
  ];

@ -22,7 +23,6 @@ stdenv.mkDerivation rec {
    libSM
    libstartup_notification
    libxml2
-    makeWrapper
    openbox
  ];

--- a/pkgs/tools/misc/kisslicer/default.nix
+++ b/pkgs/tools/misc/kisslicer/default.nix
@ -27,8 +27,11 @@ stdenv.mkDerivation rec {
    stripRoot = false;
  };

-  buildInputs = [
+  nativeBuildInputs = [
    makeWrapper
+  ];
+
+  buildInputs = [
    libGLU libGL
    libX11
  ];
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@ -26,8 +26,12 @@ let this = stdenv.mkDerivation rec {
  dontStrip         = true;
  dontPatchShebangs = true;

+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
  buildInputs = [
-    makeWrapper jre
+    jre
  ];

  installPhase = ''
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@ -41,8 +41,11 @@ let
    dontStrip = true;
    dontPatchShebangs = true;

-    buildInputs = [
+    nativeBuildInputs = [
      makeWrapper
+    ];
+
+    buildInputs = [
      jre
    ];

--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -68,6 +68,17 @@ in lib.makeExtensible (self: {
  nix_2_7 = common {
    version = "2.7.0";
    sha256 = "sha256-m8tqCS6uHveDon5GSro5yZor9H+sHeh+v/veF1IGw24=";
+    patches = [
+      # remove when there's a 2.7.1 release
+      # https://github.com/NixOS/nix/pull/6297
+      # https://github.com/NixOS/nix/issues/6243
+      # https://github.com/NixOS/nixpkgs/issues/163374
+      (fetchpatch {
+        url = "https://github.com/NixOS/nix/commit/c9afca59e87afe7d716101e6a75565b4f4b631f7.patch";
+        sha256 = "sha256-xz7QnWVCI12lX1+K/Zr9UpB93b10t1HS9y/5n5FYf8Q=";
+      })
+    ];
+
  };

  stable = self.nix_2_7;
--- a/pkgs/tools/security/aeskeyfind/default.nix
+++ b/pkgs/tools/security/aeskeyfind/default.nix
@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "aeskeyfind";
+  version = "1.0";
+
+  src = fetchurl {
+    url = "https://citpsite.s3.amazonaws.com/memory-content/src/aeskeyfind-${version}.tar.gz";
+    sha256 = "sha256-FBflwbYehruVJ9sfW+4ZlaDuqCR12zy8iA4Ev3Bgg+Q=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp aeskeyfind $out/bin
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Locates 128-bit and 256-bit AES keys in a captured memory image";
+    homepage = "https://citp.princeton.edu/our-work/memory/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fedx-sudo ];
+  };
+
+}
+
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -202,6 +202,8 @@ with pkgs;

  aesfix = callPackage ../tools/security/aesfix { };

+  aeskeyfind = callPackage ../tools/security/aeskeyfind { };
+
  astrolog = callPackage ../applications/science/astronomy/astrolog { };

  atkinson-hyperlegible = callPackage ../data/fonts/atkinson-hyperlegible { };
@ -23376,7 +23378,6 @@ with pkgs;
    withCryptsetup = true;
    withFido2 = true;
    withTpm2Tss = true;
-    inherit libfido2 p11-kit;
  };
  systemdStage1Network = systemdStage1.override {
    pname = "systemd-stage-1-network";
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -982,6 +982,14 @@ let

    ocsigen-toolkit = callPackage ../development/ocaml-modules/ocsigen-toolkit { };

+    ocsipersist = callPackage ../development/ocaml-modules/ocsipersist {};
+
+    ocsipersist-lib = callPackage ../development/ocaml-modules/ocsipersist/lib.nix { };
+
+    ocsipersist-pgsql = callPackage ../development/ocaml-modules/ocsipersist/pgsql.nix { };
+
+    ocsipersist-sqlite = callPackage ../development/ocaml-modules/ocsipersist/sqlite.nix { };
+
    octavius = callPackage ../development/ocaml-modules/octavius { };

    odate = callPackage ../development/ocaml-modules/odate { };