Merge master into staging-next

doc/builders/images/dockertools.section.md

@@ -20,7 +20,12 @@ buildImage {
   fromImageName = null;
   fromImageTag = "latest";
 
-  contents = pkgs.redis;
+  copyToRoot = pkgs.buildEnv {
+    name = "image-root";
+    paths = [ pkgs.redis ];
+    pathsToLink = [ "/bin" ];
+  };
+
   runAsRoot = ''
     #!${pkgs.runtimeShell}
     mkdir -p /data
@@ -46,7 +51,7 @@ The above example will build a Docker image `redis/latest` from the given base i
 
 - `fromImageTag` can be used to further specify the tag of the base image within the repository, in case an image contains multiple tags. By default it's `null`, in which case `buildImage` will peek the first tag available for the base image.
 
-- `contents` is a derivation that will be copied in the new layer of the resulting image. This can be similarly seen as `ADD contents/ /` in a `Dockerfile`. By default it's `null`.
+- `copyToRoot` is a derivation that will be copied in the new layer of the resulting image. This can be similarly seen as `ADD contents/ /` in a `Dockerfile`. By default it's `null`.
 
 - `runAsRoot` is a bash script that will run as root in an environment that overlays the existing layers of the base image with the new resulting layer, including the previously copied `contents` derivation. This can be similarly seen as `RUN ...` in a `Dockerfile`.
 
@@ -81,7 +86,11 @@ pkgs.dockerTools.buildImage {
   name = "hello";
   tag = "latest";
   created = "now";
-  contents = pkgs.hello;
+  copyToRoot = pkgs.buildEnv {
+    name = "image-root";
+    paths = [ pkgs.hello ];
+    pathsToLink = [ "/bin" ];
+  };
 
   config.Cmd = [ "/bin/hello" ];
 }

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -303,6 +303,15 @@
           and require manual remediation.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>dockerTools.buildImage</literal> deprecates the
+          misunderstood <literal>contents</literal> parameter, in favor
+          of <literal>copyToRoot</literal>. Use
+          <literal>copyToRoot = buildEnv { ... };</literal> or similar
+          if you intend to add packages to <literal>/bin</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2.

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -114,6 +114,9 @@ Use `configure.packages` instead.
 
 - Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.
 
+- `dockerTools.buildImage` deprecates the misunderstood `contents` parameter, in favor of `copyToRoot`.
+  Use `copyToRoot = buildEnv { ... };` or similar if you intend to add packages to `/bin`.
+
 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.
 
 - Add udev rules for the Teensy family of microcontrollers.

nixos/tests/docker-tools-cross.nix

@@ -24,7 +24,11 @@ let
   hello1 = remoteCrossPkgs.dockerTools.buildImage {
     name = "hello1";
     tag = "latest";
-    contents = remoteCrossPkgs.hello;
+    copyToRoot = remoteCrossPkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ remoteCrossPkgs.hello ];
+    };
   };
 
   hello2 = remoteCrossPkgs.dockerTools.buildLayeredImage {

pkgs/applications/audio/pyradio/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.8.9.21";
+  version = "0.8.9.22";
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-uaQG840R4twPkE3GYLpcF0MHVH5JaLn5CSAd1DrNOvQ=";
+    sha256 = "sha256-QBgXg2SNEQX1ngY+cEWqStC0zsFZ0Er81tuhTszbHWM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/misc/logseq/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "sha256-uMlvpEEzanJ3zTEZKNE2zEfqvGC4IWL97b0AkTfwZeU=";
+    sha256 = "sha256-3YCO0pQT5vUkscQEE4+XrfEkQJro8DpQ5xDLglfqJjI=";
     name = "${pname}-${version}.AppImage";
   };
 

pkgs/applications/networking/cluster/arkade/default.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.28";
+  version = "0.8.29";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-Tw/FxrmBpC+FDvfvDT1xQtcQwlxUpQHDMzTs3TrugYg=";
+    sha256 = "sha256-VCscevLGRpBgqxhRNcvIkCdroE0MawG1fROVOLjZLW0=";
   };
 
   CGO_ENABLED = 0;
 
-  vendorSha256 = "sha256-E+fjDW7UIAYDiDI8Eb8atAtccEIRcV5hqYdSxRYM9fc=";
+  vendorSha256 = "sha256-CoIlqDMmhZY+B5SEabmnbP2QUu1jkFluCzLp3Y8Z7n0=";
 
   # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
   subPackages = [

pkgs/applications/networking/cluster/cmctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    sha256 = "sha256-IR+z3+f9Pa7wQAP4EVya7fb7FnndaUY7F2ckTzpEuCA=";
+    sha256 = "sha256-sfC1acnCrcQ4A1tXXcjh47Af6xeJqjdGXy0gK21ZSFg=";
   };
 
   vendorSha256 = "sha256-UYw9WdQ6VwzuuiOsa1yovkLZG7NmLYSW51p8UhmQMeI=";

pkgs/applications/office/autokey/default.nix

@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   # Tests appear to be broken with import errors within the project structure
   doCheck = false;
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   buildInputs = [
     gobject-introspection
@@ -38,19 +38,9 @@ python3Packages.buildPythonApplication rec {
     pygobject3
   ];
 
-  dontWrapGapps = true;
-
-  pythonPath = with python3Packages; requiredPythonModules [ dbus-python xlib pygobject3 ];
-
   postInstall = ''
-    rm $out/bin/autokey-qt
-    buildPythonPath "$out $pythonPath"
-    makeWrapperArgs+=(
-      "''${gappsWrapperArgs[@]}"
-      # for autokey-shell ModuleNotFoundError: No module named 'autokey'
-      --prefix "PYTHONPATH" ":" "$out/lib/${python3Packages.python.libPrefix}/site-packages"
-      --prefix "PYTHONPATH" ":" "$program_PYTHONPATH"
-    )
+    # remove Qt version which we currently do not support
+    rm $out/bin/autokey-qt $out/share/applications/autokey-qt.desktop
   '';
 
   meta = {

pkgs/applications/science/electronics/gtkwave/0001-Fix-detection-of-quartz-in-gdk-3.0-target.patch

@@ -0,0 +1,40 @@
+From 69a6ab80cf0908c2a44430c297932ef3659a1655 Mon Sep 17 00:00:00 2001
+From: Jiajie Chen <c@jia.je>
+Date: Wed, 22 Jun 2022 16:24:10 +0800
+Subject: [PATCH 1/2] Fix detection of quartz in gdk-3.0 target
+
+The GTK+3 built by Nix targets ``broadway quartz`` instead of only `quartz`,
+thus the target check is wrong. The script is modified to look up `quartz` in a
+loop. The variable name is renamed to `targets` in `gdk-3.0.pc` as well.
+
+---
+ configure | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index 628a80f..9cb88d5 100755
+--- a/configure
++++ b/configure
+@@ -7361,7 +7361,10 @@ $as_echo "yes" >&6; }
+ fi
+         GTK_VER=`$PKG_CONFIG gtk+-3.0 --modversion`
+ 
+-        _gdk_tgt=`$PKG_CONFIG --variable=target gdk-3.0`
++        # gdk-3.0 may have multiple targets e.g. "broadway quartz"
++        _gdk_tgts=`$PKG_CONFIG --variable=targets gdk-3.0`
++        for _gdk_tgt in $_gdk_tgts;
++        do
+         if test "x$_gdk_tgt" = xquartz; then
+ 
+ pkg_failed=no
+@@ -7466,6 +7469,7 @@ fi
+            COCOA_GTK_LDFLAGS="-framework Cocoa -framework ApplicationServices"
+ 
+         fi
++        done
+ 
+         if test x$with_gconf = xyes; then
+ 
+-- 
+2.36.1
+

pkgs/applications/science/electronics/gtkwave/0002-Check-GDK_WINDOWING_X11-macro-when-using-GtkPlug.patch

@@ -0,0 +1,101 @@
+From 6045177a0d4753bb7a6a6ffc3f1a4a3e96129c6d Mon Sep 17 00:00:00 2001
+From: Jiajie Chen <c@jia.je>
+Date: Wed, 22 Jun 2022 17:03:29 +0800
+Subject: [PATCH 2/2] Check GDK_WINDOWING_X11 macro when using GtkPlug
+
+---
+ src/main.c     |  5 +++++
+ src/twinwave.c | 12 ++++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/main.c b/src/main.c
+index 81bf505..b89f629 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -2080,10 +2080,15 @@ if(!GLOBALS->socket_xid)
+ #ifdef WAVE_USE_XID
+ 	else
+ 	{
++#ifdef GDK_WINDOWING_X11
+         GLOBALS->mainwindow = gtk_plug_new(GLOBALS->socket_xid);
+         gtk_widget_show(GLOBALS->mainwindow);
+ 
+         g_signal_connect(XXX_GTK_OBJECT(GLOBALS->mainwindow), "destroy",   /* formerly was "destroy" */G_CALLBACK(plug_destroy),"Plug destroy");
++#else
++	fprintf(stderr, "GTKWAVE | GtkPlug widget is unavailable\n");
++	exit(1);
++#endif
+ 	}
+ #endif
+ }
+diff --git a/src/twinwave.c b/src/twinwave.c
+index 590c7f6..d5c60f2 100644
+--- a/src/twinwave.c
++++ b/src/twinwave.c
+@@ -143,15 +143,19 @@ if(GDK_IS_WAYLAND_DISPLAY(gdk_display_get_default()))
+ 	use_embedded = 0;
+ 	}
+ #endif
++#if defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ 	{
+ 	xsocket[0] = gtk_socket_new ();
+ 	xsocket[1] = gtk_socket_new ();
+ 	gtk_widget_show (xsocket[0]);
+ 	gtk_widget_show (xsocket[1]);
+ 	}
++#endif
+ 
++#if defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ if(!twinwayland)
+ g_signal_connect(XXX_GTK_OBJECT(xsocket[0]), "plug-removed", G_CALLBACK(plug_removed), NULL);
++#endif
+ 
+ #if GTK_CHECK_VERSION(3,0,0)
+ main_vbox = gtk_box_new(GTK_ORIENTATION_VERTICAL, 5);
+@@ -208,7 +212,7 @@ if(hMapFile != NULL)
+ 				memset(&pi, 0, sizeof(PROCESS_INFORMATION));
+ 
+ 				sprintf(buf, "0+%08X", shmid);
+-#ifdef MINGW_USE_XID
++#if defined(MINGW_USE_XID) && defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ 				sprintf(buf2, "%x", gtk_socket_get_id (GTK_SOCKET(xsocket[0])));
+ #else
+ 				sprintf(buf2, "%x", 0);
+@@ -279,7 +283,7 @@ if(hMapFile != NULL)
+ 				memset(&pi, 0, sizeof(PROCESS_INFORMATION));
+ 
+ 				sprintf(buf, "1+%08X", shmid);
+-#ifdef MINGW_USE_XID
++#if defined(MINGW_USE_XID) && defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ 				sprintf(buf2, "%x", gtk_socket_get_id (GTK_SOCKET(xsocket[1])));
+ #else
+ 				sprintf(buf2, "%x", 0);
+@@ -429,10 +433,12 @@ if(shmid >=0)
+ 				sprintf(buf, "0+%08X", shmid);
+ 				if(use_embedded)
+ 					{
++#if defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ #ifdef MAC_INTEGRATION
+ 					sprintf(buf2, "%x", gtk_socket_get_id (GTK_SOCKET(xsocket[0])));
+ #else
+ 					sprintf(buf2, "%lx", (long)gtk_socket_get_id (GTK_SOCKET(xsocket[0])));
++#endif
+ #endif
+ 					}
+ 					else
+@@ -467,10 +473,12 @@ if(shmid >=0)
+ 			sprintf(buf, "1+%08X", shmid);
+ 			if(use_embedded)
+ 				{
++#if defined(__GTK_SOCKET_H__) && defined(GDK_WINDOWING_X11)
+ #ifdef MAC_INTEGRATION
+ 				sprintf(buf2, "%x", gtk_socket_get_id (GTK_SOCKET(xsocket[1])));
+ #else
+ 				sprintf(buf2, "%lx", (long)gtk_socket_get_id (GTK_SOCKET(xsocket[1])));
++#endif
+ #endif
+ 				}
+ 				else
+-- 
+2.36.1
+

pkgs/applications/science/electronics/gtkwave/default.nix

@@ -3,6 +3,7 @@
 , glib
 , gperf
 , gtk3
+, gtk-mac-integration
 , judy
 , lib
 , pkg-config
@@ -23,7 +24,16 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-  buildInputs = [ bzip2 glib gperf gtk3 judy tcl tk xz ];
+  buildInputs = [ bzip2 glib gperf gtk3 judy tcl tk xz ]
+    ++ lib.optional stdenv.isDarwin gtk-mac-integration;
+
+  # fix compilation under Darwin
+  # remove these patches upon next release
+  # https://github.com/gtkwave/gtkwave/pull/136
+  patches = [
+    ./0001-Fix-detection-of-quartz-in-gdk-3.0-target.patch
+    ./0002-Check-GDK_WINDOWING_X11-macro-when-using-GtkPlug.patch
+  ];
 
   configureFlags = [
     "--with-tcl=${tcl}/lib"
@@ -36,7 +46,7 @@ stdenv.mkDerivation rec {
     description = "VCD/Waveform viewer for Unix and Win32";
     homepage = "http://gtkwave.sourceforge.net";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ thoughtpolice ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ thoughtpolice jiegec ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }

pkgs/build-support/docker/default.nix

@@ -332,7 +332,7 @@ rec {
     , # JSON containing configuration and metadata for this layer.
       baseJson
     , # Files to add to the layer.
-      contents ? null
+      copyToRoot ? null
     , # When copying the contents into the image, preserve symlinks to
       # directories (see `rsync -K`).  Otherwise, transform those symlinks
       # into directories.
@@ -344,7 +344,8 @@ rec {
     }:
     runCommand "docker-layer-${name}"
       {
-        inherit baseJson contents extraCommands;
+        inherit baseJson extraCommands;
+        contents = copyToRoot;
         nativeBuildInputs = [ jshon rsync tarsum ];
       }
       ''
@@ -390,7 +391,8 @@ rec {
     , # Script to run as root. Bash.
       runAsRoot
     , # Files to add to the layer. If null, an empty layer will be created.
-      contents ? null
+      # To add packages to /bin, use `buildEnv` or similar.
+      copyToRoot ? null
     , # When copying the contents into the image, preserve symlinks to
       # directories (see `rsync -K`).  Otherwise, transform those symlinks
       # into directories.
@@ -418,9 +420,9 @@ rec {
 
       inherit fromImage fromImageName fromImageTag diskSize;
 
-      preMount = lib.optionalString (contents != null && contents != [ ]) ''
+      preMount = lib.optionalString (copyToRoot != null && copyToRoot != [ ]) ''
         echo "Adding contents..."
-        for item in ${escapeShellArgs (map (c: "${c}") (toList contents))}; do
+        for item in ${escapeShellArgs (map (c: "${c}") (toList copyToRoot))}; do
           echo "Adding $item..."
           rsync -a${if keepContentsDirlinks then "K" else "k"} --chown=0:0 $item/ layer/
         done
@@ -500,7 +502,7 @@ rec {
     , # Tag of the parent image; will be read from the image otherwise.
       fromImageTag ? null
     , # Files to put on the image (a nix store path or list of paths).
-      contents ? null
+      copyToRoot ? null
     , # When copying the contents into the image, preserve symlinks to
       # directories (see `rsync -K`).  Otherwise, transform those symlinks
       # into directories.
@@ -517,10 +519,20 @@ rec {
       diskSize ? 1024
     , # Time of creation of the image.
       created ? "1970-01-01T00:00:01Z"
+    , # Deprecated.
+      contents ? null
     ,
     }:
 
     let
+      checked =
+        lib.warnIf (contents != null)
+          "in docker image ${name}: The contents parameter is deprecated. Change to copyToRoot if the contents are designed to be copied to the root filesystem, such as when you use `buildEnv` or similar between contents and your packages. Use copyToRoot = buildEnv { ... }; or similar if you intend to add packages to /bin."
+        lib.throwIf (contents != null && copyToRoot != null) "in docker image ${name}: You can not specify both contents and copyToRoot."
+        ;
+
+      rootContents = if copyToRoot == null then contents else copyToRoot;
+
       baseName = baseNameOf name;
 
       # Create a JSON blob of the configuration. Set the date to unix zero.
@@ -545,13 +557,15 @@ rec {
           mkPureLayer
             {
               name = baseName;
-              inherit baseJson contents keepContentsDirlinks extraCommands uid gid;
+              inherit baseJson keepContentsDirlinks extraCommands uid gid;
+              copyToRoot = rootContents;
             } else
           mkRootLayer {
             name = baseName;
             inherit baseJson fromImage fromImageName fromImageTag
-              contents keepContentsDirlinks runAsRoot diskSize
+              keepContentsDirlinks runAsRoot diskSize
               extraCommands;
+            copyToRoot = rootContents;
           };
       result = runCommand "docker-image-${baseName}.tar.gz"
         {
@@ -715,7 +729,7 @@ rec {
       '';
 
     in
-    result;
+    checked result;
 
   # Merge the tarballs of images built with buildImage into a single
   # tarball that contains all images. Running `docker load` on the resulting
@@ -776,12 +790,14 @@ rec {
   # contents. The main purpose is to be able to use nix commands in
   # the container.
   # Be careful since this doesn't work well with multilayer.
-  buildImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }: (
+  # TODO: add the dependencies of the config json.
+  buildImageWithNixDb = args@{ copyToRoot ? contents, contents ? null, extraCommands ? "", ... }: (
     buildImage (args // {
-      extraCommands = (mkDbExtraCommand contents) + extraCommands;
+      extraCommands = (mkDbExtraCommand copyToRoot) + extraCommands;
     })
   );
 
+  # TODO: add the dependencies of the config json.
   buildLayeredImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }: (
     buildLayeredImage (args // {
       extraCommands = (mkDbExtraCommand contents) + extraCommands;

pkgs/build-support/docker/examples.nix

@@ -24,7 +24,11 @@ rec {
   bash = buildImage {
     name = "bash";
     tag = "latest";
-    contents = pkgs.bashInteractive;
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      paths = [ pkgs.bashInteractive ];
+      pathsToLink = [ "/bin" ];
+    };
   };
 
   # 2. service example, layered on another image
@@ -36,7 +40,12 @@ rec {
     fromImage = bash;
     # fromImage = debian;
 
-    contents = pkgs.redis;
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      paths = [ pkgs.redis ];
+      pathsToLink = [ "/bin" ];
+    };
+
     runAsRoot = ''
       mkdir -p /data
     '';
@@ -118,13 +127,17 @@ rec {
   # 5. example of multiple contents, emacs and vi happily coexisting
   editors = buildImage {
     name = "editors";
-    contents = [
-      pkgs.coreutils
-      pkgs.bash
-      pkgs.emacs
-      pkgs.vim
-      pkgs.nano
-    ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [
+        pkgs.coreutils
+        pkgs.bash
+        pkgs.emacs
+        pkgs.vim
+        pkgs.nano
+      ];
+    };
   };
 
   # 6. nix example to play with the container nix store
@@ -132,13 +145,17 @@ rec {
   nix = buildImageWithNixDb {
     name = "nix";
     tag = "latest";
-    contents = [
-      # nix-store uses cat program to display results as specified by
-      # the image env variable NIX_PAGER.
-      pkgs.coreutils
-      pkgs.nix
-      pkgs.bash
-    ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [
+        # nix-store uses cat program to display results as specified by
+        # the image env variable NIX_PAGER.
+        pkgs.coreutils
+        pkgs.nix
+        pkgs.bash
+      ];
+    };
     config = {
       Env = [
         "NIX_PAGER=cat"
@@ -155,7 +172,11 @@ rec {
     name = "onTopOfPulledImage";
     tag = "latest";
     fromImage = nixFromDockerHub;
-    contents = [ pkgs.hello ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ pkgs.hello ];
+    };
   };
 
   # 8. regression test for erroneous use of eval and string expansion.
@@ -163,7 +184,11 @@ rec {
   runAsRootExtraCommands = pkgs.dockerTools.buildImage {
     name = "runAsRootExtraCommands";
     tag = "latest";
-    contents = [ pkgs.coreutils ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ pkgs.coreutils ];
+    };
     # The parens here are to create problematic bash to embed and eval. In case
     # this is *embedded* into the script (with nix expansion) the initial quotes
     # will close the string and the following parens are unexpected
@@ -176,7 +201,11 @@ rec {
   unstableDate = pkgs.dockerTools.buildImage {
     name = "unstable-date";
     tag = "latest";
-    contents = [ pkgs.coreutils ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ pkgs.coreutils ];
+    };
     created = "now";
   };
 
@@ -265,7 +294,11 @@ rec {
     name = "l3";
     fromImage = l2;
     tag = "latest";
-    contents = [ pkgs.coreutils ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ pkgs.coreutils ];
+    };
     extraCommands = ''
       mkdir -p tmp
       echo layer3 > tmp/layer3
@@ -290,7 +323,11 @@ rec {
     name = "child";
     fromImage = environmentVariablesParent;
     tag = "latest";
-    contents = [ pkgs.coreutils ];
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ pkgs.coreutils ];
+    };
     config = {
       Env = [
         "FROM_CHILD=true"
@@ -424,7 +461,11 @@ rec {
         name = "layers-unpack-order-${layerName}";
         tag = "latest";
         fromImage = parent;
-        contents = [ pkgs.coreutils ];
+        copyToRoot = pkgs.buildEnv {
+          name = "image-root";
+          pathsToLink = [ "/bin" ];
+          paths = [ pkgs.coreutils ];
+        };
         runAsRoot = ''
           #!${pkgs.runtimeShell}
           echo -n "${layerName}" >> /layer-order
@@ -441,7 +482,8 @@ rec {
   # buildImage without explicit tag
   bashNoTag = pkgs.dockerTools.buildImage {
     name = "bash-no-tag";
-    contents = pkgs.bashInteractive;
+    # Not recommended. Use `buildEnv` between copy and packages to avoid file duplication.
+    copyToRoot = pkgs.bashInteractive;
   };
 
   # buildLayeredImage without explicit tag
@@ -501,7 +543,11 @@ rec {
   in crossPkgs.dockerTools.buildImage {
     name = "hello-cross";
     tag = "latest";
-    contents = crossPkgs.hello;
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ crossPkgs.hello ];
+    };
   };
 
   # layered image where a store path is itself a symlink
@@ -643,7 +689,8 @@ rec {
   build-image-with-path = buildImage {
     name = "build-image-with-path";
     tag = "latest";
-    contents = [ pkgs.bashInteractive ./test-dummy ];
+    # Not recommended. Use `buildEnv` between copy and packages to avoid file duplication.
+    copyToRoot = [ pkgs.bashInteractive ./test-dummy ];
   };
 
   layered-image-with-path = pkgs.dockerTools.streamLayeredImage {

pkgs/data/icons/elementary-xfce-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-xfce-icon-theme";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "shimmerproject";
     repo = "elementary-xfce";
     rev = "v${version}";
-    sha256 = "sha256-p6HQhYf+rw3obrc6e5lYqC02i4dK+5eXGwnTJj0+D+k=";
+    sha256 = "sha256-9WdVUCwHFX6wlu3++QqzV0RgTDYDnUYqK7yUl83liko=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/mate/caja/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "caja";
-  version = "1.26.0";
+  version = "1.26.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1m0ai2r8b2mvlr8bqj9n6vg1pwzlwa46fqpq206wgyx5sgxac052";
+    sha256 = "MP1ubwCjggD24uiYrX+nl4drsGDx0DQd0vc5MnnhTAc=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aresponses/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aresponses";
-  version = "2.1.5";
+  version = "2.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "CircleUp";
     repo = pname;
     rev = version;
-    sha256 = "sha256-9ZzIrj87TwxQi0YMlTHFPAp0V1oxfuL0+RMGXxUxFoE=";
+    sha256 = "sha256-Ui9ZpWaVBfCbDlZH3EgHX32FIZtyTHnc/UXqtoEyFcw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cron-descriptor/default.nix

@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "cron_descriptor";
-  version = "1.2.27";
+  version = "1.2.30";
 
   src = fetchFromGitHub {
     owner = "Salamek";
     repo = "cron-descriptor";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-ycpBbXVUl7mIPx6p4DoVq51T86Im9bkF6LQFSYUL4uk=";
+    sha256 = "sha256-Qei9f0HlIu5sautMEASvxdUqZyXKvHDWJgd3oST1gJo=";
   };
 
   # remove tests_require, as we don't do linting anyways

pkgs/development/tools/analysis/checkstyle/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.3";
+  version = "10.3.1";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-3n5gXGHznrLGL9hudk1nZs1GJ5V2qzqVPCtn1fqujB0=";
+    sha256 = "sha256-mHBCZtBvi2DxzzWckvncCXgRCZirzx1OTtx7m6kRNvc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/build-managers/bloop/default.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bloop";
-  version = "1.5.0";
+  version = "1.5.2";
 
   platform =
     if stdenv.isLinux && stdenv.isx86_64 then "x86_64-pc-linux"
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   bloop-binary = fetchurl rec {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
     sha256 =
-      if stdenv.isLinux && stdenv.isx86_64 then "sha256-jif9z05W17vjFgb146qWC3o44HmbnX05gWPlbXttYsE="
-      else if stdenv.isDarwin && stdenv.isx86_64 then "sha256-YOnXgKXsGrTu9P4I0NZW6ollZVQUXnbW8WtZTJmy+w0="
+      if stdenv.isLinux && stdenv.isx86_64 then "0dizvvkr5dw5xb3ggil2c5xi2vfcqyb46kfxnq8whbrq8pis70pi"
+      else if stdenv.isDarwin && stdenv.isx86_64 then "1a3a90ggyhfjq58wiqlxhz4djjp5crxvl822f8gzm3pjara5xpbc"
       else throw "unsupported platform";
   };
 

pkgs/development/tools/buildah/default.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.26.1";
+  version = "1.26.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "sha256-RlDvTabpW2DQHJe4wFYBBuNrkfKTYbyudoX26MyvGBQ=";
+    sha256 = "sha256-FQ0fYiQBz+Ba8Xe8PWIYpIKyWOYa+NlTNJqzBC64O6M=";
   };
 
   outputs = [ "out" "man" ];

pkgs/development/web/cypress/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cypress";
-  version = "10.0.3";
+  version = "10.2.0";
 
   src = fetchzip {
     url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "0lz9rf58dzn18yxs337sw3fia0xif039dmlmslxhlhn48g9yj67z";
+    sha256 = "y34EnCoAmV9ib72LpT7D0eUxP1h80h+rKqvrn9TfsQg=";
   };
 
   # don't remove runtime deps

pkgs/development/web/deno/default.nix

@@ -16,15 +16,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.23.2";
+  version = "1.23.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rygBiDIZ8W51GIu36+g6zFOnIvmGe+HLGZg7x/pRFJ0=";
+    sha256 = "sha256-kxQZDuqVddooYeelW3gJBbU7N/PnARj/IG7eBVJoAJ8=";
   };
-  cargoSha256 = "sha256-q7yZZXws58QuEfC0J+fZo8QyYUWx6sOKfphmIurxVkU=";
+  cargoSha256 = "sha256-bQZpE3kBqN5+lPdHWiiUQsWQwuMkvnfHLy3S1HnS4lk=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/tools/audio/dsp/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dsp";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "bmc0";
     repo = "dsp";
     rev = "v${version}";
-    sha256 = "sha256-LTgjpzAGi3oL8l5NcJj1ortKFd3vWDfXHr8YyedAxEE=";
+    sha256 = "sha256-S1pzVQ/ceNsx0vGmzdDWw2TjPVLiRgzR4edFblWsekY=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/tools/misc/foma/default.nix

@@ -11,20 +11,23 @@ stdenv.mkDerivation rec {
     sha256 = "1vf01l18j8cksnavbabcckp9gg692w6v5lg81xrzv6f5v14zp4nr";
   };
 
-  sourceRoot = "source/foma";
+  sourceRoot = "${src.name}/foma";
 
   nativeBuildInputs = [ flex bison ]
     ++ lib.optional stdenv.isDarwin darwin.cctools;
   buildInputs = [ zlib readline ];
 
   makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
+    "CC:=$(CC)"
+    "RANLIB:=$(RANLIB)"
+    "prefix=$(out)"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    "AR:=$(AR)" # libtool is used for darwin
   ];
 
   patchPhase = ''
     substituteInPlace Makefile \
-      --replace '-ltermcap' ' ' \
-      --replace '/usr/local' '$(out)'
+      --replace '-ltermcap' ' '
   '';
 
   meta = with lib; {

pkgs/tools/system/btop/default.nix

@@ -8,8 +8,8 @@
 
 stdenv.mkDerivation rec {
   pname = "btop";
-  version = "1.2.7";
-  hash = "sha256-zQpt/CEWW3oPqPo6SPuawyfLa50y6M4hL07uRO7YjLo=";
+  version = "1.2.8";
+  hash = "sha256-X+JJXv+8EIh0hjYnKkeQ3+XQ6CerHrEvPCok5DYxcwc=";
 
   src = fetchFromGitHub {
     owner = "aristocratos";