From 08aaa97b1e1b7f82d7994b8714aa57036890f199 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Oct 2022 17:22:11 +0000
Subject: [PATCH 01/27] gummy: 0.2 -> 0.3

---
 pkgs/tools/misc/gummy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/gummy/default.nix b/pkgs/tools/misc/gummy/default.nix
index defe5950a116..9d5b473c3b9c 100644
--- a/pkgs/tools/misc/gummy/default.nix
+++ b/pkgs/tools/misc/gummy/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gummy";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "fushko";
     repo = "gummy";
     rev = version;
-    sha256 = "sha256-nX5wEJ4HmgFHIgJP2MstBzQjU/9lrXOXoIl1vlolqak=";
+    sha256 = "sha256-dw2yOXTS61OIe+NOq8MPydhkZvTit13eC7cbL5nFseg=";
   };
 
   nativeBuildInputs = [

From 713369c44b1bcf17b5d2f209bb229656ce2613bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= <git@viraptor.info>
Date: Sun, 23 Oct 2022 15:23:02 +1100
Subject: [PATCH 02/27] doc/contributing: Explicitly allow trivial changes by
 non-authors

Discussed and proposed at https://discourse.nixos.org/t/rules-around-adding-to-someones-pr/22671/3
---
 doc/contributing/reviewing-contributions.chapter.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/contributing/reviewing-contributions.chapter.md b/doc/contributing/reviewing-contributions.chapter.md
index 4452695a6f38..0e6a0dd5b530 100644
--- a/doc/contributing/reviewing-contributions.chapter.md
+++ b/doc/contributing/reviewing-contributions.chapter.md
@@ -302,6 +302,12 @@ Container system, boot system and library changes are some examples of the pull
 
 It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
 
+In case the PR is stuck waiting for the original author to apply a trivial
+change (a typo, capitalisation change, etc.) and the author allowed the members
+to modify the PR, consider applying it yourself. (or commit the existing review
+suggestion) You should pay extra attention to make sure the addition doesn't go
+against the idea of the original PR and would not be opposed by the author.
+
 <!--
 The following paragraphs about how to deal with unactive contributors is just a proposition and should be modified to what the community agrees to be the right policy.
 

From a42e1ccdb30f1fc35e0a94a4b06394c6c408e401 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 23 Oct 2022 20:52:56 +0000
Subject: [PATCH 03/27] minio: 2022-10-20T00-55-09Z -> 2022-10-21T22-37-48Z

---
 pkgs/servers/minio/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 8e772ca8893c..589d166548bf 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2022-10-20T00-55-09Z";
+  version = "2022-10-21T22-37-48Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-O3+2FKAiprFucx05T9lYcA30yr9KSlDF9VEbAgH4B0E=";
+    sha256 = "sha256-kdf1V7qg/UwVASYYSAY2kfT8m+cmOnAb69FVzdzvZ5Y=";
   };
 
-  vendorSha256 = "sha256-dl+7K/Vd1ybCc1IHwITaHroeLymyk5kWqqIwmLgYYA8=";
+  vendorSha256 = "sha256-m2U2VfUBAmPMFOXhSCQCxtwWI1eFh5TLAp8Izqi8HLQ=";
 
   doCheck = false;
 

From 2c5942b26510b0e46e513c269af85386ff77610a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 23 Oct 2022 23:47:32 +0000
Subject: [PATCH 04/27] python310Packages.mailmanclient: 3.3.3 -> 3.3.4

---
 pkgs/development/python-modules/mailmanclient/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mailmanclient/default.nix b/pkgs/development/python-modules/mailmanclient/default.nix
index 7aafe6e61e81..6fcb91e542e7 100644
--- a/pkgs/development/python-modules/mailmanclient/default.nix
+++ b/pkgs/development/python-modules/mailmanclient/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "mailmanclient";
-  version = "3.3.3";
+  version = "3.3.4";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92fe624675e41f41f59de1208e0125dfaa8d062bbe6138bd7cd79e4dd0b6f85e";
+    sha256 = "sha256-0y31HXjvU/bwy0s0PcDOlrX1RdyTTnk41ceD4A0R4p4=";
   };
 
   propagatedBuildInputs = [ six httplib2 requests ];

From 50eb816d2994682b3269205b5cf7a4bdeb4a482c Mon Sep 17 00:00:00 2001
From: oxalica <oxalicc@pm.me>
Date: Tue, 18 Oct 2022 23:50:44 +0800
Subject: [PATCH 05/27] nixos/btrbk: fix ordering of subsections and refactor

---
 nixos/modules/services/backup/btrbk.nix | 104 ++++++++++++------------
 nixos/tests/all-tests.nix               |   1 +
 nixos/tests/btrbk-section-order.nix     |  51 ++++++++++++
 3 files changed, 105 insertions(+), 51 deletions(-)
 create mode 100644 nixos/tests/btrbk-section-order.nix

diff --git a/nixos/modules/services/backup/btrbk.nix b/nixos/modules/services/backup/btrbk.nix
index f1d58f597c25..b6eb68cc43f1 100644
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@@ -1,72 +1,74 @@
 { config, pkgs, lib, ... }:
 let
   inherit (lib)
+    concatLists
+    concatMap
     concatMapStringsSep
     concatStringsSep
     filterAttrs
-    flatten
     isAttrs
-    isString
     literalExpression
     mapAttrs'
     mapAttrsToList
     mkIf
     mkOption
     optionalString
-    partition
-    typeOf
+    sort
     types
     ;
 
+  # The priority of an option or section.
+  # The configurations format are order-sensitive. Pairs are added as children of
+  # the last sections if possible, otherwise, they start a new section.
+  # We sort them in topological order:
+  # 1. Leaf pairs.
+  # 2. Sections that may contain (1).
+  # 3. Sections that may contain (1) or (2).
+  # 4. Etc.
+  prioOf = { name, value }:
+    if !isAttrs value then 0 # Leaf options.
+    else {
+      target = 1; # Contains: options.
+      subvolume = 2; # Contains: options, target.
+      volume = 3; # Contains: options, target, subvolume.
+    }.${name} or (throw "Unknow section '${name}'");
+
+  genConfig' = set: concatStringsSep "\n" (genConfig set);
+  genConfig = set:
+    let
+      pairs = mapAttrsToList (name: value: { inherit name value; }) set;
+      sortedPairs = sort (a: b: prioOf a < prioOf b) pairs;
+    in
+      concatMap genPair sortedPairs;
+  genSection = sec: secName: value:
+    [ "${sec} ${secName}" ] ++ map (x: " " + x) (genConfig value);
+  genPair = { name, value }:
+    if !isAttrs value
+    then [ "${name} ${value}" ]
+    else concatLists (mapAttrsToList (genSection name) value);
+
+  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
+
+  mkConfigFile = name: settings: pkgs.writeTextFile {
+    name = "btrbk-${name}.conf";
+    text = genConfig' (addDefaults settings);
+    checkPhase = ''
+      set +e
+      ${pkgs.btrbk}/bin/btrbk -c $out dryrun
+      # According to btrbk(1), exit status 2 means parse error
+      # for CLI options or the config file.
+      if [[ $? == 2 ]]; then
+        echo "Btrbk configuration is invalid:"
+        cat $out
+        exit 1
+      fi
+      set -e
+    '';
+  };
+
   cfg = config.services.btrbk;
   sshEnabled = cfg.sshAccess != [ ];
   serviceEnabled = cfg.instances != { };
-  attr2Lines = attr:
-    let
-      pairs = mapAttrsToList (name: value: { inherit name value; }) attr;
-      isSubsection = value:
-        if isAttrs value then true
-        else if isString value then false
-        else throw "invalid type in btrbk config ${typeOf value}";
-      sortedPairs = partition (x: isSubsection x.value) pairs;
-    in
-    flatten (
-      # non subsections go first
-      (
-        map (pair: [ "${pair.name} ${pair.value}" ]) sortedPairs.wrong
-      )
-      ++ # subsections go last
-      (
-        map
-          (
-            pair:
-            mapAttrsToList
-              (
-                childname: value:
-                  [ "${pair.name} ${childname}" ] ++ (map (x: " " + x) (attr2Lines value))
-              )
-              pair.value
-          )
-          sortedPairs.right
-      )
-    )
-  ;
-  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
-  mkConfigFile = settings: concatStringsSep "\n" (attr2Lines (addDefaults settings));
-  mkTestedConfigFile = name: settings:
-    let
-      configFile = pkgs.writeText "btrbk-${name}.conf" (mkConfigFile settings);
-    in
-    pkgs.runCommand "btrbk-${name}-tested.conf" { } ''
-      mkdir foo
-      cp ${configFile} $out
-      if (set +o pipefail; ${pkgs.btrbk}/bin/btrbk -c $out ls foo 2>&1 | grep $out);
-      then
-      echo btrbk configuration is invalid
-      cat $out
-      exit 1
-      fi;
-    '';
 in
 {
   meta.maintainers = with lib.maintainers; [ oxalica ];
@@ -196,7 +198,7 @@ in
       (
         name: instance: {
           name = "btrbk/${name}.conf";
-          value.source = mkTestedConfigFile name instance.settings;
+          value.source = mkConfigFile name instance.settings;
         }
       )
       cfg.instances;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index aa584e95db19..8f404b2d1d65 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -102,6 +102,7 @@ in {
   brscan5 = handleTest ./brscan5.nix {};
   btrbk = handleTest ./btrbk.nix {};
   btrbk-no-timer = handleTest ./btrbk-no-timer.nix {};
+  btrbk-section-order = handleTest ./btrbk-section-order.nix {};
   buildbot = handleTest ./buildbot.nix {};
   buildkite-agents = handleTest ./buildkite-agents.nix {};
   caddy = handleTest ./caddy.nix {};
diff --git a/nixos/tests/btrbk-section-order.nix b/nixos/tests/btrbk-section-order.nix
new file mode 100644
index 000000000000..20f1afcf80ec
--- /dev/null
+++ b/nixos/tests/btrbk-section-order.nix
@@ -0,0 +1,51 @@
+# This tests validates the order of generated sections that may contain
+# other sections.
+# When a `volume` section has both `subvolume` and `target` children,
+# `target` must go before `subvolume`. Otherwise, `target` will become
+# a child of the last `subvolume` instead of `volume`, due to the
+# order-sensitive config format.
+#
+# Issue: https://github.com/NixOS/nixpkgs/issues/195660
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "btrbk-section-order";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
+
+  nodes.machine = { ... }: {
+    services.btrbk.instances.local = {
+      onCalendar = null;
+      settings = {
+        timestamp_format = "long";
+        target."ssh://global-target/".ssh_user = "root";
+        volume."/btrfs" = {
+          snapshot_dir = "/volume-snapshots";
+          target."ssh://volume-target/".ssh_user = "root";
+          subvolume."@subvolume" = {
+            snapshot_dir = "/subvolume-snapshots";
+            target."ssh://subvolume-target/".ssh_user = "root";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("basic.target")
+    got = machine.succeed("cat /etc/btrbk/local.conf")
+    expect = """
+    backend btrfs-progs-sudo
+    timestamp_format long
+    target ssh://global-target/
+     ssh_user root
+    volume /btrfs
+     snapshot_dir /volume-snapshots
+     target ssh://volume-target/
+      ssh_user root
+     subvolume @subvolume
+      snapshot_dir /subvolume-snapshots
+      target ssh://subvolume-target/
+       ssh_user root
+    """.strip()
+    print(got)
+    assert got == expect
+  '';
+})

From 8dad5a22399782a4ef681174219546cb050e580f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Reu=C3=9Fe?= <seb@schattenkopie.de>
Date: Mon, 24 Oct 2022 09:13:07 +0200
Subject: [PATCH 06/27] nixos/zsh: prefer added completions over completions
 shipped with Zsh

Zsh ships some rudimentary completions for programs where upstream also ships
their own completions (e.g., curl). So as not to shadow those completions, we
need to prepend to the fpath instead of appending.

Fixes #197502
---
 nixos/modules/programs/zsh/zsh.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/programs/zsh/zsh.nix b/nixos/modules/programs/zsh/zsh.nix
index 0c59d20fee46..29790e0dd759 100644
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@@ -184,7 +184,7 @@ in
 
         # Tell zsh how to find installed completions.
         for p in ''${(z)NIX_PROFILES}; do
-            fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
+            fpath=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions $fpath)
         done
 
         # Setup custom shell init stuff.

From 062bc0d32e53740838ef3134a84fb826c5a7a592 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 24 Oct 2022 10:17:01 +0200
Subject: [PATCH 07/27] python310Packages.mailmanclient: add pythonImportsCheck

- specify license
- adjust inputs
- disable on older Python releases
---
 .../python-modules/mailmanclient/default.nix  | 33 +++++++++++++++----
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/mailmanclient/default.nix b/pkgs/development/python-modules/mailmanclient/default.nix
index 6fcb91e542e7..e7a752663c6d 100644
--- a/pkgs/development/python-modules/mailmanclient/default.nix
+++ b/pkgs/development/python-modules/mailmanclient/default.nix
@@ -1,22 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, six, httplib2, requests }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, requests
+, typing-extensions
+}:
 
 buildPythonPackage rec {
   pname = "mailmanclient";
   version = "3.3.4";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0y31HXjvU/bwy0s0PcDOlrX1RdyTTnk41ceD4A0R4p4=";
+    hash = "sha256-0y31HXjvU/bwy0s0PcDOlrX1RdyTTnk41ceD4A0R4p4=";
   };
 
-  propagatedBuildInputs = [ six httplib2 requests ];
+  propagatedBuildInputs = [
+    requests
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];
+
+  # Tests require a running Mailman instance
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "mailmanclient"
+  ];
 
   meta = with lib; {
-    homepage = "https://www.gnu.org/software/mailman/";
     description = "REST client for driving Mailman 3";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
+    homepage = "https://www.gnu.org/software/mailman/";
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ globin qyliss ];
+    platforms = platforms.linux;
   };
 }

From b65f049b6b1010ac644c23d19529b3ef6b4d608c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Oct 2022 11:55:27 +0000
Subject: [PATCH 08/27] clojure: 1.11.1.1165 -> 1.11.1.1177

---
 pkgs/development/interpreters/clojure/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 9055f9e0af6b..10da22d29403 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.1.1165";
+  version = "1.11.1.1177";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-UXukXP6Dt1Clj4JGvO5WmuFJ2HJGkPLbyP8xhxU/6dE=";
+    sha256 = "sha256-Axutyw+f7TPObxcw8llbu3r0zxYIKxFnBuUp+trR9eI=";
   };
 
   nativeBuildInputs = [

From fc3e69368031cd1ebf93f6ec5f9356bf20667cd6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Oct 2022 12:16:46 +0000
Subject: [PATCH 09/27] e16: 1.0.25 -> 1.0.26

---
 pkgs/applications/window-managers/e16/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/window-managers/e16/default.nix b/pkgs/applications/window-managers/e16/default.nix
index 0fa6ff10d96a..6e2fd639ddef 100644
--- a/pkgs/applications/window-managers/e16/default.nix
+++ b/pkgs/applications/window-managers/e16/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e16";
-  version = "1.0.25";
+  version = "1.0.26";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/e16-${version}.tar.xz";
-    hash = "sha256-rUtDaBa4vvC3gO7QSkFrphWuVOmbtkH+pRujQDaUOek=";
+    hash = "sha256-1FJFE4z8UT5VYv0Ef9pqi5sYq8iIbrDPKaqcUFf9dwE=";
   };
 
   nativeBuildInputs = [

From 0a657fb3e6da28c63439bb9e4e514026c27d91fe Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Mon, 24 Oct 2022 10:38:27 +0800
Subject: [PATCH 10/27] gitea: unpin Go 1.18

---
 pkgs/top-level/all-packages.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 28d111ac574d..cc6040119657 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7160,9 +7160,7 @@ with pkgs;
 
   git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { };
 
-  gitea = callPackage ../applications/version-management/gitea {
-    buildGoPackage = buildGo118Package; # nixosTests.gitea fails with 1.19
-  };
+  gitea = callPackage ../applications/version-management/gitea { };
 
   gokart = callPackage ../development/tools/gokart { };
 

From e04013af1a9320fd78819119adf5696a167506c9 Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Mon, 24 Oct 2022 10:39:12 +0800
Subject: [PATCH 11/27] nixos/gitea: set proper SystemCallFilter

remove trailing whitespace
---
 nixos/modules/services/misc/gitea.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index d9dece3343f6..ac598108a01e 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -592,7 +592,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
+        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @setuid @swap";
       };
 
       environment = {

From db029623b732cfa34eae29b6eb98e2b0c7d62f68 Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Sun, 23 Oct 2022 22:24:39 +0800
Subject: [PATCH 12/27] nixos/dnscrypt-proxy2: properly set SystemCallFilter

---
 nixos/modules/services/networking/dnscrypt-proxy2.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix
index 99ff5ee0bd8f..de1ca0d2f206 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@@ -111,7 +111,6 @@ in
           "~@aio"
           "~@keyring"
           "~@memlock"
-          "~@resources"
           "~@setuid"
           "~@timer"
         ];

From 7415970a3e853ba153c4e8147147751d15e7ea98 Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Mon, 24 Oct 2022 10:46:56 +0800
Subject: [PATCH 13/27] nixos/endlessh-go: set proper SystemCallFilter

---
 nixos/modules/services/security/endlessh-go.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/endlessh-go.nix b/nixos/modules/services/security/endlessh-go.nix
index 61cca5531739..6557ec953cd8 100644
--- a/nixos/modules/services/security/endlessh-go.nix
+++ b/nixos/modules/services/security/endlessh-go.nix
@@ -126,7 +126,7 @@ in
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           SystemCallArchitectures = "native";
-          SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
         };
     };
 

From 0ce08acdce4bc021f8dba9ed035cf7d1426dac86 Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Mon, 24 Oct 2022 11:02:42 +0800
Subject: [PATCH 14/27] nixos/navidrome: set proper SystemCallFilter

---
 nixos/modules/services/audio/navidrome.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix
index d74835e220f7..e73828081d4b 100644
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@@ -62,7 +62,7 @@ in {
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
         RestrictRealtime = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;

From f93f9f43c6b3347b2091a8a41421d31e84cb9275 Mon Sep 17 00:00:00 2001
From: Ulrik Strid <ulrik.strid@outlook.com>
Date: Mon, 24 Oct 2022 08:42:58 +0200
Subject: [PATCH 15/27] ocamlPackages.bls12-381-signature: init at 1.0.0

---
 .../bls12-381-signature/default.nix           | 33 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/bls12-381-signature/default.nix

diff --git a/pkgs/development/ocaml-modules/bls12-381-signature/default.nix b/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
new file mode 100644
index 000000000000..e8e43c31a24e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchzip,
+  buildDunePackage,
+  bls12-381,
+  alcotest,
+  bisect_ppx,
+  integers_stubs_js,
+}:
+
+buildDunePackage rec {
+  pname = "bls12-381-signature";
+  version = "1.0.0";
+  src = fetchzip {
+    url = "https://gitlab.com/nomadic-labs/cryptography/ocaml-${pname}/-/archive/${version}/ocaml-bls12-381-signature-${version}.tar.bz2";
+    sha256 = "sha256-KaUpAT+BWxmUP5obi4loR9vVUeQmz3p3zG3CBolUuL4=";
+  };
+
+  minimalOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [ bls12-381 ];
+
+  checkInputs = [alcotest bisect_ppx integers_stubs_js];
+
+  doCheck = true;
+
+  meta = {
+    description = "Implementation of BLS signatures for the pairing-friendly curve BLS12-381";
+    license = lib.licenses.mit;
+    homepage = "https://gitlab.com/nomadic-labs/cryptography/ocaml-bls12-381-signature";
+    maintainers = [lib.maintainers.ulrikstrid];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2b2cc769fad8..f4674f9fb4b8 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -94,6 +94,8 @@ let
     bls12-381-gen = callPackage ../development/ocaml-modules/bls12-381/gen.nix { };
     bls12-381-legacy = callPackage ../development/ocaml-modules/bls12-381/legacy.nix { };
 
+    bls12-381-signature = callPackage ../development/ocaml-modules/bls12-381-signature { };
+
     bos = callPackage ../development/ocaml-modules/bos { };
 
     brisk-reconciler = callPackage ../development/ocaml-modules/brisk-reconciler { };

From 3758f7fa4ab4002b427d3e256db9df4a96d75b66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Merlin=20G=C3=B6ttlinger?= <megoettlinger@gmail.com>
Date: Mon, 24 Oct 2022 08:26:30 +0200
Subject: [PATCH 16/27] maintainers: update @mgttlinger's name

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d30e7563be0f..6b56b7c6bff9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8803,7 +8803,7 @@
     email = "megoettlinger@gmail.com";
     github = "mgttlinger";
     githubId = 5120487;
-    name = "Merlin Göttlinger";
+    name = "Merlin Humml";
   };
   mguentner = {
     email = "code@klandest.in";

From 7b5475e8d7b84256e98407fd318d3d91376c7b02 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 24 Oct 2022 15:33:42 +0200
Subject: [PATCH 17/27] jadx: allow local networking on Darwin

---
 pkgs/tools/security/jadx/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index b5c9d869396e..83504dd784b2 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -47,6 +47,9 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ gradle jdk makeWrapper ];
 
+  # Otherwise, Gradle fails with `java.net.SocketException: Operation not permitted`
+  __darwinAllowLocalNetworking = true;
+
   buildPhase = ''
     # The installDist Gradle build phase tries to copy some dependency .jar
     # files multiple times into the build directory. This ends up failing when

From 6fe8b8ed3c2eec7df228f1dbdafd9aa875ec94e6 Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Mon, 24 Oct 2022 09:33:28 +0200
Subject: [PATCH 18/27] jadx: 1.4.4 -> 1.4.5

---
 pkgs/tools/security/jadx/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index b5c9d869396e..ca26467502b1 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ku82SHCJhrruJEiojH6Rp7FUWvM8KtvDivL8CE5C8gc=";
+    hash = "sha256-so82zzCXIJV5tIVUBJFZEpArThNQVqWASGofNzIobQM=";
   };
 
   deps = stdenv.mkDerivation {
@@ -37,10 +37,14 @@ let
       find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
         | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
         | sh
+
+      # Work around okio-2.10.0 bug, fixed in 3.0. Remove "-jvm" from filename.
+      # https://github.com/square/okio/issues/954
+      mv $out/com/squareup/okio/okio/2.10.0/okio{-jvm,}-2.10.0.jar
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-nGejkCScX45VMT2nNArqG+fqOGvDwzeH9Xob4XMtdow=";
+    outputHash = "sha256-J6YpBYVqx+aWiMFX/67T7bhu4RTlKVaT4t359YJ6m7I=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;

From eafdbcc9b4c9f0312a276f2c2c5f097d2f6e7846 Mon Sep 17 00:00:00 2001
From: Ulrik Strid <ulrik.strid@outlook.com>
Date: Mon, 24 Oct 2022 09:39:21 +0200
Subject: [PATCH 19/27] ocamlPackages.tezos-bls12-381-polynomial: 0.1.2 ->
 0.1.3

---
 .../ocaml-modules/tezos-bls12-381-polynomial/default.nix   | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix
index 9a157c4db0f8..9723127a1de8 100644
--- a/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix
+++ b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix
@@ -4,6 +4,7 @@
   buildDunePackage,
   bls12-381,
   data-encoding,
+  bigstringaf,
   alcotest,
   alcotest-lwt,
   bisect_ppx,
@@ -12,16 +13,16 @@
 
 buildDunePackage rec {
   pname = "tezos-bls12-381-polynomial";
-  version = "0.1.2";
+  version = "0.1.3";
   duneVersion = "3";
   src = fetchFromGitLab {
     owner = "nomadic-labs/cryptography";
     repo = "privacy-team";
     rev = "v${version}";
-    sha256 = "sha256-HVeKZCPBRJWQXkcI2J7Fl4qGviYLD5x+4W4pAY/W4jA=";
+    sha256 = "sha256-H1Wog3GItTIVsawr9JkyyKq+uGqbTQPTR1dacpmxLbs=";
   };
 
-  propagatedBuildInputs = [bls12-381 data-encoding];
+  propagatedBuildInputs = [bls12-381 data-encoding bigstringaf];
 
   checkInputs = [alcotest alcotest-lwt bisect_ppx qcheck-alcotest];
 

From 0766c6574776957774ffa4fc7eda0f36dad5b91b Mon Sep 17 00:00:00 2001
From: Et7f3 <cadeaudeelie@gmail.com>
Date: Mon, 24 Oct 2022 16:48:25 +0200
Subject: [PATCH 20/27] Update ocaml packages.git and paf le chien (#197422)

* ocamlPackages.paf: 0.1.0 -> 0.2.0

* ocamlPackages.git: 3.9.1 -> 3.10.0
---
 pkgs/development/ocaml-modules/git/default.nix | 4 ++--
 pkgs/development/ocaml-modules/paf/default.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index 1e886e94dd16..fbbfd17ddb36 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -8,13 +8,13 @@
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.9.1";
+  version = "3.10.0";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "sha256-OyeMW5gsq4fMEWRmhzPq2qardFZtMjoQk6mMKz5+Ds4=";
+    sha256 = "sha256-slUzAT4qwPzUNzHMbib/ArxaGzcMFl8tg0ynq1y5U1M=";
   };
 
   # remove changelog for the carton package
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index cf7a25b81d0e..59f17d28d3bc 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -25,11 +25,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "sha256-JIJjECEbajauowbXot19vtiDhTpGAQiSCBY0AHZOyZM=";
+    sha256 = "sha256-TzhRxFTPkLMAsLPl0ONC8DRhJRGstF58+QRKbGuJZVE=";
   };
 
   minimalOCamlVersion = "4.08";

From 5e35744c4cf3440f34e7dbf4af870eab524a85b2 Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Mon, 24 Oct 2022 16:25:18 +0200
Subject: [PATCH 21/27] maintainers: add lheckemann and hoverbear to
 determinatesystems

---
 maintainers/team-list.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 887965bd48f1..34d847b01c20 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -182,6 +182,8 @@ with lib.maintainers; {
     members = [
       cole-h
       grahamc
+      hoverbear
+      lheckemann
     ];
     scope = "Group registration for packages maintained by Determinate Systems.";
     shortName = "Determinate Systems employees";

From ac70b1c269399f8d31b0238e869c6d7ede3ef0ec Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Mon, 24 Oct 2022 16:25:55 +0200
Subject: [PATCH 22/27] coldsnap: maintained by Determinate Systems

---
 pkgs/tools/admin/coldsnap/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/admin/coldsnap/default.nix b/pkgs/tools/admin/coldsnap/default.nix
index cf29d3a790f5..3717550846c2 100644
--- a/pkgs/tools/admin/coldsnap/default.nix
+++ b/pkgs/tools/admin/coldsnap/default.nix
@@ -27,6 +27,6 @@ rustPlatform.buildRustPackage rec {
     description = "A command line interface for Amazon EBS snapshots";
     changelog = "https://github.com/awslabs/coldsnap/blob/${src.rev}/CHANGELOG.md";
     license = licenses.apsl20;
-    maintainers = with maintainers; [ hoverbear ];
+    maintainers = teams.determinatesystems.members;
   };
 }

From 55325e23f81f28b4b65a7b5cf115c9b187d45529 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Oct 2022 08:21:35 +0000
Subject: [PATCH 23/27] ballerina: 2201.2.1 -> 2201.2.2

---
 pkgs/development/compilers/ballerina/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/ballerina/default.nix b/pkgs/development/compilers/ballerina/default.nix
index 42daf6235146..f8dcc907f7ab 100644
--- a/pkgs/development/compilers/ballerina/default.nix
+++ b/pkgs/development/compilers/ballerina/default.nix
@@ -1,6 +1,6 @@
 { ballerina, lib, writeText, runCommand, makeWrapper, fetchzip, stdenv, openjdk }:
 let
-  version = "2201.2.1";
+  version = "2201.2.2";
   codeName = "swan-lake";
 in stdenv.mkDerivation {
   pname = "ballerina";
@@ -8,7 +8,7 @@ in stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://dist.ballerina.io/downloads/${version}/ballerina-${version}-${codeName}.zip";
-    sha256 = "sha256-QNXaEivwlqBdbpxGCYnfIN/fQkWlVu8lqGWKfLlVB5s=";
+    sha256 = "sha256-xBr7lsZJKk4VXuUDt7IRQN/ZDH4WrxYjd1mBIoyb9qs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 3dcfce65a0fc64dbf662d9fa6fd338d59fe932b6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Oct 2022 08:02:27 +0000
Subject: [PATCH 24/27] armadillo: 11.4.1 -> 11.4.2

---
 pkgs/development/libraries/armadillo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 5af49f23c44f..95e89f660cca 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "11.4.1";
+  version = "11.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-2ttf01vE3CUbNvXdgHKcPFiNZeLsvNTk41mtnLBFI/s=";
+    sha256 = "sha256-5oYBNPGsllbGoczHTHS3X4xZZqyGEoQfL78Mkc459Ok=";
   };
 
   nativeBuildInputs = [ cmake ];

From 4a177de7f287d10dd889063b86bc9c54d3029606 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 23 Oct 2022 20:23:47 +0000
Subject: [PATCH 25/27] mangal: 3.12.0 -> 3.14.0

---
 pkgs/applications/misc/mangal/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/mangal/default.nix b/pkgs/applications/misc/mangal/default.nix
index f14084a865e5..2b04fb4fa291 100644
--- a/pkgs/applications/misc/mangal/default.nix
+++ b/pkgs/applications/misc/mangal/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "mangal";
-  version = "3.12.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "metafates";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1fWy7riInrbReQ0sQ1TF8GhqWQG0KXk1JzhmxlSuvmk=";
+    hash = "sha256-IQSRPjtMaxwJuiKGjOYQ7jp0mAPS/V6fA1/Ek/K5yqk=";
   };
 
   proxyVendor = true;
-  vendorSha256 = "sha256-+HDuGSZinotUtCqffrmFkjHegxdArSJMWwnUG/tnLRc=";
+  vendorSha256 = "sha256-XslNMrFCI+dGaSw7ro1vBMamFukbMA3m0I3hOl9QccM=";
 
   ldflags = [ "-s" "-w" ];
 

From f3cb29a5b88794d733fd87dcc46ba7824db98491 Mon Sep 17 00:00:00 2001
From: KFears <kfearsoff@gmail.com>
Date: Mon, 24 Oct 2022 19:31:50 +0400
Subject: [PATCH 26/27] nixos/grafana: fix issues with rfc42 refactoring

---
 nixos/modules/services/monitoring/grafana.nix | 32 +++++++++----------
 nixos/tests/grafana/basic.nix                 | 22 ++++++++-----
 nixos/tests/grafana/provision/default.nix     | 20 ++++++++----
 3 files changed, 43 insertions(+), 31 deletions(-)

diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 964602547e7d..9e15844f7dd2 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -245,17 +245,17 @@ in {
     (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrg" ] [ "services" "grafana" "settings" "users" "auto_assign_org" ])
     (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrgRole" ] [ "services" "grafana" "settings" "users" "auto_assign_org_role" ])
     (mkRenamedOptionModule [ "services" "grafana" "auth" "disableLoginForm" ] [ "services" "grafana" "settings" "auth" "disable_login_form" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "enable" ] [ "services" "grafana" "settings" "auth" "anonymous" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_name" ] [ "services" "grafana" "settings" "auth" "anonymous" "org_name" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_role" ] [ "services" "grafana" "settings" "auth" "anonymous" "org_role" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "enable" ] [ "services" "grafana" "settings" "auth" "azuread" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowSignUp" ] [ "services" "grafana" "settings" "auth" "azuread" "allow_sign_up" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "clientId" ] [ "services" "grafana" "settings" "auth" "azuread" "client_id" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedDomains" ] [ "services" "grafana" "settings" "auth" "azuread" "allowed_domains" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedGroups" ] [ "services" "grafana" "settings" "auth" "azuread" "allowed_groups" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "enable" ] [ "services" "grafana" "settings" "auth" "google" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "allowSignUp" ] [ "services" "grafana" "settings" "auth" "google" "allow_sign_up" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "clientId" ] [ "services" "grafana" "settings" "auth" "google" "client_id" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "enable" ] [ "services" "grafana" "settings" "auth.anonymous" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_name" ] [ "services" "grafana" "settings" "auth.anonymous" "org_name" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_role" ] [ "services" "grafana" "settings" "auth.anonymous" "org_role" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "enable" ] [ "services" "grafana" "settings" "auth.azuread" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowSignUp" ] [ "services" "grafana" "settings" "auth.azuread" "allow_sign_up" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "clientId" ] [ "services" "grafana" "settings" "auth.azuread" "client_id" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedDomains" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_domains" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedGroups" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_groups" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "enable" ] [ "services" "grafana" "settings" "auth.google" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "allowSignUp" ] [ "services" "grafana" "settings" "auth.google" "allow_sign_up" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "clientId" ] [ "services" "grafana" "settings" "auth.google" "client_id" ])
     (mkRenamedOptionModule [ "services" "grafana" "analytics" "reporting" "enable" ] [ "services" "grafana" "settings" "analytics" "reporting_enabled" ])
 
     (mkRemovedOptionModule [ "services" "grafana" "database" "passwordFile" ] ''
@@ -351,7 +351,7 @@ in {
             protocol = mkOption {
               description = lib.mdDoc "Which protocol to listen.";
               default = "http";
-              type = types.enum ["http" "https" "socket"];
+              type = types.enum ["http" "https" "h2" "socket"];
             };
 
             http_addr = mkOption {
@@ -1173,14 +1173,14 @@ in {
         any (x: x.secure_settings != null) cfg.provision.notifiers
       ) "Notifier secure settings will be stored as plaintext in the Nix store! Use file provider instead.")
       (optional (
-        builtins.isList cfg.provision.datasources
+        builtins.isList cfg.provision.datasources && cfg.provision.datasources != []
       ) ''
           Provisioning Grafana datasources with options has been deprecated.
           Use `services.grafana.provision.datasources.settings` or
           `services.grafana.provision.datasources.path` instead.
         '')
       (optional (
-        builtins.isList cfg.provision.dashboards
+        builtins.isList cfg.provision.datasources && cfg.provision.dashboards != []
       ) ''
           Provisioning Grafana dashboards with options has been deprecated.
           Use `services.grafana.provision.dashboards.settings` or
@@ -1253,8 +1253,8 @@ in {
         RuntimeDirectory = "grafana";
         RuntimeDirectoryMode = "0755";
         # Hardening
-        AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = if (cfg.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+        AmbientCapabilities = lib.mkIf (cfg.settings.server.http_port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = if (cfg.settings.server.http_port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
         DeviceAllow = [ "" ];
         LockPersonality = true;
         NoNewPrivileges = true;
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index f91d649540e6..f6566d449709 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -6,12 +6,18 @@ let
   baseGrafanaConf = {
     services.grafana = {
       enable = true;
-      addr = "localhost";
-      analytics.reporting.enable = false;
-      domain = "localhost";
-      security = {
-        adminUser = "testadmin";
-        adminPassword = "snakeoilpwd";
+      settings = {
+        analytics.reporting_enabled = false;
+
+        server = {
+          http_addr = "localhost";
+          domain = "localhost";
+        };
+
+        security = {
+          admin_user = "testadmin";
+          admin_password = "snakeoilpwd";
+        };
       };
     };
   };
@@ -24,7 +30,7 @@ let
     };
 
     postgresql = {
-      services.grafana.database = {
+      services.grafana.settings.database = {
         host = "127.0.0.1:5432";
         user = "grafana";
       };
@@ -40,7 +46,7 @@ let
     };
 
     mysql = {
-      services.grafana.database.user = "grafana";
+      services.grafana.settings.database.user = "grafana";
       services.mysql = {
         enable = true;
         ensureDatabases = [ "grafana" ];
diff --git a/nixos/tests/grafana/provision/default.nix b/nixos/tests/grafana/provision/default.nix
index 331de35ed7fa..7a707ab9fed1 100644
--- a/nixos/tests/grafana/provision/default.nix
+++ b/nixos/tests/grafana/provision/default.nix
@@ -6,14 +6,20 @@ let
   baseGrafanaConf = {
     services.grafana = {
       enable = true;
-      addr = "localhost";
-      analytics.reporting.enable = false;
-      domain = "localhost";
-      security = {
-        adminUser = "testadmin";
-        adminPassword = "snakeoilpwd";
-      };
       provision.enable = true;
+      settings = {
+        analytics.reporting_enabled = false;
+
+        server = {
+          http_addr = "localhost";
+          domain = "localhost";
+        };
+
+        security = {
+          admin_user = "testadmin";
+          admin_password = "snakeoilpwd";
+        };
+      };
     };
 
     systemd.tmpfiles.rules = [

From 2ddb4ec4cfb37b5d879f7bac714a6229e44d78a2 Mon Sep 17 00:00:00 2001
From: Steven Kou <skykinetic@stevenkou.xyz>
Date: Mon, 24 Oct 2022 23:53:59 +0800
Subject: [PATCH 27/27] zoom-us: 5.12.0.{11129,4682} -> 5.12.{3.11845,2.4816}

---
 .../instant-messengers/zoom-us/default.nix           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 3e1d4e524d3d..8f78f0d9add8 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -47,23 +47,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.12.0.11129";
-  versions.x86_64-darwin = "5.12.0.11129";
-  versions.x86_64-linux = "5.12.0.4682";
+  versions.aarch64-darwin = "5.12.3.11845";
+  versions.x86_64-darwin = "5.12.3.11845";
+  versions.x86_64-linux = "5.12.2.4816";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-0XhqJrls4X8wO9VNmmmUGexJkA9NDkwJkYRjmyV1kAU=";
+      hash = "sha256-iDLxqG7/cdo60V0mFE3tX/Msi0rRUjoM8X9yq2rlvf0=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-E7+zMrW4y1RfsR1LrxCJRRVlA+BuhzwMI/sfzqNHObo=";
+      hash = "sha256-+YOtdoh8S50+GHRLb6TPYCqDtry7SnnNqo7USzkDc7c=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-UNtxyR4SMCP9c1Dre/arfdSVZbAV8qoHyHlvj3ZbXIs=";
+      hash = "sha256-kgjooMqeZurzqIn3ADcgFjlqaC58dQNuIAHLx4M0S9I=";
     };
   };