Merge master into staging-next

nixos/modules/hardware/video/nvidia.nix

@@ -361,11 +361,12 @@ in
     services.udev.extraRules =
       ''
         # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
-        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
-        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%n c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", PROGRAM="${pkgs.gnugrep}/bin/grep 'Device Minor:' /proc/driver/nvidia/gpus/%b/information", \
+          RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%c{3} c 195 %c{3}"
         KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
-        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
+        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
       '' + optionalString cfg.powerManagement.finegrained ''
         # Remove NVIDIA USB xHCI Host Controller devices, if present
         ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"

nixos/modules/module-list.nix

@@ -172,6 +172,7 @@
   ./programs/java.nix
   ./programs/k40-whisperer.nix
   ./programs/kclock.nix
+  ./programs/k3b.nix
   ./programs/kdeconnect.nix
   ./programs/kbdlight.nix
   ./programs/less.nix
@@ -1183,13 +1184,14 @@
   ./system/boot/stage-2.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/initrd-secrets.nix
+  ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
   ./system/boot/systemd/shutdown.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
-  ./system/boot/systemd/initrd.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
   ./system/etc/etc-activation.nix

nixos/modules/programs/k3b.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  # interface
+  options.programs.k3b = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable k3b, the KDE disk burning application.
+
+        Additionally to installing <package>k3b</package> enabling this will
+        add <literal>setuid</literal> wrappers in <literal>/run/wrappers/bin</literal>
+        for both <package>cdrdao</package> and <package>cdrecord</package>. On first
+        run you must manually configure the path of <package>cdrdae</package> and
+        <package>cdrecord</package> to correspond to the appropriate paths under
+        <literal>/run/wrappers/bin</literal> in the "Setup External Programs" menu.
+      '';
+    };
+  };
+
+  # implementation
+  config = mkIf config.programs.k3b.enable {
+
+    environment.systemPackages = with pkgs; [
+      k3b
+      dvdplusrwtools
+      cdrdao
+      cdrkit
+    ];
+
+    security.wrappers = {
+      cdrdao = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrdao}/bin/cdrdao";
+      };
+      cdrecord = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrkit}/bin/cdrecord";
+      };
+    };
+
+  };
+}

nixos/modules/system/boot/systemd/initrd-secrets.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  config = lib.mkIf (config.boot.initrd.enable && config.boot.initrd.systemd.enable) {
+    # Copy secrets into the initrd if they cannot be appended
+    boot.initrd.systemd.contents = lib.mkIf (!config.boot.loader.supportsInitrdSecrets)
+      (lib.mapAttrs' (dest: source: lib.nameValuePair "/.initrd-secrets/${dest}" { source = if source == null then dest else source; }) config.boot.initrd.secrets);
+
+    # Copy secrets to their respective locations
+    boot.initrd.systemd.services.initrd-nixos-copy-secrets = lib.mkIf (config.boot.initrd.secrets != {}) {
+      description = "Copy secrets into place";
+      # Run as early as possible
+      wantedBy = [ "sysinit.target" ];
+      before = [ "cryptsetup-pre.target" ];
+      unitConfig.DefaultDependencies = false;
+
+      # We write the secrets to /.initrd-secrets and move them because this allows
+      # secrets to be written to /run. If we put the secret directly to /run and
+      # drop this service, we'd mount the /run tmpfs over the secret, making it
+      # invisible in stage 2.
+      script = ''
+        for secret in $(cd /.initrd-secrets; find . -type f); do
+          mkdir -p "$(dirname "/$secret")"
+          cp "/.initrd-secrets/$secret" "/$secret"
+        done
+      '';
+
+      unitConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+    # The script needs this
+    boot.initrd.systemd.extraBin.find = "${pkgs.findutils}/bin/find";
+  };
+}

nixos/tests/systemd-initrd-luks-keyfile.nix

@@ -32,7 +32,7 @@ in {
         };
       };
       virtualisation.bootDevice = "/dev/mapper/cryptroot";
-      boot.initrd.systemd.contents."/etc/cryptroot.key".source = keyfile;
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
     };
   };
 

pkgs/applications/audio/pyradio/default.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.8.9.16";
+  version = "0.8.9.17";
 
   propagatedBuildInputs = with python3Packages; [
     requests
@@ -13,8 +13,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "sha256-uerQfyGHWhLbO6UkLSMA1tdfW/8fDQkcm6hYIdwwC7I=";
+    sha256 = "sha256-lfDSD1+xbA6tAKeHKciq/n6YHWS4JTOvjIqOn+FQ2yA=";
   };
 
   checkPhase = ''

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -3,13 +3,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.4.7";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Qz4BNrhK+NPnKBgjXGYl4P2R878LCuMGZxLECawA12E=";
+    sha256 = "sha256-DcxRrVUen+JxMpiLDPfknpwCe962ifaekBeBnxJ0y88=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -31,18 +31,18 @@
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.All";
-    version = "1.3.2";
+    version = "1.3.6";
-    sha256 = "0xcfba8n9zf5m1nb48ilggp03kpki4nv4kx7k7a5w1gxgm6k6j9z";
+    sha256 = "0jdpqy6kxg0lyh4n88wsvrcqc0kk7s7zn5lw7ivwys716m69qrdl";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Charge";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "1xakwnb839dl0qnhqprsnfq8png31iyb0fsngljis5jc8yvb4353";
+    sha256 = "0v5rss6dg7297kq1frhn2pj9gd0rd8g1p5d316x5wkd4w7pmrm2w";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.CLightning";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "0a79p6i3xiq6svv08c4hhihkvqa2ac7fphi3g9i0cwh47ak0k5h2";
+    sha256 = "0qs5p6pm54il23j8yysw0pzvrki37y6z8cd2gdknpz2f3wg7slm9";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Common";
@@ -51,23 +51,23 @@
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Common";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "165p1246fn628hlwdrx7sanlxa6qqpn480rq1asn5r1602w21844";
+    sha256 = "119zplkc7iy9wc95iz1qnyi42fr99ar4hp8a11p708a22w941yi0";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.Eclair";
-    version = "1.3.1";
+    version = "1.3.2";
-    sha256 = "1vlwm5mw8wffp00xhkx19yavk59b5x540sg81vis3q7hjvvgca5c";
+    sha256 = "08gw1gqng1khxzvvhlwsg6lw1w56ylilg738wi6cbcwy7vl7f6bb";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.LNBank";
-    version = "1.3.1";
+    version = "1.3.4";
-    sha256 = "0qga34vi4fzfr0g4qk0ad8xkqdig2ishmdj9i32s5yrrjrkx7c8d";
+    sha256 = "1vyz63pi5j31y8pz0b4hp9c4j249rszzfcymk3z3b2clwq32s4i4";
   })
   (fetchNuGet {
     pname = "BTCPayServer.Lightning.LND";
-    version = "1.3.1";
+    version = "1.3.3";
-    sha256 = "1b70jlyzy9xjvfywzi6i3l3sd4mkknxpni9akdi0phsfqysmy0wl";
+    sha256 = "137azpxxmp2q69bp07ky1jsgnfy9lf0dg5ba8l654flvvrgxaq6y";
   })
   (fetchNuGet {
     pname = "BuildBundlerMinifier";
@@ -89,6 +89,11 @@
     version = "15.0.5";
     sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma";
   })
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
   (fetchNuGet {
     pname = "DigitalRuby.ExchangeSharp";
     version = "0.6.3";
@@ -374,11 +379,6 @@
     version = "3.1.6";
     sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5";
   })
-  (fetchNuGet {
-    pname = "Microsoft.EntityFrameworkCore.Abstractions";
-    version = "6.0.0";
-    sha256 = "1aw13qjkpglc1mm3cv7s73s8fschy8lzdnigsp346b7mycpg7v92";
-  })
   (fetchNuGet {
     pname = "Microsoft.EntityFrameworkCore.Abstractions";
     version = "6.0.1";
@@ -831,8 +831,8 @@
   })
   (fetchNuGet {
     pname = "NBitcoin";
-    version = "6.0.15";
+    version = "6.0.18";
-    sha256 = "038dcl2k88w4cijws3pdnjflgy4lmqx70z0l7yqz355kmxjz8ain";
+    sha256 = "1dr669h68cx6yfzr3n97yzzwbgnsv5g2008diyxngdjm55nh3q9s";
   })
   (fetchNuGet {
     pname = "NBitcoin";
@@ -856,8 +856,8 @@
   })
   (fetchNuGet {
     pname = "NBXplorer.Client";
-    version = "4.1.3";
+    version = "4.2.0";
-    sha256 = "1nh4jj7yg81825hr7cc99qlnfmdm6jibap81qqi8a968b61z4251";
+    sha256 = "1adbn5cbr42cjfvijaf1lffhcrcn0ws1arfi7mrg3kjshbzfgims";
   })
   (fetchNuGet {
     pname = "NETStandard.Library";
@@ -931,13 +931,13 @@
   })
   (fetchNuGet {
     pname = "Npgsql.EntityFrameworkCore.PostgreSQL";
-    version = "6.0.1";
+    version = "6.0.3";
-    sha256 = "108sc62dqdb6ym2ck651kamcv6qf93cmaqzygfblmiglwzi6frnx";
+    sha256 = "0mgwm9psxvrq6vs2cy7m72wnknydgrs71hir2jqal5wbdh8g01np";
   })
   (fetchNuGet {
     pname = "Npgsql";
-    version = "6.0.1";
+    version = "6.0.3";
-    sha256 = "150paiwqxp6zsy5v7vl2a9h3ikzfv3pd04whxifmamq0h1ghw0ld";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
   })
   (fetchNuGet {
     pname = "NSec.Cryptography";
@@ -1086,8 +1086,8 @@
   })
   (fetchNuGet {
     pname = "Selenium.WebDriver.ChromeDriver";
-    version = "98.0.4758.10200";
+    version = "100.0.4896.6000";
-    sha256 = "10mc50gm78zbxrwvxlygzmj2a29liiacv8haax0534c26vj9dwkl";
+    sha256 = "1pfdvxjy4xiw1j7787lf07w9nr0dmj589vf6p4aqmk2cfz8j35c6";
   })
   (fetchNuGet {
     pname = "Selenium.WebDriver";

pkgs/applications/blockchains/lnd/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.14.2-beta";
+  version = "0.14.3-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "sha256-JOKitxxWcTlGlxYR1XpySZlI2fT9jgBrOxNUwT/sqdQ=";
+    sha256 = "sha256-ZTvGFmjhQBIWqMGatMAlX59uVyl1oUKo7L5jiz571Gc";
   };
 
   vendorSha256 = "sha256-shDmJcEyobY7Ih1MHMEY2GQnzAffsH/y4J1bme/bT7I=";

pkgs/applications/blockchains/nbxplorer/default.nix

@@ -2,13 +2,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.2.20";
+  version = "2.3.20";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-C3REnfecNwf3dtk6aLYAEsedHRlIrQZAokXtf6KI8U0=";
+    sha256 = "sha256-cAko5s1bFSI7HOcXg/tZtdMMe0S9zkRBeZ6bispxgwc=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";

pkgs/applications/blockchains/nbxplorer/deps.nix

@@ -1,4 +1,9 @@
 { fetchNuGet }: [
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
   (fetchNuGet {
     pname = "DBTrie";
     version = "1.0.39";
@@ -249,6 +254,11 @@
     version = "1.0.0.18";
     sha256 = "0lgssxafv6cqlw21fb79fm0fcln0clgsk6zadcwrnjv9vampfw7b";
   })
+  (fetchNuGet {
+    pname = "Npgsql";
+    version = "6.0.3";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
+  })
   (fetchNuGet {
     pname = "NuGet.Frameworks";
     version = "5.0.0";
@@ -754,6 +764,11 @@
     version = "4.5.0";
     sha256 = "17labczwqk3jng3kkky73m0jhi8wc21vbl7cz5c0hj2p1dswin43";
   })
+  (fetchNuGet {
+    pname = "System.Runtime.CompilerServices.Unsafe";
+    version = "6.0.0";
+    sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc";
+  })
   (fetchNuGet {
     pname = "System.Runtime.Extensions";
     version = "4.1.0";

pkgs/applications/misc/fspy/default.nix

@@ -2,7 +2,6 @@
 let
   pname = "fspy";
   version = "1.0.3";
-  name = "${pname}-v${version}";
 
   src = fetchurl {
     url = "https://github.com/stuffmatic/fSpy/releases/download/v${version}/${pname}-${version}-x86_64.AppImage";
@@ -10,10 +9,10 @@ let
   };
 
 in appimageTools.wrapType2 {
-  inherit name src;
+  inherit pname version src;
 
   extraInstallCommands = ''
-    mv $out/bin/${name} $out/bin/${pname}
+    mv $out/bin/${pname}-v${version} $out/bin/${pname}
   '';
 
   meta = with lib; {

pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.96.0";
+  version = "0.98.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3O+ZdOloh5gILPQssztt7s/MwRgDOnpJItwLn7FXnPU=";
+    sha256 = "sha256-oZzjnuu6C522qBs/A83jKIZ3dUrJRmKJ/C8NRX31yvw=";
   };
 
-  vendorSha256 = "sha256-TgE/ToHBg2QBgtk0gPZTV/icIbQN14RpVAbL/8b+W0U=";
+  vendorSha256 = "sha256-HM5IE/rVNWyTfjUtVOlw+69+YoWYlLtU2FOXeH2BAi8=";
 
   doCheck = false;
 

pkgs/applications/networking/browsers/chromium/common.nix

@@ -162,7 +162,11 @@ let
       ./patches/widevine-79.patch
     ];
 
-    postPatch = ''
+    postPatch = optionalString (chromiumVersionAtLeast "102") ''
+      # Workaround/fix for https://bugs.chromium.org/p/chromium/issues/detail?id=1313361:
+      substituteInPlace BUILD.gn \
+        --replace '"//infra/orchestrator:orchestrator_all",' ""
+    '' + ''
       # remove unused third-party
       for lib in ${toString gnSystemLibraries}; do
         if [ -d "third_party/$lib" ]; then

pkgs/applications/networking/cluster/fluxcd/update.sh

@@ -3,36 +3,43 @@
 
 set -x -eu -o pipefail
 
-cd $(dirname "${BASH_SOURCE[0]}")
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+FLUXCD_PATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
-TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; fluxcd.version or (builtins.parseDrvName fluxcd.name).version" | tr -d '"')"
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
 
-VERSION=$(echo ${TAG} | sed 's/^v//')
+if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
+    SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz)
+    SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz)
 
-SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${TAG}.tar.gz)
+    setKV () {
+        sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/default.nix"
+    }
 
-SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${TAG}/manifests.tar.gz)
+    setKV version ${LATEST_VERSION}
+    setKV sha256 ${SHA256}
+    setKV manifestsSha256 ${SPEC_SHA256}
+    setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
 
-setKV () {
+    set +e
-    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
+    VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-}
+    set -e
 
-setKV version ${VERSION}
+    if [ -n "${VENDOR_SHA256:-}" ]; then
-setKV sha256 ${SHA256}
-setKV manifestsSha256 ${SPEC_SHA256}
-setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
-
-cd ../../../../../
-set +e
-VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-set -e
-
-cd - > /dev/null
-
-if [ -n "${VENDOR_SHA256:-}" ]; then
         setKV vendorSha256 ${VENDOR_SHA256}
-else
+    else
         echo "Update failed. VENDOR_SHA256 is empty."
         exit 1
-fi
+    fi
 
+    # `git` flag here is to be used by local maintainers to speed up the bump process
+    if [ "$1" = "git" ]; then
+        git switch -c "package-fluxcd-${LATEST_VERSION}"
+        git add "$FLUXCD_PATH"/default.nix
+        git commit -m "fluxcd: ${OLD_VERSION} -> ${LATEST_VERSION}"
+    fi
+else
+    echo "fluxcd is already up-to-date at $OLD_VERSION"
+fi

pkgs/applications/radio/rtl-sdr/default.nix

@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromGitHub
 , cmake
 , pkg-config
 , libusb1
@@ -8,12 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl-sdr";
-  version = "0.6.0";
+  version = "0.8.0";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = "git://git.osmocom.org/rtl-sdr.git";
+    owner = "librtlsdr";
-    rev = "refs/tags/${version}";
+    repo = "librtlsdr";
-    sha256 = "0lmvsnb4xw4hmz6zs0z5ilsah5hjz29g1s0050n59fllskqr3b8k";
+    rev = "v${version}";
+    sha256 = "1fgxlkgmdchbrf0nn98ivjr6css5hak3608nr4xrf2qzf7xy2kdk";
   };
 
   postPatch = ''
@@ -28,7 +29,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libusb1 ];
 
-  cmakeFlags = lib.optional stdenv.isLinux "-DINSTALL_UDEV_RULES=ON";
+  cmakeFlags = lib.optional stdenv.isLinux [
+    "-DINSTALL_UDEV_RULES=ON"
+    "-DWITH_RPC=ON"
+  ];
 
   meta = with lib; {
     description = "Turns your Realtek RTL2832 based DVB dongle into a SDR receiver";

pkgs/data/themes/flat-remix-gnome/default.nix

@@ -7,25 +7,25 @@
 let
   # make install will use dconf to find desktop background file uri.
   # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20220407/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L38
   fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
   pname = "flat-remix-gnome";
-  version = "20220407";
+  version = "20220422";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    hash = "sha256-Q54uF49NbvupN6LH80bgRtvyW7Cqm9vqsWXDkQrF4HQ=";
+    hash = "sha256-W/BNn10SggtBacelNljPh42jVMBfykJFRWBCaj/ar7U=";
   };
 
   nativeBuildInputs = [ glib fake-dconf ];
   makeFlags = [ "PREFIX=$(out)" ];
   preInstall = ''
     # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20220407/Makefile#L56
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L56
     mkdir -p $out/share/gnome-shell/
     touch $out/share/gnome-shell/gnome-shell-theme.gresource
   '';

pkgs/data/themes/flat-remix-gtk/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flat-remix-gtk";
-  version = "20220330";
+  version = "20220412";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-TRBjttAYpx3M/Qza6N9dJy50vQtUOJGmdLNdobnAt2Y=";
+    sha256 = "sha256-LIGYPsOoPN3KIe0XrjCIf7yV3p3Gfzx8zci57+HzW18=";
   };
 
   dontBuild = true;

pkgs/development/libraries/ffmpegthumbnailer/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ffmpegthumbnailer";
-  version = "unstable-2021-09-02";
+  version = "unstable-2022-02-18";
 
   src = fetchFromGitHub {
     owner = "dirkvdb";
     repo = "ffmpegthumbnailer";
-    rev = "d92e191dd793b12cee0a0f685f5a8d8252988399";
+    rev = "3db9fe895b2fa656bb40ddb7a62e27604a688171";
-    sha256 = "1ysfq3g74b8ivivrdpfi4vm23d3cyc3rfla5i6y8q9aycis9xv6q";
+    sha256 = "0606pbg391l4s8mpyyalm9zrcnm75fwqdlrxy2gif9n21i2fm3rc";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/development/python-modules/bleak/default.nix

@@ -4,13 +4,13 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.14.2";
+  version = "0.14.3";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fkq8q54s9apqiamdd8vgrhk5p02w5w281q93dfnrd37xv7ysk6h";
+    sha256 = "sha256-dg5bsegECH92JXa5uVY9Y7R9UhsWUpiOKMPLXmS2GZA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/types-decorator/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-decorator";
-  version = "5.1.6";
+  version = "5.1.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OZ+qczvJMstRtQ08odfpV7KuAvPE1xGcdpYxKCo4aKY=";
+    sha256 = "sha256-srf0f9AcoY+JyMAmSDnZLl95oezAes5Hu5AO/XzQL1k=";
   };
 
   # Modules doesn't have tests

pkgs/development/tools/altair-graphql-client/default.nix

@@ -3,24 +3,23 @@
 let
   pname = "altair";
   version = "4.1.0";
-  name = "${pname}-v${version}";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
     sha256 = "sha256-YuG7H+7FXYGbNNhM5vxps72dqltcj3bA325e7ZbW8aI=";
   };
 
-  appimageContents = appimageTools.extract { inherit name src; };
+  appimageContents = appimageTools.extract { inherit pname version src; };
 in
 appimageTools.wrapType2 {
-  inherit src name;
+  inherit src pname version;
 
   profile = ''
     export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
   '';
 
   extraInstallCommands = ''
-    mv $out/bin/${name} $out/bin/${pname}
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
 
     install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/${pname}.desktop \

pkgs/development/tools/database/pg_activity/default.nix

@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pg_activity";
-  version = "2.3.0";
+  version = "2.3.1";
   disabled = python3Packages.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "dalibo";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-O5ACTWsHoIty+QLTGaSuk985qduH7xBjviiH4yCrY2o=";
+    sha256 = "sha256-oStoZVFf0g1Dj2m+T+8caiKS0o1CnhtQNe/GbnlVUCM=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/development/tools/misc/binutils/default.nix

@@ -21,7 +21,7 @@ in
 , enableGold ? execFormatIsELF stdenv.targetPlatform
 , enableShared ? !stdenv.hostPlatform.isStatic
   # WARN: Enabling all targets increases output size to a multiple.
-, withAllTargets ? false, libbfd, libopcodes
+, withAllTargets ? false
 }:
 
 # WARN: configure silently disables ld.gold if it's unsupported, so we need to
@@ -183,11 +183,9 @@ stdenv.mkDerivation {
   # Fails
   doCheck = false;
 
-  postFixup = lib.optionalString (enableShared && withAllTargets) ''
+  # Remove on next bump. It's a vestige of past conditional. Stays here to avoid
-    rm "$out"/lib/lib{bfd,opcodes}-${version}.so
+  # mass rebuild.
-    ln -s '${lib.getLib libbfd}/lib/libbfd-${version}.so' "$out/lib/"
+  postFixup = "";
-    ln -s '${lib.getLib libopcodes}/lib/libopcodes-${version}.so' "$out/lib/"
-  '';
 
   # INFO: Otherwise it fails with:
   # `./sanity.sh: line 36: $out/bin/size: not found`

pkgs/games/dwarf-fortress/dfhack/default.nix

@@ -131,6 +131,9 @@ let
 
     patches = [ ./fix-stonesense.patch ];
 
+    # gcc 11 fix
+    NIX_CFLAGS_COMPILE = "-fpermissive";
+
     # As of
     # https://github.com/DFHack/dfhack/commit/56e43a0dde023c5a4595a22b29d800153b31e3c4,
     # dfhack gets its goodies from the directory above the Dwarf_Fortress

pkgs/os-specific/linux/sgx/ssl/default.nix

@@ -14,12 +14,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
-  version = "lin_${sgxVersion}_${opensslVersion}";
+  version = "${sgxVersion}_${opensslVersion}";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-sgx-ssl";
-    rev = version;
+    rev = "lin_${sgxVersion}_${opensslVersion}";
     hash = "sha256-ibPXs90ni2fkxJ09fNO6wWVpfCFdko6MjBFkEsyIih8=";
   };
 

pkgs/tools/admin/lxd/default.nix

@@ -11,13 +11,13 @@
 
 buildGo118Package rec {
   pname = "lxd";
-  version = "5.0.0";
+  version = "5.1";
 
   goPackagePath = "github.com/lxc/lxd";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz";
-    sha256 = "sha256-qZt+37UsgZWy3kmIhE0y1zvmQm9s/yhAglBReyOP3vk=";
+    sha256 = "sha256-MZ9Ok1BuIUTtqigLAYX7N8Q3TPfXRopeXIwbZ4GJJQo=";
   };
 
   postPatch = ''
@@ -25,6 +25,8 @@ buildGo118Package rec {
       --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
   '';
 
+  excludedPackages = [ "test" "lxd/db/generate" ];
+
   preBuild = ''
     # required for go-dqlite. See: https://github.com/lxc/lxd/pull/8939
     export CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
@@ -33,9 +35,6 @@ buildGo118Package rec {
   '';
 
   postInstall = ''
-    # test binaries, code generation
-    rm $out/bin/{deps,macaroon-identity,generate}
-
     wrapProgram $out/bin/lxd --prefix PATH : ${lib.makeBinPath (
       [ iptables ]
       ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu attr ]